Emacc HDBK Edition 3 1 Endorsed 20180925

EUROPEAN MILITARY AIRWORTHINESS
CERTIFICATION CRITERIA (EMACC)
EMACC Handbook
Edition Number 3.1
Edition Date 25 September 2018
Status Endorsed
MILITARY AIRWORTHINESS
AUTHORITIES FORUM
EUROPEAN MILITARY AIRWORTHINESS CERTIFICATION CRITERIA - EMACC
DOCUMENT CONTROL
DOCUMENT APPROVAL
The following table identifies the persons who have approved this document
Edition MAWA Forum /

Authorised by DATE
No: Advisory Group
Guy Bodet
Prepared by DPAG 06 Sep 2018
3.1 DPAG Chair
Endorsed for Henk Corporaal
MAWA Forum 25 Sep 2018
Release MAWA Forum Chair
Edition Number: 3.1 Edition Date: 25 Sep 2018 Status: endorsed Page 2/675
DOCUMENT CHANGE RECORD
Edition Edition Reason for change Sections or pages

Status
Number Date (detailed) affected
Working Draft issue for review
1.0 30/11/2010 All sections
Draft by TF4.
Working Formal Issue as part of
1.1 17/12/2010 -
Draft Contract 09-ARM-008
Change of title and Title page, Sections
Working
1.2 24/02/2011 Embodiment of TF4 5.2.4, 5.3.1, 9.4.6 &
Draft
comments 14.2.3
Draft issue for review
Working by TF4 as part of
1.3 28/11/2012 All Sections
Draft Contract
10.ARM.OP.23
Endorsement for
2.0 24/01/2013 Endorsed release by MAWA -
Forum
Formal Issue as part of Sections 4, 5, 6, 7, 8,
2.1 17/09/2015 Draft Contract 9, 10, 11, 12, 14, 16,
14.CPS.OP.040 18, 19, 20.
Endorsement for
2.1 12/10/2015 Endorsed release by MAWA -
Forum
Revise all Criteria to
3.0 1/02/2018 Endorsed align with All Sections
MIL-Hdbk 516C
Added heading to
8.5.12.10, corrected
reference to address
landing gear instead
fuel system in
8.5.12.16, correct
order of paragraphs in Section 8:
3.1 Draft section 15, correct 8.5.12.10, 8.5.12.16,
15.1.8 and 15.1.9 to Section 15, 16
reflect the content
approved by the
DPAG,
Removed duplicated
paragraph in section
16
STATUS
The Status of the document can take 3 values:

Working Draft: First version provided during the elaboration of the document by Task Force.
Draft: Draft version when issued by Task Force and proposed to MAWA Forum.
Endorsed: The document is endorsed by the participating Member States for release.
EDITION
Edition will have the following template: Edition X.Y

The value of X will change after a major modification of the document
The value of Y will change after a minor modification of the document
TABLE OF CONTENTS
SECTION 1 - SCOPE ......................................................................................................................................... 8
1.1 Purpose ............................................................................................................................................... 8

1.2 Applicability ......................................................................................................................................... 8
1.3 Cross References ............................................................................................................................. 10
1.4 Information Sources .......................................................................................................................... 10
SECTION 2 - APPLICABLE DOCUMENTS .................................................................................................... 11
2.1 General ............................................................................................................................................. 11

2.2 Defence Standards ........................................................................................................................... 11
2.3 STANAGs ......................................................................................................................................... 12
2.4 EASA Certification Specifications ..................................................................................................... 19
2.5 Department of Defence Specifications ............................................................................................. 19
2.6 Federal Aviation Administration Code of Federal Regulation (CFR) ................................................ 19
SECTION 3 - DEFINITIONS & ABBREVIATIONS .......................................................................................... 21
3.1 Definitions ......................................................................................................................................... 21

3.2 Abbreviations and Acronyms ............................................................................................................ 25
SECTION 4 - SYSTEMS ENGINEERING ........................................................................................................ 28
4.1 Design criteria. .................................................................................................................................. 29

4.2 Tools and databases......................................................................................................................... 35
4.3 Materials selection. ........................................................................................................................... 36
4.4 Manufacturing and quality. ................................................................................................................ 37
4.5 Operator's and maintenance manuals/technical orders. .................................................................. 41
4.6 Configuration identification. .............................................................................................................. 43
SECTION 5 - STRUCTURES ........................................................................................................................... 46
5.1 Loads ................................................................................................................................................ 47

5.2 Structural dynamics. ......................................................................................................................... 58
5.3 Strength ............................................................................................................................................ 64
5.4 Damage tolerance and durability (fatigue) ........................................................................................ 70
5.5 Mass properties ................................................................................................................................ 77
5.6 Flight release .................................................................................................................................... 80
SECTION 6 - FLIGHT TECHNOLOGY ............................................................................................................ 83
6.1 Flying qualities. ................................................................................................................................. 84

6.2 Vehicle control functions (VCF). ..................................................................................................... 118
6.3 Aerodynamics and performance. .................................................................................................... 181
SECTION 7 - PROPULSION AND PROPULSION INSTALLATIONS .......................................................... 188
7.1 Propulsion Risk Management. ........................................................................................................ 192

7.2 Gas turbine engine applications. .................................................................................................... 197
7.3 Alternate propulsion systems. ......................................................................................................... 243
SECTION 8 - AIRCRAFT SYSTEMS............................................................................................................. 265
8.1. HYDRAULIC AND PNEUMATIC SYSTEMS. ................................................................................ 265

8.2. ENVIRONMENTAL CONTROL SYSTEM (ECS). ......................................................................... 278
8.3. FUEL SYSTEM. ............................................................................................................................. 290
8.4. FIRE AND HAZARD PROTECTION.............................................................................................. 311
8.5. LANDING GEAR AND DECELERATION SYSTEMS. ................................................................... 335
8.6. AUXILIARY/EMERGENCY POWER SYSTEM(S) (APS/EPS)...................................................... 389
8.7. AIR-TO-AIR REFUELLING (AAR) SYSTEM. ................................................................................ 401
8.8 MECHANISMS ................................................................................................................................ 429
8.9 CARGO HOOK SYSTEMS. ............................................................................................................ 451
8.10 HOIST/WINCH SYSTEMS. .......................................................................................................... 454
8.11 ABSEIL BOLSTER / FAST ROPE INSERTION/EXTRACTION SYSTEM (FRIES). .................... 456
SECTION 9 - CREW SYSTEMS .................................................................................................................... 458
9.1. ESCAPE AND EGRESS SYSTEM. ............................................................................................... 458

9.2. CREW STATIONS AND AIRCRAFT INTERIORS. ....................................................................... 465
9.3. AIRCRAFT LIGHTING. .................................................................................................................. 472
9.4. HUMAN FACTORS........................................................................................................................ 476
9.5. LIFE SUPPORT SYSTEMS. .......................................................................................................... 481
9.6. TRANSPARENCY INTEGRATION. ............................................................................................... 486
9.7. CRASH SURVIVABILITY. ............................................................................................................. 492
9.8. LAVATORIES, GALLEYS, AND AREAS NOT CONTINUOUSLY OCCUPIED. ........................... 500
SECTION 10 - DIAGNOSTICS SYSTEMS .................................................................................................... 504
10.1. FAILURE MODES........................................................................................................................ 504

10.2. OPERATION. ............................................................................................................................... 506
SECTION 11 - AVIONICS .............................................................................................................................. 511
11.1. AVIONICS ARCHITECTURE. ..................................................................................................... 511

11.2. AVIONICS SUBSYSTEMS. ......................................................................................................... 518
11.3. AVIONICS INSTALLATION. ........................................................................................................ 523
SECTION 12 - ELECTRICAL SYSTEM ......................................................................................................... 526
12.1. ELECTRIC POWER GENERATION SYSTEM. ........................................................................... 526

12.2. ELECTRICAL WIRING SYSTEM, INCLUDING POWER DISTRIBUTION. ................................ 535
SECTION 13 - ELECTROMAGNETIC ENVIRONMENTAL EFFECTS (E3) ................................................. 548
13.1. COMPONENT/SUBSYSTEM E3 QUALIFICATION. ................................................................... 548

13.2. SYSTEM-LEVEL E3 QUALIFICATION........................................................................................ 550
SECTION 14 - SYSTEM SAFETY ................................................................................................................. 558
14.1. SYSTEM SAFETY PROGRAM. .................................................................................................. 558

14.2. SAFETY DESIGN REQUIREMENTS. ......................................................................................... 562
14.3. SOFTWARE SAFETY PROGRAM. ............................................................................................. 572
SECTION 15 - COMPUTER SYSTEMS AND SOFTWARE .......................................................................... 580
15.1. AIRCRAFT PROCESSING ARCHITECTURE ............................................................................ 580

15.2 Design and functional integration of SPA elements. .................................................................... 589
15.3 Processing hardware/electronics. ................................................................................................. 596
15.4 Software development processes................................................................................................. 596
15.5 Software architecture and design. ................................................................................................ 598

15.6 Software qualification and installation........................................................................................... 606
SECTION 16 - MAINTENANCE ..................................................................................................................... 611
16.1. MAINTENANCE MANUALS/CHECKLISTS................................................................................. 611

16.2. INSPECTION REQUIREMENTS. ................................................................................................ 616
16.3 INSTRUCTIONS FOR CONTINUED AIRWORTHINESS ............................................................ 619
SECTION 17 - ARMAMENT/STORES INTEGRATION ................................................................................ 620
17.1 Gun/rocket integration and interface............................................................................................. 621

17.2 Stores integration. ......................................................................................................................... 624
17.3 Laser integration and interface. .................................................................................................... 630
SECTION 18 - PASSENGER SAFETY ......................................................................................................... 635
18.1. SURVIVABILITY OF PASSENGERS. ......................................................................................... 635

18.2. FIRE RESISTANCE. .................................................................................................................... 645
18.3. PHYSIOLOGY REQUIREMENTS OF OCCUPANTS. ................................................................ 647
SECTION 19 - MATERIALS .......................................................................................................................... 649
19.1 Properties and processes. ............................................................................................................ 650

19.2 Corrosion ...................................................................................................................................... 654
19.3 Nondestructive inspection. ............................................................................................................ 657
19.4 Wear and erosion. ......................................................................................................................... 659
SECTION 20 - OTHER CRITERIA ................................................................................................................. 660
20.1 Air transportability and airdrop. ..................................................................................................... 660

20.2 Mission/test equipment operations and installation. ..................................................................... 672
20.3 Pan-platform criteria...................................................................................................................... 674
SECTION 1 - SCOPE
1.1 PURPOSE
This document establishes the airworthiness certification criteria to be used in the determination of
airworthiness of all manned and unmanned, fixed and rotary wing aircraft systems. It is a foundational
document to be used by the relevant military airworthiness authority or authorities or other entity to define
the aircraft’s airworthiness certification basis.
1.2 APPLICABILITY
The criteria within this document may be tailored and applied at any point throughout the life of an aircraft
system when an airworthiness determination is necessary, especially when there is a change to the
functional or product baseline.
Rotary wing aircraft and unmanned air system/remotely operated aircraft (UAS/ROA) features demand
unique safety-of-flight (SOF) system requirements. Therefore, unique criteria are included for these types
of systems to ensure that minimum levels of design for safe operation and maintenance are established.
The UAS/ROA operating system can be built into the vehicle or be part of the control station for remotely
operated aircraft. The UAS/ROA system comprises the control station, data links, flight control system,
communications systems/links, etc., as well as the aircraft. UAS/ROA vary greatly in size, weight, and
complexity. Because they are unmanned, SOF risks associated with loss of aircrew may not apply.
However, as with manned aircraft, SOF risk associated with personnel, damage to equipment, property,
and/or environment must be considered. As such, the airworthiness criteria may be tailored for this
unique application, including when a UAS/ROA is designed to be “expendable” or where the UAS/ROA
will conduct missions with “minimum life expectancy.” Consideration should be given to the environment
in which the UAS/ROA will be operated (controlled test range, national airspace, fleet usage, including
ship based applications), to the airframe life for which the aircraft is designed, and to the “expendability”
of the UAS/ROA in close proximity to the control system, personnel, property, or other equipment.
Similarly, aircraft intended for use in ship-borne operations have unique requirements in areas such as
structural integrity, propulsion system dynamic response and tolerance to steam ingestion, control
systems response to approach and landings in high turbulence conditions, electromagnetic environmental
effects, deck handling, support and servicing, and pilot field of view.
Commercial derivative aircraft (CDA) are initially approved for safety of flight by a National approving
Authority for Civil Aviation and may have an approved Type Certificate (or equivalent document). Any
non-Civil approved alteration to a CDA may render all civil certifications invalid. While alterations to CDA
are covered by rules unique to each Nation (both Civil and Military regulations), the operating Nations’
service always has the responsibility for the airworthiness certification approval under public aircraft rules.
Therefore, when planning any alterations to a civil certified CDA, the modifier should contact the
appropriate National Military Airworthiness Authority at the earliest opportunity.
In all instances, complete and accurate documentation of both applicability and system specific
measurable criteria values is critical to ensuring consistent, timely, and accurate airworthiness
assessments.
1.2.1 Tailoring to Create the Certification Basis

Not all of the airworthiness criteria within this document apply to every type of aircraft; platform-unique,
previously undefined criteria, may also need to be added to fully address safety aspects of unique
configurations. Therefore, it may be necessary to tailor the total set of criteria to identify a complete
(necessary and sufficient) subset of applicable airworthiness criteria, creating the system’s certification
basis. This certification basis should be fully documented and maintained under strict configuration
control.
To meet individual Nation needs, tailoring may be required to ensure the following aspects are respected:
• The approach to governance and the associated contracting model(s);

• The approach to development, production and ongoing upkeep of the product basis of
certification, including the acceptable approaches to means of compliance;
• Sufficient flexibility and adaptability within the criteria to meet the operational needs, scenarios
and role for the Product(s).
The primary objective in tailoring is to maintain the intent and context of the criteria. It is not an exercise
intended to relax and/or degrade the criteria. Indeed, for military operations, tailoring may result in a more
arduous certification basis. Where possible, it is recommended that a risk based approach to the
evaluation of the potential impacts (if any) of the tailoring exercise is conducted.
Guidance for tailoring the criteria within the EMACC is provided within the EMACC Guidebook. As an
overview tailoring rules are as follows:
a. Identify each criterion as either applicable or non-applicable, considering system or product
complexity, type, data, and intended use. Document the rationale for identifying any criteria as non-
applicable;
b. Applicable criteria may not be deleted in any manner. However, if a portion of otherwise
applicable criteria does not apply or is modified, identify the applicable and non-applicable portions and
any modification, and document the rationale. It is not recommended that the criteria be modified, but in
the event a criteria is modified, it is essential that the intent and context is maintained;
c. Supplement applicable criteria with specific measurable parameters, where appropriate (i.e., they
add value to the definition of airworthiness requirements);
d. Develop additional criteria, as appropriate, for any capabilities or systems (including the
whole/complete system) not fully addressed by the criteria contained in this document.
The TCB should be created using a 'Top-down' approach, ensuring that all appropriate sections of this
EMACC Handbook are captured. In some cases an aircraft or modification may appear to have a narrow
scope, and therefore may seem to only affect a small number of sections of this Handbook, however it is
important to capture the effect that changes to one system may have on the design, function or operating
environment for other systems.
Consideration should be given to defining quantitative airworthiness parameters that are compatible with
performance requirements.
Consideration should be given to operational requirements for safe operation when defining the
certification basis.
Some criteria within this EMACC Handbook are merged with other criteria to simplify the content of this
Handbook while maintaining similarity with MIL-HDBK-516. Where a section is merged with another, it is
important to review both sections to ensure that the merged criterion is adequately captured within the
TCB.
1.3 CROSS REFERENCES

The criteria included in this document are written with the intent that an experienced engineer, trained in
the specific technical area under consideration, should be able to interpret, tailor, apply, and evaluate a
particular system’s compliance with the criteria.
1.4 INFORMATION SOURCES

Each Airworthiness Certification Criteria is matched with corresponding Title 14, Code of Federal
Regulations reference (14CFR reference) and Joint Service Specification Guides (JSSG), where
available. In addition, cross-references are provided to the relevant sections within EASA Certification
Specifications (CS), Defence Standard 00-970 and NATO STANAG documents.
The FAA Code of Federal Regulations Part and EASA CS (i.e. 23, 25, 27, 29) referenced is dependent on
aircraft type and must be consistent with aircraft size and usage. The list shown is not exhaustive. The
user is cautioned to refer to the reference material only as a guide and not for the purposes of citing
requirements. The user is also advised to use additional FAA and EASA Advisory Circulars, Def-Stan 00-
970 leaflets or other acceptable means of compliance documents to assist in understanding the
implementation of the relevant regulatory requirements.
With respect to the cross-referencing of NATO STANAGs, Nations should examine their ratification status
for each STANAG prior to assuming that the document is applicable.
This document will be periodically updated through review and cross-checking of the referenced
documents. Users should always refer to the current version of the referenced documents. Where a
conflict exists between the reference documents and this document then this should be brought to the
attention of the EMACC sponsor.
SECTION 2 - APPLICABLE DOCUMENTS
2.1 GENERAL
The documents listed below are not necessarily all of the documents referenced herein but are those
necessary to understand the information provided by this handbook. Refer to the current version of these
documents, unless otherwise indicated.
2.2 DEFENCE STANDARDS

The following specifications, standards, and handbooks form a part of this document to the extent
specified herein:
• Defence Standard 00-56 - Safety Management Requirements for Defence Systems;

• Defence Standard 00-970 - Design and Airworthiness Requirements for Service Aircraft.
The table below details the issue status of the various sections of Defence Standard 00-970 as used in
the cross-references in this document.
Part No: 0: Procedures for Use, Content and Definitions Issue 6 dated: 22/01/10
Part No: 1: Fixed Wing
Section No: 1: "General" Issue 6 dated: 05/02/10
Section No: 2: "Flight" Issue 5 dated: 31/01/07
Section No: 3: "Structure" Issue 6 dated: 05/02/10
Section No: 4: "Design and Construction" Issue 6 dated: 05/02/10
Section No: 5: "Powerplant" Issue 5 dated: 31/01/07
Section No: 6: "Equipment" Issue 6 dated: 05/02/10
Section No: 7: "Operating Limitations and Information" Issue 5 dated: 31/01/07
Section No: 8: "Gas Turbine Auxiliary Power Unit Installation" Issue 5 dated: 31/01/07
Section No: 9: "Military Specific Systems" Issue 6 dated: 05/02/10
Part No: 7: Rotorcraft
Section No: 1: "General and Operational Requirements" Issue 3 dated: 29/01/10
Section No: 2: "Structural Strength and Design for Flight" Issue 3 dated: 29/01/10
Section No: 3: "Structural Strength and Design for Operation on Specified Issue 2 dated: 31/01/07
Surfaces"
Section No: 4: "Detail Design and Strength of Materials" Issue 2 dated: 31/01/07
Section No: 5: "Aero-Elasticity and Strength of Materials" Issue 2 dated: 31/01/07
Section No: 6: "Flight and Ground Handling Qualities" Issue 2 dated: 31/01/07
Section No: 7: "Installations" Issue 3 dated: 29/01/10
Section No: 8: "Maintenance" Issue 2 dated: 31/01/07
Section No: 9: "Flight Tests - Handling" Issue 2 AL1 dated:
04/12/07
Section No: 10: "Flight Tests - Installations and Structures" Issue 2 dated: 31/01/07
Part No: 9: UAV Systems Issue 5 dated: 20/04/09
Part No: 11: Engines Issue 1 dated: 27/01/06
Part No: 13: Military Common Fit Equipment Issue 2 dated: 15/01/10
Part No: 15: Items with no Specific Military Requirements Issue 4 dated: 27/01/06
2.3 STANAGS
Each Airworthiness Certification Criteria is matched with corresponding Title 14, Code of Federal
Regulations reference (14CFR reference) and Joint Service Specification Guides (JSSG). In addition,
cross-references are provided to the relevant sections within EASA Certification Specifications (CS),
Defence Standard 00-970 and NATO STANAG documents.
The user is cautioned to look at the reference material only as a guide and not for purposes of citing
requirements. The user is also advised to use additional Advisory Circulars, Def-Stan 00-970 leaflets or
other acceptable means of compliance documents to assist in understanding the implementation of the
relevant regulatory requirements.
With respect to the cross-referencing of NATO STANAGs, pMS should examine their ratification status for
each STANAG prior to assuming that the document is applicable. Users should always refer to the
current version of the referenced documents. For NATO STANAG, this is reflected in the NATO
Standardization Document Database (NSDD). The table below details the ratification status for pMS for
all reference STANAGs as of 3rd June 2010.
STANAG Edition STANAG Title Relevant Ratified by pMS Ratified with

Reference section of reservation/comment /
No. EMACC not implementing
Handbook
2445 Edition 3 Criteria for the 8.10 Belgium Luxemburg
clearance of Czech Republic Spain
Helicopter Germany
Underslung Load
Hungary
Equipment (HUSLE)
and Underslung Italy
Loads (USL’s). Netherlands
Poland
UK
3098 Edition 10, Aircraft jacking. 8.5.12 Belgium Spain
Amdt.3 France UK
Germany
Greece
Netherlands
Poland
3105 Edition 6, Pressure refuelling 8.3 Czech Republic Belgium
Amdt.1 connections and Germany France
defueling for aircraft. Greece Spain
Hungary
Italy
Netherlands
UK

Handbook
3109 Edition 5, Symbol marking of 16 Belgium Hungary
Amdt.6 Aircraft servicing Czech Republic
and Safety/Hazard France
points.
Germany
Greece
Italy
Netherlands
Spain
UK
3198 Edition 4, Functional 8.2.8, 18.3 France Belgium
Amdt.4 requirements of Germany
Aircraft oxygen Greece
equipment and
Italy
pressure suits.
Netherlands
Spain
UK
3217 Edition 6 Operations of 9.2 Belgium Germany
controls and Bulgaria Poland
switches at Aircrew Czech Republic Spain
stations.
Estonia
Romania
UK
3224 Edition 7 Aircraft interior and 9.2 Czech Republic Estonia
exterior lighting Germany Greece
Night Vision Goggle Netherlands UK
(NVG) and Non-
Spain
NVG compatible.
3230 Edition 7 Emergency 9.1 Czech Republic Belgium
markings on Germany Greece
Aircraft. Netherlands Hungary
Poland Italy
Slovenia Portugal
UK Spain
3278 Edition 8, Aircraft towing 8.5.12 Czech Republic Belgium
Amdt.1 attachments and Germany France
devices. Netherlands Greece
Poland
UK
3294 Edition 4, Aircraft fuel caps 8.3 Belgium Greece
Amdt.1 and fuel cap access 16.1 France
covers. Germany
Italy
Netherlands
Portugal
Spain
UK

Handbook
3368 Edition 3, Internal Aircraft 8.6 Belgium Greece
Amdt.1 engine starting France Italy
system. Germany Portugal
Netherlands Spain
UK
3372 Edition 6, Low Pressure air 8.1 Belgium Spain
Amdt.2 and associated Germany
electrical connectors Greece
for aircraft.
Netherlands
Portugal
UK
3400 Edition 3, Restraint of cargo in 20.1 Belgium
Amdt.5 Fixed Wing Aircraft. France
Greece
Italy
Netherlands
Portugal
Spain
UK
3436 Edition 4, Colours and 9.2 Belgium Portugal
Amdt.4 markings used to France Spain
denote operating Germany
ranges of Aircraft
Greece
instruments.
Italy
Netherlands
UK
3447 Edition 3. Aerial refuelling 8.7 Belgium
Amdt.4 equipment France
dimensional and Germany
functional
Greece
characteristics
Netherlands
Portugal
Spain
UK
3455 Edition 4, Basic symbols for 12.2 Belgium Hungary
Amdt.1 Aircraft electrical Czech Republic
circuits. France
Germany
Greece
Italy
Netherlands
Portugal
Spain
UK

Handbook
3456 Edition 6, Aircraft electrical 12.2 France Belgium
Amdt.1 power systems Greece Germany
characteristics. Netherlands Portugal
Spain
UK
3510 Edition 3, The provision of 8.1 Belgium Greece
Amdt.2 hydraulic power for France Spain
servicing Aircraft Germany UK
hydraulic systems.
Italy
Netherlands
Portugal
3516 Edition 5 Electromagnetic 13 Germany Czech Republic
Interference, test Netherlands Poland
methods for Aircraft Spain
electrical and
UK
electronic
equipment.
3548 Edition 3 Tie-down fitting on 20.1 Belgium Germany
air transported and France
air dropped Portugal
equipment and
Spain
cargo carried
internally by Fixed UK
Wing Aircraft.
3610 Edition 2, Characteristics of 9.5 France
Amdt.1 controlled 8.2.10 Greece
breathable air Italy
supplied to Aircraft.
Netherlands
Spain
UK
3614 Edition 5 Electromagnetic 13 Czech Republic Portugal
Environmental Germany
effects (E3) – Netherlands
Requirements for
Poland
Aircraft systems and
equipment. Spain
UK
3616 Edition 2 Responsibility for 9.8 Belgium
the design and France
provision of Germany
adaptors necessary
Greece
for the compatibility
of air cargo loading, Italy
securing, unloading Netherlands
and dropping Portugal
systems in Fixed UK
Wing Aircraft.

Handbook
3659 Edition 4 Electrical bonding 12.2.6, Belgium Czech Republic
requirements for 13.2.8 Germany Italy
metallic Aircraft Greece Poland
systems.
Spain
UK
3681 Edition 3, Criteria for Pressure 8.3 Belgium Czech Republic
Amdt.1 fuelling/defuelling of Germany France
Aircraft. Greece Poland
Italy
Netherlands
Portugal
Spain
UK
3682 Edition 5, Electrostatic safety 8.3 Belgium
Amdt.2 connection Germany
procedures for Greece
aviation fuel
Italy
handling and liquid
fuel Netherlands
loading/unloading Portugal
operations during Spain
ground transfer and UK
aircraft
fuelling/defueling.
3701 Edition 3, Aircraft interior 9.2 Germany Belgium
Amdt.2 colour schemes. Netherlands France
UK Greece
Spain
3705 Edition 3, Human Engineering 9.2 Belgium Greece
Amdt.2 design criteria for Germany Spain
controls and Netherlands
displays in Aircrew
UK
stations.
3828 Edition 3 Minimum 9.2, 9.3.4 Belgium Bulgaria
requirements for Czech Republic Germany
Aircrew protection Estonia Greece
against the Hazards
Hungary
of Laser target
designators. Italy
Luxemburg
Romania
Slovakia
UK
3847 Edition 1, Helicopter In-Flight 8.7 France
Amdt.5 Refuelling (HIFR) Germany
equipment. Netherlands
UK

Handbook
3896 Edition 5 Aircraft emergency 8.4 Belgium
rescue information Czech Republic
(Fire Protection). France
Greece
Italy
Spain
UK
3950 Edition 2 Helicopter design Belgium Czech Republic
Amdt.1 criteria for crew France Italy
crash protection and Germany Spain
anthropometric
Greece
accommodation.
Netherlands
UK
3967 Edition 2 Design and 8.3 Belgium Portugal
performance Italy Spain
requirements for Netherlands UK
aviation fuel filter
separator, coalescer
and separator
elements.
3971 Edition 6 Air to Air Refuelling 8.7 Belgium Bulgaria
– ATP-56(A). Czech Republic Estonia
Greece France
Italy Romania
Netherlands UK
Poland
Spain
7011 Edition 2 Automated fuel 8.3 Belgium France
system monitoring Germany Greece
and control Netherlands Italy
equipment.
Spain UK
7029 Edition1 Characteristics of 8.3 Belgium
Aircraft fuelling Germany
hoses and Greece
couplings.
Italy
Netherlands
Portugal
UK
7039 Edition 1 Test procedures to 13 Belgium
Amdt.2 ensure compatibility France
of equipment with Germany
Aircraft systems.
Portugal
UK

Handbook
7116 Edition 1 Verification 13 Czech Republic Bulgaria
methodology for the Germany Estonia
electromagnetic Netherlands Latvia
hardness of Aircraft.
Romania Lithuania
Spain Slovakia
UK
7139 Edition 3 Aircraft engine 9.2 Estonia Belgium
controls, switches, Germany Bulgaria
displays, indicators, Spain Czech Republic
gauges and
Italy
Arrangements.
Lithuania
Netherlands
Poland
Romania
Slovakia
UK
7140 Edition 1 Aircraft flight 9.2 Germany Belgium
instruments – Spain France
Layout and display. Greece
Netherlands
UK
7187 Edition 1 On Board Oxygen Netherlands Belgium
Generating System Bulgaria
(OBOGS) Czech Republic
performance
Estonia
standards.
Germany
Lithuania
Romania
Slovakia
Spain
UK
7068 Edition 2: Aircraft stores Czech Republic Belgium
Amdt.1 certification Germany
procedure. Greece
Luxemburg
Netherlands
Spain
UK
4671 Edition 1 Unmanned aerial Various
vehicle systems
airworthiness
requirements
(USAR).

Handbook
4101 Edition 2 Towing Attachments Belgium Germany
Netherlands
Portugal
Spain
UK
2.4 EASA CERTIFICATION SPECIFICATIONS

specified herein:
• EASA CS 23 - Normal, Utility, Aerobatic and Commuter Category Aircraft Amendment 4;

• EASA CS 25 - Large Aeroplanes Amendment 18;
• EASA CS 27 - Small Rotorcraft Amendment 3;
• EASA CS 29 - Large Rotorcraft Amendment 3;
• EASA CS E - Engines Amendment 4;
• EASA CS P - Propellers Amendment 1.
2.5 DEPARTMENT OF DEFENCE SPECIFICATIONS

specified herein:
• JSSG-2000B Air System, dated 21st September 2004;

• JSSG-2001A aircraft, dated 22nd October 2002;
• JSSG-2005 Avionic Subsystem, Main Body;
• JSSG-2006 Aircraft Structures, dated 30 th October 1998;
• JSSG-2007B Engines, Aircraft, Turbine, dated 6th December 2007;
• JSSG-2008 Vehicle Control and Management System (VCMS);
• JSSG-2009 aircraft Subsystems, dated 30th October 1998; and,
• JSSG-2010 Crew Systems.
It should be noted that some JSSG documents are not freely available. In some cases it has therefore
not been possible to perform an in-depth review of the sections of JSSG documents. Where a section of
a JSSG has not been reviewed, references within this Handbook state '(Unverified)'. Care should be
taken when referencing such unverified sections to ensure that the referenced section is appropriate.
2.6 FEDERAL AVIATION ADMINISTRATION CODE OF FEDERAL REGULATION (CFR)

specified herein:
• TITLE 14 Aeronautics and Space

• Part 23, Airworthiness Standards: Normal, Utility, Acrobatic and Commuter Category
Aeroplanes;
• Part 25, Airworthiness Standards: Transport Category: Airplanes;
• Part 27, Airworthiness Standards: Normal Category Rotorcraft;
• Part 29, Airworthiness Standards: Transport Category: Rotorcraft.
SECTION 3 - DEFINITIONS & ABBREVIATIONS
3.1 DEFINITIONS
All definitions, unless otherwise referenced, are to be considered within the context of this document.
Where appropriate, consistency has been maintained between this definitions list and the European
Military Airworthiness Document - EMAD 1 - Acronyms and Definitions Document; Edition 1.3; dated 10
Oct 2017, referred to in this list simply as 'EMAD 1'.
TERM DEFINITION/EXPLANATION
Aircraft Any vehicle that is capable of atmospheric flight including the installed
equipment (hardware and software).
(As defined in EMAD 1)
Airworthiness The ability of an aircraft, or other airborne equipment or system, to
operate in flight and on ground without significant hazard to aircrew,
ground crew, passengers (where relevant) or to other third parties.
Airworthiness Limitations A section of the Instructions for Continued Airworthiness that contains
each mandatory replacement time, structural inspection interval, and
related structural inspection task. This section may also be used to
define a threshold for the fatigue related inspections and the need to
control corrosion to Level 1 or better. The information contained in the
Airworthiness Limitations section may be changed to reflect service
and/or test experience or new analysis methods.
Authority Unless otherwise defined in specific EMARs, Authority means a National
Military Airworthiness Authority (NMAA) responsible for the airworthiness
of military aircraft hereto and "the Authorities" means all the military
Authorities responsible for airworthiness hereto.
Certification Recognition that a production, part or appliance, organisation or person
complies with the applicable airworthiness requirements followed by a
declaration of compliance.
Certifcation Review Item A document recording Deviations, Special Conditions, new Means of
Compliance or any other certification issue which requires clarification
and interpretation, or represents a major technical or administrative
issue.
Configuration Control A systematic process that ensures that changes to released
configuration documentation are properly identified, documented,
evaluated for impact, approved by an appropriate level of authority,
incorporated, and verified.
Configuration Management A management process for establishing and maintaining consistency of a
product’s performance, functional, and physical attributes with its
requirements, design and operational information throughout its life.
Continuing Airworthiness All of the processes ensuring that, at any time in its operating life, the
aircraft complies with the airworthiness requirements in force and is in a
condition for safe operation.
Continued (design) All tasks to be carried-out to verify that the conditions under which a
Airworthiness type-certificate or a supplemental type-certificate has been granted
continue to be fulfilled at any time during its period of validity.
Control Surface Float Angle The position a control surface will ‘Float’ to under aerodynamic load but
with zero hinge moment (i.e. stick free stability)
Credible Combination of All credible combination of failure(s), based on the outcome of a safety
Failures analysis process, which can include a single event/failure, which may
result in an unacceptable level of safety.
Critical Location A critical location in an aircraft structure is one that has been identified
through analysis, test, or service history as a being especially sensitive
to the presence of damage.
Damage Tolerance Damage tolerance is the attribute of a structure that permits it to retain its
required residual strength for a period of un-repaired usage after the
structure has sustained specific levels of fatigue, corrosion, accidental,
and/or discrete source damage. An item is judged to be damage tolerant
if it can sustain damage and the remaining structure can withstand
reasonable loads without structural failure or excessive structural
deformation until the damage is detected.
Design Service Life The design service life is the period of time (e.g., years, flight cycles,
hours, landings, etc.) established at design, during which the structure is
expected to maintain its structural integrity when flown to the design
loads/environment spectrum.
Delamination/Debonding Structural separation or cracking that occurs at or in the bond plane of a
structural element, within a structural assembly, caused by in service
accidental damage, environmental effects and/or cyclic loading.
Durability Durability is the ability of the aircraft structure to resist cracking,
corrosion, thermal degradation, delamination, wear, and the effects of
foreign object damage for a prescribed period of time.
Economic Life The economic life is the period during which it is more cost-effective to
maintain and repair an aircraft than to replace it. Economic life can be
applied on a component, aircraft, or force basis.
Electrical Wiring An electrical connection between two or more points including the
Interconnection System associated terminal devices (e.g., connectors, terminal blocks, splices)
(EWIS) and the necessary means for its installation and identification.
Factor of Safety Factor of Uncertainty as referred to within JSSG 2006 is the same as the
Factor of Safety, i.e. a figure that is applied to prescribed Limit Loads
used in calculating the Ultimate Load.
Failure The inability of an item to perform within previously specified limits.
Failure Condition The effect on the aircraft and its occupants, both direct and
consequential, caused or contributed to by one or more failures,
considering relevant adverse operational or environmental conditions.
Failure Effect What is the result of a functional failure?
Fatigue Damage (FD) The initiation of a crack or cracks due to cyclic loading and subsequent
propagation.
Fatigue Related Sampling Inspections on specific aircraft selected from those which have the
Inspection highest operating age/usage in order to identify the first evidence of
deterioration in their condition caused by fatigue damage.
Fault An identifiable condition in which one element of a redundant system has
failed (no longer available) without impact on the required function output
of the system (MSI). At the system level, a fault is not considered a
functional failure.
Functional Baseline The approved configuration documentation describing a system's or top
level configuration item's performance (functional, inter-operability, and
interface characteristics) and the verification required to demonstrate the
achievement of those specified characteristics.
Functional Failure Failure of an item to perform its intended function within specified limits.
Graceful Degradation In the presence of a failure(s), system characteristics are such that there
is a gradual, observable and manageable reduction in functionality. The
progression and sustainment of aircraft control, related to aircrew
workload and situational awareness, must be safely achieved.
Initial Quality Initial quality is a measure of the condition of the aircraft structure relative
to flaws, defects, or other discrepancies in the basic materials or
introduced during manufacture of the aircraft structure.
Install/Installation To connect or set in position and prepare for use or to load and configure
software into an information system.
Integrate/Integration The process of bringing together component sub-systems into one
system (an aggregation of subsystems cooperating so that the system is
able to deliver the overarching functionality) and ensuring that the
subsystems function together.
Item Any level of hardware assembly (i.e., system, sub-system, module,
accessory, component, unit, part, etc.).
Maintenance Any one or combination of overhaul, repair, inspection, replacement,
modification or defect/fault rectification of an aircraft or component, with
the exception of pre-flight inspection.
Maintenance Manual That part of the Military Air System document set which identifies the
particular maintenance procedures and periodicity necessary to maintain
the airworthiness of the Military Air System.
Mission-Critical Part As shown on figure 1, a mission-critical part is a structural component in
which damage or failure could result in the inability to meet critical
mission requirements or could result in a significant increase in
vulnerability.
Non-destructive Inspection Non-destructive inspection is an inspection process or technique that
(NDI) reveals conditions at or beneath the external surface of a part or material
without adversely affecting the material or part being inspected.
Other Structure Structure which is judged not to be a Structural Significant Item. "Other
Structure" is defined both externally and internally within zonal
boundaries.
Pilot Induced Oscillations Oscillations of aircraft movement caused or exacerbated by pilot input.
Potential Failure A defined identifiable condition that indicates that a degradation process
is taking place that will lead to a functional failure.
Protective Device Any device or system that has a function to avoid, eliminate or reduce
the consequences of an event or the failure of some other function.
Probability of detection A POD is a statistical measurement of the likelihood, with a specified
(POD) confidence level, of finding a flaw of a defined size using a specific
inspection technique.
Residual Strength The strength of a damaged structure.
Single load path Single load path is the distribution of applied loads through a single
member, the failure of which would result in the loss of the structural
capability to carry the applied loads.
Structural Integrity Structural integrity is the condition which exists when a structure is sound
and unimpaired in providing the desired level of structural safety,
performance, durability, and supportability.
Structural Operating Structural operating mechanisms are those operating, articulating, and
Mechanisms control mechanisms which transmit structural forces during actuation and
movement of structural surfaces and elements.
Structural Element Two or more structural details which together form an identified
manufacturer's assembly part.
Time Limited Dispatch Time Limited Dispatch (TLD) refers to the process of obtaining type
design approval of engines with degraded electronic engine control
systems.
TLD analysis focusses on redundancy when these systems are to be
dispatched with Faults present for
limited time intervals before maintenance actions are required
CS-E CSE 1030 and associated AMC refers.
Type Certification Basis An agreed set of airworthiness requirements a product must be
compliant with in order to obtain a Military Type Certificate.
Unmanned Aerial Vehicle A reusable aircraft which is designed to operate by being remotely
piloted (no human pilot or passengers on board) or automatically flying a
pre-programmed flight profile.
UAV System (May also be Comprises individual UAV System elements consisting of the unmanned
called a UAS or RPAS) aerial vehicle (UAV), the UAV control station and any other UAV System
elements necessary to enable flight, such as a command and control
data link, communication system and take-off and landing element.
There may be multiple UAV, UCS, or take-off and landing elements
within a UAV System.
3.2 ABBREVIATIONS AND ACRONYMS

14CFR Title 14, Code of Federal Regulations
AAR Air-to-Air Refuelling
AC Advisory circulars
ADS Aeronautical Design Standard
AFGS Air Force Guide Specification
AFI Air Force Instruction
AFPD Air Force Policy Directive
AFR Air Force Regulation
AMC Acceptable Means of Compliance
APC Aircraft pilot coupling
APS Auxiliary power system
APU Auxiliary power unit
AR Army Regulation
ARSAG Aerial Refueling Systems Advisory Group
BARO VNAV Barometric vertical navigation
BIT Built-in-test
CAD Cartridge actuated devices
CDR Critical design review
CFD Computational fluid dynamics
CFR Code of Federal Regulations
CofG Centre of gravity
CI Configuration item
CNS/AT Communication, navigation, surveillance/air traffic management
Comm’l Commercial
CSA Configuration status accounting
CSCI Computer software configuration item
CSI Critical safety item
DoD Department of Defense
DOD Domestic object damage
EASA European Aviation Safety Agency
ECP Engineering change proposal
ECS Environmental control system
E3 Electromagnetic environmental effects
EHMS Engine health monitoring systems
EMACC European Military Airworthiness Certification Criteria
EMAR European Miliatry Airworthiness Requirements
EMAR 21 Certification of military aircraft and related products, parts and appliances, and
design and production organisations
EMI Electromagnetic interference
EMP Electromagnetic pulse
EMS Environmental management system
EPS Emergency power system
FAA Federal Aviation Administration
FAR Federal Acquisition Regulation
FCA Functional configuration audit
FMECA Failure modes, effects, and criticality analysis
FMET Failure modes and effects testing
FOD Foreign object damage
FRACAS Failure report and corrective action system
FSCAP Flight safety critical aircraft part
g Acceleration or load factor in units of acceleration of gravity
HCF High cycle fatigue
HERF Hazards of electromagnetic radiation to fuel
HERO Hazards of electromagnetic radiation to ordnance
HERP Hazards of electromagnetic radiation on personnel
HUD Head-up display
ICD Interface control document
I/O Input/output
JACG Joint Aeronautical Commanders Group
JFS Jet fuel starter
JSSG Joint Service Specification Guide
LCF Low cycle fatigue
LEP Laser eye protection
MAWA Military Airworthiness Authorities
MSL Mean sea level
MWL Maximum wear limit
NATO North Atlantic Treaty Organization
NBC Nuclear, biological, and chemical
NDI Non-destructive inspection
NFPA National Fire Protection Association
NVIS Night vision imaging system
OEM Original Equipment Manufacturer
OFP Operational flight program
PAD Pyrotechnic actuated devices
PCA Physical configuration audit
PDR Preliminary design review
PFR Primary flight reference
PIO Pilot-induced oscillations
PLA Power lever angle
PLOC Probability loss of control
POD Probability of detection
PTO Power take-off
PVI Pilot vehicle interface
RAT Ram air turbine
RF Radio frequency
RNAV Radio navigation
RNP Required navigation performance
ROA Remotely operated aircraft
RVSM Reduced vertical separation minima
RTO Rejected take-off
SAE Society of Automotive Engineers
SAWE Society of Allied Weight Engineers
SDIMP Software development integrity master plan
SD Software development plan
SFAR Special Federal Aviation Regulation
SOF Safety-of-flight
SPM System program manager
SRS Software requirements specification
SSHA Subsystem hazard analysis
STANAG Standardization agreement
STLDD Software top-level design document
TBD To be determined
TEMP Test and evaluation master plan
T.O. Technical order
TSO Technical standard order
UAS Unmanned air system
UAV Unmanned aircraft
VCF Vehicle control function
VCMS Vehicle control and management system
VL/ML Limit speed
VNAV Vertical navigation
SECTION 4 - SYSTEMS ENGINEERING

This section details the minimum necessary criteria to establish, verify, and maintain an airworthy design.
The criteria go beyond pure airworthiness certification, covering best practice with respect to ensuring
initial design certification, continuing airworthiness and through life quality management.
Included within the scope of this section are:
• Definition of a robust set of design criteria addressing all aspects of safety, at the system,
sub-system and component levels, including coverage of system integration and software
aspects;
• The use and validation of design and performance verification analysis tools, prediction
methods, models, and/or simulations;
• The process for materials selection and validation of material properties;
• Manufacturing and quality processes and procedures;
• The production and management of the operator maintenance manual;
• Platform design & build standard and configuration control.
The criteria are expected to form part of an over-arching process that has been established, undertaken
and maintained. The process will be selected to suit the specific needs and constraints of the capability,
product and/or service, typically EMAR 21.
It is expected that the selected process can be integrated into the companion qualification process.
TYPICAL CERTIFICATION SOURCE DATA

1. Reliability, quality, and manufacturing program plans
2. Contractor policies and procedures
3. Durability and damage tolerance control plans
4. Work instructions
5. Process specifications
6. Production/assembly progress reports
7. Quality records
8. Defect/failure data
9. Failure modes, effects, and criticality analysis (FMECA) documentation
10. Tech data package
11. As-built list to include part numbers/serial numbers for all critical safety items/components
12. List of deviations/waivers and unincorporated design changes
13. List of approved class I engineering change proposals (ECPs)
14. Proposed DD Form 250, Material Inspection and Receiving Report
15. Configuration management plans/process description documents
16. Diminishing Manufacturing Sources Plan
17. Obsolete Parts Plan
18. Test reports
19. Test plans
20. FAA Airworthiness Directives and Advisory Circulars
21. Manufacturer-issued service bulletins
22. Civil aviation authority certification plan
23. Civil aviation authority certification basis
24. Civil aviation authority certification report
25. System Safety Analysis Report
CERTIFICATION CRITERIA
4.1 DESIGN CRITERIA.
4.1.1 Requirements allocation.

The design criteria, including requirements and ground rules, adequately address airworthiness and
safety for mission usage, full permissible flight envelope, duty cycle, interfaces, induced and natural
environment, inspection capability, maintenance philosophy, and design life.
Consideration should be given to:

a. Defining processes for requirements allocation and design criteria definition/tailoring;
b. High level mission and safety requirements;
c. Extending the design criteria to cover use and impact of (complex) GSE as part of the maintenance
philosophy.
d. Requirements to satisfy Extended Range Twin Operations (ETOPS) where appropriate.
Considerations for preparation of AMC:

1. Production of process documentation;
2. Ensuring traceability between design criteria, requirements, solutions and verification/validation
activities;
3. Consistency between design criteria and airworthiness and safety requirements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Appropriate design criteria Def-Stan 00-970 00-970 P1 S1
paragraphs of JSSG-2000, Reference: 00-970 P1 S2
2001, 2005, 2006, 2007, 2008, 00-970 P1 S4
2009, 2010, and others
00-970 P1 S6
00-970 P1 S7
00-970 P7 S9 L900/1 4
00-970 P7 S9 L906 7.14
STANAG 4671.21
Reference: 4671.45
4671.141
4671.143
4671.251
4671.301
4671.601
4671.611
4671.1309
4671.1529
FAA Doc: 14CFR references: 23.21-23.3, EASA CS CS 23.21
25.21-25.33 Reference: CS 23.45
CS 23.141
CS 23.143
Information Sources
CS 23.251
CS 23.301
CS 23.601
CS 23.611
CS 23.1309
CS 23.1529
CS 25.21
CS 25.101
CS 25.143
CS 25.251
CS 25.301
CS 25.601
CS 25.611
CS 25.1309
CS 25.1529
CS 27.21
CS 27.45
CS 27.141
CS 27.143
CS 27.251
CS 27.301
CS 27.601
CS 27.611
CS 27.1309
CS 27.1529
CS 29.21
CS 29.45
CS 29.141
CS 29.143
CS 29.251
CS 29.301
CS 29.601
CS 29.611
CS 29.1309
CS 29.1529
4.1.2 Safety critical hardware and software.

The airworthiness and safety design criteria shall address all components, system and subsystem levels,
including interfaces, latencies, software and information assurance.

a. Identification of critical safety items within the design solution;
b. Safety critical functions and functional chains.

1. Documentation records that safety critical software, hardware and associated design criteria and
critical characteristics resulting from this process are verified.
2. Documentation records that security requirements and mitigation techniques that affect flight safety are
incorporated into safety critical software and hardware.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Appropriate design criteria Def-Stan 00-970 00-970 P1 S1
paragraphs of JSSG-2000, Reference: 00-970 P1 2.16.19
2001, 2005, 2006, 2007, 2008, 00-970 P1 3.1.3
00-970 P1 3.10.33-3.10.37
00-970 P1 S4
00-970 P1 S6
00-970 P1 6.5.33-6.5.47
STANAG 4671.601
Reference: 4671.1301
4671.1309
4671.1351
FAA Doc: 14CFR references: 23.21, EASA CS CS 23.601
23.601-23.629, 25.601-25.631 Reference: CS 23.1301
CS 23.1309
CS 23.1351
CS 25.601
CS 25.1301
CS 25.1309
CS 25.1703
CS 25.1705
CS 27.601
CS 27.1301
CS 27.1309
CS 27.1351
CS 29.601
CS 29.1301
CS 29.1309
CS 29.1351
4.1.3 Commercial derivative aircraft.

For commercial derivative aircraft, the aircraft's certification basis shall address all design criteria
appropriate for the planned military usage.

a. Ensuring the intended military utilisation, including environment, and flight envelope of the aircraft are
shown to be wholly within the existing commercial certification basis;
b. Identifying any military "delta" conditions and environments over and above those covered by the
commercial certification;
c. Requirements to satisfy Extended Range Twin Operations (ETOPS) where appropriate.
1. Military aircraft airworthiness certification documentation details the difference between Civil and
Military usage, defines all appropriate certification requirements that apply to those differences, and
demonstrates compliance against those requirements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Appropriate design criteria Def-Stan 00-970 The Def Stan 00-970
paragraphs of JSSG-2000, Reference: requirement appropriate to the
2001, 2005, 2006, 2007, 2008, aircraft and role being
2009, 2010, and others considered.
STANAG The STANAG requirement
Reference: appropriate to the aircraft and
role being considered.
FAA Doc: 14CFR references: 23.21, EASA CS The EASA requirement
23.601-23.629, 25.601-25.631 Reference: appropriate to the aircraft and
role being considered.
4.1.4 Failure conditions.

Safety of flight related failure conditions shall be adequately addressed in the design criteria.

a. Hazard Identification and Analysis;
b. Definitions of operating envelopes, classes of airspace, restrictions and placard limitations;
c. Single points of failure.

1. Hazard analysis verifies that safety critical hazards have been identified;
2. Operating limitations are defined;
3. Analysis includes and specifies known parameters and assumptions where appropriate.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 1.1.13
Reference: 00-970 P1 1.1.14
00-970 P1 S4
00-970 P1 S6 Par. 1.1
STANAG 4671.572-4671.575
FAA Doc: EASA CS CS 23.571-23.575
Reference: CS 23.1309
CS 25.571
CS 25.1309
CS 27.571
CS 27.573
CS 27.1309
CS 29.571
CS 29.573
CS 29.1309
4.1.5 Operating environment.

The air system, including the aircraft and control station equipment, is qualified to operate in the intended
natural and induced environments.

The air system, including the aircraft and control station equipment, is qualified to operate in the intended
natural and induced environments such as:
a. Temperature;
b. Humidity;
c. Precipitation:
d. Icing:
e. Fungus:
f. Salt fog;
g. Particulate and liquid contamination;
h. Shock and vibration;
i. Explosive atmosphere.

1. Analysis, demonstration and test verify that equipment provides required function and performance.
2. Qualification testing which verifies that equipment is qualified for its intended environments.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 2.20
Reference: 00-970 P1 7.2.2
00-970 P1 7.2.3
00-970 P1 7.2.4
00-970 P1 7.2.6
00-970 P1 7.2.8
00-970 P1 7.2.9
00-970 P1 7.3.2
STANAG 4671.603
Reference: 4671.881
4671.1181
4671.U1703
4671.905
4671.1203
4671.613
FAA Doc: EASA CS CS 23.603
CS 23.613
CS 23.773
CS 23.1093
CS 23.1419
CS 25.603
CS 25.609
CS 25.613
Information Sources
CS 25.773
CS 25.1093
CS 25.1324
CS 25.1419
CS 25.1420
CS 25.1435
CS 25.1527
4.1.6 Flight and safety critical functions.

The design criteria identifies flight and safety critical functions, modes and states for the air system,
including the aircraft.
The aircraft detects and responds appropriately, predictably, safely and in a timely manner to:
• Flight or safety critical function degraded states or failures.

• Aircraft flight or safety critical function degraded states or failures, with or without operator
intervention.
• Loss of flight and safety critical command and control data link(s) between the operator and
aircraft.
1. Inspection of documentation verifies that design criteria and processes identify flight and safety critical
functions, modes and states; flight and safety critical function degraded states and failures; and loss of
flight and safety critical command and control data link(s).
2. Inspection of documentation verifies that design criteria and processes ensure air system responses
are appropriate for the intended airspace.
3. Analysis verifies that flight and safety critical functions, modes and states for the air system, including
the aircraft, are identified.
4. Analysis verifies that flight and safety critical function degraded states and failures are identified.
5. A combination of ground testing and simulation verifies that the air system (including aircraft) detects
and responds appropriately, predictably, safely and in a timely manner.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P9 S2 U1788
Reference: 00-970 P9 S2 U1613
00-970 P9 S2 UK901c
STANAG 4671.171
Reference: 4761.U1490
FAA Doc: EASA CS
Reference:
4.1.7 Flight Termination System.

Design criteria ensure that the flight termination function operates reliably and in a timely manner when
commanded.

a. Pilot accessibility to Termination System operation.
b. Likelihood of uncommanded operation of Termination System.

1. Design criteria are in place to ensure that the flight termination function operates reliably and
appropriately, and only when required.
2. Test and simulation data verifies that the flight termination function operates appropriately, only when
required, and results in the expected defined flight state(s).
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P9 S3 U1412a
Reference: 00-970 P9 S3 U1412b
STANAG 4671.U1742
Reference:
FAA Doc: EASA CS
Reference:
4.2 TOOLS AND DATABASES.
4.2.1 Tool and database processes.

All tools, methods, and databases used in the requirements definition/allocation, design, risk control and
assessments of safety shall be adequately validated and/or certified.

a. Ensuring all design and performance verification analysis tools, prediction methods, models, and/or
simulations are applied appropriately and exhibit accuracy commensurate with their application;
b. Use of competent and accredited design organisations.

1. Ensuring processes are in place to demonstrate that tools and databases are validated and under
configuration control.
2. Analysis, modelling and simulation tools and databases are of appropriate accuracy and fidelity for the
intended applications.
3. Validation basis of design analysis, models and simulations is substantiated and based on actual
hardware/software test data.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Appropriate design criteria Def-Stan 00-970
paragraphs of JSSG-2000, Reference:
2001, 2005, 2006, 2007, 2008, STANAG
Reference:
FAA Doc: Refer to technical point of EASA CS
contact for this discipline (listed Reference:
in section A.2)
4.3 MATERIALS SELECTION.
4.3.1 Selection of materials.

The material selection process shall use validated and consistent material properties data, including
design mechanical and physical properties such as material defects, and corrosion and environmental
protection requirements.

a. The impact of processing (joints, coating, ageing, etc) on material properties adequately assessed for
intended design.

1. Documentation confirms that materials are adequately covered by specifications as approved by the
procuring agency.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 3.2.3-3.2.4
Reference: 00-970 P1 3.2.8-3.2.20
00-970 P1 4.1.4
00-970 P1 4.1.8-4.1.12
00-970 P1 4.1.13-4.1.33
00-970 P1 6.2.54
00-970 P7 S2 L200 3-4
00-970 P13 1.4.5.9
STANAG 4671.307
Reference: 4671.603
4671.609
4671.613
4671.1123
FAA Doc: DOT/FAA/AR-MMPDS-01 EASA CS CS 23.307
CS 23.609
CS 23.613
CS 23.1123
CS 25.307
CS 25.603
CS 25.609
CS 25.613
CS 25.1123
CS 27.307
CS 27.603
CS 27.609
CS 27.613
CS 27.1123
CS 29.307
CS 29.603
Information Sources
CS 29.609
CS 29.613
CS 29.1123
4.4 MANUFACTURING AND QUALITY.
4.4.1 Key characteristics.

Key product characteristics (including critical characteristics) shall be identified.

a. Identifying all critical safety items (CSI);
b. Analysing CSI installations taking account of, for instance: weight bearing requirements, physical space
and access, and thermal and other environmental conditions;
c. Recording the key characteristics of those CSIs and Flight Critical Components along with any
associated tolerances;
d. Manufacturing process controls for specific key product characteristics.

1. Key product characteristic (including critical characteristics) and tolerance definitions are verified by
inspection and analysis of program design documentation at the applicable levels of the product
hierarchy;
2. Identifying approaches for verification of these characteristics during manufacture, operation and
maintenance.
Information Sources
Comm'l Doc: ASME Y14.5 "Dimensioning
and Tolerancing" AS 9100
DoD/MIL Doc: ASC/EN Manufacturing Def-Stan 00-970 00-970 P1 3.1.1
Development Guide, Section Reference: 00-970 P1 4.0.1
6.5, "Key Characteristics and 00-970 P1 4.1.4
Processes" AFI 63-501
00-970 P1 4.3.1
00-970 P1 S6
STANAG 4671.305
Reference: 4671.601
4671.603
4671.609
4671.1309
FAA Doc: 14CFR reference: 23.601- EASA CS CS 23.305
23.605, 25.601-25.603 Reference: CS 23.601
CS 23.603
CS 23.609
CS 23.1309
CS 25.302
CS 25.305
CS 25.601
CS 25.603
Information Sources
CS 25.609
CS 25.1309
CS 27.305
CS 27.309
CS 27.601
CS 27.602
CS 27.603
CS 27.609
CS 27.1309
CS 29.305
CS 29.309
CS 29.601
CS 29.602
CS 29.603
CS 29.609
CS 29.1309
4.4.2 Critical processes.

Key product characteristic requirements shall be ensured by appropriate manufacturing processes.

a. Listing critical processes and organisations approved to carry them out;
b. Ensuring that approved organisations have sufficient capacity and competency;
c. Utilising an existing organisational approval (e.g. EMAR 21, EASA Part 21).

1. Design and process control documentation which records critical process capabilities and control
plans.
Information Sources

Development Guide, Section Reference: 00-970 P1 4.6.1-4.6.14
6.6, "Variability Reduction," for 00-970 P1 4.7.1-4.7.9
additional information on Cpk,
Critical Processes, and STANAG 4671.601
Process Control Plans AFI 63- Reference: 4671.605
501 4671.613
4671.621
FAA Doc: 14CFR references: 23.601- EASA CS CS 23.601
23.605, 25.601-25.603 Reference: CS 23.605
CS 23.613
CS 23.621
CS 25.601
CS 25.605
Information Sources
CS 25.613
CS 25.621
CS 27.601
CS 27.602
CS 27.605
CS 27.613
CS 27.621
CS 29.601
CS 29.602
CS 29.605
CS 29.613
CS 29.621
4.4.3 Critical process controls.

All critical manufacturing process controls shall exist to assure key product characteristic requirements
are met.

a. The approval granted to the manufacturing facility should be in accordance with EASA CS 21A Sub-
part G, or equivalent, and this approval should cover process controls;
b. Non-destructive inspection (NDI) accept/reject criteria.

1. First article inspections or first article tests to ensure design conformance.
2. Manufacturing process control data, and/or periodic hardware quality audits.
Information Sources

Development Guide AFI 63- Reference: 00-970 P1 4.6
501 00-970 P1 4.7
Joint Aeronautical
STANAG 4671.605
Commander's Group's
Reference: 4671.613
Performance Based Product
4671.621
Definition Guide, Section 5.0,
"Performance Based
Approach," for additional
information on Product
Acceptance Criteria.
FAA Doc: 14 CFR references: 23.601- EASA CS CS 23.605
23.605, 25.601-25.603 Reference: CS 23.613
CS 23.621
CS 25.605
CS 25.613
CS 25.621
Information Sources
CS 27.602
CS 27.605
CS 27.613
CS 27.621
CS 29.602
CS 29.605
CS 29.613
CS 29.621
4.4.4 Quality system.

Production allowances and tolerances shall be within acceptable limits and assure conformance to
design.

a. Suitable processes to ensure that the 'as-built' configuration matches the 'as designed' configuration.
b. Manufacturer approval in accordance with EASA CS 21A Sub-part G, or equivalent, assuring
conformance to design through the application of suitable assurance processes.

1. Quality System policies, processes and procedures;
2. Internal and 3rd party audit against an appropriate standard (e.g. ISO 9001);
3. Continual recording of tolerances to ensure that variance does not creep over time.
Information Sources

Development Guide, Section 5, Reference: 00-970 P1 4.1.4
"Quality Systems,” and Section 00-970 P1 4.4.54
6.6 "Variability Reduction" AFI
00-970 P1 4.5.4
63-501 Joint Aeronautical
Commander's Group's 00-970 P1 4.4.62
"Engineering and 00-970 P1 4.18.4
Manufacturing Practices for 00-970 P7 L805 7
Defect Prevention"
FAR Part 46, "Quality STANAG 4671.603
Reference: 4671.605
Assurance"
4671.619
4671.623
4671.625
23.605, 25.601-25.603 Reference: CS 23.605
CS 23.619
CS 23.623
CS 23.625
CS 25.603
CS 25.605
Information Sources
CS 25.619
CS 25.623
CS 25.625
CS 27.602
CS 27.603
CS 27.605
CS 27.619
CS 27.623
CS 27.625
CS 29.602
CS 29.603
CS 29.605
CS 29.619
CS 29.623
CS 29.625
4.4.5 Merged with 4.4.3
4.5 OPERATOR'S AND MAINTENANCE MANUALS/TECHNICAL ORDERS.
4.5.1 Procedures and limitations.

Processes shall be in place to identify and document all procedures, limitations, restrictions, warnings,
cautions and notes.

a. Procedures for identifying and documenting all restrictions, warnings, and cautions.
b. Procedures for identifying which documents particular restrictions, warnings, and cautions should be
recorded in (i.e. aircrew or groundcrew manual etc).
c. Regularly review of procedures for applicability and to ensure complete coverage of the aircraft.
d. Provision for updating original information as necessary.

1. Aircraft Flight Manual (or other document where appropriate) should record procedures, limitations,
restrictions, warnings, cautions and notes.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-38784, Standard Def-Stan 00-970
Practice for Manuals, Reference:
Technical: General Style and STANAG
Format Requirements 4671.1501
4671.1541
4671.1581
4671.1589
4671 Appendix G
FAA Doc: 14CFR reference: 23.1581, EASA CS CS 23.1501
25.1581, 23.1541, 25.1541 Reference: CS 23.1529
Information Sources
CS 23.1541
CS 23.1581
CS 23.1589
CS 23 Appendix G
CS 25.1501
CS 25.1529
CS 25.1541
CS 25.1581
CS 25.1591
CS 25J.1521
CS 25 Appendix H
CS 27.1501
CS 27.1529
CS 27.1541
CS 27.1581
CS 27.1589
CS 27 Appendix A
CS 29.1501
CS 29.1529
CS 29.1541
CS 29.1581
CS 29.1589
CS 29 Appendix A
4.5.2 Line Deleted

4.5.3 Maintenance of safety.
Procedures shall be in place for establishing and managing integrity.

a. Structural, propulsion, and systems integrity through-life.
b. Ensuring that the correct mix of specialists is involved from across the maintenance and operational
aspects of the platform, and that representation is consistent.
c. The intended usage of the aircraft

1. Operator and maintenance manuals (i.e., change pages) provide processes for the recording of
traceability to change events.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-515, Weapon Def-Stan 00-970 00-970 Pt 1 3.2.2
System Integrity Guide MIL- Reference: 00-970 Pt 1 3.2.3
STD-1530, Aircraft Structural 00-970 Pt 1 3.2.21
Integrity Program
00-970 Pt 1 3.2.22
MIL-HDBK-87244,
00-970 Pt 1 3.2.29
Avionics/Electronics Integrity
JSSG-2001A: 3.3.5.1, 3.3.7.1 STANAG 4671.570
Information Sources
JSSG-2009: Appendix I Reference: 4671.572
4671.573
CS 23.573
CS 25.302
CS 25.571
CS 27.571
CS 27.573
CS 29.571
CS 29.573
4.6 CONFIGURATION IDENTIFICATION.
4.6.1 Functional baseline.

The functional baseline shall be properly documented, established, and brought under configuration
control.

a. Methods used to document the functional baseline - requirements capture.
b. Methods used to maintain, and amend as necessary, the functional baseline ensuring that an audit trail
is kept of changes.
c. Methods used to establish and maintain configuration control.
d. Methods used to assure configuration control - QA processes.

1. Inspection of documentation verifies that the functional baseline has been documented and approved.
2. Inspection of the approved engineering documentation and engineering release system verifies
adequate capture of the functional baseline.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-961E, Defense and Def-Stan 00-970
Program Unique Specifications Reference:
Format and Content, Appendix STANAG
A
MIL-HDBK-61A, Configuration Reference:
Management, sections 3, and
5.5.1 Configuration Baselines
for definitions and purposes of
configuration baselines
FAA Doc: 14CFR reference: 23.21, EASA CS
25.21, 23.601, 25.601, Reference:
23.1301, 25.1301
4.6.2 Allocated baseline.

The allocated baseline shall be properly documented, established, and brought under configuration
control.

a. Methods used to document the allocated baseline - requirements capture.
b. Methods used to maintain, and amend as necessary, the allocated baseline ensuring that an audit trail
is kept of changes.

1. Inspection of documentation verifies that the allocated baseline has been documented and approved.
adequate capture of the allocated baseline.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-961E, Defense and Def-Stan 00-970
Program Unique Specifications Reference:
Format and Content, Appendix STANAG
A
MIL-HDBK-61A, Configuration Reference:
Management, sections 3, and
5.5.1 Configuration Baselines
for definitions and purposes of
configuration baselines
FAA Doc: 14CFR reference: 23.21, EASA CS
25.21, 23.601, 25.601, Reference:
23.1301, 25.1301
4.6.3 Product baseline.

The product baseline shall be properly documented, established, and brought under configuration control.

a. Methods used to document the product baseline - requirements capture.
b. Methods used to maintain, and amend as necessary, the product baseline ensuring that an audit trail is
kept of changes.

1. Inspection of documentation verifies that the product baseline has been documented and approved.
adequate capture of the product baseline.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970
Reference:
STANAG
Reference:
Information Sources
FAA Doc: EASA CS
Reference:
4.6.4 Safety critical item configuration management.

A configuration management system shall have the capability to track the configuration of safety-critical
items.

a. Ensuring that all safety-critical items have been included.
b. Provision of QA checks for system effectiveness.
c. Provision of a clear and unambiguous interface showing when events are due.
d. Ability to demonstrate the history of items.

1. Inspection of CSA records and reports for CI/CSCIs verifies accuracy of the configuration status
accounting system and that the system is able to track and record changes to the configuration.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
SECTION 5 - STRUCTURES
This section covers criteria for the design, installation, arrangement and compatibility of the aircraft
structure.
The aircraft structure includes the fuselage, wing (fixed or rotating), empennage, structural elements of
landing gear, the control system, control surfaces, drive system, rotor systems, radome, antennae, engine
mounts, nacelles, pylons, thrust reversers (if not part of the engine), air inlets, AAR mechanisms,
structural operating mechanisms, structural provisions for equipment/payload/cargo/personnel, etc.

1. Design criteria
2. Loads analyses
3. Internal load and stress analyses
4. Materials, processes, corrosion prevention, non-destructive evaluation and repair data
5. Results from any design development tests conducted
6. Proof test results
7. Flutter, mechanical stability and aeroservoelastic analyses
8. Loads wind tunnel test data
9. Flutter wind tunnel test data
10. Ground vibration test results
11. Damage tolerance and durability analyses
12. Component/full-scale static and fatigue test results
13. Live fire test results and ballistic analysis
14. Bird strike test and analysis results
15. Arresting wire strike test and analysis results
16. User and maintainer manuals, or equivalent
17. Flight operating limits
18. Strength summary and operating restrictions
19. Damage tolerance and durability test results
20. Full-scale durability test results
21. Functional test results
22. Flight loads test results
23. Instrumentation and calibration test results
24. Control surface, tabs and damper test results
25. Thermoelastic test results
26. Limit-load rigidity test results
27. Flight flutter test results
28. Mass properties control and management plan (interface)
29. Weight and balance reports (interface)
30. Inertia report
31. Design trade studies and analyses
32. Fuel system test results
33. Results of actual weighing
34. Weight and balance handbook, or equivalent
35. Hazard analysis
36. Environmental criteria and test results
37. Vibration and acoustic test results
38. Aircraft tracking program

39. Landing gear and airframe drop test plans and results
40. Mechanical stability test plans and results
41. Whirl test plans and results
42. Tie-down test plans and results
43. Structural description report
44. Tipover and rollover stability analyses
45. External store interface and release data
46. Ground and/or air transport rigging procedures, interface loads, and associated
inspection requirements
47. Failure modes, effects, and criticality analysis (FMECA) documentation
48. Ground and rotor blade clearance dimensional data
49. Loss of lubrication testing
50. Heat generation/rejection analysis
51. Airframe and component fatigue analyses and test results
52. Hydraulic and Control System “RAP” test results
5.1 LOADS
5.1.1 Design flight and ground loads.

Verify that the loads used in the design of the aircraft include the maximum, minimum and most critical
combination of loads that can result from authorized ground and flight loading conditions for the aircraft.
These include loads during piloted or autonomous manoeuvres, loss of control manoeuvres, gusts,
pressurization, turbulence, take-off, landing, catapult (if applicable), shipboard and land based
arrestments (if applicable), ground operations, maintenance activity, systems failures from which recovery
is expected (to include rapid depressurization) and loads expected to be seen throughout the specific
lifetime of usage.
Typical system failures shall include:

Tyre failures, Propulsion system failures, Radome failures, Mechanical failures, Hydraulic failures, Flight
control system failures, Transparency failures, Hung stores and other failures.

a. The loads used should consider critical combinations of configurations, gross weights, centres of
gravity, thrust, power, altitudes, speeds, control surface deflections, control input variation and
environmental factors and are used in the design of the aircraft.
b. Loads should be established for both primary and secondary structural components by selection of
flight parameters likely to produce critical applied loads.
c. Symmetric and asymmetric flight operations considered should include symmetric and unsymmetrical
fuel and payload loadings and adverse trim conditions.
d. Loads should also consider normal and failure modes of operation, including rapid pressurization and
depressurization, and loads expected to be seen throughout the specific lifetime of usage.
Verification methods include analysis and inspection of documentation. Multiple variables and factors are
needed to account for development of maximum and minimum load factors. The following compliance
paragraphs are applicable to all standards.
a. Load factor selection considers the following items:
(1) Mission and flying techniques employed to execute the required mission.
(2) Weapon types and possible delivery methods.
(3) Anticipated weight and power plant growth.
(4) Maximum speed and time spent at maximum speed.
(5) Utilization of external stores and external fuel tanks.
(6) Training.
(7) Past experience with similar types of aircraft, mission, etc.
b. Load factors are defined which include appropriate ranges for symmetrical, asymmetrical, directional
manoeuvres, and atmospheric turbulence for each configuration. The defined load factors are attainable
by the aircraft, which should be demonstrated by analysis.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.2.9, A.4.2.9 Def-Stan 00-970 00-970 P1 3.1.2
Reference: 00-970 P1 3.1.4
00-970 P1 3.1.6
00-970 P1 3.1.16
00-970 P1 3.1.22
00-970 P1 3.2.15
00-970 P1 3.3.2
00-970 P1 3.4.2
00-970 P1 3.5.3
00-970 P1 3.5.5
00-970 P1 3.6.2
00-970 P1 4.1.3
STANAG 4671.143
Reference: 4671.301
4671.305
4671.321
4671.333
4671.345
4671.361
FAA Doc: 14CFR reference: EASA CS CS 23.143
Section 23.141, 23.301, Reference: CS 23.301
23.305, 23.321, 23.333, CS 23.305
23.343, 23.361 ; CS 23.321
Section 25.143, 25.301, CS 23.333
25.321, 25.303, 25.331, CS 23.343
25.341, 25.343, 25.349, CS 23.361
25.361 ; CS 25.143
Section 27.301, 27.305, CS 25.301
27.321, , 27.341, 27.473 ; CS 25.303
Section 29.301, 29.305, CS 25.321
Information Sources
29.321, 29.341, 29.473. CS 25.331
CS 25.341
CS 25.343
CS 25.349
CS 25.361
CS 27.143
CS 27.301
CS 27.305
CS 27.473
CS 29.143
CS 29.301
CS 29.305
CS 29.321
CS 29.473
5.1.2 Use of probabilistic vs deterministic loads.

Verify that the limit loads, to be used in the design of elements of the airframe subject to deterministic
design criteria, shall be the maximum and most critical combination of loads which can result from
authorized ground and flight use of the aircraft, including maintenance activity and system failures from
which recovery is expected.
This requirement defines the load capability that the airframe must possess to achieve adequate
structural safety and economic operation. Where such loads are the result of randomly occurring loads,
the minimum frequency of occurrence of these loads must be defined. This insures the inclusion of loads
which are of sufficient magnitude to size elements of the airframe and whose frequency of occurrence
warrants their inclusion. It is typically only necessary to include loads whose frequency of occurrence is
greater than or equal to 1 x 10-7 per flight.

a. Combined load-strength probability analysis to predict the risk of detrimental structural deformation and
structural failure in order to substantiate deterministic values.
b. Ensuring limit design loads are the maximum loads anticipated on the aircraft during its lifetime of
service.

a. Correlated ground and flight loads analyses to provide details of magnitudes and distribution of all
applied external loads.
b. Wind tunnel tests for development of aerodynamic loads.
c. Stiffness and ground vibration tests to update flexibility vs. rigid characteristics of analytical models.
d. Flight controls and aerodynamic flight tests inform aircraft simulation models.
e. Loads calibration tests to develop ground/flight load equations.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 3.1.12
00-970 P1 3.2.11
Information Sources
00-970 P1 3.2.12
00-970 P1 3.2.13
00-970 P1 3.2.14
STANAG 4671.23
Reference: 4671.301
4671.307
Section 23.23, 23.301, 23.305, Reference: CS 23.301
23.307 ; CS 23.305
Section 25.23, 25.301, 25.303, CS 23.307
25.305, 25.307 ; CS 25.23
Section 27.301, 27.305, 27.307 CS 25.301
; CS 25.303
Section 29.301, 29.305, CS 25.305
29.307 CS 25.307
CS 27.301
CS 27.305
CS 27.307
CS 29.301
CS 29.305
CS 29.307
5.1.3 Foreign Object Damage (FOD).

Loads used in the design of the airframe shall include loads due to FOD from birds, hail, runway, taxiway,
and ramp debris.

a. The aircraft should be designed to withstand the impact of FOD during any phase of taxi, take-off, flight
and landing without loss of the aircraft, incapacitation of the pilot or crew and without detectable or
undetectable damage to structural elements that result in reductions in structural strength below ultimate
load carrying capability throughout the flight envelope (including manoeuvres).
b. The aircraft, including main and tail rotor systems, should be designed to ensure the capability of
continued safe flight and landing following impact. Windshields should be designed to withstand impact
without penetration. Fairings that may be used to shield or enclose flight critical components (e.g., flight
control computers) should be designed with sufficient strength to ensure capability of continued safe flight
and landing.

Verification methods include analysis, test, and inspection of documentation. Probabilistic analyses are
performed to address FOD occurrences. Lab tests such as bird strike tests are performed to validate
analytical model(s) and/or structural capabilities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006 3.2.24 Def-Stan 00-970 00-970 P1 3.1.2
Reference: 00-970 P1 3.1.25
00-970 P1 4.9
Information Sources
00-970 P5 UK25.473b
00-970 P5 UK25.631a 00-970
P5 UK25.721b
00-970 P7 L206 2.11
STANAG 4671 U631
Reference:
FAA Doc: EASA CS
Reference:
5.1.4 Repeated loads.

All sources of repeated loads shall be considered and included in the development of the service loads
spectra and shall not detract from the airframe service life. The following operational and maintenance
conditions shall be included as sources of repeated loads: Manoeuvres, including load spectra covering,
Gusts, Suppression Systems, Vibration and Acoustics, Landings, Buffeting, Effects of Pressurisation,
Repeated Operations of Movable Structures, Stored Loads, Heat Flux and other loads including all
ground loads.

a. Manoeuvres - Designed such that final spectra accounts for variables such as manoeuvre capability,
tactics, and flight control laws reflecting projected average usage with the design utilization distribution
and also usage such that 90% of the fleet (95% for all fatigue damaging conditions for rotorcraft) is
expected to meet the service life.
b. Gusts - Designed such that gust load spectra developed by continuous turbulence analysis methods.
c. Suppression system which enhances ride qualities such as active oscillation control, gust alleviation,
flutter suppression and terrain following.
d. Vibration and aeroacoustics.
e. Landings - Designed with cumulative occurrences of sink speed per 1000 landings, by type of landing,
typical of projected service usage.
f. For rotorcraft - Designed with consideration of CF loads due to rotor start and stop cycle and torsional
loads due to rotor braking cycles.
g. Buffet due to non-linear flow caused by vortex shedding during high angle of attack manoeuvers,
rotary-wing blade stall and transonic shock instabilities - Designed such that analytical predictions of the
structural response are generated during flight operations in the buffet regime and adjusted as needed by
test data.
h. Ground operation loads - Designed with: (1) the number of hard and medium braking occurrences per
full stop landing along with associated braking effects; (2) number of pivoting occurrences; and (3)
definition of roughness characteristics of the airfield(s) to be utilized and the number of taxi operations on
each airfield.
i. Pressurization - Designed with the total number of cycles projected for one service life.
j. Impact, operational, and residual loads occurring from the normal operation of movable structures such
as control surfaces.
k. Store carriage and employment loads.
l. Heat flux.

Verification methods include analysis, test, and inspection of documentation, including:
1. Ground and flight loads analyses, correlated with test data.
2. For rotorcraft, flight load survey testing to gather loads data (e.g. maximum, minimum, average,
frequency etc) for each regime in the usage spectrum.
3. Wind tunnel tests for development of buffet loads.
4. Buffet flight tests to verify analytical buffet predictions.
5. Incorporation of loads associated with the vibration and aeroacoustic environments.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.2.14.3, Def-Stan 00-970 00-970 P1 3.2.11
A.4.2.14 Reference: 00-970 P1 3.2.13
00-970 P1 3.2.14
STANAG 4671.570
Reference: 4671.572
4671.573
23.573, 23.574 ; CS 23.573
Section 25.571 ; CS 23.574
Section 27.571 ; CS 25.571
Section 29.571. CS 27.571
CS 27.573
CS 29.571
CS 29.573
5.1.5 Propulsion loads.

The aircraft airframe shall be designed for the power or thrust of the installed propulsion system. This
includes the ground and flight conditions of intended use, including system failures, and the capabilities of
the propulsion system and crew. This should also take into account the flight and ground loads, including
gyroscopic loads and forces associated with the power or thrust of the installed propulsion system, over
all ranges of thrust and torque from zero to maximum.

Flight loading conditions should be based on aircraft response to pilot induced or autonomous
manoeuvres, loss of control manoeuvres, pressurization and turbulence. These conditions should
consider both required, and expected to be encountered, critical combinations of configurations, gross
weights, centres of gravity, thrust, power, altitudes, speeds, critical combinations of control system
(surfaces and rotor system) deflections, control input variation and environmental factors and are used in
the design of the aircraft. Considered flight loading conditions should include symmetric and asymmetric
flight operations and should be established for both primary and secondary structural components by
selection of flight parameters likely to produce critical applied loads. Symmetric and asymmetric flight
operations include symmetric and unsymmetrical fuel and payload loadings and adverse trim conditions.
Loads also consider normal and failure modes of operation, including rapid pressurization and
depressurization, and loads expected to be seen throughout the specific lifetime of usage.

Verification methods include analysis and inspection of documentation. Multiple variables and factors
account for development of maximum and minimum load factors. The following compliance paragraphs
are applicable to all standards.
a. Load factor selection considers the following items:

(1) Mission and flying techniques employed to execute the required mission.
(2) Weapon types and possible delivery methods.
(3) Anticipated weight and power plant growth.
(4) Maximum speed and time spent at maximum speed.
(5) Utilization of external stores and external fuel tanks.
(6) Training.
(7) Past experience with similar types of aircraft, mission, etc..
b. Load factors are defined which include appropriate ranges for symmetrical, asymmetrical, directional
manoeuvres, and atmospheric turbulence for each configuration. Analysis verifies that the load factors
are attainable by the aircraft.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.321
Reference: 4671.371
Section 23.371 Reference: CS 25.321
Section 25.321, 25.371 CS 25.371
5.1.6 Flight control and automatic control device loads.

In the generation of loads, consideration shall be given to flight control and automatic control devices,
including load alleviation and ride control devices. This shall include all Flight Control and ACS operating
modes (operative, inoperative, and transient) including but not limited to such identified system
degradations and failures as Tire failures, Propulsion system failures, Radome failures, Mechanical
failures, Hydraulic failures, Flight control system failures, Transparency failures, Hung stores and other
failures.

a. Stability augmentation.
b. Load and flutter alleviation.
c. Pilot cueing software and vibration control devices.

1. Verification methods include analyses, inspection of documentation, simulations, wind tunnel and
ground and flight test.
2. Analyses and tests to verify normal operation and emergency associated modes of operation.
3. Correlated ground and flight loads analyses.
4. Wind tunnel tests for development of aerodynamic loads.
5. Flight controls and aerodynamic flight tests to ensure that aircraft simulation models are up-to-date.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.2.18 and Def-Stan 00-970 00-970 P1 3.10.54
A.4.2.18 Reference: 00-970 P1 3.10.55
00-970 P1 3.10.56
Information Sources
00-970 P1 3.10.57
00-970 P1 3.10.58
00-970 P1 3.10.59
STANAG 4671.141
Reference: 4671.321
4671.331
4671.337
4671.395
4671.459
4671.683
4671.1329
23.337, 23.683, 23.1329 ; CS 23.331
Section 25.321, 25.331 25.337 CS 23.337
25.395, 25.683 25.1329 ; CS 23.395
Section 27.141, 27.321, 27.337 CS 23.683
27.395, 27.683 27.1329 ; CS 23.1329
Section 29.141, 29.321, 29.337 CS 25.321
29.395, 29.683 29.1329. CS 25.331
CS 25.337
CS 25.395
CS 25.683
CS 25.1329
CS 27.141
CS 27.321
CS 27.337
CS 27.395
CS 27.1329
CS 29.141
CS 29.321
CS 29.337
CS 29.395
CS 29.683
CS 29.1329
5.1.7 Analysis and testing of realistic flight loading conditions.

Flight loading conditions shall reflect all flight operations including but not limited to symmetric,
asymmetric, directional and evasive manoeuvres, turbulence, AAR and delivery, speed and lift control,
braking wheels in air, extension and retraction of landing gear, pressurisation, aero elastic deformation
effects and dynamic response during flight operations.
Symmetric and asymmetric flight operations include symmetric and asymmetric fuel and payload loadings
as well as adverse trim conditions.

a. Both primary and secondary structural components.
b. Symmetric and asymmetric fuel and payload loadings (including external stores) and adverse trim
conditions.
c. Symmetric manoeuvres including steady pitching, abrupt pitching, flaps down pull-outs, aerial delivery
pull-outs, and emergency stores release.
d. Directional manoeuvres which include sideslips, rudder kicks, rudder reversals, asymmetrical thrust
with zero sideslip, engine failure, and engine out operation.
g. Vertical and lateral gusts.
h. Pressurization.
m. Aeroelastic deformations.

1. Correlated flight loads analyses of magnitudes and distribution of all applied external loads.
2. Service and maximum loads expected to be encountered are established for operation under all flight
conditions.
3. Wind tunnel tests for development of aerodynamic loads.
4. Stiffness and ground vibration tests to update flexibility vs. rigid characteristics of loads analytical
model.
5. Flight controls and aerodynamic flight tests to update aircraft simulation models.
6. Loads calibration tests to develop flight load equations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.4.1, A.3.4.1.1- Def-Stan 00-970 00-970 P1 3.1.2
15 Reference: 00-970 P1 3.1.16
JSSG-2006: Power Spectrum 00-970 P1 3.1.29
Equation on pg 264 under 00-970 P1 4.20.18
A.3.4.1.6 (for standard 00-970 P1 4.20.19
development) STANAG 4671.321
JSSG-2006: Table XI Reference: 4671.331
“Turbulence Field Parameters,”
pg 441 (for standard
development)
Section 23.321, 23.331 ; Reference: CS 23.331
Section 25.301, 25.321, 25.331 CS 25.301
; CS 25.321
Section 27.321 ; CS 25.331
Section 29.321. CS 27.321
CS 29.321
5.1.8 Analysis and testing of realistic ground loading conditions.

Ultimate loads used in airframe design shall be obtained through the multiplication of limit loads by
prescribed factors of safety. The factor of safety is not typically lower than 1.5. If a factor of safety is less
than 1.5, justification should be agreed with the Certifying Authority. For crash case conditions, specific
ultimate load factors are to be applied allowing a structural design to give each occupant every
reasonable chance of escaping serious injury. The aircraft structure shall be designed so that the ultimate
loads do not generate stresses higher than relevant allowable stress values (i.e. rupture).

a. Maximum landing touchdown vertical sink speeds
b. Crosswinds at take-off and landing
c. Landing touchdown roll, yaw, pitch attitude, and sink speed combinations
d. Bumps and dips during taxiing
e. Forces applied during jacking of the aircraft.
f. Ground loading conditions expected to be encountered in critical combinations of configurations.
g. Symmetric and asymmetric fuel and payload loadings and adverse trim conditions.
h. Ground operations consisting of taxing, turning, pivoting, braking, landing (including arrestment) and
take-off.
i. Ground handling conditions consisting of towing, jacking, and hoisting.
j. Dynamic response and shimmy during ground operations as well as for rough runway conditions.
k. Ground winds as a result of weather and jet blast.

1. Tests are utilized to correlate analytical model and substantiate the design loads. Such as:
a. Correlated ground loads analyses including dynamic response analyses.
b. Dynamic stability/taxi analyses.
c. Ground vibration tests and landing gear shimmy lab tests.
d. Loads calibration tests.
2. Demonstrate the safe operation of the aircraft to the maximum attainable operating limits consistent
with the structural design and to verify that loads used in the structural analysis and static tests are not
exceeded at the structural design limits of the airspeed and load factor envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.2.10, Def-Stan 00-970 00-970 P1 3.1.4
3.2.10.1-6, A.4.2.10, Figure 4 Reference: 00-970 P1 3.4.6
&5 00-970 P1 3.1.7
JSSG-2006: Figure 4, pg 459,
“Discrete bumps and dips for
STANAG 4671.301
slow speeds up to 50 knots-
Reference: 4671.305
single and double excitations”.
4671.307
(for standard development)
JSSG-2006: Figure 5, pg 460,
“Discrete bumps and dips for
high speeds above 50 knots-
single and double excitations”.
(for standard development)
23.305, 23.561 CS 23.561
Section 25.301, 25.303, CS 25.301
25.362, 25.561 CS 25.303
Section 27.301, 27.303, CS 25.362
27.305, 27.561 CS 25.561
Section 29.301, 29.303, CS 27.301
29.305, 29.561 CS 27.305
Information Sources
CS 27.561
CS 29.301
CS 29.305
CS 29.561
5.1.9 Crash loads.

The airframe, although it may be damaged in emergency landing conditions on land or water, shall be
designed to protect personnel during crash landings. The intent of this requirement is to establish crash
load factors for structural requirements of airframe installations and backup structures required to protect
personnel during crash landings.
The airframe shall also not inhibit personnel egress.

a. Seat installations;
b. Fuel tanks and installations;
c. Fixed and removable equipment;
d. Cargo;
e. Litters;
f. Bunks.
The airframe should provide a protective shell surrounding the personnel, and should minimise the loads
experienced by personnel so that (hopefully) they will be less than human tolerance limits. Mass items
are to be supported in such a manner so as to prevent lethal or injurious blows to personnel.

1. Correlated ground loads analyses which detail of magnitudes and distribution of all critical design loads
are established.
2. Ground loads test demonstrations to correlate analytical models and substantiate the design loads.
Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-36 (Army use) Def-Stan 00-970 00-970 P1 3.1.13
JSSG-2006: A.3.4.2.11, Table Reference: 00-970 P1 4.22.2
XIV, “Seat Crash Load 00-970 P1 4.22.6
Factors,” pg 443 (for standard 00-970 P1 4.22.8
development) 32 00-970 P1 4.22.11
JSSG-2006 A.3.4.2, 00-970 P1 4.22.23
A.3.4.2.1, A.3.4.2.2, A.3.4.2.3, 00-970 P1 4.22.26
A.3.4.2.4, A.3.4.2.5, A.3.4.2.6, 00-970 P1 4.22.27
A.3.4.2.7, A.3.4.2.8, A.3.4.2.9, 00-970 P1 4.22.28
A.3.4.2.10, A.3.4.2.11, 00-970 P1 4.22.51
A.3.4.2.12, A.3.4.2.13 00-970 P1 4.22 53
STANAG 4671.301
Reference:
Information Sources
23.497, 23.499, 23.505, 23.511 CS 25.561
; CS 25.562
Section 23.511, 25.471, CS 27.561
25.473, 25.489, 25.511, 25.519 CS 27.562
; CS 29.561
Section 27.471, 27.473, CS 29.562
27.497, 27.501, 27.549 ;
5.2 STRUCTURAL DYNAMICS.
5.2.1 Aeroelastic design - general.

Verify that the aircraft, in all configurations including store carriage and system failures, is free from flutter,
whirl flutter, divergence, and other related aeroelastic or aeroservoelastic instabilities, including transonic
aeroelastic instabilities at any point within the flight envelope enlarged at all points by an airspeed margin
of safety.
Also, verify that all aerodynamic surfaces and components of the aircraft are free from aeroelastic
divergence and that the inlet, transparency, and other aerodynamically loaded panels are designed to
prevent flutter and limited amplitude oscillations when exposed to high transonic or supersonic flow.
Adequate tolerances shall be established for quantities which affect flutter; including speed, damping,
mass balance and control system stiffness.
The aeroservoelastic model shall be validated by tests or other approved methods to be agreed with the
authority.

a. Ensuring that the margin of safety is maintained in equivalent airspeed (Ve) at all points on the VL/ML
envelope of the aircraft, both at constant Mach number and separately, at constant altitude.

1. Flutter analyses of the complete aircraft.
2. Analyses involving variable fuel conditions for external tanks.
3. Divergence and buzz analyses as well as panel flutter analyses.
4. Wind tunnel and unsteady pressure model tests.
5. Laboratory tests such as component ground vibration and stiffness tests.
6. Complete aircraft ground vibration modal tests.
7. Aeroservoelastic ground tests.
8. Flight flutter tests and flight aeroservoelastic stability tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.1.2, A.3.7.1, Def-Stan 00-970 00-970 P1 3.10.98
A.3.7.1.2, A.3.7.1.4, A.3.7.1.5, Reference: 00-970 P1 3.10.99
A.3.7.1.6, A.3.7.1.7, A.3.7.2, 00-970 P1 4.8.4
A.3.7.3, A.3.3.9, A.4.3.9, A.4.7
00-970 P1 4.8.10
STANAG 4671.629
Information Sources
23.677, 23.687; CS 23.677
Section25.409, 25.629, 25.677; CS 23.687
Section 27.687; CS 25.409
Section 29.687. CS 25.629
CS 25.677
CS 27.687
CS 29.687
5.2.2 Aeroelastic design - aeroservoelasticity.

aircraft components which are exposed to the airstream shall be designed to prevent any aeroelastic or
aeroservoelastic instability.
All control surfaces and tabs shall be designed for the most severe combination of airspeed and tab
deflection likely to be obtained within the flight envelope for any usable loading condition.
Tab controls must be irreversible unless the tab is properly balanced and has no unsafe flutter
characteristics.
All control surfaces and tabs shall contain sufficient static and dynamic mass balance, or sufficient
bending, torsional, and rotational rigidity; or a combination of these means to prevent flutter; or limited-
amplitude instabilities of all critical modes under all flight conditions for normal and failure operating
conditions of the actuating systems.
In addition, interactions of aircraft systems, such as the control systems coupling with the airframe, shall
be controlled to prevent the occurrence of any aeroservoelastic instability.

a. Aeroservoelastic stability analyses correlated with aeroservoelastic ground tests that are conducted for
the critical flight conditions, taking into account the flight control systems gain scheduling and control
surface effectiveness.
b. Flight aeroservoelastic stability tests of the aircraft and its flight augmentation system.
Information Sources
Comm'l Doc:
A.3.7.1.3, A.3.7.1.8, A.3.7.2, Reference: 00-970 P1 3.9.43
A.3.7.3, A.3.7.4, A.3.7.5, A.4.7, 00-970 P1 3.9.44
A.4.7.5
00-970 P1 3.10.98
00-970 P1 3.10.99
STANAG 4671.409
Reference: 4671.677
4671.687
Information Sources
23.687; CS 23.687
Section 25.409, 25.677; CS 25.409
Section 27.687; CS 25.651
Section 29.687. CS 25.677
CS 27.629
CS 27.687
CS 29.629
CS 29.687
5.2.3 Aeroelastic design - control surfaces and other components.
The control surfaces and tabs shall contain sufficient static and dynamic mass balance, or sufficient
bending, torsional, and rotational rigidity; or a combination of these means to prevent flutter; or limited-
amplitude instabilities of all critical modes under all flight conditions for normal and failure operating
conditions of the actuating systems.
All control surfaces and parts thereof shall be free from single-degree-of-freedom flutter, such as buzz.
All other aircraft components exposed to the airstream, such as spoilers, dive brakes, scoops, landing
gear doors, weapon bay doors, ventral fins, movable inlet ramps, movable fairings, and blade antennae
shall be free from aeroelastic instability.

a. Exposure to any natural or manmade environment throughout the service life of the airframe.
b. Ensuring control surface free play limits are not exceeded during the service life of the airframe.
c. Establishment of maximum allowable inertia properties.
d. Establishment of mass balance design requirements.

1. Flutter analyses including non-linear analyses of the aircraft's control surfaces and tabs.
2. Parametric variation flutter analyses.
3. Mass measurements of all control surfaces and tabs.
4. Rigidity, stiffness and wear tests which are conducted for both normal and design failure conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006 3.7 Def-Stan 00-970 00-970 P1 3.5.10
Reference: 00-970 P1 L45 3.5
00-970 P1 4.8
00-970 P7 L500
STANAG 4671.629
Reference:
CS 27.629
CS 29.629
5.2.4 Aeroelastic design - fail safe.

Following a structural failure, as well as for aircraft augmentation system failures, the aircraft shall be free
from flutter, limited amplitude oscillations, divergence, and other related aeroelastic or aeroservoelastic
instabilities, including limit cycle oscillations.

a. The designed margin of safety is maintained in equivalent airspeed (Ve) at all points on the VL/ML
envelope of the aircraft, both at constant Mach number and separately, at constant altitude.
b. The total (aerodynamic plus structural) damping coefficient, for any critical flutter mode or for any
significant dynamic response mode for all altitudes and flight speeds from minimum cruising speeds up to
VL/ML.

a. Flutter analyses of the complete aircraft including external stores.
b. Divergence and buzz analyses as well as panel flutter analyses.
c. Wind tunnel and unsteady pressure model tests.
d. Laboratory tests such as component ground vibration and stiffness tests, mass measurements of
control surfaces/tabs, balance weight attachment verification tests, damper qualification tests,
thermoelastic tests as well as control surface, tab, and actuator rigidity, free play, and wear tests.
e. Complete aircraft ground vibration modal tests as well as aeroservoelastic ground tests.
f. Flight flutter tests and flight aeroservoelastic stability tests of the aircraft which substantiate the aircraft
is free from aeroelastic instabilities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006 3.7 Def-Stan 00-970 00-970 P1 3.5.10
Reference: 00-970 P1 L45 3.5
00-970 P1 4.8
00-970 P7 L500
STANAG 4671.629
Reference:
CS 27.629
CS 29.629
5.2.5 Environment design - sonic fatigue.

The airframe structure (including cavities), equipment, and equipment provisions shall withstand the
aeroacoustic loads and the vibrations induced by aeroacoustic loads (including acoustic fatigue) for the
defined service life and usage of the aircraft without cracking or functional impairment.
Verify that the airframe structure (including cavities), equipment, and equipment provisions withstand the
aeroacoustic loads and vibrations induced by the aeroacoustic environment for the aircraft specified
service life and usage without cracking or functional impairment.

a. All aeroacoustic loads sources associated with the aircraft and its usage.
b. The application of an uncertainty factor for predicted aeroacoustic sound pressure levels.

Verification methods include analyses and tests. The following compliance instruments are applicable in
addressing the standards:
a. Predictions of the near field aeroacoustic loads and fatigue life encompassing the aircraft service life
and usage and the identified aeroacoustic load sources.
b. Wind tunnel, jet models which define acoustic levels.
c. Component acoustic fatigue tests based on fatigue life predictions.
d. Ground and flight aeroacoustic measurements from full scale test aircraft including internal noise
measurements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.5.1, A.4.5.1 Def-Stan 00-970
Reference:
STANAG 4671.251
Reference: 4671.570
Section 23.25; Reference: CS 25.251
Section 25.251; CS 25.771
Section 25.251, 27.771; CS 27.251
Section 29.251, 29.771 CS 27.771
CS 29.251
CS 29.771

5.2.7 Environment design - personnel exposure to aircraft noise.
Requirements associated with Sound Pressure levels and personnel exposure are detailed at section
9.4.6.
5.2.8 Environment design - vibration.
The airframe shall be designed such that the structure and components withstand the vibrations resulting
from all vibration sources for the defined service life and usage of the aircraft.
Typical sources of vibration to which the airframe may be exposed are listed below.
a. Forces and moments transmitted to the aircraft structure mechanically or aerodynamically from the
propulsion systems, secondary power sources, propellers, jet effluxes and aerodynamic wakes,
downwashes and vortices (including those from protuberances, speed brakes, wings, flaps, etc.) and
cavity resonances;
b. Forces from gun recoil or gun blast;
c. Buffeting forces;
d. Unbalances, both residual and inherent, of rotating components such as propellers, and rotating
components of engines;
e. Forces from store and cargo carriage and ejection;
f. Forces due to operation from airfields and ships;
g. Structural response due to gusts.
There shall be no vibration or buffeting severe enough to result in structural damage, fatigue cracking or
excessive vibration of the airframe structure or components, under any appropriate speed and power
conditions within the flight envelope.
Excessive vibrations are those structural displacements which result in components of the aircraft
systems not being fully functional.

Verification methods include analyses and tests. The following compliance instruments are applicable in
addressing the standards:
a. Updated predictions of the vibration environment.
b. Component tests verifying analytical fatigue life predictions and which demonstrate that components
meet service usage requirements in the vibration environment.
c. Ground and flight vibration tests which identify the response characteristics of the aircraft to forced
vibrations and impulses.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.5.1 - A3.5.2, Def-Stan 00-970 00-970 P1 4.8.2
A.4.6.2 Reference: 00-970 P1 4.8.3
00-970 P1 4.8.5
00-970 P1 4.8.10
00-970 P1 4.8.11
00-970 P1 4.8.12
STANAG 4671.251
Reference: 4671.570
4671.572
4671.573
4671.629
4671.963
23.963; CS 23.963
Section 25.251, 25.305, CS 25.251
25.683, 25.963; CS 25.305
Section 27.251, 27.659; CS 25.683
Section 29.251, 29.659. CS 25.875
CS 25.963
CS 27.251
CS 27.659
CS 29.251
CS 29.659
5.2.9 Environment design - vents and louvers.

Verify that equipment and structure behind and near vents and louvers are designed for the effects of flow
through the vents and louvers during conditions of normal and reverse flows.
Hot gases from auxiliary power units as well as from propulsion systems may be drawn into the airframe
through vents and louvers under some conditions thus damaging equipment and structure. If necessary
to maintain their required usefulness, equipment and structure behind and near vents and louvers shall
be designed for the effects of flow through the vents and louvers during conditions of normal and reverse
flows. Thermal, sand abrasion, rain, ice and other foreign object damage effects are to be covered.

Verification methods include analyses, tests and review of documentation, including: Analytical
predictions of the effects of gas temperatures and airflow environment through vents and louvers,
updated by component tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.3.8 Def-Stan 00-970 00-970 P1 4.3.2
Reference: 00-970 P1 4.3.8
00-970 P1 4.3.85
00-970 P1 4.24.9
00-970 P1 4.24.32
00-970 P1 4.24.35
STANAG 4671.365
Reference: 4671.609
23.831, 23.859; CS 23.831
Section 25.365, 25.609, CS 23.859
25.831, 25.859; CS 25.365
Section 27.609, 27.831, CS 25.609
27.859; CS 25.831
Section 29.609, 29.831, CS 25.859
29.859. CS 27.609
CS 27.831
CS 27.859
CS 29.609
CS 29.831
CS 29.859
5.3 STRENGTH
5.3.1 Static strength verification.

The airframe structure must be able to support p x limit loads (proof loads) without detrimental,
permanent deformation. At any load up to proof loads, the deformation may not interfere with safe
operation if the aircraft. The ratio p is typically defined between 105% and 115% as to be agreed by the
Certifying Authority.
The airframe structure must be able to support ultimate loads without failure for at least three seconds,
except local failures or structural instabilities between limit and ultimate load are acceptable only if the
structure can sustain the required ultimate load for at least three seconds.

1. Verification of sufficient strength is required for operations, maintenance functions, occurrences of
system failures, and any tests that simulate load conditions, including modifications, new or revised
equipment installations, major repairs, extensive reworks, extensive refurbishment, or remanufacture.
2. Validation information includes formal checked and approved internal loads and strength analysis
reports. Analytical distributions on major components are correlated with test instrumentation
measurements of stress and strain from static test and the structural strength analysis is updated.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.2.13, Def-Stan 00-970 00-970 P1 3.1.1
A.3.10.5, A.3.10.9, A.3.10.10 Reference: 00-970 P1 3.1.4
(for standard development); 00-970 P1 3.1.8
A.4.10.5, A.4.10.5.1,
00-970 P1 3.1.8a
A.4.10.5.2, A.4.10.9, A.4.10.10
(for compliance development) 00-970 P1 3.1.10
00-970 P1 3.1.11
00-970 P1 3.1.14
00-970 P1 3.1.22
00-970 P1 3.1.27
00-970 P1 3.2.2
00-970 P1 3.2.4
00-970 P1 3.2.11
00-970 P1 3.2.13
00-970 P1 3.2.57
00-970 P1 3.7.43
00-970 P1 4.1.6
00-970 P1 4.1.41
00-970 P1 4.4.35
00-970 P1 4.4.37
STANAG 4671.305
Reference: 4671.307
4671.321
4671.570
4671.572
4671.573
4671.575
4671.603
4671.613
4671.629
4671.681
23.573, 23.575, 23.603, CS 23.573
23.613, 23.629, 23.681 ; CS 23.575
Section 25.305, 25.307, CS 23.603
25.571, 25.603, 25.613, CS 23.613
Information Sources
25.629, 25.681 ; CS 23.629
Section 27.305, 27.307, CS 23.681
27.309, 27.603, 27.613 ; CS 25.305
Section 29.305, 29.307, CS 25.307
29.309, 29.571, 29.603, 29.613 CS 25.603
; CS 25.613
CS 25.629
CS 25.681
CS 27.305
CS 27.307
CS 27.309
CS 27.603
CS 27.613
CS 29.305
CS 29.307
CS 29.309
CS 29.603
CS 29.613
5.3.2 Materials and Processes

Materials selection for use within the airframe structure shall be selected taking into account the criticality
of the application within the airframe structure and the limits of the material properties using estimated
minima derived using appropriate statistical compensations that take account of the criticality of the part
and the nature of the selected material. Appropriate selection will take into account, fabrication
processes, repair techniques, environmental changes and the variability of materials through established
fabrication and processes, and verification of suitability shall be demonstrated through appropriate
testing, verification and analyses.
The allowable structural properties shall include all applicable statistical variability and environmental
effects, such as exposure to climatic conditions of moisture and temperature; exposure to corrosive and
corrosion causing environments; airborne or spilled chemical warfare agents; and maintenance induced
environments commensurate with the usage of the airframe. Specific material requirements are:
a. Where applicable, average values of crack growth data (da/dN) should be used in the crack growth
analysis;
b. Where applicable, minimum values of fracture toughness should be used for residual strength analysis;
c. "A" basis design allowables should be used in the design of all critical parts. "A" basis design
allowables should also be used in the design of structure not tested to ultimate load in full scale airframe
static testing. "B" basis design allowables may be used for all other structure.
The processes used to prepare and form the materials for use in the airframe as well as joining methods
shall be commensurate with the material application. Further, the processes and joining methods shall not
contribute to unacceptable degradation of the properties of the materials when the airframe is exposed to
operational usage and support environments.

1. Use of standardized test methods to establish metallic and composite material systems properties.
2. Documentation of materials and processes development and characterization and the selection
process.
3. Second source materials (when established as a program requirement) are qualified and demonstrated
through testing to have equivalent performance and fabrication characteristics as the selected baseline
material.
4. Environmentally conditioned tests performed at the appropriate development test level to meet relevant
design conditions.
5. Materials and processes characteristics for critical parts comply with the requirements of parts control
processes.
6. Environmental compliance with all applicable environmental statutes and laws for all materials systems
and processes selected is verified. This includes life cycle management of hazardous materials.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1568 Def-Stan 00-970 00-970 P1 3.2.8
MIL-HDBK-1587 Reference: 00-970 P1 3.2.9
JSSG-2006: A.3.2.19, 00-970 P1 3.2.10
A.3.2.19.1, A.3.2.19.2 (for 00-970 P1 3.2.42
standard development) 00-970 P1 4.1.2
JSSG-2006: A.4.2.19, 00-970 P1 4.1.4
A.4.2.19.1, A.4.2.19.2 (for 00-970 P1 4.1.13
compliance development) 00-970 P1 4.1.14
00-970 P1 4.5.2
00-970 P1 4.5.4
00-970 P1 4.6.2
00-970 P1 4.7.6
STANAG 4671.573
Reference: 4671.603
4671.605
4671.613
4671.625
23.605, 23.625 ; CS 23.605
Section 25.573, 25.603, CS 23.613
25.605, 25.625 ; CS 23.625
Section 27.573, 27.603, CS 25.307
27.605, 27.625 ; CS 25.603
Section 29.573, 29.603, CS 25.605
29.605, 29.625 . CS 25.613
CS 25.625
CS 27.603
CS 27.605
CS 27.613
CS 27.625
CS 29.603
CS 29.605
Information Sources
CS 29.613
CS 27.625
5.3.3 Stress and strain design controls.

Appropriate use of nominal data, design and material selection shall ensure required stresses, strain and
structural strength within airframe component members. The airframe structure must be able to provide
sufficient static strength for reacting all loading conditions loads without degrading the structural
performance capability of the airframe. Sufficient strength shall be provided for operations, maintenance
functions, and any tests that simulate load conditions.
Consideration should be given to the following aspects and typical values are provided.
a. All structure are designed to nominal dimensional values or 110 percent of minimum values, whichever
is less.
b. The determination of margins of safety is based on the allowable of §5.3.2.
c. Thermal stresses and strains are determined for structures that experience significant heating or
cooling whenever expansion or contraction limited by external or internal constraints. Thermal stresses
and strains are combined with concurrent stresses produced by other load sources in a conservative
manner.
d. In laminated composites, the stresses and ply orientation are compatible and residual stresses of
manufacturing are accounted for, particularly if the stacking sequence is not symmetrical.
e. For each fitting and attachment whose strengths are not proven by limit and ultimate load tests in which
actual stress conditions are simulated in the fitting and surrounding structure, the design stress values are
increased in magnitude by multiplying these loads or stress values by a fitting factor. The fitting factor is
1.15 for all bolted and welded joints and for structure immediately adjacent to the joints. A fitting factor
does not have to be used for continuous lines of rivets installed in sheet-metal joints.
f. The design stress values for bolted joints with clearance (free fit) that are subjected to relative rotation
under limit load or shock and vibration loads, are increased in magnitude by multiplying by a 2.0 bearing
factor times the stress values. This bearing factor does not have to be multiplied by the fitting factor.
g. Structural doors and panels as well as access doors and components with one or more quick-opening
latches or fasteners do not fail, open, vibrate, flap or flutter in flight. The most critical combinations of
latches or fasteners are designed for left unsecure.
h. Castings are classified and inspected, and all castings conform to applicable process requirements. A
casting factor of 1.33 is used. The factors, tests and inspections of this section are applied in addition to
those necessary to establish foundry quality control. The use of castings or C/Hipped parts for primary or
critical applications and/or castings with a casting factor less than 1.33, have successfully completed a
developmental and qualification program. These castings meet the analytical requirements without a
casting factor and meet the service life requirements for both crack initiation and crack growth for flaws
representative of the casting and manufacturing process.
i. Due to the nature of some structural designs or materials, high variability may be encountered around
the nominal design. Such design features must have a minimum level of structural integrity at the
acceptable extremes of dimensions, tolerances, material properties, processing windows, processing
controls, end or edge fixities, eccentricities, fastener flexibility, fit up stresses, environments,
manufacturing processes, etc. In addition to meeting the standard strength requirements, the structure
must have no detrimental deformation of the maximum once per lifetime load and no structural failure at
125 percent of design limit load for the critical combinations of the acceptable extremes.
1. Validation information includes formal checked and approved internal loads and strength analysis
reports.
2. All castings are shown to satisfy the casting factor requirements by analysis.
3. 100 percent inspection by visual and magnetic particle or penetrant or approved equivalent non-
destructive inspection methods.
4. High variability structure is shown to satisfy the requirements by analyses considering critical
combinations of component characteristics.
Information Sources
Comm'l Doc:
A.3.10.4, A.3.10.4.1, Reference: 00-970 P1 3.1.4
A.3.10.4.2, A.3.10.4.3, 00-970 P1 3.1.7
A.3.10.4.4, A.3.10.5 (for
00-970 P1 3.1.8
standard development)
JSSG-2006: A.4.10.4, 00-970 P1 3.1.8a
A.4.10.4.1, A.4.10.4.2, 00-970 P1 3.1.9
A.4.10.4.3, A.4.10.4.4 (for 00-970 P1 3.4.15
00-970 P1 4.3.86
00-970 P1 4.6.10
00-970 P1 4.7.4
00-970 P1 4.7.5
00-970 P1 4.7.6
STANAG 4671.301
Reference: 4671.321
4671.607
4671.613
4671.621
4671.623
4671.625
4671.627
4671.783
23.613, 23.621, 23.625, CS 23.613
23.627, 23.783 ; CS 23.621
Section 25.301, 25.607, CS 23.623
25.613, 25.621, 25.625, 25.783 CS 23.625
; CS 23.627
Section 27.25, 27.301, 27.607, CS 23.783
27.613, 27.621 ; CS 25.301
Section 29.25, 29.301, 29.607, CS 25.607
29.613, 29.621, 29.783. CS 25.613
CS 25.621
CS 25.623
CS 25.625
CS 25.783
Information Sources
CS 27.25
CS 27.301
CS 27.573
CS 27.607
CS 27.613
CS 27.621
CS 27.623
CS 29.25
CS 29.301
CS 29.573
CS 29.607
CS 29.613
CS 29.621
CS 29.623
CS 29.783
5.4 DAMAGE TOLERANCE AND DURABILITY (FATIGUE)
5.4.1 Damage tolerance.

The airframe structure and associated components, whose failure would be catastrophic, must be shown
by analysis supported by test evidence and, if available, service experience, to meet the fatigue
requirements of a damage tolerant or, if not applicable a safe life design methodology over the design
service life of the aircraft. The fatigue evaluation must include the requirements of subparagraph (1), (2),
and (3) and also must include a determination of the probable locations and modes of damage caused by
fatigue, considering environmental effects, intrinsic/discrete flaws, or accidental damage.
(1) The airframe shall have adequate (as defined by the type of aircraft and application) residual strength
in the presence of flaws for the period of service usage before they are detected.
(2) The damage tolerance evaluation must include a determination of the probable locations and modes
of damage due to fatigue, corrosion, or accidental damage. Damage at multiple sites due to fatigue must
be included where the design is such that this type of damage can be expected to occur. The evaluation
must incorporate repeated load and static analyses supported by test evidence. The extent of damage for
residual strength evaluation at any time within the operational life of the aeroplane must be consistent
with the initial detectability and subsequent growth under repeated loads.
(3) Replacement time evaluation and/or inspection interval. It must be shown that the probability of
catastrophic fatigue failure provides an acceptable level of safety, as defined by the relevant authority,
within a replacement time or inspection interval as specified within the relevant continued airworthiness
documentation.
Based on the evaluations required by this paragraph, established as necessary to avoid catastrophic
failure, inspections, replacement times, combinations thereof, or other procedures must be included in the
relevant airworthiness limitations section of the appropriate continued airworthiness documentation.

1. Analyses and tests are performed to verify that the airframe structure meets the damage tolerance
requirements.
2. Damage tolerance testing of a complete airframe to demonstrate compliance with requirements.

3. Fatigue reliability is appropriately considered within the fatigue methodology to avoid airworthiness
impacts.
4. Flight load survey testing for each regime in the usage spectrum.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.12 Damage Def-Stan 00-970 00-970 P1 3.2.2
Tolerance, pg 398 Reference: 00-970 P1 3.2.3
JSSG-2006: A.4.12 Damage 00-970 P1 3.2.8
Tolerance, pg 400 (for 00-970 P1 3.2.9
00-970 P1 3.2.11
00-970 P1 3.2.12
00-970 P1 3.2.13
STANAG 4671.305
Reference: 4671.570
4671.572
4671.573
4671.575
23.571, 23.572, 23.573; Reference: CS 23.572
25.571; CS 23.573
27.571; CS 23.575
29.571. CS 25.571
CS 27.571
CS 27.573
CS 29.571
CS 29.573
5.4.2 Durability.
The durability capability of the airframe shall be adequate to resist fatigue cracking, corrosion, thermal
degradation, delamination, and wear during operation and maintenance such that the operational and
maintenance capability of the airframe is not degraded and the service life and usage conditions are not
adversely affected (including consideration of adverse effects on safety, economic, operational,
maintenance, repair, and modification costs throughout the intended service life). These requirements
apply to metallic and non-metallic structures, including composites, with appropriate distinctions and
variations as indicated. Durability material properties shall be consistent and congruent with those
properties of the same material, in the same component, used by the other structures disciplines.

a. Fatigue cracking/delamination damage.
For one lifetime when the airframe is subjected to the environment and service usage, except where it is
desired to meet special life provisions, the airframe shall be free of cracking, delaminations, disbonds,
deformations, or defects which:
i. Require repair, replacement, inspection to maintain structural integrity, or undue inspection burden for
ship based aircraft.
ii. Cause interference with the mechanical operation of the aircraft.
iii. Affect the aircraft aerodynamic characteristics.

iv. Cause functional impairment.
v. Result in sustained growth of cracks/delaminations resulting from steady-state level flight or ground
handling conditions.
vi. Result in water intrusion.
vii. Result in visible damage from a single impact.
b. Corrosion prevention and control.
i. The airframe shall operate in corrosion producing environments.
ii. Corrosion (including pitting, stress corrosion cracking, crevice, galvanic, filiform, and exfoliation) which
affects the operational readiness of the airframe through initiation of flaws which are unacceptable from a
durability, damage tolerance, and residual strength viewpoint shall not occur during the defined service
life and usage for the aircraft.
iii. Corrosion prevention systems shall remain effective during the service life and usage of the aircraft in
defined chemical, thermal and climatic environments.
iv. Specific corrosion prevention and control measures, procedures and processes must be identified and
established commensurate with the operational and maintenance capability required of the airframe.
c. Thermal protection assurance.
Thermal protection systems shall remain effective during the service life and usage the aircraft in defined
chemical, thermal and climatic environments.
d. Wear and erosion.
The function of structural components, elements, and major bearing surfaces shall not be degraded by
wear during the service life and usage of the aircraft.
The criteria applies to the following typical components:
i. Structural surfaces which move
ii. Structural and maintenance access panels and other removable parts
iii. Doors and ramps
iv. Other structure
v. Leading edges
vi. Radomes
vii. Housings
viii. Other protrusions
e. Special life requirement structure.
The following structural components shall comply with special life requirements:
i. Limited life structure
ii. Extra life structure.
f. Non-destructive testing and inspection (NDI).
NDI shall be utilized during the design, development, production, and deployment phases of the program
to assure that the system is produced and maintained with sufficient structural integrity to meet
performance requirements. Other requirements apply as appropriate.
The methods of fabrication used must produce a consistently sound structure. If a fabrication process
(such as gluing, spot welding, or heat treating) requires close control to reach this objective, the process
must be performed under an approved process specification. In addition, each new aircraft fabrication
method must be substantiated by a test programme.
To ensure sufficient durability over the useful operating life of the aircraft, protective measures should be
applied to the materials and structure, particular with respect to environmental degradation, corrosion and
abrasion.
The variability of material properties (including hazardous materials) and fabrication processes shall be
considered for when determining the durability capability of the airframe structure, ensuring that the
workmanship employed is of a high standard and that reference is made to the relevant specifications
and design data. Consistent material properties at the fabrication process stage will ensure that variability
between materials, structures and components is reduced.
Considerations for AMC:

Verification methods include analysis, test, demonstration and inspection of documentation.
a. Durability analyses and tests are performed to verify that the airframe structure meets the durability
requirements. A full scale airframe is durability tested to show that the structure meets the required
service life which satisfies the following:
(1) The airframe is as close to structurally identical to the operational airframe, as practices allow.
Significant differences require additional tests. When changes are not significant and additional testing
cannot be accomplished, the re-design, repair, or modification is designed to three (3) lifetimes of the
service life and usage.
(2) Two (2) lifetimes of testing plus the indicated inspections verify adequate durability.
(3) Test anomalies which occur within the duration of the test are evaluated for production and retrofit
modifications. Test anomaly analysis is correlated to test results and adjusted results are shown to meet
the durability requirements. Modifications are also shown to satisfy durability and damage tolerance
requirements by either test or analysis at the discretion of the acquisition activity.
(4) The test is subjected to the design flight-by-flight loads spectra. Truncation, elimination, or substitution
of load cycles is allowed subject to approval by the acquisition activity.
(5) Inspections are performed as an integral part of the durability tests and at the completion of testing
and include design inspections, special inspections, and post-test teardown inspections.
(6) A minimum of two (2) lifetimes of durability testing is required to certify the airframe structure. A third
lifetime testing is performed to support damage tolerance, repairs and modifications, usage changes, and
life extension potential.
(7) Durability testing demonstrates that the onset of widespread fatigue damage will not occur during the
design service life.
b. A flight-by-flight durability stress spectra and chemical and thermal environment spectra is developed
and spectra interaction effects are accounted for.
c. For rotorcraft, a fatigue methodology and composite worst case usage spectrum are established and
documented for the platform, including consideration of maneuvering loads, maneuver to maneuver load
cycles, centrifugal (CF) loads due to rotor start and stop cycles, and torsional loads due to rotor braking
cycles. Fatigue reliability is appropriately considered within the fatigue methodology to avoid
airworthiness impacts (specifically, the methodology includes appropriate considerations of strength,
loads, and usage variability). In addition to expanding the load factor, aeromechanical, or aero-elastic
stability limitations, envelope expansion flight testing establishes airspeed, gross weight, center of gravity,
and density altitude restrictions for each configuration to avoid level flight fatigue damage. Flight load
survey testing is performed for each regime in the usage spectrum. For safe-life components, fatigue
strength curve shapes and coefficients of variation are established in the fatigue methodology based on
historical testing of similar components or based on coupon testing with appropriate adjustments due to
full-scale component size and fabrication/design details. Component fatigue laboratory testing is
performed to establish endurance limits with appropriate confidence, typically using identical
instrumentation as used in the flight load survey testing. Fatigue substantiation analysis is performed in
accordance with the applicable platform fatigue methodology based on flight and laboratory test data.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.11 Durability, Def-Stan 00-970 00-970 P1 3.2.4
pg 378 JSSG-2006: A.4.11 Reference: 00-970 P1 3.2.5
Durability, pg 379 (for 00-970 P1 3.2.7
compliance development)
00-970 P1 3.2.8
00-970 P1 3.2.9
00-970 P1 3.2.10
00-970 P1 3.10.55
STANAG 4671.572
Reference: 4671.573
4671.603
4671.609
Section 23.573, 23.603, 23.609 Reference: CS 23.603
; CS 23.609
Section 25.603, 25.609 ; CS 25.603
Section 27.603, 27.609 ; CS 25.609
Section 29.603, 29.609. CS 27.573
CS 27.603
CS 27.609
CS 29.573
CS 29.603
CS 29.609
5.4.3 Durability and damage tolerance control processes.

A Durability Control Program shall be established for the aircraft structure. This program shall identify and
define all the tasks necessary to ensure compliance with the durability requirements (including damage
tolerance). The disciplines of fracture mechanics, fatigue, materials and processes selection,
environmental protection, corrosion prevention and control, design, manufacturing, quality control, non-
destructive inspection, and probabilistic methods shall be considered when the durability (including
damage tolerance) control processes are developed. This program shall include the requirement to
perform durability (including damage tolerance) design concept, material, weight, performance, and cost
trade studies early during the aircraft’s design so as to obtain structurally-efficient and cost-effective
designs.
This program shall also include the definition of means for tracking each individual aircraft fatigue
consumption and crack growth life, as well as the definition of a suitable inspection program to be
included in the instructions for continued airworthiness.
The durability (including damage tolerance) control process should include as a minimum the following
tasks:
a. A disciplined procedure for durability design should be implemented to minimise the possibility of
incorporating adverse residual stresses, local design details, materials, processing, and fabrication
practices into the problems (i.e., to find these problems which otherwise have historically been found
during durability testing or early in service usage).
b. Basic data (i.e., initial quality distribution, fatigue allowables, KIC, KC, KISCC, da/dn, etc.) utilized in
the initial trade studies and the final design and analyses should be obtained from existing sources or
developed as part of the contract.
c. A criteria for identifying and tracing maintenance critical parts should be established by the contractor
and should require approval by the procuring agency. It is envisioned that maintenance critical parts will
be expensive, non-economical-to-replace parts. A maintenance critical parts list should be established by
the contractor and should be kept current as the design of the airframe progresses.
d. A criteria for identifying and tracing fatigue/fracture critical parts should be established by the contractor
and should require approval by the procuring agency. It is envisioned that fatigue/fracture critical parts will
be expensive or safety of flight structural parts. A fatigue/fracture critical parts list should be established
by the contractor and should be kept current as the design of the airframe progresses.
e. Design drawings for the maintenance critical parts and fatigue/fracture critical parts should identify
critical locations, special processing (e.g., shot peening), and inspection requirements.
f. Material procurement and manufacturing process specifications should be developed and updated as
necessary to ensure that initial quality and fracture toughness properties of the critical parts exceed the
design value.
g. Experimental determination sufficient to estimate initial quality by microscopic or fractographic
examination should be required for those structural areas where cracks occur during full scale durability
testing.
h. Durability analyses, corrosion cracking assessment, damage tolerance analyses, development testing,
and full scale testing should be performed in accordance with this specification.
i. Complete non-destructive inspection requirements, process control requirements, and quality control
requirements for maintenance, fatigue/fracture critical parts should be established by the contractor and
should require approval by the procuring agency. This task should include the proposed plan for certifying
and monitoring subcontractor, vendor, and supplier controls.
j. The durability and damage tolerance control process should include any special nondestructive
inspection demonstration programs conducted in accordance with the requirements of this specification.
k. Traceability requirements should be defined and imposed by the contractor on those fatigue and
fracture critical parts that receive prime contractor or subcontractor in-house processing and fabrication
operations which could degrade the design material properties.
l. For all fracture critical parts that are designed for a degree of inspectability other than inservice non-
inspectable, the contractor should define the necessary inspection procedures for field use for each
appropriate degree of inspectability as specified in the specification.Consideration should be given to
Individual Aircraft Tracking task.
Considerations for AMC:

1. Documented durability and damage tolerance control process.
2. Criteria for identifying and tracing fatigue/fracture critical parts are established and are approved by the
procuring agency.
3. Complete nondestructive inspection requirements, process control requirements, and quality control
requirements are established for maintenance.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-6870 for guidance Def-Stan 00-970 00-970 P1 3.2.6
in the development of Reference: 00-970 P1 3.2.7
Nondestructive Inspection 00-970 P1 3.2.13
procedures.
JSSG-2006: A.3.13, pg 417 STANAG 4671.573
Reference: 4671.575
JSSG-2006: A.4.13, pg 419
(for compliance development)
Information Sources
MIL-HDBK-1568
MIL-STD-1530C
Section 23.575; Reference: CS 25.571
Section 25.571; CS 27.571
Section 27.571; CS 27.573
Section 29.571. CS 29.571
CS 29.573
5.4.4 Corrosion prevention and control.

Throughout the service life of the aircraft, corrosion prevention measures shall be provided against
deterioration or loss of strength in materials by providing resistance and protection from any effects of
environmental degradation.
Evaluations into material strength, detailed design and fabrication shall show that all forms of corrosion,
including and not limited to pitting, stress corrosion cracking, crevice, galvanic, filiform, and exfoliation will
not result in catastrophic failure to the aircraft.
Protective finishes applied to materials and structure, including the appropriate selection of materials
against deterioration or loss of strength, along with applicable processes, procedure and control methods
shall be commensurate within the operational and maintenance philosophy applied to the aircraft during
service life and should be recorded within the relevant Airworthiness Limitations section of the Continued
Airworthiness documentation.
An Environmental Protection Control Plan shall be prepared consistent with the design service life
defining corrosion prevention and control requirements and all the measures that minimise the potential
for environmental degradation (including corrosion) throughout the structure. The plan shall take into
account at least the following:
a. An evaluation of the susceptibility of the aircraft structure to environmental degradation (including
corrosion) shall be conducted identifying locations where the structure might be susceptible to
environmental degradation (including corrosion) and the expected type(s) of degradation and corrosion
(e.g., exfoliation, uniform, crevice, intergranular, and stress-corrosion cracking, etc.) that could occur at
these locations. To identify potential environmental degradation and corrosion damage locations, the
evaluation shall account for the materials, manufacturing processes, corrosion prevention systems (e.g.
coatings, sealants, etc.), preventative maintenance approaches (e.g. hangaring, wash cycles, wash fluids,
etc.), the inspectability of the location, and structural fabrication techniques as well as the expected
operational environments to which the aircraft are subjected.
b. The criteria for the selection of corrosion resistant materials and their subsequent treatments shall be
defined.
c. Organic and inorganic coatings for all airframe structural components and parts, and their associated
selection criteria shall be defined.
d. Procedures for requiring drawings to be reviewed by and signed off by materials and processes
personnel shall be defined.
e. Finishes for the airframe shall be defined. General guidelines shall be included for selection of finishes
in addition to identifying finishes for specific parts, such that the intended finish for any structural area is
identified.
f. The organizational structure, personnel, and procedures for accomplishing these tasks shall be defined
and established.

1. The criteria for the selection of corrosion resistant materials and their subsequent treatments are
defined.
2. The specific corrosion control and prevention measures are defined and established.
3. Organic and inorganic coatings for all airframe structural components and parts, and their associated
selection criteria are defined.
4. Finishes for the airframe are defined.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.11.2 Def-Stan 00-970 00-970 P1 3.2.4
Corrosion Prevention and Reference: 00-970 P1 3.2.8
Control, pg 389 00-970 P1 3.2.9
JSSG-2006: A.4.11.2
00-970 P1 3.2.10
Corrosion Prevention and
00-970 P1 3.2.12
Control, pg 392 (for
STANAG 4672.575
compliance development)
Reference: 4671.603
4671.609
MIL-HDBK-6870
4671.613
STANAG 7011
MIL-HDBK-1568
MIL-STD-1530C
Section 23.575, 23.603, 23.609 Reference: CS 23.603
Section 25.571, 25.603, 25.609 CS 23.609
Section 27.571, 27.603, 27.609 CS 25.571
Section 29.571, 27.603, CS 25.603
27.609. CS 25.609
CS 27.571
CS 27.573
CS 27.603
CS 27.609
CS 29.571
CS 29.573
CS 29.603
CS 29.609
5.5 MASS PROPERTIES
5.5.1 Evaluation of Mass Properties

Mass properties shall fully support safe vehicle operations at each appropriate combination of mass and
centre of gravity within the range of loading conditions for which certification is requested. This shall be
shown -
• By tests upon an aeroplane of the type for which certification is requested, or by calculations based on,
and equal in accuracy to, the results of testing; and,
• By systematic investigation of each probable combination of mass and centre of gravity, if compliance
cannot be reasonably inferred from combinations investigated.
Ranges of mass and centres of gravity within which the aeroplane may be safely operated shall be
established and shall include the range for lateral centres of gravity if possible loading conditions can
result in significant variation of their positions.
Consideration should be given to all masses, measured using agreed standards, with defined and
appropriate tolerances, between:-
a. The minimum mass; and
b. The maximum mass at which the aeroplane can reach the altitude considered.

1. The mass properties (masses and centre of gravities) are verified by inspections, analyses, and actual
vehicle weighing. Pieces and parts are verified by calculation as drawings are released and actual
weighing when parts are available.
2. The Mass Properties are verified to reflect the current configuration of the aircraft and comply with
defined mission requirements.
Information Sources
Comm'l Doc: SAWE RP No. 7: 3.2.6 and 3.3
DoD/MIL Doc: JSSG-2006: 3.2.5 Def-Stan 00-970 00-970 P1 3.3.13
Reference: 00-970 P1 3.3.14
00-970 P1 3.4.16
STANAG 4671.21
Reference: 4671.23
4671.25
4671.29
4671.321
4671.343
4671.659
23.29, 23.321, 23.343, 23.659; CS 23.25
Section 25.21, 25.25, 25.29, CS 23.29
25.321, 25.343; CS 23.321
Section 7.21, 27.23, 27.25, CS 23.343
27.29, 27.321, 27.659; CS 23.659
Section 29.21, 29.25, 29.29, CS 25.21
29.321, 29.659. CS 25.25
CS 25.29
CS 25.321
CS 25.343
CS 27.21
CS 27.23
CS 27.25
CS 27.29
Information Sources
CS 27.321
CS 27.659
CS 29.21
CS 29.25
CS 29.29
CS 29.321
CS 29.659
5.5.2 Weight and centre of gravity.

Centre of gravity margins shall be properly defined to handle aerodynamic, centre of gravity, and inertia
changes resulting from fuel usage, store expenditure, asymmetric fuel and store loading, fuel migration at
high angle-of-attack and roll rates, and AAR, and release of external sling loads, and air drop of internal
cargo.

1. The centre of gravity is verified to remain in the approved envelope for all mission scenarios.
2. The provisions for determining the weight, centre of gravity, and inertias are verified to adhere to stated
requirements through inspections, analysis and test.
3. The centre of gravity envelope is verified to encompass all possible mission and production variations
to ensure safe flight.
4. The fuel system calibration methodology is verified by determination of trapped fuel weight and centre
of gravity, determination of unusable fuel weight and centre of gravity, determination of the usable fuel
mass properties (weight and centre of gravity), and comparison of on-board fuel indicating equipment to
actual usable fuel mass properties.
Information Sources
Comm'l Doc: SAWE RP No. 7: 3.4.9, 3.5,
3.2.7.3.1, and 3.2.7.3.1.4
Reference: 00-970 P1 3.4.16
STANAG 4671.21
Reference: 4671.23
4671.29
4671.321
4671.1519
23.1519; CS 23.529
Section 25.21, 25.23, 25.27, CS 23.1519
25.29, 25.1519; CS 25.21
Section 27.21, 27.27, 27.29, CS 25.23
27.1519; CS 25.27
Section 29.21, 29.27, 29.29, CS 25.29
29.1519. CS 25.1519
CS 27.21
CS 27.27
CS 27.29
Information Sources
CS 27.1519
CS 29.21
CS 29.27
CS 29.29
CS 29.1519
5.5.3 Manuals.
The mass and centre of gravity ranges determined for the aeroplane shall be established as operating
limitations and furnished in the aeroplane flight and maintenance manuals.
Verify that flight and maintenance manuals (or equivalent) are consistent and contain all required
checklists and loading data necessary to conduct required mass and balance checks while complying
with specific mass and balance requirements.

1. Information contained within manuals is verified through analysis and test with actual part weighing of
inventory items.
Information Sources
Comm'l Doc: SAWE RP No. 7 3.4.9 and DI-
MGMT-81502
DoD/MIL Doc: DI-MGMT-81502; TO 1-1B-50 Def-Stan 00-970
"USAF Weight and Balance"; Reference:
TM 55-1500-342-23 "Army STANAG
Aviation Maintenance 4671.1519
Engineering Manual - Weight Reference: 4671.1583
and Balance"; NA 01-1B-50 4671.1589
"USN/USMC Aircraft Weight
and Balance Control" 35
23.1589, 23.1501; CS 23.1589
Section 25.1583, 25.1501; CS 23.1501
Section 27.1583, 27.1501; CS 25.1583
Section 29.1583, 29.1501. CS 25.1501
CS 27.1583
CS 27.1501
Cs 29.1583
CS 29.1501
5.6 FLIGHT RELEASE
5.6.1 Substantiation of release.

The structural evidence supporting the type certificate (or equivalent document) shall be based on up-to-
date design criteria and mass properties, and the completion of all required analyses; laboratory, ground,
and flight tests relating to loads, strength, durability, damage tolerance, structural dynamics, and stiffness.
The structural data generated by the required analysis and test shall substantiate the integrity and flight
worthiness of the design.

1. Structural analysis (external loads, internal loads and strength, limited durability and damage tolerance,
structural dynamics) is correlated to all available ground and flight testing.
2. Inspection and maintenance intervals are established to ensure continued safe operations
3. Wind tunnel tests. Component ground vibration, acoustic and stiffness tests. Mass measurements of
control surfaces/tabs. Control surface, tab, and actuator rigidity, free play, and wear tests. Complete
aircraft ground vibration modal tests. Aeroservoelastic ground tests. Updated predictions of near field
aeroacoustic, vibration and internal noise. Ground loads test demonstrations, shimmy ground tests, rough
runway tests.
4. Successful completion of appropriate flight flutter, vibroacoustics, loads testing (100%) and ultimate
loads static tests.
5. Structural analyses are validated and updated for all testing such that the predictive methods ensure
adequate strength levels and understanding of the structural behaviour.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: A.3.5, A.3.6, Def-Stan 00-970 00-970 P1 3.1.25
A.3.7, A.4.7, A.4.10.5.3, Reference: 00-970 P1 3.5.9
A.4.10.5.4, A.4.10.5.5 00-970 P1 3.7.11
00-970 P1 4.8.4
00-970 P1 4.8.10
00-970 P1 4.8.12
00-970 P1 4.10.12
00-970 P1 4.15.77
00-970 P1 4.15.78
00-970 P1 4.15.80
00-970 P1 4.26.80
STANAG 4671.21
Reference: 4671.251
4671.307
4671.629
4671.963
4671.965
23.629, 23.963, 23.965; CS 23.629
Section 25.251, 25.305, CS 23.963
25.629, 25.683, 25.771, CS 23.965
25.963, 25.965; CS 25.251
Section 27.251, 27.771, CS 25.305
27.963, 27.965; CS 25.629
Section 29.251, 29.771, CS 25.683
29.963, 29.965. CS 25.771
CS 25.963
Information Sources
CS 25.965
CS 27.251
CS 27.771
CS 27.963
CS 27.965
CS 29.251
CS 29.771
CS 29.963
CS 29.965
SECTION 6 - FLIGHT TECHNOLOGY

Flight technology comprises the flight mechanics functional areas consisting of stability and control, flying
qualities, flight control functions, external aerodynamics, internal aerodynamics and performance. The
aircraft aerodynamic and stability configuration, engine/inlet/nozzle compatibility, performance and
integrated control airworthiness of an aircraft should be assessed using the criteria provided in the text
below (not all items apply in each case; similarly, items may have to be added for vehicles employing new
or innovative technology/techniques).
EXAMPLES OF TYPICAL CERTIFICATION SOURCE DATA

1. Design criteria.
2. Design studies and analyses.
3. Design, installation, and operational characteristics.
4. Simulation tests, modelling, and results (including simulation verification, validation and accreditation
data).
5. Design approval and function/system compatibility tests.
6. Component and functional level qualification and certification tests.
7. Electromagnetic environmental effects.
8. Installed propulsion compatibility tests.
9. Acceptance criteria for test results.
10. Failure modes, effects, and criticality analysis/failure modes and effects testing (FMECA/FMET).
11. Hazard analysis and classification.
12. Safety certification program.
13. Computational, theoretical, and/or semi-empirical prediction methods.
14. Configuration: aerodynamic design and component location.
15. Wind tunnel test results and correction methods.
16. Mathematical representation of system dynamics.
17. Ground resonance and loop stability tests.
18. Aeroservoelastic design criteria and analysis.
19. Performance analysis.
20. Flight manual.
21. Natural environmental sensitivities.
22. Flight path guidance analysis and simulation to include ship launch and recovery routines if applicable
(including sensor or processor failure modes and effects on flight control).
23. Interface/integration control documents.
24. Function, sub-function, and component specifications.
25. Selection criteria and patterns selected for screens constructed to demonstrate inlet/engine
compatibility.
26. Flight test plan.
27. Detailed flight profiles.
28. Aircraft/engine operating limitations.
29. Control laws.
30. Flight test reports.
31. Aerodynamic and air data uncertainty sensitivity studies.
32. Force and Moment Accounting system.
33. Mass properties: weights, centres of gravity, and inertias.
CERTIFICATION CRITERIA, STANDARDS AND METHODS OF COMPLIANCE
The following criteria, standards and methods of compliance apply to all aircraft and represent the
minimum requirements necessary to establish, verify, and maintain an airworthy design.
The documents referenced under any criterion, standard and/or method of compliance may provide other
standards. References provide supporting rationale, guidance, lessons learned and other important
information useful in properly understanding, interpreting, and applying the relevant criterion, standard
and/or method of compliance.
6.1 FLYING QUALITIES.

Flying qualities are those characteristics of the complete aircraft which allow the pilot/operator to perform
to his/her satisfaction the flying tasks required to safely accomplish the mission, with an acceptable
workload, while operating in the real world environment for which it is intended to operate. These
characteristics are equally applicable for assuring the flight safety of an Unmanned Air System (UAS).
6.1.1 Preliminary steps in application of flying qualities.

6.1.1.1 Determining operational missions.
The operational mission requirements of the aircraft system, for which flight safety is to be assured, shall
be determined and adequately defined.

a. Speed profiles,
b. Altitude profiles,
c. Environmental requirements,
d. Manoeuvre and flight handling requirements,
e. Dynamic and/or static stability requirements
f. Payload (fuel, cargo, munitions, etc.) requirements,
g. Take-off and landing performance requirements, including take-off/landing distance, climb performance
and engine-off requirements,
h. Requirements for use of specific equipment (e.g. defensive aids, weapons, hoists, under-slung loads,
fuel tank inerting systems, oxygen generation systems, etc.).

1. Verification methods include inspection of requirements, design, and configuration documentation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797, section 4.1.1. Def-Stan 00-970 00-970 P1 S2.1.10
ADS-33-PRF section 3.1.1 and Reference: 00-970 P1 S2.1.6
3.1.3. 00-970 P1 S7.1.2
JSSG 2001B 3.1.1, 3.1.2 00-970 P5 UK25.321a
00-970 P7 L600 S5
00-970 P7 L600 S8
STANAG 4671.U17
Reference: 4671.U19
4671.1501
Information Sources
CS 23.1583
CS 25.21
CS 25.143
CS 25.1583
CS 27.21
CS 27.141
CS 27.1583
CS 29.21
CS 29.141
CS 29.1583
6.1.1.2 Determining applicable flight phases.

The aircraft's applicable flight phases shall be determined where safety of flight is to be assessed for the
aircraft's operational mission(s).

a. Common aircraft flight phases including; Flight Planning, Push-back, Taxi, Take-off, Climb, Cruise,
Descent, Final Approach, and Landing.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 4.1.2 Def-Stan 00-970 00-970 P1 S2.1.10
ADS-33-PRF section 3.1.1, Reference: 00-970 P1 S2.1.6
3.1.3 and 3.11. 00-970 P1 S7.1.2
JSSG 2001B 3.1.1, 3.1.2 00-970 P5 UK25.321a
00-970 P7 L600 S5
00-970 P7 L600 S8
STANAG 4671.U17
Reference: 4671.U19
4671.1501
CS 23.1583
CS 25.21
CS 25.143
CS 25.1583
CS 27.21
CS 27.141
CS 27.1583
CS 29.21
CS 29.141
CS 29.1583
6.1.1.3 Defining aircraft states.

The aircraft's applicable aircraft States shall be determined where safety of flight is to be assessed.
This shall include determination of:
a. Configuration of internal and external stored assessing all possible combinations.
b. Configuration of aircraft loadings.
c. The aircraft's moments and products of inertia.
d. aircraft configurations.
e. aircraft normal states.
f. aircraft extreme states.
g. aircraft failure states.
h. aircraft special failure states.

a. The aircraft's average (mean, median and/or mode as considered appropriate) configuration for the
expected aircraft missions.
b. The upper and lower limits of specific parameters of aircraft configuration (e.g. Longitudinal and Lateral
Centre of Gravity masses and positions).
c. Limits of manoeuvre-based parameters, for example accelerations due to pitch, roll and yaw.
The State of the aircraft is defined by the selected configuration together with the functional status of each
of the aircraft components or systems, throttle setting, weight, moments of inertia, centre–of–gravity
position, and external store complement.
The trim setting and the positions of the pitch, roll, and yaw controls are not included in the definition of
aircraft state since they are often specified in the requirements.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 4.1.3.1-4.1.3.8 Def-Stan 00-970 00-970 P1 S2.1.10
ADS-33-PRF section 3.1.6 Reference: 00-970 P1 S2.1.6
JSSG 2001B 3.1.1, 3.1.2 00-970 P1 S7.1.2
00-970 P5 UK25.321a
00-970 P7 L600 S5
00-970 P7 L600 S8
STANAG 4671.U17
Reference: 4671.U19
4671.1501
CS 23.1583
CS 25.21
CS 25.143
CS 25.1583
CS 27.21
CS 27.141
Information Sources
CS 27.1583
CS 29.21
CS 29.141
CS 29.1583
6.1.1.4 Defining the regions of handling.

The aircraft's region of handling shall be determined where safety of flight is to be assessed.
This should include:
a. Regions of Satisfactory Handling,
b. Regions of Tolerable Handling, and,
c. Regions of Recoverable Handling.

a. Definitions of 'Satisfactory', 'Tolerable' and 'Recoverable' handling. Such definitions could be
considered equivalent to Cooper-Harper ratings as follows:
i. Satisfactory = Rating 1-3,
ii. Tolerable = Rating 4-6,
iii. Recoverable = Rating 7-9

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 4.1.4 Def-Stan 00-970 00-970 P1 S2.1.10
JSSG 2001B 3.1.1, 3.1.2 Reference: 00-970 P1 S2.1.6
00-970 P1 S7.1.2
00-970 P5 UK25.321a
00-970 P7 L600 S5
00-970 P7 L600 S8
STANAG 4671.U17
Reference: 4671.U19
4671.1501
CS 23.1583
CS 25.21
CS 25.143
CS 25.1583
CS 27.21
CS 27.141
CS 27.1583
CS 29.21
CS 29.141
CS 29.1583
6.1.1.5 Modelling, simulation, analysis tools and databases.

Modelling, simulation and analysis tools and databases shall have appropriate fidelity and shall accurately
represent the aircraft for evaluating airworthiness criteria and safety of flight.

a. The demonstration of an effective verification, validation and accreditation (VV&A) process.
b. Configuration control across all such tools to assure currency and traceability.
c. Verification and validation that predicted data, as well as offline and piloted simulation results, are
generated by the most appropriate and accurate tools and processes.

1. Verification methods include inspection of maturity, fidelity and accuracy of analysis, modelling and
simulation tools and databases, as well as the processes in place to assure their currency, traceability
and configuration control. Analysis, modelling and simulation tools and databases, including the
verification and validation of their results, reflect industry best practices for the purpose of their intended
use.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B 3.1.1, 3.1.2 Def-Stan 00-970 00-970 P1 S2.1.10
Reference: 00-970 P1 S2.1.6
00-970 P1 S7.1.2
00-970 P5 UK25.321a
00-970 P7 L600 S5
00-970 P7 L600 S8
STANAG 4671.U17
Reference: 4671.U19
4671.1501
CS 23.1583
CS 25.21
CS 25.143
CS 25.1583
CS 27.21
CS 27.141
CS 27.1583
CS 29.21
CS 29.141
CS 29.1583
6.1.2 Primary flying qualities.

Flying qualities shall be defined and assessed for safety of flight for all Aircraft States (as referenced in
section 6.1.1.3 of this handbook) encountered in the Flight Phases and tasks (as referenced in section
6.1.1.2 of this handbook) of the operational missions (as referenced in section 6.1.1.1 of this handbook).
This should specifically include (but is not limited to):
a. Ensuring that all aircraft states have been considered for all expected environmental conditions.
b. Ensuring that allowable levels of aircraft normal states have been defined and assessed.
c. Ensuring that allowable levels of aircraft extreme states have been defined and assessed.
d. Ensuring that primary requirements for aircraft failure states have been defined and assessed.

a. Combinations of Aircraft States, Flight Phases/Tasks and Operational Missions both within the bounds
of the aircraft specification (and therefore expected to be encountered in the operation of the aircraft) and
outside of the bounds of the aircraft specification.
b. The definition and assessment of flying qualities where combinations are considered within the bounds
of the aircraft specification.
c. The specification of combinations considered outside of the bounds of the aircraft specification, (for
example as a defined flight envelope or as a limitation in the Aircraft Flight Manual).
d. Preventative measures to prevent the aircraft entering a combination considered outside of the aircraft
specification.

1. Verification methods include analysis, simulation, and inspection of requirements, design, and
configuration documentation.
2. Aircraft states will typically be defined as follows:
i. Normal aircraft states typically cover operation of the aircraft within its defined limits (e.g. centre of
gravity limits, airspeeds, etc.);
ii. Extreme aircraft states typically include operation of the aircraft in exceedance of 1 or more of its
defined limits;
iii. Failure aircraft states typically include operation with 1 or more failure. Where failures are determined
to be reasonably probable, it may be appropriate to include such failures within the Normal aircraft state.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.1. Def-Stan 00-970 00-970 P1 S2.1.10
ADS-33-PRF section 3.1 . Reference: 00-970 P1 S2.1.6
JSSG 2001B 3.1.1, 3.1.2 00-970 P1 S7.1.2
00-970 P5 UK25.321a
00-970 P7 L600 S5
00-970 P7 L600 S8
STANAG 4671.U17
Reference: 4671.U19
4671.1501
CS 23.1583
CS 25.21
CS 25.143
CS 25.1583
CS 27.21
CS 27.141
CS 27.1583
CS 29.21
CS 29.141
Information Sources
CS 29.1583
6.1.3 Flying qualities in degraded environmental conditions.

The effect that degraded environmental conditions have on the aircraft's flight handling qualities shall be
defined and assessed considering the effect on the safety of flight.

a. The environmental conditions for which the aircraft is cleared to fly (as detailed in the aircraft
specification) and the transitory environmental conditions that could be anticipated in the normal
operation of the aircraft in the environments that it is cleared to fly in.
b. Degraded environmental conditions including (as appropriate):
i. Degradation of the ambient environmental parameters (temperature, humidity, pressure etc.)
ii. Operation in degraded visual environments (e.g. white-out and brown-out conditions)

1. Verification methods include analysis, test, demonstration, simulation, and inspection of process,
requirements, design, test, and configuration documentation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B 3.2 Def-Stan 00-970 00-970 P1 S2.1.11
Reference: 00-970 P1 S7.2
00-970 P7 L100 S8.1
00-970 P7 L600 S6
00-970 P7 L101
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.3.1 Flying qualities in icing conditions.

Flying qualities in icing conditions shall be defined and assessed for safety of flight.

a. The icing conditions for which the aircraft is cleared to fly (as specified in the aircraft specification) and
the transitory icing conditions that could be anticipated in the normal operation of the aircraft in the
environments that it is cleared to fly in.

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B 3.2 Def-Stan 00-970 00-970 P1 S2.1.11
MIL-HDBK-516C 6.1.3.1 Reference: 00-970 P1 S7.2
00-970 P7 L100 S8.1
Information Sources
00-970 P7 L600 S6, 00-970 P7
L101
STANAG 4671.U292
Reference: 4671.905
4671.929
4671.1419
CS 27.1419
CS 29.1419
6.1.4 Control margin.

Control margins and their effect on flight handling shall be defined and assessed for safety of flight.

a. Limits in control authority for each flight control surface both in isolation and in conjunction with other
surfaces. Where appropriate, this should include:
i. Consideration of limits on flight control surfaces that cause a moment around different aircraft axes--for
example the concurrent application of longitudinal control surfaces (e.g. ailerons) and lateral control
surfaces (e.g. elevators), and,
ii. Consideration of limits on flight control surfaces that cause a moment around the same aircraft axis--for
example the concurrent application of lateral control surfaces (e.g. elevators and horizontal tail plane).

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B 3.3.11.1.3 Def-Stan 00-970 00-970 P1 S4.10.8
MIL-HDBK-516B 6.1.4 Reference: 00-970 P7 L600 S12
00-970 P7 L601 S6
00-970 P7 L602 S6
00-970 P7 L603 S6
00-970 P7 L607 S6
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.5 General flying qualities

6.1.5.1 Approach to dangerous flight conditions.
Flight handling qualities in approaches to dangerous flight conditions shall be defined and assessed for
safety of flight.
a. The pilots' ability to readily and safely return to the Service Flight Envelope without exceptional skill or
technique.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516C 6.1.5.1 Def-Stan 00-970 00-970 P1 S2.1.32
00-970 P7 L600 S8.3
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.5.2 Buffet.
Buffet characteristics shall be defined and assessed for safety of flight.

a. Prevention of degradation of the aircraft flight handling qualities below those stated in the aircraft
specification for the specified aircraft states, phases/tasks and missions.

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B C.3.3 Def-Stan 00-970 00-970 P5 UK25.143a
MIL-HDBK-516C 6.1.5.2 Reference: 00-970 P7 L600 S13.1.1
STANAG 4671.251
Reference: 4671.253
6.1.5.3 Release of stores.

The effect of release of stores shall be defined and assessed for safety of flight.

a. Prevention of the degradation of the aircraft flight handling qualities below those stated in the aircraft

Information Sources
Comm'l Doc:
Reference: 00-970 P1 S2.24.18
00-970 P1 S7.1.7
00-970 P5 UK25.143a
00-970 P5 UK25.3.1.1
00-970 P7 L600 S13.1.2
00-970 P7 L601 S6.4.2
00-970 P7 L602 S6.4.2
00-970 P7 L604 S5.1
00-970 P7 L903 S7.8.2
00-970 P7 L903 S7.5.2
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.5.4 Effects of armament delivery and special equipment.

The effects of armament delivery and special equipment on flight handling shall be defined and assessed
for safety of flight

a. Prevention of degradation of the aircraft flight handling qualities below those stated in the aircraft

Information Sources
Comm'l Doc:
Reference: 00-970 P1 S2.17.33
00-970 P1 S2.24.19, 00-970
P5 UK25.143a
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.5.5 Failures.
Safety of flight following failures shall be verified.

a. The probability of a single or combination of failures that would cause the aircraft to be in an unsafe
condition.
b. The effect of failure(s) for the specified range of aircraft states, phases/tasks and missions.

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B section Def-Stan 00-970 00-970 P1 S1.1.13
3.3.11.1.1.3 Reference: 00-970 P1 S1.1.34
MIL-HDBK-516C 6.1.5.5 00-970 P1 S2.1.22
00-970 P1 S2.1.38
00-970 P1 S2.8.25
00-970 P1 S2.10.17
00-970 P1 S2.14.22
00-970 P1 S2.14.24
00-970 P1 S2.15.19
00-970 P7 L100 S9.1.1
00-970 P7 L600 S3.5.1
00-970 P7 L600 S7.2.2
00-970 P7 L600 S8.1.1
STANAG 4671.51
Reference: 4671.143
4671.367
4671.459
4671.572
4671.573
4671.787
4671.903
4671.933
4671.953
4671.1331
4671.1351
4671.1461
4671.U1485
4671.1585
CS 23.145
CS 23.147
CS 23.367
CS 23.441
CS 23.573
CS 23.574
CS 23.672
CS 23.841
CS 23.853
CS 23.933
Information Sources
CS 23.937
CS 23.953
CS 23.959
CS 23.1306
CS 23.1308
CS 23.1309
CS 23.1353
CS 23.1461
CS 25.105
CS 25.143
CS 25.149
CS 25.207
CS 25.302
CS 25.307
CS 25.362
CS 25.365
CS 25.367
CS 25.571
CS 25.603
CS 25.629
CS 25.671
CS 25.672
CS 25.734
CS 25.735
CS 25.831
CS 25.841
CS 25.869
CS 25.933
CS 25.937
CS 25.952
CS 25.981
CS 25.991
CS 25.1307
CS 25.1316
CS 25.1322
CS 25.1331
CS 25.1333
CS 25.1351
CS 25.1353
CS 25.1438
CS 25.1461
CS 27.75
CS 27.79
CS 27.141
CS 27.143
CS 27.395
CS 27.571
Information Sources
CS 27.573
CS 27.602
CS 27.603
CS 27.672
CS 27.674
CS 27.691
CS 27.903
CS 27.991
CS 27.1353
CS 27.1461
CS 29.55
CS 29.59
CS 29.61
CS 29.62
CS 29.77
CS 29.79
CS 29.83
CS 29.87
CS 29.141
CS 29.143
CS 29.395
CS 29.547
CS 29.573
CS 29.602
CS 29.672
CS 29.674
CS 29.691
CS 29.903
CS 29.908
CS 29.917
CS 29.923
CS 29.991
CS 29.1303
CS 29.1309
CS 29.1331
CS 29.1353
CS 29.1355
CS 29.1461
CS 29.1517
6.1.5.6 Pilot induced oscillations.

It shall be verified that there are no pilot induced oscillation (PIO) tendencies
Note that:
a. PIO (also known as aircraft-pilot coupling (APC)) is an interaction between a pilot and aircraft that
causes sustained aircraft oscillations to occur over a range of amplitudes and frequencies.
b. Such oscillations can occur about each of the aircraft's directional axes (longitudinal, lateral and
normal), and as such oscillations about each axis should be considered..
c. Oscillations can occur in stable, straight and level flight, or while performing a manoeuvre such as a
banked turn or a descent

a. The effect of control surface movement and trim settings when determining the presence of PIO
tendencies.
b. Variations in other aircraft parameters such as the aircraft's moments of inertia (mass and Centre of
Gravity) and the engine(s) thrust vector (magnitude and direction of thrust).

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.1.6 Def-Stan 00-970
ADS-33-PRF section 3.1.16 Reference:
JSSG 2001B section C.3.7 STANAG
MIL-HDBK-516C 6.1.5.6 Reference:
FAA Doc: EASA CS
Reference:
6.1.5.7 Residual oscillations.

It shall be verified that residual oscillations characteristics are safe.
Note that:
a. Residual oscillations are the oscillations in aircraft movement following completion of a manoeuvre.
b. Such oscillations can occur about each of the aircraft's directional axes (longitudinal, lateral and
normal).

a. Oscillation about each aircraft axis both in isolation and in combination.
b. Variations in other aircraft parameters such as the aircraft's moments of inertia (mass and Centre of
Gravity) and the engine(s) thrust vector (magnitude and direction of thrust).

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.1.7 Def-Stan 00-970 00-970 P1 S2.21.8
ADS-33-PRF section 3.1.17 Reference: 00-970 P1 S2.22.1
JSSG 2001B Appendix C.3.8 00-970 P1 S2.22.7
MIL-HDBK-516C 6.1.5.7 00-970 P1 S2.25.14
00-970 P1 S2.25.45
00-970 P1 S2.25.50
00-970 P7 L600 S11.7.1
Information Sources
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.5.8 Ride qualities.

The aircraft ground handling/ride qualities characteristics shall be safe.
Consideration should be given to the following:

a. All specified mission environments including prepared, unprepared, sloping ground, wet, snow,
ice...etc. conditions;
b. All normal and abnormal centre-of-gravity locations for realisable fuel states during taxi, take-off, and
landings;
c. Potential failure conditions (weight on wheel normal and failed conditions);
d. Positive steering control, including Steering/ Directional control with the nose wheel remaining on the
ground whether using nose wheel steering, differential braking or asymmetric thrust;
e. Steering sensitivities;
f. Steering fade in/out;
g. Ground control paths;
h. The ability to taxi through 360 degrees with the nose wheel remaining on the ground whether using
nose wheel steering, differential braking or asymmetric thrust;
i. Determination of safe field lengths for take-off (including rejected take-off) and landing;
j. Controllability whilst taxiing in crosswinds;
k. Ability to withstand heavy landing / shock loading;
l. Use of transportation equipment (UAS);
m. Effects on control surfaces of ground gusts and taxiing down-wind;
n. Dynamic Roll Over;
o. Ground Resonance;
p. Embarked operations.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.1.8 Def-Stan 00-970 00-970 P1 2.3.18
MIL-HDBK-516C 6.1.5.8 Reference: 00-970 P1 2.3.19
00-970 P1 2.3.20
STANAG 4671.55(c)
Reference: 4671.75
4671.231
4671.233
4671.235
4671.249
4671.415
Information Sources
CS 23.235
CS 23.237
CS 23.239
CS 23.499
CS 23.749
CS 25.231
CS 25.233
CS 25.235
CS 25.237
CS 25.239
CS 25.499
CS 25.745
CS 27.231
CS 27.235
CS 27.239
CS 27.241
CS 29.231
CS 29.235
CS 29.239
CS 29.241
6.1.6 Longitudinal flying qualities

6.1.6.1 Longitudinal response to the pitch controller.
It shall be verified that the longitudinal response to the pitch controller is safe.
Specific aspects that should be considered include:
a. Lower-order equivalent system dynamics (including phugoid dynamics and short-period dynamics);
b. Time response of the pitch controller;
c. Frequency response of the pitch controller;
d. Closed-loop analysis with a pilot model;
e. Pilot Induced Oscillations (PIO);
f. Normal acceleration at the pilot station;
g. Adequacy of longitudinal control power;
h. Safety of longitudinal control forces and displacements.

a. The effect of variations in flight dynamics of pitch controlling flight surfaces (e.g. the angle-of-attack of
wing surfaces, airspeed, etc.) and other pitching moments (e.g. the engine thrust vector).

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.2.1 Def-Stan 00-970 00-970 P7 L601 S2.3
Information Sources
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.6.2 Longitudinal response to the designated flight path controller.

It shall be verified that the longitudinal response to the designated flight path controller is safe.

a. The effect of variations in flight dynamics of pitch controlling flight surfaces (e.g. the angle-of-attack of
wing surfaces, airspeed, etc.) and other pitching moments (e.g. the engine thrust vector).

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516C 6.1.6.2 Def-Stan 00-970 00-970 P7 L601 S2.3
Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.7 Lateral-directional flying qualities.

Directional flying qualities (i.e. bank and yaw qualities) shall be defined and assessed for safety of flight.

a. The assessment of handling qualities for bank and yaw both separately and together. Rotation about
the longitudinal aircraft axis (bank) often induces rotation about the normal aircraft axis (yaw) and vice-
versa (i.e. adverse yaw).
b. Variations in flight configurations. Variation in the aircraft's moments of inertia (mass and Centre of
Gravity) and engine thrust settings will have an effect on the directional handling qualities for example.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.3 Def-Stan 00-970 00-970 P1 S2.8
JSSG 2001B section 3.3.11.1 Reference: 00-970 P5 UK25.147a 00-970
MIL-HDBK-516C 6.1.7 P7 L602
STANAG
Information Sources
Reference:
CS 27.143
CS 29.143
6.1.7.1 Lateral-directional modal characteristics.

Oscillatory directional flying qualities shall be assessed for safety of flight.

a. Handling qualities for bank and yaw both separately and together. Rotation about the longitudinal
aircraft axis (bank) often induces rotation about the normal aircraft axis (yaw) and vice-versa (i.e. adverse
yaw).
b. Variations in flight configurations. Variation in the aircraft's moments of inertia (mass and Centre of
Gravity) and engine thrust settings will have an effect on the directional handling qualities for example.
c. The frequency and amplitude of flight handling oscillatory characteristics including other oscillatory
aircraft characteristics (such as fuel sloshing, cargo movement, pilot/auto-pilot inputs etc.). Oscillations
should have a frequency sufficiently different so as not to induce resonance.

Information Sources
Comm'l Doc:
including 5.2.3.1.1-5.2.3.1.5. Reference:
ADS-33-PRF, 3.4.9 STANAG
MIL-HDBK-516C 6.1.7 Reference:
FAA Doc: EASA CS
Reference:
6.1.7.2 Lateral-directional dynamic response characteristics.

The aircraft's dynamic response to directional inputs shall be defined and assessed as safe.

a. Combinations of yaw and bank inputs. Yaw and bank outputs should be considered for yaw inputs,
bank inputs and yaw and bank inputs concurrently.
b. Instantaneous inputs. Both small and large instantaneous inputs should be considered.
c. Progressive inputs.
d. Oscillatory inputs, at a variety of frequencies and amplitudes to ensure that resonance can be suitably
prevented.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.3.2 Def-Stan 00-970 00-970 P1 S2.8
including 5.2.3.2.1-5.2.3.2.8 Reference: 00-970 P5 UK25.147a 00-970
ADS-33-PRF sections 3.3.2, P7 L602
3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, STANAG
3.4.6, 3.4.7 and 3.4.8 Reference:
JSSG 2001B section 3.3.11.1
MIL-HDBK-516C 6.1.7.2
CS 27.143
CS 29.143
6.1.7.3 Roll PIO.

PIO in roll shall be prevented.

a. Direct and Indirect sources of roll. All inputs that can lead to a roll output should be considered (e.g.
ailerons, asymmetric spoilers/airbrakes, rudder etc.) to ensure that all potential sources of PIO in roll are
assessed.
b. Oscillating pilot inputs. A suitable variety of control input frequencies and magnitudes should be
considered to ensure that PIO in roll is suitably prevented.

Information Sources
Comm'l Doc:
MIL-HDBK-516C 6.1.7.3 STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.7.4 Yaw PIO.

PIO in yaw shall be prevented.

a. Direct and Indirect sources of yaw. All inputs that can lead to a yaw output should be considered (e.g.
elevators, horizontal tail-plane (or all-moving tail-plane), canards, engine thrust vector, etc.) to ensure that
all potential sources of PIO in roll are assessed.
b. Oscillating pilot inputs. A suitable variety of control input frequencies and magnitudes should be
considered to ensure that PIO in yaw is suitably prevented.
Information Sources
Comm'l Doc:
Reference:
FAA Doc: EASA CS
Reference:
6.1.7.5 Lateral-directional dynamic response characteristics.

The effectiveness of the pilot's control of roll shall be safe.

a. Direct and Indirect sources of roll. All inputs that can lead to a roll output should be considered (e.g.
ailerons, asymmetric spoilers/airbrakes, rudder etc.) to ensure that all potential sources of roll are
considered.
b. Concurrent application of multiple inputs. Where it is possible for more than one source of roll to be
applied by the pilot concurrently, the concurrent application of the sources should be considered.
c. Failures. For failures or other events that could reasonably occur in service that could affect the pilot's
effective control of roll (for example the asymmetric jettison of stores or asymmetric failure of flight control
surfaces) the effect of the event on the pilot's ability to control the aircraft should be considered.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 sections 5.2.3.5 Def-Stan 00-970 00-970 P1 S2.8
including 5.2.3.5.1-5.2.3.5.3 Reference: 00-970 P5 UK25.147a 00-970
JSSG 2001B section 3.3.11.1 P7 L602
Reference:
CS 27.143
CS 29.143
6.1.7.6 Lateral-directional control with speed changes.

Directional control of the aircraft shall be safe despite changes in the aircraft's speed.

a. Varying flying conditions. Directional control should be maintained through changes in speed in both
straight and level flight, and through pitch, roll and yaw manoeuvres.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.3.6 Def-Stan 00-970 00-970 P1 S2.8
including 5.2.3.6.1 Reference: 00-970 P5 UK25.147a 00-970
ADS-33-PRF section 3.4.8.4 P7 L602
JSSG 2001B section 3.3.11.1 STANAG
CS 27.143
CS 29.143
6.1.7.7 Yaw control forces in wave-off (go-around).

Yaw control forces during wave-off/go-around shall be safe.

a. The effect of side-winds expected in service.
b. The effect of asymmetric flying control surfaces that could be reasonably be anticipated in service.
c. The effect of asymmetric thrust due to the failure of one or more engines (as would be reasonably
anticipated in service).

Information Sources
Comm'l Doc:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.7.8 Lateral-directional control forces and displacements.

Forces and Displacements induced in the directional controls shall be assessed as safe.

a. The pilot's ergonomic environment. Considerations may include the dimensions of the cockpit/flight-
deck, seat position(s), positions of controls, the effect of any equipment that may be added/removed such
as ballistic protection, etc.
b. Variations in pilots' anthropomorphic dimensions. Ranges of anthropomorphic dimensions considered
should reflect the variation in sizes of aircrew anticipated to pilot the aircraft in service.
c. Clothing and Aircrew Equipment Assemblies (e.g. helmets, respirators, Chemical, Biological,
Radiological and Nuclear (CBRN) equipment, etc.).
d. The magnitude and direction of control input forces, reflecting the strength of aircrew anticipated to pilot
the aircraft in service.
e. Both instantaneous application of control forces as well as progressive application.

Information Sources
Comm'l Doc:
including sections 5.2.3.8.1 - Reference: 00-970 P1 S4.19.2
5.2.3.8.6 00-970 P7 L600 S10.1.4
ADS-33-PRF section 3.6
STANAG
JSSG 2001B section 3.4.3
Reference:
MIL-HDBK-516C 6.1.7.8
CS 27.151
CS 29.151
6.1.7.9 Steady sideslips.

The steady sideslips that the aircraft can undergo shall be assessed as safe.

a. Altitude and yaw angles. Safety of sideslips should be assured through the range of aircraft attitudes
where steady sideslip can occur, considering a variety of pitch, roll and yaw angles.
b. Aircraft configuration. The effect of variation in aircraft configuration (such as moments of inertia,
engine thrust, flap setting, etc.) should be considered.

Information Sources
Comm'l Doc:
including sections 5.2.3.9.1 - Reference: 00-970 P5 UK25.349a
5.2.3.9.4 00-970 P7 L602 S3
ADS-33-PRF section 3.4.10
STANAG
MIL-HDBK-516C 6.1.7.9
Reference:
FAA Doc: EASA CS
Reference:
6.1.7.10 Lateral-directional control in crosswinds.

Directional control and safety of flight shall be assured for crosswinds up to the limit(s) detailed in the
aircraft specification and/or through the wind vectors (magnitudes and directions/azimuths) detailed in the
aircraft specification.

a. The definition of limits. In specifying the limits for crosswinds, it may be more appropriate to prescribe a
single magnitude crosswind limit, where the wind vector is assumed to be acting perpendicular to the
aircraft's heading, or to prescribe a vector-plot of allowable wind-speed magnitudes and directions. The
former approach is typically more appropriate for fixed wing aircraft where the crosswind magnitude is
relatively small in comparison to the aircraft's airspeed while the latter approach is typically more
appropriate to rotary wing aircraft where the aircraft's airspeed can be much smaller (for example in hover
or approach to land).
b. Flight configuration. Variation in the aircraft's moments of inertia (mass and Centre of Gravity) and
engine thrust settings will have an effect on the directional handling qualities for example.

Information Sources
Comm'l Doc:
including 5.3.2.10.1-5.2.3.10.3. Reference: 00-970 P1 S2.5.23
ADS-33-PRF section 3.9.3 00-970 P1 S2.22.28-2.22.32.
Reference:
CS 29.143
6.1.7.11 Lateral-directional control with asymmetric thrust.

Directional control and safety of flight shall be assured for asymmetric thrust.

a. Instantaneous and progressive thrust asymmetry. Thrust asymmetry can have a variety of causes; for
example total or partial failure can cause an engine to produce less thrust than other engines, or throttle
settings can purposefully create differences in thrust. Progressive asymmetry should therefore be
considered in addition to instantaneous asymmetry.
b. Increases in drag caused by a 'wind-milling' or stopped engine. For propeller engines, the ability to
feather the propellers should not be assumed.
c. Engine criticality. Often, compliance is shown for the failure of the 'critical engine' only. Since the
engines installed on an aircraft often have the same thrust capabilities and drag characteristics, the
engine whose failure causes the greatest thrust asymmetry is generally the furthest outboard.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.3.11 Def-Stan 00-970 00-970 P1 S2.14.
Reference:
6.1.7.12 Wings-level turn.

The performance of a wings-level turn using the yaw controller should be assessed as safe.

a. Turn co-ordination. Generally, the introduction of yaw in forward flight to turn an aircraft would cause
the aircraft to bank due to the greater airspeed of the wing on the outside of the turn (causing a wing-up
moment) and the lesser airspeed of the wing on the inside of the turn (causing a wing-down moment).
The performance of a wings-level turn may therefore require preventative control of roll.

Information Sources
Comm'l Doc:
Reference:
FAA Doc: EASA CS
Reference:
6.1.7.13 Lateral translation.

Lateral translation of the aircraft shall be assessed as safe.

a. All sources of lateral velocities and accelerations, including:
(1) The introduction of lateral accelerations along the aircraft due to the yawing motion of flight
manoeuvres.
(2) Lateral velocities alongside a significant longitudinal velocity (i.e. slight lateral translation in forward
flight).
(3) Lateral velocities without a significant longitudinal velocity (i.e. lateral translation when in hover).

Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797 section 5.2.3.13 Def-Stan 00-970 00-970 P7 L602
Reference:
FAA Doc: EASA CS
Reference:
6.1.8 Cross-axis responses.

The aircraft's cross-axis responses to control inputs shall be defined and assessed for safety of flight.
This shall include (but is not limited to):
a. Definition and assessment of longitudinal (roll) control forces in sideslip flight.
b. Definition and assessment of directional (roll and yaw) control forces in dive and pull-out flight.
c. Definition and assessment of all cross-axis control forces in roll manoeuvres.
d. Definition and assessment of Pitch and Roll control crosstalk (i.e. the movement of the pitch controller
inducing a roll and movement of the roll controller inducing a pitch change).
e. Definition and assessment of the aircraft's 'Control Harmony' (the balancing of control input forces) to
ensure that required input forces are not disproportionate from one axis control to another.
f. Definition and assessment of control cross-coupling safety.

a. The force that can be applied at each of the aircraft's controls and the force required for a given level of
control output--forces should be balanced proportionately. The strength of pilots (and the variation in that
strength) should therefore also be considered.

Information Sources
Comm'l Doc:
including sections 5.2.4.1- Reference:
5.2.4.6 STANAG
ADS-33-PRF section 3.3.9
Reference:
and 3.4.5
MIL-HDBK-516C 6.1.8
FAA Doc: EASA CS
Reference:
6.1.9 High angle-of-attack.

The aircraft's flight at high angles of attack shall be assessed and confirmed as safe..
a. The adequacy of pilot warning(s) when approaching a stall.
b. Aircraft stability and safety of flight when approaching a stall.
c. Aircraft stability and safety of flight during a sustained stall.
d. Aircraft stability and safety of flight through stall prevention measures and through recovery from a
stall.
e. Aircraft stability and safety of flight through any departures from controlled flight.
f. Aircraft stability and safety of flight through the recovery from post-stall gyrations and spins.

a. The existing crew workload and any other distractions that may prevent the crew from realising that
they are approaching or are in a stall, when considering the adequacy of pilot warnings.
b. The amount of time and altitude required to recover from a stall, considering the type of aircraft and the
likely manoeuvres that it will perform in service.
c. The failure of sensors or other devices that are required for stall warning, prevention or recovery.

Information Sources
Comm'l Doc:
including sections 5.2.5.1- Reference:
5.2.5.6 STANAG
MIL-HDBK-516C 6.1.8
Reference:
FAA Doc: EASA CS
Reference:
6.1.10 Shipboard operations.

Shipboard operations shall be assessed for safety of flight.
a. Deck handling.
b. Catapult launches (where specified).
c. Carrier approach and landing.
d. Failed arrest (bolter).
e. Go around (wave-off).
f. Engine failure (of multi-engine aircraft).
g. Launches and recoveries.
h. Permitted wind envelopes.
i. Vertical launch and recovery of multiple aircraft at adjacent spots.
j. Adequacy of visual cues at planned spots at day and night both with and without the aid of Night Vision
Devices (NVDs).
k. The effect of the ship's air-wake.
l. The effect of the aircraft's control law modes.
m. Run-on landings.
n. Pilot workload.
o. The motion of the ship and the application of suitable limits for operation.
p. Use of ship-assisted recovery devices.
q. Vertical replenishment and other externally slung loads.
r. Rotorcraft performance in ship motion and ship air-wake conditions.

a. The aircraft states and configurations where shipborne operations may occur.
b. The characteristics of the different ships where shipborne operations may occur and their effect on the
aircraft's safety of flight.

design, test, or configuration documentation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B 3.4.8 Def-Stan 00-970 00-970 P7 L606 S3
MIL-HDBK-516C 6.1.10 Reference:
including 6.1.10.1-6.1.10.18 STANAG 4671.1194
Reference:
FAA Doc: EASA CS
Reference:
6.1.11 Vertical/Short Take-Off and Landing (V/STOL) aircraft.

Where applicable, V/STOL characteristics shall be defined and assessed for safety of flight.
a. Ensuring that V/STOL operations are safe, specifically;
i. Ensuring that Short Take-Off (STO) is safe.
ii. Ensuring that Vertical Take-Off (VTO) is safe.
iii. Ensuring that any V/STOL shipboard recovery pattern is safe.
iv. Ensuring that V/STOL powered-lift landing is safe.
v. Ensuring that hover is safe.
vi. Ensuring that V/STOL vertical landing is safe.
vii. Ensuring that V/STOL ground handling is safe.
viii. Ensuring that V/STOL transition/conversion is safe.
iv. Ensuring that V/STOL hovering translation is safe.
b. Ensuring that V/STOL dynamic flight handling characteristics are safe, specifically;
i. Flying qualities in pitch, roll and yaw axes and in normal/vertical, longitudinal and lateral translation
including cross-axis coupling and angular control.
ii. Flying qualities in the transition region..

a. The aircraft states and configurations where V/STOL operations may occur.
b. The effect that different landing conditions may have on the safety of the aircraft (e.g. shipborne
operations, landing in dust, snow etc.).

Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: MIL-HDBK-516C 6.1.11 Def-Stan 00-970 00-970 P1 S2.19
including 6.1.11.1-6.1.11.2 Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.12 Characteristics of the primary flight control system

6.1.12.1 Transfer to alternate control modes.
Transfer to and from alternate control modes shall be verified as safe.

a. The aircraft states and configurations where transfer between modes may occur.
b. The change of the control/handling input/output ratio from one mode to another, the required change in
control inputs by the pilot(s) to compensate and the effect of a pilot not realising that the control mode has
changed.
c. The effect of transfer of control mode when performing a manoeuvre or in a critical flight phase.

Information Sources
Comm'l Doc:
Reference: 00-970 P1 S4.10.11
00-970 P1 S4.10.13
00-970 P1 S4.10.23
00-970 P1 S4.10.24
00-970 P7 L903 S7.8.2
00-970 P7 L904 S7.5.2
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.1.12.2 Augmentation systems.

Augmentation systems shall be verified as safe.

a. The change of the control/handling input/output ratio if the characteristics of the augmentation system
were to alter of fail, the required change in control inputs by the pilot(s) to compensate and the effect of a
pilot not realising that a change has occurred.
c. The effect of failure or alteration of the augmentation system when performing a manoeuvre or in a
critical flight phase.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 S4.10.11
00-970 P1 S4.10.12
00-970 P1 S4.10.13
00-970 P1 S4.10.23 00-970 P7
L600 S8.2.1
00-970 P7 L600 S8.2.3
00-970 P7 L601 S4.2.1
00-970 P7 L602 S4.2.1
00-970 P7 L903 S7.8.2
00-970 P7 L904 S7.5.2
STANAG
Reference:
CS 27.672
CS 29.672
6.1.12.3 Cockpit controller characteristics.

The characteristics of the pilots' controllers shall be verified as safe.

a. The change of the control/handling input/output ratio if the characteristics of the augmentation system
were to alter of fail, the required change in control inputs by the pilot(s) to compensate and the effect of a
pilot not realising that a change has occurred.
c. The effect of failure or alteration of the augmentation system when performing a manoeuvre or in a
critical flight phase.

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B Section 3.4.3.1.5 Def-Stan 00-970 00-970 P7 L600 S9
MIL-HDBK-516C 6.1.12.3 Reference: 00-970 P7 L600 S10
STANAG
Reference:
CS 27.671
CS 29.671
6.1.12.4 Displays and instruments.

The pilots' displays and instruments shall be verified as safe.

a. The physical aspects of the displays and instruments and their installation, including design,
construction and integration with other aircraft systems (e.g. electrical supply).
c. The Human-Machine-Interface and the displays and instruments ability to adequately convey the
information most relevant to the continued safe flight of the aircraft.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797A section Def-Stan 00-970
5.2.8.4 Reference:
JSSG 2001B Section 3.4.3.1.5 STANAG 4671.1301
MIL-HDBK-516C 6.1.12.4 Reference: 4671.1309
4671.1329
4671.1331
4671.U1721
4671.U1722
4671.U1723
4671.U1725
4671.U1726
4671.U1727
4671.U1728
4671.U1729
4671.U1730
CS 23.1305
CS 23.1309
CS 23.1311
CS 23.1321
CS 23.1322
CS 23.1323
CS 23.1325
CS 23.1326
CS 23.1327
CS 23.1329
CS 23.1331
CS 23.1335
CS 23.1337
CS 25.1301
CS 25.1302
Information Sources
CS 25.1303
CS 25.1305
CS 25.1309
CS 25.1321
CS 25.1322
CS 25.1323
CS 25.1325
CS 25.1326
CS 25.1327
CS 25.1329
CS 25.1331
CS 25.1333
CS 25.1337
CS 27.1301
CS 27.1303
CS 27.1305
CS 27.1309
CS 27.1321
CS 27.1322
CS 27.1323
CS 27.1325
CS 27.1327
CS 27.1329
CS 27.1335
CS 27.1337
CS 29.1301
CS 29.1303
CS 29.1305
CS 29.1309
CS 29.1321
CS 29.1322
CS 29.1323
CS 29.1325
CS 29.1327
CS 29.1329
CS 29.1331
CS 29.1333
CS 29.1335
CS 29.1337
6.1.13 Characteristics of secondary flight control systems

6.1.13.1 Trim system.
The aircraft's trim system shall be verified as safe.

a. Flight configurations and aircraft states where prolonged corrective/preventative control system input
could be required by the pilot, and therefore where a trim system would be beneficial, including:
i. Thrust asymmetry (e.g. due to an engine failure), including effects of a vertically displaced engine (e.g.
the Trident, 727 or DC-10),
ii. Longitudinally displaced centres of gravity (e.g. due to longitudinally displaced fuel, cargo, personnel)
iii. Laterally displaced centres of gravity (e.g. due to laterally displaced fuel, cargo, personnel)
iv. Asymmetric drag (e.g. due to missing non-essential panels, landing gear failed in the extended
position or asymmetric external stores)
b. The aircraft's ability to perform required manoeuvres with the aircraft trimmed correctly.
c. Requirements to trim the aircraft in the longitudinal (roll), lateral (pitch) and normal (yaw) axes.
d. The increased longitudinal trim required in transonic and supersonic flight regimes, correcting Mach-
tuck.
e. The performance assessment of the aircraft with the combination of trim functions, including degraded
modes.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797A section Def-Stan 00-970 00-970 P1 S2.6.21
5.2.9.1 Reference: 00-970 P1 S2.6.22
MIL-HDBK-516C 6.1.13.1 00-970 P1 S2.8.20
00-970 P1 S2.8.21
00-970 P1 S2.8.22
00-970 P7 L903 S7.4.1
00-970 P7 L903 S7.8
00-970 P7 L904 S7.5
STANAG 4671.161
Reference: 4671.677
CS 27.161
CS 29.161
6.1.13.2 Operation of secondary control devices and in-flight configuration changes.

The operation of secondary control devices and the in-flight change of aircraft configuration shall be
assessed as safe.

a. The operation of all secondary control devices both separately and together where the devices may be
operated concurrently. Secondary control devices are used to influence the performance of the aircraft
but are not the primary surfaces used for aircraft manoeuvres. Secondary control devices may include
(but are not limited to):
i. Spoilers,
ii. Flaps,
iii. Slats,
iv. Air brakes.
b. All sources of change in aircraft configuration that could occur in-flight, including.
i. Displacement of Centre of Gravity (e.g. due to movement of fuel, cargo, passengers, etc.),
ii. Changes in the aircraft's external surfaces (e.g. due to the opening of cargo doors, bomb-bay doors,
landing bay doors, jettison of external stores, etc.)

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797A section Def-Stan 00-970 00-970 P1 S4.10.14 - 4.10.21
5.2.9.2 Reference: 00-970 P7 L600 S9.6
MIL-HDBK-516C 6.1.13.2 STANAG 4671.161
Reference: 4671.677
6.1.13.3 Auxiliary dive recovery devices.

Auxiliary dive recovery devices shall be verified as safe.

a. The loads induced through the airframe when operating a dive recovery device. This shall consider at
least:
i. The airspeeds that may be encountered during a dive and the resulting airframe loads,
ii. The operation of a dive recovery device both in isolation and together with other pitch control devices,
iii. The effect that a dive recovery device may have on the aircraft's roll control (in the event that the
device is operated during a spiral dive before wings-level flight is achieved),
iv. The effect that a dive recovery device may have on the location of centre of lift, including effects at
transonic and supersonic airspeeds (e.g. Mach-tuck).
b. The lower and upper limits of vertical airspeed/rate of descent, airspeed, roll-rate and normal
acceleration (g) where the dive recovery device should be operated.

Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797A section Def-Stan 00-970 00-970 P1 S4.10.20
5.2.9.3 Reference:
Reference:
FAA Doc: EASA CS
Reference:
6.1.14 Rotorcraft unique criteria.

Aspects of flight unique to rotorcraft shall be assessed as safe. This shall include but is not limited to:
a. Translational rate response (sideways cyclic control),
b. Vertical axis response in hover (collective and throttle control/governance),

c. Hover in winds (in all aircraft axes of translation and rotation),
d. Position hold (in all aircraft axes of translation and rotation),
e. Rotor speed response (throttle control/governance),
f. Engine torque response,
g. Slope landing and take-off characteristics,
h. Ground operation,
i. Carriage, release and jettison of external slung loads,
j. Water landing characteristics,
k. Autorotation.

a. Characteristics that could affect the safety of the rotorcraft,
b. Characteristics that should be considered desirable for the pilot(s) ease of handling,

Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-33-PRF sections 3.3.1, Def-Stan 00-970 00-970 P7: Rotorcraft
3.3.10.1, 3.3.10.2, 3.3.10.3, Reference: Supplement 2: Flight (Subpart
3.3.10.4, 3.3.11, 3.4.3.3, B)
3.4.5.1.3, 3.7.2, 3.7.3, 3.9.1, STANAG
3.9.2, 3.9.3, 3.9.4.1, 3.10 Reference:
MIL-HDBK-516C 6.1.14
including 6.1.14.1-6.1.14.11
FAA Doc: EASA CS CS 27 Subpart B - Flight
Reference: CS 29 Subpart B - Flight
6.1.15 Manuals.
Technical Publications including Flight, Performance and Operations Manuals and any supplements shall
contain the aircraft's operating limits and instructions to assure flight safety of the aircraft.

a. All of the aircraft's defined conditions, configurations, load-outs etc.
b. Cautions, Warnings, Advisories, Notes, Corrective Actions and other relevant pilot information.

1. Aircraft Flight Manual and other technical publications as appropriate which include the aircraft's
operating limits and suitable operating instructions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 S7
Reference:
STANAG
Information Sources
Reference:
CS 23.1585
CS 23.1587
CS 23.1589
CS 25.1581
CS 25.1583
CS 25.1585
CS 25.1587
CS 25.1591
CS 25.1593
CS 27.1581
CS 27.1583
CS 27.1585
CS 27.1587
CS 27.1589
CS 29.1581
CS 29.1583
CS 29.1585
CS 29.1587
CS 29.1589
6.2 VEHICLE CONTROL FUNCTIONS (VCF).
6.2.1 VCF architecture design.

6.2.1.1 Functional criteria.
The design of the aircraft VCF, including its sub-systems, shall be shown to be safe within the required
performance envelope.

a. Definition of the required aircraft performance envelope;
b. Definition of the required aircraft safety levels and safety requirements of enabling systems;
c. Development of Test & Acceptance Plans or Validation & Verification Plan to record how the
equipment, sub-system, system and aircraft level safety requirements are to be demonstrated;
d. Successful demonstration of achieved safety requirements (e.g. Test & Acceptance Report or
Validation & Verification Report).

1. Document recording aircraft performance requirements (e.g. Top Level Aircraft Requirements
Document);
2. Aircraft Loss Model;
3. Failure Mode and Effects Analysis (FMEA) / Failure Modes, Effects and Criticality Analysis (FMECA);
4. Test and & Acceptance Report or Validation & Verification Report.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3 thru 3.8, 4 thru Def-Stan 00-970 00-970 P1 2.15
4.8 Reference: 00-970 P1 2.16
MIL-HDBK-516C 6.2.1.1 00-970 P1 3.9
00-970 P1 3.10
00-970 P1 6.6
00-970 P1 6.11
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1
STANAG 4671.685
Reference: CS 23.321-23.459
CS 23.1309
CS 23.1501-23.1529
CS 25.143-25.255
CS 25.321-25.459
CS 25.689
CS 25.1309
CS 27.141-27.251
CS 27.321-27.447
CS 27.1309
CS 27.1501-27.1529
CS 29.141-29.251
CS 29.321-29.427
CS 29.1309
CS 29.1501-29.1529
6.2.1.2 High-level architecture function.

Aspects of the VCF critical to the safe operation of the aircraft shall incorporate sufficient and appropriate
risk mitigations to allow graceful degradation and interface with other systems to ensure power is
available for continued safe operation.

a. The following failure mitigation approaches:
i. Failure Absorption;
ii. Cross lane monitoring/voting and failure rejection;
iii. Lane self-monitoring and failure rejection.
b. The appropriate use of redundant and fail-safe designs in systems.

Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: JSSG 2008 3.1.7 - 3.1.7.3, Def-Stan 00-970 00-970 P1 6.6.18
4.1.7 - 4.1.73 Reference: 00-970 P1 6.11.3
MIL-HDBK-516C 6.2.1.2 00-970 P1 6.12.2
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1
STANAG 4671.1309
4671.1412
4671.1413
CS 25.1310
CS 27.1309
CS 29.1309
CS 25.671*
CS 25.672*
*(unverified-Dutch 516)
6.2.1.3 Safety critical functions and components.

The VCFs shall have appropriate levels of risk mitigations typically achieved through separation,
redundancy, fault tolerance and self-test to prevent any unsafe function resulting in a loss of control.

a. The appropriate use of redundant and fail-safe designs in systems;
b. The use of Built-In Test (BIT) functions;
c. The failure of software elements.

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 2.14.19
3.1.11-3.1.11.2, 4.1.11- Reference: 00-970 P1 2.15.17
4.1.11.2 00-970 P1 4.4.7
MIL-HDBK-516C 6.2.1.3
00-970 P1 4.4.46
00-970 P1 6.2.33
00-970 P1 6.5.29
00-970 P1 6.5.33
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1
00-970 P7 L725 3.2.1
STANAG 4671.1309
Information Sources
4671.1490
CS 27.1309
CS 29.1309
6.2.1.4 Integration of functions.

Each aspect of the VCF (such as flaps, trim, auto-stabilisers, hydraulics) shall be suitably separated and
protected to ensure graceful degradation of the VCF in the presence of failures and combination of
failures.


Document);
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.1.1 - 3.1.4, 4.1.1 Def-Stan 00-970 00-970 P1 2.6.25
- 4.1.4 Reference: 00-970 P1 2.8.25
MIL-HDBK-516B 6.2.1.4 00-970 P1 2.14.16
00-970 P1 2.14.24
00-970 P1 2.15.9
00-970 P1 2.15.11
00-970 P1 2.15.12
00-970 P1 2.15.13
00-970 P1 2.15.14
00-970 P1 2.15.15
00-970 P1 2.15.17
00-970 P1 2.15.20
00-970 P1 2.15.21
00-970 P1 2.15.23
00-970 P1 2.15.24
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1
Information Sources
STANAG 4671.459
Reference: 4671.701
CS 25.672
CS 27.672
CS 29.672
CS 25.671*
CS 25.672*
6.2.1.5 Failures.
No single failure, dual failure or reasonably credible combination of failures of the VCF (including AFCS if
applicable) shall result in an unacceptable Probability of Loss of Control (PLOC).


Document);
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 6.5.33
3.1.11-3.1.11.2, 4.1.11- Reference: 00-970 P1 6.6.2
4.1.11.2 00-970 P5 UK25.671a
MIL-HDBK-516B 6.2.1.6
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1
00-970 P7 L604 20.1.5
STANAG 4671.1309
Reference:
CS 27.1309
CS 29.1309
CS 25.671*
CS 25.672*
Information Sources
6.2.1.6 Reliability and redundancy.

The level of VCF redundancy and reliability shall be appropriate for the aircraft's size category and
planned operational area/airspace.

a. Definition of the aircraft's size category;
b. The aircraft's planned operational area/airspace in both civil and military operations or combat and
non-combat roles;
c. Definition of the required aircraft safety levels and safety requirements of enabling systems;
d. Development of Test & Acceptance Plans or Validation & Verification Plan to record how the
e. Successful demonstration of achieved safety requirements (e.g. Test & Acceptance Report or

1. Document recording aircraft requirements (e.g. Top Level Aircraft Requirements Document);
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 S2.15
3.1.11-3.1.11.2, 4.1.11- Reference: 00-970 P1 S2.16
4.1.11.2 00-970 P1 S3.9
MIL-HDBK-516C 6.2.1.6
00-970 P1 S3.10
00-970 P1 S6.6
00-970 P1 S6.11
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1
STANAG 4671.1309
FAA Doc: EASA CS CS 23.141 - 23.257
CS 23.1501-23.1529
CS 25.143-25.255
CS 25.321-25.259
CS 25.689
CS 27.141-27.251
CS 27.321-27.247
CS 27.1501-27.1529
CS 29.141-29.251
CS 29.321-29.427
Information Sources
CS 29.1501-29.1529
CS 23 to CS 29 Clause 1309
6.2.1.7 Probability of loss of aircraft (PLOA).

An overall requirement for the allowed PLOA shall be defined and a sub-requirement for the allowed
Probability of Loss of Control (PLOC) for the aircraft. Any estimates and assumptions used in these
requirements shall be adequately substantiated/justified.


Document);
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 S2.15
3.1.11-3.1.11.2, 4.1.11- Reference: 00-970 P1 S2.16
4.1.11.2 00-970 P1 S3.9
MIL-HDBK-516C 6.2.1.7
00-970 P1 S3.10
00-970 P1 S6.6
00-970 P1 S6.11
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1.
STANAG 4671.1309
FAA Doc: EASA CS CS 23.141 - 23.257
CS 23.1501-23.1529
CS 25.143-25.255
CS 25.321-25.259
CS 25.689
CS 27.141-27.251
CS 27.321-27.247
CS 27.1501-27.1529
CS 29.141-29.251
CS 29.321-29.427
Information Sources
CS 29.1501-29.1529
6.2.1.8 In-line fault coverage.

Where systems utilise dual redundancy, the probability of occurrence of all faults that could affect both
systems shall be defined and integrated into the probability of loss of the aircraft.


Document);
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 S 2.15
3.1.11-3.1.11.2, 4.1.11- Reference: 00-970 P1 S2.16
4.1.11.2 00-970 P1 S3.9
MIL-HDBK-516C 6.2.1.8
00-970 P1 S3.10
00-970 P1 S6.6
00-970 P1 S6.11
00-970 P5 UK25.671a
00-970 P7 L600 S3.5.1
00-970 P7 L600 S8.1.1.
STANAG 4671.1309
FAA Doc: EASA CS CS 23.141 - 23.257, 23.321-
Reference: 23.459, 23.1501-23.1529,
25.143-25.255, 25.321-25.259,
25.689, 27.141-27.251,
27.321-27.247, 27.1501-
27.1529, 29.141-29.251,
29.321-29.427, 29.1501-
29.1529
6.2.1.9 Unmanned aircraft (UAV) unrestricted operation

For UAVs cleared for operation in unrestricted airspace, it shall be determined that no single failure of the
UAV System can result in a degraded operational state, or unacceptable increase in the Probability of
Loss of Aircraft (PLOA) or Probability of Loss of Control (PLOC).

a. Definition of the required UAV System performance envelope;
b. Definition of the required UAV System safety levels and safety requirements of enabling systems;
equipment, sub-system, system and UAV System level safety requirements are to be demonstrated;

Document);
2. UAV System Loss Model;
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516C 6.2.1.9 Def-Stan 00-970
Reference:
STANAG 4671.1309
FAA Doc: EASA CS
Reference:
6.2.1.10 UAS degraded operation.

For UAVs cleared for operation in restricted airspace, warning areas, maritime environments and combat
zones, it shall be determined that no single failure of the UAV System can result in an unacceptably
degraded operational state, or unacceptable increase in the Probability of Loss of Aircraft (PLOA) or
Probability of Loss of Control (PLOC).

a. Definition of the required UAV System performance envelope;
b. Definition of the required UAV System safety levels and safety requirements of enabling systems;
equipment, sub-system, system and UAV System level safety requirements are to be demonstrated;

1. Document recording UAV System performance requirements (e.g. Top Level Aircraft Requirements
Document);
2. UAV System Loss Model;
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516C 6.2.1.9 Def-Stan 00-970
Reference:
STANAG 4671.1309
FAA Doc: EASA CS
Reference:
6.2.2 VCF Safety of Design

6.2.2.1 Safety protection functions and devices.
VCF safety provisions (protection functions, devices, procedures, limitations) shall not adversely affect
the safety of the aircraft.

a. Applicable standards (including software) to be agreed and verified
b. Use of an appropriate system safety programme as detailed in Section 14;
c. Compatibility with weapon systems;
d. Safety provisions from both component and software induced faults;
e. Acceptable probabilities of occurrence, to be agreed and verified for;
i. Any failure condition that would prevent the continued safe flight and landing of the aircraft;
ii. Any other failure condition that would significantly reduce the capability of the aircraft or the ability of
the flight crew to cope with adverse operating conditions.
f. Flight envelope protection for UAS.

1. Failure Modes and Effects Analysis (FMEA) / Failure Modes, Effects and Criticality Analysis (FMECA) /
Fault Tree Analysis (FTA) considering the effect of safety provisions, their probability of failure and effect
of failure on the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.5.3, 3.1.5.2, Def-Stan 00-970 00-970 P1 S2.16.41
3.1.5.4, 3.1.9, 3.1.11.1, 3.1.10, Reference: 00-970 P1 S2.16.42
3.1.11.1.1, 3.1.13 to 3.1.13.2, 00-970 P1 S3.10.48
3.1.16, 3.2.2.5.4.1, 3.2.4 thru
00-970 P1 S3.10.86
3.2.4.6, and associated section
4 paragraphs (Note: Unverified 00-970 P1 S6.2.35
- no access to JSSG-2008) 00-970 P7 L700 S1.3
00-970 P7 L725 S4.1
00-970 P9 UK FW.1309b
00-970 P9 UK RW.1309a
00-970 P9 UK LFW.30a
STANAG 4671.1309 (AMC.1309(b))
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 25.1309 (AMC.1309)
23.459, 25.321-25.459, CS 27.1309
23.1501-23.1529, 25.1501-
Information Sources
25.1529 CS 29.1309
6.2.2.2 Flight critical components.

Flight-critical VCF component design shall be demonstrably safe. This includes preventing degradation in
VCF operation from environmental conditions; resisting the formation of fungi; ensuring VCF physical
characteristics do not cause a single point failure by virtue of components design, interfaces nor
integration of functions.

a. Environments conditions (including, humidity, temperature, pressure altitude), to be agreed and
specified;
b. Avoiding pockets, traps, wells, etc., into which water, condensed moisture or other liquids would
collect;
c. Ensuring adequate drain provision;
d. Ensuring drain location adequate to prevent formation of hazardous quantities of ice on the aircraft;
e. Any deleterious effects due to tightening or slackening resulting from differential expansion;
f. Providing sufficient clearance to ensure the efficient operation of all detail fittings, such as jacks,
bearings, guides, fairleads, etc., to be agreed and verified;
g. Withstanding physical, induced, chemical, biological and nuclear stresses.
h. Wherever possible, avoid materials which expand appreciably with moisture for such parts as fairleads
and washers.

Fault Tree Analysis (FTA) considering the VCF components, their probability of failure and effect of failure
on the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.14 thru Def-Stan 00-970 00-970 P1 2.15
3.1.14.9, 4.1.14 thru 4.1.14.9, Reference: 00-970 P1 3.9.24
3.1.15 thru 3.1.18, 4.1.15 thru 00-970 P1 3.9.25
4.1.18, 3.2.3 thru 3.2.3.3, 4.2.3
00-970 P1 3.9.31
thru 4.2.3.3, 3.4 thru 3.5.2, 4.4
thru 4.5.2 (Note: Unverified - 00-970 P1 S6.2.35
no access to JSSG-2008) 00-970 P7 L700 S1.3
00-970 P7 L725 S4.1
00-970 P9 UK FW.1309b
00-970 P9 UK RW.1309a
00-970 P9 UK LFW.30a
STANAG 4671.603
4671.1329(g)
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.321-23.459
23.1501-23.1529, 25.1501-
CS 23.603
25.1529
CS 23.1309
Information Sources
CS 23.1329(g)
CS 25.21
CS 25.143-25.255
CS 25.321-25.459
CS 25.603
CS 25.1309
CS 25.1455
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 27.603
CS 27.1309
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
CS 29.603
CS 29.1309
6.2.2.3 Pre-flight checklists.

Comprehensive and all-inclusive pre-flight checklists shall be established which are sufficient to
determine the flight-worthiness of the VCF. This includes ensuring that pre-flight tests, diagnostics,
redundancy, and monitoring includes all test sequences required to determine the status of the VCF and
integrated systems prior to take-off. It shall also be possible to conduct tests and checklists in a safe
manner, such as to preclude injury.

a. Ensuring that all redundant elements, failure detection and signal selection algorithms, etc., are
correctly functioning;
b. The use of an automatic, or where unavoidable, pilot-interactive pre-flight test function;
c. Ensuring the use of built-in-test (BIT) does not degrade system performance;
d. Ensuring the time to complete pre-flight tests meets the specified requirements, to be agreed and
verified (typically 30 seconds for a complete automatic end to end check of the VCF).
e. Identifying any need for physical and/or visual checks by the pilot or supporting ground crew and the
time and effort that such physical/visual may take to be performed satisfactorily.

1. Design documentation comprehensively detailing the pre-flight checks that are mandated, the type of
check (e.g. automatic failure detection, pilot action, visual check, etc) and a simple risk assessment for
each check.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.12, Def-Stan 00-970 00-970 P1 2.16.49
3.1.13, 3.1.13.1, 3.1.14.7, Reference: 00-970 P1 2.16.50
3.2.2.2, 3.2.2.5, 3.2.2.5.1, 00-970 P1 3.9.54
3.2.2.5.2, 3.2.2.5.3, 3.3.6.2,
00-970 P1 3.10.63
3.7.1, 3.7.1.1, and associated
section 4 paragraphs (Note: 00-970 P1 3.10.69-3.10.71
Information Sources
Unverified - no access to 00-970 P1 6.5.29-6.5.31
JSSG-2008) STANAG 4671.1329(j) (AMC.1329 (j))
Reference:
FAA Doc: 14CFR references: 23.141- EASA CS
23.253, 25.21-25.255, 23.321- Reference:
23.459, 25.321-25.459,
23.1501-23.1529, 25.1501-
25.1529
6.2.2.4 Loss of function.

The effects of loss of VCF function(s) on aircraft safety shall be established. This includes ensuring the
probability of any reasonable credible combination of failures of VCF function(s) are acceptably
improbable.

a. Complete hazard analysis combined with failure modes and effects testing;
b. Acceptable probability of failure limits to be agreed and verified;
c. Where redundancy is employed special care shall be taken to eliminate sources of common-mode
failure.

Fault Tree Analysis (FTA) considering the effect of loss of VCF functions, their probability of failure and
effect of failure on the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0 thru 3.3.8, 4.0 Def-Stan 00-970 00-970 P1 2.16.40-2.16.42
thru 4.3.8 (Note: Unverified - Reference: 00-970 P1 3.9.18
no access to JSSG-2008) 00-970 P1 3.10.28
00-970 P1 3.10.30
00-970 P1 3.10.94
00-970 P1 S6.2.35
00-970 P7 L700 S1.3
00-970 P7 L725 S4.1
00-970 P9 UK FW.1309b
00-970 P9 UK RW.1309a
00-970 P9 UK LFW.30a
STANAG 4671.143-4671.253
4671.1329
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.672
23.1501-23.1529, 25.1501-
CS 23.1309
25.1529
CS 23.1329
CS 25.21
Information Sources
CS 25.143-25.255
CS 25.672
CS 25.1309
CS 25.1329
CS 27.21
CS 27.141-27.251
CS 27.672
CS 27.1309
CS 27.1329
CS 29.21
CS 29.141-29.251
CS 29.672
CS 29.1309
CS 29.1329
6.2.2.5 Functional modes and limiters.

Control law limiters shall achieve the intended limiting for all VCF functions and protect the air crew and
aircraft from unsafe flight. This includes ensuring that no VCF function shall induce conditions that defeat
control law limiters throughout the flight envelope, and during the most adverse conditions the limiters
function in.
Note that control law limiters may consist of structural limiters or filters, angle of attack and sideslip
limiters, data input rate limiters, command limiters, data input max and min limiters, time limiters,
persistence limiters, stale data limiters, and other limiters defined by the application at hand.

a. Establishing what limiters are used and where in the in the control scheme;
b. Any Structural Load Limiting (SLL) implemented in such a manner that the pilot may choose to exceed
these limits in emergency.

1. Aircraft control system design documentation.
2. Flight simulation and flight handling testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.5.2, Def-Stan 00-970 00-970 P1 3.9.32,
3.1.5.8, 3.1.5.9, 3.1.7.2, Reference: 00-970 P1 3.10.104,
3.1.7.3, 3.1.11, 3.1.11.2, 00-970 P1 4.10.8,
3.1.13.1, 3.1.13.3, 3.1.14,
00-970 P1/5 S3 L28 Para 2
3.1.14.7, 3.2.2.2.4, 3.2.2.2.5,
3.2.2.2.9, 3.2.2.2.11, 3.2.2.4, STANAG 4671.375
3.2.2.5.1, 3.2.2.5.1.1 thru Reference: 4671.675
3.2.2.5.1.4, 3.2.2.5.4.1, 3.2.2.6, 4671.1329
3.3.2.1, 3.3.6.2, and
associated section 4
paragraphs (Note: Unverified -
no access to JSSG-2008)
Information Sources
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.321-23.459
23.1501-23.1529, 25.1501-
CS 23.672
25.1529
CS 23.675
CS 23.1329
CS 23.1501-23.1529
CS 25.21
CS 25.143-25.255
CS 25.321-25.459
CS 25.672
CS 25.675
CS 25.1329
CS 25.1501-25.1529
CS CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 27.672, 27.675
CS 27.1329
CS 27.1501-27.1529
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
CS 29.672, 29.675
CS 29.1329
CS 29.1501-29.1529
6.2.2.6 Failure mode and effects.

VCF failure mode effects for critical manoeuvers and critical flight regions shall be demonstrably safe.
This includes ensuring the probability of aircraft or crew loss, or loss of aircraft control resulting from
effects at these critical flight regimes does not adversely affect safety.

a. Specified levels of safety to be agreed and verified.
b. Effects of failure from each function or probable combinations of functions conducted at critical flight
regimes.

Fault Tree Analysis (FTA) considering the effect of loss of VCF functions through critical manoeuvres and
flight regions, their probability of failure and effect of failure on the aircraft.
Information Sources
Comm'l Doc:
3.1.5.7, 3.1.5.8, 3.1.5.9, 3.1.9, Reference: 00-970 P1 3.10.9
3.1.14, 3.2.1.3, 3.2.1.2, 3.2.2.2, 00-970 P1 3.10.28
3.2.2.5, 3.2.2.5.4, 3.2.2.6, 3.3,
00-970 P1 3.10.30
Information Sources
and associated section 4 00-970 P1 S6.2.35
paragraphs (Note: Unverified - 00-970 P7 L700 S1.3
00-970 P7 L725 S4.1
00-970 P9 UK FW.1309b
00-970 P9 UK RW.1309a
00-970 P9 UK LFW.30a
STANAG 4671.1329
Reference:
FAA Doc: 14CFR references: 23.141- EASA CS CS 23.672,
23.253, 25.21-25.255, 23.321- Reference: CS 23.1329
23.459, 25.321-25.459, CS 25.672,
23.1501-23.1529, 25.1501-
CS 25.1329
25.1529
CS 27.672,
CS 27.1329
CS 29.672,
CS 29.1329
6.2.2.7 Environmental requirements.

VCF related installed equipment's shall be protected where necessary, and shall be safely and suitably
designed for its intended environment. Any VCF related equipment's that require specific installation
protection for the required environmental operating conditions shall be adequately protected.

a. Temperature and humidity.
b. EMC/EMI and lightning; including bonding.
c. Corrosion, fungal growths, and sand and dust ingress.
d. Vibration and shock.
e. Nuclear, biological, radiological, chemical, and laser weapons.

1. Analysis, test and review of documentation.
2. Definition of the expected environmental conditions at the equipment's location of installation,
supported by testing as appropriate.
3. Qualification of the equipment for the expected environmental conditions at the equipment's location of
installation, including testing as appropriate.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.14, 4.1.14, Def-Stan 00-970 00-970 P1 2.15.25
3.4, 4.4, 3.5, 4.5(all) Reference: 00-970 P1 3.9.24-3.9.25
00-970 P1 3.10.8-3.10.10
00-970 P1 3.10.11
00-970 P1 3.10.13
00-970 P1 4.27.7-4.27.25
00-970 P1 6.1.5
00-970 P1 6.2.40-6.2.60
00-970 P1 6.10
Information Sources
00-970 P1 S9.11
00-970 P5 UK25.1301a -
UK25.1316a
00-970 P7 Section 2
Supplement 6: Equipment
STANAG 4671.867
4671.1431
23.253, 25.21-25.255, 23.321- Reference: CS 23.1309
23.459, 25.321-25.459, CS 23.1431
23.1501-23.1529, 25.1501-
CS 25.1309
25.1529
CS 25.1316
CS 25.1431
CS 27.1309
CS 29.1309
CS 29.1431
6.2.2.8 Emergency procedures.

The aircraft VCF emergencies and their associated procedures shall be clearly related and recorded. It
shall be demonstrated through testing that the emergency procedures are appropriate and safe and are
documented in a location such that operators will be aware of them.

a. Ensuring that all identified emergencies have an appropriate emergency procedure.
b. Ensuring that the identified emergencies provide an appropriate level of detail.
c. Ensuring that the Test and Acceptance Plan provides adequate proof that the emergency procedures
are appropriate and safe.
d. The level of detail and location of recording of the emergency procedures.

1. Design documentation and Aircrew Operating Manuals detailing the VCF emergencies and their
associated procedures.
2. An aircraft Loss Model featuring the mitigating effect of aircrew emergency procedures and any
considerations that could affect their effectiveness.
Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-51-HDBK Def-Stan 00-970 00-970 P1 3.10.4
ADS-33E-PRF Reference: 00-970 P1 3.10.88
Refer to Army Aviation 00-970 P1 3.10.89
technical point of contact for STANAG 4671.1309
this discipline for specific Reference: 4671.1412
guidance (listed in section A.2) 4671.1483
4671.1485
FAA Doc: TBD: Refer to technical point of EASA CS CS 23.1309
Information Sources
contact for this discipline (listed Reference: CS 23.1581
in section A.2) CS 23.1585
CS 25.1309
CS 25.1581
CS 25.1585
CS 27.1309
CS 27.1581
CS 27.1585
CS 29.1309
CS 29.1581
CS 29.1585
6.2.2.9 Flight termination system.

Where a Flight Termination System (FTS) is installed and utilizes the flight control system it shall be
verified that that the probability of an erroneous termination command leading to a Loss of Aircraft (LOA)
and/or Loss of Control (LOC) is at least one hundred times less likely than the Probability of Loss of
Control (PLOC) and is included in the PLOC calculations.

a. All sources of an erroneous termination command.
b. All design precautions/protections preventing an erroneous termination command from leading to a
Loss of Aircraft.

Fault Tree Analysis (FTA) identifying the probability of an erroneous termination command.
2. Aircraft Loss Model integrating the probability of an erroneous termination command into the
Probability of Loss of Control (PLOC) and/or Probability of Loss of Aircraft (PLOA).
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P9 UK FW.U1412a
Reference: 00-970 P9 UK FW.U1412b
00-970 P9 UK RW.U1412a
00-970 P9 UK RW.U1412b
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.2.3 VCF actuator safety

6.2.3.1 Redundancy management.
Actuator redundancy management shall be shown to adequately support the aircraft's compliance with
flight handling qualities (see section 6.1) and safety.
a. The timely and accurate switching between failed and redundant functions and the effect that any time-
delay may have on the aircraft when operating in flight critical phases or when performing manoeuvres.
b. The isolation of the failed function and any residual probability for the failure to further affect control.

Fault Tree Analysis (FTA) including the effect of function redundancy and redundancy management on
flight handling qualities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: 3.1.4 Def-Stan 00-970 00-970 P1 S1.1.13
MIL-HDBK-516C 6.2.3.1 Reference: 00-970 P1 S2.15.12
00-970 P1 S3.9.18
00-970 P7 L100 S9.1.1
00-970 P9 UK FW.1301b
00-970 P9 UK RW.1301a
STANAG 4671 USAR.1309
Reference:
CS 27.1309
CS 29.1309
6.2.3.2 Failure detection and isolation.

The VCF actuation failure detection and isolation design shall be determined safe.

a. The timely and accurate detection and isolation of failed functions and the effect that any time-delay
may have on the aircraft when operating in flight critical phases or when performing manoeuvres.
b. The isolation of the failed function and any residual probability for the failure to further affect control.

Fault Tree Analysis (FTA) including the effect of function failure detection and isolation on flight handling
qualities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: 3.1.4 Def-Stan 00-970 00-970 P1 S1.1.13
MIL-HDBK-516C 6.2.3.2 Reference: 00-970 P1 S2.15.12
00-970 P1 S3.9.18
00-970 P7 L100 S9.1.1
00-970 P9 UK FW.1301b
00-970 P9 UK RW.1301a
Reference:
Information Sources
CS 27.1309
CS 29.1309
6.2.3.3 Hydraulic contamination.

VCF actuation shall not be susceptible to hydraulic contamination effects, and shall not cause loss of
actuation with subsequent loss of control.

a. Contamination of hydraulic systems through various sources including:
i. Designated system filling points (e.g. reservoirs);
ii. Relative movement of hydraulic connectors;
iii. Broken, cracked and/or punctured seals;
iv. Damage to hydraulic system parts (e.g. pitting of linear actuator cylinders)
b. The performance of filtration systems (if any) and the build-up of contamination in hydraulic parts over
time.

Fault Tree Analysis (FTA) including the likelihood and effect of hydraulic system contamination on flight
handling qualities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009A: B.3.4.2.1.6 Def-Stan 00-970 00-970 P1 S4.12.36
MIL-HDBK-516C 6.2.3.3, 8.1 Reference: 00-970 P1 S6.11.52
00-970 P7 L704 S13.1
00-970 P9 UK FW.1301b
00-970 P9 UK RW.1301a
Reference:
CS 27.1309
CS 29.1309
6.2.3.4 Bottoming and snubbing.

Bottoming of linear actuators shall be prevented. Snubbing of linear actuators shall be designed within
tolerable limits.

a. The full range of linear actuator displacement that can occur in normal, extreme and failure conditions,
taking account of deformation/deflection of aircraft structure and control surfaces as appropriate.
b. The range of actuator displacements where snubbing is to occur and the types of force required for the
appropriate snubbing characteristics (for example the combination of Coulomb Friction, Viscous Friction
and Stribeck Friction sources).

1. Mechanical and Kinematic analysis of the linear actuator's assembly demonstrating that bottoming
cannot occur through the assembly's full range of motion, and that snubbing characteristics are
appropriate. Where appropriate, this should include combinations of deflections due to in-service loads.
2. Actuator design documentation detailing the range of linear displacement of the actuator and snubbing
characteristics.
3. Rig, assembly and aircraft testing demonstrating the correct prevention of bottoming and
appropriateness of snubbing characteristics.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516C 6.2.3.4, 8.1 Def-Stan 00-970 00-970 P1 S4.12.36
Reference: 00-970 P1 S6.11.52
00-970 P7 L704 S13.1
00-970 P9 UK FW.1301b
00-970 P9 UK RW.1301a
Reference:
CS 27.1309
CS 29.1309
6.2.3.5 Environmental requirements.

The actuation system shall be demonstrably safe and shall not permit unsafe VCF actuation. This
includes ensuring VCF performance / stability is not degraded beyond specified operational limits under
all specified conditions (e.g.. burst pressure, normal performance, high and low temperature, pressure
impulses) and environments.

a. Specified operational limits, to be agreed and verified;
b. The most adverse environmental conditions, to be agreed and verified;
c. The probability of loss of the actuation system, to be agreed and verified;
d. The use of pneumatic actuation devices;
e. The use of electrically powered actuators, including electro-hydrostatic actuators and electro-
mechanical actuation and electric power used to actuate relatively low-duty cycle;
f. Employing control actuation redundancy.

Fault Tree Analysis (FTA) including considerations of environmental effects and failure of necessary
components (e.g. radiators, cooling fans, heat exchangers etc).
2. Calculations (e.g. Computation Fluid Dynamics, hand calculations etc as appropriate) of fluid-dynamics
effects such as surge due to valve opening/closing, pump start-up/shut-down, etc on the working fluid's
properties (pressure, volume, flow rate, temperature, viscosity, etc), and the acceptability of this variation.
3. Stress analysis (e.g. Finite Element Analysis, hand calculations etc as appropriate) of the actuation
system components including pipes, hoses, unions and equipment.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 6.11
3.1.5.6, 4.1.5.6, 3.1.14.1, Reference: 00-970 P1 6.12
4.1.14.1, 3.1.14.3, 4.1.14.3, 00-970 P7 L703
3.2.2.1, 4.2.2.1 (Note:
00-970 P7 L704
Unverified - no access to
JSSG-2008) STANAG 4671.1309
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 23.1435
23.459, 25.321-25.459, CS 23.1438
23.1501-23.1529, 25.1501-
CS 25.1309
25.1529
CS 25.1435
CS 25.1436
CS 27.1309
CS 27.1435
CS 29.1309
CS 29.1435
6.2.3.6 Motor/torque tube driven and rotary actuators.

Motor, torque tube driven and other rotary actuators shall be determined to be safe.
Note that the other requirements of this section also apply to rotary actuators.

a. Redundancy management (see 6.2.3.1);
b. Failure detection and isolation from the system. Note that this includes functional/mechanical isolation
of the failed component (i.e. fail-safe design) and isolation of the failed component from the power supply
system (see 6.2.3.2);
c. Contamination (see 6.2.3.3);
d. Exceedance of actuator limits (see 6.2.3.4);
e. Environmental requirements (6.2.3.5);
f. Requirements for surface rate, hinge moment and stiffness (see 6.2.3.7); and,
g. Physical constraints and appropriate limits (see 6.2.3.8)

Fault Tree Analysis (FTA) including the likelihood and effect of failure of rotary actuators.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008: Sections 3.0, 4.0, Def-Stan 00-970 Def Stan 00-970, Part 1 Sec
3.1, 4.1, 3.1.5.6, 4.1.5.6, Reference: 3.10.26, Part 1 Sec 6.11.80,
3.1.5.7, 4.1.5.7, 3.1.9, 4.1.9, Part 1 Section 1.1.13, Part 1
3.1.11, 4.1.11, 3.1.11.1, Section 2.15.12, Part 1 Section
4.1.11.1, 3.1.11.1.1, 4.1.11.1.1, 3.9.18, Part 7 Leaflet 100
3.1.12, 4.1.12, 3.1.14.1, Section 9.1.1, Part 9 UK
4.1.14.1, 3.1.14.3, 4.1.14.3, FW.1301b, Part 9 UK
3.2.2.1, 4.2.2.1 RW.1301a
Information Sources
Reference:
FAA Doc: EASA CS CS 23.1309, 25.1309, 27.1309,
Reference: 29.1309
6.2.3.7 Surface rate, hinge moment and stiffness.

Surface rate and hinge moments for VCF actuation shall not adversely affect aircraft control throughout
the combined range of attainable angles of attack (both positive and negative) and sideslip in both normal
and failure conditions. This includes ensuring no actuator hinge moments or blowback can cause a
departure, loss of control or pilot coupling, under all specified flight, environmental and load conditions.

a. The most adverse combination of flight, environment and load conditions, to be agreed and verified.
b. Deep stall trim conditions;
c. All manoeuvring;
d. Factors such as pilot strength, regions of control–surface–fixed instability, inertial coupling, fuel slosh,
the influence of symmetric and asymmetric stores, stall/post–stall/ spin characteristics, atmospheric
disturbances and Aircraft Failure States;
e. Failure transients and manoeuvering flight appropriate to the Failure State;
f. The degree of effectiveness and certainty of operation of limiters, e.g. control malfunction or
mismanagement, and transients from failures in the propulsion, flight control and other relevant systems;
g. All configuration including Stores (symmetric and asymmetric).

1. Identification of maximum loads on each control surface and on each hinge and actuator using
calculations (hand calculations, Computational Fluid Dynamics, Finite Element Analysis, etc) and testing
(wind-tunnel mock-up, ground testing, flight testing, etc), considering normal and failure conditions.
2. Assessment of the effect of loads on structure using calculations (hand calculations, Finite Element
Analysis, etc), and testing (coupon, sub-assembly and assembly testing) as appropriate.
3. Where surface rates are appreciably affected, evidence (e.g. flight handling tests) demonstrating that
the reduced rate does not affect flight safety, and incorporation of the effect of the reduced rates into the
aircraft loss model.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.5.6 thru Def-Stan 00-970 00-970 P1 3.4.13
3.1.5.7, 4.1.5.6 thru 4.1.5.7, Reference: 00-970 P1 3.9.9
3.2.2.1, 4.2.2.1, 3.2.1, 4.2.1, 00-970 P1 4.10.8
3.2.1.1, 4.2.1.1 (Note:
00-970 P1 S3.9.31
JSSG-2008) 00-970 P7 L203
STANAG
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.321-23.459
23.1501-23.1529, 25.1501-
CS 23.657
25.1529
CS 23.1501-23.1529
Information Sources
CS 25.21
CS 25.143-25.255
CS 25.321-25.459
CS 25.651
CS 25.657
CS 25.1501-23.1529
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 27.1501-27.1529
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
CS 29.1501-29.1529
6.2.3.8 Physical constraints.

Each flight control surface and/or flight control actuator shall be adequately constrained to limit the range
of motion to within the limits considered in the design of the surface and actuator.

a. The appropriate use of stops, including physical stops on the control surface/actuator(s) and/or stops
built into the design of the actuation system (e.g. limit switches and/or software limits).
b. The strength of stops to withstand the loads that could be reacted during normal and failure conditions.
c. The load that can be reacted through the control system and through the pilot's controls before the limit
is reached and the system's ability to react those loads without failure.

1. Mechanical analysis demonstrating the control surfaces' acceptable range of motion including the
forces reacted by the control system and by the stops (where used).
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 S3.9.32
Reference: 00-970 P7 L203 S4.2
Reference: 4671 USAR.675
CS 25.655
CS 25.675
CS 27.675
CS 29.675
6.2.4 VCF air data safety

6.2.4.1 Accuracy and tolerances.
The accuracy and tolerance of the air data system shall be considered in the assessment of the aircraft's
safety.

a. The air data types and sources whose integrity could impact the safety of the aircraft, including (but not
limited to):
i. Dynamic pressure;
ii. Static pressure;
iii. Altitude;
iv. Angle of attack;
v. Angle of side-slip;
vi. Mach number.
b. The probability of sensor failure or other source of data corruption (e.g. Electro-Magnetic Interference,
blockage/occlusion of sensor, etc) ;
c. Redundancy or other duplication of sensors, and voting parameters, and its effect on the overall
probability of failure;
d. The probability of and effect of failure of air data both in isolation and concurrently with other air data
failures; and,
e. The probability of and effect of degradation of air data both in isolation and concurrently with other air
data degradations.

Fault Tree Analysis (FTA) considering the probability and effect of loss and/or degradation of air data on
Information Sources
Comm'l Doc:
Reference: 00-970 P1 S2.15.27
00-970 P1 S2.15.28
00-970 P1 S6.3.6 - 6.3.12
00-970 P1 S6.10
00-970 P5 UK25.1301d
00-970 P7 L725 S4.1
00-970 P9 UK FW.1301b
00-970 P9 UK FW.1309b
4671 USAR.1325
4671 USAR.1327
4671 USAR.1337
CS 23.1325
CS 23.1327
CS 23.1337
CS 25.1309
CS 25.1323
Information Sources
CS 25.1325
CS 25.1327
CS 25.1329
CS 25.1337
CS 27.1309
CS 27.1323
CS 27.1325
CS 27.1327
CS 27.1337
CS 29.1309
CS 29.1323
CS 29.1325
CS 29.1327
CS 29.1337
6.2.4.2 Integration.
Air data sensors shall be integrated safely in the design of the aircraft. Air data parameters from any
single source or combination of sources shall be verified for accuracy prior to being transmitted, displayed
to flight crew or utilised by the aircraft in any autonomous function.

a. Appropriate means of data verification. Such verification may include combinations of (note that this list
is not exhaustive and the verification means will depend on aircraft requirements and sensor type):
i. Value limits (i.e. setting boundaries for possible limits of air data parameters);
ii. Limits on rate-of-change (i.e. identifying sensors as degraded/failed if they report a value that changes
too quickly);
iii. Redundancy and voting (i.e. using multiple sensors and identifying degraded/failed sensors when a
sensor reports a value different to others);
iv. Self-checking (i.e. intermittently forcing a sensor to read a known value and highlighting the sensor
degraded/failed if a different value is read);
v. Other forms of Built-in-Test (BIT) as appropriate.
b. The demonstrated integrity of sensors, recorded through empirical means.
c. The Integrity of the systems interpreting the air data and verifying its accuracy.

Fault Tree Analysis (FTA) considering the probability and effect of loss and/or degradation of air data on
Information Sources
Comm'l Doc:
Reference: 00-970 P1 S2.15.27 00-970 P1
S2.15.28
00-970 P1 S6.3.6 - 6.3.12
00-970 P1 S6.10
00-970 P5 UK25.1301d
Information Sources
00-970 P7 L725 S4.1
00-970 P9 UK FW.1301b
00-970 P9 UK FW.1309b
4671 USAR.1325
4671 USAR.1327
4671 USAR.1337
CS 23.1325
CS 23.1327
CS 23.1337
CS 25.1309
CS 25.1323
CS 25.1325
CS 25.1327
CS 25.1329
CS 25.1337
CS 27.1309
CS 27.1323
CS 27.1325
CS 27.1327
CS 27.1337
CS 29.1309
CS 29.1323
CS 29.1325
CS 29.1327
CS 29.1337
6.2.4.3 Ground provisions.

The effective ability for ground crew to verify the state of air data systems, and their safety while doing so,
shall be assured.

a. Ground crew access to provisions for Built-in-Test Equipment (BITE) and wiring and components for
fault isolation;
b. Protection for ground crew from the elements and any other environmental hazards;
c. Isolation of power supply systems (electric, hydraulic, pneumatic, etc) to prevent potentially hazardous
situations;
d. Procedures, processes or equipment to prevent damage to personnel and equipment.

1. Design documentation demonstrating acceptable access and safety provisions.
2. Aircraft Maintenance Manual identifying the processes and procedures for the effective and safe
access by ground crew.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 L800 S9.1
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.2.4.4 Ice prevention.

Air data sensors shall be provided with sufficient ice prevention means to prevent the build-up of moisture
and ice. The ice prevention means shall ensure that air data sensors are not degraded by ice
accumulation in all environments that the aircraft is cleared to operate in.

a. The environmental conditions in which the aircraft is cleared to operate that affect ice accretion (most
notably humidity, temperature and airspeed). This should also include those conditions that the aircraft is
not cleared to operate, but may encounter regardless (e.g. transient flight conditions).
b. Built-in-Test (BIT) and other fault finding means to ensure that ice prevention means are operating
correctly.
c. The design of air data sensors to ensure that moisture is prevented (e.g. prevention of moisture traps).

1. Analysis and accompanying test documentation demonstrating that moisture and ice accretion is
suitably prevented throughout a suitable range of environmental conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2001B 3.2.2 Def-Stan 00-970 00-970 P1 S2.15.21
Reference: 00-970 P1 S2.15.27
00-970 P1 S2.15.28
00-970 P1 S6.3.6 - 6.3.12
00-970 P1 S6.10
00-970 P1 S7.2.2
00-970 P1 S7.2.9
00-970 P5 UK25.1301d
00-970 P5 UK25.1419a
00-970 P7 L711
00-970 P7 L725 S4.1
00-970 P9 UK FW.1301b
00-970 P9 UK FW.1309b
4671 USAR.1325
4671 USAR.1327
4671 USAR.1337
Information Sources
4671 USAR.1419
CS 23.1325
CS 23.1327
CS 23.1337
CS 23.1419
CS 25.1309
CS 25.1323
CS 25.1325
CS 25.1327
CS 25.1329
CS 25.1337
CS 25.1419
CS 25.1420
CS 27.1309
CS 27.1323
CS 27.1325
CS 27.1327
CS 27.1337
CS 27.1419
CS 29.1309
CS 29.1323
CS 29.1325
CS 29.1327
CS 29.1337
CS 29.1419
6.2.4.5 Safety provisions.

Adequate safety provisions shall be provided concerning the aircraft's air data system(s).

a. The provision of the following:
i. In-flight monitoring of the air data health and annunciation of integrity to the operator/crew when
appropriate.
ii. Mitigation or accommodation for shorting or opening of power wires that removes electrical power.
iii. Mitigation or accommodation for loss of the mounting structure such as a radome that takes out more
than one probe at a time.
iv. Alternate methods for air data to compensate for loss of air data.
v. Provisions to handle possible bird strikes.

1. Design documentation, analysis and testing (as appropriate) demonstrating the safety of the air data
system installation(s).
Information Sources
Comm'l Doc:
Information Sources
Reference: 00-970 P1 S2.15.27
00-970 P1 S2.15.28
00-970 P1 S6.3.6 - 6.3.12
00-970 P1 S6.10
00-970 P5 UK25.1301d
00-970 P7 L725 S4.1
00-970 P9 UK FW.1301b
00-970 P9 UK FW.1309b
4671 USAR.1325
4671 USAR.1327
4671 USAR.1337
CS 23.1325
CS 23.1327
CS 23.1337
CS 25.1309
CS 25.1323
CS 25.1325
CS 25.1327
CS 25.1329
CS 25.1337
CS 27.1309
CS 27.1323
CS 27.1325
CS 27.1327
CS 27.1337
CS 29.1309
CS 29.1323
CS 29.1325
CS 29.1327
CS 29.1337
6.2.5 VCF control law safety

6.2.5.1 Flight envelope.
Control laws incorporated in the VCF shall be demonstrably safe, and shall provide levels of performance
as stated in the aircraft specification. The probability of loss (if gain or phase margins which results in an
unrecoverable aircraft condition) shall be significantly less than the required probability for loss of the
aircraft due to control system failure.

a. Operating in turbulence;
b. All predictable variations in system operating conditions, aircraft configurations and flight envelope;
c. Ensuring all flight control laws are defined in unambiguous Flight Requirements Document (FRD) or
Software Requirements Statement (SRS);
d. Appropriate control law strategies to recover from unusual attitudes, or from intentional manoeuvres
which involve transition through a period of low or negative airspeed;
e. Using the minimum number of sensor derived feedbacks;
f. Using the most rugged sensors for primary feedbacks essential to continued safe flight;
g. Conditions of full and partial constraint (e.g., undercarriage restraint).

1. Design documentation supported by flight simulation and flight testing where appropriate that
demonstrates the acceptable handling of the aircraft throughout the aircraft's defined operating
conditions, aircraft configurations and flight envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1, 3.1.5.2, Def-Stan 00-970 00-970 P1 3.10.33-3.10.46
3.1.5.5, 3.1.5.7, 3.1.8, 3.1.11.6, Reference: 00-970 P1 3.10.81
3.1.11.8, 3.1.13, 3.1.14.8, 00-970 P5 UK25.302a
3.1.16, 3.1.17, 3.1.18, 3.2.2.1,
00-970 P7 L207
3.2.2.4, 3.2.2.5.2, 3.2.2.5.4
thru 3.2.2.5.4.5, 3.2.2.6, 3.3.1, STANAG 4671.1329
3.3.4, 3.3.5, 3.3.7, and Reference: 4671 USAR.141
associated section 4 4671 USAR.U282
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.672
23.1501-23.1529, 25.1501-
CS 23.1329
25.1529
CS 25.21
CS 25.143-25.255
CS 25.672
CS 25.1329
CS 27.21
CS 27.141-27.251
CS 27.672
CS 27.1329
CS 29.21
CS 29.141-29.251
CS 29.672
CS 29.1329
6.2.5.2 Nonlinearities.
Functional control nonlinearities shall not preclude safety-of-flight (SOF). This includes ensuring
aggregate nonlinearities of all interfaces and computational paths do not induce departure, loss of control
or pilot coupling.

a. Gain margin to be agreed and verified (typically not worse than 6 db);
b. Phase margin to be agreed and verified (typically not worse than 45 degrees);
c. Mechanical, electrical, hydraulic, digital and analogue interface nonlinearities;

d. Avoiding oversensitivity or sluggishness in response.

demonstrates the acceptable handling of the aircraft and prevention of non-linearities affecting safety of
flight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.2.2.5.4 thru Def-Stan 00-970 00-970 P1 2.17.29
3.2.2.5.4.5, 4.2.2.5.4 thru Reference: 00-970 P1 2.22.6
4.2.2.5.4.5 (Note: Unverified - 00-970 P1 2.22.15
00-970 P1 3.10.38
00-970 P1 3.10.59
00-970 P5 UK25.302a
00-970 P7 L207
STANAG
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.321-23.459
23.1501-23.1529, 25.1501-
CS 25.21
25.1529
CS 25.143-25.255
CS 25.321-25.459
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 29.21,
CS 29.141-29.251
CS 29.321-29.427
6.2.5.3 Transients.
Control law transients for gain and mode changes shall not exceed specified limits such as to preclude
safety-of flight (SOF). This includes ensuring that where changes of control law (mode) can occur in flight,
either automatically or by air crew selection, they shall incur minimum disturbance to controlled flight.

a. Normal or lateral acceleration limits, to be agreed and verified (typically 0.05g);
b. Roll rate limits, to be agreed and verified (typically up to 5 deg/sec roll rate (recommended is 3
deg/sec));
c. Sideslip limits, to be agreed and verified (typically 5 degrees of sideslip or a period of 2 seconds);
d. Pitch force, to be agreed and verified (typically <20 lb);
e. Roll force, to be agreed and verified (typically 10lb);
f. Yaw force, to be agreed and verified (typically 10lb);
g. Stability margins, to be agreed and verified (typically 25% sensitivity changes);
h. Worst case conditions as well as nominal flight conditions.

demonstrates the acceptable handling of the aircraft through control law transients.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1, 3.1.2, 3.1.2.1, Def-Stan 00-970 00-970 P1 2.8.15
3.1.3, 3.1.5, 3.1.5.1, 3.1.5.2, Reference: 00-970 P1 3.10.33
3.1.5.4, 3.1.5.5, 3.1.5.7, 00-970 P1 3.10.38
3.1.5.8, 3.1.7, 3.1.7.2, 3.1.7.3,
00-970 P1 3.10.41
3.1.9, 3.1.10, 3.1.11, 3.1.11.2,
3.1.11.4, 3.1.11.5, 3.1.11.6, 00-970 P1 3.10.81
3.1.11.9, 3.1.11.10, 00-970 P5 UK25.302a
3.1.11.11.2, 3.1.11.11.3, 00-970 P7 L207
3.1.12, 3.1.12.1, 3.1.13.1,
3.1.13.2, 3.1.14.2.2, 3.1.14.2.4, STANAG 4671 USAR.141
3.2.2.1, 3.2.2.2, 3.2.2.5, 3.3 Reference: 4671 USAR.U282
thru 3.3.4, 3.3.6, 3.3.6.2, and 4671.1329
23.253, 25.21-25.255, 23.321- Reference: CS 23.1329
23.459, 25.321-25.459, CS 25.672
23.1501-23.1529, 25.1501-
CS 25.1329
25.1529
CS 27.672
CS 27.1329
CS 29.672
CS 29.1329
CS 23.21
CS 23.141-23.257
CS 23.321-23.459
CS 25.21
CS 25.143-25.255
CS 25.321-25.459
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
6.2.5.4 Redundancy and failure management.

All aircraft control systems shall be assessed to identify those whose failure could affect the flying
qualities of the aircraft. These systems shall then be analysed to identify their failure modes and
subsequent effects. All such failure modes that could lead to unacceptable flying qualities shall be further
analysed to ensure that they do not fail in an undetected or latent manner, and that they do not suffer
unannounced faults.
a. Recording justification for those systems considered not to affect the aircraft's flying qualities.
b. Component and system testing.
c. Aircraft ground and flight testing.

Fault Tree Analysis (FTA) considering the effect of redundancy and failure management on the overall
safety of the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.8, 3.1.9 Def-Stan 00-970 00-970 P1 2.1.38
Reference: 00-970 P1 2.15
00-970 P1 2.16.16
00-970 P1 2.16.42
00-970 P1 6.2.35
00-970 P1 6.5.46-6.5.49
00-970 P1 6.6.2
00-970 P5 UK25.302a
00-970 P7 L207
STANAG 4671.141-4671.253
Reference: 4671.321-4671.459
4671.1501-4671.1529
4671.1309
FAA Doc: 14CFR references: 23.141- EASA CS CS 23.141-23.253
23.253, 25.21-25.255, 23.321- Reference: CS 23.321-23.459
23.459, 25.321-25.459, CS 23.1309
23.1501-23.1529, 25.1501-
CS 23.1501-23.1529
25.1529
CS 25.105
CS 25.143-25.255
CS 25.321-25.459
CS 25.1309
CS 25.1501-25.1533
CS 27.141-27.251
CS 27.321-27.427
CS 27.1309
CS 27.1501-27.1529
CS 29.141-29.251
CS 29.321-29.427
CS 29.1309
CS 29.1501-29.1529
6.2.5.5 Aerodynamic and air data uncertainty.

The envelope for each aerodynamic configuration shall be clearly established; and a sensitivity study
shall be performed to determine the error bounds of the envelope beyond which unsafe handling
characteristics would be apparent. The actual air data errors, or variations from actual pressures, shall be
determined within each envelope for each dependant system. An analysis shall be performed to ensure
that the two sets of data do not overlap leading to unsafe handling characteristics.

a. Displayed air data.
b. Computed air data.
c. Systems using the computed air data. These could include flight control systems, aerodynamic
configuration systems, trim and auto feel systems.

Fault Tree Analysis (FTA) considering the effect of air data errors/uncertainties on the overall safety of the
aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: TBD: Refer to Def-Stan 00-970 00-970 P1 2.4
technical point of contact for Reference: 00-970 P1 2.5
this discipline (listed in section 00-970 P1 2.6
A.2)
00-970 P1 2.7
00-970 P1 2.8
00-970 P1 2.10
00-970 P1 2.15.27
00-970 P1 6.3
00-970 P5 UK25.302a
00-970 P7 L207
Reference: 4671 USAR.U282
4671.1323 - 1325
FAA Doc: 14CFD References: TBD: EASA CS CS 23.1323-23.1326
Refer to technical point of Reference: CS 25.1323-25.1326
contact for this discipline (listed
in section A.2)
6.2.5.6 Time delays.

The aircraft VCF shall not be adversely affected by time delays.

a. Signal or data synchronisation issues.
b. Signal or data latency issues.
c. The use and applicability of open architectures.

Fault Tree Analysis (FTA) considering the effect of time delays on the overall safety of the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-51-HDBK Def-Stan 00-970 00-970 P1 3.10.2
ADS-33E-PRF Reference: 00-970 P1 3.10.11-3.10.13
Information Sources
Refer to Army Aviation 00-970 P1 3.10.32
technical point of contact for 00-970 P1 3.10.47-3.10.53
this discipline for specific 00-970 P1 3.10.79-3.10.93
guidance (listed in section A.2) 00-970 P5 UK25.302a
00-970 P7 L207
4671.685
4671.1309
4671.1431
4671.1481
FAA Doc: TBD: Refer to technical point of EASA CS CS 23.1309
CS 29.1309
6.2.5.7 Autonomous modes.

The autonomous modes within the VCF shall be assessed to be safe.

a. Operating in turbulence;
b. All predictable variations in system operating conditions, aircraft configurations and flight envelope;
c. Ensuring all flight control laws are defined in unambiguous Flight Requirements Document (FRD) or
Software Requirements Statement (SRS);
d. Appropriate control law strategies to recover from unusual attitudes, or from intentional manoeuvres
which involve transition through a period of low or negative airspeed;
e. Using the minimum number of sensor derived feedbacks;
f. Using the most rugged sensors for primary feedbacks essential to continued safe flight;
g. Conditions of full and partial constraint (e.g., undercarriage restraint).

demonstrates the acceptable handling of the aircraft throughout the aircraft's defined operating
conditions, aircraft configurations and flight envelope.
Information Sources
Comm'l Doc: 14CFR references: 23.141-
23.253, 25.21-25.255, 23.321-
23.459, 25.321-25.459,
23.1501-23.1529, 25.1501-
25.1529
DoD/MIL Doc: JSSG-2008: 3.1, 3.1.5.2, Def-Stan 00-970 00-970 P1 3.10.33-46
3.1.5.5, 3.1.5.7, 3.1.8, 3.1.11.6, Reference: 00-970 P1 3.10.81
3.1.11.8, 3.1.13, 3.1.14.8, 00-970 P5 UK25.302a
3.1.16, 3.1.17, 3.1.18, 3.2.2.1,
00-970 P7 L207
3.2.2.4, 3.2.2.5.2, 3.2.2.5.4
thru 3.2.2.5.4.5, 3.2.2.6, 3.3.1, STANAG STANAG 4671 USAR.141,
3.3.4, 3.3.5, 3.3.7, and Reference: 4671 USAR.U282, 4671.1329
Information Sources
FAA Doc: EASA CS EASA CS 23.21, 23.141-
Reference: 23.257, 23.672, 23.1329
EASA CS 25.21, 25.143-
25.255, 25.672, 25.1329
EASA CS 27.21, 27.141-
27.251, 27.672, 27.1329
EASA CS 29.21, 29.141-
29.251, 29.672, 29.1329
6.2.6 VCF pilot vehicle interface (PVI) safety

6.2.6.1 Crew commands.
VCF command control elements, shall be demonstrably safe for the entire range of aircraft and air crew
responses. This includes ensuring component functional characteristics are defined and do not to induce
a departure or loss of control.

a. All flight phases;
b. All VCF command control elements which transmit crew control commands or generate and/or convey
commands;
c. Altitudes up to the maximum expected in operation;
d. Mechanical, analogue and electrical component functional characteristics;
e. Compatibility between mechanical and non-mechanical components;
f. Ensuring each control operates easily, smoothly and positively enough to allow proper performance of
its functions.
g. Cable systems.

demonstrates the acceptable handling of the aircraft and air crew feedback and response throughout the
aircraft's defined operating conditions, aircraft configurations and flight envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: para 3.1.1, 4.1.1, Def-Stan 00-970 00-970 P1 2.6.14
3.1.11.10, 4.1.11.10, 3.1.11.11 Reference: 00-970 P1 2.8.12
thru 3.1.11.11.4, 4.1.11.11 thru 00-970 P1 4.10.2
4.1.11.11.4, 3.2.2 thru
00-970 P5 UK25.397a
3.2.2.5.4, 4.2.2 thru 4.2.2.5.4
(Note: Unverified - no access 00-970 P5 UK25.397b
to JSSG-2008) 00-970 P7 L203
00-970 P7 L207
STANAG 4671.671
4671.1731
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
Information Sources
23.459, 25.321-25.459, CS 23.321-23.459
23.1501-23.1529, 25.1501- CS 23.671
25.1529
CS 23.1309
CS 25.21
CS 25.143-25.255
CS 25.321-25.459
CS 25.671
CS 25.689
CS 25.1309
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 27.671
CS 27.1309
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
CS 29.671
CS 29.1309
6.2.6.2 Functional characteristics.

Friction levels, breakout forces, dead zones, hysteresis, and backlash of each axis of the control system
(including thrust, and thrust vector angle if it is controlled by a separate inceptor) shall not preclude
safety-of-flight (SOF). This includes ensuring functional characteristics do not induce a control system
failure, loss of control or a departure.

a. Non-linear characteristics;
b. Probability of combinations of these phenomena leading to a failure condition;
c. Tests are to be made with the auto-stabilisers, 'q' feel systems etc. operative.

demonstrates the acceptable handling of the aircraft including the effect of friction levels, breakout forces,
dead zones, hysteresis and backlash in each control axis.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 4.0, Def-Stan 00-970 00-970 P1 2.6.11
3.2.2.5.1.1, 4.2.2.5.1.1 (Note: Reference: 00-970 P1 2.8.12
Unverified - no access to 00-970 P1 2.17.30
JSSG-2008)
00-970 P1 2.19.22
00-970 P1 3.9.22
00-970 P1 3.9.23
00-970 P1 4.10.6
00-970 P1 4.10.7
00-970 P7 L204 S3.4
Information Sources
00-970 P7 L204 S3.5
STANAG 4671.629(j) (AMC.629(j))
Reference: 4671.671
4671.683
23.253, 25.21-25.255, 23.321- Reference: CS 23.321-23.459
23.459, 25.321-25.459, CS 23.683
23.1501-23.1529, 25.1501-
CS 25.143-25.255
25.1529
CS 25.321-25.459
CS 25.683
CS 27.141-27.251
CS 27.321-27.427
CS 27.683
CS 29.141-29.251
CS 29.321-29.427
CS 29.683
6.2.6.3 Cockpit/operator control forces.

Cockpit control forces shall not exceed the specified design limits and shall provide full and free
movement of the control input devices, for all axes, including trim. Forces shall not be so great as to make
excessive demands on the pilot’s strength when manoeuvring the aircraft and shall not be so low that the
aircraft can easily be overstressed inadvertently.

a. Aircraft type, intended operational use and role;
b. Specified design limit control forces, to be agreed and verified;
c. Both short and long term application of force;
d. Both one and two hands available for control;
e. Control forces for pitch, roll, yaw and trim;
f. Forces applied to the control wheel, stick or rudder pedal;
g. Ensuring control system forces and free play do not inhibit a smooth, direct aircraft response;
h. Specified manoeuvres, to be agreed and verified;
i. Force of the pilots operating dual controls in opposition, to be agreed and verified.

demonstrates the acceptable handling of the aircraft and cockpit control forces throughout the aircraft's
defined operating conditions, aircraft configurations and flight envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.2.2.3, 4.2.2.3, Def-Stan 00-970 00-970 P1 3.4.6
3.2.2.5.1, 4.2.2.5.1, 3.2.2.5.1.1, Reference: 00-970 P1 3.4.13
4.2.2.5.1.1, 3.2.2.5.1.3, 00-970 P1 4.10.4
4.2.2.5.1.3 (Note: Unverified -
00-970 P5 UK25.397a
00-970 P5 UK25.397b
00-970 P7 L203
Information Sources
00-970 P7 L207
STANAG
Reference:
25.779, 23.141-23.253, 25.21- Reference: CS 23.141-23.257
25.255, 23.321-23.459, CS 23.321-23.459
25.321-25.459, 23.1501-
CS 25.21
23.1529, 25.1501-25.1529
CS 25.143-25.255
CS 25.321-25.459
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
6.2.6.4 Ratio changers and artificial feel devices.

Ratio changers and artificial feel devices (or similar devices) shall not adversely affect safety-of-flight
(SOF). This includes ensuring that no changes in artificial feel can produce departure, loss of control or
pilot coupling. Control system units, components, and parts which transmit control signals mechanically
shall meet the specified design limit conditions and safety factors.

a. Design limit conditions and safety factors, to be agreed and verified;
b. Assessing the effects from loss of the artificial feel devices;
c. The most critical case from handling considerations in terms of airspeed, altitude, mass, c of g and
external stores configuration.

demonstrates the acceptable handling of the aircraft--taking account of ratio changers and artificial feel
devices--throughout the aircraft's defined operating conditions, aircraft configurations and flight envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 4.0, 3.1.7.2, Def-Stan 00-970 00-970 P1 2.15.14
4.1.7.2, 3.1.11.11, 4.1.11.11, Reference: 00-970 P1 3.9.3
3.1.11.11.1, 4.1.11.11.1, 00-970 P1 3.9.4
3.1.12.1, 4.1.12.1, 3.1.14.4,
00-970 P1 3.9.31
4.1.14.4 (Note: Unverified - no
access to JSSG-2008) 00-970 P7 L203
00-970 P7 L207
STANAG
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 23.321-23.459
23.459, 25.321-25.459, CS 25.143-25.255
23.1501-23.1529, 25.1501-
CS 25.321-25.459
Information Sources
25.1529 CS 27.141-27.251
CS 27.321-27.427
CS 29.141-29.251
CS 29.321-29.427
6.2.6.5 Warning, caution, and advisory functions.

VCF warning and caution function/devices shall provide fast and adequate notification to the air crew for
any VCF failure or condition which could result in an unsafe flight. Warnings shall be clearly
distinguishable to the air crew under expected flight conditions without requiring the air crew’s attention.

a. Warnings and caution philosophy including:
i. Ensuring warnings and cautions are within the air crew's field of vision;
ii. Ensuring warnings and cautions minimise air crew errors and confusion;
iii. Indicating the current mode of operation, including any armed modes, transitions, and reversions;
iv. Ensuring indications are grouped and presented in a logical and consistent manner;
v. Ensuring indications are visible to each pilot under all expected lighting conditions;
vi. The use of a three category warning system.

demonstrates the acceptable handling of the aircraft including the suitability of control warning and
caution devices throughout the aircraft's defined operating conditions, aircraft configurations and flight
envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 3.10.64
3.1.11.10, 4.1.11.10, 3.1.13.4, Reference: 00-970 P1 3.10.65
4.1.13.4, 3.1.17, 4.1.17, 00-970 P1 3.10.68
3.2.2.2.7, 4.2.2.2.7, 3.2.2.5.1.2,
00-970 P1 3.10.76
4.2.2.5.1.2, 3.2.2.5.1.4,
4.2.2.5.1.4 (Note: Unverified - 00-970 P1 3.10.96
00-970 P1 4.15.35
00-970 P1 4.19.57
STANAG
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 23.1329
23.459, 25.321-25.459, CS 25.672
23.1501-23.1529, 25.1501-
CS 25.1329
25.1529
CS 27.672
CS 27.1329
CS 29.672
CS 29.1329
6.2.7 VCF integrated systems safety

6.2.7.1 Control surface positions.
Control system surfaces shall be installed so there is no mechanical interference from surrounding aircraft
structures or devices, or jamming with other control system components or surrounding
equipment/structure. If an adjustable stabiliser is used, it shall have stops that limit its range of travel to
that allowing safe flight and landing.
For rotorcraft, there shall be sufficient clearance between the rotor blades and other parts of the structure
to prevent the blades from striking any part of the structure during any operating condition.

a. The most critical clearance positions;
b. The full range of movement of surrounding devices;
c. Structural deflections resulting from the most adverse flight, manufacturing, environmental and load
conditions, the means of which is to be established, agreed and verified;
d. Ensuring the control system is free from excessive friction, and excessive deflection.
e. Jamming of control systems without interference with other components (for example overcentre
positions of control components).

1. Design documentation supported by kinematic and/or clearance analysis, rig, ground and/or flight
testing (as appropriate) and deflection calculations (e.g. hand calculations and/or Finite Element Analysis)
demonstrating that control surfaces do not suffer from interference, jamming or excessive deformation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.2.1 thru 3.2.1.4, Def-Stan 00-970 00-970 P1 3.9.18
4.2.1 thru 4.2.1.4, 3.2.2.5 thru Reference: 00-970 P1 3.9.26
3.2.2.5.1.1, 4.2.2.5 thru 00-970 P1 S3.9.31
4.2.2.5.1.1, 3.2.3, 4.2.3 (Note:
00-970 P1 S3.9.32
JSSG-2008) 00-970 P7 L203 S3.3.3
STANAG 4671.655
Reference: 4671.683
23.253, 25.21-25.255, 23.321- Reference: CS 23.683
23.459, 25.321-25.459, CS 25.655
23.1501-23.1529, 25.1501-
CS 25.683
25.1529
CS 27.661
CS 27.683
CS 29.661
CS 29.683
6.2.7.2 Intermittent devices.

Control devices intended for intermittent operation (such as flaps, slats, speed brakes, geometry
mechanisms, auxiliary control devices) shall not preclude safety-of-flight (SOF). This includes ensuring
latent failures for devices used only in discrete parts of the flight envelope (modes), or that are seldom
used or that are only for some type of backup capability, cannot induce a departure, loss of control, or
pilot coupling.

a. Monitoring such elements of the VCF to ensure that they are fit for use when required;
b. Provision of fail-safe reversion to manual control for recovery for non-full-time systems.

Fault Tree Analysis (FTA) incorporating the probability and effect of functional failure of latent devices on
flight handling qualities and safety of flight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.8, 4.1.8, Def-Stan 00-970 00-970 P1 2.15.15
3.2.1.3, 4.2.1.3, 3.2.1.4, Reference: 00-970 P1 2.15.20
4.2.1.4, 3.2.1, 4.2.1, 00-970 P1 2.15.29
3.2.2.5.4.5, 4.2.2.5.4.5, 3.1.12
00-970 P1 3.10.73
thru 3.1.12.1, 4.1.12 thru
4.1.12.1 (Note: Unverified - no 00-970 P1 3.10.105
access to JSSG-2008) 00-970 P1 S3.6
00-970 P7 L203 S3.3.1
STANAG 4671.701
FAA Doc: 14CFR references: 23.141- EASA CS CS 23.701,
23.253, 25.21-25.255, 23.321- Reference: CS 23.1309
23.459, 25.321-25.459, CS 25.701,
23.1501-23.1529, 25.1501-
CS 25.1309
25.1529
CS 27.674,
CS 27.1309
CS 29.674,
CS 29.1309
6.2.7.3 Foreign object damage (FOD).

The VCF shall have sufficient clearances to prevent foreign object damage (FOD). This includes ensuring
no probable combination of temperature effects, air loads, structural deflections, vibration, build-up of
manufacturing tolerances, wear, sag, or installation which can cause binding or jamming of any portion of
the VCF, result in insufficient clearance.

a. The following minimum clearances, provided for guidance, to be agreed and verified:
i. Between wiring and plumbing which carries combustible fluids (typically 152mm);
ii. Between wiring and control cables (typically 76mm);
iii. Around any control routing and connections such as bell-cranks, cables, actuator attachments, path
changers, etc (typically 6mm);
iv. Between elements which move in relation to one another but which are guided or connected to the
same component (typically 3mm);
v. Between elements which move in relation to one another and which are guided or connected to
separate components (typically 6mm);
vi. Between elements and aircraft structure or equipment to which they are not attached, unless
structural flexibility requires a greater clearance to be provided (typically 12mm).
b. Where surrounding material such as fasteners, rivets, nuts, bolts, washers etc., exceed 6mm, the
design accommodates these particulars.

1. Design documentation supported by kinematic and/or clearance analysis, rig, ground and/or flight
testing (as appropriate) and deflection calculations (e.g. hand calculations and/or Finite Element Analysis)
demonstrating that sufficient clearance exists between control system components and surrounding
aircraft structure.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: para 3.0, 4.0, 3.1, Def-Stan 00-970 00-970 P1 2.2.2
4.1, 3.1.7.2, 4.1.7.2, 3.1.7.3, Reference: 00-970 P1 2.15.14
4.1.7.3, 3.1.11.11, 4.1.11.11, 00-970 P1 3.1.19
3.1.11.11.1, 4.1.11.11.1,
00-970 P1 3.9.18
3.1.13, 4.1.13, 3.1.14, 4.1.14,
3.1.14.5, 4.1.14.5, 3.2.2.1, 00-970 P1 3.9.20
4.2.2.1, 3.2.3, 4.2.3, 3.2.3.3, 00-970 P1 3.9.24-3.9.26
4.2.3.3, 3.4.4, 4.4.4, 3.5.7, 00-970 P1 L24
4.5.7 (Note: Unverified - no
00-970 P1 S3.9.31
access to JSSG-2008)
00-970 P1 S3.9.32
00-970 P7 L203 S3.3.3
STANAG 4671.655
Reference: 4671.683
4671.685
23.253, 25.21-25.255, 23.321- Reference: CS 23.141-23.257
23.459, 25.321-25.459, CS 23.321-23.459
23.1501-23.1529, 25.1501-
CS 23.655
25.1529
CS 23.683
CS 23.685
CS 25.21
CS 25.143-25.255
CS 25.321-25.459
CS 25.655
CS 25.671
CS 25.683
CS 25.685
CS 27.21
CS 27.141-27.251
CS 27.321-27.427
CS 27.683
CS 27.685
CS 29.21
CS 29.141-29.251
CS 29.321-29.427
CS 29.683
Information Sources
CS 27.685
6.2.7.4 Structural mode interaction (SMI).

The location of sensors shall minimise/avoid structural mode coupling such as to prevent erroneous
feedback and disruption of the VCF or aircraft. Sensor location shall also provide adequate protection
from bird-strike, accidental and battle damage.

a. Structural mode coupling, including vibration from configuration loading and gun fire;
b. Account for sensitivities to actual manufacturing and variations in key stability derivatives and structural
mode frequencies;
c. Use of the most rugged sensors for primary feedbacks essential to continued safe flight.

1. Design documentation, supported by calculations (e.g. hand calculations, Finite Element Analysis
and/or dynamic/modal analysis) and assembly, rig, ground and/or flight testing (as appropriate) that
demonstrates that Structural Mode Interaction is suitably minimised/prevented.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.2.1, Def-Stan 00-970 00-970 P1 2.23
3.1.5, 3.1.5.6, 3.1.7.2, 3.1.11, Reference: 00-970 P1 3.10.20
3.1.13, 3.1.15, 3.1.17, 3.2.2.2, 00-970 P1 3.10.36
3.2.2.5, 3.2.2.5.1.1, 3.2.2.5.2,
00-970 P1 4.9.12
3.2.2.5.4.3, 3.2.2.5.4.4, 3.3.4,
3.3.6.2, 3.5.7, and associated 00-970 P1 L26
section 4 paragraphs (Note: 00-970 P1 S4.8
Unverified - no access to 00-970 P7 L500
JSSG-2008)
STANAG 4671.1309
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 25.1309
23.459, 25.321-25.459, CS 27.1309
23.1501-23.1529, 25.1501-
CS 29.1309
25.1529
6.2.7.5 Integration with avionics systems.

Interfaces between VCF and avionics equipment shall be demonstrated to be safe. The integration of
VCF and avionics equipment shall be demonstrated to be safe.

a. The interdependence of all aircraft functions within the integrated VCF;
b. Other control functions, e.g., structural mode and secondary controls, thrust and thrust vectoring;
c. Failure modes which may threaten safety-of-flight (SOF), for reasonably credible combination of
failures;
d. Required levels of system integrity.
1. Design documentation, supported by rig (system rigs, 'Iron Bird', etc), ground and flight testing (as
appropriate) demonstrating the function and safety of avionics interfaces.
2. Appropriate assurance of software development incorporating an appropriate assurance level (e.g.
Design Assurance Level), utilising a suitable standard (e.g. DO-178C 'Software Considerations in
Airborne Systems and Equipment Certification').
Fault Tree Analysis (FTA) incorporating the probability and effect of functional failure of avionics
interfaces on flight handling qualities and safety of flight.
Information Sources
Comm'l Doc:
3.1.5, 3.1.7, 3.1.8, 3.1.11, Reference: 00-970 P1 3.10.6
3.1.12, 3.1.13, 3.1.14.4, 00-970 P1 3.10.7
3.2.2.2, 3.2.2.4, 3.2.2.5,
00-970 P1 3.10.32
3.2.2.6, 3.3, 3.2.4, and
associated section 4 00-970 P1 3.10.94
paragraphs (Note: Unverified - 00-970 P1 3.10.95
00-970 P1 S6.2,
00-970 P7 L725
STANAG 4671.1309
23.253, 25.21-25.255, 23.321- Reference: CS 23.1329
23.459, 25.321-25.459, CS 25.1309
23.1501-23.1529, 25.1501-
CS 25.1329
25.1529
CS 27.1309
CS 27.1329
CS 29.1309
CS 29.1329
6.2.7.6 Integration with propulsion systems.

Integration and operation of the aircraft propulsion control system shall be safe for all conditions, including
any occurrences of asymmetric thrust.

a. Identifying those systems which form part of the propulsion control system.
b. Demonstrating that the identified systems meet their assigned and derived safety probability targets.
c. Ensuring that the Test & Acceptance Plan provides adequate demonstration of safe operation
throughout the approved flight envelope, including occurrences of asymmetric thrust where appropriate.

appropriate) demonstrating the function and safety of the propulsion control system.
2. Appropriate assurance of software development incorporating an appropriate assurance level (e.g.
Design Assurance Level), utilising a suitable qualification (e.g. DO-178C 'Software Considerations in
Airborne Systems and Equipment Certification').
Fault Tree Analysis (FTA) incorporating the probability and effect of functional failure of the propulsion
control system on flight handling qualities and safety of flight.
Information Sources
Comm'l Doc:
3.1.2, 4.1.2, 3.1.5.3, 4.1.5.3, Reference: 00-970 P1 2.22.37
3.1.5.5, 4.1.5.5, 3.1.7.3, 00-970 P1 3.9.18
4.1.7.3, 3.1.11, 4.1.11, 3.1.13,
00-970 P1 3.10.2
4.1.13, 3.1.13.3, 4.1.13.3,
3.1.17, 4.1.17, 3.2.2.2.9, 00-970 P1 3.10.28-3.10.30
4.2.2.2.9, 3.2.2.5.1.1, 00-970 P1 3.10.47-3.10.53
4.2.2.5.1.1, 3.2.2.5.4.5, 00-970 P1 3.10.75-3.10.77
4.2.2.5.4.5, 3.3.1, 4.3.1
00-970 P1 3.10.79-3.10.92
00-970 P1 11 3E50
STANAG 4671.141-4671.253
Reference: 4671.901-4671.909
4671.933-4671.943
4671.1141-4671.1143
4671.1309
FAA Doc: 14CFR references: 25.901 EASA CS CS 23.141-23.253
CS 23.933-23.943
CS 23.1141-23.1157
CS 23.1309
CS 25.143-25.255
CS 25.901-25.905
CS 25.933-23.945
CS 25.1141-25.1155
CS 25.1309
CS 27.141-27.251
CS 27.901-27.903
CS 27.1141-27.1151
CS 27.1309
CS 29.141-29.251
CS 29.901-29.903
CS 29.1141-29.1159
CS 29.1309
6.2.7.7 Vehicle recovery.

The extent of the safe flight envelope associated with engine failure shall be identified for each phase of
flight and recorded. Sufficient testing shall be undertaken to ensure that the aircraft can be recovered
safely, for each phase of flight, within the identified envelope. All associated limitations shall be noted in
the flight manual.

a. Engine failure mode and sequence.
b. Phase of flight when failure occurs (take-off, cruise, landing, etc.).

c. Location of engine on airframe and effect of resultant thrust (or loss of thrust).

1. Design documentation supported by flight simulations and flight testing (as appropriate) demonstrating
in which areas of the flight envelope engine failure appreciably affects the aircraft's safety of flight (i.e.
causing an appreciable increase in the Probability of Loss of Control (PLOC)).
2. Design documentation supported by flight simulations and flight testing (as appropriate) identifying
which flight condition is considered to be recoverable and which are considered to be non-recoverable,
identifying necessary actions required by flight crew.
3. Aircraft Flight Manual (or other suitable document) detailing the limitations for continued safe flight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.5, Def-Stan 00-970 00-970 P1 2.7
3.1.5.3, 3.1.5.7, 3.1.5.8, Reference: 00-970 P1 2.14
3.1.5.9, 3.1.9, 3.1.14, 3.2.1.3, STANAG
3.2.1.2, 3.2.2.2, 3.2.2.5, 4671.141-4671.253
3.2.2.5.4, 3.2.2.6, 3.3, and Reference: 4671.321-4671.459
associated section 4 4671.1501-4671.1529
paragraphs 4671.U1412
FAA Doc: 14CFR references: 23.141- EASA CS CS 23.141-23.253*
23.253, 25.21-25.255, 23.321- Reference: CS 23.321-23.459*
23.459, 25.321-25.459, CS 23.1501-23.1529*
23.1501-23.1529, 25.1501-
CS 25.143-25.255*
25.1529
CS 25.321-25.459*
CS 25.105
CS 25.111
CS 25.115
CS 25.121
CS 25.1501-25.1533*
CS 25.1309
CS 27.141-27.251
CS 27.321-27.427
CS 27.1501-27.1529
CS 29.141-29.251
CS 29.321-29.427
CS 29.1501-29.1529
6.2.7.8 Latencies and synchronizations.

The aircraft VCF shall not be adversely affected by inputs received from either the payload or from an
interfacing ground station.
Consideration should be given to :

1. Signal or data synchronisation issues.
2. Signal or data latency issues.
3. The use and applicability of open architectures.
appropriate) demonstrating the function and safety of avionics interfaces, and the resilience of the avionic
system to signal transmission delays and/or desynchronisation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-51-HDBK Def-Stan 00-970 00-970 P1 S3.10.2
ADS-33E-PRF Reference: 00-970 P1 S3.10.11-3.10.13
Refer to Army Aviation 00-970 P1 S3.10.32
technical point of contact for 00-970 P1 S3.10.47-3.10.53
this discipline for specific 00-970 P1 S3.10.79-3.10.93
guidance (listed in section A.2) STANAG 4671.685
TBD: Refer to technical point of Reference: 4671.1309
contact for this discipline (listed 4671.1431
in section A.2) 4671.1481
CS 27.1309
CS 29.1309
6.2.7.9 Automatic take-off and landing.

Automatic take-off and/or landing systems shall be assured as safe.

a. The probability and effect of failure of sensors and air data systems.
b. The probability and effect of failure of avionics equipment both incorporated in the automatic take-
off/landing system and of other aircraft systems.
c. The adequacy of air crew warning should the automated system fail, requiring reversion to manual
control, and the potential for an unacceptable increase in pilot workload.

appropriate) demonstrating the function and safety of the take-off/landing system.
Fault Tree Analysis (FTA) incorporating the probability and effect of functional failure of air data sensors,
the air data system and the aircraft's avionics systems on the failure of the take-off/landing system and
subsequent Probability of Loss of Control (PLOC).
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 S3.10
Reference: 00-970 P5 UK25.302a
00-970 P7 L604
STANAG 4671 USAR.1329, 4671
Reference: USAR.U1490, 4671
USAR.U1492
Information Sources
CS 27.1329
CS 29.1329
6.2.8 VCF engage, disengage, and interlocks safety

6.2.8.1 Interlocks.
The aircraft control system shall have positive interlocks to prevent hazardous operation of inoperative
devices/programs, to preclude their inadvertent operation.

a. Any Operational Flight Program (OFP)s that deal with diagnostics, and BITs;
b. Providing an unmistakable warning when the control system lock is engaged;
c. Interlock methods such as:
i. Removal of memory or processor chip;
ii. Double access to partitioned memory;
iii. Removal of power;
iv. Cockpit switches, etc.

1. Design documentation supported by rig (e.g. system rig, 'Iron Bird' etc), ground and flight testing as
appropriate that demonstrates that processes for the locking-out of inoperative devices/programs
preclude their inadvertent operation.
2. Aircraft Flight Manual or other suitable document which includes processes for the locking-out of
inoperative devices/programs when performing activities (e.g. maintenance) on those systems.
Information Sources
Comm'l Doc:
3.1.13, 4.1.13, 3.1.13.1, Reference:
4.1.13.1, 3.1.13.3, 4.1.13.3, STANAG
3.1.14.7, 4.1.14.7, 3.2.2.2.2, 4671.679
4.2.2.2.2, 3.2.2.5.1.3, Reference: 4671.1329
4.2.2.5.1.3, 3.2.2.6, 4.2.2.6
(Note: Unverified - no access
to JSSG-2008 (Note:
JSSG-2008)
23.253, 25.21-25.255, 23.321- Reference: CS 23.679
23.459, 25.321-25.459, CS 23.1329
23.1501-23.1529, 25.1501-
CS 25.672
25.1529
CS 25.679
CS 25.1329
CS 27.672
CS 27.679
CS 27.1329
CS 29.672
CS 29.679
CS 29.1329
6.2.8.2 Incompatible modes.

VCF engage/disengage functions/devices assignments and interlocks shall be provided to prevent the
engagement of incompatible modes that could create an immediate undesirable situation or hazard that
are incompatible with flight conditions or aircraft configurations (e.g., flaps, slats, airbrake, wing sweep,
engine power, nozzle angle etc). A means shall also be provided to indicate the current mode of
operation as selections or de-selections are made, including any armed modes, transitions, and
reversions.

a. Protection against improper mode engagement or positioning of any control functions;
b. Protection against in-flight engagement of any surface locks affecting aircraft stability;
c. Protection against simultaneous engagement, and engagement with incompatible flight conditions or
aircraft configurations, to be agreed and verified;
d. Ensuring indications are visible under all expected lighting conditions;
e. Ensuring controls and indications are grouped and presented in a logical and consistent manner;
f. Means of mode indication other than selector switch position.
g. Ensuring proper engagement and mixing of modes;
h. Emergency disengagement of modes to the basic flying aircraft control mode.

appropriate that demonstrate that incompatible modes cannot be engaged.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.5.2, Def-Stan 00-970 00-970 P1 2.16.21
3.1.5.8, 3.1.5.9, 3.1.7.2, Reference: 00-970 P1 3.10.41
3.1.7.3, 3.1.11, 3.1.11.2, 00-970 P1 3.10.64
3.1.13.1, 3.1.13.3, 3.1.14,
00-970 P1 3.10.65
3.1.14.7, 3.2.2.2.4, 3.2.2.2.5,
3.2.2.2.9, 3.2.2.2.11, 3.2.2.4, 00-970 P1 3.10.68
3.2.2.5.1, 3.2.2.5.1.1 thru 00-970 P1 4.19.18
3.2.2.5.1.4, 3.2.2.5.4.1, 00-970 P1 4.19.21
3.2.2.5.4.3, 3.2.2.5.4.4, 3.2.2.6,
3.3.2.1, and associated section STANAG 4671.1329
4 paragraphs (Note: Unverified Reference:
- no access to JSSG-2008)
23.253, 25.21-25.255, 23.321- Reference: CS 23.1329
23.459, 25.321-25.459, CS 25.672
23.1501-23.1529, 25.1501-
CS 25.1329
25.1529
CS 27.672
CS 27.1329
CS 29.672
CS 29.1329
6.2.8.3 Engage, disengage and mode transition transient times.

Transient times for automatic and manual VCF mode change shall be within specified limits, such as to
maximise Safety of Fight (SOF) and to ensure smooth engagement/disengagement.

a. Automatic transient times, to be agreed and verified (typically 0.1 seconds or less). Larger transient
times maybe justified and acceptable depending on the application;
b. Manual transient times, to be agreed and verified;
c. Operation in worse case conditions, to be agreed and verified;
d. Operation in nominal flight conditions.

appropriate that demonstrate mode engagement, disengagement and transient times are optimised,
within specified limits and do not preclude the aircraft's SOF.
See also section 6.2.5.3
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2008 3.0, 3.1, 3.1.5.2, Def-Stan 00-970 00-970 P1 S6.5.12
3.1.5.4, 3.1.5.5, 3.1.7.2, Reference:
3.1.7.3, 3.1.11, 3.1.11.5, STANAG
3.1.12, 3.1.12.1, 3.1.13.2, 4671 USAR.1329
3.1.14, 3.2.2.1, 3.2.2.2.1, Reference:
3.2.2.2.2, 3.2.2.2.6, 3.2.2.2.12,
3.2.2.5.4, 3.2.2.5.4.3, 3.2.2.6,
3.3.1, 3.3.2, 3.3.2.1, and
paragraphs
CS 27.1329
CS 29.1329
6.2.9 VCF command and control communications safety

6.2.9.1 Integration.
All command and control channels used by the aircraft shall be identified; these may include
communications within the VCF, communications with ground control, and communications with other
linked vehicles. Each of these channels shall be:
1. Safely integrated with the other aircraft systems.
2. Have an acceptable probability of failure assigned to it.
3. Resilient to effects of the operating environment

a. Common mode failure.
b. Data verification and correction techniques.
c. Demonstrating achievement of failure probabilities.
d. Requirements of Test and Acceptance Plan to demonstrate compliance.

1. Design documentation clearly identifying the command and control channels utilised by the aircraft,
redundancy (if any), probability and effect of failure and considerations of the operating environment.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1, 4.1, 3.1.8, Def-Stan 00-970 00-970 Pt 1 3.10.1-3.10.2
4.1.8, 3.1.7.3, 4.1.7.3, 3.1.11, Reference: 00-970 Pt 1 6.1.12-6.1.16
4.1.11, 3.1.11.7, 4.1.11.7, 00-970 Pt 1 6.1.19
3.1.11.9, 4.1.11.9, 3.1.13,
00-970 Pt 1 6.1.44
4.1.13, 3.2.2.2, 4.2.2.2,
3.2.2.5.1.2, 4.2.2.5.1.2, 00-970 Pt 1 6.6.1
3.2.2.5.3, 4.2.2.5.3, 3.3, 4.3, STANAG 4671.141-4671.253
3.3.1, 4.3.1, 3.3.2.3, 4.3.2.3, Reference: 4671.321-4671.459
3.3.3, 4.3.3
4671.1501-4671.1529
4671.U1309
4671.U1601-1617
23.253, 25.21-25.255, 23.321- Reference: CS 23.321-23.459
23.459, 25.321-25.459, CS 23.1501-23.1529
23.1501-23.1529, 25.1501-
CS 23.1309
25.1529
CS 25.143-25.255
CS 25.321-25.459
CS 25.1501 -1533
CS 25.1309
CS 27.141-27.251
CS 27.321-27.427
CS 27.1501-27.1529
CS 27.1309
CS 29.141-29.251
CS 29.321-29.427
CS 29.1501-29.1529
CS 29.1309
6.2.9.2 Security.
Unauthorised access to the aircraft command and control communications shall be prevented, and any
security techniques used to achieve this shall be implemented safely. To achieve this, the aircraft
command and control communications systems shall be identified, and the required security level for
each assigned. Any security techniques used to achieve the required level of security shall be shown to
be safe, and shall be implemented in a safe manner.

1. Documenting the expected threat against each system.
2. Demonstrating that chosen security techniques are safe for the proposed use.
3. Demonstrating that the chosen security techniques are implemented safely.
4. Partitioning critical data from less critical data.
5. Encryption.
6. Physical means of security.

1. Design documentation clearly identifying the command and control channels utilised by the aircraft,
security levels for each channel, and security techniques implemented to ensure protection against
intrusive threats.
2. Rig (system, 'Iron Bird' etc), ground and flight testing as appropriate, demonstrating that practical
attempts at unauthorised access are prevented.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.1.8, 4.1.8, Def-Stan 00-970 00-970 P1 3.10.1-3.10.2
3.1.14.6, 4.1.14.6, 3.1.16, Reference: 00-970 P1 3.10.11
4.1.16, 3.2, 4.2, 3.3.1, 4.3.1 00-970 P1 3.10.19
00-970 P1 3.10.27
00-970 P1 3.10.32
00-970 P1 3.10.47-3.10.49
STANAG 4671.141-4671.253
Reference: 4671.321-4671.459
4671.1501-4671.1529
4671.1309
4671.U1601-1617
23.253, 25.21-25.255, 23.321- Reference: CS 23.321-23.459
23.459, 25.321-25.459, CS 23.1501-23.1529
23.1501-23.1529, 25.1501-
CS 23.1309
25.1529
CS 25.143-25.255
CS 25.321-25.459
CS 25.1501 - 1533
CS 25.1309
CS 27.141-27.251
CS 27.321-27.427
CS 27.1501-27.1529
CS 27.1309
CS 29.141-29.251
CS 29.321-29.427
CS 29.1501-29.1529
CS 29.1309
6.2.9.3 Lost communications and failures.

Aircraft guidance, navigation and control functions shall implement robust and safe contingency logic for
dealing with lost-communications and on-board failures.

a. The probability of single and combined failures including both lost-communications and on-board
failures.
b. The effect of failures on the continued safe flight of the aircraft through all flight phases.
c. The vehicle's ability to continue and complete its mission, and the effect that any failure may have on
the overall mission reliability of the aircraft.

Fault Tree Analysis (FTA) considering the probability of lost-communications and on-board failures and
their effect on the aircraft's continued safe flight.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671 USAR.U1603
FAA Doc: EASA CS
Reference:
6.2.9.4 Loss of command.

Loss of command signal from a control station shall not unacceptably degrade the aircraft's operational
state.

a. The continued safe flight of the aircraft, including the Probability of Loss of Control (PLOC) and
Probability of Loss of Aircraft (PLOA).
b. The continued missionworthiness of the aircraft and the ability for the aircraft to successfully complete
its assigned mission.

Fault Tree Analysis (FTA) considering the probability of lost-communications and on-board failures and
their effect on the aircraft's continued safe flight.
Information Sources
Comm'l Doc:
Reference:
FAA Doc: EASA CS
Reference:
6.2.9.5 Sensor operability.

For UAS equipped with remote control capability, sensors used to provide feedback to a remote operator
shall be fully operational under natural and induced environmental conditions.

a. The full range of environmental conditions that could be encountered, incorporating any protections
against such conditions afforded by the aircraft (e.g. Environmental Conditioning Systems), including but
not limited to:
i. Temperature;
ii. Humidity;
iii. Pressure;
iv. Vibration; and,
v. Electromagnetic interference.

1. Design documentation supported by equipment, rig, ground and flight testing (as appropriate)
demonstrating that the required equipment remains functional in the environmental conditions in which it
will be subjected to.
Information Sources
Comm'l Doc:
Reference:
Reference:
CS 27.1309
CS 29.1309
6.2.10 VCF hydraulic power source safety

(Note: See section 8.1 for specific hydraulic systems criteria)
6.2.10.1 Hydraulic distribution.

The VCF shall not adversely affect safety of flight following degradation of the hydraulic system.

a. Hydraulic system distribution;
b. Loss of one, or part of any one, of the aircraft's hydraulic systems.

Fault Tree Analysis (FTA) considering the probability and effect of hydraulic system on the function of the
VCF, and therefore on the overall Probability of Loss of Control (PLOC) and Probability of Loss of Aircraft
(PLOA).
See also section 8.1 for Hydraulic Systems requirements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.2, Def-Stan 00-970 00-970 P1 6.11.52-6.11.55
3.1.2.1, 3.1.3, 3.1.7.2, 3.1.7.3, Reference: 00-970 P7 S1 L100 Para 9.1
3.1.11, 3.1.11.11.3, 3.1.12, 00-970 P7 S7 L704 13.2-13.4
3.1.12.1, 3.1.14.4, 3.1.14.9,
3.2.1.3, 3.2.2.2.1, 3.2.2.2.5, STANAG 4671.1435
3.2.3.1, and associated section Reference:
4 paragraphs
23.253, 25.21-25.255, 23.321- Reference: CS 25.1309
23.459, 25.321-25.459, CS 27.1309
23.1501-23.1529, 25.1501-
CS 29.1309
25.1529
6.2.10.2 Hydraulic system dynamics.

The aircraft hydraulic system(s) shall be designed to withstand defined peak pressure loads or pulses,
and to operate without excessive pressure fluctuation.

a. The values for proof and ultimate pressure, related to Design Operating Pressure (DOP).
b. Cyclic pressures, including transients (surges) and those due to system volumetric changes.
c. Pressure fluctuation within the system.

1. Design documentation, supported by rig, ground and flight testing as appropriate, demonstrating that
system pressures--including cyclic and surge pressures and other fluctuations--are fully defined.
2. Fluid and stress analysis (using hand calculations, Finite Element Analysis and Computational Fluid
Dynamics as appropriate) supported by rig, ground and flight testing demonstrating that the system can
withstand system pressures with an appropriate factor of safety.
Information Sources
Comm'l Doc:
3.1.5.6, 4.1.5.6, 3.1.7.2, Reference: 00-970 P1 6.11.60
4.1.7.2, 3.1.11.11.3, 00-970 P1 6.11.75
4.1.11.11.3, 3.2.2.2.1,
00-970 P7 S7 L704 8.1.4
4.2.2.2.1, 3.3 thru 3.3.4, 4.3
thru 4.3.4, 3.3.6, 4.3.6, 3.3.6.2, 00-970 P7 S7 L704 15.5.3
4.3.6.2 STANAG 4671.1435
Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 25.1435
23.459, 25.321-25.459, CS 27.1435
23.1501-23.1529, 25.1501-
CS 29.1435
25.1529
6.2.10.3 Flow/pressure irregularities.

The aircraft backup and/or emergency hydraulic systems shall be designed to ensure that system
pressure and flow rates are sufficient to maintain safety of flight.

a. The minimum system pressure and flow rates should be agreed and verified.
b. Specifically testing to ensure that flutter does not preclude safety of flight when backup or emergency
hydraulic systems are used.

1. Documentation supported by analysis (hand calculations, system computational models and/or
computational fluid dynamics), rig, ground and flight testing as appropriate to demonstrate that system
pressure and flow rates are adequate to provide sufficient power to the aircraft flight controls to maintain
safety of flight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 6.11.52-6.11.55
3.1.5.6, 4.1.5.6, 3.1.7.2, Reference:
4.1.7.2, 3.1.11.11.3, STANAG
4.1.11.11.3, 3.2.2.2.1, 4671.1435
4.2.2.2.1, 3.2.2.2.5, 4.2.2.2.5 Reference:
23.253, 25.21-25.255, 23.321- Reference: CS 25.1309
23.459, 25.321-25.459, CS 27.1309
23.1501-23.1529, 25.1501-
CS 29.1309
25.1529
6.2.10.4 Transients/fluctuations.
Use of the backup or emergency hydraulic systems shall not lead to loss of vehicle control function.
Consideration should be given to the following:

a. Pressure transients induced by component switch over. This includes, but is not limited to, pumps,
actuators, valves, accumulators etc.
b. Time lags induced by component switch over.
c. The ability to revert to the primary hydraulic system, if available, on failure of the backup or emergency
supply.

1. Design documentation supported by rig, ground and flight testing as appropriate demonstrating the
safe switch-over from the primary hydraulic system to the back-up/emergency system.
Information Sources
Comm'l Doc:
3.1.5.2, 4.1.5.2, 3.1.5.6, Reference: 00-970 P1 6.11.53
4.1.5.6, 3.1.7.2, 4.1.7.2, 3.1.10, 00-970 P7 S7 L704 3.4.1
4.1.10, 3.1.11.11.3,
4.1.11.11.3, 3.1.13, 4.1.13, STANAG 4671.1435
3.2.2.2.1, 4.2.2.2.1, 3.2.2.2.5, Reference:
4.2.2.2.5
23.253, 25.21-25.255, 23.321- Reference: CS 25.1309
23.459, 25.321-25.459, CS 27.1309
23.1501-23.1529, 25.1501-
CS 29.1309
25.1529
6.2.10.5 Merged with 6.2.10.1
6.2.11 VCF electrical power system safety
(Note: See section 12 for specific electrical power system criteria)
6.2.11.1 Backup.
The aircraft electrical system shall be designed such there is sufficient electrical power to be able to
perform a controlled emergency landing, or perform emergency recovery actions, following a total loss of
on-board electrical generating capability.

a. The length of time required to perform emergency recovery actions.
b. The maximum time likely to be required to perform an emergency landing.
c. The amount of power required to perform the emergency actions, or carry out an emergency landing.
d. Minimising any time lag between the failure occurring and notification to the operator.

1. Documentation supported by analysis, rig, ground and flight testing demonstrating the safe switch-over
to emergency/back-up electrical supply systems, effective aircraft control using those systems, and ability
for the aircraft to perform a controlled emergency actions and/or recovery actions.
See also section 12 for Electrical Systems requirements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008: 3.0, 3.1, 3.1.2, Def-Stan 00-970 00-970 P1 6.6.6-6.6.8
3.1.5.2, 3.1.5.4, 3.1.7.2, 3.1.10, Reference: 00-970 P1 6.6.18
3.1.11, 3.1.11.11.2, 3.1.13, 00-970 P7 S7 L706 2.7.1-2.7.3
3.2.2.2, 3.2.2.2.2, 3.2.2.2.5, 3.3
thru 3.3.4, 3.3.6, 3.3.6.2, and STANAG 4671.1351
associated section 4 Reference: 4671.1353
paragraphs 4671.1412
4671.1413
23.1367, 25.1351-25.1363, Reference: CS 23.1351
23.141-23.253, 25.21-25.255, CS 25.903
23.321-23.459, 25.321-25.459,
CS 25.1351
23.1501-23.1529, 25.1501-
25.1529 CS 27.903
CS 27.1351
CS 29.903
CS 29.1351
6.2.11.2 Independent sources.

The aircraft electrical system shall be designed such that, where there are independent power sources:
a. They shall not adversely interact to preclude continued safe flight of the aircraft.
b. They shall provide sufficient redundant power for continued safe flight.

a. The total electrical power requirements of the aircraft.
b. The requirement for independent redundant sources.
c. The capacity of the individual systems to supply the required electrical power.
independence and redundancy of the electrical systems and the ability for each system to provide power
to the specified equipment (which may include electrical load shedding).
Information Sources
Comm'l Doc:
3.1.2, 4.1.2, 3.1.2.1, 4.1.2.1, Reference: 00-970 P1 6.6.7
3.1.3, 4.1.3, 3.1.7.2, 4.1.7.2, 00-970 P1 6.6.17
3.1.11, 4.1.11, 3.1.11.11.2,
00-970 P7 S7 L706 2.7.2
4.1.11.11.2, 3.1.12, 4.1.12,
3.1.12.1, 4.1.12.1, 3.2.2.2.2, 00-970 P7 S7 L706 2.7.3
4.2.2.2.2, 3.2.2.2.5, 4.2.2.2.5, STANAG 4671.1351-4671.1367
3.3 thru 3.3.4, 4.3 thru 4.3.4, Reference:
3.3.6, 4.3.6, 3.3.6.2, 4.3.6.2
23.1367, 25.1351-25.1363, Reference: CS 23.1351
23.141-23.253, 25.21-25.255, CS 25.1309
23.321-23.459, 25.321-25.459,
CS 25.1351
23.1501-23.1529, 25.1501-
25.1529 CS 25.1362
CS 27.1309
CS 27.1351
CS 29.1309
CS 29.1351
6.2.11.3 Transients.
The electrical installation shall be designed such that any power transients generated, either through
normal operation or component switching, shall not preclude safe operation of the aircraft.

a. Switching between power sources.
b. The operation of relays and contactors.
c. The effect or short or open circuits.
d. Switching supplied equipment on or off.

function and safety of electrical systems and equipment, including the effects of the worst-case power
transients.
Information Sources
Comm'l Doc:
3.1.5.2, 4.1.5.2, 3.1.7.2, Reference: 00-970 P1 6.6.16
4.1.7.2, 3.1.10, 4.1.10, 00-970 P1 6.6.104
Information Sources
3.1.11.11.2, 4.1.11.11.2, STANAG 4671.1351-4671.1367
3.2.2.2.2, 4.2.2.2.2, 3.2.2.2.5, Reference:
4.2.2.2.5
23.1367, 25.1351-25.1363, Reference: CS 23.1351
23.141-23.253, 25.21-25.255, CS 25.1309
23.321-23.459, 25.321-25.459,
CS 25.1351
23.1501-23.1529, 25.1501-
25.1529 CS 25.1431
CS 27.1309
CS 27.1351
CS 29.1309
CS 29.1351
6.2.11.4 Merged with 12.1.6

6.2.11.5 Bus separation.
Where electrical power busses are operated in parallel, the system shall be designed so that there are no
single points of failure which could adversely affect more than one power source. In addition, such a
failure shall not cause any loss of function of the Vehicle Control System.

a. Load matching and balancing components.
b. Bus switching components.
c. Bus or load faults.
d. Redundancy in power supply to VCF equipment.

Fault Tree Analysis (FTA) identifying the successful independence of power busses, robustness to single
failures and continued operation of Vehicle Controls following failures of the electrical system.
Information Sources
Comm'l Doc:
3.1.2.1, 3.1.3, 3.1.7.2, 3.1.7.3, Reference: 00-970 P1 6.6.3
3.1.10, 3.1.11.11.2, 3.1.12, 00-970 P1 6.6.37
3.1.12.1, 3.1.14.4, 3.2.1.3,
00-970 P1 6.6.104
3.2.2.2.2, 3.2.2.2.5, 3.2.3.1,
and associated section 4 00-970 P7 S7 L706 2.4
paragraphs STANAG 4671.1351-4671.1367
Reference:
23.1367, 25.1351-25.1363, Reference: CS 25.1309
23.141-23.253, 25.21-25.255, CS 27.1309
23.321-23.459, 25.321-25.459,
CS 29.1309
23.1501-23.1529, 25.1501-
25.1529
6.2.11.6 Effects of failure modes.

The electrical power system shall be designed such that its characteristics do not adversely affect
continued safety of flight.

a. All modes of the electrical power system including: normal, abnormal, and failure modes.
b. The potential effects of spikes, surges, or interrupts.
c. Provision of a separate emergency direct power source for the VCF where necessary to mitigate the
effects of normal system failures.

Fault Tree Analysis (FTA) identifying the probability and effects of failures of the electrical system on the
VCF.
2. Design documentation demonstrating that VCF equipment functions with supplied electrical power in
normal, abnormal and failure modes of the aircraft's electrical supply system.
Information Sources
Comm'l Doc:
3.1.2.1, 3.1.3, 3.1.7.2, 3.1.7.3, Reference: 00-970 P1 6.6.7
3.1.11.11.2, 3.1.13, 3.1.14.4, 00-970 P1 6.6.8
3.2.1.3, 3.2.2.2.2, 3.2.2.2.5, 3.3
00-970 P1 6.6.18
thru 3.3.4, 3.3.6, 3.3.6.2, and
associated section 4 00-970 P1 6.6.104
paragraphs STANAG 4671.1351-4671.1357
Reference:
23.1367, 25.1351-25.1363, Reference: CS 25.1309
23.141-23.253, 25.21-25.255, CS 27.1309
23.321-23.459, 25.321-25.459,
CS 29.1309
23.1501-23.1529, 25.1501-
25.1529
6.2.11.7 Uninterruptible power.

Electrical power sources for the provision of direct supply to VCF shall not preclude continued safety of
flight.

a. Numbers and type of direct supply sources.
b. Utilization of circuit protection devices.
c. Testing methodology.

1. Design documentation demonstrating that VCF equipment functions with supplied electrical power in
normal, abnormal and failure modes of the aircraft's electrical supply system.
Information Sources
Comm'l Doc:
3.1.2.1, 3.1.3, 3.1.7.2, 3.1.7.3, Reference: 00-970 P1 6.6.7
3.1.11, 3.1.11.11.2, 3.1.12, 00-970 P1 6.6.8
3.1.12.1, 3.1.14.4, 3.2.1.3,
00-970 P1 6.6.104
3.2.2.2.2, 3.2.2.2.5, 3.3 thru
3.3.4, 3.3.6, 3.3.6.2, and 00-970 P7 S7 L706 2.7.1-2.7.3
associated section 4 STANAG 4671.1351-4671.1367
paragraphs Reference:
23.1367, 25.1351-25.1363, Reference: CS 25.1351-25.1365
23.141-23.253, 25.21-25.255, CS 27.1351-27-1367
23.321-23.459, 25.321-25.459,
CS 29.1351-29.1363
23.1501-23.1529, 25.1501-
25.1529
6.2.12 VCF electronic systems safety

6.2.12.1 Computer design.
The VCF computer/processor(s) shall be designed to ensure that processing hardware meets the
specified requirements so as to ensure safety-of-flight (SOF). This includes providing speed of operation
and levels of discrimination fully compatible with the intended performance of the control laws, and
enabling all management functions to be effective without incurring significant penalties arising from time
delays. In addition, the VCF computer/processor capacity requirements shall ensure there is sufficient
margin or be capable of growth, to meet later expansion requirements.

a. Ensuring sufficient redundancy is incorporated to meet the safety requirements and to ensure that
failures do not propagate;
b. Ensuring the processor can withstand all induced and natural environments;
c. Processing hardware requirements, and any specialized requirements;
d. VCF computer/processor capacity margins (typically 50%);
e. Accounting for noise sources of narrow-band signals such as harmonics of microprocessor clocks and
power supply equipment.

1. Design documentation, supported by avionics rig testing and aircraft ground and flight testing as
appropriate demonstrating the verification of computer components against their defined requirements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2008:3.0, 4.0, 3.1, 4.1, Def-Stan 00-970 00-970 P1 3.10.19
3.1.14.6, 4.1.14.6, 3.1.18, Reference:
4.1.18, 3.2.2.2, 4.2.2.2, 3.3, STANAG
4.3, 3.3.1, 4.3.1, 3.3.2, 4.3.2, 4671.1329
3.3.2.1, 4.3.2.1, 3.3.2.2, Reference:
4.3.2.2, 3.3.2.3, 4.3.2.3, 3.3.4,
4.3.4 (Note: Unverified - no
access to JSSG-2008)
Information Sources
23.253, 25.21-25.255, 23.321- Reference: CS 25.1329
23.459, 25.321-25.459, CS 27.1329
23.1501-23.1529, 25.1501-
CS 29.1329
25.1529
6.2.12.2 Electronic sensors.

Electronic sensors utilised in the VCF shall be assured as safe.

a. The reliability of each sensor in isolation;
b. Redundancy and failure management of the electronic sensors and systems;

appropriate) demonstrating the appropriate and safe use of electronic sensors in the design of the VCF.
2. Appropriate equipment qualification using a suitable standard (e.g. MIL-STD-810, DO-160, etc)
demonstrating that the electronic sensors function through the range of environments and other
conditions in which they are required to operate.
Fault Tree Analysis (FTA) demonstrating that the probability and effect of failure of VCF electronic
sensors does not unacceptably increase the Probability of Loss of Control (PLOC) or Probability of Loss
of Aircraft (PLOA).
Information Sources
Comm'l Doc:
Reference: 00-970 P1 S3.10.8
00-970 P1 S3.10.20
00-970 P1 S3.10.28
00-970 P7 L711 S6.5.1
00-970 P9 UK FW.1309b
STANAG
Reference:
FAA Doc: EASA CS
Reference:
6.3 AERODYNAMICS AND PERFORMANCE.
6.3.1 Engine-airframe compatibility.

The installed propulsion system design shall consider engine and airframe compatibility in order to ensure
safe operation of the aircraft.

a. Flow disturbances entering the engine from the inlet.
b. Flow disturbances entering the engine from the afterburner/nozzle.
c. Flow, mechanical and thermal interfaces with the airframe and subsystems.
d. Operation of flight, engine and subsystem controls.

1. Propulsion system instabilities are identified during design and development through test, analysis, and
demonstration.
2. Exhaust system back pressure and nozzle matching effects are verified by analysis, test, and
demonstration.
3. Thermal boundary, fuel, air induction, exhaust and bleed air extraction system, ambient temperature,
ambient pressure, vibratory environment, and altitude cold start and hot restart capability effects are
verified by analysis, test, and demonstration.
4. Steady state and transient response characteristics of the engine and engine control system, engine
response to input signals at different frequencies, fuel flow modulation, engine control and vehicle control
system communication, and auxiliary engine control function effects to propulsion system instabilities are
verified by analysis, test, and demonstration.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1797A Def-Stan 00-970 00-970 P1 S5.1.15
JSSG 2007A Section 3.1.1.1 Reference: 00-970 P1 S5.1.16
MIL-HDBK-516C 6.3.1 00-970 P1 S5.1.17
00-970 P5 UK25.903a 00-970
P7 L700 S2.1
00-970 P9 S2 UK FW.901d
STANAG
Reference:
CS 25.903
CS 27.901
CS 27.903
CS 29.901
CS 29.903
6.3.2 Performance information.

The aircraft performance information provided to the pilot/operator shall be suitably complete and
accurate to ensure safe flight.

a. The types and level of detail of information relevant to the pilots' continued safe flight of the aircraft.
b. The information that may be required through all of the aircraft's flight phases (preparation, taxi, launch,
take-off, climb, cruise, descent, approach and landing/recovery).
c. The information that may be required through manoeuvres (turning, hover, in-flight refuelling, etc.).
d. The information that may be required in emergencies or in the event of equipment failures.

1. An aircraft force and moment accounting system.
2. Aerodynamic, propulsion, and mass properties databases, based on the latest information available.
3. Predictions of:
a. Trimmed lift and drag in and out of ground effect,

b. Installed thrust, power available, and power required,
c. Fuel flow and fuel quantity,
d. Inertias, centre of gravity, and weights.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1501
4671.1507
4671.1513
4671.1519
4671.1521
4671.1525
4671.1527
4671.1581
4671.1583
4671.1585
4671.1587
4671.1589
CS 23.1507
CS 23.1511
CS 23.1513
CS 23.1519
CS 23.1521
CS 23.1525
CS 23.1527
CS 23.1581
CS 23.1583
CS 23.1585
CS 23.1587
CS 23.1589
CS 25.1501
CS 25.1503
CS 25.1505
CS 25.1507
CS 25.1516
CS 25.1517
CS 25.1519
CS 25.1521
CS 25.1525
CS 25.1527
CS 25.1531
Information Sources
CS 25.1533
CS 25.1581
CS 25.1583
CS 25.1585
CS 25.1587
CS 25.1591
CS 27.1501
CS 27.1503
CS 27.1505
CS 27.1509
CS 27.1519
CS 27.1521
CS 27.1525
CS 27.1527
CS 27.1581
CS 27.1583
CS 27.1585
CS 27.1587
CS 27.1589
CS 29.1501
CS 29.1503
CS 29.1505
CS 29.1509
CS 29.1517
CS 29.1519
CS 29.1521
CS 29.1525
CS 29.1527
CS 29.1581
CS 29.1583
CS 29.1585
CS 29.1587
CS 29.1589
6.3.3 Performance limits.

All aircraft performance flight limits shall be provided to the pilot/operator to ensure safe operation.

a. Limits relevant to the pilots' continued safe flight of the aircraft.
b. Limits that may be required through all of the aircraft's flight phases (preparation, taxi, launch, take-off,
climb, cruise, descent, approach and landing/recovery).
c. Limits that may be required through manoeuvres (turning, hover, in-flight refuelling, etc.).
d. Limits relevant in emergencies or in the event of equipment failures.

3. Predictions of:
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1501
4671.1507
4671.1513
4671.1519
4671.1521
4671.1525
4671.1527
4671.1581
4671.1583
4671.1585
4671.1587
4671.1589
CS 23.1507
CS 23.1511
CS 23.1513
CS 23.1519
CS 23.1521
CS 23.1525
CS 23.1527
CS 23.1581
CS 23.1583
CS 23.1585
CS 23.1587
CS 23.1589
CS 25.1501
CS 25.1503
CS 25.1505
CS 25.1507
CS 25.1516
CS 25.1517
CS 25.1519
CS 25.1521
CS 25.1525
CS 25.1527
Information Sources
CS 25.1531
CS 25.1533
CS 25.1581
CS 25.1583
CS 25.1585
CS 25.1587
CS 25.1591
CS 27.1501
CS 27.1503
CS 27.1505
CS 27.1509
CS 27.1519
CS 27.1521
CS 27.1525
CS 27.1527
CS 27.1581
CS 27.1583
CS 27.1585
CS 27.1587
CS 27.1589
CS 29.1501
CS 29.1503
CS 29.1505
CS 29.1509
CS 29.1517
CS 29.1519
CS 29.1521
CS 29.1525
CS 29.1527
CS 29.1581
CS 29.1583
CS 29.1585
CS 29.1587
CS 29.1589
6.3.4 Performance information.

Failures that appreciably affect the performance of the aircraft shall be identified and defined in the
Aircraft Flight Manual or other aircraft document. For such failures, the effect on the aircraft's performance
shall be characterised and defined in the same document.

a. Failures that could affect the continued safe flight of the aircraft.
b. Failures affecting performance through all of the aircraft's flight phases (preparation, taxi, launch, take-
off, climb, cruise, descent, approach and landing/recovery).
c. Failures affecting performance through manoeuvres (turning, hover, in-flight refuelling, etc.).

3. Predictions of:
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516C 6.3.4 Def-Stan 00-970
Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
SECTION 7 - PROPULSION AND PROPULSION

INSTALLATIONS
This section covers the design, installation, arrangement and compatibility of the complete aircraft
propulsion system and subsystem components.

• Propulsion Safety Management Criteria, necessary to identify, analyse and mitigate propulsion
system risks.
• General Engine System Criteria, necessary to ensure that the engine and associated subsystems
functionality, performance and operation allows safe operation of the aircraft. The scope of this
section encompasses both installed and uninstalled propulsions system and covers:
• Normal engine operation and performance;
• Degraded engine operation and performance;
• Consideration of all installation effects (functional, physical and compatibility) due to
aircraft/engine integration;
• Engine subsystems, components, computer resources and software;
• Performance across all intended operational environments.
• Alternate Propulsions Systems Criteria for propeller driven systems, rotary wing platforms and
reciprocating engines.
The certification team will need to align and review all of the propulsion criteria when defining the
certification requirements for engines, propellers, and Rotary Wing and Fixed Wing integration. For
guidance, a cross reference matrix of the EMACC Handbook Section 7 structure to an equivalent EASA
Civil Structure has been produced below.
Civil Structure
RW installation
FW Installation
Propellers
PROPULSION AND PROPULSION INSTALLATIONS

Engines
(EMACC Structure)
7.1 Propulsion Risk Management.
7.1.1 Safety-critical propulsion system x x x x
7.1.2 Engine Out x x
7.1.3 Technical data
7.1.5 Critical safety items x x x x
7.1.6 Propulsion system operation x x x x
7.2 Gas turbine engine applications.
7.2.1 Performance.
7.2.1.1 Installed performance x x x x
7.2.1.1.1 Volcanic Conditions
7.2.1.2 Degraded performance x x x x
7.2.2 Operability.
7.2.2.1 Stability margin x x x x

7.2.2.2 Transient operation x x x x
7.2.2.3 Air start x x x x
7.2.2.4 Stall recoverability x x x x
7.2.3 Structures.
7.2.3.1 Engine structure. x x
7.2.3.2 Through life Durability x x
7.2.3.3 Damage tolerance x x
7.2.3.4 Material characterization. x x
7.2.3.5 Design service life x x
7.2.3.6 Life management x x
7.2.4 Engine subsystems, components, computer resources and software.
7.2.4.1 Subsystems.
7.2.4.1.1 Engine control system x x
7.2.4.1.2 Isolation of subsystems x x
7.2.4.1.3 Stability x x
7.2.4.1.4 Failure modes x x
7.2.4.1.5 Failure criticality x x x x
7.2.4.1.6 Fuel system x x x x
7.2.4.1.7 Ignition system x x
7.2.4.1.7.1 Battery operated ignition systems at a platform
x x
level
7.2.4.1.8 Anti-ice/de-ice systems x x
7.2.4.1.9 Cooling and thermal management x x x x
7.2.4.1.10 Variable geometry systems x x x x
7.2.4.1.11 Lubrication system operation x x x x
7.2.4.1.12 Lubrication system discharge x x x x
7.2.4.1.13 Lubrication system non-combustion x x x x
7.2.4.1.14 Propulsion monitoring system x x x x
7.2.4.1.15 Engine bleed air system x x x x
7.2.4.2 Components: mechanical and electrical.
7.2.4.2.1 Controls and subsystems rotating components x x x x
7.2.4.2.2 Bearing thrust balance x x x x
7.2.4.2.3 Tubing/plumbing routing x x
7.2.4.2.4 Tubing/plumbing vibratory response x x x x
7.2.4.2.5 Externals maximum operating conditions x x
7.2.4.2.6 Gearboxes x x
7.2.4.2.7 Gearbox mounted component failures x x
7.2.4.2.8 PTO shaft x x
7.2.4.2.9 Electrical components and cable routing x x
7.2.4.2.10 Electromagnetic environment x x
7.2.4.2.12 Electrical power x x x x
7.2.4.2.13 Computer resources and software x x x x
7.2.5 Installations.
7.2.5.1 Physical Installation.
7.2.5.1.1 Physical interfaces x x
7.2.5.1.2 Engine mounts x x
7.2.5.1.3 Power-take-off (PTO) shaft vibratory response x x
7.2.5.1.4 Uncontained rotating parts x x
7.2.5.1.5 Engine/aircraft clearances x x
7.2.5.1.6 Drains and ventilation systems x x
7.2.5.1.7 Engine stall loads x x
7.2.5.1.8 Installed engine accessibility x x
7.2.5.1.9 FOD/DOD x x
7.2.5.2 Functional installation.
7.2.5.2.1 Functional compatibility x x
7.2.5.2.2 Power demands/extractions x x
7.2.5.2.3 Bleed air contamination x x
7.2.5.2.4 Engine shutdown x x
7.2.5.3 Inlet compatibility.
7.2.5.3.1 Inlet compatibility x x
7.2.5.4 Exhaust system compatibility.
7.2.5.4.1 Exhaust gas impingement x x
7.2.5.4.2 Thrust reverser/thrust vectoring x x
7.2.5.5 Environmental compatibility.
7.2.5.5.1 Engine bay/nacelle cooling and ventilation x x
7.2.5.5.2 Vibratory compatibility x x
7.2.5.6 Installation other.
7.2.5.6.1 Crew/operator station compatibility x x
7.3 Alternate propulsion systems.
7.3.1 Propeller driven systems.
7.3.1.1 Design margins x
7.3.1.2 Critical speeds x
7.3.1.3 Reversing and pitch controls x
7.3.1.4 Propeller interfaces x x
7.3.1.5 Feathering system x
7.3.1.7 Vibration and balancing x
7.3.1.8 Ice control system x
7.3.1.9 Bird strike resistance x
7.3.1.10 Environmental conditions x
7.3.2 Rotary wing systems.
7.3.2.1 Design margins x
7.3.2.2 Safe controllability x
7.3.2.3 Main rotor blade passage frequencies x
7.3.2.4 Engine/airframe vibratory response x
7.3.2.5 Lubrication system x
7.3.2.6 Dynamic coupling x

7.3.2.7 Control system stability x
7.3.2.8 Misalignment x
7.3.2.9 Rotor securing x
7.3.2.10 Braking x
7.3.2.11 Condition monitoring x
7.3.2.12 Load absorbers x
7.3.2.13 Loss of lubrication x
7.3.2.14 Rotor meshing x
7.3.2.15 Accessory drives x
7.3.2.16 Environmental conditions x
7.3.2.17 Drive system design x
7.3.2.18 Space envelope x
7.3.2.19 Protection from environmental elements x
7.3.2.20 Accessibility x
7.3.2.21 Faults and warnings x
7.3.2.22 Contamination x
7.3.3 Reciprocating engines.
7.3.3.1 Reciprocating engines
7.3.4 Other propulsion systems

1. Design criteria
2. Design studies and analyses
3. Design, installation, and operational characteristics
4. Engine ground and simulated altitude tests
5. Engine design function/system compatibility tests
6. Engine component and functional level qualification and certification tests
7. Electromagnetic environmental effects
8. Installed propulsion compatibility tests
9. Acceptance test results
10. Failure modes, effects, and criticality analysis/testing (FMECA/FMET)
11. Hazard analysis and classification
12. Safety certification program
13. Engine endurance and accelerated mission testing
14. Engine and component structural and aeromechanical tests
15. Flight test plans and results
16. Engine structural integrity program (ENSIP) analyses and tests
17. Engine life management plans
18. Over-speed and over-temperature tests
19. Overall engine and component performance analyses
20. Flight manual
21. Natural environmental sensitivities
22. Inlet airflow distortion/engine stability assessments and audits
23. Interface/integration control documents
24. Function, subfunction, and component specifications

25. Selection criteria and inlet distortion patterns selected to demonstrate inlet/engine compatibility.
26. Engine control system rig tests
27. Engine health monitoring system design reports and tests
28. Aircraft/engine operating limitations
29. Engine software development plan and product specifications
30. Engine software test plans, test procedures and test reports
31. Engine software configuration control/management plan and procedure
32. Propulsion and Power Flight Clearance Plan, JSSG-2007A, Table XLVIIIb
33. Diminishing manufacturing sources plan
34. Obsolete parts plan
7.1 PROPULSION RISK MANAGEMENT.

This section details Propulsion Risk Management Criteria, necessary to identify, analyse and mitigate
propulsion system risks.
7.1.1 Safety-critical propulsion system.

The propulsion system certification documentation shall be reviewed to ensure that a satisfactory safety
analysis has been completed.

a. Integrating the engine safety analysis into the platform safety management system;
b. All constituent sub-systems (typically control systems);
c. Direct lift engine systems and any safety requirements over and above those for a standard installation;
d. Ensuring the safety-critical propulsion system risks are identified, probabilities are validated, and risk
controls (which may be related to airframe specific measures including configuration features) are in
place;
e. Contribution to, or mitigation of propulsion risks introduced by integrating systems (typically ground
support systems).
f. Ensuring maintenance and inspection requirements are documented in the technical data.

1. Failure Modes Effects and Criticality Analysis (FMECA) and System Safety Hazard Analysis.
2. A Documented system safety approach to describe the practices to manage propulsion risks to the
required in-flight shutdown rates.
3. Review of technical data to ensure maintenance and inspection requirements and special procedures
have been documented.
Information Sources
Comm'l Doc: SAE ARP 5580
DoD/MIL Doc: JSSG-2007A: A.3.1, A.4.1; Def-Stan 00-970 00-970 P1 3.9
A.3.2, A.4.2; A.3.2.1, A.4.2.1; Reference: 00-970 P1 3.10
A.3.3.1, A.4.3.1; A.3.3.2, 00-970 P1 4.19.34
Information Sources
A.4.3.2; A3.4, A.4.4; A.3.5.1, 00-970 P1 5.1.140
A.4.5.1; A.3.7, A.4.7; A.3.7.2.1, 00-970 P11 S3 E690
A.4.7.2.1; A.3.11, A.4.11;
00-970 P11 S4.1
A.3.12, A.4.12; Table XLIXa
STANAG 4671.1529
Reference: 4671.901
FAA Doc: 14CFR references: 33.5, EASA CS CS-E 25
33.35, 33.75, 33.8 Reference: CS-E 510
AC 33-2B CS 23.901
CS 23.903
CS 23.1529
CS 25.901
CS 25.903
CS 25.1529
CS 27.1529
CS 29.1529
7.1.2 Engine Out

An engine out condition on a multi-engine aircraft shall not prevent the safe recovery of the aircraft.
Consideration should be given to all phases of flight including:

a. Take-off;
b. Cruise;
c. Landing;
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.2, A.4.2, Def-Stan 00-970 00-970 P1 2.4.22
A.3.11, A.4.11, A.3.12, A.4.12 Reference: 00-970 P1 2.4.23
00-970 P1 2.14
00-970 P1 3.4.11
00-970 P1 4.14.13
00-970 P1 5.1.3
00-970 P1 6.12.15
00-970 P1 7.1.2
00-970 P13 1.5.1.5
STANAG 4671.U2
Reference: 4671.143
4671.367
4671.745
4671.1413
33.5, 33.7, 33.8 Reference: CS 23.367
AC 33-2B CS 23.745
CS 23.903
CS 23.1309
CS 25.143
Information Sources
CS 25.105
CS 25.107
CS 25.109
CS 25. 117
CS 25.121
CS 25.362
CS 25.367
CS 25.901
CS 25.1309
CS 27.33
CS 27.51
CS 27.75
CS 27.143
CS 27.917
CS 27.1309
CS 29.33
CS 29.53
CS 29.63
CS 29.79
CS 29.83
CS 29.143
CS 29.917
CS 29.1309
7.1.3 Technical data.

The technical data provided by the manufacturer shall include all propulsion system related operational
and maintenance procedures and limitations necessary for safe operation and maintenance of the
aircraft.

a. Normal and emergency operating procedures.
b. Requirements for unscheduled maintenance.
c. Requirements for routine maintenance.
d. Information relating to component lifing requirements.

1. Inspection of the maintenance and inspection of the technical orders and flight manuals provides
assurance that all information is current and up to date.
2. Review of the system and process used to maintain the technical orders and flight manuals provides
assurance that critical information will be correctly updated in a timely manner.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.2.20
00-970 P1 4.4.3
00-970 P1 5.1.8
Information Sources
00-970 P11 3.E20
00-970 P11 3.E510
00-970 P11 3.E515
STANAG 4671.1501-4671.1589(USAR)
Reference:
FAA Doc: 14CFR references: 23.1585 EASA CS CS 23.1501-23.1589
Reference: CS 25.1501-25.1589
CS 27.1501-27.1589
CS 29.1501-29.1589
CS-E 20
CS-E 510
CS-P 150
CS-P 160
7.1.4 Merged with Section 4.6

7.1.5 Critical safety items.
Engine-related critical safety items (CSI) and critical characteristics shall be identified.

a. Propulsion system parts, assemblies, or installations containing critical characteristics whose failure,
malfunction, or absence may cause a catastrophic or critical failure.
b. Control inputs which could result in an uncommanded engine shutdown that jeopardizes safety.

1. Inspection of the Critical Safety Item (CSI) list and FMECA to ensure that all items have been
accounted for.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2007A: 3.4.1.4 Def-Stan 00-970 00-970 P11 3.E515
DoDM 4140.01, Vol 11, Enc 3, Reference:
Procedures 3, CSI-Specific STANAG 4671.1529
Procedures Reference:
NAVAIRINST 4200.56
Critical Item Management
Desktop Guide (to NAVAIR
4200.56)
JACG Aviation Critical Safety
Item Management Handbook
FAA Doc: EASA CS CS-E 20
Reference: CS-E 510
CS-E 515
CS-P 150
CS-P 160
CS 23.1529
CS 25.1529
Information Sources
CS 27.1529
CS 29.1529
7.1.6 Propulsion system operation.

Engine thrust or power, fuel consumption, endurance, and structural integrity should be characterized
with representative installation effects over the expected flight and manoeuvre envelope and shown to
support the safe operation of the aircraft.

a. Inlet effects due to:
i. External protuberances (sensors, probes);
ii. Anti-ice devices;
iii. Sand and dust separators;
iv. Exhaust system effects due to infrared (IR) or noise suppressors;
v. Extractions due to bleed air and mechanical power.
b. Operational environments such as cold and hot days, and weather such as rain, snow, or ice.
c. Operational environments can also include bird, ice, sand, volcanic ash ingestion, as well as hot gas
ingestion from any source (including armament gases).
d. The manoeuvre envelope, including rotational velocities, accelerations, and gyroscopic moment
conditions.

1. A combination of engine test, analysis and review of documentation.
2. Verification of baseline performance, installation effects and deterioration caused by the operational
environment at representative ground and altitude conditions.
3. Analysis performed with a model based on measured test data for characterization of performance at
conditions that have not been tested.
4. Analysis to verify that component deflections under gyroscopic loading conditions do not impair
operation of the engine under ultimate loading levels and meet life requirements under limit load
conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007: A.3.2, A.4.2 Def-Stan 00-970 00-970 Pt1 Sec 5.1.33 to
(Performance and Operability); Reference: 5.1.39
A.3.3, A.4.3 (Environmental 00-970 Pt 11 Sec 2.3
Conditions); A.3.4, A.4.4 00-970 Pt 11 Sec 2.10
(Integrity)
00-970 Pt 11 Sec 2.11
00-970 Pt 11 Sec 2.13.4
STANAG 4671.USAR: 901
Reference: 4671.USAR: 903
FAA Doc: 14 CFR 33.23, 33.5, 33.35, EASA CS CS-E 510
33.7, 33.75, 33.8, 33.91 Reference: CS-E 515
CS-E 40
CS-E 100
CS-E 170
CS-E 250
Information Sources
CS-E 560
CS-P 150
CS 23.901
CS 25.901
CS 27.901
CS 29.901
7.2 GAS TURBINE ENGINE APPLICATIONS.

This section details General Engine System Criteria, necessary to ensure that the engine and associated
subsystems functionality, performance and operation allows safe operation of the aircraft. The scope of
this section encompasses both installed and uninstalled propulsions system and covers:
• Normal engine operation and performance;

• Degraded engine operation and performance;
• Consideration of all installation effects (functional, physical and compatibility) due to
aircraft/engine integration;
• Engine subsystems, components, computer resources and software;
• Performance across all intended operational environments.
7.2.1 Performance.
7.2.1.1 Installed performance.
Engine performance shall be adequate for safe operation of the aircraft. This includes consideration of all
installation effects due to aircraft/engine integration, and all intended operational environments.

a. Engine steady and transient response characteristics of the engine and engine control system,
including Reheat Modulation
b. Fuel flow modulation
c. Engine responses to input signals at different frequencies
d. Engine control and vehicle control system communication
e. Fuel, air induction, exhaust and bleed air extraction systems, ambient temperatures, ambient
pressures, and vibratory environment
f. Performance rating structure
g. Performance deterioration throughout normal operating conditions
h. Performance deterioration due to particular ingestion conditions (rain, hail, birds, sand, ice, snow, etc.)
i. Sensitivity, stability, control response, and torque predictability for engine and vehicle control during
engine power changes (acceleration and deceleration)
j. Auxiliary engine control functions
k. Altitude cold start and hot restart capability
l. Relight
m. Pressure and drag effects due to engine installation protuberances such as sensors and probes

1. A combination of engine tests and analyses.
2. Testing at representative ground and altitude conditions to characterize and verify baseline
performance.
3. Analyses performed with a model based on measured test data for characterization of performance at
4. The trend toward system integration may lead to Electronic Engine Control Systems that:
i. Have other control functions integrated within the Engine Control System, such as an integrated Engine
and Propeller Control System or,
ii. Depend on aircraft resources.
Examples of these aircraft supplied resources include recording of rotorcraft One Engine Inoperative data
and aircraft central computers that perform some or all of the Engine control functions.
The applicant is responsible for specifying the specifications for the EECS for these aircraft supplied
resources in the Engine instructions for installation and substantiating the adequacy of those
specifications (AMC E 20 Engine Configuration and Interfaces).
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007: A.3.1, A.4.1; Def-Stan 00-970 00-970 P1 2.4
A.3.7, A.4.7; A.3.2, A.4.2; Reference: 00-970 P1 2.5
A.4.2.1, A.4.2.1.1; A.3.3.1, 00-970 P1 5.1.33-5.1.39
A.4.3.1; A.3.3.2, A.4.3.2;
00-970 P1 5.1.127-5.1.134
A.3.11, A.4.11; A.3.12, A.4.12;
Table XLIXa and JSSG-2001B 00-970 P1 5.1.135
3.3.1.1, 4.3.1.1 STANAG 4671. 901
4671.1309
33.35, 33.7, 33.8, Reference: CS 23.1301
FAA AC 33.2B CS 23.1309
CS 25.901
CS 25.943
CS 25.1301
CS 25.1309
CS 27.901
CS 27.1301
CS 27.1309
CS 29.901
CS 29.1301
CS 29.1309
CS-E 20
CS-E 40
CS-E 300
CS-E 430
CS-E 440
CS-E 690
CS-E 740
7.2.1.1.1 Volcanic Conditions

The ability of any aircraft to operate in, or in the vicinity of, a volcanic ash cloud shall be clearly
understood and detailed in the aircraft operating manuals. It is understood that military operational
imperatives may override this regulatory criteria as necessary.

Engine abrasion corrosion;
a. Blockage of engine cooling ducts/vents or paths;
b. Aircraft skin and transparency abrasion;
c. Damage to systems from ingestion of particles (air conditioning, electronic cooling, contamination of
surfaces or fluids)
e. Blockage of air data system (pitot or static systems);

2. Analyses performed with a model based on measured test data for characterization of performance at
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:
7.2.1.2 Degraded performance.

Degraded engine performance shall meet the relevant requirements for safety.
In addition to considerations defined in 7.2.1.1, consideration should be given to:

a. Performance in any backup control mode.
b. Performance after bird, excessive ice, rain, or sand ingestion.
c. Performance for time limited dispatch

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: Backup control: Def-Stan 00-970 00-970 P11 3.E50
A.3.7.2.1.1, A.4.7.2.1.1; Bird Reference: 00-970 P11 3.E540
ingestion: JSSG-2007A 00-970 P11 3.E780
A.3.3.2.1, A.4.3.2.1; Ice
00-970 P11 3.E790
ingestion: A.3.3.1.4, A.4.3.1.4;
and Sand ingestion: A.3.3.2.4, 00-970 P11 3.E800
A.4.3.2.4 STANAG 4671.903
Reference:
Information Sources
FAA Doc: 14CFR references: 33.65 EASA CS CS-E 20e
Surge and stall characteristics; Reference: CS-E 50
33.73 Power or thrust CS-E 540
response; and 33.89 Operation
CS-E 580
test
CS-E 700
CS-E 780
CS-E 790
CS-E 800
CS-E 820
CS-E 1030
7.2.2 Operability.
7.2.2.1 Stability margin.
Adequate positive stability margin shall exist in all flight conditions, or placards shall be documented in
the flight manual.

a. Ensuring positive engine surge margin at conditions that are critical to the safety of the flight vehicle,
such as crosswind take-offs, take-offs on cold days following a rapid reaction start, and extreme
manoeuvers.
b. All destabilizing effects, such as: engine deterioration, non-standard day effects, steam ingestion,
armament gas ingestion, liquid water ingestion, and transient response.

1. Rig and/or engine tests to measure fan and compressor stall lines.
2. A stability methodology developed by testing fan/compressor sensitivity to distortion and other
destabilizing influences.
3. Inlet model tests conducted to quantify the levels of performance, distortion, and inlet stability.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.2.2.6, Def-Stan 00-970 00-970 P1 2.13.14
A.4.2.2.6, A.3.2.2.11, Reference: 00-970 P1 5.1.12
A.4.2.2.11, A.3.3.2.5, 00-970 P1 5.1.15
A.4.3.2.5, A.3.3.2.6, A.4.3.2.6,
00-970 P1 5.1.138
A.3.3.2.7, A.4.3.2.7
00-970 P1 5.1.140
00-970 P11 3.E500
00-970 P11 3.E745
STANAG 4671. 939
4671.1541
4671.1581
4671.1583
33.73 (stability), 33.5 Reference: CS 23.1521
(distortion) CS 23.1541
Information Sources
CS 23.1581
CS 23.1583
CS 25.939
CS 25.1521
CS 25.1541
CS 25.1581
CS 25.1583
CS 27.939
CS 27.1521
CS 27.1541
CS 27.1581
CS 27.1583
CS 29.939
CS 29.1521
CS 29.1541
CS 29.1581
CS 29.1583
CS-E 25
CS-E 50
CS-E 500
CS-E 745
7.2.2.2 Transient operation.

The engine shall have adequate stability during throttle transients to achieve required manoeuvres safely.
Consideration should be given to the full range of activities which include, but are not limited to:
a. Land and ship approaches, AAR, quick stops, use of reverse thrust, and VSTOL;
b. For rotorcraft, bob-up and re-mask, and nap of the earth ridgeline crossings.

1. Analysis, electronic and closed loop bench tests, engine tests, vehicle integration tests, flight tests and
inspection of documentation.
Information Sources
Comm'l Doc:
A.4.2.2.6, A.3.2.2.7, A.4.2.2.7 Reference: 00-970 P13 3.5.68
MIL-HDBK-516: criteria 00-970 P13 3.5.73
7.2.4.1.3 00-970 P1 2.19.26-2.19.32
00-970 P1 5.1.15
00-970 P1 5.1.138
00-970 P1 5.1.140
00-970 Pt 11 3.E500
00-970 Pt 11 3.E740
00-970 Pt 11 3.E745
STANAG 4671.939
Reference:
Information Sources
33.73, 33.89 Reference: CS 25.939
CS 27.939
CS 29.939
CS-E 50
CS-E 500
CS-E 740
CS-E 745
CS-E 890
7.2.2.3 Air start.

The requirements for an in-flight engine relight, or air-start, ability shall be met, and the associated
procedures and any limitations documented in the flight manual.

1. Engine spool-down.
2. Windmill start.
3. Start using cross-bleed, or starter-assisted as appropriate.
4. Hot and cold relights.

1. Initial verification through ground testing in altitude test cells.
2. Verification though flight test.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.2.2.3.2, Def-Stan 00-970 00-970 P1 5.1.57
A.4.2.2.3.2 Reference: 00-970 P1 5.1.86-5.1.89
00-970 P1 5.1.136
00-970 P1 5.1.140
00-970 P11 S2.5
00-970 P11 3E.910
STANAG 4671.903
FAA Doc: 14CFR references: 33.89 EASA CS CS 23.903
CS 23.1585
CS 25.903
CS 25.1581
CS 25.1585
CS 27.903
CS 27.1581
CS 27.1585
CS 29.903
CS 29.1581
CS 29.1585
CS-E 370
Information Sources
CS-E 500
CS-E 910
7.2.2.4 Stall recoverability.

The engine shall recover from any instability induced by external influences (such as inlet distortion,
steam, or armament gas ingestion) after the external influence is removed, without employing measures
such as commanded idle or shutdown, and without exceeding thermal or structural limits.

a. Automatic relight system for single engine applications.

1. Verification of control system detection by engine ground and bench testing.
2. Self-recovery is demonstrated from engine ground and altitude cell testing.
Information Sources
Comm'l Doc:
A.4.2.2.3.5, A.3.2.2.11.2, Reference: 00-970 P1 5.1.139
A.4.2.2.11.2, A.3.7.2.1, 00-970 P13 3.2.36
A.4.7.2.1
00-970 P11 4.5
00-970 P11 4.6.1
STANAG 4671.1091
Reference:
33.65 Reference: CS 25.1091
CS 27.1091
CS 29.1091
CS-E 50*
CS-E 500
CS-E 540
7.2.3 Structures.
7.2.3.1 Engine structure.
The engine structure shall not:
1. Exhibit detrimental permanent set or deflect to the extent that operation or performance is impaired
when operated to limit load conditions (singly or in combination) within the flight or ground envelope.
2. Experience catastrophic failure under ultimate load conditions or combinations of ultimate loading.

a. Definitions of limit and ultimate loads.
b. Integrity of engine case and pressure vessels including pressure balance and blade containment.
c. Engine mounts and associated structure.
1. Verification methods include analysis, test, demonstration, simulation, inspection and review of
documentation for:
- Factor of safety (SF)
- Rotor integrity
- Gyroscopic moments
- Disk burst speed
- Blade and disk deflection
- Blade out
- Engine mounts
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1783B: A.3.4.1.6, Def-Stan 00-970 00-970 P11 2.11.2
A.4.4.1.6 Strength; A.3.1.1.4.3, Reference: 00-970 P11 3.70
A.4.1.1.4.3 Engine Stiffness; 00-970 P11 3.100
A.3.4.1.2.1, A.4.4.1.2.1
00-970 P11 3.510
Externally Applied Forces
00-970 P11 3.680
00-970 P11 3.810
00-970 P11 S4
STANAG 4671.361
Reference: 4671.363
4671.371
33.91, 33.23 Reference: CS 23.361
CS 23.363
CS 23.371
CS 25.361
CS 25.362
CS 25.363
CS 25.371
CS 27.361
CS 27.549
CS 29.361
CS 29.549
CS-E 70
CS-E 100
CS-E 510
CS-E 680
CS-E 810
7.2.3.2 Through life Durability.

The engine shall have a positive durability margin over the defined operational interval and duty cycle to
preclude adverse safety impacts.

a. Cycle fatigue life margins.
b. Vibratory stresses.
c. Degradation due to material corrosion.
d. Foreign object/domestic object damage

e. Requirements regarding inspection procedures/intervals during operation.

documentation for:
- Low cycle fatigue margin (LCF)
- High cycle fatigue margin (LCF)
- Corrosion
- Creep
- Vibration
- Acoustic environment
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007: A.3.4.1.5, Def-Stan 00-970 00-970 P11 2.13
A.4.4.1.5, Durability; Reference: 00-970 P11 3.25
A.3.4.1.5.2, A.4.4.1.5.2, LCF; 00-970 P11 3.70
A.3.3.1.5,A.4.3.1.5, Corrosive 00-970 P11 3.90
atmosphere; 00-970 P11 3.140
A.3.4.1.8,A.4.4.1.8, Vibration 00-970 P11 3.270
and dynamic response; 00-970 P11 3.340
A.3.4.1.5.1, A.4.4.1.5.1, High 00-970 P11 3.440
cycle fatigue (HCF) life 00-970 P11 3.510
guidance; 00-970 P11 3.650
A.3.2.1.4, A.4.2.1.4, 00-970 P11 3.700
Performance retention 00-970 P11 3.740
guidance; 00-970 P11 4.7
A.3.4.1.10, A.4.4.1.10 Acoustic 00-970 P11 4.9.1
noise; 00-970 P11 4.12.1
A.3.3.2.2, A.4.3.2.2, Foreign STANAG 4671.901
object damage (FOD) Reference:
33.5, 33.63, 33.83, 33.19 Reference: CS-E 70
CS-E 90
CS-E 140
CS-E 270
CS-E 340
CS-E 440
CS-E 510
CS-E 650
CS-E 700
CS-E 740
7.2.3.3 Damage tolerance.

All safety and mission-critical parts shall be designed to be damage tolerant over the defined operational
interval and duty cycle.

a. Ensuring that safety and mission critical parts are serialized, properly marked and tracked, and
subjected to the required process control and NDI procedures.
b. Requirements regarding inspection procedures/intervals during operation.

documentation for:
- Fracture critical component
- Initial flaw size
- Residual strength
- Damage tolerance controls.
2. Damage Tolerance assessments should be performed to minimise the potential for Failure from
material, manufacturing and service-induced anomalies within the Approved Life of the part. (AMC E 515
Engine Critical Parts)
Information Sources
Comm'l Doc:
A.4.4.1.4 Parts classification; Reference: 00-970 P1 3.70
A.3.4.1.7, A.4.4.1.7 Damage 00-970 P1 3.80
tolerance; 00-970 P1 3.130
3.4.1.7 through 3.4.1.7.4 and 00-970 P1 3.510
A.4.4.1.7 through A.4.4.1.7.4, 00-970 P1 3.515
Composites damage tolerance 00-970 P1 3.570
00-970 P1 3.700
00-970 P11 4.7
STANAG
Reference:
FAA Doc: 14CFR references: 33.75 EASA CS CS-E 25
Reference: CS-E 70
CS-E 80
CS-E 130
CS-E 510
CS-E 515
CS-E 570
CS-E 700
7.2.3.4 Material characterization.

Material properties shall be based on the minimum specified for each material used and established
considering statistical variability, the expected environments, fabrication processes, repair techniques,
and quality assurance procedures. The conditions and properties for material repairs shall satisfy design
requirements.

a. Fracture toughness and crack growth rate.
Considerations of AMC:
1. Test and modelling programs to establish material structural properties.

2. Anticipated properties under damage states (e.g., fretting) have been verified.
3. Critical structural properties are dependent upon the manufacturing processes. This should be
accounted for during testing to ensure accurate comparison.
4. Damage states in the parts which may occur during field usage have been verified for their potential
effect on high cycle fatigue life.
Information Sources
Comm'l Doc:
A.4.4.1.3 Material Reference: 00-970 P1 3.70
characterization 00-970 P1 3.100
00-970 P1 3.515
00-970 P1 3.640
00-970 P1 3.650
00-970 P1 3.840
00-970 P11 4.7
STANAG
Reference:
Reference: CS-E 70
CS-E 100
CS-E 515
CS-E 640
CS-E 650
CS-E 840
7.2.3.5 Design service life.

The engine shall be designed such that pertinent environmental variables and all sources of repeated
loads are considered, and these considerations included in the development of the design duty cycle.

a. Defining the expected flight envelope.
b. Defining the type of mission and mission envelope.
c. Any power take-off requirements.
d. Expected environmental conditions (rain, sand, steam, temperature, etc.)
e. Any military deltas over and above the CS-E requirements.

1. The specification and/or the Structural Integrity Program (e.g., strength and life report), as appropriate,
document the design duty cycle details and life analyses.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007: A.3.4.1.2, Def-Stan 00-970 00-970 P1 5.1.33-5.1.39
A.4.4.1.2 Design usage Reference: 00-970 P11 2.3
00-970 P11 2.13
00-970 P11 3.25
Information Sources
00-970 P11 3.30
00-970 P11 3.90
00-970 P11 3.100
00-970 P11 3.210
00-970 P11 3.500
00-970 P11 3.510
00-970 P11 3.515
00-970 P11 3.680
00-970 P11 4
STANAG 4671.903
Reference:
Reference: CS-E 30
CS-E 90
CS-E 100
CS-E 210
CS-E 500
CS-E 510
CS-E 515
CS-E 680
7.2.3.6 Life management.

Engine inspection intervals and life-limited components shall be identified in the technical manuals.

a. Ensuring the required maintenance actions (component inspection, repair, or replacement
requirements) have been defined.
b. Allowance for Probability of Detection (POD) of the individual inspection processes.
c. The assumed in-service inspection procedures and intervals should be integrated into the Service
Management Plan and included, as appropriate, in the airworthiness limitations section of the instructions
for continued airworthiness.

1. Documentation of the Engine Life Management Plan, applicable maintenance manuals and the parts
life tracking program.
2. POD based upon the statistical review of sufficient quantities of relevant testing or experience (EASA
AMC E 515).
Information Sources
Comm'l Doc:
A.4.4.1.1 Design service life. Reference: 00-970 P11 3.25
00-970 P11 3.510
00-970 P11 3.515
STANAG
Reference:
Information Sources
FAA Doc: 14 CFR 33.4 EASA CS CS-E 25
Reference: CS-E 510
CS-E 515
7.2.4 Engine subsystems, components, computer resources and software.

7.2.4.1 Subsystems.
7.2.4.1.1 Engine control system.
The engine control system shall maintain safe and stable engine operation under all required conditions.

a. Keeping the engine within the approved operating limits over changing atmospheric conditions in the
declared flight envelope;
b. Modulating of engine power or thrust with adequate sensitivity and accuracy over the declared range of
engine operating conditions and transients;
c. Avoiding unacceptable thrust or power oscillations;
d. Ensuring that the architecture accommodates all control mode operations, including failure conditions.

1. A Failure Modes, Effects and Criticality Analysis (FMECA) and a System Safety Hazard Analysis
(SSHA) of the control system.
2. Closed loop bench testing, using production qualified components to ensure the system can properly
interact with all other systems and components on the engine.
3. Engine sea level and altitude testing.
4. Flight testing to ensure the engine performs as required and that there are no unaccounted for
installation effects.
5. Alternative compliance approaches include similarity to other military systems or previous civil (e.g.,
FAA) airworthiness certification support documentation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.2/A.4.7.2, Def-Stan 00-970 00-970 P11 3E.40
control systems design and Reference: 00-970 P11 3E.50
verification. 00-970 P11 3E.510
00-970 P11 S4
STANAG 4671.903
Reference:
33.28, 33.91 Reference: CS-E 50
CS-E 510
CS 25.20
7.2.4.1.2 Isolation of subsystems.

An engine’s subsystems shall be isolated from each other to prevent cascading failures which could result
in the loss of more than one propulsion sub-system due to any single or common cause.
a. Ensuring controls and subsystem components are:

i. Physically isolated or protected to minimize collateral or secondary damage in the event of failure.
ii. Systemically and operationally isolated.

1. Inspection of design review and test data, drawings and installed hardware provide information to
evaluate adequate physical isolation of engine subsystem components.
2. Mock-ups can be used if they adequately represent fielded systems.
3. A Failure Modes, Effects and Criticality Analysis (FMECA)
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.2/A.4.7.2, Def-Stan 00-970 00-970 P1 5.2.8
control systems guidance. Reference: 00-970 P11 3E.50
00-970 P11 3E.510
00-970 P11 S4
STANAG 4671.903
33.28, 33.91 Reference: CS-E 510
CS 23.903
CS 23.1143
CS 23.1309
CS 25.903
CS 25.1143
CS 25.1309
CS 27.1143
CS 27.1309
CS 29.903
CS 29.1143
CS 29.1309
7.2.4.1.3 Stability.
The engine control system shall maintain both stable engine operation and response during all steady
state and transient conditions.

a. Defining the steady state conditions (take-off, cruise, dash, etc.)
b. All specified operating environments (such ice, rain, snow, volcanic ash, etc.);
c. Defining the required responsiveness.
d. Reheat modulation

1. Phase and gain stability margins are verified through analysis, open and closed loop modelling, bench
testing (wet rig) and full-up engine testing.
2. Closed loop models are validated using closed loop bench and full-up engine testing.
3. Ground and flight testing.
Information Sources
Comm'l Doc:
control systems guidance. Reference: 00-970 P1 5.1.15
MIL-HDBK-516 criteria 7.2.2.2 00-970 P1 5.1.18
00-970 P1 5.1.138
00-970 P1 5.1.140
00-970 P11 3E.50
00-970 P11 3E.500
00-970 P11 3E.740
00-970 P11 3E.745
00-970 P11 3E.890
00-970 P11 S4
STANAG 4671.939
Reference:
33.28, 33.91 Reference: CS-E 500
CS-E 740
CS-E 745
CS-E 890
CS 23.939
CS 25.939
CS 27.939
CS 29.939
7.2.4.1.4 Failure modes.

Any failure of the engine controls and associated sub-systems shall result in a fail-safe condition.

a. Ensuring that loss of redundancy does not affect control system capability. Failures may be
accommodated by the following:
• Fail-operational capability provides full-up engine performance.

• Fail-safe capability allows continued engine operation at a degraded level of performance
sufficient to sustain safe aircraft operation.
• Failure accommodation on multi-engine platforms may include engine shutdown if loss of
aircraft does not result.
1. A Failure Modes, Effects and Criticality Analysis (FMECA).
2. Closed loop and fault injection bench testing to ensure the control system can correctly identify and
accommodate all known failures.
Information Sources
Information Sources
Comm'l Doc:
control systems guidance. Reference: 00-970 P11 3E.140
00-970 P11 3E.210
00-970 P11 3E.510
00-970 P11 S4
STANAG 4671.1141
33.28, 33.91 Reference: CS-E 140
CS-E 210
CS-E 510
CS-E 560
CS-E 590
CS 23.1309
CS 25.1309
CS 27.1309
CS 29.1309
7.2.4.1.5 Failure criticality.

Engine control system failures and accommodations shall not result in unacceptable controllability,
stability, or handling qualities; or require any urgent or excessive operator action.

a. The dynamic latency and response should ensure safe operation.
b. Appropriate warnings and cautions to notify the operator of failures.
c. Recording of critical and non-critical failures.

1. Flight testing for degraded engine control modes (e.g., reversionary, backup) verifies acceptable
handling qualities.
2. Closed loop bench and fault injection testing.
3. A Failure Modes, Effects and Criticality Analysis (FMECA).
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.2, A.4.7.2, Def-Stan 00-970 00-970 P11 3E.50
A.3.7.6, A.4.7.6 Reference: 00-970 P11 3E.140
00-970 P11 3E.210
00-970 P11 3E.500
00-970 P11 3E.510
00-970 P11 S4
STANAG 4671.1141
33.28, 33.91 Reference: CS-E 140
CS-E 210
Information Sources
CS-E 500
CS-E 510
CS 23.1309
CS 25.1309
CS 27.1309
CS 29.1309
7.2.4.1.6 Fuel system.

The engine fuel system shall safely provide the required fuel supply to the combustor and reheat sub-
systems under all required conditions.

a. Ensuring in-line filtration systems include cleaning, replacement and bypass indication.
b. Ensuring all fuel carrying components and lines are fire resistant.

1. Complete analysis of fuel system requirements versus capabilities, using worse case flight conditions,
establishes the system design parameters.
2. Bench (wet rig) testing demonstrates the fuel systems ability to produce required flows, pressures and
temperatures.
3. Ground engine testing demonstrates the fuel system's ability to provide properly conditioned fuel to the
engine.
4. A fuel filter flow and contamination test ensures that the filter adequately cleans debris from the fuel.
5. Applicable fuel system performance testing (suction lift, cavitation, vapour to liquid ratio (V/L), lubricity,
etc.).
6. Proof and burst pressure component testing.
Information Sources
Comm'l Doc: SAE-AS1055B, Fire Testing
DoD/MIL Doc: JSSG-2007A: Def-Stan 00-970 00-970 P11 3E.130
A.3.7.3.2/A.4.7.3.2, Fuel Reference: 00-970 P11 3E.140
Systems Performance, engine 00-970 P11 3E.210
fuel system design and
00-970 P11 3E.250
verification testing
JSSG-2007A: 00-970 P11 3E.440
A.3.1.8.1/A.4.1.8.1, Flammable 00-970 P11 3E.470
Fluid Systems - fire resistance 00-970 P11 3E.510
testing requirements and 00-970 P11 3E.560
procedures. 00-970 P11 3E.660
00-970 P11 3E.740
00-970 P11 S4
STANAG 4671.951
Reference:
33.67, 33.87(a)(7), 33.89, Reference: CS-E 140
33.91 CS-E 210
SAE AS4273
CS-E 250
Information Sources
SAE AS1055 CS-E 440
CS-E 470
CS-E 510
CS-E 560
CS-E 660
CS-E 740
7.2.4.1.7 Ignition system.

The engine ignition system shall provide a safe and effective ignition source for the main combustor and
reheat system.

a. Flameout detection and auto-relight, or manual activation of the ignition systems.
b. Sufficient insulation of external cabling to prevent inadvertent conduction.

1. Verification of the ignition system's ability to provide adequate spark energies to the main combustor
and augmenter.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: Def-Stan 00-970 00-970 P1 5.1.86
A.3.2.2.3.5/A.4.2.2.3.5, Auto- Reference: 00-970 P11 3E.210
Relight and A.3.7.5/A.4.7.5, 00-970 P11 3E.240
Ignition Systems
00-970 P11 3E.450
00-970 P11 3E.500
00-970 P11 3E.510
00-970 P11 3E.910
00-970 P11 S4
STANAG 4671.1165
Reference:
33.69 Reference: CS-E 500
CS-E 510
CS-E 910
7.2.4.1.7.1 Battery operated ignition systems at a platform level.

The battery operated engine ignition system shall provide a safe and dependable ignition source for the
main combustor and augmenter.

a. Capacity of batteries and generators to provide total load required by aircraft;
b. Inoperative generator(s);
c. Completely depleted batteries;
d. Routing of ground wires;
e. Independence of the ignition system from any other electrical system not used for assisting, controlling,
or analysing the ignition system;
f. Means to warn appropriate crew members if the malfunctioning of any part of the electrical system is
causing the continuous discharge of any battery necessary for engine ignition;
g. Each engine ignition system of a turbine powered aircraft must be considered an essential electrical
load.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:
7.2.4.1.8 Anti-ice/de-ice systems.

The engine anti-ice/de-ice system shall prevent damaging ice build-up, or provide safe and non-damaging
ice removal, at all engine speeds/power levels and shall not result in heat-induced damage to the
engine's front frame structure.

a. Temperature monitoring systems to prevent damage due to over-heat.

1. Analysis of the aircraft mission defines the engine's icing environment.
2. Bench and engine tests of the anti-ice or de-ice plumbing, valves and sensors.
3. Analysis and inspection of all critical control system components verifies resistance to moisture
collection and freezing.
4. Bench testing of the control system demonstrates that it can identify the existence of icing conditions
and turn on the anti-ice or de-ice system.
Information Sources
Comm'l Doc:
Anti-ice and De-ice Systems Reference: 00-970 P1 5.1.36
00-970 P1 5.1.42
00-970 P11 3E.230
00-970 P11 3E.780
00-970 P11 S4
STANAG 4671.929
Reference:
Reference:
7.2.4.1.9 Cooling and thermal management.

The engine cooling and thermal management systems shall safely remove excess heat from the engine
and its sub-systems and integrate with the aircraft thermal management system (if applicable).
a. The full operational envelope of the aircraft.

b. Those components (electronic controls, sensors, lubrication system, etc.) which could become
damaged, or operate erratically, if subjected to excessive thermal load.
c. Installation affects such as nacelle ventilation, surface temperatures, oil-fuel cooling and electronics
functioning.
d. Thermal load dissipation for the entire aircraft, including post-shutdown conditions such as engine
soakback.

1. Analysis and modelling of engine components determine their thermal loading and heat rejection
characteristics.
2. Verify the engine components' ability to continue operation when exposed to engine induced thermal
loads.
3. Analysis and modelling of the combined aircraft and engine thermal management systems ensures
there are no conditions that result in exceedance of established loss of aircraft (LOA) rates.
4. Engine testing is used to validate the results of thermal modelling and analyses.
5. Aircraft installation surveys are performed to verify that component maximum operating temperatures
and maximum non-operating temperatures are not exceeded.
Information Sources
Comm'l Doc:
A.3.2.2.13/A.4.2.2.13, Reference: 00-970 P1 5.3.5
A.3.7.3.3, A.4.7.3.3 00-970 P11 3E.60
00-970 P11 3E.260
00-970 P11 3E.740
00-970 P11 3E.860
00-970 P11 S4
STANAG 4671.1041
Reference:
Reference: CS-E 60
CS-E 100(a)
CS-E 660
CS-E 700
CS-E 740
CS-E 860
CS-E 870
CS 25.961
CS 25.1041
CS 29.961
CS 29.1041
7.2.4.1.10 Variable geometry systems.

Engine variable geometry systems shall operate safely under all engine operating conditions.

a. Variable intakes.
b. Variable exhaust nozzles, including re-heat.

c. Variable engine guide vanes.
d. Engine performance in the presence of incorrect inlet/nozzle/guide vane positioning.
e. Ensuring all variable geometry components and lines that carry fuel are fire resistant and those that
carry oil are fire proof.

1. Analysis and bench testing of each variable geometry system.
2. Engine and flight testing of the variable geometry system.
Information Sources
DoD/MIL Doc: JSSG-2007A: A.3.7/A.4.7, Def-Stan 00-970 00-970 P2 2.1
variable geometry system Reference: 00-970 P1 5.1.23
design and verification testing. 00-970 P1 5.1.45
A.3.1.8.1, A.4.1.8.1 Flammable
00-970 P1 5.1.48
Fluid Systems - fire resistance
and fire proof testing 00-970 P1 5.1.89
00-970 P11 3E.130
00-970 P11 3E.140
00-970 P11 3E.650
00-970 P11 S4
STANAG 4671.903
Reference:
27.695, 29.695, 33.17, 33.72, Reference: CS-E 650
43.1
7.2.4.1.11 Lubrication system operation.

The engine lubrication system shall operate safely under all engine and airframe operating conditions.

a. Oil supply, scavenge, cooling, filtration and de-aeration under all engine operating conditions.
b. Ensuring that the engine safely operates in a low or no lubrication condition for specified periods.
c. In-line filtration system inclusion of cleaning, replacement and a bypass indication.
d. Monitoring of system debris within lubricant.
e. Ensuring all oil carrying components, lines and manifolds are fire proof.

1. Lubrication system bench, engine and flight testing demonstrate its ability to provide the operating
pressures, temperatures and flows required in the engine specification.
2. Lubrication system simulator test verifies operational attitudes.
3. An oil de-aeration test ensures the system deaerator removes entrained air from the oil.
4. Analysis, bench and engine testing of all monitored lubrication system information.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.8/A.4.7.8, Def-Stan 00-970 00-970 P1 5.3
Lubrication System, A.3.1.8.1, Reference: 00-970 P11 3E.25
Information Sources
A.4.1.8.1 Flammable Fluid 00-970 P11 3E.130
Systems - fire resistance and 00-970 P11 3E.270
fireproof testing
00-970 P11 3E.440
00-970 P11 3E.570
00-970 P11 3E.740
00-970 P11 S4
STANAG 4671.1011-4671.1027
Reference:
FAA Doc: 14CFR references: 33.5, EASA CS CS 25.1011-25.1027
33.71, 33.87, 33.89 Reference: CS 29.1011-29.1027
CS-E 25
CS-E 130*
CS-E 570
CS-E 640
CS-E 680
CS-E 740
CS-E 770
7.2.4.1.12 Lubrication system discharge.

The lubrication system shall be free from excessive discharge at the breather.

a. Health and safety Threshold Limit Values.
b. Location and orientation of the breather exhaust port to minimise ground personnel's exposure.

1. Analysis of breather emissions establishes test parameters.
2. Instrumented engine testing measures breather emissions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: Def-Stan 00-970 00-970 P1 5.3.71-5.3.74
paraA.3.7.8.3/A.4.7.8.3, Reference: 00-970 P11 3E.270
Breather Mist - engine breather 00-970 P11 3E.570
exhaust emissions design and
00-970 P11 S4
verification testing.
STANAG 4671.1017
Reference:
Reference: CS-E 570
7.2.4.1.13 Lubrication system non-combustion.

The lubrication system and bearing compartments shall not support combustion.

a. System components such as: tanks, lines, fittings, sumps and gearboxes.
b. Components subject to both fuel and oil, such heat exchangers.
c. Ensuring all oil carrying components, lines and manifolds are fire proof.

1. Analysis of bearing compartments, tanks, lines, gearboxes and sumps establish the system design
parameters.
2. Analysis and bench testing verifies fuel and oil carrying component failures do not allow mixing of the
two systems.
Information Sources
A.3.1.8.1/A.4.1.8.1, Flammable Reference: 00-970 P11 3E.210
Fluid Systems - fire resistance 00-970 P11 3E.510
and fireproof testing, A.3.7.8,
00-970 P11 3E.570
A.4.7.8 Lubrication System
00-970 P11 S4
STANAG 4671.1011
Reference:
Reference: CS-E 210
CS-E 510
CS-E 570
7.2.4.1.14 Propulsion monitoring system.

The propulsion monitoring system shall provide adequate warnings in a timely manner to reduce
occurrences of in-flight shutdowns and power losses.

a. Oil and magnetic chip sampling programmes.
b. Ensuring all safety/mission-critical faults and warnings are supplied to the operator/maintainer.
c. Involvement of off-board components/IT systems in the processing of safety-related information.
d. Ensuring the propulsion monitoring and control systems provide accurate information and do not allow
false positive faults to occur.

1. Analysis and fault injection bench testing verifies the capability of the monitoring system.
2. Engine/aircraft testing provides assurance that the pilot/operator is provided clear notification of any
critical failure.
3. Engine fault download testing verifies the operators/maintainers have full access to failure data.
Information Sources
Comm'l Doc:
Engine Health Monitoring Reference: 00-970 P11 3E.50
Systems (EHMS), the Interface 00-970 P11 3E.60
Control Document (ICD) and
00-970 P11 3E.515
the pilot's operating manual
00-970 P11 S4
STANAG 4671.U1787
Reference:
Information Sources
Reference: CS-E 50
CS-E 60
CS-E 515
7.2.4.1.15 Engine bleed air system.

Engine bleed air system operation, including malfunctions, shall not adversely affect safety of flight,
particularly addressing degraded states.

a. Prevention of over-temperature, surge, stall, or other detrimental factors occurring to the Engine due to
air bleed extraction during all flight conditions in the aircraft operating envelope.

1. Bleed air interface airflow and quality is verified by test and demonstration.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007: A.3.1.1.7, Def-Stan 00-970 00-970 Pt1 5.1.74
A.4.1.1.7 Reference: 00-970 Pt1 5.1.75
00-970 Pt11 3.E690
Reference:
Reference: CS-E 690
CS-E 510
CS-E 20
CS 23.1111
CS 25.1103
7.2.4.2 Components: mechanical and electrical.

7.2.4.2.1 Controls and subsystems rotating components.
Any uncontained failure of an engine control or sub-system component containing rotating parts shall
have an adequately low risk of affecting the continued safe operation of the aircraft.
High-energy controls and subsystem rotating components shall be designed to be damage tolerant, or
provisions for containment of failed parts should be included.

a. Including, but not be limited to, pumps, turbochargers, or other rotating drives.
b. Damage tolerance methodologies.
c. System safety analysis in accordance with Section 14.

1. Analysis of components' damage tolerance design characteristics.
2. Analysis of components' protections (shields, locations, orientations, etc.)
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7/A.4.7, Def-Stan 00-970 00-970 P11 3E.20
Subsystems, engine Reference: 00-970 P11 3E.25
subsystem component design 00-970 P11 3E.50
and verification.
00-970 P11 3E.80
MIL-HDBK-1783B: A.4.8/A.5.8,
00-970 P11 3E.160
Damage Tolerance;
00-970 P11 3E.170
A.4.10.3/A.5.10.3,
00-970 P11 3E.210
Containment, component
00-970 P11 3E.510
containment design
00-970 P11 3E.515
requirements.
00-970 P11 S4
STANAG 4671.1461
Reference:
CS-E 210
CS-E 510
CS-E 515
7.2.4.2.2 Bearing thrust balance.

Changes in bearing thrust balance shall not result in the bearing operating in failure prone regions of
operation

a. Maximum expected changes in load and load direction (crossover) across the entire operating
envelope.

1. Analysis followed by bearing rig and full-up instrumented engine testing to ensure:
• Engine bearing radial and thrust loading is within design limitations

• Satisfactory operation of the bearing and rotor support system.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1783B: Def-Stan 00-970 00-970 P11 3E.100
A.4.10.10/A.5.10.10, Pressure Reference: 00-970 P11 3E.440
balance 00-970 P11 3E.500
00-970 P11 3E.520
00-970 P11 3E.740
00-970 P11 S4
STANAG
Reference:
Reference: CS-E 440
Information Sources
CS-E 500
CS-E 520
CS-E 740
7.2.4.2.3 Tubing/plumbing routing.

All engine mounted tubing, manifolds, clamps, electrical components and cabling shall be safely affixed
and routed on the engine.

a. Potential interference or contact with neighbouring components or the engine structure.
b. Wear or chafing conditions.
c. Ensuring orientation and routing of tubes/lines carrying combustible fluid meet engine specification
requirements by providing separation from all potential sources of extreme temperatures or ignition.

1. Inspection of engine externals drawings and hardware, design mock-ups and an as-drawn
manufactured engine installation.
Information Sources
Comm'l Doc: SAE ARP 994,
Tubing/Plumbing Routing
A.3.1.1.3/A.4.1.1.3, Interface Reference: 00-970 P11 3E.25
Loads, A.3.11/A.4.11, Controls 00-970 P11 3E.80
and Externals Verification, the
00-970 P11 3E.110
Interface Control Document
(ICD) 00-970 P11 S4
STANAG 4671.901
Reference:
Reference: CS-E 25
CS-E 80
CS-E 110
7.2.4.2.4 Tubing/plumbing vibratory response.

No engine mounted components or associated cabling shall react to engine, or aircraft induced, vibratory
or acoustic excitations. Where this cannot be achieved, sufficient design margin against strength, life and
functional requirements needs to be proven for these operating ranges.

a. Tubing, manifolds, clamps, electrical components etc.
b. Ensuring engine mounted equipment does not contain natural frequencies within the engine and sub-
systems operating ranges

1. Analysis and vibration surveys (ping testing) and vibration (shaker table) testing on external
components, tubes/manifolds and lines.
2. Analysis and engine testing results confirms the externals capability to withstand excitations resulting
from a blade out condition.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.11/A.4.11, Def-Stan 00-970 00-970 P11 3E.20
Controls and Externals Reference: 00-970 P11 3E.100
Verification. 00-970 P11 3E.330
00-970 P11 3E.340
00-970 P11 3E.520
00-970 P11 3E.650
00-970 P11 S4
00-970 P7 C706 2.2
00-970 P7 C706 5.1.1
STANAG 4671.901

Reference: CS-E 100
CS-E 330
CS-E 340
CS-E 520
CS-E 650
7.2.4.2.5 Externals maximum operating conditions.

All pressure vessels, tubes and manifolds shall meet maximum operating strength and life requirements.

a. Fire resistant lines.
b. Fireproof oil carrying components.
c. Redundant, visually verifiable locking features for Safety Critical electrical connectors.

1. Burst pressure component testing to ensure adequate safety margin across the entire flight envelope.
2. Verification of the existence of redundant locking features for critical connections.
3. Analysis of design review information to ensure damage tolerance capability.
Information Sources
DoD/MIL Doc: JSSG-2007A: A.3.7.3.2, Def-Stan 00-970 00-970 P11 3E.20
A.4.7.3.2 and A.3.7.8, A.4.7.8, Reference: 00-970 P11 3E.25
pressure vessel proof and 00-970 P11 3E.570
burst testing.
00-970 P11 3E.640
JSSG-2007A: A.3.1.8.1,
00-970 P11 3E.700
A.4.1.8.1, Flammable Fluid
00-970 P11 S4
Systems, fire resistance and
fire proof testing. STANAG
Reference:
Information Sources
MIL-HDBK-1783B:
A.4.10/A.5.10
Reference: CS-E 25
CS-E 570
CS-E 640
CS-E 700
7.2.4.2.6 Gearboxes.
Engine gearboxes shall meet maximum operating strength and life requirements.

a. Maximum torque and power transmission requirements
b. Acceleration and gyroscopic loads
c. All internal gears are free from damaging resonance

1. Analysis, bench and engine testing to verify the gearbox ability to support all mounted components.
2. Analysis and testing to verify the gearbox is capable of simultaneous operation of all the drives at
maximum permissible torque or power rating, with the required factor of safety.
Information Sources
Comm'l Doc:
A.3.7.16/A.4.7.16, Gearbox. Reference: 00-970 P11 3E.80
00-970 P11 3E.100
00-970 P11 3E.160
00-970 P11 3E.440
00-970 P11 3E.510
00-970 P11 3E.515
00-970 P11 3E.740
00-970 P11 S4
STANAG
Reference:
Reference: CS-E 80
CS-E 100
CS-E 160
CS-E 440
CS-E 510
CS-E 515
CS-E 740
7.2.4.2.7 Gearbox mounted component failures.

The failure of any gearbox mounted component (e.g. oil pumps, fuel pumps, starters, generators) shall
not result in failure of the gearbox itself.

a. Provision of disengagement (e.g., shear sections) prior to causing secondary damage to the gearbox
or other components.
b. Components, whose continued operation is required to maintain safe aircraft operation, do not contain
shear sections.

1. Analysis and inspection of the gearbox and mounted components ensures adequate disengagement
provisions.
Information Sources
Comm'l Doc:
A.3.7.16/A.4.7.16, Gearbox. Reference: 00-970 P11 3E.80
00-970 P11 3E.160
00-970 P11 3E.210
00-970 P11 3E.510
00-970 P11 3E.515
00-970 P11 3E.590
00-970 P11 S4
STANAG 4671.1309
Reference:
Reference: CS-E 80
CS-E 160
CS-E 210
CS-E 510
CS-E 515
CS-E 590
7.2.4.2.8 PTO shaft.

Failure of the engine power take-off (PTO) coupling assembly or driveshaft shall not adversely affect safe
operation of the aircraft.

a. Design of the PTO/driveshaft coupling assembly prevents that assembly from unacceptably damaging
surrounding hardware (e.g., anti-flail design).

1. Analysis and inspection of the PTO drawings and hardware.
2. Testing to verify driveshaft coupling assembly life and anti-flail capability.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: Def-Stan 00-970 00-970 Pt 11 Sec 3E Clauses
A.3.1.1.10/A.4.1.1.10, Power Reference: 80, 520, and 650.
Take-Off and 00-970 Pt 11 Sec 4
A.3.7.16/A.4.7.16, Gearbox. STANAG
Information Sources
MIL-HDBK-516 criteria Reference:
7.2.5.1.3
Reference: CS-E 520
CS-E 650
7.2.4.2.9 Electrical components and cable routing.

All engine mounted electrical components and cabling shall be safely affixed and routed on the engine.

a. Prevention of wear or chaffing.
b. Separation between combustible fluids and potential ignition sources.
c. Locking features for safety critical electrical connectors.
Information Sources
Comm'l Doc: SAE-AS-50881, for required
clearances for electrical
cables, and requirements for
appropriate selection and
installation of wiring and wiring
devices.
DoD/MIL Doc: JSSG-2007A: Def-Stan 00-970 00-970 Pt 11 Sec 3E Clauses
A.3.1.1.3/A.4.1.1.3, Interface Reference: 20, 25, 80, 110, and 135.
Loads and A.3.7.4/A.4.7.4, 00-970 Pt 11 Sec 4
Electrical System. STANAG 4671.1367
MIL-STD-464A, for
Reference:
requirements for proper
bonding and grounding
CS 27.1163
CS 29.1163
CS-E 20
CS-E 25
CS-E 80
CS-E 110
CS-E 135
7.2.4.2.10 Electromagnetic environment.

All engine mounted electrical components and cabling shall operate safely in a lightning and
electromagnetic effects environment in accordance with all the applicable criteria of Section 13.

a. The shielding capability incorporated into the design of the internal environment (i.e. Faraday Cage).
a. Components such as electronic controls, alternators/generators, cables, wires, sensors.
b. Safe operation when exposed to the worst case expected electromagnetic (EMI), nuclear (EMP) or
lightning induced energy environments.
c. Prevention of emissions of EMI that could affect the continued safe operation of any engine or aircraft
electrical system or component.

1. Analysis of the aircraft EMI, EMP and lightning threat/exposure environment and the engine EMI
generation characteristics.
2. Control and electrical subsystem closed loop bench testing to verify the engine EMI, EMP and lightning
operational capabilities.
3. Evaluation of the engine's ability to meet specification requirements when installed inside the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: For guidance on engine EMI, Def-Stan 00-970 00-970 P1 6.10
EMP, and Lightning design and Reference: 00-970 P11 3E.20
verification testing: 00-970 P11 3E.80
JSSG-2007A: A.3.3.3/A.4.3.3
00-970 P11 3E.135
MIL-STD-461E
00-970 P11 3E.170
MIL-STD-464A.
00-970 P11 S4
STANAG 4671.867
Reference:
CS 23.1309
CS 25.581
CS 25.899
CS 25.1301
CS 25.1309
CS 25.1316
CS 25.1705
CS 27.867
CS 27.1301
CS 27.1309
CS 29.867
CS 29.1301
CS 29.1309
CS-E 20
CS-E 80
CS-E 135
CS-E 170
7.2.4.2.11 Merged with 7.2.4.2.4

7.2.4.2.12 Electrical power.
Electrical power shall be supplied to all safety critical engine systems at all ground and flight operating
conditions, including transients. In case of power supply failures, at least safe shutdown / rundown of the
engine needs to be assured, not preventing restart / recovery.
a. Engine driven alternator/generator capability should be adequate to provide safe and reliable electrical
power at all specified engine speeds.
b. Seamless transition to and from back-up power for all engine safety critical systems and components.

1. Analysis of the engine's total power consumption.
2. Analysis, bench and engine testing demonstrate the ability to meet the electrical power generation
requirements of the engine specification, when not installed in the aircraft.
3. Flight testing demonstrates the engine's ability to meet the electrical power generation requirements.
4. Analysis and test of the aircraft's power generation and battery systems.
.
Information Sources
Comm'l Doc:
Electrical System. Reference: 00-970 P11 3E.510
00-970 P11 S4
STANAG 4671.1351
Reference:
7.2.4.2.13 Computer resources and software.

For subsystems that use computer systems and software, see Section 15 for additional specific criteria,
standards and methods of compliance.

a. The interrelationship of software requirements (DALs) and power system design (i.e. single or multi-
engine).
Information Sources
Comm'l Doc: IEEE/EIA 12207.0, IEEE/EIA
12207.1, IEEE/EIA 12207.2
and RTCA DO 178 and 254
DoD/MIL Doc: JSSG-2007A: 3.8/4.8 Software Def-Stan 00-970 00-970 P11 S4
Resources. Reference: 00-970 P11 3E.20
00-970 P11 3E.25
00-970 P11 3E.50
00-970 P11 3E.80
00-970 P11 3E.110
00-970 P11 3E.135
STANAG 4671.1367
Reference:
FAA Doc: 14 CFR reference: 33.28 EASA CS CS-E 20
Reference: CS-E 25
CS-E 50
CS-E 80
CS-E 110
Information Sources
CS-E 135
7.2.5 Installations.
7.2.5.1 Physical Installation.
7.2.5.1.1 Physical interfaces.
All engine/aircraft physical interfaces such as mechanical, fluid, and electrical connections shall meet all
safety related requirements to permit safe operation.

a. Ensuring interfaces remain securely connected and do not leak when subjected to the operating
conditions (vibration, temperature, etc.) of the aircraft;
b. Ensuring interfaces are free of any contact with neighbouring components that result in a wear or
chaffing condition;
c. Ensuring interfaces can withstand the maximum combination of static and dynamic loading throughout
the defined flight and ground envelopes and environments;
d. Ensuring all safety critical engine to aircraft interfaces are fault tolerant or fail safe with no reasonable
credible combination of failures having an unacceptable probability of aircraft loss;
e. Accessibility for necessary inspections and maintenance (engine and airframe).

1. Inspection of the hardware and a demonstration of installing the engine ensures that interface
requirements defined in the engine Interface Control Document (ICD) are met.
2. Analysis, full-up engine and flight tests ensure interface loads are within design limitations.
3. Physical interface requirements are verified by inspection of program documentation.
4. Analysis and inspection of the interfaces, with the engine installed in the aircraft.
5. System interfaces are analysed to withstand maximum loading at worst case single failure operating
and loading conditions.
6. System interface critical analysis assumptions are verified.
Information Sources
Comm'l Doc:
A.4.1.1.3, Interface Loads. Reference: 00-970 P1 5.1.16
JSSG-2001B: STANAG 4671.901
3.3.1.1.1/4.3.1.1.1 Reference:
CS 25.901
CS 27.901
CS 29.901
7.2.5.1.2 Engine mounts.

The aircraft / engine mounts shall be designed with adequate safety margin to permit safe operation of
the engine, and to ensure the engine remains properly secured under all operating conditions (including
intentional shutdown) and known failure conditions.
a. Withstanding all limit loads, resulting from aircraft manoeuvres and engine failures, without permanent
deformation;
b. Withstand all ultimate tensile strength loads without complete fracture;
c. Preventing the engine from entering the flight deck or passenger compartments in the event of a crash
landing;
d. Meeting established durability, strength and damage tolerance design requirements;
e. If flexible mountings are used to isolate such vibrations, the maximum deflections of such mountings
shall be taken into account in the design of the relevant components;
f. Ensuring any reasonable credible combination of equipment failures does not result in further damage
likely to produce a hazardous engine effect.

1. Analysis, full-up engine and flight testing ensure the mounts retain the engine under all operation and
known failure conditions.
2. Engine mount testing ensures adequate design safety margins.
3. Analysis of the engine mount design review data and drawings ensures a damage tolerant design.
Information Sources
Comm'l Doc:
A.4.1.1.4, Mounts Reference: 00-970 P1 5.1.16
MIL-HDBK-1783B, Engine STANAG 4671.901
Structural Integrity (Unverified) Reference:
FAA Doc: 14CFR references: 33.5, 33.23 EASA CS CS-E 25
Reference: CS-E 80
CS-E 100
CS 23.901
CS 25.901
CS 27.901
CS 29.901
7.2.5.1.3 Power-take-off (PTO) shaft vibratory response.

Any installed power-take-off (PTO) shaft system shall withstand vibratory induced loads from start-up to
maximum operating speed under any combined expected torsional (power extraction) and aircraft
manoeuvre induced loading. The system shall contain no natural (resonant) frequencies within the normal
operating range; or shall have adequate damping provisions to prevent resonances, damage or failure.

a. Establishing suitable critical speed margins that accommodate manufacturing variation, wear and
unknown system dynamics.

1. Inspection of design criteria establishes suitable critical speed margins that accommodate
manufacturing variation, wear and unknown system dynamics.
2. Analysis (e.g., dynamic model) of end to end system predicts compliance with the speed margin goal.
3. Analysis results evaluate the capability of the system components to withstand excitations.
4. Component tests validate response, stiffness and other characteristics used in the analysis.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: C.3.4.3.10.2/ Def-Stan 00-970 00-970 P11 3E.80
C.4.4.3.10.2 Reference: 00-970 P11 3E.520
JSSG-2007A: A.3.716/ A4.7.16 00-970 P11 3E.650
00-970 P11 S4
STANAG
Reference:
FAA Doc: EASA CS CS 23.1163 (d)
Reference: CS 25.1163 (c)
CS-E 80
CS-E 520
CS-E 650
7.2.5.1.4 Uncontained rotating parts.

Design precautions shall be taken to reduce the risk of damaging aircraft safety of flight (SOF)/critical
safety items (CSIs) due to uncontained engine failures, to an acceptable level. This covers:
1. Uncontained rotating parts;
2. Other uncontained engine failures (such as torching flame and exploding pressure vessel)

a. Minimising the probability and severity of uncontained rotating parts failure: including turbine blade
failure and of disc fragmentation;
b. Safety effects beyond the engine boundary (such as combustion chamber breakthrough) in relation to
the crew, the structure, and to flight and mission critical equipment.
c. Vibratory loads and their impact on engine mount design.

1. Inspection of the safety analyses documentation verifies that hazards associated with uncontained
failures are reduced to an acceptable level.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: 3.3.10/4.3.10 Def-Stan 00-970 00-970 P1 5.1.123
Reference:
STANAG 4671.903
Reference:
FAA Doc: EASA CS CS 25.903(d)(1)
Reference: CS 29.903(d)(1)
AMC-E 510(d)(iii)
7.2.5.1.5 Engine/aircraft clearances.

The installed engine shall maintain a positive clearance between the aircraft and the engine (except at
physical interface points) under all operating conditions within the ground and flight envelopes. This shall
include associated components, plumbing, and harnesses.
a. Adequate provision for flexibility where relative movement between components within the propulsion
system and between such components and the aeroplane can occur;
b. Use of flexible hose assemblies or equivalent means for fluid lines under pressure which are subjected
to relative movement;
c. Thermal expansion or contraction of parts to the extremes of movement within the operating envelope
of the engine;
d. Movement resulting from likely fault conditions of either the fixed or rotating parts;
e. Minimum static clearances to be agreed and verified.

1. Engine/aircraft clearance requirements are verified by inspection of design documentation.
2. System clearances are validated by inspection of system design analysis and simulation.
3. System design analysis and simulations are validated by first article inspections and flight tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001 B: 3.3.1.1/4.3.1.1 Def-Stan 00-970 00-970 P1 5.1.26
Reference: 00-970 P1 5.1.27
STANAG
Reference:
FAA Doc: EASA CS CS-E 520(b)
Reference:
7.2.5.1.6 Drains and ventilation systems.

The propulsion system shall include sufficient drain provisions capable of handling fluid/vapor leakage,
venting, and spillage throughout required ground and flight attitudes and regimes, that is consistent with
the system's safety, fire and explosion prevention, maintainability and survivability requirements.

a. Capacities are sufficient for flow requirements and volume capacities for projected missions;
b. Suitable drainage provisions for all closed compartments in the engine installation (such as the engine
accessory section, spaces enclosing fuel, oil and hydraulic lines and equipment, vent areas and other
pockets where fluids may collect);
c. Ensuring all drains should be identified with labels or other markings to assist in diagnostics and safety;
d. Inadvertent liquid spillage and accidents as well as combat aircraft battle damage should be
considered when sizing and locating drains;
e. Routing overboard drain lines to permit fluid to exit free of the aircraft fuselage, nacelle, wing and pylon
and protecting them from chafing when passing through bulkheads and cowlings.
f. In degraded modes, the drain system should minimise the potential for fire and/or explosion.

1. Propulsion drain and ventilation system sizing is validated by inspection of design documents and
analysis identifying flow requirements and volume capacities for projected missions.
2. System operation at ground attitudes and under flight conditions is validated by analysis of in-flight
pressure gradients and attitudes.
3. Analysis assumptions (e.g., pressure gradients, attitudes) are validated by ground and flight test.
4. Storage or expulsion hazards of fluids are recorded in System Safety documentation with mitigations
defined where appropriate.
Information Sources
Comm'l Doc:
A.4.1.1.8, for design and Reference: 00-970 P1 5.1.71
verification guidance for drains. 00-970 P1 5.2.47
JSSG-2001B: 3.3.1.1/4.3.1.1
00-970 P1 5.3.17
00-970 P1 5.3.42
STANAG 4671.999
Reference:
CS 25.999
CS 27.999
CS 29.999
7.2.5.1.7 Engine stall loads.

The engine air inlet components shall have adequate structural margin to withstand over-pressures (inlet
stall), under worst case conditions, generated by inlet/compressor anomalies without causing degradation
in performance; permanent deformation or vibration harmful to the engine.

a. The maximum induced inlet stall pressures generated by inlet/engine anomalies;
b. The effects of inlet temperature and pressure distortion on engine surge margin;
c. Providing inlet airflow distortion limits throughout the aircraft operating envelope (typically 1.5X inlet
stall pressure);
d. Ensuring distortion limits are defined in terms of both spatial and planar content;
e. Hammershock and interactive surge.

1. Engine air inlet components requirements are verified by inspection of design documents.
2. Maximum induced inlet stall pressures generated by inlet/engine anomalies are validated by inspection
of analyses and/or test.
3. Capability of the components to withstand required inlet stall pressure is verified through component
proof analysis and test.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001 B: 3.3.1.1/4.3.1.1 Def-Stan 00-970 00-970 P1 5.1.17
Reference:
STANAG 4671.1103
Reference:
Reference: CS-E 100
CS 23.939
CS 25.939
CS 27.939
Information Sources
CS 29.939
7.2.5.1.8 Installed engine accessibility.

Provision shall be made for access to propulsion-system-related equipment in order to permit servicing,
inspections, and maintenance. This shall include accessibility for: inspection of principal structural
elements and control systems; replacement of parts normally requiring replacement, adjustment; and
lubrication as necessary for continued airworthiness.

a. The maintainer's anthropometric dimensions and strength limitations, all environmental conditions, and
any required mission equipment (chemical protective gear, gloves, etc.);
b. Accessibility of filters for cleaning and removal of screen / element;
c. Accessibility of all replenishment points for consumables and to permit examination of all relevant
contents indicators;
d. Accessibility of adjustment points and special engine health monitoring provisions and techniques (e.g.,
intrascope/boroscope, magnetic chip detectors);
e. Minimising the number of access panels;
f. Removal and replacement of engine accessories (e.g., fuel pump(s), fuel control unit, starter motor,
igniters, igniter boxes etc.), without having to remove the engine change unit;
g. Sufficient ground clearance to permit engine removal from the underside of the aircraft without using
pits or jacking;
h. Ensuring the inspection means for each item must be practicable for the inspection interval for the item;
i. Particular attention shall be paid to provision of adequate space and access to break points, utilised
during engine removal and replacement.

1. Inspection of design criteria establishes required servicing, inspections and maintenance requirements.
2. Analysis of virtual models or physical mock-ups verifies accessibility to required servicing, inspection
and maintenance areas.
3. Maintenance demonstration verifies the ability to accomplish required tasks.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: 3.3.1.1/4.3.1.1 Def-Stan 00-970 00-970 P1 5.1.97-5.1.119
Reference:
STANAG 4671.901
Reference:
FAA Doc: EASA CS AMC-E 560(6)
Reference: AMC-E 570(1)
AMC-E 570(3)
CS 23.611
CS 23.901
CS 25.611
CS 25.901
CS 27.611
CS 27.901
CS 29.611
Information Sources
CS 29.901
7.2.5.1.9 FOD/DOD.
Design practices and processes ensure that airframe equipment, fasteners, etc., upstream of the installed
propulsion system, and the propulsion system itself, shall be designed and installed to eliminate sources
of self-induced foreign/domestic object damage (FOD/DOD) to the propulsion system.

a. Ensuring the design of the air intake assembly (including all fasteners) minimises the possibility of
generating foreign objects (including ice and slush accretion);
b. Minimising the number of components of equipment fitted in the intake assembly (e.g., variable intake
mechanisms) which could enter the engine if they become detached;
c. Ensuring features in the complete intake assembly into which foreign objects can be trapped and
subsequently released into the engine are avoided or easily inspected.

1. Inspection and analysis of documentation (e.g., FMEA, FMECA, SHA, SSHA) of systems within or
upstream of the inlet verifies the absence of FOD/DOD generating failure modes.
2 Inspection verifies that manufacturing and maintenance procedures contain FOD/DOD control
practices.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: Def-Stan 00-970 00-970 P1 5.1.44-5.1.46
3.3.1.1.1/4.3.1.1.1 Reference: 00-970 P11 S3.E540
STANAG 4671.903
Reference:
Reference: CS-E 570(d)&(f)
CS-E 580
CS 23.1091(c)(2)
CS 25.1091(e)
CS 27.1091(d)(2)
CS 29.1091(f)(2)
7.2.5.2 Functional installation.

7.2.5.2.1 Functional compatibility.
The engine / aircraft interfaces and interfacing subsystems shall be safe and maintain functional
compatibility throughout all normal operating and flight conditions; and shall remain safe given any
reasonable credible combination of failures.

a. Assessing the functional capabilities of the total integrated propulsion system relative to the mission
requirements of the aircraft;
b. Defining more than one compatibility envelope, such as might be the case with a weapon/store
deployment, launch operation and plume ingestion;

1. Engine/aircraft functional interface requirements are verified by inspection of program documentation.
2. Integrated system functional compatibility is verified by simulation, test and demonstration of system
functionality at integration test facilities and on the aircraft during ground and flight test.
3. Engine/aircraft functional hazards and probability of aircraft loss are recorded in System Safety
documentation with mitigations defined where appropriate.
4. Verifying what the various supplying systems provide to the interface; and what the receiving systems
require from the interface in order to satisfy its requirements as well as physical definitions for
establishing proper fit, alignment and loading.
5. Multi-engine aircraft configurations should consider verifying interactions between engines to provide
the interface; and what the receiving systems require from the interface in order to satisfy its requirements
as well as physical definitions for establishing proper fit, alignment and loading.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: 3.3.1.1/4.3.1.1 Def-Stan 00-970 00-970 P1 5.2.4
Reference: 00-970 P1 5.2.213
STANAG 4671.901
Reference:
FAA Doc: EASA CS AMC-E 650 (9)
CS 25.901
CS 27.901
CS 29.901
7.2.5.2.2 Power demands/extractions.

The engine shall be capable of safely supplying all systems (power, bleed air and electrical extractions)
under all operating conditions. Aircraft bleed airflow and quality shall be maintained and the engine shall
not introduce foreign matter or contaminants into the bleed air supply that could cause damage. Aircraft
power extraction and electrical power extraction shall meet the requirements across the entire flight
envelope.

a. Damage to critical parts where bleed air is used to cool or to pressurise areas of the engine.
b. The use of bleed air and power extraction during air starts
c. Both PTO and Gearbox power extraction requirements
d. Power extraction during windmilling
e. Ensuring the power take-off drives and bleed air extraction level is representative of the maximum
required at that condition;
f. The position of the bleed port internal pickup points to ensure low susceptibility to FOD, and ingestion of
sand, dust, ice, moisture, and any other foreign materials contained in the air.

1. Bleed air interface airflow and quality, PTO horsepower extraction and gearbox horsepower extraction
are verified by demonstration and test.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.2, A.4.2 and Def-Stan 00-970 00-970 P1 5.1.74
A.3.7, A.4.7, engine Reference: 00-970 P1 5.1.75
performance and operability STANAG
impacts of customer 4671.901
extractions. Reference:
JSSG-2007A: A.3.1.1.7,
A.4.1.1.7, bleed air interface
design and verification.
JSSG-2007A: A.3.1.1.10,
A.4.1.1.10 and A.3.7.16,
A.4.7.16, PTO horsepower
extraction.
JSSG-2007A: A.3.7.4.1,
A.4.7.4.1, electrical power
design and verification
requirements.
FAA Doc: EASA CS CS-E 745(a)(1)
Reference:
7.2.5.2.3 Bleed air contamination.

Bleed air contamination / ingress of foreign matter shall not exceed safe limits in order to prevent
hazardous contamination of the aircraft breathable air supply.

a. Specifying the maximum concentration of engine generated contaminants permitted in the bleed air;
b. Identifying defects which could affect the purity of the bleed air;
c. Ensuring engine failures does not cause contamination of bleed air;
d. Safe limits ensure both unacceptable quantity and unacceptable size of contamination / foreign matter
is precluded.

1. Customer bleed air contamination is verified by analysis and tests.
Information Sources
Comm'l Doc:
A.4.1.1.7.1, customer bleed air Reference: 00-970 P11 S3.E690
contaminants guidance STANAG
Reference:
FAA Doc: EASA CS CS-E 510(g)(2)(ii),
Reference: CS-E 580,
CS-E 690(b)
CS 23.1111
7.2.5.2.4 Engine shutdown.

Engines shall have the ability to safely and reliably shutdown in the event of a platform initiated fuel
shutoff.

a. Prevention of damage to engine due to loss of fuel.
b. Post shutdown fire.

1. Analysis, rig testing (dry bench) and engine testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2009 E.3.4.5.2.6 Def-Stan 00-970 00-970 P7 Ch702 24.3
Reference:
STANAG
Reference:
7.2.5.3 Inlet compatibility.

7.2.5.3.1 Inlet compatibility.
The air induction system(s) shall function under all expected ground, flight, and environmental conditions
without adversely affecting engine operation or resulting in engine damage. This shall include ensuring
inlet ice accretion and separation, distortion, sand and dust ingestion, water ingestion, do not adversely
impact engine performance and operability.

a. Tolerable performance following:
i. Armament Gas Ingestion (AGI) (i.e. gases or pressure waves from guns, rockets and missiles);
ii. Operation in volcanic ash.

1. Analysis and installed engine testing verify inlet performance for all expected environmental conditions.
2. For icing environments, analysis, icing tunnel or ground icing tests and/or flight tests reveal acceptable
icing build up and/or levels of shedding that are compatible with the engine(s).
Information Sources
Comm'l Doc:
A.4.3.2.4, for sand and dust Reference:
design and verification; STANAG
A.3.3.2.3, A.4.3.2.3, for ice 4671.901(d)(2)
ingestion guidance; A.3.2.2.11, Reference: 4671.1091
A.4.2.2.11, distortion guidance;
and A.3.3.2.5, A.4.3.2.5, for
atmospheric liquid water
ingestion guidance.
JSSG-2001B:
3.3.1.1.1/4.3.1.1.1
FAA Doc: EASA CS CS-E 650(c)(1)
Reference: CS-E 790(d)(3)
Information Sources
CS 23.901(d)(2)
CS 23.1091
CS 25.1091
CS 27.1091
CS 29.1091
7.2.5.4 Exhaust system compatibility.

7.2.5.4.1 Exhaust gas impingement.
The exhaust system, including relevant ducting, shall be designed and installed such that exhaust gases
are directed to the atmosphere, and do not: impinge on the aircraft structure, equipment or stores, to the
extent that their maximum temperatures are exceeded, unless adequate protection is provided; impinge
on or mix (except when designed) with any flammable fluid drainage or vapour discharge to the extent
that the fluid/vapour auto ignition temperature is achieved or exceeded; impose an unavoidable hazard to
flight/ground crew or boarding/discharging passengers; or impede a pre-flight/launch activity. Where
applicable, the jet wake shall also be compatible with ground or shipboard equipment.

a. Preventing hazards including: fire hazards, carbon monoxide contamination in personnel
compartments, discharge which may cause a glare seriously affecting pilot vision at night.
b. The effects of thrust vectoring and thrust reversal;
c. Deflection of exhaust gases by crosswinds etc., during ground manoeuvring;
d. Separating each exhaust system from adjacent (external) flammable parts with fireproof shields;
e. Locating or shielding hot exhaust system parts to prevent ignition of flammable fluids or vapours
following leakage of other systems;
f. Compatibility with ground or shipboard equipment such as the Jet Blast Deflector (JBD);
g. Jet wake temperature and velocity characteristics for various power settings and nozzle vector angles.

1. Exhaust plume interaction with structure, fluid/vapour discharge, and all personnel is validated by
inspection of plume and thermal analysis and models and ground and flight testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: Def-Stan 00-970 00-970 P1 5.1.52
3.3.1.1.2/4.3.1.1.2, Nozzle and Reference:
Exhaust Systems, 3.4.8/4.4.8 STANAG
Ship Combatibility 4671.1121
JSSG-2007A: A.3.1.8.2, Reference:
A.4.1.8.2, A.3.1.8.5, A.4.1.8.5
and A.3.1.8.7, A.4.1.8.7, fire
prevention, air and gas
leakage and jet wake;
A.3.7.10, A.4.7.10, engine
exhaust nozzle system design
and verification
Reference: CS 25.941(a)
Information Sources
CS 25.1121
CS 27.1121
CS 29.1121
7.2.5.4.2 Thrust reverser/thrust vectoring.

Thrust reverser/thrust vectoring systems shall be compatible with the engine and aircraft structure, such
that operation does not adversely impact engine performance, operability or damage to the aircraft
structure; and shall be fail-safe, such that no unsafe condition will result during normal operation of the
system, or from any reasonable credible combination of failures.

a. Forces and moments and dynamic response from the thrust reverser/thrust vectoring systems;
b. Ensuring engine limitations approved for reverse thrust are not exceeded;
c. Means to prevent the engine from producing more than idle thrust when the reversing system
malfunctions.

1. Verify the design is free from single or combined failures modes that would create an unacceptable risk
hazard.
2. Analysis of reverser flow field patterns verifies acceptable conditions relative to impingement, inlet
ingestion (e.g., propulsive, environmental control system, ventilation, auxiliary power system), and
FOD/Sand and Dust generation.
3. Ground tests demonstrate reverser safety features and compatibility with engines and airframe. Flight
tests demonstrate safe reverser deployment and operation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.1.1.12 to Def-Stan 00-970 00-970 P1 5.1.54
A.4.1.1.13, for exhaust system Reference: 00-970 P1 5.1.55
and thrust reverser interfaces STANAG
design and verification 4671.U1761
guidance; A.3.7.10, A.4.7.10, Reference:
Exhaust Nozzle System and
A.3.7.10.2, A.4.7.10.2,
Vectored Nozzle
CS 25.933
7.2.5.5 Environmental compatibility.

7.2.5.5.1 Engine bay/nacelle cooling and ventilation.
The engine bay/nacelle cooling and ventilation provisions shall be sufficient to maintain the temperatures
of power plant components, engine fluids, other bay/nacelle equipment and structure within the
temperature limits established for these components and fluids, under ground and flight operating
conditions, and after normal engine shutdown.

a. Compatibility with the fire protection certification criteria of Section 8.4;
b. Air and gas leakage and any ducting system throughputs;
c. Ensuring specified temperature limits are not exceeded;

d. The effect of solar radiation with the aircraft being parked in direct sunlight;
e. The appropriate aerodynamic heating in flight.

1. Temperature limit requirements are recorded in design documentation.
2. System thermal performance is demonstrated by design analysis, thermal models and simulations.
3. Engine bay/nacelle environments are verified by thermal surveys during ground and flight tests.
Information Sources
Comm'l Doc:
A.3.1.8.5/A.4.1.8.5, Reference: 00-970 P1 5.1.73
A.3.2.2.13/A.4.2.2.13 00-970 P1 5.3.5
STANAG 4671.1041
Reference:
Reference: CS-E 270(d)
CS-E 660
CS-E 860
CS 23.1041
CS 23.1043
CS 23.1045
CS 25.1041
CS 25.1043
CS 25.1045
CS 27.1041
CS 27.1043
CS 27.1045
CS 29.1041
CS 29.1043
CS 29.1045
CS 29.1047
CS 29.1049
7.2.5.5.2 Vibratory compatibility.

The installed vibratory compatibility of the engine/airframe system shall be such that airframe induced,
engine vibration does not exceed engine limits.

a. Specified engine limits for the aircraft and engine operational envelope;
b. Ensuring carcass vibration characteristics do not exceed those established during the type certification
of the engine;
c. Acoustic noise vibration.

1. Airframe induced engine vibration is established by analysis, and ground and flight vibration tests
which identify the response characteristics of the aircraft/engine to forced vibrations and impulses.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001B: 3.3.1.1.2/4.3.1.1, Def-Stan 00-970 00-970 P1 5.2.22
exhaust integration design and Reference: 00-970 P1 5.2.37
verification requirements. 00-970 P1 5.2.96
00-970 P1 5.3.77
STANAG 4671.901
Reference:
FAA Doc: EASA CS CS-E 100(c)
Reference: CS-E 650
CS 23.901
CS 25.901
CS 27.901
CS 29.901
7.2.5.5.3 Merged with 7.2.5.4.1

7.2.5.6 Installation other.
7.2.5.6.1 Crew/operator station compatibility.
The aircraft propulsion controls and crew station information shall be adequate to permit proper crew
control and operation of the propulsion system.

a. Ensuring aircraft propulsion controls meet the installation, arrangement and design requirements (See
Section 9.2);
b. Provision of instrumentation necessary to ensure operation in compliance with the Engine operating
limitations;
c. Provision of additional instrumentation or indicators which are necessary for use by the crew because
of unusual features of the propulsion system (e.g., variable intake);
d. Ensuring that no reasonable credible combination of failures adversely affects the instrumentation
necessary for safe control of the engine and propulsion unit systems;
e. Adequate provisions for instrument installation.
f. Novel systems with integrated aircraft and thrust control strategies
g. The following functions: start/stop each engine independently; independently control/set thrust for each
engine; assess engine operating condition to the extent necessary for flight safety; maintain any set
position or power demand without constant attention by the flight crewmember(s) and without creep due
to control loads or vibration.
h. Suitable and sufficient warnings, cautions and advisories shall be provided to operators and
maintainers to identify hazardous failure conditions.

1. Crew/operator station propulsion control capabilities are validated by inspection of design
documentation, analyses and hardware and software tests in integration facilities and on the aircraft.
2. Warnings, cautions and advisories to operators and maintainers for hazardous failure conditions are
validated.
Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: JSSG-2001B: Def-Stan 00-970 00-970 P1 5.1.18-5.1.25
3.4.3.1.6/4.4.3.1.6, Reference: 00-970 P1 5.1.54
3.4.3.1.5/4.4.3.1.5 STANAG
MIL-STD-411 (Unverified) 4671.U1701
Reference:
FAA Doc: EASA CS CS-E 50,
Reference: CS-E 60
CS 23.1141
CS 23.1143
CS 23.1145
CS 25.1141
CS 25.1143
CS 25.1145
CS 27.1141
CS 27.1143
CS 27.1145
CS 29.1141
CS 29.1143
CS 29.1145
7.3 ALTERNATE PROPULSION SYSTEMS.

This section covers the installation, integration, interface, arrangement of alternate propulsion systems,
including: propeller driven systems, rotary wing systems and reciprocating engines.
Included with the scope of this section are:

• Propeller performance, strength and durability;
• Propeller / aircraft compatibility;
• Propeller bird-strike tolerability;
• Rotary wing power, torque, strength and durability;
• Rotary wing torsional stability;
• Rotary wing control and braking;
• Reciprocating engine certification.
7.3.1 Propeller driven systems.

7.3.1.1 Design margins.
Adequate margins shall exist for the performance, strength, and durability of the propeller and propeller
system components. This may include but is not limited to the propeller drive shaft, reduction gearbox,
torque measurement system, negative torque system, propeller brake, and mechanical over-speed
governor.

a. Ensuring all propellers meet or exceed the minimum performance required to ensure the capability;
b. All propeller steady-state and transient operating limits (maximum, minimum) for all modes of
operation;
c. Structural design considerations include the application of appropriate limit and ultimate load factors;
d. Ensuring the control system avoids critical propeller speeds where practicable.

1. Analysis verifies durability and positive margins of safety for all operating conditions.
2. Durability tests are as follows:
- Component Testing to establish component capability to perform its function for the period established
in the model specification.
- Whirl Stand Testing to calibrate sea level performance characteristics, demonstrate durability,
overspeed capability, vibratory stress and overspeed feathering.
- System Tests such as preliminary aircraft test of the propeller, installation static functional check,
Steady State check, transient check to determine the stability of the control system, ground vibratory
stress survey, flight vibratory stress survey.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.3.4.12/L.4.4.12 Def-Stan 00-970
and L.3.4.12.4/L.4.4.12.4, Reference:
performance and structural STANAG
design and compliance 4671.905
methods Reference: 4671.907

Reference: CS-E 180
CS-E 340
CS-E 390
CS-E 500
CS-E 510
CS-E 650
CS-E 710
CS-E 745
CS-E 810
CS-E 840
CS-E 890
CS-E 920
CS-P 160
CS-P 350
CS-P 370
CS-P 390
CS-P 400
CS-P 410
CS-P 440
CS-P 530
CS-P 550
CS 23.907
CS 25.907
7.3.1.2 Critical speeds.

All critical propeller speeds shall be outside the engine operating range; or shall be identified and included
as limitations within the appropriate operators and maintenance technical manuals (T.O.'s); such as to
ensure safe operation under normal operating conditions.

a. Critical speeds existing below the operating range, and ensuring they are below the minimum steady
state operating speed (typically by at least 20 percent);
b. Critical speeds existing above the maximum operating, and ensuring they are above the maximum
allowable transient shaft rotational speed (typically be at least 20 percent).

1. Analysis verifies critical speeds of the propeller system. Typical test are as follows:
• Whirl Stand Tests.

• Propeller and Engine Test Stand Tests.
• Flight Vibratory Stress Survey.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.3.4.12/L.4.4.12 Def-Stan 00-970 00-970 P1 5.1.60
and L.3.4.12.6/L.4.4.12.6 Reference:
STANAG 4671.33
Reference: 4671.907
33.83, 33.63 Reference: CS-E 650
CS-P 400
CS-P 410
CS-P 530
CS 23.33
CS 23.905
CS 23.907
CS 25.33
CS 23.905
CS 23.907
7.3.1.3 Reversing and pitch controls.

For variable and reversible pitch propellers, hardware and software components shall not allow unsafe or
unsatisfactory control of the propeller for all steady state, transient, and emergency operating conditions.
This includes ensuring that no reasonable credible combination of failures will result in unwanted travel of
the propeller blades to a position below the In-Flight Low-Pitch Position.

a. The use of adequate emergency features to mitigate for any failures;
b. Ensuring risk levels meet the safety thresholds.

1. Demonstration of satisfactory control of the propeller is accomplished through control response test,
steady state check, and transient check.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.3.4.12/L.4.3.12 Def-Stan 00-970 00-970 P1 5.1.63
and L.3.4.12.5/L.4.3.12.5 Reference:
STANAG 4671.933(b)
Reference:
FAA Doc: 14CFR references: 35.21 EASA CS CS-P 210
Reference: CS 23.933(b)
CS 25.933(b)
7.3.1.4 Propeller interfaces.

All physical and functional interfaces between the propeller and any system that drives the propeller shall
be established and controlled to prevent unsafe operation; and to ensure compatibility under all steady
state, transient, and emergency operating conditions.

a. The propeller, engine, and airframe interface, all related modules and components, their arrangements
functional relationships, interface loadings, weight, and position;
b. Ensuring the allowable range of characteristics of the propeller at the engine interface is specified.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.3.4.12/L.4.3.12; Def-Stan 00-970 00-970 P1 5.1.18
L.3.4.12.1/L.4.4.12.1; Reference: 00-970 P1 5.1.20
L.3.4.12.5/L.4.4.12.5 and 00-970 P1 5.1.59
L.3.4.12.2/L.4.3.12.2
00-970 P1 5.1.60
STANAG 4671.901
Reference:
FAA Doc: 14CFR references: 35.21, EASA CS CS-E 20(d)
35.39, 35.41 Reference: CS-E 50
CS-E 180
CS-P 150(a)
CS-P 210
CS-P 230
CS-P 390
CS-P 400
7.3.1.5 Feathering system.

Manual and automatic feathering systems shall be operational for all steady state, transient, and
emergency operating conditions. This shall include the ability to feather and unfeather in flight.

a. Any likely wear and leakage;
b. Ensuring any feathering and unfeathering limitations are documented in the appropriate manual(s).
c. An emergency means of initiating feathering, independent of the normal means for such operations.
d. The time required for the propeller to achieve full feather position.
1. Demonstration of satisfactory control of the propeller, accomplished through control response test,
steady state check, and transient check.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.3.4.12.1, Def-Stan 00-970 00-970 P1 5.1.63
L.4.4.12.1 Reference: 00-970 P1 5.3.15
STANAG 4671.905
CS-E 570(f)(3)
CS-P 220
7.3.1.6 Merged with 7.3.1.4

7.3.1.7 Vibration and balancing.
Each propeller, other than a conventional fixed pitch wooden propeller, shall be free of aero-elastic effects
(including flutter and dynamic response) and vibrations that could cause the equipment to operate below
specified requirements or cause excessive crew discomfort; and shall be free of destructive vibrations at
all steady-state and transient operating conditions.

a. Capability of the propeller to balance in order to remove vibration;
b. Ensuring vibration stresses do not exceed those shown by the propeller manufacturer to be safe for
continuous operation.

1. Analysis shows all critical vibratory modes, their frequencies and stresses as a function of blade angle
and rpm.
2. The vibratory characteristics of the propeller are verified from the data obtained during the vibratory
stress surveys.
3. Data representing all bending and twisting modes as well as unbalance are identified and compared to
design calculated values and to specified limits.
4. Verification of balancing methods based on analysis of vibration data obtained during propeller and
engine stand tests and flight tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.3.4.12.6, Def-Stan 00-970
L.4.4.12.6, guidance on Reference:
vibration and balance. STANAG 4671.907
Reference:
FAA Doc: EASA CS CS-E 340(b)
Reference: CS-P 530
CS 23.907
CS 25.907
7.3.1.8 Ice control system.

The propeller ice control system shall provide sufficient protection such as to minimise the risk of ice
formation adversely affecting performance for all operating conditions.

a. The use of either electrical, fluid, gas, compound, or mechanical ice control systems;
b. Protection of all areas forward propeller that are likely to accumulate and shed ice into the propeller
disc.

1. Analysis, component and rig testing verify that the ice control system provides the necessary level of
protection against ice formation.
2. Analysis and testing verify ice protection does not damage the propeller system or compromise any
other flight critical aircraft (sub)system/component.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.6.3.1, for Def-Stan 00-970 00-970 P1 5.1.35
guidance on propeller anti-icing Reference:
systems. STANAG 4671.905
Reference:
Reference: CS-E 780
CS 25.875
CS 25.929
7.3.1.9 Bird strike resistance.

The propeller blades and spinner shall be capable of withstanding the impact of birds at the most critical
location and flight conditions without causing a structural failure or inability to control the propeller.

a. Specifying the mass and number of the birds applicable to the intended installation of the propeller in
the aircraft specifications;
b. The most critical location and the flight conditions which will cause the highest blade loads.

1. Component/rig tests or analysis based on relevant acceptable birdstrike tests verify the structural
integrity and controllability of the propeller and spinner under bird ingestion conditions.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 5.1.39
STANAG 4671.U631
Reference:
Reference: CS-P 360
Information Sources
AMC-P 360
7.3.1.10 Environmental conditions.

The propeller system shall safely and reliably operate in worldwide environments as required by the
system specification.

a. Ice accretion and separation, distortion, sand and dust ingestion, water ingestion.
b. Design usage including missions and mission mix, usage parameters, externally applied forces,
operating envelope, engine attitude limits, ambient temperature distribution corrosive atmosphere
conditions, acoustic environment, and engine performance retention characteristics.

1. Propeller system components are verified for expected usage and environmental conditions using
analyses, component test, and ground/flight tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: L.1 - Air vehicle Def-Stan 00-970 00-970 P1 5.1.59
propeller subsystem Reference:
requirements and guidance. STANAG 4671 USAR.33
FAA Doc: EASA CS CS-P 50

Reference: CS-P 150
CS-P 160
CS-P 170
CS-P 230
CS-P 370
CS-P 440
CS 23.929
CS 25.929
7.3.2 Rotary wing systems.

7.3.2.1 Design margins.
The rotary wing and all associated components and systems (including but is not limited to the drive
shaft, reduction gearbox, torque measurement system, negative torque system, brake system, and
mechanical overspeed governor) shall provide sufficient power, torque, strength, and durability to allow
safe operation throughout the aircraft and engine envelopes without any degradation in structural strength
or durability.

a. Safe operation at sea level hover and margin for vertical climb and hover throughout the flight
envelope;
b. Sufficient strength and durability of the rotary wing and its associated components and systems for the
expected life of the aircraft;
c. Ensuring the power drive subsystem is of a robust design capable of operating beyond its maximum
rated condition for those instances where excursions may occur such as autorotation, other emergency
conditions and defined transients;
d. The most severe input power condition (torque and speed) for all allowed operating modes exclusive of
transient conditions;
e. Strength and durability limitations include the application of appropriate limit and ultimate load factors.

1. Rig testing verifies the rotary wing's ability to provide adequate power.
2. Analysis verifies the expected strength and durability of the rotary wing and its associated components
and systems.
3. Instrumented aircraft/engine testing verifies that the rotary wing and all associated components and
systems operate safely as an integrated system.
4. Typical drive system tests include, but are not limited to:
- Integrity/Overstress.
- 200 hr Production Configuration.
- System Level Pre-Flight Acceptance.
- 200 hr Verification Military Qualification Test (MQT).
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.16, Def-Stan 00-970 00-970 P7 L700 4.4
A.4.7.16 Reference: 00-970 P7 L905 8.1
JSSG-2009: K.4.4.11, for drive 00-970 P7 L1001 8.1
system bench and system level 00-970 P7 L732
testing. STANAG
Reference:
33.83, 33.63 Reference: CS 29.1309
7.3.2.2 Safe controllability.

The rotor system shall provide safe control of the aircraft under all operating conditions including loss of
lubricant and OEI and autorotations.

a. Sufficient power response levels to maintain safe control;
a. The behaviour of the engine(s)/control system(s) in response to rapid power demands, e.g. collective,
cyclic and yaw control inputs;
c. For rotorcraft certificated for a 30second OEI power rating, a means must be provided to automatically
activate and control the 30second OEI power and prevent any engine from exceeding the installed engine
limits associated with the 30second OEI power rating approved for the rotorcraft.

1. Rig testing verifies that the rotary wing provides the expected response.
2. Typical rotor system tests include, but are not limited to, ground testing, flight testing, and component
testing.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.16, Def-Stan 00-970 00-970 P7 L1001 8.1(b)
A.4.7.16 Reference:
STANAG
Reference:
7.3.2.3 Main rotor blade passage frequencies.

For rotary wing aircraft, the effects of high-energy, low-frequency vibrations, generated by main rotor
blade passage (fundamental and harmonic) frequencies at all engine and related component operating
speeds and powers, shall not adversely affect the operation of the engine and the drive system.

a. Ensuring airframe induced engine vibration do not exceed specified engine limits within the aircraft and
engine operational envelope;
b. High frequency vibration modes generated by the engine do not cause potentially damaging vibration
to the propulsion subsystems or other parts of the aircraft;
c. Vibration levels of engine and drive train components over the entire operational range of aircraft and
rotor speeds, aircraft gross weights, and centre of gravity limits.

1. Verification is by engine test and ground/flight test.
2. During ground/flight test, vibration levels of engine and drive train components are monitored
throughout the operating range.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.4.1.8, Def-Stan 00-970 00-970 P7 L700 2.2, P7 L732
A.4.4.1.8; A.3.4.1.8.1, Reference: 3.1.8, P7 L1001 8.5
A.4.4.1.8.1 STANAG
JSSG-2009: K.3.4.11.1/
Reference:
K.4.4.11.1
CS 29.251
CS 29.907
7.3.2.4 Engine/airframe vibratory response.

For rotary wing aircraft, each engine (including subsystems/accessories) shall be designed, constructed
and installed to prevent the harmful vibration of any part of the engine or aircraft. The addition of the rotor
and the rotor drive system to the engine may not subject the principal rotating parts of the engine to
excessive vibration stresses. A satisfactory interface shall be achieved between the engine and the
airframe, such that no excessive vibration forces are imparted to the aircraft structure.

a. Both high-frequency propulsion system-excited and low-frequency vibrations.
b. If flexible mountings are used to isolate vibrations, the maximum deflections of such mountings take
into account in the design of the relevant propulsion unit components.

1. Vibration levels of the propulsion system, including the drive system and airframe components are
monitored throughout the operating range.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.4.1.8, Def-Stan 00-970 00-970 P7 L700 2.2
A.4.4.1.8, for engine vibration Reference:
and dynamic response. STANAG
JSSG-2009: K.3.4.11.1/
Reference:
K.4.4.11.1
CS 29.251
CS 29.907
CS-E 100(c)
7.3.2.5 Lubrication system.

The rotor drive transmission/gearbox lubrication system shall provide clean and cooling lubricant to all
components subjected to rolling and/or sliding contact (e.g. bearings, gears, and splines); be free from
leakage; and shall operate safely and effectively under all aircraft operating conditions. The
transmission/gearbox lubrication system shall also be sufficiently independent of the lubrication systems
of the engine(s) in order to sustain sufficient lubrication during autorotation.

a. The requirements for the essential functional elements of the lubrication system which should include:
gearbox breathers, lubrication filtering, filling provisions, gearbox oil drain, lubricant selection, cooling
system, valves and pressure pumps, oil level indication, oil Leakage;
b. Pressurized systems to ensure lubricant is provided at the required pressure and flow rate to all
required components and accessories;
c. Operation over the range of temperatures, attitudes, and manoeuvres for which the aircraft is designed;
d. Provision of cooling oil to remove heat generated due to friction at gear meshes and bearings;
e. Provision of an oil film to reduce wear between sliding elements.

1. Analysis includes a functional description of the lubrication system.
2. Schematics showing all components and indicating minimum flow rates to each oil jet.
3. Cooling system or heat balance analysis includes consideration of the highest ambient air condition
specified in the aircraft specification, the minimum gearbox oil flow, the maximum allowable oil
temperatures and the minimum cooling airflow as a basis for sizing the cooling system.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: K.4.4.11.4, for Def-Stan 00-970 00-970 P7 L705 3.2.9
lubrication element, Reference: 00-970 P7 L705 4.2.1
Information Sources
component, and system level 00-970 P7 L705 4.3
testing. 00-970 P7 L705/1 6
STANAG
Reference:
7.3.2.6 Dynamic coupling.

When the engine, engine accessories, rotor, propeller, or fan system(s), and all power drive subsystem
dynamic components are operated as a combined dynamic system, there shall be no unfavourable
dynamic coupling modes (i.e. that are destructive or limit the aircraft) for all permitted ground and flight
modes.

a. Recognizing the fact that one component can induce destructive vibrations in another component
through interconnecting shafting;
b. Providing adequate allowances for the occurrence of transient loads arising from changes of input or of
working state, (e.g. freewheel slippage or actuation or abrupt changes of power);
c. If flexible mountings are used to isolate vibrations, the maximum deflections of such mountings take
into account in the design of the relevant propulsion unit components.

1. Verification is through similarity analysis or a combination of analyses, static and dynamic testing.
2. Analysis of critical speeds in relation to operational speeds throughout the range of possible shaft
misalignments.
3. Measurement of stresses at the critical speed to ensure they are within design limits.
4. Show the absence of dynamic coupling modes that are destructive or limit the use of the aircraft for all
permitted ground and flight modes.
5. Define all power drive subsystem spring constants, inertia and damping coefficients for use in torsional
stability assessments.
6. Gear resonance test; the dynamic stress levels in each gear are measured in locations sensitive to all
significant vibratory modes.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P7 L700 2.2
Reference: 00-970 P7 L705 2.1.2
00-970 P7 L705 4.1.3
STANAG
Reference:
FAA Doc: JSSG-2007A: A.3.4.1.8, EASA CS CS 27.251
A.4.4.1.8 Reference: CS 29.251
JSSG-2009: K.3.4.11.1/
K.4.4.11.1
7.3.2.7 Control system stability.

The engine's control/rotor system torsional stability shall have required gain and phase margins and main
rotor torque damping during steady-state and transient operation. No dangerous torsional or flexural
vibrations shall occur at any permissible torque and at any rotational speed up to the maximum engine
overspeed or the maximum permissible rotor speed, whichever is the greater.

a. The most critical combinations of power, rotational speed, and control displacement;
b. Control system gain and phase margins meet the specified requirements.

1. Analysis includes linearized models of the engine control loops and the rotor system.
2. The control design is verified throughout the operational envelope of the helicopter.
3. Open and closed loop bench testing of the control.
4. Engine control system stability evaluation by flight test.
5. Testing to show stable response throughout the operational envelope of the helicopter.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.4.1.8, Def-Stan 00-970 00-970 P7 L705/2 8.5
A.4.4.1.8 Reference: 00-970 P7 L1001 8.6
JSSG-2009: K.3.4.11.1/ STANAG
K.4.4.11.1 Reference:
FAA Doc: 14CFR references:29.939 EASA CS CS 27.939
7.3.2.8 Misalignment.
The drive shaft couplings shall be designed for continuous, maintenance-free operation at the maximum
permissible misalignment of coupled drive shafts (when installed in the aircraft), for all possible
combinations of torque and speed.

a. The maximum torque that could be delivered at the worst permissible misalignment;
b. The use of dry type couplings to avoid the necessity of doing maintenance checks before every flight;
c. Replacement of coupling mechanisms should not require realignment of the associated shafting.
d. Couplings are the dry type to avoid the necessity of doing maintenance checks before every flight.

1. Vibration and stress analyses of all components subjected to potential stress or vibration induced
failure.
2. Prediction of the range of values for steady, cyclic and vibratory stresses.
3. Loading reflects the influence of all environmental and operational factors on the life calculation
methods of all fatigue sensitive coupling components.
4. Endurance Testing.
5. Fault Tolerance Demonstration.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.1.1.9, Def-Stan 00-970
A.4.1.1.9, A.3.7.16, A.4.7.16 Reference:
JSSG-2009: K.3.4.11.2 / STANAG
K.4.4.11.2 Reference:
CS 29.917(c)(4)
7.3.2.9 Rotor securing.

A means shall be provided of preventing rotation of the rotor during engine non-operation, power up, and
ground idle conditions, when exposed to winds at specified velocities and directions.

a. A wind environment encompassing both atmospheric and weather induced conditions, wind-over-deck
from carrier vessel movement, and downwash and jetwash conditions from other aircraft;
b. If a rotor brake is fitted, any limitations on use must be specified, and control must be guarded to
prevent inadvertent operation;
c. The use of engine control interlock safeguards to prevent inadvertent actuation.

1. Analyses include heat generation, provisions for isolation from flammable materials or fluids, energy
absorption rate and effects on the dynamic response of the transmission.
2. Component bench and system level testing.
3. Component endurance tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: I.3.4.9.4.1, Def-Stan 00-970 00-970 P7 S7 L732/1 4.1
I.4.4.9.4.1, K.3.4.11.3/ Reference:
K.4.4.11.3 STANAG
Reference:
7.3.2.10 Braking.
Normal and emergency braking systems (consisting of aerodynamic rotor drag and subsequent
mechanical braking) shall be capable of stopping the rotor, from 100% speed, within specified times after
engine shutdown and provide a gust-lock capability.

a. The specified minimum stopping time can be based on a structural analysis to protect power drive
subsystem gears and components from overloads due to sudden stops;
b. If a rotor brake is fitted, any limitations on use must be specified, and control must be guarded to
prevent inadvertent operation;
c. Thermal Analysis to establish the risk of combustible materials reaching their 'Flash point' temperature
adjacent to the Rotor Brake Energy absorption elements.
d. Ensuring there are no critical vibratory modes for the braking system.

1. Verify margins against heat generation limits, provisions for isolation from flammable materials or
fluids, and transmission energy absorption rate limit.
2. Component bench and system level testing to demonstrate the capability to keep the rotors from
rotating when exposed to the specified conditions.
3. System level test to demonstrate the ability of the engine interlock safeguard system to prevent
actuation during specified periods.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: K.3.4.11.3/ Def-Stan 00-970 00-970 P7 S2 L705 3.1.4,
K.4.4.11.3 Reference: 00-970 P7 S2 L705 3.2.10
STANAG
Reference:
7.3.2.11 Condition monitoring.

Drive system condition monitoring shall provide warning of impending failure that could result in loss of
the aircraft or prevent a safe landing. Elements of condition monitoring shall be specified and may
include: debris monitoring, lubrication system oil pressure and temperature monitoring, health and usage
monitoring (HUM).

1. Debris monitor testing to demonstrate the ability to detect debris of the size, shape and material
specified, the characteristic of debris considered abnormal and its insensitivity to normal wear.
2. Oil pressure and temperature. Full up rig and flight testing to demonstrate the required monitoring
capability of the lubrication system.
3. Health monitoring. Testing to identify a characteristic normal baseline for applying diagnostic indicators
to isolate mechanical component faults.
4. Usage monitoring. Testing to demonstrate acceptable and accurate in-flight monitoring of the power
drive subsystem operational usage.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: K.3.4.11.5/ Def-Stan 00-970 00-970 P7 L732 3.2.5
K.4.4.11.5 Reference: 00-970 P7 L732 4.2.3
JSSG-2007: A.3.7.8.2.4/ 00-970 P7 L700 7.4.2
A.4.7.8.2.4 00-970 P7 L703/5 16.2.1
00-970 P7 L727
STANAG
Reference:
Reference: CS 29.1305,
CS 29.1309(c)
Information Sources
CS 29.1465
7.3.2.12 Load absorbers.

The drive system clutching devices shall permit engagement and disengagement of the engines from the
load absorbers as required for all applicable modes of aircraft operation.
For rotary-wing aircraft in autorotation mode, the engine(s) not supplying torque shall be immediately and
automatically disengaged from the power drive subsystem. For multi-engine aircraft conducting single
engine operations, the engines not supplying torque shall be similarly disengaged to permit continued
operation of the rotor system and accessory drive for 2 hours without damage to the overrunning
mechanism.

a. Determining the torsional spring rate (angular deflection of the outer race relative to the inner race) of
the clutch;
b. Engagement and disengagement characteristics including measurement of torque fluctuations, and
peak values resulting from slip and sudden engagement where appropriate;
c. Defining the clutch’s fatigue characteristics;
d. Overrunning and cold temperature engagement performance;
e. Clutch durability.

1. Bench tests to demonstrate compliance:
• Static torque test.

• Cyclic fatigue (stroking) test.
• Overrunning test.
• Cold temperature engagement test.
• Clutch durability test.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: K.3.4.11.7/ Def-Stan 00-970 00-970 P7 L705/2 4.8
K.4.4.11.7 Reference: 00-970 P7 L705/2 4.9
00-970 P7 L705/2 5.3
00-970 P7 L705/2 10.1.8
STANAG
Reference:
7.3.2.13 Loss of lubrication.

Rotary drive system gearboxes shall continue to function safely for a specified duration following loss of
the primary lubrication system, and shall be in a condition such that the gearbox is still capable of
transmitting the required power.
The specified duration shall be sufficient to permit the safe landing and/or recovery of the aircraft, typically
at least 30 minutes.

a. Sufficient torque and rotational speed is maintained for that duration to allow continued safe flight;
b. The gearbox continues to function although not necessarily without damage.

1. A thirty minute loss-of-lubrication overrunning test consistent with a loss-of-lubricant test spectrum
demonstrates the ability of continued safe operation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2007A: A.3.7.8.1.3, Def-Stan 00-970 00-970 P7 L705 4.2
A.4.7.8.1.3 Reference: 00-970 P7 L705 4.3
JSSG-2009 STANAG
K.3.4.11.8/K.4.4.11.8 Reference:
FAA Doc: EASA CS CS 27.927(c)
CS 29.927(c)
CS 29.1027
7.3.2.14 Rotor meshing.

For intermeshing-rotor systems, phased externally, means shall be provided in the power drive
subsystem to prevent operation with de-phased rotors. Means shall be included for cockpit indication that
the rotors are locked in phase.

a. If the rotors must be phased for intermeshing, each system must provide constant and positive phase
relationship under any operating condition;
b. If a rotor dephasing device is incorporated, there must be means to keep the rotors locked in proper
phase before operation.

1. Analysis and demonstration are accomplished during system verification for the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Def-Stan 00-970 00-970 P7 L605 2.1.2
K.3.4.11.9/K.4.4.11.8 9 Reference:
STANAG
Reference:
Reference:
7.3.2.15 Accessory drives.

Failure or seizure of any individual accessory shall not cause failure of the gearbox(s) or cause damage
to any power drive subsystem components. For rotary-wing aircraft, accessories shall be driven whenever
the rotor system is rotating including during autorotation. Any failure of flight-critical accessories shall be
annunciated to the pilot/operator.
Cover plates shall be provided for use when accessories are not installed.

a. Accessory drive splines should be protected from wear with non-metallic inserts or should be positively
lubricated with oil when functioning.

1. Testing and inspection during gearbox system level verification.
2. Pilot/operator annunciation is verified by inspection, analysis of drawings and by demonstration.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Def-Stan 00-970 00-970 P7 L700 4.3
K.3.4.11.10/K.4.4.11.10 Reference: 00-970 P7 L705 3.1.9
STANAG
Reference:
Reference:
7.3.2.16 Environmental conditions.

The rotor/drive system shall operate safely and reliably in world-wide environments as required by the
system specification.

a. All intended natural and induced environments, including: temperature, humidity, precipitation, icing,
fungus, salt fog, particulate and liquid contamination, shock and vibration, and explosive atmosphere
conditions.

1. Rotor/drive system components are verified for expected usage and all intended and induced
environmental conditions using analyses, component test, and ground/flight tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-810 Def-Stan 00-970 00-970 P7 L705 1.4.1
MIL-HDBK-310 Reference:
STANAG
Reference:
Reference:
7.3.2.17 Drive system design.

The drive systems shall be capable of operating beyond the maximum rated torque and speed under
emergency conditions as defined by the aircraft specification.

a. Durability, dynamic response and structural integrity requirements specified.
b. Excursions from normal operational conditions such as autorotation.

1. Bench and system level tests to ensure structural integrity, endurance, performance, and capability to
withstand all specified transient excursions, operational and environmental conditions, including
emergency conditions and autorotation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 K.3.4.11 Def-Stan 00-970 00-970 P7 L705 1.4.1
Reference: 00-970 P7 L705 3.2.3
STANAG
Reference:
Reference:
7.3.2.18 Space envelope.

The space envelope provided for the transmission systems shall be such as to cause no hazard to
exposed shafts, oil lines, sensors, or other vulnerable parts which could occur due to contact with drive
system components.

a. Chafing and wear between rotating/moving parts and static components.
b. Where relative movement between components within the transmission systems and between such
components and the rotorcraft can occur, there shall be adequate provision for flexibility.

1. Inspection after aircraft drive/rotor system qualification testing is accomplished to assure minimum
clearances are maintained and that components do not have wear/chafing due to contact with each other.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P7 L705 2.1.3
Reference: 00-970 P7 L705 2.1.4
STANAG
Reference:
FAA Doc: EASA CS
Reference:
7.3.2.19 Protection from environmental elements.

The transmission and associated drive system components shall be adequately protected/sealed from
environmental elements (e.g., water, dust, and other contaminants), and external cleaning procedures
shall be in place that will not breach the sealing of those components.
1. Analysis of the designs, along with component level tests, verify that protective provisions have been
incorporated to prevent contaminants from penetrating critical areas.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P7 L705 2.1.7
Reference:
STANAG
Reference:
Reference:
7.3.2.20 Accessibility.
Reasonable accessibility to rotor and drive system-related equipment shall be provided for the
performance of required servicing, inspections, and maintenance.
Considerations should be given to:

a. Maintainer's anthropometric dimensions and strength limitations.
b. All environmental conditions, and any required mission equipment (e.g., chemical protective gear,
gloves).

1. Inspection of design criteria (to include Interface Control Document data) to verify that required
servicing, inspections and maintenance requirements have been established.
2. Analysis of virtual models and/or physical mock-ups to verify accessibility to required servicing,
inspection and maintenance areas.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 3.2.6 Def-Stan 00-970 00-970 Pt7 L705 2.1.6
Maintainability. Reference: 00-970 Pt7 L705 2.2.3
STANAG
Reference:
7.3.2.21 Faults and warnings.

The rotor and drive system health monitoring and prognostics systems shall provide adequate warnings
in a timely manner to ensure safety of flight.

a. Ensuring all safety/mission-critical faults and warnings are available to operators/maintainers.
b. Providing immediate notification of critical faults to the operator.
c. Recording all faults requiring maintenance action for post-flight download.
d. Providing critical rotor and drive system information, such as speed, control operating mode and fluid
quantities and pressures, to the maintainer.
e. Ensuring the rotor and drive system health monitoring system provides accurate information and
minimizes false positive faults.

1. Analysis and fault injection bench testing verify the capability of the monitoring system.
2. Aircraft level testing to verify that the operator is provided clear notification of any critical failure.
3. Fault download testing to verify that the maintainers have full access to failure data.
4. Information provided to the flight crew regarding the warnings and other information that may be
provided, and the required action. Such information should be consistent with the content of the engine
Interface Control Document (ICD) and operator manual.
Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-79-HDBK Def-Stan 00-970 00-970 Pt7 L727
Reference: 00-970 Pt7 L705 2.1.6
00-970 Pt7 L705 2.1.8
00-970 Pt7 L705 2.2.4
00-970 Pt7 L705 3.2.5
00-970 Pt7 L705 4.2.4
00-970 Pt7 L705 4.3.4
STANAG 4671.USAR.1309
Reference: 4671.USAR.1337
CS 29.1305
CS 29.1309
CS 29.1337
7.3.2.22 Contamination.
Contaminants shall not become trapped in rotating components, on external surfaces, or around seals
without the ability to run off or be removed.

a. Adequate drainage to prevent pooling of fluids.
b. Conditions expected to prevail when drainage is required.

1. Inspection of the design of components and external surfaces should determine if any areas that could
trap contaminants/fluids exist.
2. If contaminants/fluids can be trapped, verify that procedures are adequate to remove those
contaminants/fluids.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2009 G.3.4.7.5 Drainage Def-Stan 00-970 00-970 Pt7 L705 2.1.7
Reference: 00-970 Pt7 L700 5.1.2
Information Sources
STANAG 4671.USAR.1309
Reference: 4671.USAR.1337

7.3.3.1 Reciprocating engines.
Turbocharged reciprocating engine operating characteristics shall be investigated in flight to assure that
no adverse characteristics, as a result of an inadvertent overboost, surge, flooding, or vapour lock, are
present during normal or emergency operation of the engine(s) throughout the range of operating
limitations of both aeroplane and engine.

1. Aircraft operating limitations (defined in the aircraft's Type Certification and Aircraft Flight Manual)
should not exceed limitations of engine operating characteristics.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.903
Reference:
FAA Doc: 14CFR reference 33 subpart C EASA CS CS 23.939
for design requirements for Reference: CS-E Subpart B
commercial applications. CS-E Subpart C
14CFR reference 33 subpart D
for verification requirements for
commercial applications.

7.3.4.1 Other propulsion systems.
Other propulsion systems (e.g., rotary, wankel, electric) shall meet the requirements to achieve an Engine
Type Certificate and operate safely.

a. New/Novel propulsion systems and sub-systems.
b. Understanding the interactions with other aircraft systems and the requirements placed on them.

1. AAMC may be required to verify that new/novel propulsion systems meet the safety requirements to
warrant issue of an Engine Type Certificate.
Information Sources
Comm'l Doc:
Reference:
Information Sources
STANAG 4671.903
Reference:
FAA Doc: 14CFR reference 33 subpart C EASA CS CS-E 10
for design requirements for Reference: CS 27.901
commercial applications. CS 29.901
14CFR reference 33 subpart D
for verification requirements for
commercial applications.
SECTION 8 - AIRCRAFT SYSTEMS

1. Design criteria
2. Functional operations test results
3. Performance test results
4. Failure modes, effects, and criticality analyses (FMECA)
5. Hazard analysis
6. Component and system SOF certifications/qualifications
7. Design studies and analysis
8. Installation and operational characteristics
9. Flight manual and limitations
10. Electromagnetic environmental effects analysis and test results
11. Diminishing manufacturing sources plan
12. Obsolete parts plan
(Note: For subsystems that use computer resources, see section 15 for additional, specific criteria.)
8.1. HYDRAULIC AND PNEUMATIC SYSTEMS.
8.1.1 Redundant hydraulic system operation.

Where there is more than one hydraulic and/or pneumatic system, or where a system's design includes
redundant elements, the system shall be designed such that safe operation will continue following failure
of any one system or element thereof.

a. Common mode failures, especially where a common pressure source is used;
b. Ensuring stable and convergent aircraft handling with degraded systems.

1. Failure Modes and Effects Analyses (FMEA) should identify all failures of a system's elements and
their effect on the operation of the systems.
Information Sources
Comm'l Doc: SAE ARP4752
DoD/MIL Doc: JSSG-2009: B.3.4.2, B.4.4.2, Def-Stan 00-970 00-970 P1 2.15.22
B.3.4.2.1.10, B.4.4.2.1.10, Reference: 00-970 P1 2.15.23
B.3.4.2.1.16, B.4.4.2.1.16, 00-970 P1 2.15.25
Emergency Operation and
00-970 P1 6.11.52
Appendix M:
00-970 P1 6.11.53-6.11.55
M.3.4.13/M.4.4.13, Pneumatic
00-970 P1 6.12.3-6.12.4
Subsystems.
00-970 P1 6.12.6
00-970 P1 6.12.15
00-970 P7 L703 2.2
00-970 P7 L704 2.1
Information Sources
STANAG 4671.1301
4671.1437
FAA Doc: 14CFR references: 25.1435 b4 EASA CS CS 23.1301
CS 23.1437
CS 25.1301
CS 25.1309
CS 25.1310
CS 25.1435
CS 25.1436
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
8.1.1.1 Merged with 14.2.3.

8.1.2 Interfaces and redundancies.
All interfaces and redundancies with other systems shall be evaluated and shown to be safe.

a. Identifying and documenting all interfaces and redundancies with quoted systems; ensuring that the
interfaces are adequately described..
b. Producing a test and acceptance plan that:
i. Demonstrates that the requirements have been achieved safely.
ii. Redundancy scheme works appropriately.

1. System Interface Documents (SID) should define system parameters at its interface with other systems
under normal operating conditions, and all anticipated degraded/failed conditions. One SID per system
interface is preferred, but where practical to do so, one ICD may define a system's parameters multiple
systems. Where the parameters of one system affect the parameters of its interfacing system, it may be
practical for one SID to define the parameters of both systems.
2. Failure Modes and Effects Analyses (FMEA) should identify all failures of a system and their effect on
the interface parameters with other systems.
Information Sources
DoD/MIL Doc: JSSG-2009: B.3.4.2, B.4.4.2, Def-Stan 00-970 00-970 P1 1.1.12 to 1.1.14
B.3.4.2.1.10/ B.4.4.2.1.10 Reference: 00-970 P1 6.10
Emergency Operation; 00-970 P1 6.11.50
B.3.4.2.1.9/B.4.4.2.1.9
00-970 P1 6.11.52
Leakage Control;
B.3.4.2.2/B.4.4.2.2 Interface 00-970 P1 6.12.5
requirements; B.3.4.2/B.4.4.2 00-970 P1 6.12.33
Hydraulic power subsystem; 00-970 P1 6.12.34
and Appendix M:
Information Sources
M.3.4.13/M.4.4.13 Pneumatic STANAG 4671.1301
Subsystem. Reference: 4671.1309

CS 25.1301
CS 25.1309
CS 25.1435
CS 25.1436
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
8.1.3 Transition to backup systems.

Power operated and augmented systems and equipment shall be shown to operate as expected
throughout the degraded operation of Normal hydraulic, pneumatic and vacuum systems and throughout
operation via back-up, and emergency systems.

a. Ensuring the requirements have been correctly interpreted in the design.
b. Ensuring that sufficient hydraulic and pneumatic power is available to the requisite systems at all times.
c. Ensuring that transition from Normal operation to back-up or emergency systems does not affect any
operating characteristic of the power operated systems, and at a minimum does not have a negative
effect on flight safety.

1. Ground testing should verify that all anticipated combinations of degraded operation of hydraulic,
pneumatic and vacuum systems, and operation via back-up and/or emergency systems does not prevent
the acceptable operation of power-operated systems.
2. Flight testing should verify that all anticipated combinations of degraded operation of hydraulic,
pneumatic and vacuum systems, and operation via back-up and/or emergency systems does not affect
any operating characteristic of the power operated systems during all flight phases and configurations,
and at a minimum does not have a negative effect on flight safety.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix B: Def-Stan 00-970 00-970 P1 6.11.2
B.3.4.2.1.2/B.4.4.2.1.2 System Reference: 00-970 P1 6.11.4
Fluid Capacity; 00-970 P1 6.11.25
B.3.4.2.1.10/B.4.4.2.1.10
00-970 P1 6.11.52
Emergency Operation; and
00-970 P1 6.11.53
Appendix M: M.3.4.13,
00-970 P1 6.11.54
M.4.4.13
00-970 P1 6.11.55
00-970 P1 6.12.33
00-970 P1 6.12.34
Information Sources
00-970 P7 L704/0 3.4
STANAG 4671.1301
4671.1435
CS 23.1435
CS 25.1301
CS 25.1309
CS 25.1310
CS 25.1433
CS 25.1436
CS 27.1301
CS 27.1309
CS 27.1435
CS 29.1301
CS 29.1309
CS 29.1435
8.1.4 Fluid operating temperatures.

Hydraulic fluid temperatures shall not exceed the maximum allowable temperature during any
foreseeable operating condition.

a. Ensuring that the permitted hydraulic fluid specifications are clearly defined.
b. Ensuring that the maximum allowable hydraulic fluid operating temperature is defined and that this
temperature takes account of all relevant hydraulic fluid characteristics for all permitted fluid
specifications.
c. Ensuring that the maximum allowable hydraulic fluid operating temperature takes account of the
maximum allowed temperature for hydraulic system components and, where relevant,
systems/equipment interfacing or in proximity with the hydraulics system.
d. Accounting for all anticipated combinations of aircraft operation that affect the temperature of hydraulic
fluid, including heating elements (hydraulic pumps, brakes, etc.), cooling elements (e.g. heat exchangers)
and any credible combination of failures that could affect the system's temperature management.
e. Accounting for all operating environments in which the aircraft is anticipated to operate, including
temperatures, pressures and humidities.

1. Analysis should verify that all anticipated combinations of aircraft operation, including credible
combinations of failures of relevant systems/equipment does not cause hydraulic fluid temperatures to
exceed their maximum allowable value, for all permitted hydraulic fluid specifications.
2. Ground and/or Flight testing should verify the accuracy of the performed analyses, including
combinations of at least the following:
a. Prolonged application of brakes during ground taxi;
b. Acceleration to and subsequent deceleration from V1 (i.e. Rejected Take-off at speeds up to V1);
c. Failure and degraded operation of hydraulic fluid cooling elements (heat exchangers, ram-air ducts,
etc.), including operation at low speeds; and,
d. High ambient temperatures and heat-soaking of the aircraft.
Information Sources
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970 00-970 P1 6.11.13
B.3.4.2.1.14/B.4.4.2.1.14 High Reference: 00-970 P1 6.11.14
Temperature Operation; 00-970 P1 6.11.79
B.3.4.2.1.14.1/B.4.4.2.1.14.1
00-970 P7 L704/0 8.2
Thermal Relief;
00-970 P7 L704/1 3.3
B.3.4.2.1.15/B.4.4.2.1.15 Fire
STANAG 4671.1309
and Explosion Proofing
Reference:
CS 25.1435
CS 27.1309
CS 29.1309
8.1.5 Operator interface.

Adequate information shall be available to notify the flight crew of the hydraulic and pneumatic systems'
operating conditions.

a. Clear presentation of relevant information to crew, including status indication, and warning, caution and
advisory information.
b. Ensuring that changes in the hydraulic and pneumatic systems' operating conditions are highlighted to
the crew in a clear and unambiguous manner.
c. Ensuring that any required pilot input or intervention is clearly and unambiguously identified.
d. Ensuring that, where pilot action is required in accordance with an emergency procedure, checklist or
other Technical Publication, the relevant section of the Technical Publication is clearly defined such that
the pilot can intervene with minimal delay.
e. Ensuring that any credible combination of failures does not prevent the accurate notification of system

1. System Description Documents (SDD) should identify the controls and displays provided to crew. For
controls, detail should be provided regarding the mode of operation and function of each control. For
displays, detail should be provided regarding all information displayed to the crew, and where
appropriate, the conditions that would lead to specific indications.
2. System Description Documents (SDD) should clearly define the possible system operating conditions
and the operating parameters that trigger each condition.
3. Analysis (e.g. System Simulations) should demonstrate that system status information and changes in
system operating conditions are provided to the crew throughout all foreseeable aircraft operating
conditions.
4. Rig and/or Ground Testing should verify the accuracy of the performed analysis, including the effect of
system/equipment failures.
5. Flight Simulations, Ground Testing and/or Flight Testing should verify that the system status
information and changes in operating conditions are displayed clearly and unambiguously, and that
emergency procedures, checklists and other Technical Publications can be used effectively.
Information Sources
Fluid Monitoring; 00-970 P1 6.12.9
B.3.4.2.1.4.3/B.4.4.2.1.4.3
00-970 P7 L703 2.8
System Pressure Indication;
B.3.4.2.1.4.4/B.4.4.2.1.4.4 00-970 P7 L704/0 8.4
System Low-Pressure STANAG 4671.1309
Warning; Reference: 4671.1721
B.3.4.2.2.3/B.4.4.2.2.3
4671.1813
Instrumentation interface(s);
and Appendix M:
M.3.4.13.3/M.4.4.13.3 Status
Indication.
a2, 25.1435 b1 Reference: CS 23.1435
CS 25.1309
CS 25.1435
CS 25.1436
CS 27.1309
CS 29.1309
CS 29.1435
8.1.6 Technical manuals.

Flight and maintenance manuals shall include normal, back-up and emergency operating procedures,
limitations, restrictions, servicing, and maintenance information.

a. The level of detail necessary to provide accurate technical information while remaining concise;
b. The information, at the appropriate level of detail, required to allow personnel to operate and maintain
the aircraft as safely and effectively as possible at an acceptable workload.
c. Ensuring that all required operating procedures are defined, taking account of requirements for military
operation (e.g. in-flight rectification).

1. Operational Technical Publications for the flight crew (Aircraft Flight Manual, Emergency Procedures,
Checklists etc.) should clearly define all required normal, back-up and emergency operating procedures,
limitations and restrictions.
2. Maintenance Technical Publications for ground crew (Aircraft Maintenance Manual, Master Minimum
Equipment List, Maintenance Schedule, etc.) should clearly define all required servicing and maintenance
information.
3. Flight Simulations, Ground Testing and/or Flight Testing should verify that all Operational Technical
Publications are clear and unambiguous and can be followed by a flight crew through all flight phases and
conditions without incurring excessive crew workload and serve their intended function.
4. Rig and/or Ground Testing should verify that all Maintenance Technical Publications are clear and
unambiguous and can be followed by a competent maintenance engineer in a manner which ensures the
continuing airworthiness of the aircraft.
Information Sources
Reference: 00-970 P1 7.5.3
STANAG 4671.1501
4671.1581
4671.1583
4671.1585
4671.1587
4671.1589
4671.1591
FAA Doc: Refer to technical point of EASA CS CS 23.1529
CS 23.1585
CS 23.1587
CS 23.1589
CS 25.1529
CS 25.1581
CS 25.1583
CS 25.1585
CS 25.1587
CS 25.1591
CS 27.1529
CS 27.1581
CS 27.1583
CS 27.1585
CS 27.1587
CS 27.1589
CS 29.1529
CS 29.1581
CS 29.1583
CS 29.1585
CS 29.1587
CS 29.1589
8.1.7 Hydraulic/pneumatic components, lines and fittings.

The hydraulic and pneumatic components, lines and fittings and their installation shall be safe.

a. All system components, including:
i. Reservoirs;
ii. Pressure generation equipment (pumps, bleed air extraction equipment, ram-air ducts, turbines, etc);
iii. Pressure storage equipment (e.g. accumulators);

iv. Power transfer/conversion equipment (Power Transfer Units, motors, actuators, etc.);
v. Pipes and hoses (flexible & rigid);
vi. Couplings (including design to prevent reverse installation or inadvertent cross-connection);
vii. Fixings, brackets and miscellaneous ironmongery; and,
viii. Other components which form part of the hydraulic/pneumatic system.
b. System parameters including operating pressure and temperature.
c. All anticipated ambient environments including temperatures, pressures, vibration and fatigue through
the aircraft's anticipated operating environment and conditions.
d. Consideration of single failures and credible combinations of failures including:
i. Damage due to foreign objects (bird strike, uncontained engine rotors, etc.);
ii. Damage due to contamination of the working fluid;
iii. Interference between moving parts and other parts (moving and stationary); and,
iv. System overpressure (due to excessive force on hydro-locked components, thermal expansion of
compressible fluids, failure of pressure regulation devices, etc.).
e. Compatibility of hydraulic fluids and system seals or other components.

1. System Description Documents (SDD) should clearly define the operating parameters for the system
and the appropriateness of components.
2. Assembly Clearance Analyses should verify the clearance of all components through all normal
operating and failure conditions, taking account of the maximum possible displacements of all moving
parts.
3. Equipment Testing should verify that all components meet their specifications.
4. Analysis should verify that the systems are able to operate safely and meet all performance
requirements throughout all foreseeable flight phases and conditions.
5. Rig testing should verify the accuracy of system analysis and should verify that systems are able to
operate safely and meet all performance requirements throughout all foreseeable flight phases and
conditions.
6. Ground and Flight Testing should verify the safe operation of the hydraulic/pneumatic system(s) and
their ability to adequately provide power to other systems.
7. Failure Modes and Effects Analyses (FMEA) should identify all failures of the system and their effect on
its safe operation.
Information Sources
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970 00-970 P1 6.11
B.3.4.2.1.1/B4.4.2.1.1 Fluid Reference: 00-970 P1 6.11.36-6.11.41
Selection; B.3.4.2.1.2/4.4.2.1.2 00-970 P1 6.11.44-6.11.49
System fluid capacity;
00-970 P1 6.11.57-6.11.58
B.3.4.2.1.4/B.4.4.2.1.4 System
Pressure; 00-970 P1 6.11.62-6.11.64
B.3.4.2.1.5/B.4.4.2.1.5 00-970 P1 6.11.70-6.11.75
Pressure Control; 00-970 P1 6.12.1
B.3.4.2.1.14.1/B.4.4.2.1.14.1
00-970 P1 6.12.15-6.12.17
Thermal Relief;
B.3.4.2.1.15/B.4.4.2.1.15 Fire 00-970 P1 6.12.26-6.12.27
and Explosion Proofing; 00-970 P1 6.12.32-6.12.33
B.3.4.2.1.17/B.4.4.2.1.17 00-970 P7 L703 7.3
Information Sources
Clearances, 00-970 P7 L704/0 10
M.3.4.13.2/M.4.4.13.3 STANAG 4671.1309
Pressure,
M.3.4.13.4/M.4.4.13.4 Moisture
4671.1438
Content, M.6.4 Component
Information
a1, a3, c1, c2, 25.1435 a2, a4, Reference: CS 23.1435
a5 CS 25.1309
CS 25.1435
CS 25.1436
CS 25.1438
CS 27.1309
CS 27.1435
CS 29.1309
CS 29.1435
8.1.8 Power levels.

The aircraft hydraulic and pneumatic systems' size and power capacities shall be sufficient to provide
adequate power to all power-operated systems.

a. Ensuring adequate hydraulic/pneumatic power to all power-operated systems through all flight phases
and all foreseeable operating conditions.
b. The categorisation of power-operated systems (for example as 'essential' and 'non-essential') and load
shedding such that those systems considered essential for continued safe flight remain adequately
powered throughout any credible combination of failure, including multiple engines inoperative.
c. Providing adequate margin in power generation and/or storage devices such that any foreseeable
combination of undetected failures (e.g. multiple leaks throughout the system) does not impair adequate
supply of power.
d. Taking account of power-losses within the power-supply system (e.g. due to hydro-dynamic pressure
loss).

1. System Description Documents (SDD) should clearly define the operating parameters for the system
including maximum continuous power output (in Watts or equivalent unit) and transient power capacity (in
Joules or equivalent unit).
2. System Interface Documents (SID) should define the parameters for continuous power output (in Watts
or equivalent unit) and transient power capacity (in Joules or equivalent unit) of the power supply system,
and the corresponding maximum requirement for the power-operated system.
3. Equipment Testing should verify that all power generating and power storing components meet their
specifications.
4. Analysis should verify that the systems are able to operate safely and meet all performance
5. Rig testing should verify the accuracy of system analysis and should verify that systems are able to
operate safely and meet all performance requirements throughout all foreseeable flight phases and
conditions.
6. Ground and Flight Testing should verify the safe operation of the hydraulic/pneumatic system(s) and
their ability to adequately provide power to other systems.
its safe operation.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix B: Def-Stan 00-970 00-970 P1 6.11.2-6.11.3
B.3.4.2/B.4.4.2 Hydraulic Reference: 00-970 P1 6.11.5-6.11.8
Power Subsystem; 00-970 P1 6.11.9-6.11.10
B.3.4.2.1.2/B.4.4.2.1.2 System
00-970 P1 6.11.70
Fluid Capacity; and Appendix
00-970 P1 6.11.80-6.11.81
M: M.3.4.13/M.4.4.13
00-970 P1 6.12.2
Pneumatic Subsystems.
00-970 P1 6.12.5
00-970 P1 6.12.33
00-970 P7 L703 6.2
STANAG 4671.1309
4671.1438
FAA Doc: Refer to technical point of EASA CS CS 23.1309
CS 25.1309
CS 25.1435
CS 25.1436
CS 25.1438
CS 27.1309
CS 27.1435
CS 29.1309
CS 29.1435
8.1.9 Pressure variance.

Pressure fluctuations shall be taken into account in the design of the system.

a. The magnitude and frequency of all pressure fluctuations in the system, including those arising from:
i. Start-up and shutdown of pumps/compressors;
ii. Opening/closing of valves;
iii. Cavitation;
iv. Operation of power-operated systems/equipment; and,
v. Large system pressures due to high flow, choked flow and waterfall effects.
b. The effectiveness of pressure management including devices (such as pressure relief valves, surge
suppressors (including devices where surge suppression is a secondary function such as accumulators),
burst discs/diaphragms, etc.), and controlled operation of system components (e.g. slow-starting pumps,
slow-closure of valves, etc.), and the effect of failure of this pressure management.
1. System Description Documents (SDD) should define the maximum continuous and transient surge
pressures of the system, including both magnitude, and frequency.
2. System Interface Documents (SID) should define the maximum continuous and transient surge
pressures at the interface between the hydraulic/pneumatic system and other systems.
3. Equipment Testing should verify that components meet their specifications in all respects relevant to
surge pressure generation/management, including the opening/closure time of valves, start-up/shutdown
time of pumps, and the pressures induced at the component's highest flow rate.
4. Analysis should identify the anticipated continuous and transient surge pressures taking account of
component characteristics when integrated into the system throughout all foreseeable flight phases and
conditions.
5. Rig testing should verify the accuracy of system analysis and should verify that system pressures do
not exceed expected values throughout all foreseeable flight phases and conditions.
6. Ground and Flight Testing should verify the safe operation of the system and should verify that system
pressures do not exceed expected values throughout all foreseeable flight phases and conditions.
its safe operation.
Information Sources
B.3.4.2.1.5/B.4.4.2.1.5 Reference: 00-970 P1 6.11.9 to 6.11.12
Pressure Control; 00-970 P1 6.11.60
B.3.4.2.1.5.1/B.4.4.2.1.5.1
00-970 P1 6.11.70
Peak Pressure; and
B.3.4.2.1.5.2/B.4.4.2.1.5.2 00-970 P1 6.11.80 to 6.11.81
Pressure Ripple; and Appendix 00-970 P1 6.12.5
M: M.3.4.13.2/M.4.4.13.2 00-970 P1 6.12.20 to 6.12.22
Pressure.
00-970 P1 6.12.33
00-970 P7 L704 6.1
00-970 P7 L704/0 8.1.4
00-970 P7 L704/1 3.2
STANAG 4671.1309
a3, 25.1435 b2 Reference: CS 23.1435
CS 25.1309
CS 25.1435
CS 25.1436
CS 25.1438
CS 27.1309
CS 27.1435
CS 29.1309
CS 29.1435
8.1.10 Impurities.
The system shall include means for controlling and purging impurities and for determining that the
system's level of contamination is acceptable.
a. Contamination by any foreign matter, including solid, liquid, and/or gaseous materials.
b. Prevention of contamination including the use of seals, diaphragms, gators, etc.
c. Management of contamination and prevention of system deterioration, including filters, magnetic plugs,
top/bottom reservoir pick-ups, air release valves, etc.
d. Means for identifying levels of contamination, including; contamination of filters etc., continuous or
scheduled particulate measurement, periodic testing, etc.
e. Means for purging of contaminated systems, including isolating and purging components, lines and
fittings, replacing contaminated filters.

1. System Description Documents (SDD) should define the system's means for controlling and purging
impurities and that maximum allowed levels of contamination within the system.
2. System Interface Documents (SID) should define the maximum anticipated levels of contamination of
the system.
3. Equipment Testing should verify that components are able to operate throughout all expected
operating environments without introducing unacceptable levels of contamination to the system.
4. Analysis should verify that the system is able to operate safely despite contamination.
5. Failure Modes and Effects Analyses (FMEA) should identify all failures of the system, including
contamination, and their effect on its safe operation.
6. Maintenance Technical Publications (Aircraft Maintenance Manual, Master Minimum Equipment List,
Maintenance Schedule, etc.) should clearly define all required servicing and maintenance information,
including the process for, and required frequency of system checks and purging.
Information Sources
Level Contamination 00-970 P1 6.11.19
Prevention;
00-970 P1 6.11.26-6.11.34
B.3.4.2.1.7/B.4.4.2.1.7 System
Air Removal; and 00-970 P1 6.11.35
B.3.4.2.1.8/B.4.4.2.1.8 00-970 P1 6.12.7
Moisture Removal; 00-970 P7 L704 9.1
M.3.4.13/M.4.4.13 Pneumatic
Subsystem. STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.1.11 Component testing.

All aspects of component requirements shall be validated to ensure that they support the requirements of
the system. Testing shall be performed on each component to ensure compliance with all component
requirements and on each assembly, sub-system and system to ensure compliance with system
requirements.

a. All relevant aspects of the component specification, including:
i. Strength/stress;
ii. Performance;
iii. Physical parameters (size, critical dimensions and tolerances, mass/weight, Centre of Gravity,
moments of inertia, heat capacity, etc.);
iv. Endurance/Longevity (fatigue, Mean Time Before Failure, etc.).
b. Component's compliance with relevant requirements/standards (e.g. EN 10255:2004).
c. Testing in compliance with relevant requirements/standards (e.g. IEC 60193).

1. System Description Documents (SDD) should detail the components used throughout the system and
the function of components, assemblies, sub-systems and systems, including any key performance
requirements.
2. Equipment Testing should verify that components meet their specifications in all respects.
3. Analysis should identify system characteristics when integrated into the system throughout all
foreseeable flight phases and conditions.
4. Rig testing should verify the accuracy of system analysis and should verify compliance with all system
5. Ground and Flight Testing should verify the safe operation of the system and should verify compliance
with all system requirements throughout all foreseeable flight phases and conditions.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 6.11.59
00-970 P1 6.11.60
00-970 P1 6.11.67
00-970 P1 6.11.68
00-970 P1 6.11.70
00-970 P1 6.11.71
00-970 P1 6.11.72
00-970 P1 6.11.74
00-970 P1 6.11.76
00-970 P1 6.11.77
00-970 P1 6.11.80
00-970 P1 6.11.81
00-970 P1 6.11.82
00-970 P1 6.11.83
00-970 P1 6.12.28
00-970 P1 6.12.29
00-970 P1 6.12.30
00-970 P1 6.12.31
00-970 P1 6.12.32
00-970 P1 6.12.33
00-970 P1 6.12.34
00-970 P1 6.12.35
00-970 P1 6.12.36
00-970 P1 6.12.37
00-970 P1 6.12.38
00-970 P7 L1000
Information Sources
00-970 L730 S2.2.1
00-970 L730 S3.2.1
00-970 L730 S4.1
00-970 L719 S5
00-970 L719 S6
00-970 L704 S14
00-970 L704 S15.2
00-970 L704 S15.3
00-970 L704 S15.5.2
00-970 L704 S15.5.3
00-970 L1004
STANAG
Reference:
CS 25.1435
CS 25.1436
CS 27.1435
CS 29.1435
8.2. ENVIRONMENTAL CONTROL SYSTEM (ECS).
8.2.1 Design for Safety

The Environmental Control System (ECS) shall be designed to meet an appropriate level of system
safety.

a. The ECS, its interfacing systems and systems providing associated functions, including:
i. Pressurisation;
ii. Heating and Cooling (of crew/passengers and equipment);
iii. De-icing;
iv. De-fogging;
v. Uncontaminated breathing air;
vi. Engine bleed air for use in ECS; and,
vii. Pneumatic systems related to ECS.
b. The appropriate level of system safety taking into account the performance of the system in normal and
failure states, and its effect on airworthiness.

1. Failure Modes and Effects Analyses (FMEA) should identify all failures of the system's elements and
their effect on the airworthiness of the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: 3.3.3, 4.3.3 Def-Stan 00-970 00-970 P1 4.24
Information Sources
00-970 P1 4.26
00-970 P1 6.12.3
00-970 P1 6.12.4
00-970 P1 6.12.5
00-970 P1 6.12.14
STANAG 4671.USAR 1307(a)
Reference: 4671.USAR 1431
4671.USAR 1485
CS 25. 831
CS 25. 832
CS 25.841
CS 25.833
CS 25.855
CS 25.857
CS 25. 859
CS 25.1309
CS 25.1438
CS 27. 831
CS 27.1309(b)
CS 25. 859
CS 29.831
CS 29 855
CS 29.857
8.2.2 Integration
The ECS shall be integrated into the aircraft in such a way that Safety of Flight is not compromised
throughout the flight envelope.

a. Components and their integration under all anticipated environments and loadings.

their effect on the airworthiness of the aircraft; and,
2. Rig, ground and flight testing should demonstrate the correct integration of system components.
Information Sources
Comm'l Doc:
JSSG-2001: 3.3.10, 3.3.10.1 Reference: 00-970 P1 4.24
00-970 P1 4.25
00-970 P1 6 6.12.14
00-970 P1 6 6.12.15
00-970 P1 6 6.12.16
00-970 P1 6 6.12.17
Information Sources
00-970 P1 6 6.12.18
00-970 P1 6 6.12.19
STANAG 4671.USAR 1307(b)
CS 25.831
CS 25.832
CS 25.841
CS 25.859
CS 25.1309
CS 25.1438
CS 27.831
CS 27.859
CS 29.831
CS 29.859
CS 29.1309
8.2.3 Merged with Line 8.2.5

8.2.4 Pressurisation
The ECS shall provide normal and emergency pressurisation to support Safety of Flight.

a. An appropriate level of redundancy, taking account of the effect of failure of the pressurisation system
on the aircraft and its occupants; and,
b. Monitoring of the pressurisation system, both on board the aircraft, and where appropriate, remotely.

2. Rig, ground and flight testing should demonstrate the correct function of the normal and emergency
pressurisation systems.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix D: Def-Stan 00-970 00-970 P1 S3 L14 Par. 2
D.3.4.4.1, D.4.4.4.1 Reference:
STANAG 4671.841
Reference: 4671.843
4671.1795
4671.1307(e)
FAA Doc: EASA CS CS 23.365*
CS 23.843
CS 25.841
CS 25.843
8.2.5 Degraded system operation

The effect of loss of some or all ECS functions on aircraft safety and performance shall be acceptable.

a. An appropriate level of redundancy, taking account of the effect of failure of the ECS on the aircraft and
its occupants.

2. Rig, ground and flight testing should demonstrate the correct function of the normal and emergency
ECS functions.
Information Sources
Comm'l Doc:
Appendix D: Reference: 00-970 P1 4.24.23
D.3.4.4.5*, D.3.4.4.12*, 00-970 P1 4.25
D.4.4.3.3*, D.4.4.4.5*, 00-970 P1 4.26.62
D.4.4.4.12*, 00-970 P1 6.2.24
D.3.4.4.5.2/D.4.4.4.5.2* 00-970 P1 6.2.25
D.3.4.4.5.3/D.4.4.4.5.3* 00-970 P1 6.12.1
D.3.4.4.12.2/D.4.4.4.12.2* 00-970 P1 6.12.2
D.3.4.4.5.2/ D.4.4.4.14.2* 00-970 P1 6.12.3
D.3.4.4.14.3/D.4.4.4.14.3* 00-970 P1 6.12.4
D.3.4.4.5.1/D.4.4.4.5.1 00-970 P1 6.12.5
00-970 P1 7.2
00-970 P7 L731
00-970 P13 Clause 1.5
STANAG 4671.USAR 1307(c)(f)


Reference: CS 23.1309(b)(4)
CS 25.831
CS 25.1309
CS 25.1435
CS 27.831
CS 27.1309
CS 29.831
CS 29.1309

Aircraft technical publications associated with the ECS shall include normal, back-up and emergency
operating procedures, limitations, restrictions, servicing, and maintenance information.

information.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1307(g)
4671.U1485

CS 27.1581
CS 29.1581

Adequate controls and displays at the appropriate locations shall be available to notify the flight crew of
the ECS systems.

b. UAS applications in which it might be appropriate for ECS controls to be located in any ground control
station;
c. The ECS controls for pneumatic pressure and temperature within the occupied compartment should be
readily accessible to all applicable flight crew;
d. The operation of ECS controls should not cause instability;
e. For UAV operations, the operator should have full access to the relevant status indicators, warnings,
cautions and advisories;
f. Accessibility, labelling, and ease of use of ECS controls;
2. Flight simulation, ground and flight testing demonstrating that controls and displays support safe flight.
Information Sources
Comm'l Doc:
D.3.4.4.3/D.4.4.4.3 ECS crew Reference: 00-970 P1 4.19
station interface 00-970 P1 4.24.22
00-970 P1 6.12
00-970 P7 L731 Par. 6.1
STANAG 4671.USAR 1307(h)
FAA Doc: EASA CS CS 23.1309(b)(3)

CS 25.859
CS 25.1301
CS 25.1309(c)
CS 25.1322
CS 25.1541
CS 25.1543
CS 29.1309(c)
CS 25.1436
8.2.8 Personnel accommodation

The ECS shall provide an atmosphere appropriate for personnel including adequate crew/occupant
ventilation and protective flight garment supply systems (oxygen equipment, pressure suits, and anti-g
garments or ventilation garments).

a. The effect and adequate prevention of malfunction, including excessive or insufficient pressure,
temperature, oxygen content, and the presence of harmful compounds such as smoke, carbon monoxide
and ozone; and,
b. Flight crew/passenger physiological requirements (Human Factors), including requirements for certain
occupants such as medical evacuation patients.

2. System Description Document (SDD) detailing the selected physiological limits for each atmospheric
variable, and the ECS' operation within these limits; and,
3. Analysis, ground and flight testing demonstrating the safe provision of appropriate atmosphere within
the defined limits for each atmospheric variable.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix D: Def-Stan 00-970 00-970 P1 4.24
D.3.4.4.3, D.4.4.3.3, Reference: 00-970 P13 Clause 1.4.1
D.3.4.4.5.4/D.4.4.4.5.4 ECS STANAG 3198
Suit ventilation and Reference:
pressurization
CS 25.841
CS 29.831
8.2.9 Environmental protection

Sub-systems provided for environmental protection (windshield rain/snow/ice removal, ice protection and
defog, etc.) shall ensure the safe operation of the aircraft within the specified flight environment.

a. Environmental conditions for which the aircraft is cleared to fly;
b. Environmental conditions in which the aircraft is not cleared to fly but through which the aircraft may be
forced to operate for short periods (e.g. landing in deteriorated weather conditions or an inadvertent icing
encounter);
c. Automation of control systems which minimise the workload of pilots when flying through degraded
environmental conditions;
d. Provision of means for monitoring external surfaces and conditions (e.g. icing) by the crew throughout
the design envelope; and,
e. The effect and adequate prevention of malfunctions which may jeopardise safety of flight.

1. The Aircraft Specification should specify the environmental conditions for which the aircraft is cleared
to fly, and through which the aircraft may be expected to operate for short periods;
2. Rig, ground and flight testing should demonstrate the adequate performance of environmental
protection systems throughout the environmental conditions for which the aircraft is cleared to fly, and
through which the aircraft may be expected to operate for short periods.
Information Sources
Comm'l Doc:
DoD/MIL Doc: D.3.4.4.8/D.4.4.4.8 970 P1 13 Def-Stan 00-970 00-970 P1 4 4.24.6
1.5.1.1 Reference: 00-970 P1 7.2
Transparent area fog and frost 00-970 P1 13 1.5.1.1
protection; STANAG 4671.USAR 1419
D.3.4.4.9/D.4.4.4.9 Reference:
Rain removal;
D.3.4.4.10/D.4.4.4.10 *
Transparency cleaning;
D.3.4.4.11/D.4.4.4.11 Ice
protection
Information Sources
CS 25.1093
CS 25.1419
CS 27.1419
CS 29.773
CS 29.859
CS 29.975
CS 29.1093
CS 29.1105
CS 29.1419
8.2.10 Personnel air quality

Each crewmember's air supply shall be protected from all forms of contamination, including that resulting
from oil leakage from the engine(s) and under Nuclear/Biological/Chemical (NBC) environment
conditions.

a. Automatic and/or manual means to shut off contaminated air flow;
b. Fresh air ventilation and overboard exhaust for contamination, harmful vapour, gases and odour; and,
c. Means to prevent, manage and protect occupants against NBC contamination.

2. Rig, ground and flight testing should demonstrate the effective ventilation of ambient air and purging of
crew air supplies.
Information Sources
Comm'l Doc:
D.3.4.4.2.8/D.4.4.4.2.8 Reference: 00-970 P1 4.24.9
D.3.4.4.5.1/D.4.4.4.5.1 00-970 P1 4.24.10
D.3.4.4.5.2/D.4.4.4.5.2 00-970 P1 4.24.11
D.3.4.4.6.1/D.4.4.4.6.1 00-970 P1 4.24.48
D.3.4.4.6.3/D.4.4.4.6.3 00-970 P1 13 1.5.1.1
00-970 P13 3.11
00-970 P7 L731 Par. 3 2.4
STANAG USAR 3610

Reference:
CS 23.1111
CS 25.831
CS 25.832
CS 25.857
CS 25.859
Information Sources
CS 25.1121
CS 29.831
CS 29.855
CS 29.859
CS 29.1121
8.2.11 Leak monitoring/detection

The bleed air system and other compressed air duct systems shall be monitored for leaks and structural
integrity.

a. Ensuring that, should a duct fail, any hot air leaking from damaged bleed air ducting would not:
i. Act as a source of ignition for flammable liquids, vapours or materials;
ii. Cause damage to Structurally Significant Items, items that impact Safety of Flight, or Critical System
Items.
b. The necessary integrity/reliability of any leak monitoring/detection system, and the need for redundant
systems, particularly in high-risk areas (e.g. where flammable fluids, vapours or gases may be present).

2. Rig, ground and flight testing should demonstrate the effective leak monitoring and detection of bleed
air systems.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix D: Def-Stan 00-970 00-970 P1 4.24.25
D.3.4.4.12, D.4.4.4.12, Reference: 00-970 P1 4.24.37
D.3.4.4.12.8/D.4.4.4.12.8 00-970 P1 4.25
MIL-HDBK-221: 2.8 00-970 P1 4.26.69
STANAG 4671.USAR 1307(j)
Reference:
CS 29.1103
8.2.12 Bleed air shut-off

Means for bleed air shut-off shall be provided at, or as close as possible to, the bleed air source.

a. The fail-safe design of shut-off means (i.e. ensuring that shut-off remains possible despite failures of
power systems);
b. Minimising the possibility of a leak upstream of the provided shut-off means, and the effect on safety
should such a leak develop;
c. The use of multiple redundant vales may, especially in safety-critical applications, or where
integrity/reliability cannot be ensured with a single shut-off valve.

2. Rig, ground and flight testing should demonstrate the effective shut-off of the bleed air system(s), when
automatically and/or manually actuated, and the effective display of system status.
Information Sources
Comm'l Doc:
D.3.4.4.12.2/D.4.4.4.12.2 Reference: 00-970 P1 6.12
D.3.4.4.12.3/D.4.4.4.12.3 STANAG
D.3.4.4.12.4/D.4.4.4.12.4 Reference:
D.3.4.4.12.10/D.4.4.4.12.10
FAA Doc: EASA CS
Reference:
8.2.13 Pressurization stabilization control

Pressure surges in the aircraft cockpit, control station (where appropriate) and avionics bays shall be
prevented.

a. Means to maintain automatic pressurisation levels throughout all flight conditions; and,
b. Means to prevent excessive pressure differentials (positive and negative) while providing controlled
pressure relief.

1. The Aircraft Specification should specify limits to all variables which could affect the aircraft's
differential pressure (Rate of Climb, Rate of Descent, etc);
2. System Description Documents should detail the means for pressure control including the means for
minimisation of differential pressures and surge pressures;
3. Rig, ground and flight testing should demonstrate the appropriate control of pressure levels throughout
a variety of flight phases, including high rates of climb and descent.
Information Sources
Comm'l Doc:
D.3.4.4.1.1/D.4.4.4.1.1* Reference:
D.3.4.4.1.4/D.4.4.4.1.4* STANAG 4671.841
D.3.4.4.1.5/D.4.4.4.1.5* Reference:
D.3.4.4.1.6/D.4.4.4.1.6*
D.3.4.4.1.7/D.4.4.4.1.7*
Reference: CS 23.843*
CS 25.841
CS 25.843*
8.2.14 Nuclear, biological and chemical (NBC) protection provisions

Nuclear, biological, and chemical (NBC) protection equipment and/or procedures shall be provided so
that ventilation air is free from contaminants to the levels and in the environments specified in the aircraft
specification.

a. The environments against which protection is required;
b. The limits to which protection is to be considered acceptable; and,
c. The action (if any) required by the crew to put in place or maximise NBC protection, and the effect of
their inaction (e.g. due to high crew workload or incapacitation).

1. The Aircraft Specification should specify the NBC environments for which protection is required and the
acceptable limits for NBC exposure of the occupants;
2. System Description Documents (SDD) should specify equipment and procedures for NBC protection;
3. Aircraft Technical Publications should specify procedures for minimising NBC exposure; and,
4. Simulations, ground and flight testing should demonstrate that NBC procedures can be followed by the
crew effectively.
Information Sources
Comm'l Doc:
D.3.4.4.2.8/D.4.4.4.2.8 * Reference: 00-970 P1 4.24.48
D.3.4.4.5.1/D.4.4.4.5.1 00-970 P13 3.11
D.3.4.4.5.2/D.4.4.4.5.2 00-970 P7 L731/3
D.3.4.4.6.1/D.4.4.4.6.1 STANAG
D.3.4.4.6.3/D.4.4.4.6.3 Reference:
CS 27.831
CS 29.831
8.2.15 Thermal management

The thermal management system shall be stable for all flight conditions and environments.

a. The full range of anticipated flight environments;
b. Normal and emergency conditions; and,
c. The thermal effect of aircraft systems, including operation of high-power electrical equipment.
Consideration for preparation of AMC:

1. The Aircraft Specification should specify the environments in which the aircraft is expected to operate,
including anticipated cold-soaking and hot-soaking, and any other environment that could affect the
aircraft's thermal management (e.g. prolonged flight in hover or ground runs, where airflow is minimal);
2. Thermal analysis should show that the heating and cooling capacity of the ECS can adequately heat
and cool the relevant compartments with systems and equipment generating the appropriate amount of
heat to reflect their operating conditions in normal and reasonably anticipated failure states; and,
3. Rig, ground and flight testing should verify the accuracy of thermal modelling, and should demonstrate
that aircraft compartments, systems and equipment do not exceed specified temperature limits.
Information Sources
Comm'l Doc:
D.3.4.4.2, D.3.4.4.18 * Reference: 00-970 P1 4.24.14-4.24.20
D.4.4.4.2, D.4.4.4.18 * 00-970 P1 4.24.40
JSSG-2001: 3.3.10, 3.3.10.1 STANAG 4671.1307(k)
Reference:
CS 29.833

8.2.17 Surface touch temperatures
Surface touch temperatures shall be acceptable and shall preclude any operational limitations to safety of
flight operations of the aircraft.

a. The surfaces that could reasonably be touched inadvertently;
b. Providing protection in the form of guards and warning labels as appropriate;
c. Maintaining the comfort of the aircraft's occupants; and,
d. Ensuring the safety of personnel from risk of sustaining burns, including cold burns.

1. The Aircraft Specification should specify maximum and minimum touch temperatures for all surfaces.
This should distinguish between occupied and non-occupied compartments where appropriate;
2. Thermal analysis should show that the heating and cooling capacity of the ECS can adequately heat
and cool the relevant compartments such that surface touch temperatures remain within acceptable limits
with systems and equipment generating the appropriate amount of heat to reflect their operating
conditions in normal and reasonably anticipated failure states; and,
3. Rig, ground and flight testing should verify the accuracy of thermal modelling, and should demonstrate
that aircraft compartments, systems and equipment do not exceed specified temperature limits.
Information Sources
Comm'l Doc:
D.3.4.4.4, D.4.4.4.4 Reference: 00-970 P1 4.24.19
00-970 P1 4.24.20
00-970 P7 L731
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.3. FUEL SYSTEM.
8.3.1 Integration
The fuel system design, including interfaces, shall be functionally and physically compatible with other
aircraft systems.

a. Interfaces with other aircraft systems (engine, cooling, electrical, pneumatic, etc.); and,
b. Ensuring all materials used in the fuel subsystem are compatible with the aircraft designated fuels.

1. System Interface Documents (SID) should identify interface parameters between the Fuel System and
each interfacing system; and,
2. Failure Modes and Effects Analysis (FMEA) should identify the possible failures of the Fuel System
and its interfacing systems, and the effects of those failures.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: 3.4.4.1/4.4.4.1; Def-Stan 00-970 00-970 P1 5.2.4
Appendix E: E.3.4.5.1.1, Reference: 00-970 P1 5.2.17
E.4.4.5.1.1, E.3.4.5.1.2, STANAG
E.4.4.5.1.2, E.3.4.5.1.3, 4671.953
E.4.4.5.1.3, E.3.4.5.1.3.11, Reference: 4671.993
E.4.4.5.1.3.11, E.3.4.5.2.1, 4671.994
E.4.4.5.2.1, E.3.4.5.2.2, 4671.995
E.4.4.5.2.2, E.3.4.5.3,
E.4.4.5.3
23.979, 23.991-23.1001, Reference: CS 25.951-25.1001
25.951-25.981, 25.991- CS 27.951-27.1001
25.1001
CS 29.951-29.1001
8.3.2 Qualification tests

All fuel system components shall pass all required qualification tests to ensure their suitability for use in
all expected usage and environmental conditions.
See also section 8.3.6 regarding pressure capability, and 8.3.10 regarding over-pressure protection.

a. A wide variety of qualification tests such as: proof, burst, vibration, containment, over-speed,
acceleration, explosive atmosphere, pressure cycling, and temperature cycling;
b. Conducting qualification in accordance with appropriate existing standards, where such standards
exist; and,
c. Creating appropriately detailed procedures for qualification where existing standards do not exist.

1. Qualification Test Procedures (QTP) should define the qualification tests necessary to demonstrate the
suitability of components to perform their intended function;
2. Qualification Test Reports (QTR) should record the conduct and results of qualification testing in
accordance with the relevant QTP or other existing, relevant standard;
3. Declarations of Design Performance (DDP) should record the scope of qualification, the intended
function, and suitability to perform that function for each component; and,
4. Rig, ground and flight testing should demonstrate the correct function of all components when installed
as part of the system.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 5.2.17-5.2.22
Reference: 00-970 P1 5.2.34
00-970 P1 5.2.35
00-970 P1 5.2.37
STANAG 4671.951
Reference: 4671.963
4671.965
CS 25.952
CS 25.963
CS 25.965
CS 27.963
CS 27.965
CS 29.963
CS 29.965
8.3.1.1 Merged with 8.3.17

8.3.3 Compatibility with approved fuels
The fuel system shall function satisfactorily with all designated fuels including additives and expected
contaminants.

a. Compatibility of materials used in the fuel system;
b. The use of alternate fuels, restricted fuels and emergency fuels, and any associated aircraft limitations,
restrictions, or possible fuel system degradation; and,
c. Fuel system operation with fuel contamination, including particulates, microbes and water.

1. The Aircraft Specification should list the aircraft's approved fuels, and maximum allowable levels of
contamination, including particulates, microbial growth and water (free, emulsified and dissolved);
2. Declarations of Design Performance should list the fuels for which components are approved and list
any limitations associated with specific fuel types;
3. Analysis should identify any limitations and restrictions associated with using specified fuels; and,
4. Rig, ground and flight testing should demonstrate the correct function of the fuel system with
appropriate fuel types.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix E: Def-Stan 00-970 00-970 P1 5.2.3
E.3.4.5.1.1, E.4.4.5.1.1, Reference: 00-970 P1 5.2.4
Information Sources
E.3.4.5.1.2, E.4.4.5.1.2, 00-970 P1 5.2.15
E.3.4.5.1.3, E.4.4.5.1.3, 00-970 P7 L702 2.1 - 2.2
E.3.4.5.1.4, E.4.4.5.1.4,
E.3.4.5.2.1, E.4.4.5.2.1, STANAG 4671.951-4671.1001*
E.3.4.5.2.2, E.4.4.5.2.2 Reference:
23.979, 23.991-23.1001, Reference: CS 23.1309
25.951-25.981, 25.991- CS 25.951-25.1001
25.1001
CS 25.1309
AC 20-29
CS 27.951-27.1001
CS 27.1309
CS 29.951-29.1001
CS 29.1309
8.3.4 Covered by Section 14.

8.3.5 Fuel system strength.
The complete fuel system (including all fuel lines, components, tanks etc.) shall be installed, adequately
supported, and have sufficient clearances, such that no unsafe conditions or hazards are created during
normal aircraft operations.

a. Ensuring each fuel line is installed and supported to prevent excessive vibration;
b. Protecting fuel system components from damage which could result in spillage;
c. Ensuring each fuel line connected to components of the aircraft, between which relative motion could
exist, have provisions for flexibility;
d. Means to prevent chafing of fuel system components against surrounding structure and components;
e. Ensuring fuel tanks are adequately supported.

1. Static and Dynamic analysis (e.g. Finite Element Analysis) should demonstrate that all fuel system
components can withstand the loads expected in service without permanent deformation, or deformation
that would cause unacceptable clearance between aircraft components. The loads that should be
considered include fuel system pressures, loads due to aircraft acceleration, loads due to vibration and
any loads arising from relative motion of parts, including thermal expansion/contraction.
2. System Description Documents (SDD) should define the preventative means provided for protection
against spillage. Such means may include the double-walling of fuel lines, and provision of monitorable
drain lines.
3. SDD should define the provisions made to allow for relative movement between parts of the aircraft.
4. SDD should define the provisions made to prevent chafing of fuel system components.
5. Static analysis should demonstrate that fuel tanks and supporting structure are suitably strong to
withstand loads resulting from the mass of carried fuel and expected aircraft acceleration.
6. Rig, ground and flight testing should demonstrate the accuracy of static and dynamic analysis.
Information Sources
Comm'l Doc:
3.3.8, 4.3.8 Reference: 00-970 P1 5.2.30
Information Sources
00-970 P1 5.2.32
00-970 P1 5.2.37
00-970 P1 5.2.43-5.2.53
00-970 P1 5.2.96
STANAG 4671.951
Reference: 4671.963
4671.993
23.993, 23.994, 25.963, Reference: CS 23.963
25.993, 25.994 CS 23.993
CS 23.994*
CS 25.305
CS 25.963
CS 25.993
CS 25.994*
CS 27.305
CS 27.963
CS 27.993
CS 29.305
CS 29.963
CS 29.993
8.3.6 Pressure capability.

All fuel system components, lines and connections, (both as completely assembled and installed within
the aircraft), shall be capable of withstanding the specified proof pressure limits, without resulting in fuel
leakage, critical system performance degradation or critical life limited durability.

a. The magnitude and frequency of fuel system pressures, including both positive and negative pressures
and surge pressures that the various sections of fuel lines will be subjected to in service.
b. The effect of component failures on fuel system pressures, and for failures that could be realistically
expected in service, the magnitude and frequency of those pressures.
c. A means with fail-safe features to prevent the build-up of an excessive pressure difference between the
inside and outside of the fuel tank.

1. System Description Documents (SDD) should define the maximum and minimum pressures expected
in the fuel system, and their frequency of occurrence. This should include pressures that could result from
failures that could be realistically expected in service.
2. Static strength analysis should demonstrate the ability for all fuel lines and fittings to withstand the
maximum and minimum expected pressures without leakage or permanent deformation.
3. Fatigue analysis should demonstrate the ability for all fuel lines and fittings to withstand the magnitude
and frequency of fuel system pressures without failure during the components expected lives.
4. Rig, ground and flight testing should demonstrate the accuracy of the defined fuel system pressures
(both magnitude and frequency), and the accuracy of static and fatigue analysis.
Information Sources
Information Sources
Comm'l Doc:
E.3.4.5.1.5, E.4.4.5.1.5, Reference: 00-970 P1 5.2.55
E.3.4.5.1.6, E.4.4.5.1.6, 00-970 P1 5.3.96
E.3.4.5.1.7, E.4.4.5.1.7,
00-970 P1 5.2.152
E.3.4.5.1.8, E.4.4.5.1.8,
E.3.4.5.6.1, E.4.4.5.6.1 STANAG 4671.963
Reference: 4671.965
4671.993
CS 23.993
CS 25.963
CS 25.965
CS 25.993
CS 27.963
CS 27.965
CS 27.993
CS 29.963
CS 29.965
CS 29.993
8.3.7 Fuel flow.

The fuel system shall provide a continuous flow of fuel at a rate and pressure established for proper
engine functioning throughout the aircraft's operating envelope.

a. Critical combinations of aircraft altitudes, attitudes, accelerations, fuel tank quantities, and fuel system
component failures;
b. Flow rates and pressures required at the engine interface.

1. System Interface Documents (SID) should define the fuel flow rates and pressures required at the
engine interface for the various aircraft flight conditions.
2. Analysis (e.g. Computational Fluid Dynamics (CFD)) should demonstrate that the fuel system provides
a continuous provision of fuel at flow-rates and pressures exceeding the requirements at the engine
interface for all required aircraft operating conditions.
3. Rig, ground and flight testing should demonstrate the accuracy of analysis for fuel system flow-rates
and pressures at the engine interface for the most critical aircraft operating conditions.
4. Technical Publications should clearly identify any aircraft operating conditions through which the
required fuel system flow-rate and pressure is not provided at the engine interface, and should identify
any resulting limitation (e.g. degradation of flight handling characteristics).
Information Sources
Comm'l Doc:
E.3.4.5.2.1, E.4.4.5.2.1, Reference: 00-970 P1 5.2.24
E.3.4.5.2.2, E.4.4.5.2.2, 00-970 P1 5.2.116
Information Sources
E.3.4.5.2.4, E.4.4.5.2.4, 00-970 P2 5.2.216
E.3.4.5.2.5, E.4.4.5.2.5 00-970 P7 L702 2.1
STANAG 4671.951(a)
Reference: 4671.955(a)
4671.959
23.953, 23.955, 23.959, Reference: CS 23.955
25.951, 25.953, 25.955, 25.959 CS 23.959
CS 25.943
CS 25.951
CS 25.955
CS 25.959
CS 27.951
CS 27.955
CS 27.959
CS 29.951
CS 29.955
CS 29.959
8.3.8 Fuel transfer rates.

The rate of fuel transfer from one aircraft fuel tank to another shall be sufficient to meet the operational
ground and flight envelope requirements, and shall not limit aircraft performance.
Consideration should be given to;

a. Ensuring compatibility between the fuel transfer subsystem and other fuel sub-systems (jettison,
engine feed system, AAR refuelling/dispensing systems, etc.);
b. Providing adequate redundancy, which may include an alternate/reversionary (back-up) transfer
system and/or gravity feed.

1. System Description Documents (SDD) should record the maximum expected flow-rates into and from a
fuel tank, including those through engine feed, jettison, AAR refuel and dispensing, ground refuel and
tank-to-tank fuel transfer. The SDD should also identify the expected and possible combinations of sub-
system operation, and should identify the protections in place to prevent fuel tank overflow and
inadvertent fuel tank emptying.
2. Analysis (e.g. Computational Fluid Dynamics (CFD)) should identify the expected fuel flow rates into
and from each tank via each of the fuel sub-systems.
3. Rig, ground and flight testing should demonstrate the accuracy of analysis for fuel sub-system flow
rates, and the correct operation of each means to prevent fuel tank overflow and inadvertent tank
emptying.
Information Sources
Comm'l Doc:
E.3.4.5.2.3, E.4.4.5.2.3, Reference: 00-970 P1 5.2.25
E.3.4.5.4, E.4.4.5.4, 00-970 P1 5.2.119
Information Sources
E.3.4.5.4.1, E.4.4.5.4.1 00-970 P7 L702 5.1
STANAG 4671.951
Reference: 4671.953
4671.955
23.952, 23.953, 23.955, Reference: CS 23.955
23.961, 25.951, 25.952, CS 23.961*
25.953, 25.955, 25.961
CS 25.951
CS 25.952
CS 25.955
CS 25.961*
CS 27.951
CS 27.955
CS 27.961
CS 29.951
CS 29.955
CS 29.961
8.3.9 Centre of gravity.

The fuel system shall be designed so that in both normal and failed operation, the aircraft CofG is
maintained within a range compatible with other systems and aircraft control & handling.

a. Release of stores, AAR (if applicable), fuel transfer and other lateral deviations of CG due to fuel
asymmetry in separate tanks, fuel dumping operations, wing sweep operations, catapult launches,
arrested landings, and engine feed;
b. The use of fuel measurement, control software and / or crew system manual control to maintain aircraft
CofG requirements for all mission phases;
c. The most critical combination of aircraft altitudes, attitudes and other conditions with respect to fuel
distribution on CofG.

1. The Aircraft Specification should specify the aircraft's permitted CofG envelope(s).
2. System Description Documents (SDD) should specify the fuel system's permitted CofG envelope(s).
Where different CofG envelopes exist (for example where weight restrictions or flight manoeuvre limits
are specified) the limits/restrictions associated with each envelope should be clearly specified.
3. Analysis should demonstrate that all permitted combinations of fuel distribution, cargo distribution
(including jettisonable cargo, and the result of its jettison), passengers, crew, and any other factor that
could appreciably affect the aircraft CofG, do not result in an aircraft CofG outside permitted limits.
4. Rig, ground and flight testing should demonstrate that any integrated provisions intended to prevent
aircraft loading outside of the permitted CofG envelope function satisfactorily.
5. Technical Publications should clearly identify any distribution or combination of distributions which
could result in an aircraft CofG exceeding permitted limits, and should identify any resulting limitation
(degradation of flight handling characteristics, prohibition of flight functions, etc.).
Information Sources
Comm'l Doc:
Information Sources
E.3.4.5.5, E.4.4.5.5 Reference: 00-970 P1 5.2.149
00-970 P13 3.5.79
STANAG 4671.23
Reference: 4671.29
CS 23.29
CS 23.1001*
CS 25.21
CS 25.23
CS 25.27
CS 25.29
CS 25.1001*
CS 27.21
CS 27.27
CS 27.29
CS 29.21
CS 29.27
CS 29.29
8.3.10 Over-pressure protection.

The fuel system shall be designed such that no aircraft operation (refuelling, de-fuelling, transfer, fuel
feed, fuel dump, engine feed etc.), can cause fuel pressures to exceed the system's proof pressure limits
(both minimum and maximum). See also section 8.3.6.

a. Providing means to prevent the exceedance of defined pressure limits, including both the exceedance
of pressure magnitude and frequency of occurrence (see also section 8.3.6 for criteria regarding the
definition of these limits).
b. Ensuring that fuel system components cannot cause excessive pressures under normal and failure
conditions.
c. Providing redundant and fail-safe design elements to ensure that any failure that does occur does not
result in a hazardous operating condition.

1. System Description Documents (SDD) should define the maximum and minimum pressures expected
in the fuel system, and their frequency of occurrence. This should include pressures that could result from
failures that could be realistically expected in service.
2. SDD should identify any over-pressure devices integrated in the design of the fuel system, the
conditions upon which these devices will operate and the result of the operation of these devices (if any).
3. Failure Modes and Effects Analysis (FMEA) should demonstrate that the effect, probability and overall
risk of failure of any over-pressure protection is acceptable.
Information Sources
Comm'l Doc:
Information Sources
E.3.4.5.1.7, E.4.4.5.1.7, Reference: 00-970 P1 5.2.55
E.3.4.5.1.8, E.4.4.5.1.8, 00-970 P1 5.2.185
E.3.4.5.8, E.4.4.5.8
00-970 P1 5.2.202
00-970 P1 5.2.203
00-970 P13 3.5.79
STANAG 4671.955
Reference: 4671.963
4671.979
FAA Doc: 14CFR references: 23.963, EASA CS CS 23.963*
23.979, 25.963, 25.979 Reference: CS 23.979
CS 25.963
CS 25.979
CS 27.955
CS 27.965
CS 29.955
CS 29.965

limitations, restrictions, servicing, and maintenance information and other information necessary for safe
operation of the fuel system.

1. The level of detail necessary to provide accurate technical information while remaining concise;
2. The information, at the appropriate level of detail, required to allow personnel to operate and maintain

information.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: 3.2.6, 4.2.6; Def-Stan 00-970 00-970 P1 5.2.11
Appendix E, E.3.4.5.6.8, Reference: 00-970 P1 7.3.3
E.4.4.5.6.8 00-970 P1 7.4.28
00-970 P1 7.4.31
Information Sources
STANAG 4671.1581
4671.1585
FAA Doc: EASA CS CS 23.973*
CS 23.1583
CS 23.1587
CS 25.973*
CS 25.1581
CS 25.1583
CS 25.1587
CS 27.973*
CS 27.1581
CS 27.1583
CS 27.1587
CS 29.973*
CS 29.1581
CS 29.1583
CS 29.1587
8.3.12 Contamination.
The fuel system design and procedures shall be sufficient for controlling and purging impurities from the
fuel system, in order to maintain contamination at acceptable levels, at all times. Fuel system components
shall function reliably in the presence of contaminants, up to a specified level of contamination.

a. Ensuring that the fuel system is adequately protected from blockages.
b. Ensuring that the engine feed system incorporates appropriate filtration to ensure that contamination of
fuel provided at the engine interface remains within acceptable limits.
c. Providing means to remove contamination (particles, water, fungal growth, etc.) from the fuel system
and its filters.
d. Defining maintenance procedures to identify and control the contamination within the aircraft fuel tanks.

1. System Description Documents (SDD) should identify the design features of the fuel system intended
to prevent blockage in the fuel system lines and fittings, minimise the level of contamination of fuel
provided to the engines, and allow maintenance personnel to monitor and remove contamination from the
fuel tanks.
2. System Interface Documents (SID) should define maximum allowed levels of contamination of fuel
provided by the fuel system to the engines.
3. Technical Publications should define maintenance procedures for minimising and managing fuel tank
and fuel system contamination.
Information Sources
Comm'l Doc:
E.3.4.5.6.2, E.4.4.5.6.2, Reference: 00-970 P1 5.2.115
Information Sources
E.3.4.5.6.3, E.4.4.5.6.3, 00-970 P7 L702 25.2
E.3.4.5.1.3, E.4.4.5.1.3
MIL-F-8615
STANAG 4671.951(c)
Reference: 4671.971
4671.977
4671.997
FAA Doc: 14CFR references: 23.971, EASA CS CS 23.951(c)
23.973, 23.977, 23.997, Reference: CS 23.971
25.971, 25.973, 25.977, 25.997 CS 23.973
AC 20-119
CS 23.977
CS 23.997
CS 25.951(c)
CS 25.971
CS 25.973
CS 25.977
CS 25.997
CS 25.1455
CS 27.951(c)
CS 27.971
CS 27.973
CS 27.977
CS 27.997
CS 29.951(c)
CS 29.971
CS 29.973
CS 29.977
CS 29.997
8.3.13 Electrical and electromagnetic effects.

The fuel system shall be designed and arranged to prevent ignition / explosion as a result of: lightning
strike (either directly, or indirectly as result of component failure (e.g. overvoltage) following a lightning
strike); electrostatic discharge; fuel leaks, and the introduction of electrical power into fuel tanks. All fuel
subsystem components located in an explosive atmosphere shall be capable of operating without
initiating an explosion, including under electrical fault conditions.

a. Electrical bonding of fuel system / subsystem tubing and components to eliminate static charge
accumulation, provide controlled current return paths, and provide lightning protection;
b. Minimising electro-static build-up within fuel lines and within the fuel tank;
c. Preventing electrical arcing;
d. Isolating electrical equipment from the fuel to minimise the possibility of fuel leakage and fuel vapour
coming into contact with electrical equipment.
e. Ensuring all components inside of a fuel tank have energy levels low enough to prevent an ignition
source and prevent introduction of an ignition source through the wiring or components;
f. Preventing ignition of fuel and fuel vapour (risk mitigation, e.g. Inerting).
1. System Description Documents should identify the aspects of fuel system design provided to reduce
the risk due to electromagnetic effects.
2. Functional Hazard Analyses (FHA) should identify the risk of ignition/explosion due to lightning strikes,
electrical faults and other electro-magnetic effects.
Information Sources
Comm'l Doc:
E.3.4.5.1.9, E.4.4.5.1.9, Reference: 00-970 P7 L702 4.1
E.3.4.5.1.11, E.4.4.5.1.11, STANAG
E.3.4.5.7, E.4.4.5.7, 4671.863
E.3.4.5.8.12, E.4.4.5.8.12 Reference: 4671.867
4671.954
4671.975
4671.967(b)
23.954, 23.971, 23.975, Reference: CS 23.954
25.863, 25.954, 25.971, CS 23.975
25.975, 25.981
CS 25.863
AC 20-53A, AC 25.981-2, AC
CS 25.954
25.981-1B, AC 25-16
CS 25.975
CS 25.981
CS 27.863
CS 27.954
CS 27.975
CS 29.863
CS 29.954
CS 29.975
8.3.13.1 Merged with 8.3.13

8.3.13.2 Secondary barriers.
Secondary fuel and vapour tight barriers shall be provided between fuel tanks, fire hazard areas, and
inhabited areas, in order to isolate and remove flammable vapours to a safe location in the event of
primary barrier (tank wall) failure and minimise the probability of ignition and the resultant hazard if
ignition does occur. A means to determine whether the primary barrier has failed shall be provided.

a. Protection between the fuel tank and areas where there is a high probability that fuel leakage can be
ignited, including the following compartments: personnel, cargo, gun, engine compartments or any
compartment which contains an ignition source;
b. Adequate fault isolation provisions to detect a failure of the primary fuel barrier;
c. Ensuring an adequate cavity between the firewall and the fuel tank;
d. Sufficient draining and ventilation provisions in all areas surrounding fuel tanks to remove the fire
hazard due to fuel spillage or leakage;
e. The potential for secondary barriers to interfere with fuel bay venting.

1. System Description Documents (SDD) should clearly identify the primary barrier and secondary barrier
provided between each fuel tank and adjacent hazardous area.
2. SDD should identify the means provided for failure detection of the primary barrier.
3. Failure Modes and Effects Analysis (FMEA) should define the residual risk of ignition/explosion taking
into account the failure probability of the primary and secondary barriers and the probability of undetected
failure of the primary barrier.
4. Technical Publications should identify the maintenance procedures for detecting the failure of the
primary barrier.
Information Sources
Comm'l Doc:
E.3.4.5.6.11, E.4.4.5.6.11 Reference: 00-970 P1 5.2.47
00-970 P1 5.2.49
00-970 P1 5.2.52
STANAG 4671.863
Reference: 4671.967
23.967, 23.1185, 25.863, Reference: CS 23.967
25.967, 25.1185, 25.981 CS 25.863
AC 25-981-2, AC 25-981-1B
CS 25.967
CS 25.981
CS 25.1185
CS 27.863
CS 27.967
CS 29.863
CS 29.967
CS 27.1185
8.3.13.3 Drainage.
Fuel system drainage provisions shall permit safe drainage of the entire fuel system on the ground; such
that all areas surrounding fuel tanks or containing fuel system components are properly drained; and all
normal and accidental fuel leakage is removed to a safe location outside of the aircraft.
Refer also to 8.3.13.2 regarding in-flight draining of leakage, and 8.3.13.4 regarding jettison..

a. Ensuring fuel is discharged clear of all parts of the aircraft;
b. Ensuring the drain valve has manual or automatic means for positive locking in the closed position;
c. Ensuring the drain valve(s) is readily accessible and can be easily opened and closed, for example for
fuel system contamination checks;
d. Locating or protecting the drain valve to prevent fuel spillage in the event of a landing with landing gear
retracted.

1. System Description Documents (SDD) should identify the location of drain points both inside of the fuel
tank, and on the aircraft's external skin.
2. Analysis should identify the quantity of fuel remaining in each tank when drained down to the point of
the lowest drain, in all aircraft attitudes that could reasonably be expected to occur when the aircraft is on
the ground with fuel tanks drained.
3. Ground testing should demonstrate the accuracy of analysis, determining the quantity of fuel remaining
in each tank when drained down to the point of the lowest drain in the most critical (resulting in the
highest undrainable fuel quantity) aircraft attitude for each tank.
4. Ground testing should demonstrate that, when operated correctly, the drain valves discharges drained
fuel clear of all parts of the aircraft.
4. Technical Publications should identify the maintenance procedures for operation of fuel tank drains,
including subsequent closure of the drains.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix E: Def-Stan 00-970 00-970 P1 5.2.79-5.2.81
E.3.4.5.6.2, E.4.4.5.6.2, Reference: 00-970 P1 5.2.87
E.3.4.5.1.10, E.4.4.5.1.10 00-970 P1 5.2.89
00-970 P1 6.11.20
STANAG 4671.967
Reference: 4671.977
4671.997
4671.999
23,997, 23.999, 25.977, Reference: CS 23.997
25.997, 25.999 CS 23.999
CS 25.977
CS 25.997
CS 25.999
CS 27.977
CS 27.997
CS 27.999
CS 29.977
CS 29.997
CS 29.999
8.3.13.4 Safe fuel release.

The fuel system jettison discharge points, vents and any components outside of the fuel tanks shall be
located such that fuel (jettisoned, vented, leaked, or otherwise) cannot be ingested by the engines, flow
into hazardous ignition areas, flow onto the environmental management system or become reingested
into the aircraft.

a. Avoiding potential ignition sources, including hot brakes, bleed air ducts, engine, APU, etc.

1. System Description Documents (SDD) should identify the points through which fuel is jettisoned, or
may otherwise be released from the aircraft (e.g. due to an open drain, failed vent system or through
general leakage).
2. Functional Hazard Analysis should identify the risk due to released fuel coming into contact with any
part of the aircraft.
Information Sources
Comm'l Doc:
E.3.4.5.2.6, E.4.4.5.2.6 Reference: 00-970 P1 5.2.88
00-970 P1 5.2.127-5.2.129
00-970 P7 L702 27.8
STANAG 4671.999
Reference: 4671.1001(c)
23.999, 23.1001, 25.971, Reference: CS 23.999
25.999, 25.1001 CS 23.1001*
CS 25.971*
CS 25.999
CS 25.1001
CS 27.999
CS 29.999
CS 29.1001
8.3.14 Fuel tank strength.

Each fuel tank shall be able to withstand, without failure, the vibration, inertia, fluid and structural loads
that it may be subjected to in operation, including those required for crashworthiness. See also section
8.3.5.

a. All sources of loads on the aircraft fuel tanks, and possible combination of load types.
b. Requirements for crashworthiness.
c. The strength of surrounding structure.

1. System Description Documents (SDD) should identify the load cases that the fuel tanks are expected
to withstand in service, including where appropriate, combinations of load types.
2. Static and Dynamic analysis (e.g. Finite Element Analysis) should demonstrate that all fuel tanks can
withstand the loads expected in service without permanent deformation or failure.
3. Rig, ground and flight testing should demonstrate the accuracy of performed analysis, determining the
structural integrity of the fuel tanks under critical loading conditions.
Information Sources
Comm'l Doc:
E.3.4.5.6, E.4.4.5.6, Reference: 00-970 P1 5.2.150
E.3.4.5.6.13, E.4.4.5.6.13 00-970 P1 5.2.152
00-970 P7 L702 11.2
STANAG 4671.963(a)
Reference: 4671.965
4671.993
Information Sources
23.965, 23.993, 25.963, Reference: CS 23.965
25.965, 25.993 CS 23.993
AC 25.963-1
CS 25.963
CS 25.965
CS 25.993
CS 27.952
CS 27.963
CS 27.965
CS 27.993
CS 29.952
CS 29.963
CS 29.965
CS 29.993
8.3.15 Tank pressure.

The fuel tanks shall be designed to withstand the maximum pressure that could occur with any single
failure within the fuel system without permanent deformation or failure.

a. All possible tank differential pressures, including high internal tank pressure (due to refuelling, fuel
transfer, AAR refuelling receipt, etc.) and low external tank pressure (e.g. due to operation at high
altitude), low internal tank pressure (due to defuel, fuel transfer, AAR refuelling dispense, etc.) and high
external tank pressure (e.g. due to operation at low altitude), and where appropriate, differences in
pressure between adjacent fuel tanks. These considered pressures should take account of hydrostatic
pressure, including where appropriate those during accelerated flight conditions.
b. Failure of any component that could result in a change of tank pressure, and the effect of failure on
tank differential pressures. Such components will depend on the fuel system architecture but are likely to
include refuel valves, high-level sensors, vent lines and fuel pumps, and may also include power
distribution or system management components.

1. System Description Documents (SDD) should define the fuel tank maximum differential pressures, the
load cases that are expected to result in high differential tank pressures, and the failures that may lead to
large changes in differential tank pressures or exceedance of tank pressure limits.
2. System Safety Assessments (SSA) should identify single component failures that could affect tank
differential pressures, including single failures that could result in the effective failure of multiple
components (e.g. power distribution or system management components).
3. Analysis (e.g. Computational Fluid Dynamics) should identify the effect of each component failure, and
where one single failure can result in the effective failure of multiple components, the effect of each
multiple component failure case on the fuel tank differential pressures.
4. Rig, ground and flight testing should demonstrate the accuracy of performed analysis, demonstrating
that critical component failure cases do not result in excessive tank differential pressures.
Information Sources
Comm'l Doc:
Information Sources
and Appendix E: E.3.4.5.1.7, Reference: 00-970 P1 5.2.40
E.4.4.5.1.7, E.3.4.5.1.8, 00-970 P7 L702 13.1-L702
E.4.4.5.1.8, E.3.4.5.1.12,
13.2
E.4.4.5.1.12
STANAG 4671.965(a)
Reference:
23.963, 23.965, 25.957, Reference: CS 23.965
25.963, 25.965 CS 23.1309
AC 25.963-1
CS 25.963
CS 25.965
CS 25.1309
CS 27.965
CS 27.1309
CS 29.965
CS 29.1309
8.3.16 Refuelling/defueling.
The aircraft shall be capable of being safely refuelled and defueled.

a. Refuel pressures and flow-rates up to the maximum permitted limits.
b. Requirements for refuelling with crew and/or passengers on board the aircraft, and with engine(s)
and/or APU(s) running.
c. Provision of standardised gravity and/or pressure refuelling interface(s).
d. Provision of refuel control systems, including manual and/or automatic refuel shut-off valves
sequencing of filling tanks and isolation of tanks.
e. Procedures for ground crew to follow to support the effective and safe refuel of the aircraft.
f. Adequate prevention of leakage and spillage of fuel.

1. System Description Documents (SDD) should define the provisions made for refuelling and defueling
the aircraft and the allowable refuelling and defuelling pressure limits.
2. Functional Hazard Analysis (FHA) should identify the hazards associated with refuelling and defueling
the aircraft.
3. Technical Publications should identify the operating procedures regarding the safe refuel and defuel of
the aircraft, including information regarding the refuelling/defueling of the aircraft with crew and/or
passengers on board, and with engine(s) and/or APU(s) running.
Information Sources
Comm'l Doc:
E.3.4.5.1.12, E.4.4.5.1.12, Reference: 00-970 P1 5.2.169
E.3.4.5.8.1, E.4.4.5.8.1, 00-970 P1 5.2.175
E.3.4.5.8.4, E.4.4.5.8.4,
00-970 P1 5.2.176
E.3.4.5.8.5, E.4.4.5.8.5,
E.3.4.5.8.6, E.4.4.5.8.6, 00-970 P1 5.2.178
E.3.4.5.8.7, E.4.4.5.8.7, 00-970 P1 5.2.187
E.3.4.5.8.8, E.4.4.5.8.8 00-970 P1 5.2.188
Information Sources
00-970 P1 5.2.213
00-970 P1 5.2.214
00-970 P7 L701/3 2.2
STANAG 4671.23.863
Reference: 4671.23.973
4671.23.975
4671.23.977
4671.23.979
23.973, 23.975, 23.979, Reference: CS 23.973*
25.863, 25.973, 25.975, 25.979 CS 23.975*
CS 23.977*
CS 23.979
CS 25.863*
CS 25.973*
CS 25.975*
CS 25.977*
CS 25.979
CS 27.863*
CS 27.973*
CS 27.975*
CS 27.977*
CS 29.863*
CS 29.973*
CS 29.975*
CS 29.977*
CS 29.979
8.3.17 Spill prevention.

The fuel system shall be designed to prevent fuel spills during refuelling/defueling operations and during
subsequent normal manoeuvres on the ground and in flight.

a. Providing automatic shut-off means to prevent the quantity of fuel in each tank from exceeding the
maximum quantity for that tank;
b. Providing means for over-flow detection, to automatically shut-off refuel in the event of an overflow, or
alert refuelling ground crew;
c. Providing indication to inform ground crew when fuel tank(s) are full;
d. Providing ground and flight crew operating procedures to prevent the spillage of fuel following refuel.

1. System Description Documents (SDD) should detail the means provided to prevent the quantity of fuel
in each tank from exceeding its maximum allowed quantity.
2. SDD should detail the means provided for detection of refuel over-flow and subsequent automatic shut-
off and/or alerting of ground crew.
3. SDD should detail the means provided for informing ground crew that fuel tanks are full.
4. Technical Publications should define procedures for refuelling/defueling of aircraft, including prevention
of spills.
5. Technical Publications should define operating procedures to prevent the spillage of fuel during and
following refuel.
Information Sources
Comm'l Doc:
E.3.4.5.1.12, E.4.4.5.1.12, Reference: 00-970 P1 5.2.179
E.3.4.5.6.1, E.4.4.5.6.1,
E.3.4.5.8.1, E.4.4.5.8.1,
E.3.4.5.8.11, E.4.4.5.8.11, STANAG 4671.973
E.3.4.5.8.14, E.4.4.5.8.14, Reference:
E.3.4.5.9, E.4.4.5.9
23.975, 25.969, 25.975 Reference: CS 23.973
CS 23.975*
CS 23.979
CS 25.969*
CS 25.973
CS 25.975*
CS 25.979
CS 27.969*
CS 27.973
CS 27.975
CS 29.969*
CS 29.973
CS 29.975*
CS 29.979

Adequate controls and displays shall be available to notify the flight crew of the fuel systems and its
necessary functions to warn for hazardous conditions.

b. All required fuel system functions and tracked parameters (e.g. fuel pressure, fuel temperature, fuel
quantity, CofG monitoring, pump status, fuel unbalance, low level fuel, etc.);
c. The location of the temperature sensors should be carefully considered so that a true fuel temperature
will be indicated;
d. The position of the fuel quantity indicators to ensure accurate data readings;
e. Ensuring all displays and controls meet the specified requirements (arrangement, location, type, size,
guards etc.).

2. Rig, ground and flight testing should demonstrate that controls perform their intended function(s) and
that displays provide accurate and useful information to the crew.
Information Sources
Comm'l Doc:
E.3.4.5.1.12, E.4.4.5.1.12, Reference: 00-970 P1 5.2.110
E.3.4.5.8.11, E.4.4.5.8.11, 00-970 P1 5.2.115
E.3.4.5.12, E.4.4.5.12,
00-970 P1 5.2.121
E.3.4.5.12.1, E.4.4.5.12.1,
E.3.4.5.12.2, E.4.4.5.12.2, 00-970 P1 5.2.133
E.3.4.5.12.3, E.4.4.5.12.3, 00-970 P1 5.2.138
E.3.4.5.12.4, E.4.4.5.12.4, 00-970 P1 5.2.139
E.3.4.5.12.5, E.4.4.5.12.5
00-970 P1 5.2.143
00-970 P1 5.2.144
00-970 P1 5.2.146
00-970 P1 5.2.147
00-970 P1 5.2.148
00-970 P7 L702 29.1
STANAG 4671.1725
4671.1729
CS 23.979
CS 23.991
CS 23.1141
CS 23.1305
CS 23.1311
CS 23.1553
CS 25.979
CS 25.1141
CS 25.1161
CS 25.1305
CS 25.1553
CS 27.1141
CS 27.1305
CS 27.1553
CS 29.979
CS 29.1141
CS 29.1305
CS 29.1553
8.3.19 Diagnostics.
The fuel system shall include the necessary built-in-test (BIT), fault detection and isolation provisions, in
order to identify critical failures to the operators and maintainers.

a. Providing power-on BIT (which performs a diagnostic process on power-on of a given
component/system), on-demand BIT (which performs a diagnostic process when operated by an
operator), and/or continuous BIT (which performs continuous diagnostic processes).
b. Providing means for manual and/or automatic fault isolation, and operation of back-up systems, taking
consideration of the benefit of minimising pilot work-load while ensuring that the pilot remains informed of
the aircraft's flightworthiness and mission-worthiness.

1. System Description Documents (SDD) should detail the provisions for BIT.
2. Technical Publications should detail the procedures for operating BIT equipment (if any), the
procedures for managing information provided by BIT, and for managing the fuel system during flight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: 3.2.9, 4.2.9 and Def-Stan 00-970 00-970 P1 5.2.120
Appendix E: E.3.4.5.8.11, Reference: 00-970 P1 5.2.154
E.4.4.5.8.11, E.3.4.5.12.5, STANAG
E.4.4.5.12.5 4671.965
Reference: 4671.979
CS 25.965
CS 25.979
CS 27.965
CS 29.965
CS 29.979
8.3.19 Fuel jettison (dump) outlets shall be located such that jettisoned fuel does not impinge on aircraft
surfaces or become re-ingested into the aircraft. Fuel jettison operations shall be safe and shall not
adversely affect the controllability of the aircraft.

a. Safe location of the fuel jettison in relation to potential ignition sources (hot brakes, bleed air ducts,
engine, APU, etc.);
b. The implications of the fuel dump system failures.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 5.2.217
STANAG 4671.1001
Reference:
CS 29.1001
8.3.20 Merged with 8.3.14.
8.4. FIRE AND HAZARD PROTECTION.
8.4.1 Integration.
The fire protection system shall not introduce additional hazards. In addition, risks associated with
existing hazards shall not be increased by integration of the fire protection system.

a. Ensuring that the fire protection system components and elements can withstand the hazards they are
designed to control and mitigate;
b. Protection in this context encompasses both detection and extinguishing.

1. System Description Documents (SDD) should detail the general architecture and design of the fire
protection system, and should identify the specific hazards that the system is designed to control and
mitigate, and where applicable identify any key hazards that the system is not designed to control or
mitigate.
2. System Safety Analysis (SSA) should assess the overall safety of the system and should identify and
assess the hazards caused by the fire protection system, and the effect of the system on the aircraft's
existing hazards.
3. Declarations of Design and Performance (DDP) should identify the physical and functional
requirements of each item of equipment of the system, and should declare conformance with each
requirement.
4. Rig, ground and flight testing should confirm the correct and safe integration of the fire protection
system.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix G: Def-Stan 00-970 00-970 P1 4.26.1
G.3.4.7, G.4.4.7, G.3.4.7.1, Reference: 00-970 P1 4.26.2
G.4.4.7.1, G.3.4.7.2, G.4.4.7.2, 00-970 P1 4.26.9
G.3.4.7.29, G.4.4.7.29
00-970 P1 4.26.24
MIL-HDBK-221: 2.7, 2.12,
00-970 P1 4.26.25-4.26.30
2.13, 2.16, 2.17
00-970 P1 4.26.55
00-970 P1 4.26.60
00-970 P1 4.26.62
00-970 P13 Clause 1.12.1-
1.12.4
00-970 P13 1.6.12.1 to1.6.12.4
and 1.6.12.5
STANAG 4671.850
4671.1309
23.865, 25.851-25.869, Reference: CS 23.855
23.1181-23.1203, 25.1181- CS 23.859
25.1207, 23.1411, 25.1411
CS 23.1203
Information Sources
CS 23.1309
CS 23.1359
CS 25.851
CS 25.854
CS 25.858
CS 25.859
CS 25.867
CS 25.1203
CS 25.1207
CS 25.1309
CS 25.1705
CS 25.1713
CS 27.859
CS 27.1195
CS 27.1309
CS 29.851
CS 29.859
CS 29.1195
CS 29.1203
CS 29.1309
8.4.1.1 Failure modes and effects.

All single-point failure conditions of the fire and hazard protection system shall be identified and the
consequences of their failure shall be acceptable, eliminated or mitigated.

a. Defining and demonstrating compliance with an acceptable failure rate for each component, sub-
system and system.
b. The effect of single-point failures on other elements of the system, and possible further failures and
other effects.

1. Failure Modes and Effects Analysis (FMEA) should identify all single-point failures within the fire and
hazard protection system and should identify controls and mitigations to ensure that consequences of
their failure are acceptable.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1309
Reference:
CS 25.1309
CS 27.1309
CS 29.1309
Information Sources
8.4.1.2 Qualification tests.

All components shall undergo an appropriate Qualification Test Programme (QTP) to demonstrate their
suitability to perform their intended function.

a. System Validation and Verification (V&V), i.e. the definition of requirements at all levels (system, sub-
system, assembly and component) such that the overall requirements for the system are met (Validation)
and the demonstration of compliance against the defined requirements at all levels (Verification).
b. The range of design and performance requirements that may apply to a given system, sub-system,
assembly and component, which may include requirements for proof and/or burst pressure, vibration,
containment, over-speed, acceleration, explosive atmosphere, pressure cycling, and temperature cycling.
c. Demonstrating compliance against appropriate established standards (e.g. ISO 14186:2013 Air cargo -
- Fire containment covers -- Design, performance and testing requirements)

1. System Description Documents (SDD) should define Qualification Requirements (QR), including
requirements for component performance, which may include requirements for proof and/or burst
pressure, vibration, containment, over-speed, acceleration, explosive atmosphere, pressure cycling, and
temperature cycling.
2. Qualification Programme(s) (QP) should specify the testing to be completed for each component,
assembly, sub-system or system as appropriate and the requirement(s) that each test will demonstrate
compliance against.
3. Qualification Test Procedures (QTP) should define at an appropriate level of detail the procedures to
be followed for qualification testing of each component, assembly, sub-system or system as appropriate.
4. Qualification Test Reports (QTR) should record the completion of qualification testing in accordance
with QTPs and acceptable demonstration of compliance against each QR.
5. Declarations of Design and Performance (DDP) should identify the physical and functional
requirements of each equipment of the system, and should declare conformance with each requirement.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.26.55
00-970 P1 4.26.56
00-970 P1 4.26.61
00-970 P1 4.26.62
STANAG 4671.1203
4671.1359
CS 23.1203
CS 23.1309
CS 23.1359
Information Sources
CS 25.857
CS 25.858
CS 25.1203
CS 25.1309
CS 25.1705
CS 25.1713
CS 27.859
CS 27.1195
CS 27.1309
CS 29.855
CS 29.1199
CS 29.1203
CS 29.1309
CS 29.1359
8.4.1.3 Operator interface.

Adequate crew-station information shall be available to notify the flight crew of the status if the fire and
hazard protection system and any warnings related to detection of fire or smoke.

b. Where more than one zone or area is monitored, provision of indication to crew of detection location;

2. Demonstrating the controls and display show the status of the fire and hazard protection system and
the warnings and cautions related to the aircraft hazards
3. Technical Publications (e.g. Aircraft Flight Manual) should adequately describe the information made
available to the crew regarding the status of the fire and hazard protection system and should provide
detailed procedures for crew to follow upon the display of warnings and cautions related to the aircraft
hazards against which the system is designed to provide hazards control and/or mitigation.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.26.24
00-970 P1 4.26.60
00-970 P1 4.26.61
00-970 P1 4.26.62
STANAG 4671.1203
Information Sources
CS 23.1305
CS 25.854
CS 25.857
CS 25.858
CS 25.1203
CS 25.1305
CS 27.1195
CS 29.855
CS 29.1203
CS 29.1305
8.4.2 Hazard protection zones.

Each compartment of the aircraft shall be zoned according to the fire and explosion hazards present
within that compartment. Each hazard shall be controlled and mitigated such that no fire or explosion
hazard has unacceptable risk under normal operating conditions.

a. Identifying the different zones of the aircraft, the compartments which make up each zone, and the
adequacy of partitions between zones.
b. Identifying an acceptable level of risk for the hazards of each zone.
c. Analysing the hazards associated with each zone, including the fire and explosion protection such that
hazards are controlled and mitigated to an acceptable level.

1. System Description Documents (SDD) should define each hazard protection zone, their compartments,
and the acceptable level of risk for each zone.
2. System Safety Assessment (SSA) should analyse the hazards associated with each zone and
demonstrate that the hazard controls and mitigations support an acceptable level of risk.
Information Sources
G.3.4.7, G.4.4.7 Reference: 00-970 P1 4.26.5
MIL-HDBK-221: 2.11 00-970 P1 4.26.6
00-970 P1 4.26.10
00-970 P1 4.26.11
00-970 P1 4.26.22
00-970 P1 4.26.41
00-970 P7 L712 2.1
STANAG 4671.865
4671.1203
4671.1309
4671.1359
23.865, 25.851-25.869, Reference: CS 23.865
Information Sources
23.1181-23.1203, 25.1181- CS 23.903
25.1207, 23.1411, 25.1411 CS 23.1181-23.1182
CS 23.1203
CS 23.1309
CS 23.1359
CS 23.1451
CS 25.857
CS 25.859
CS 25.865
CS 25.869
CS 25.1181
CS 25.1187
CS 25.1203
CS 25.1207
CS 25.1309
CS 25.1713
CS 27.859
CS 27.1309
CS 27 Annex C
CS 29.859
CS 29.1181
CS 29.1187
CS 29.1203
CS 29.1309
CS 29.1359
8.4.2.1 Control station protection.

Each compartment of the Control Station (if applicable, i.e. for UAV, RPAS, etc.) shall be zoned according
to the fire and explosion hazards present within that compartment. Each hazard shall be controlled and
mitigated such that no fire or explosion hazard has unacceptable risk under normal operating conditions
or single failure conditions.

a. Identifying the different zones of the Control Station, the compartments which make up each zone, and
the adequacy of partitions between zones.
c. Analysing the hazards associated with each zone, including the fire and explosion protection such that
hazards are controlled and mitigated to an acceptable level.
d. Identifying single failures that could cause hazards or affect the risk of existing hazards.

1. System Description Documents (SDD) should define each hazard protection zone, their compartments,
and the acceptable level of risk for each zone.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P9 UK FW.U1701c
Reference: 00-970 P9 UK FW.U1701d
00-970 P9 UK RW.U1701c
00-970 P9 UK RW.U1701d
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.4.3 Hazard consideration in designs.
The fire and hazard protection system shall be designed in such a way that it mitigates the hazards
identified in the System Safety Assessments of the aircraft’s systems into an acceptable level of risk.

a. Identifying fire hazards associated with each aircraft system and the acceptable level of risk for each
hazard.
c. The effect of the fire and hazard protection system on the hazards associated with each system and
the way these hazards are controlled and mitigated to an acceptable level.

1. System Description Documents (SDD) for the fire and hazard protection system should summarize the
hazards introduced by each individual system, and by the integration of the different systems into the
aircraft.
2. System Safety Assessment (SSA) should analyse the hazards associated with the fire and hazard
protection system and demonstrate that, at aircraft level, the level of risk is acceptable.
Information Sources
G.3.4.7.1, G.4.4.7.1 Reference: 00-970 P1 4.26.10
MIL-HDBK-221: 2.1, 2.2.1.2, 00-970 P1 4.26.11
2.2.1.4, 2.2.1.5, 2.2.1.6, 00-970 P1 4.26.37-4.26.40
2.2.1.7, 2.2.1.8, 2.2.2 through 00-970 P1 4.26.41
2.2.9, 2.5, 2.6, 2.7.3, 2.7.11, 00-970 P1 4.26.46-4.26.49
2.7.13, 2.10.2 though 2.10.8 00-970 P1 4.26.53
00-970 P1 4.26.66
00-970 P1 4.26.71-4.26.73
00-970 P1 4.26.82-4.26.83
STANAG 4671.613
Reference: 4671.850
4671.865
4671.903
4671.967
Information Sources
4671.994
4671.1061
4671.1103
4671.1121
4671.1141
4671.1163
4671.1181-4671.1193
4671.1307
4671.1309
4671.1351-4671.1367
FAA Doc: 14CFR references: 23.851- EASA CS CS 23.775, 23.859, 23.865,
23.865, 25.851-25.869, Reference: 23.903, 23.967, 23.994,
23.1181-23.1203, 25.1181- 23.1061, 23.1103, 23.1121-
25.1207, 23.1411, 25.1411 23.1125, 23.1163, 23.1181-
23.1193, 23.1309, 23.1351,
23.1359-23.1365, 23.1451
CS 25.857, 25.859, 25.865,
25.867, 25.869, 25.903,
25.963, 25.994, 25.1017,
25.1121, 25.1141, 25.1181-
25.1193, 25.1309, 25.1351,
25.1365, 25.1713-25.1731
CS 27.859, 27.861, 27.1121,
27.1183-27.1194, 27.1309,
27.1365
CS 29.803, 29.807, 29.859,
29.861, 29.903, 29.1023,
29.1091, 29.1121, 29.1183-
29.1194, 29.1309, 29.1351,
29.1359
8.4.3.1 Minimization of ignition risk.

In areas where flammable fluids or vapours may be present, the design shall minimise the probability of
ignition of the fluids and vapours and the consequences of such an ignition.

a. For each hazard associated with ignition risk:
i. Identifying potential causes (i.e. ignition threats);
ii. Identify potential consequences (e.g. fire, explosion, failure of other components/systems, etc.)
iii. Identify risk reduction means, i.e. control measures (which reduce the probability of a hazardous
event's occurrence) and recovery measures (which reduce the severity of the consequence of the
hazardous event's occurrence).
b. Incorporating control and recovery measures effectively, which may involve changes to the design of
the aircraft, or its operation or maintenance.

1. System Description Documents (SDD) should, for each system, define the fire hazards and acceptable
level of risk for each system.
2. System Safety Assessment (SSA) should, for each system, analyse associated hazards and
Information Sources
G.3.4.7.3, G.4.4.7.3, G.3.4.7.6, Reference: 00-970 P1 4.26.6
G.4.4.7.6 00-970 P1 4.26.14-4.26.18
00-970 P1 4.26.20
00-970 P1 4.26.32
00-970 P1 4.26.34
00-970 P1 4.26.63-4.26.69
00-970 P7 L712 2.4
STANAG 4671.863
Reference: 4671.967
4671.1061
4671.1091
4671.1103
4671.1121
4671.1163
4671.1183
4671.1307
4671.1309
4671.1337
4671.1361
4671.1367
FAA Doc: 14CFR references: 23.851- EASA CS CS 23 Clauses: 23.853,
23.865, 25.851-25.869, Reference: 23.859, 23.863, 23.967,
23.1181-23.1203, 25.1181- 23.1061, 23.1091, 23.1103,
25.1207, 23.1411, 25.1411 23.1121, 23.1163, 23.1183,
23.1309, 23.1337
CS 25 Clauses: 25.859,
25.863, 25.869, 25.952,
25.1091, 25.1121, 25.1163,
25.1183, 25.1185, 25.1187,
25.1309, 25.1337
27.863, 27.1091, 27.1121,
27.1183, 27.1185, 27.1187,
27.1309, 27.1337
29.863, 29.1091, 29.1103,
29.1121, 29.1125, 29.1163,
29.1183, 29.1185, 29.1187,
29.1309, 29.1337
8.4.3.2 Safety critical components.

Aircraft components that are critical for safe flight, which are susceptible and potentially exposed to heat
and fire, shall withstand fire and heat to a predetermined level.

a. Identifying an appropriate level for fire and heat exposure, including but not limited to: environmental
conditions expected in service; hazards within the zone(s) within which components are located (see
section 8.4.2); change in material properties due to changes in temperature (Young's modulus, yield
stress, etc.); effects due to thermal expansion and contraction; requirements for burn-through; and,
incorporation of safety margins.
b. Demonstrating the suitability of the components throughout and following exposure to heat and fire up
to the identified level.
c. Demonstrating that the risk of exceeding the identified level for fire and heat exposure is acceptable.

1. System Description Documents (SDD) should define the limits for fire and heat exposure associated
with each zone.
2. Analysis should demonstrate the suitability of components throughout and following exposure to heat
and fire up to the identified level.
3. Testing (usually coupon, equipment and rig testing) should demonstrate the accuracy of the performed
analysis for components whose failure would have a large effect on the safety of the aircraft, or where
there is a high risk of fire and heat exposure.
4. System Safety Assessment (SSA) should analyse the hazards associated with fire and heat exposure
and demonstrate that the hazard controls and mitigations support an acceptable level of risk.
Information Sources
G.3.4.7.6, G.4.4.7.6, Reference: 00-970 P1 4.26.14 - 4.26.16
G.3.4.7.21, G.4.4.7.21 00-970 P1 4.26.20
00-970 P1 4.26.34
00-970 P1 4.26.38 - 39
00-970 P1 4.26.46
00-970 P1 4.26.83
00-970 Pt 7 L712 2.5
STANAG 4671.850
Reference: 4671.863
4671.865
4671.1191
4671.1193
4671.1203
4671.1351
4671.1359
4671.1367
FAA Doc: 14CFR references: 23.851- EASA CS CS 23 Clauses: 23.863,
23.865, 25.851-25.869, Reference: 23.865, 23.1141, 23.1182,
23.1181-23.1203, 25.1181- 23.1191, 23.1193, 23.1201,
25.1207, 23.1411, 25.1411 23.1203, 23.1309, 23.1359
25.865, 25.869, 25.1141,
25.1182, 25.1189, 25.1191,
Information Sources
25.1193, 25.1201, 25.1203,
25.1207, 25.1309, 25.1713
27.863, 27.1191, 27.1193,
27.1194, 27.1309, 27.1365
29.863, 29.1191, 29.1193,
29.1194, 29.1309, 29.1359
8.4.4 Drainage and ventilation.

Where required to reduce the risk of fire and explosion hazards to acceptable levels, adequate drainage
and ventilation shall be provided.

a. The capacity of each drain or vent; ensuring that it is adequate to drain the expected quantities of fluid
and/or vapour;
b. The location of each drain or vent to maximise the performance of the drain/vent, minimise the risk of
blockage and remove fluid and vapours to a safe location which prevents the re-entering of fluids/vapours
into the aircraft on ground and in flight;
c. The prevention of transfer of fluids/vapours from one compartment to another via the drains/vents.
d. The prevention of connecting drains/vents carrying flammable fluids/vapours with those that do not
carry flammable fluids/vapours through manifolds.

1. System Description Documents (SDD) should identify drainage and ventilation provisions for each
compartment.
2. Analysis should demonstrate the suitability of drains and vents for the type and quantities of fluids
and/or vapours for which they are designed.
3. Rig, ground and flight testing should demonstrate the accuracy of the performed analysis and the
suitability of the drains and vents for removal of fluids and vapours to a safe location.
4. System Safety Assessment (SSA) should analyse the hazards associated with fire and explosion
incorporating drainage and ventilation into the assessment of risk.
Information Sources
G.3.4.7.3, G.4.4.7.3, G.3.4.7.4, Reference: 00-970 P1 4.26.19
G.4.4.7.4, G.3.4.7.5, G.4.4.7.5, 00-970 P1 4.26.20
G.3.4.7.18, G.4.4.7.18
00-970 P1 4.26.35
MIL-HDBK-221: 2.4
00-970 P1 4.26.36
00-970 P1 4.26.67
00-970 P1 4.26.68
00-970 P1 4.26.70
00-970 P1 4.26.73
00-970 P1 4.26.82
00-970 P1 6.11.20
00-970 P13 3.5.26
Information Sources
00-970 P13 1.4.4.14
STANAG 4671.903
Reference: 4671.967
4671.971
4671.975
4671.999
4671.1001
4671.1013
4671.1017
4671.1021
4671.1061
4671.1091
4671.1103
4671.1121
4671.1189
4671.1193
4671.1309
FAA Doc: 14CFR references: 23.851- EASA CS CS 23 Clauses: 859, 967, 971,
23.865, 25.851-25.869, Reference: 975, 999, 1001, 1013, 1017,
23.1181-23.1203, 25.1181- 1021, 1061, 1091, 1103, 1121,
25.1207, 23.1411, 25.1411 1189, 1193, 1309
CS 25 Clauses: 859, 967, 971,
973, 975, 869, 999, 1001,
1013, 1017, 1021, 1091, 1121,
1187, 1189, 1193, 1309
CS 27 Clauses: 859, 963, 973,
999, 1021, 1091, 1121, 1183,
1187, 1193, 1309
CS 29 Clauses: 859, 963, 973,
975, 999, 1013, 1017, 1021,
1091, 1103, 1121, 1187, 1189,
1193, 1309
8.4.4.1 Merged with 8.4.4.

8.4.5 Merged with 8.4.4.
8.4.6 Engine fire zone provisions.
Engine nacelle cooling and ventilation provisions shall be adequate to avoid hot surface ignition sources
and collection of flammable fluids or vapours.

a. Heat transfer from the engine to the nacelle and surrounding compartments, and heat transfer from the
nacelle and surrounding compartments to other areas of the aircraft and its surrounding environment. The
modes of heat transfer will likely include conduction (through the nacelle, through the surrounding aircraft
structure, etc.), radiation (e.g. from engine surfaces to compartment surfaces), and convection (including
the compartment ventilation).
b. Identifying acceptable limit temperatures for the surfaces and content of each compartment, taking into
account the flash points and auto-ignition temperatures of the fluids and vapours expected in each
compartment.

1. System Description Documents (SDD) should identify acceptable temperature limits for the surfaces
and content of each compartment.
2. Analysis should demonstrate adequate thermal management for the engine and surrounding
compartments.
3. Rig, ground and flight testing should demonstrate the accuracy of the performed analysis and the
performance of thermal management provisions.
4. System Safety Assessment (SSA) should analyse the hazards associated with fire and explosion
incorporating engine nacelle cooling and ventilation provisions into the assessment of risk.
Information Sources
G.3.4.7.4, G.4.4.7.4, Reference: 00-970 P1 4.26.20
G.3.4.7.18, G.4.4.7.18 00-970 P1 4.26.37
MIL-HDBK-221: 2.11.2.4,
00-970 P1 4.26.39
2.11.2.5
00-970 P1 4.26.40
STANAG 4671.1193
Reference:
23.865, 25.851-25.869, Reference: CS 23.1193
23.1181-23.1203, 25.1181- CS 25.1182
25.1207, 23.1411, 25.1411
CS 25.1187
CS 25.1193
CS 27.1187
CS 27.1193
CS 29.1187
CS 29.1193
8.4.7 Merged with 8.4.1.3 and 8.4.2.

8.4.8 Merged with 8.4.3.2.
8.4.9 Electrically powered fire protection.
Each electrically powered fire protection sub-system shall be provided with power at all times during
aircraft operation, including engine start and battery operations.

a. All functions of the fire protection system including fire detection, extinguishing, and explosion
suppression systems.
b. The duration for which the aircraft could be expected to operate without electrical power generation or
external power sources, and ensuring capacity to power the fire protection sub-systems for that duration.
1. System Description Documents (SDD) should define the electrical power source(s) which power the
fire suppression sub-systems, and the duration for which the aircraft is expected to operate without
electrical power generation or external power sources.
2. Analysis should demonstrate that the electrical power system is capable of providing adequate
electrical power to the fire protection sub-systems for the required duration, taking account of any other
electrical loads.
3. Rig, ground and flight testing should demonstrate the accuracy of the analysis performed, and should
demonstrate the function of the fire protection sub-systems using each source of electrical power.
Information Sources
Comm'l Doc:
G.3.4.7.10, G.4.4.7.10 Reference: 00-970 P1 6.6.8
MIL-HDBK-221: 2.12, 2.13 00-970 P1 6.6.88
00-970 P1 6.6.89
STANAG 4671.850
4671.1309
4671.1359
23.865, 25.851-25.869, Reference: CS 23.859
23.1181-23.1203, 25.1181- CS 23.1203
25.1207, 23.1411, 25.1411
CS 23.1309
CS 23.1359
CS 25.854
CS 25.858
CS 25.859
CS 25.869
CS 25.1203
CS 25.1309
CS 25.1310
CS 25.1362
CS 25.1705
CS 27.859
CS 27.1195
CS 27.1309
CS 29.859
CS 29.1195
CS 29.1203
CS 29.1309
CS 29.1359
8.4.10 Explosion suppression.

Where required to reduce the risk of explosion hazards to acceptable levels, adequate explosion
suppression shall be provided.

a. Passive explosion suppression, such as explosion suppressing foam.
b. Active explosion suppression, such as suppressant agent discharge systems.

c. Hazards associated with an explosion and the rapid dispersion of explosion suppression agents, and
the effect that dispersion would have on aircraft components and structure.
d. The overall level of risk associated with explosions and the effect of incorporation of explosion
suppression systems.

1. System Description Documents (SDD) should identify explosion suppression provisions for each
compartment that require such provisions.
2. Analysis should demonstrate the suitability of explosion suppression systems for the environments in
which they are located and the hazards that they are designed to mitigate.
3. Testing (typically lab or rig testing) should demonstrate the accuracy of the performed analysis and the
suitability of the explosion suppression systems for the environments in which they are located and the
hazards that they are designed to mitigate.
4. System Safety Assessment (SSA) should analyse the hazards associated with explosion, incorporating
the explosion suppression system into the assessment of risk.
Information Sources
G.3.4.7.8, G.4.4.7.8, G.3.4.7.9, Reference: 00-970 P1 4.26.73
G.4.4.7.9, G.3.4.7.26, 00-970 P7 L712
G.4.4.7.26, G.3.4.7.27,
G.4.4.7.27, G.3.4.7.28, STANAG
G.4.4.7.28 Reference:
MIL-HDBK-221: 2.17
23.865, 25.851-25.869, Reference:
23.1181-23.1203, 25.1181-
25.1207, 23.1411, 25.1411
8.4.11 False warnings.

The fire detection system shall be designed to preclude false warnings.

a. Providing redundancy to reduce the probability of a false warning due to system/component failure.
b. Incorporating active system monitoring (i.e. Built In Test Equipment (BITE)) to actively detect system
failures and mitigate their effect.
c. Ensuring that components are suitable for the environmental conditions that are expected in service.

1. System Description Documents (SDD) should identify the aspects of the fire detection system intended
to preclude false warnings.
2. System Safety Assessment (SSA) should demonstrate that system/component failure cannot result in
false warning.
Information Sources
Information Sources
G.3.4.7.9, G.4.4.7.9, Reference:
G.3.4.7.10, G.4.4.7.10, STANAG 4671.1203
G.3.4.7.11, G.4.4.7.11,
G.3.4.7.12, G.4.4.7.12,
G.3.4.7.13, G.4.4.7.13,
G.3.4.7.14, G.4.4.7.14,
G.3.4.7.15, G.4.4.7.15
23.865, 25.851-25.869, Reference: CS 23.1309
23.1181-23.1203, 25.1181- CS 25.858
25.1207, 23.1411, 25.1411
CS 25.863
CS 25.1203
CS 25.1309
CS 25.1731
CS 27.863
CS 27.1309
CS 29.863
CS 29.1203
CS 29.1309
8.4.12 Fire suppression.

Where required to reduce the risk of explosion hazards to acceptable levels, adequate fire suppression
shall be provided.

a. Active fire suppression systems (such as suppressant agent discharge systems) and/or passive fire
suppression systems (such as fire suppressing foam).
b. Performance requirements for the system(s), including (but not limited to) agent concentrations and
durations required to adequately suppress fire(s), the size of zone(s) for which suppression is required,
and the types of fire for which suppression is required.
c. The compatibility between the fire suppression agent and the aircraft, accounting for the type of zone(s)
for which suppression is required (engine bay, cargo bay, dry bay, fuel tank, etc.) and the effect that the
agent may have on aircraft components and structure..

1. System Description Documents (SDD) should identify fire suppression provisions for each
compartment.
2. Analysis should demonstrate the suitability of fire suppression systems for the environments in which
they are located and the hazards that they are designed to mitigate.
3. Testing (typically lab or rig testing) should demonstrate the accuracy of the performed analysis and the
suitability of the fire suppression systems for the environments in which they are located and the hazards
that they are designed to mitigate.
4. System Safety Assessment (SSA) should analyse the hazards associated with fire, incorporating the
fire suppression system into the assessment of risk.
Information Sources
Comm'l Doc:
Information Sources
G.3.4.7.24, G.4.4.7.24, Reference: 00-970 P1 4.26.9
G.3.4.7.25, G.4.4.7.25, 00-970 P1 4.26.25 - 4.26.30
G.3.4.7.26, G.4.4.7.26
00-970 P1 4.26.62
MIL-HDBK-221: 2.12
00-970 P13 3.9.5
00-970 Pt 7 L712 3.13.1
STANAG 4671.863
4671.1817
23.865, 25.851-25.869, Reference: CS 23.1197
23.1181-23.1203, 25.1181- CS 23.1199
25.1207, 23.1411, 25.1411
CS 23.1201
CS 23.1309
CS 25.851
CS 25.854
CS 25.857
CS 25.1195
CS 25.1197
CS 25.1199
CS 25.1201
CS 25.1207
CS 25.1309
CS 27.859
CS 27.1309
CS 29.851
CS 29.1195
CS 29.1197
CS 29.1199
CS 29.1201
CS 29.1309
8.4.13 Fire isolation.

Fireproof protective devices shall be provided to contain a fire within a defined fire zone.

a. The temperatures that protective devices would be required to withstand in the event of a fire, and the
required duration for withstanding these temperatures.
b. Requirements for fail-safe design, such that containment is achieved in the event of failure of the
protection device.

1. System Description Documents (SDD) should identify the fireproof protective devices incorporated in
the aircraft design to contain a fire within a fire zone.
demonstrate that the risk associated with fires in adjacent zones is acceptable.
Information Sources
Information Sources
G.3.4.7.20, G.4.4.7.20 Reference: 00-970 P1 4.26.13
MIL-HDBK-221: 2.7.8, 2.11 00-970 P1 4.26.16
00-970 P1 4.26.22
00-970 P1 4.26.23
00-970 P1 4.26.83
STANAG 4671.1103
4671.1193
23.865, 25.851-25.869, Reference: CS 23.1103
23.1181-23.1203, 25.1181- CS 23.1191
25.1207, 23.1411, 25.1411
CS 23.1192
CS 23.1193
CS 25.859
CS 25.1091
CS 25.1183
CS 25.1189
CS 25.1191
CS 25.1193
CS 25.1207
CS 27.859
CS 27.1191
CS 29.859
CS 29.1103
CS 29.1191
CS 29.1193
8.4.14 Fire resistance.

The finishes and materials of the aircraft sub-systems shall deter combustion. Any toxic by-products of
combustion of any aircraft material shall be at acceptable levels.

a. The flammability/combustibility of materials throughout the aircraft, particularly those located in fire
zones and occupied compartments.
b. The use of materials and finishes that are flame retardant and/or self-extinguishing.
c. The adequate ventilation of compartments and the potential build-up of toxic by-products.

1. System Description Documents (SDD) should define the materials and finishes used throughout the
aircraft and their appropriate fire resistance.
2. Analysis should demonstrate that toxic by-products cannot reach levels hazardous to health, taking
account of provisions for aircraft ventilation.
3. Testing (usually lab, coupon, equipment and rig testing) should demonstrate the adequate fire
resistance of materials and finishes used throughout the aircraft.
4. System Safety Assessment (SSA) should analyse the hazards associated with fire taking into account
the flammability/combustibility of materials and finishes.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix G: Def-Stan 00-970 00-970 P1 4.26.74 - 4.26.77
G.3.4.7.7, G.4.4.7.7, Reference: 00-970 P1 4.26.79 - 4.26.81
G.3.4.7.22, G.4.4.7.22 STANAG
MIL-HDBK-221: 2.7.9
Reference:
23.865, 25.851-25.869, Reference: CS 23.855
23.1181-23.1203, 25.1181- CS 25.831
25.1207, 23.1411, 25.1411
CS 25.853
AC 25.853-1, AC 25.869-1
CS 25.855
CS 25.856
CS 25.857
CS 25.859
CS 25.863
CS 25.869
CS 25.1713
CS 27.853
CS 27.855
CS 29.853
CS 29.855
8.4.15 Protection of inhabited and critical areas.

The fire and hazard protection system shall prevent hazardous quantities of smoke, flames, or
extinguishing agents from entering inhabited and critical areas, including the cockpit/flight deck,
passenger compartments, control station (for UAV, RPAS, etc.), or flight-critical sensor bays.

a. Identifying an acceptable level risk of smoke, flame or extinguishing agents, taking account of
physiological effects of the hazards on the aircraft's occupants, and any effects the hazards may have on
the aircraft's equipment, components and structure.
b. Minimising the risk of such hazards, ensuring that the risk is at least below the acceptable level.
c. Ensuring that any risk reduction measures (controls and/or mitigations) incorporated into the aircraft's
design, operation, or maintenance supports the intended reduction of risk.

1. System Description Documents (SDD) should identify the protection provided to prevent hazardous
quantities of smoke, flames, extinguishing agents, etc. in inhabited and critical areas.
2. Analysis should demonstrate that the protection provided to prevent hazardous quantities of smoke,
flames, extinguishing agents, etc. in inhabited and critical areas provides adequate protection.
3. Testing (usually coupon, lab, and rig testing) should demonstrate the accuracy of the performed
analysis and demonstrate that hazardous quantities of smoke, flames, extinguishing agents, etc. in
inhabited and critical areas is adequately prevented.
demonstrate that the risk associated with smoke, flames, extinguishing agents, etc. in inhabited and
critical areas is acceptable.
Information Sources
G.3.4.7.22, G.4.4.7.22 Reference: 00-970 P1 4.26.59
MIL-HDBK-221: 2.4.2, 2.19 00-970 P1 4.26.62
00-970 P1 1.4.6.6
00-970 P1 1.6.12.4
00-970 P1 1.6.12.5
STANAG 4671.775
Reference: 4671.850
4671.1191
4671.1703

23.865, 25.851-25.869, Reference: CS 23.851
23.1181-23.1203, 25.1181- CS 23.1197
25.1207, 23.1411, 25.1411
CS 25.831
AC 25-9
CS 25.851
CS 25.855
CS 25.857
CS 25.1197
CS 27.831
CS 29.831
CS 29.851
CS 29.855
CS 29.1197
8.4.16 Equipment separation.

Adequate separation shall be provided between equipment containing oxidisers, flammable fluid
systems, and electrical components.

a. The routeing and positioning of equipment containing oxidisers, flammable fluid systems and pipe-
work, and electrical system components and cables;
b. Preventing the placement of flammable fluid lines above potential ignition sources (such as electrical
components and cables) and equipment containing oxidisers to minimise the risk of combustion;
c. Incorporating hazard control design elements, such as double-walled pipes, drip fences/points (away
from ignition sources and oxidisers), shrouds and covers;
d. Providing adequate separation distances, taking account of deflection under all loading conditions on-
ground and in-flight.
1. System Description Documents (SDD) should identify compartments or zones of the aircraft where
oxidisers, flammable fluid systems, and electrical components/cables are each prohibited and allowed.
Where a compartment or zone may contain a combination of oxidisers, flammable fluid systems, and/or
electrical components/cable, SDD should identify the hazard control design elements which reduce the
risk of combustion hazards.
2. Analysis should demonstrate that the separation between oxidisers, flammable fluid systems, and
electrical components/cables is adequate.
3. Rig and ground testing should demonstrate the accuracy of performed analysis, and should
demonstrate that normal operation of flammable fluid systems does not cause unacceptable risk of
combustion.
4. Ground and flight testing should demonstrate that, under all expected loading conditions on-ground
and in-flight, deflections of components and structure does not cause unacceptable reduction of
separation distances.
demonstrate that combustion risk is acceptable.
Information Sources
G.3.4.7.16, G.4.4.7.16, Reference: 00-970 P1 4.26.42
G.3.4.7.17, G.4.4.7.17 00-970 P1 4.26.43
MIL-HDBK-221: 2.7.2, 2.7.10,
00-970 P1 4.26.44
2.10.4.2, 2.10.2.1
00-970 P1 4.26.45
00-970 P1 6.2.59
00-970 P1 6.6.3
00-970 P1 6.6.90
STANAG
Reference:
23.865, 25.851-25.869, Reference: CS 23.1361
23.1181-23.1203, 25.1181- CS 23.1365
25.1207, 23.1411, 25.1411
CS 23.1441
CS 23.1445
CS 23.1451
CS 25.863
CS 25.869
CS 25.1441
CS 25.1453
CS 25.1707
CS 27.863
CS 27.952
CS 27.1351
CS 29.863
CS 29.952
8.4.17 Fluid and electrical shut off.

Provisions shall be available to shut off flammable fluids and de-energise all electrical ignition sources in
the identified fire zone(s) for all mission phases including ground operations.

a. All flammable fluid and electrical system components within the identified fire zones, including pipe-
work and cables which run through the zones.
b. Providing means to shut-off sources of power (for electrical systems) and motive flow (for flammable
fluid systems), rather than only providing isolation of sub-systems, noting the benefits that this may have
in the case of leaks and short-circuits.

1. System Description Documents (SDD) should identify provisions for shut-off of electrical and
flammable fluid system sub-systems and sources of power.
2. Testing (usually lab and rig testing) should demonstrate that the provided shut-off means adequately
prevent ignition.
demonstrate that ignition risk is acceptable.
Information Sources
G.3.4.7.17, G.4.4.7.17, Reference: 00-970 P1 4.26.17
G.3.4.7.19, G.4.4.7.19 MIL- 00-970 P1 4.26.21
HDBK-221: 2.1.1.5, 2.2.6,
2.4.8, 2.11.1.4, 2.11.2.7 STANAG 4671.995
4671.1743
4671.1753
23.865, 25.851-25.869, Reference: CS 23.1142
23.1181-23.1203, 25.1181- CS 23.1145
25.1207, 23.1411, 25.1411
CS 23.1189
CS 25.859
CS 25.1145
CS 25.1185
CS 25.1189
CS 25.1727
CS 27.859
CS 27.1145
CS 27.1185
CS 27.1189
CS 29.859
CS 29.1142
CS 29.1145
CS 29.1185
CS 29.1189
8.4.18 Ground access.

Ground firefighting access provisions shall be compatible with standard ground firefighting systems and
shall adequately support effective fire suppression.

a. The quantity and location of ground access points;
b. The effectiveness of access points in terms of:
i. Accessibility by ground crew;
ii. Effectiveness of fire suppression through each access point.

1. System Description Documents (SDD) should identify provisions for ground firefighting access,
including (if necessary) the types of ground firefighting systems with which each point is compatible.
2. Analysis should demonstrate that the use of standard ground firefighting systems, through any given
ground access point, or combination of access points, is able to adequately suppress fire within an
acceptable amount of time, without introducing additional hazards to the aircraft, its occupants, or ground
firefighting personnel.
3. Testing (usually lab and rig testing) should demonstrate the accuracy of performed analysis, and
should demonstrate that provisions for ground firefighting access are appropriate.
4. System Safety Assessment (SSA) should analyse the hazards associated with ground firefighting and
demonstrate that the risk to the aircraft, its occupants and ground firefighting personnel is acceptable.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix G: Def-Stan 00-970 00-970 P1 4.26.25 to 4.26.30
G.3.4.7.7, G.4.4.7.7, Reference: 00-970 P1 4.26.86
G.3.4.7.13, G.4.4.7.13, 00-970 P1 4.26.87
G.3.4.7.31, G.4.4.7.31
MIL-HDBK-221: 2.11.2.10, STANAG
2.11.3.6 Reference:
FAA Doc: 14CFR references: 23.851- EASA CS CS 23.1181 - 23.1203

23.865, 25.851-25.869, Reference: CS 25.1181 - 25.1207
23.1181-23.1203, 25.1181- CS 27.1183 - 27.1203
25.1207, 23.1411, 25.1411
CS 27 Appendix C
AC 20-42C
CS 29.1181 - 29.1203
8.4.19 Post-crash protection.

Risk associated with post-crash fire and explosion hazards shall be acceptable. Where practicable, safety
features shall be provided to control and mitigate these hazards.

a. Fuel and other flammable fluids;
b. Hot surfaces;
c. Sources of ignition, including sparks from scraping along the ground.

1. System Description Documents (SDD) should identify safety features incorporated into the design of
the aircraft to control and mitigate post-crash fire and explosion hazards.
2. Analysis should demonstrate the effectiveness of any incorporated safety features.
3. Testing (usually lab and rig testing) should demonstrate the accuracy of performed analysis and the
effectiveness of any incorporated safety features.
4. System Safety Assessment (SSA) should analyse the hazards associated with post-crash fire and
explosion and demonstrate that the risk to the aircraft, its occupants and ground firefighting personnel is
acceptable.
Information Sources
G.3.4.7.7, G.4.4.7.7 Reference: 00-970 P1 4.22.44
MIL-HDBK-221: 2.7.3.2, 2.15 00-970 P1 4.22.57
00-970 P1 4.22.63
00-970 P1 4.26.29
00-970 P1 6.6.67
00-970 P1 6.6.87
00-970 P1 6.6.88
00-970 P13 1.6.11.04
STANAG 4671.944
Reference:
23.865, 25.851-25.869, Reference: CS 23.994
23.1181-23.1203, 25.1181- CS 23.1453
25.1207, 23.1411, 25.1411
CS 25.721
AC 25-17, AC 25.994.1
CS 25.787
CS 25.855
CS 25.963
CS 25.994
CS 25.1145
CS 25.1453
CS 27.855
CS 27.952
CS 27.963
CS 27.973
CS 29.855
CS 29.952
CS 29.963
CS 29.973
8.4.20 Detection and control of overheating.

The aircraft shall have provisions to detect and control overheat conditions that are potential fire and
explosion hazards.

a. Locations where overheat sensors might be required;
b. The type of warning and crew response, or automatic response, required.

1. System Description Documents (SDD) should identify provisions for detection and control of overheat
conditions.
2. Analysis should demonstrate the adequacy of overheat control provisions to effectively reduce the
temperature of the relevant aircraft components.
3. Testing (usually lab and rig testing) should demonstrate the effective detection and control of overheat
conditions.
4. System Safety Assessment (SSA) should analyse the hazards associated with overheat conditions and
resulting hazards and demonstrate that the level of risk is acceptable.
Information Sources
Comm'l Doc:
G.3.4.7.23, G.4.4.7.23, Reference: 00-970 P1 4.26.3
G.3.4.7.28, G.4.4.7.28 00-970 P1 4.26.24
MIL-HDBK-221: 2.20
00-970 P1 4.26.32
00-970 P1 4.26.69
00-970 P1 6.6.87
00-970 P1 6.6.88
STANAG 4671.863
4671.1307
4671.1309
4671.1353
23.865, 25.851-25.869, Reference: CS 23.1111
23.1181-23.1203, 25.1181- CS 23.1309
25.1207, 23.1411, 25.1411
CS 23.1353
CS 25.863
CS 25.1103
CS 25.1203
CS 25.1309
CS 25.1353
CS 25.1365
CS 25.1731
CS 27.863
CS 27.1309
CS 27.1353
CS 29.863
CS 29.1309
CS 29.1353
8.5. LANDING GEAR AND DECELERATION SYSTEMS.
8.5.1. Ground Floatation

The landing gear shall have safe ground floatation capability. It shall be designed with the load bearing
capabilities of the intended operating surfaces in mind.
a. Operation from surfaces other than smooth, hard runways, or operation on/from aircraft carriers;
b. The design of the aircraft structure and landing gear and the loads arising from operation over the
roughest ground that may reasonably be expected in normal operation;
c. The use of a recognised rating scheme to quantify the aircraft's characteristics;
d. Loads applied by the landing gear system to the airfield surface.

1. System Description Documents (SDD) should define the surface characteristics of all surfaces from
which the aircraft is designed to operate.
2. Analysis should demonstrate that the aircraft's characteristics allow it to operate from all expected
surfaces without excessive deformation of the surface, or without preventing further movement of the
aircraft. Such analysis should take account of critical aircraft weights and CofG positions, critical landing
gear configurations, and critical tire pressures.
3. Rig, ground and flight testing should demonstrate the accuracy of the performed analysis, and should
demonstrate that the aircraft can operate from all expected surfaces.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 4.13.4
A.3.4.1.2.1, A.4.4.1.2.1 Reference: 00-970 P1 S4 L48, L50
AFGS-87139: 3.2.1.1.b STANAG
Reference:
8.5.2. Arrangement, dynamics, and clearances.

8.5.2.1 Ground clearances.
The landing gear shall be arranged so that no part of the aircraft can contact the ground, except those
intended to, ( wheels, skids, arresting hooks, tail bumpers, etc.) in all expected take-off and landing
attitudes, aircraft configurations (external stores, weapons, etc.) , and with reasonably anticipated failures
(deflated tyres, collapsed shock absorbers, etc.).

a. The full range of conditions through which the aircraft is permitted to take-off and land, including wind
velocities (including gusting), permitted aircraft weights and CofG positions, landing surface conditions
(irregularities, objects on the ground, slopes, etc.);
b. The range of positions that moveable components and equipment (control surfaces, search lights, etc)
may be in on landing.

1. System Description Documents (SDD) should clearly identify the aircraft components whose contact
with the ground is routinely expected, is expected in exceptional circumstance, and is not
expected/prohibited.
2. Analysis should demonstrate, for all expected take-off and landing attitudes, aircraft configurations,
reasonably anticipated failures, take-off and landing conditions, and positions of moveable components,
that only expected parts of the aircraft contact the ground.
3. Analysis should demonstrate that all parts which may contact the ground are suitably strong to
withstand the loads that may occur during such contact without unacceptable deformation.
4. Flight test should demonstrate that no unexpected part of the aircraft contacts the ground during take-
off and landing, particularly for critical take-off and landing attitudes, aircraft configurations, reasonably
anticipated failures, take-off and landing conditions, and positions of moveable components.
Information Sources
Comm'l Doc:
A.3.4.1.1.1, A.4.1.1.1, Reference: 00-970 P1 4.13
A.3.4.1.1.6, A.4.4.1.1.6, 00-970 P1 5.1.62
A.3.4.1.1.3, A.4.4.1.1.3,
00-970 P1 5.1.101
Appendix A:
A.3.4.1.1.1/A.4.4.1.1.1 Gear 00-970 P13 3.8.29
arrangement; STANAG 4671.481
A.3.4.1.1.3/A.4.4.1.1.3 Reference: 4671.733
Extended Clearances; and
4671.925
A.3.4.1.1.6/A.4.4.1.1.6
Clearance with flat tyre and flat
strut.
AFGS-87139: 3.2.1.2
Arrangement and 3.2.1.3.a
Clearances.
FAA Doc: 14CFR reference: 13.1-13.2.4, EASA CS CS 23.733
23.1501, 23.1529, 25.1501, Reference: CS 23.925
25.1503-25.1533, 25.1529, CS 25.733
25.1541, 25.1543, 25.1557,
CS 25.925
25.1563
CS 27.411
CS 27.733
CS 29.411
CS 29.733
8.5.2.2 Aircraft stability and control on the ground.

The landing gear shall provide safe control of the aircraft during ground manoeuvres including taxy, take-
off and landing, preventing unintentional contact with the ground, turn-over or ground loops.

a. The effect of variations in aircraft mass and CofG position;
b. The effect of variations in landing gear parameters such as tyre pressure, shock absorber pressure,
etc.
c. The variety of surfaces for which operation on the ground is permitted, including reasonably anticipated
objects on the ground and surface conditions (irregularities, slope, hardness, etc.).

1. Testing should demonstrate that aircraft stability and control on the ground is acceptable for all
permitted aircraft masses and CofG positions, landing gear parameters and surfaces.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 2 2.3
A.3.4.1.1.2/A.4.4.1.1.2 Pitch Reference: 00-970 P1 4.10.11
Stability; and 00-970 P1 4.11.2
Information Sources
A.3.4.1.1.7/A.4.4.1.1.7 Gear 00-970 P1 4.11.28
Stability 00-970 P1 4.11.66
AFGS-87139: 3.2.1.2
00-970 P1 4.13.7
Arrangement and 3.2.5.1
STANAG 4671.231
General
Reference: 4671.233
4671.235
4671.586
FAA Doc: 14CFR reference: 25.233 EASA CS CS 23.231
CS 23.235
CS 25.231
CS 25.233
CS 25.235
CS 27.231
CS 27.241
CS 27.663
CS 27.751
CS 29.231
CS 29.241
CS 29.663
CS 29.751
8.5.2.3 Wheel well clearances.

Retractable landing gear and surrounding landing gear bays/wheel wells (including doors) shall be
designed to ensure that sufficient clearance is maintained to prevent the landing gear becoming stuck in
any position.

a. Kinematics of the landing gear and any other moving parts (e.g. doors);
b. The maximum size of the tyres, including unworn tread, the highest possible differential pressure
(taking account of large internal tyre pressures, e.g. due to maximum inflation and subsequent
temperature effects, and low external air pressures, e.g. due to high altitude) and centripetal forces due to
tyre rotation;
c. The effect of objects/substances which could foul mechanisms (ice/slush, sand, mud, chemicals, etc.)

1. Analysis should demonstrate that for all possible combinations of movement of moving parts (landing
gear, doors, etc.), adequate clearance is maintained.
2. Rig, ground and flight testing should verify the accuracy of the performed analysis and should
demonstrate that adequate clearance is maintained.
3. Rig, ground and flight testing should verify adequate clearance is maintained despite build-up of
objects/substances that could foul the landing gear mechanisms.
Information Sources
Comm'l Doc:
A.3.4.1.1.4/A.4.4.1.1.4 Reference: 00-970 P1 4.11.57
Information Sources
Retraction Clearances AFGS- 00-970 P1 4.11.60
87139: 3.2.1.2 Arrangement 00-970 P1 4.11.74
and 3.2.1.3.b Clearances
00-970 P1 4.12.41
(retractable landing gears)
00-970 P7 L301 3.4
STANAG 4671.729
Reference: 4671.733
4671.745
CS 25.733
CS 25.745
CS 25.729
CS 27.733
CS 27.745
CS 27.729
8.5.2.3.1 Wheel well temperatures.

Equipment and structure that are essential to the safe operation of the aeroplane and that are located on
the landing gear and in the wheel wells shall be protected from the damaging effects of the maximum
wheel brake temperatures encountered during (normal and abnormal) operation.
Consideration shall be given to:

a. Use of protective covers;
b. Means to ensure dissipation of excess temperature;
c. Location and proximity of sensitive structure or equipment;
d. Location and proximity of flammable substances or materials.

1. System Description Documents should identify the expected maximum temperature of each wheel
brake.
2. Analysis should demonstrate that the expected maximum temperature of each wheel will not be
exceeded.
3. Rig, ground and flight testing should demonstrate that equipment located in each wheel well operates
safely when subjected to the expected maximum temperature.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:
8.5.2.4 Dynamic stability for ground operation.

The landing gear shall not cause the aircraft to experience any adverse dynamics or pitching motions
(including but not limited to vibrations, buffeting, shimmy, porpoising and yaw skids), which prevent
continued safe operations, cause structural damage, interfere with satisfactory control, or cause
excessive fatigue to the flight crew, on the ground or during transition to and from flight.

a. All forces including dynamic and inertia forces that may occur on the ground and during transition to
and from flight (gyroscopic forces due to motion of rotating wheels, torque loads due to arresting spinning
wheels, oscillation of landing gear pistons, etc.) ;
b. Interaction between internal landing gear loads (e.g. torque forces due to braking) and external loads
from other sources (e.g. aerodynamic loads, thrust and thrust reversal, etc.).
1. Analysis and/or testing should identify the forces (both static and dynamic) that may occur during
operation of the aircraft on the ground and during transition to and from flight.
2. Analysis should demonstrate that combinations of forces, and the interaction of forces and aircraft
systems and structure cannot result in unacceptable oscillation (e.g. resonance).
demonstrate that operation on ground and transition to and from flight does not cause unacceptable
oscillatory motion or loads.
Information Sources
Comm'l Doc:
A.3.4.1.1.2/A.4.4.1.1.2 Pitch Reference: 00-970 P1 2.19.30(VTOL)
Stability; 00-970 P1 4.10.19
A.3.4.1.1.7/A.4.4.1.1.7 Gear
00-970 P1 4.11.28
Stability;
A.3.4.1.4.2/A.4.4.1.4.2 00-970 P1 4.11.59
Directional Control;
A.3.4.1.4.3/A.4.4.1.4.3 STANAG 4671.723
Emergency directional control;
Reference: 4671.726
A.3.4.1.4.5.1/A.4.4.1.4.5.1
Steering characteristics 4671.727
AFGS-87139: 3.2.1.2.b 4671.729
Arrangement; and 3.2.1.4 4671.731
Damping 4671.733
4671.735
4671.1309
23.745, 25.721-25.737 Reference: CS 23.723
CS 23.726
CS 23.729
CS 23.731
CS 23.733
CS 23.735
CS 23.1309
CS 25.251
CS 25.473(d)
CS 25.493(d)
CS 25.723
CS 25.729
Information Sources
CS 25.731
CS 25.733
CS 25.735
CS 25.1309
8.5.2.5 Tip over.

The landing gear shall be designed to ensure the aircraft will not tip forward or back during ground
operations, including acceleration, braking (including while reversing) and during towing.

a. Instantaneous and progressive application of braking forces during ground manoeuvres.
b. Aircraft accelerations during towing manoeuvres.
c. The effect of variations of aircraft mass and CofG positions (in all aircraft axes).
d. The effect of thrust and control surface loads.

1. Analysis should identify that, for critical combinations of aircraft weight and CofG position, resultant
loads due to thrust, control surface forces, brake forces, and aircraft accelerations will not cause the
aircraft to tip forward (in the case of tail-wheeled aircraft) or back (in the case of nose-wheeled aircraft).
2. Rig, ground and flight testing should demonstrate the accuracy of performed analysis and demonstrate
that the aircraft does not tip forward or back during ground manoeuvres involving large accelerations
(ground rolls with high thrust, heavy braking, etc.) and large control surface displacements.
Information Sources
Comm'l Doc:
A.3.4.1.3.1.14/A.4.4.1.3.1.14 Reference: 00-970 P1 S4 L42
Empennage protection; and STANAG
A.3.4.1.2.2.1.3/A.4.4.1.2.2.1.3
Landing gear towing Reference:
25.507, 25.509 Reference: CS 25.507
CS 25.509
8.5.2.6 Kneeling.
The landing gear kneeling system shall allow the aircraft to kneel safely.

a. Preventing kneeling when such action could result in aircraft tip-over.
b. Preventing kneeling when such action could result in damage to the aircraft or surrounding equipment
(e.g. Ground Support Equipment).

1. Analysis should demonstrate that kneeling can be conducted safely, and that adequate protections are
in place to prevent the unsafe kneeling of the aircraft.
2. Rig, ground and flight testing should demonstrate that kneeling can be conducted safely.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970
A.3.4.1.10/A.4.4.1.10 Reference:
Specialized subsystems STANAG
AFGS-87139: 3.1.9
Reference:
Specialized subsystems.
FAA Doc: EASA CS
Reference:
8.5.2.6.1 Kneeling procedures.

Servicing procedures for landing gear kneeling and unkneeling shall be safe and properly sequenced.

a. Managing and minimising risks that could affect safe kneeling and unkneeling, including management
of aircraft weight and CofG position whilst the aircraft is knelt.

1. Technical Publications should include detailed processes for kneeling and unkneeling the aircraft,
including considerations for managing risk.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970
A.3.4.1.10/A.4.4.1.10 Reference:
Specialized subsystems STANAG
AFGS-87139: 3.1.9
Reference:
Specialized subsystems
FAA Doc: EASA CS
Reference:
8.5.3. Landing gear structure.

8.5.3.1 Safe failure of landing gear structure.
The landing gear shall be designed such that no structural failure could result in penetration of any
occupied compartment, fuel tank, or any other bay that may cause a fire, ignition or explosion hazard.

a. The deflection of landing gear structure away from critical bays.
b. Energy absorption of nearby panels and other structure without penetration.

1. Analysis should demonstrate that interactions between landing gear structure and surrounding aircraft
structure during expected landing gear failure modes will not result in penetration of critical bays.
2. Coupon, assembly and rig testing should demonstrate the accuracy of performed analysis, and should
show that critical bays are not penetrated due to landing gear failure.
Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1/6 S4 L75
A.3.4.1.3.1.3/A.4.4.1.3.1.3 Reference: 00-970 P1 S4 L47
Failure Tolerance STANAG
AFGS-87139: 3.2.2.1.e
Reference:
General (limits on structural
failure modes)
FAA Doc: 14CFR reference: 23.721 & EASA CS CS 23.561
25.721 cover fuel spillage Reference: CS 23.721
CS 25.561
CS 25.721
CS 27.561
CS 29.561
8.5.3.1.1 Safe failure of landing gear components.

Failure of landing gear components shall not cause catastrophic failure of surrounding aircraft structure.

a. The effect and mitigation of instantaneous failure of high energy landing gear parts including wheels
and tyres rotating at high speed.

1. System Safety Analysis (SSA) should demonstrate that the risk of failure of aircraft structure due to
failure of landing gear components is acceptable.
2. Analysis, supported by testing, should demonstrate that failure of any landing gear component cannot
result in failure of surrounding aircraft structure.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:
8.5.3.2 Shock strut energy absorption.

The landing gear shall be designed so the shock absorbing mechanism allows for safe ground
operations, take-off and landing.

a. Ensuring sufficient energy absorption and dissipation is achieved during landing;
b. Providing adequate support for aircraft structure during ground manoeuvring;
c. Maximising passenger comfort;
d. Ensuring the shock absorbing mechanism does not bottom out.
e. The effect of variation in aircraft weight and CofG position.
f. The effect of variation in tyre and shock absorber pressures.
1. Analysis should demonstrate that the energy absorption capacity of the landing gear is adequate,
without bottoming out, to absorb the energy associated with ground operations, take-off and landing,
including the maximum anticipated aircraft velocities and critical aircraft weights and CofG positions.
demonstrate that energies associated with ground operations, take-off and landing are absorbed without
bottoming out of landing gear components.
Information Sources
Comm'l Doc: SAE AS 6053 Tests, Impact,
Shock Absorber, Landing
Gear, Aircraft (formerly MIL-T-
6053)
A.3.4.1.3.1.8/A.4.4.1.3.1.8 Reference: 00-970 P1 4.11.22
Energy Absorption 00-970 P1 4.11.42
3.4.1.3.1.11/4.4.1.3.1.11
00-970 P1 4.11.43
Repeated Operation
AFGS-87139: 3.2.2.1 General 00-970 P1 4.11.44
and 3.2.2.2 Shock absorption
MIL-L-8552 STANAG 4671.235
Reference: 4671.723
4671.725
4671.729
23.745, 13.1-13.2.4, 23.1501, Reference: CS 23.1501
23.1529, 25.721-25.737, CS 23.1529
25.1501, 25.1503-25.1533,
CS 25.1501
25.1529, 25.1541, 25.1543,
25.1557, 25.1563 CS 25.1503-1533*
CS 25.1529
CS 25.1541*
CS 25.1543*
CS 25.1557*
CS 25.1563*
CS 27.235
CS 27.729
CS 27.1529
CS 29.235
CS 29.729
CS 29.1529
8.5.3.3 Incorrect servicing allowance.

The landing gear shall be designed so that incorrect servicing does not compromise safety, result in
unsafe loading or cause damage to the aircraft during take-off, landing or taxiing operations.

a. Incorrect servicing of the wheels, tyres, shock absorbing mechanism;
b. Appropriate and realistic levels of incorrect servicing;
c. Loading types including fuel, weapons, stores, etc;
d. Sudden movement of the shock absorbing mechanism.

1. Analysis should demonstrate that, with shock struts incorrectly serviced and parameters influencing
performance (shock absorber pressure, fluid quantity, etc.) reasonably beyond allowed values, system
characteristics do not have a negative effect on safety, or cause damage to the aircraft during take-off,
landing or taxiing.
2. Rig, ground and flight testing should demonstrate the accuracy of performed analysis, and should
demonstrate that incorrect servicing of the landing gear does not have a negative effect on safety, or
cause damage to the aircraft during take-off, landing or taxi operations.
Information Sources
Comm'l Doc: SAE AS 6053 Tests, Impact,
Shock Absorber, Landing
Gear, Aircraft (formerly MIL-T-
6053)
DoD/MIL Doc: AFGS-87139: 3.2.1.3 Def-Stan 00-970 00-970 P1 4.11.35
Clearances Reference: 00-970 P1 4.12.9
MIL-L-8552 Landing Gear, STANAG 4671.729
Aircraft Shock Absorbers (Air- Reference:
Oil Type)
23.1501, 23.1529, 25.1501, Reference: CS 25.729
25.1503-25.1533, 25.1529,
25.1541, 25.1543, 25.1557,
25.1563
8.5.3.4 Landing operating limits.

The landing gear shall be designed to allow for safe landing operations (emergency and normal) in all
specified landing conditions, at all operating weights.

a. All expected landing conditions in both emergency and normal operating conditions;
b. The effect of failures, such as flat tyres / roll on rims and bottomed out shock absorbing mechanisms;
c. Crew and passenger comfort and functioning of equipment during ground manoeuvring;
d. The effect of maximum aircraft landing weights;
e. The effect of external stores and role equipment;

1. Analysis should demonstrate that the landing gear allows for safe landing operations in all specified
landing conditions, at all operating weights.
2. Rig, ground and flight testing should demonstrate the accuracy of performed analysis, and demonstrate
that the landing gear design allows for safe landing operations.
Information Sources
Comm'l Doc:
A.3.4.1.3.1.7/A.4.4.1.3.1.7 Flat Reference: 00-970 P1 4.11.7
tyre and flat strut operation;
A.3.4.1.3.1.8/A.4.4.1.3.1.8
Energy absorption; STANAG 4671.473
A.3.4.1.3.1.11/A.4.4.1.3.1.11 Reference: 4671.479 - 4671.485
Repeated operation
Information Sources
AFGS-87139: 3.6 4671.497
Environmental Conditions, 4671.499
3.2.2.1 General and 3.2.2.2 4671.723 - 4671.731
Shock absorption
23.731, 23.473, 23.477, Reference: CS 29.479 - 29.485
23.479, 23.481, 23.483, CS 29.497
23.485, 25.721-25.731,
CS 29.501
25.101, 25.511, 25.1583
CS 29.505
CS 29.511
CS 29.521
CS 29.723 - 29.731
CS 29.737
CS 29.757
8.5.3.5 Landing gear stability and shimmy prevention.

The landing gear shall be designed in such a way that unacceptable shimmy, or other dynamic
instabilities, do not occur at any speed encountered during operation.

a. The full range of aircraft masses and CofG positions;
b. The expected range of landing gear parameters (tyre pressure, shock absorber pressure, etc.);
c. The effect of other (external) forces acting on the aircraft, including lift, drag and thrust.

1. Analysis should demonstrate that the landing gear design does not cause unacceptable shimmy or
other dynamic instability through the full range of expected aircraft speeds, loading conditions, landing
gear parameters and external forces.
2. Rig, ground and flight testing should demonstrate the accuracy of the performed analysis and should
demonstrate that no unacceptable shimmy or other dynamic instability occurs through critical
combinations of aircraft speed, loading conditions, landing gear parameters and external forces.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 2006 3.4.2.7, 4.4.2.7 Def-Stan 00-970 00-970 P1 4.11.14
JSSG-2009 Appendix A: Reference: 00-970 P1 4.11.29
A.3.4.1.1.7/A.4.4.1.1.7 Gear 00-970 P7 L301 5.2
Stability; and
A.3.4.1.4.5.1/A.3.4.1.4.5.1 STANAG 4671.479
Steering Characteristics. Reference:
AFGS-87139: 3.2.1.2
Arrangement and 3.2.1.4
Damping.
FAA Doc: 14CFR reference: 23.721- EASA CS CS 23.729 - 23.745

23.745, 25.721-25.737- Reference: CS 25.721
shimmy is not covered, the rest CS 25.723
Information Sources
of the paragraphs imply CS 25.729
coverage CS 25.731
CS 25.733
CS 25.735
CS 27.727
CS 27.729
CS 27.731
CS 29.723
CS 29.725
CS 29.727
CS 29.729
CS 29.731
8.5.4 Tyre Load and Speed Rating

The landing gear tyres shall have an appropriate load and speed rating for all expected ground operations
and take-off and landing conditions.

a. The effect of reasonably expected tyre over- and under-inflation;
b. The effect of combinations of worn (at wear limits) and un-worn (new) tyres;
c. The effect of total deflation of a single tyre in a multi-wheel bogie or similar arrangement;
d. The effect of heavy braking (e.g. rejected take-off at V1).

1. Analysis should demonstrate that tyres have an appropriate load and speed rating for all expected
ground operations and take-off and landing conditions, including reasonable tyre over- and under-
inflation, combinations of worn and un-worn tyres, total deflation of a single tyre in a multi-wheel bogie or
similar arrangement, and effects of heavy braking.
demonstrate the appropriateness of the selected tyres for critical ground operations and take-off and
landing conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 4.11.7,
A.3.4.1.2.2/A.4.4.1.2.2 Ground Reference: 00-970 P1 4.11.10,
handling; 00-970 P1 4.11.11,
A.3.4.1.3.1.4/A.4.4.1.3.1.4
00-970 P1 4.11.12,
Strength; and
A.3.4.1.11.1.1/A.4.4.1.11.1.1 00-970 P1 4.11.24,
Air vehicle tire performance. 00-970 P1 4.11.35
AFGS-87139: 3.1.8 Ground STANAG 4671.473
handling (operations), 3.2.4.1 Reference: 4671.511
Tires 4671.733
MIL-PRF-5041
14CFR reference: 23.473,
23.726, 23.733, 25.473,
25.726, & 25.733
Information Sources
FAA Doc: EASA CS CS 23.473, 23.511, 23.726 *,
Reference: 23.733
CS 25.473, 25.499, 25.511,
25.733
CS 27.497, 27.733
CS 29.497, 29.511, 29.733
8.5.5 Wheel Loadings

The landing gear wheels shall be designed to withstand the worst-case loads for all specified ground
operations.

a. All expected landing conditions (normal and emergency);
b. All expected environmental conditions;
c. All combinations of aircraft weight and configuration;
d. The effect of over- and under-inflation of tyres, including total deflation of a single tyre in a multi-wheel
bogie or similar arrangement;
e. The effect of combinations of worn (at wear limits) and un-worn (new) tyres.

1. Analysis should demonstrate that wheels are appropriate for all expected ground operations and take-
off and landing conditions, including reasonably expected tyre over- and under-inflation, combinations of
worn and un-worn tyres, total deflation of a single tyre in a multi-wheel bogie or similar arrangement, and
effects of heavy braking.
demonstrate the appropriateness of the wheels for critical ground operations and take-off and landing
conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 4.11.11, 4.11.12, P7
A.3.4.1.2.2/A.4.4.1.2.2 Ground Reference: L303 5.1
handling; STANAG
A.3.4.1.3.1.4/A.4.4.1.3.1.4 4671.473 - 511, 4671.723 -
Strength; Reference: 733
A.3.4.1.11.2.1/A.4.4.1.11.2.1
Air vehicle wheel performance;
and •
A.3.4.1.11.2.4/A.4.4.1.11.2.4
Nonfrangibility criteria (flat tire
operation)
AFGS-87139: 3.1.8 Ground
handling (operations) and
3.2.4.2 Wheels
MIL-B-8584
MIL-W-5013 Wheel and Brake
Assemblies - inactive for new
design
14CFR reference: 23.721-
Information Sources
23.732, 25.721-25.732,
23.471-23.511 & 25.471-
25.511, 25.101 (see 13.1-
13.2.4)
FAA Doc: EASA CS CS 29.475 - 521
Reference: CS 29.723 - 731
CS 29.737
CS 29.753
8.5.6 Wheel overheating and over-pressurisation protection

Wheel or tyre explosion due to over-pressure (e.g. due to over-inflation) and over-heat (e.g. due to heavy
braking) shall be prevented.

a. The incorporation of pressure relief valves (to prevent failure due to over-inflation) and fusible plugs (to
prevent failure due to over-heat);
b. Providing an appropriate margin for over-inflation and over-heat so that wheel-tyre assemblies are
suitably protected, and inadvertent triggering of the protection devices is minimized.

1. System Description Documents (SDD) should, for each wheel/tyre assembly, identify the provided
means of preventing wheel or tyre failure/explosion due to over-inflation (e.g. Over-inflation Pressure
Relief (OPR) valve);
2. SDD should identify the provided means of preventing wheel or tyre failure/explosion due to excessive
heat (e.g. fusible plugs);
3. Analysis should demonstrate that the provided failure prevention means operate effectively through all
expected failure conditions with an appropriate margin for over-inflation and over-heating.
demonstrate that over-pressure and over-heat prevention means operate effectively prior to failure of the
wheel/tyre.
Information Sources
Comm'l Doc:
A.3.4.1.11.2.3/A.4.4.1.11.2.3 Reference: 00-970 P1 4.12.44
Brake Overheat Capability; and 00-970 P7 L310 3.2.6
A.3.4.1.11.2.6/A.3.4.1.11.2.6
00-970 P7 L310 3.2.8
Pressure-release criteria;
A.3.4.1.11.3.1/A.4.4.1.11.3.1 STANAG 4671.735
Air vehicle stopping and turn- Reference:
around performance; and
A.3.4.1.11.3.7/A.4.4.1.11.3.7
Temperature interface criteria
AFGS-87139: para 3.2.3.1
General, 3.2.4.2.c Wheel
overheat capability and
3.2.4.3.a Brakes
Information Sources
design
14CFR reference: 11.2.2 &
11.2.2.1 Included in each
specific 14CFR reference per
section
CS 25.731
CS 25.735
8.5.7. Brake Assemblies

8.5.7.1 Brake energy capability.
The aircraft braking system shall provide sufficient energy conversion and dissipation, and braking torque
throughout the defined wear range to allow safe ground, take-off and landing operations, including
accelerate-stop distance and braked roll requirements.

a. All expected combinations of aircraft weight and speed;
b. All expected aircraft configurations (e.g. air brakes deployed/retracted);
c. Reasonable failures and pilot errors that could reduce aircraft deceleration (air brakes failed, thrust
reverse failed, parachute failed, incorrect engine thrust setting, etc.).
d. All expected runway surfaces and conditions (dry, wet, muddy, sandy, etc.);
e. The effect of expected environmental conditions, such as temperature, altitude, etc;
f. The effect of repeated brake operations.

1. Analysis should demonstrate that the energy conversion and dissipation, and brake torque
performance of the brakes, throughout the defined wear range, exceeds the maximum energy conversion
and dissipation and brake torque requirements for ground, take-off and landing operations.
demonstrate that the performance of the braking system is adequate to allow safe ground, take-off and
landing operations.
Information Sources
Comm'l Doc:
A.3.4.1.11.3.1/A.4.4.1.11.3.1 Reference: 00-970 P1 4.12.19
Air vehicle stopping and turn- STANAG
around performance. 4671.55
AFGS-87139: 3.2.3.1.a & b Reference: 4671.493
Brake system (General) 4671.735
design
23.55, 23.493, 23.735, 25.45, Reference: CS 23.493
Information Sources
25.55, 25.493, 25.735, 25.101 CS 23.735
CS 25.101*
CS 25.493
CS 25.735
CS 27.493
CS 27.735
CS 29.493
CS 29.735
8.5.7.2 Brake redundancies.

The brake system, associated systems and components shall be designed to include sufficient
redundancy so that in the event of any reasonably credible combination of failures, it shall be possible to
stop the aircraft within an acceptable distance.

a. Failure of power supply and transmission systems (electrical, hydraulic, pneumatic, mechanical, etc.),
brake components, and control systems;
b. The acceptable level of performance degradation associated with single failures and combinations of
failures.

1. System Description Documents (SDD) should identify the redundancy included in the design of the
brake system, the failures (single and combination) through which braking is still possible, and the
maximum degradation of braking system performance associated with each failure.
2. Analysis should demonstrate that the increase in stopping distance associated with degradation of the
braking system performance due to failures is acceptable.
3. System Safety Assessment (SSA) should demonstrate that the risks associated with degradation of the
braking system performance due to failures is acceptable.
4. Rig, ground and/or flight testing should demonstrate the accuracy of performed analysis, and should
demonstrate that increase in stopping distance due to degraded brake system performance is acceptable.
Information Sources
Comm'l Doc: SAE ARP-1493
A.3.4.1.11.2.4/A.4.4.1.11.2.4 Reference:
Nonfrangibility criteria (flat tire STANAG
operation); 4671.735
A.3.4.1.11.3.3/A.4.4.1.11.3.3 Reference:
Structural failure criteria; and
A.3.4.1.11.3.4/A.4.4.1.11.3.4
Secondary braking capability
(fail-safe).
AFGS-87139: para 3.2.3.1.c
Brake system, General and
3.2.4.3 Brakes;
MIL-W-5013 Wheel and
Brakes - presently inactive for
new designs
Information Sources
FAA Doc: 14CFR reference: 11.2.2.1 EASA CS CS 23.735
Reference: CS 25.101, 25.109, 25.125 and
25.735
8.5.7.3 Brake torque.

The brake system shall provide sufficient static (i.e. holding) torque to prevent wheel rotation throughout
normal ground operations, including preparation for take-off.

a. The effect of ground surface conditions (e.g. slope) and contamination of braking surfaces (water, ice,
mud, etc.);
b. Combinations of forces that could result in forward/rearward movement (e.g. engine thrust), and/or
movement about the aircraft's normal axis (asymmetrical engine thrust, rotor acceleration, etc.).

1. System Description Document (SDD) should identify the static torque for each brake assembly, taking
account the effects of brake surface contamination;
2. Analysis should demonstrate that the static torque of each brake assembly is sufficient to hold the
aircraft stationary through critical combinations of forces on the aircraft;
demonstrate that the brakes can hold the aircraft stationary throughout all normal ground operations.
Information Sources
A.3.4.1.7/A.4.4.1.7 Restraint Reference: 00-970 P1 4.12.14
capability. STANAG
AFGS-87139: para 3.2.3.1.b 4671.735
Reference:
Brake System, General, and
3.2.4.3 Brakes;
MIL-W-5013 Wheels and
Brakes - presently inactive for
new designs,
MIL-B-8584 Design of Brake
Systems
14CFR references: 23.735,
25.735
SAE ARP-1493
8.5.7.4 Merged with 8.5.6

8.5.8. Brake control and anti-skid control
8.5.8.1 Brake control redundancies.
The aircraft shall have a secondary braking capability, separate and independent from the primary
stopping means, sufficient to arrest the aircraft in a safe manner.

a. Incorporation of a secondary, separate braking system, and/or auxiliary braking devices (air brakes,
thrust reversal, parachute, etc.);
b. The required level of performance of the secondary braking system.

1. System Description Documents (SDD) should identify the secondary brake system included in the
design of the aircraft, and the braking performance associated with the secondary system.
2. Analysis should demonstrate that the increase in stopping distance associated with use of the
secondary braking system is acceptable.
3. System Safety Assessment (SSA) should demonstrate that the risks associated with the use of the
secondary braking system due to failures is acceptable.
4. Rig, ground and/or flight testing should demonstrate the accuracy of performed analysis, and should
demonstrate that increase in stopping distance due to use of the secondary braking system is acceptable.
Information Sources
A.3.4.1.4.4.2/A.4.4.1.4.4.2 Reference: 00-970 P1 4.12.12
Alternate independent braking; 00-970 P13 3.13.2
AFGS-87139: para 3.2.3.2.a
STANAG
Brake actuation system and
Reference:
3.2.4.3 Brakes;
Systems;
FAA Doc: 14CFR reference: 11.2.2 & EASA CS CS 23.75
11.2.2.1; Reference: CS 25.125
CS 25.735
8.5.8.2 Braking control.

Braking control shall be designed such that input forces can be applied in a smooth and controllable
manner, and such that the resulting aircraft deceleration is broadly proportional to the applied input force,
during both engagement and disengagement of the brakes.

a. The full range of forces that are likely to be applied to the controls, and the resulting travel of the
controls;
b. Areas of non-proportionality, for example where small input forces may not result in noticeable
deceleration, and large input forces where a limit of deceleration may be reached.
c. Symmetry of braking forces for laterally displaced brake units, so that symmetric input force does not
result in unacceptable yaw.

1. System Description Documents (SDD) should identify the anticipated range of input forces, and
resulting output forces and braking torques.
2. Analysis should demonstrate that the relationship between braking input forces, output forces/torques
and resulting aircraft deceleration is acceptable and broadly proportional throughout the permitted brake
wear range.
3. Rig, ground and flight testing should demonstrate the accuracy of performed analysis and should
demonstrate that input forces can be applied in a smooth and controlled manner, and that resulting
aircraft deceleration is broadly proportional to the applied input force.
Information Sources
A.3.4.1.4.2/A.4.4.1.4.2 Reference: 00-970 P7 L310 2.2
Directional Control; and 00-970 P7 L310 2.2.4
A.3.4.1.4.4.1/A.4.4.1.4.4.1
Braking control interface. STANAG 4671.231
AFGS-87139: 3.2.3.1 General, Reference: 4671.405
3.2.3.2 Brake actuation 4671.735
system; 3.2.3.3 Anti-skid brake 4671.1731
control; and 3.2.4.3 Brakes
Systems
FAA Doc: 14CFR reference: inferred in EASA CS CS 23.231
23.45, 23.55, 23.493, 23.735, Reference: CS 23.405
25.45, 25.55, 25.493, 25.735 & CS 23.735
25.101
CS 25.231
CS 25.405
CS 25.735
CS 27.735
CS 29.735
8.5.8.3 Parking brake.

The parking brake (where fitted) shall hold the aircraft stationary through normal ground operations,
including engine starting and aircraft ground running, on all expected surfaces (e.g. slopes).

a. The effect of thrust and unbalanced torque forces during engine ground running;
b. The duration through which the aircraft will be required to be held stationary by the parking brake,
without chocks;
c. The effect of contamination of braking surfaces (water, mud, etc.).

1. System Description Documents (SDD) should identify the aircraft's parking brake provision(s).
2. Analysis should identify the braking torque/force required to hold the aircraft stationary during ground
operations, including the effect of contamination of braking surfaces, and the ability for the parking brake
to provide this force.
demonstrate that the aircraft can be held stationary on the ground through normal ground operations.
Information Sources
Comm'l Doc:
A.3.4.1.9.5/4.4.1.9.5 Parking Reference: 00-970 P1 4.12.16
Information Sources
Brake 00-970 P1 4.12.17
AFGS-87139: 3.2.3.2.d Brake 00-970 P7 L310 2.3
actuation system STANAG
MIL-B-8584 Design of Brake Reference:
Systems
8.5.8.4 Safe stopping performance.

The aircraft shall have safe stopping performance for all expected ground operations, take-off and landing
configurations, including expected runway conditions (dry, wet, snow, ice, etc.) aircraft loading conditions,
and credible combinations of failures.

a. The effect of brake wear, alternative braking modes, and other performance degradation effects.
b. Combinations of deceleration devices such as wheel brakes, air brakes, thrust reversers, parachutes,
etc.

1. System Description Documents (SDD) should define the deceleration devices fitted to the aircraft, and
the conditions in which each device will be used to achieve the required stopping performance.
2. Analysis should demonstrate acceptable stopping performance for all expected ground operations,
take-off and landing configurations, aircraft loading conditions, and credible combinations of failures.
demonstrate that the performance of the deceleration systems is adequate to allow safe ground, take-off
and landing operations.
Information Sources
DoD/MIL Doc: JSSG-2009 para Def-Stan 00-970 00-970 P1 4.12.17
3.2.7.4.4.2/4.2.7.4.4.2 Damage Reference: 00-970 P1 4.12.18
tolerant-fail safe evident 00-970 P1 4.12.19
subsystems and components;
00-970 P1 4.12.25
and Appendix A:
A.3.4.1.4.3/A.4.4.1.4.3 00-970 P1 4.12.26
Emergency directional control, 00-970 P1 4.12.27
A.3.4.1.4.4.2/A.4.4.1.4.4.2 STANAG 4671.55
Alternative independent
Reference: 4671.75
braking,
A.3.4.1.4.4.3/A.4.4.1.4.4.3 Skid 4671.735
control; and
A.3.4.1.11.3.1/A.4.4.1.11.3.1
Air vehicle stopping and turn-
around performance;
AFGS-87139: para 3.2.3.1
General; 3.2.3.2 Brake
actuation system; 3.2.3.3 Anti-
skid brake control; and 3.2.4.3
Brakes.
Information Sources
Systems
23.45, 23.55, 23.493, 23.735, Reference: CS 27.75
25.187, 25.45, 25.55, 25.493, CS 27.735
& 25.735.
CS 29.75
CS 29.735
8.5.8.5 Anti-skid system.

The anti-skid system (where fitted) shall be designed such that no reasonably credible combination of
failures will result in an unacceptable loss of braking ability or directional control of the aircraft.

a. Failure of power supply and transmission systems (electrical, hydraulic, pneumatic, mechanical, etc.),
brake components, and control systems;
b. Cross coupling of the anti-skid units to maintain directional control of the aircraft;
c. All expected runway surfaces and conditions (dry, wet, etc.);

1. System Description Documents (SDD) should identify the aircraft's anti-skid provision(s).
2. Analysis should demonstrate that the increase in stopping distance associated with operation and
failure of the anti-skid system is acceptable.
3. System Safety Assessment (SSA) should demonstrate that the risks associated with failure of the anti-
skid system are acceptable.
demonstrate that operation and failure of the anti-skid system does not result in acceptable loss of
braking ability or directional control of the aircraft.
Information Sources
A.3.4.1.4.4.4/ A.4.4.1.4.4.4 Reference: 00-970 P1 4.12.25
skid control with power 00-970 P1 4.12.26
interruption; and
A.3.4.1.4.4.5/A.4.4.1.4.4.5 anti- STANAG 4671.735
skid engagement and Reference:
disengagement;
AFGS-87139: para 3.2.3.3
Anti-skid brake control and
3.2.4.3 Brakes;
Systems
(AMC 25.109(c)(2))
CS 25.735
8.5.8.6 Locked wheel prevention.

The anti-skid system (where fitted) shall prevent excessive relative motion between wheel/tyre
assemblies and the ground for all expected ground operations, take-off and landing conditions.

a. The expected range of surface conditions and aircraft loading conditions and speeds for ground
operation, take-off and landing;
b. The optimum and allowed values for relative motion between the wheel-tyre assembly and the ground
(i.e. slip ratio) and prevention of flat spotting.
c. The integration of the anti-skid system with the aircraft, and the environments within which it operates.

1. System Description Documents (SDD) should identify the aircraft's anti-skid provision(s).
2. Analysis should demonstrate that the anti-skid system prevents locked wheels during operation on the
ground, take-off and landing for all expected aircraft conditions.
demonstrate that locked wheels during operation on the ground, take-off and landing are prevented for all
expected aircraft conditions.
Information Sources
DoD/MIL Doc: JSSG-2009 para Def-Stan 00-970 00-970 P1 4.12.25
3.2.7.2/4.2.7.2 Environment, Reference: 00-970 P1 4.12.26
Appendix A: 00-970 P1 4.12.27
A.3.4.1.4.4.3/A.4.4.1.4.4.3 Skid
Control; STANAG 4671.735
AFGS-87139: para 3.2.3.1 Reference:
General; 3.2.3.2 Brake
actuation system; 3.2.3.3 Anti-
skid brake control; and 3.2.4.3
Brakes.
Systems
23.55, 23.493, 23.735, 25.45, Reference: CS 25.735
25.55, 25.493, & 25.735
8.5.8.7 Merged with 8.5.8.2
8.5.8.8 Merged with 8.5.8.2
8.5.8.9 Merged with 8.5.8.4
8.5.8.10 Merged with 8.5.8.6
8.5.8.11 Anti-skid coupling (dynamic effects).
Operation of the anti-skid system shall not induce unacceptable dynamic instability or vibration, in any
part of the aircraft during any brake operation.

a. Minimising the fatigue effects on the aircraft;
b. Maximising braking and landing gear performance, and the comfort of occupants.

1. Analysis (e.g. brake system simulations) should identify the various characteristics (i.e. magnitude and
frequency) of forces caused by operation of the anti-skid system in expected conditions.
2. Dynamic structural analysis should demonstrate that the oscillatory forces caused by the anti-skid
system do not cause resonance with the aircraft or the landing gear, and that resulting dynamic effects
(loads, displacements, velocities and accelerations) through the aircraft do not unacceptably affect the
structural integrity of the aircraft, or the comfort of occupants.
3. Fatigue analysis should demonstrate that oscillatory forces caused by the anti-skid system do not have
an unacceptable effect on the structural integrity or fatigue life of the aircraft or the landing gear.
demonstrate that operation of the anti-skid system does not cause unacceptable dynamic effects through
the aircraft, unacceptably affect the structural integrity of the aircraft and its landing gear, or the comfort of
occupants.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: para 3.4.2.7 Def-Stan 00-970 00-970 P1 4.12.26
Dynamic response during Reference: 00-970 P1 4.12.29
ground/ship-based operations STANAG
and 4.4.2 Ground loading
conditions; Reference:
JSSG-2009 Appendix A:
A.3.4.1.4.4.3/A.4.4.1.4.4.3 Skid
Control;
AFGS-87139: para 3.2.1.4
Damping and 3.2.3.3 Anti-skid
brake control.
FAA Doc: EASA CS
Reference:
8.5.9. Directional control.

8.5.9.1 Backup for directional control.
The aircraft shall have primary and separate secondary/emergency means for directional control during
ground operations.

a. Ensuring separation between the two directional control systems, so that failure of one system cannot
lead to failure of the other system;
b. The conditions through which the aircraft will operate on the ground, including aircraft loading
conditions, surface conditions, wind velocities and environmental conditions;
c. Ensuring that the aircraft is adequately controllable using either system, and during the transition from
using one system to the other.

1. System Description Documents (SDD) should identify the provided means for directional control on the
ground, and should classify each means as primary or secondary/emergency.
2. SDD should identify the actuation method for each means of directional control.
3. Analysis should demonstrate that the aircraft is safely controllable on the ground using either primary
or secondary/emergency system throughout all of the conditions through which the aircraft is expected to
operate.
4. System Safety Analysis (SSA) should demonstrate the separation of each directional control system,
and that failure of one system cannot lead to failure of the other system.
demonstrate that the aircraft is safely controllable on the ground using either system through critical
6. Technical Publications should identify the methods and procedures for operating the direction control
systems on the ground.
Information Sources
Comm'l Doc:
A.3.4.1.4.2/A.4.4.1.4.2 Reference: 00-970 P1 4.11.24
Directional control; and 00-970 P1 4.11.27
A.3.4.1.4.3/A.4.4.1.4.3
00-970 P1 4.14.13
Emergency directional control
AFGS-87139: 3.2.5.1 General; 00-970 P7 L302/1 3.1
3.2.5.2 Nose gear steering STANAG 4671.233
system Reference: 4571 745
MIL-S-8812
23.497, 23.499, & 23.745 Reference: CS 23.745
CS 25.233
CS 25.745
8.5.9.2 Steering control system.

The steering control system shall be designed to protect against steering failure such that no credible
combination of failures may cause loss of control of the aircraft.

a. Detecting, preventing and mitigating the effect of failures, including those resulting in full-scale
deflection of steering controls;
b. Ensuring that, given a failure of the steering system resulting in any magnitude of deflection, the
resulting directional movement can be corrected instinctively and acceptably by the pilot using other
controls.

1. System Description Documents (SDD) should identify the full possible range (including the effect of
failures) of steering angles.
2. System Safety Analysis (SSA) should demonstrate that the risk of loss of control of the aircraft resulting
from any credible combination of steering failures is acceptable.
3. Analysis should demonstrate that sufficient control authority is available to counteract the effect of any
magnitude of deflection of aircraft steering, for any expected aircraft condition.
4. Rig, ground and flight testing should demonstrate that the aircraft is controllable despite any possible
magnitude of deflection of the steering system.
Information Sources
Comm'l Doc:
A.3.4.1.4.5.2/A.4.4.1.4.5.2 Reference: 00-970 P1 4.14.6
Response to nose wheel 00-970 P1 4.14.9
steering failure; and
00-970 P1 4.14.13
A.3.4.1.4.5.3/A.4.4.1.4.5.3
Emergency steering
AFGS-87139: 3.2.5.1 General, STANAG 4671.745
3.2.5.2 Nose gear steering Reference:
system
MIL-S-8812
CS 25.1309
8.5.9.3 Steering engagement.

Directional control of the aircraft shall be maintainable with minimal pilot effort throughout engagement
and disengagement of the steering system through all expected manoeuvres and speeds.

a. All expected ground operations and conditions;
b. The effect of intentional, inadvertent and uncommanded engagement and disengagement of the
steering system.

1. System Description Documents (SDD) should identify the controls and required pilot action necessary
to engage and disengage the steering system.
2. SDD should define the characteristics of system engagement and disengagement while applying
steering control inputs, and while performing on-ground directional manoeuvres (controlled through the
steering system or otherwise).
3. Analysis should demonstrate that the aircraft is controllable throughout ground manoeuvres with
intentional, inadvertent and uncommanded engagement and disengagement of the steering system.
4. Simulations should demonstrate that pilots can safely control the aircraft during all anticipated ground
manoeuvres with intentional, inadvertent and uncommanded engagement and disengagement of the
steering system.
5. Rig, ground and flight testing should demonstrate the accuracy of performed analysis and simulations,
and should demonstrate that pilots can safely control the aircraft during critical ground manoeuvres with
intentional, inadvertent and uncommanded engagement and disengagement of the steering system.
6. Technical Publications should identify the method(s) and process for engagement and disengagement
of the wheel steering.
Information Sources
Comm'l Doc:
A.3.4.1.4.5.1/A.4.4.1.4.5.1 Reference: 00-970 P1 4.11.28
Steering Characteristics 00-970 P1 4.14.8
MIL-S-8812
00-970 P1 4.14.9
AFGS-87139: 3.2.5.1 General
00-970 P1 4.14.10
Information Sources
and 3.2.5.2 Nose gear steering STANAG 4671.745
system. Reference:
CS 25.745
CS 25.1309
CS 27.1309
CS 29.1309
8.5.9.4 Merged with 8.5.9.2

8.5.9.5 Steering capability.
The steering system shall enable the aircraft to perform all required ground manoeuvres safely including
taxy, turning, parking, take-off and landing.

a. The range of expected conditions for ground operations, including environmental conditions, surface
conditions and aircraft loading conditions;
b. Interaction between aircraft steering and other directional control systems (rudder, tail rotor,
asymmetric braking, asymmetric thrust, etc.);
c. Requirements for ground handling characteristics, including range of speeds, rates of turn,
acceleration/deceleration, etc.

1. System Description Documents should describe the aircraft's provision for steering.
2. Analysis should demonstrate that the design of the steering system provides adequate ground handling
characteristics through all expected on-ground operating conditions.
demonstrate that the characteristics of the steering system are acceptable for critical expected operating
conditions and ground manoeuvres.
4. Technical Publications should identify the permitted ground manoeuvres.
Information Sources
Comm'l Doc:
A.3.4.1.4.5.1/A.4.4.1.4.5.1 Reference: 00-970 P1 4.11.25
Steering Characteristics 00-970 P1 4.11.26
MIL-S-8812
00-970 P1 4.11.27
00-970 P1 4.14.2
00-970 P1 4.14.3
00-970 P1 4.14.5
00-970 P1 4.14.14
00-970 P1 4.14.16
STANAG 4671.497
Reference: 4671.499
4671.745
23.497, 23.499, 23.745, Reference: CS 23.497
Information Sources
25.233, 25.45, 25.497, 25.499, CS 23.499
& 25.745 CS 23.745
CS 25.45
CS 25.495
CS 25.497
CS 25.499
CS 25.745
CS 27.497
CS 29.497
8.5.10. Landing gear actuation control.

8.5.10.1 Landing gear retraction and extension operation.
Retractable landing gear (where fitted) shall retract and extend (including emergency extension) safely,
and without unintentional contact between moving parts.

a. The appropriate sequencing of separate movements, and prevention of out-of-sequence movement;
b. The effect of manufacturing tolerances, aircraft operation (e.g. expected deformation/creep of
components) and maintenance;
c. The full range of flight conditions during which extension and retraction is required, including
aerodynamic loads and aircraft accelerations.

1. System Description Documents (SDD) should define the provisions for landing gear retraction.
2. SDD should define the characteristics of each landing gear position (UP & LOCKED, UP, IN TRANSIT,
DOWN, and DOWN & LOCKED, etc.);
3. SDD should define the sequencing required to extend and retract the landing gear, including
emergency extension, and the means of prevention of failure of this sequencing;
4. Analysis (e.g. kinematic analysis) should identify the clearance distances between moving parts during
extension and retraction under a variety of operating conditions, and should demonstrate that the landing
gear can retract and extend under any expected operating condition without unintentional contact
between moving parts.
5. Rig, ground, and flight testing should demonstrate the accuracy of performed analysis and should
demonstrate that adequate clearances are maintained throughout landing gear retraction, normal
extension and emergency extension through critical operating conditions (e.g. at the Maximum landing
gear operating speed).
6. Technical Publications should define the procedures for operation of the landing gear, including
emergency extension, and limitations associated with landing gear operation (e.g. the maximum landing
gear operation speed).
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 S4.11.52
A.3.4.1.1.3, A.3.4.1.1.4, Reference:
A.3.4.1.5.1, A.3.4.1.5.2, STANAG
A.4.4.1.1.3, A.4.4.1.1.4, 4761 USAR.729
A.4.4.1.5.1, A.4.4.1.5.2 Reference:
Information Sources
8.5.10.2 Gear extension redundancy.

Retractable landing gear shall be designed with an emergency means of extension which extends the
landing gear to the down and locked position despite any credible combination of failures (including
failure of any single source of hydraulic, electric, or equivalent energy supply, or loss of any landing gear
door) or the position of the normal landing gear selector.

a. Ensuring that failure of the normal landing gear extension/retraction system cannot lead to failure of the
emergency extension system;
b. The variety of aerodynamic loading conditions that could affect the landing gear and associated
panels/doors during flight;
c. Ensuring that the means for actuation of the emergency landing gear extension system is adequately
simple such that a pilot can extend the landing gear quickly and easily, but adequately complex such that
risk of inadvertent extension is minimised.

1. System Description Documents (SDD) should detail the provided means for emergency landing gear
extension.
2. Analysis should demonstrate that the emergency extension means is capable of extending the leading
gear to the down and locked position during any stage of flight and in any aircraft configuration or
environmental condition, and keeping the landing gear locked down for the remainder of any flight.
3. System Safety Analysis (SSA) should demonstrate that no failure of the normal landing gear
extension/retraction system may lead to failure of the emergency extension system.
demonstrate that the emergency extension system is capable of extending the landing gear to the down
and locked position during critical phases of flight, and in critical aircraft loading conditions.
5. Technical Publications should clearly define the provided means for emergency landing gear
extension, detailing the required method for its actuation, and any limitations/restrictions that apply to its
operation.
Information Sources
Comm'l Doc:
A.3.4.1.5.3/A.4.4.1.5.3 Single Reference: 00-970 P1 4.11.60
failure criteria;
A.3.4.1.5.4/A.4.4.1.5.4
Actuation reversal; STANAG 4671.729
A.3.4.1.5.6/A.4.4.1.5.6 Reference:
Operation with loss of door;
and A.3.4.1.5.7/A.4.4.1.5.7
Emergency extension
AFGS-87139: 3.2.6.1
Retraction-extension system;
and 3.2.6.2 Actuation system
indication
Information Sources
CS 27.729
CS 29.729
8.5.10.3 Gear status.

Visual indication shall be provided to indicate to the pilot(s) the position of each retractable landing gear
set. Such indication shall clearly and unambiguously indicate when the landing gear and associated doors
are in the locked up, locked down, and in transit positions.

a. The type, colour and configuration of position indicators;
b. Ensuring that incorrect indication is prevented.

1. System Description Documents (SDD) should identify the means of landing gear indication provided to
the pilots, and the conditions which must be met in order for each indication to be displayed.
2. Analysis should demonstrate that each landing gear position indication can only be displayed when the
landing gear is in the respective condition.
3. System Safety Assessment (SSA) should demonstrate that the risks associated with incorrect landing
gear indication, including errors in maintenance and environmental effects (e.g. corrosion and fouling of
sensors) is acceptable.
demonstrate that the landing gear position indication is clear and unambiguous, and that the landing gear
indication reflects the position of the landing gear at all times.
Information Sources
Comm'l Doc:
A.3.4.1.5.8.1/A.4.4.1.5.8.1 Reference:
Gear position status indicators; STANAG
and A.3.4.1.5.4/A.4.4.1.5.4 4671.729
Actuation reversal Reference: 4671.1793
AFGS-87139: 3.2.6.1
indication
(AMC 25.729(c))
CS 27.729
CS 29.729
8.5.10.4 Position warning system.

Warning devices shall be provided to provide clear warning when the aircraft is close to the ground and
close to landing speeds without the landing gear in the down and locked position. It shall be possible for
the pilot(s) to suppress aural warning.

a. Ensuring that any single warning device is adequate to clearly and unambiguously communicate the
aircraft condition to all pilots;
b. Defining appropriate limits for ground proximity and speed, such that pilots are able to extend the
landing gear by normal or emergency means prior to landing.

1. System Description Documents (SDD) should define the warning devices incorporated to provide clear
warning when the aircraft is close to the ground and close to landing speeds without the landing gear in
the down and locked position.
2. SDD should define the limit(s) for ground proximity and speed at which the warning devices will
operate when the landing gear is not in the down and locked position.
3. SDD should define the means for suppressing aural warnings.
4. Analysis should demonstrate that the warnings provide the pilots with sufficient advanced warning of
the unsafe aircraft configuration to allow any pilot to extend the landing gear by primary means, and in the
event of failure, by the emergency extension means prior to landing.
demonstrate that the pilots are provided with adequate warning of the unsafe landing condition with
enough time to extend the landing gear by normal and emergency means.
Information Sources
Comm'l Doc:
A.3.4.1.5.8.1/A.4.4.1.5.8.1 Reference:
Gear position status indication STANAG
AFGS-87139: 3.2.6.1 4671.1793
Reference:
indication
(AMC 25.729(c))
CS 25.1322
CS 27.729
CS 29.729
8.5.10.5 Gear position speed.

Retractable landing gear shall extend (in both normal and emergency modes) and retract within
acceptable time limits at all airspeeds required for take-off, landing and go-around.

a. Defining maximum time limits for retraction, normal extension and emergency extension of the landing
gear, from selection by the pilot(s) to the landing gear achieving the relevant position;
b. Accounting for system performance and aircraft conditions.
1. System Description Documents (SDD) should define the maximum allowed time for retraction, normal
extension and emergency extension of the landing gear, from selection by the pilot(s) to the landing gear
achieving the relevant position.
2. Analysis should demonstrate that the landing gear retracts and extends under normal and emergency
operating conditions within the maximum time limit under all expected operating conditions.
3. System Safety Assessment (SSA) should demonstrate that the risk associated with degraded
operation of the landing gear extension/retraction mechanism is acceptable.
demonstrate that the landing retracts and extends within the maximum allowed time under normal and
emergency modes through critical operating conditions.
Information Sources
Comm'l Doc:
A.3.4.1.5.5.1/A.4.4.1.5.5.1 Reference: 00-970 P1 4.11.54
Retraction; and 00-970 P1 L54
A.3.4.1.5.5.2/A.4.4.1.5.5.2
Extension
AFGS-87139: 3.2.6.3 STANAG
Retraction-extension time Reference:
25.729, 25.1515, 25.1583 Reference: CS 25.1583
8.5.10.6 Merged with 8.5.10.5.

8.5.10.7 Gear position restraint.
Retractable landing gear shall provide an automatic means to lock the landing gear in the selected
position which does not require any power (electric, hydraulic etc.) after reaching the locked position, and
which can secure the gear in each position under all expected ground and flight conditions.

a. Ensuring that adequate means are provided to ensure that risk associated with unsecured landing gear
is acceptable;
b. Incorporating multiple means of securing the landing gear, such as mechanical (springs, over-centre
joints, etc.) and hydraulic methods (e.g. hydraulic locking), particularly in the extended position;
c. Ensuring that the emergency extension system can release and/or overcome any restraint securing the
landing gear in the retracted position, and can secure the gear in the extended position.

1. System Description Documents (SDD) should detail the provided means for securing the landing gear
in each selectable position.
2. Analysis should demonstrate that extension and retraction will always result in the securing of the
landing gear in the respective position, under any expected operating condition.
3. Analysis should demonstrate that when secured in any selectable position, no expected operating
condition or combination of failures could result in the landing gear becoming unsecured without total
failure of the landing gear structure.
4. Analysis should demonstrate that the provided means for emergency extension can release and/or
overcome any restraint securing the landing gear in the retracted position, and can secure the gear in the
extended position.
demonstrate that the landing gear can be secured in all selectable positions through critical operating
conditions.
Information Sources
Comm'l Doc:
A.3.4.1.5.9.1/A.4.4.1.5.9.1 Reference: 00-970 P7 L306 4.1
Gear position restraint and 00-970 P7 L306 4.2
A.3.4.1.5.1/A.4.4.1.5.1
Retraction and extension
actuation interface STANAG 4671.729(b)
AFGS-87139: 3.2.6.4 Position Reference:
restraint
FAA Doc: 14CFR reference: 23.729, EASA CS CS 23.729(b)
25.729 Reference: CS 25.729(b)
CS 27.729(b)
CS 29.729(b)
8.5.10.8 Gear position restraint for ground operations.

Retractable landing gear shall incorporate a secondary means to secure each landing gear in the
extended position and prevent unintentional retraction during ground operations. Such secondary means
shall secure each landing gear in the extended position despite selection of landing gear retraction
without structural damage to any part of the aircraft, and shall incorporate visual indications to clearly
indicate to operators that the means are fitted.

a. The adequacy of visual indicators, such that the security of landing gear in the down position is clear
and unambiguous to ground and flight crew when performing normal pre-flight/ground checks;
b. The strength of the landing gear and resulting loads, ensuring that the strength is adequate to
withstand the forces arising from attempted landing gear retraction with the secondary securing means in
place, on the ground, on jacks, and in flight.

1. System Description Documents (SDD) should identify the provided means for secondary securing of
the landing gear in the extended position on the ground, including the means for visual indication to
operators.
2. Analysis should demonstrate that attempted retraction of the landing gear with the secondary securing
means fitted cannot result in landing gear retraction (e.g. due to failure of the securing means) or
permanent deformation of any part of the aircraft in any expected ground or flight condition (including
aircraft on jacks).
demonstrate the adequacy of provided visual indication means and that selection of landing gear
retraction with the provided security means fitted does not result in landing gear retraction or permanent
deformation of any part of the aircraft.
4. Technical Publications should detail the process for fitment and removal of the means to secure the
landing gear in the extended position.
5. Technical Publications should detail the visual indication means provided to operators to indicate that
the secondary securing means is fitted to the landing gear.
Information Sources
Comm'l Doc:
A.3.4.1.5.9.1/A.4.4.1.5.9.1 Reference: 00-970 P7 L306 4.3
Gear position restraint and 00-970 P7 L306 4.4
A.3.4.1.5.1/A.4.4.1.5.1
Retraction and extension
actuation interface STANAG
AFGS-87139: 3.2.6.4 Position Reference:
restraint
FAA Doc: EASA CS
Reference:
8.5.10.9 Merged with 8.5.10.8

8.5.10.10 Fail-safe provisions.
For retractable landing gear, no credible combination of failures shall lead to failure of the positive
engagement of the landing gear in any selectable position, or failure of the emergency extension means.

a. Combination of detectable and dormant failures;
b. Failure of power supply systems (electrical, hydraulic, mechanical, etc.).

1. System Safety Assessment (SSA) should demonstrate that the risk of failure of landing gear positive
engagement, and failure of the emergency extension means is acceptable.
Information Sources
Comm'l Doc:
3.2.7.4.4.2/4.2.7.4.4.2 Damage Reference:
tolerant-fail safe evident STANAG
subsystems and components; 4671.729
and Appendix A: Reference:
A.3.4.1.5.3/A.4.4.1.5.3 Single
failure criteria
AFGS-87139: 3.2.6.1
Retraction-extension system
indication
CS 27.729
CS 29.729
8.5.11. Auxiliary deceleration devices.

8.5.11.1 Aircraft arrestment performance.
The aircraft shall be designed to be compatible with specified arresting systems (if any) (including both
barrier/barricade and cable types) such that use of any such system can decelerate the aircraft to a stop
for all expected conditions without damage to the aircraft or the arresting system(s).

a. The range of arresting systems with which the aircraft will be permitted to operate.
b. The range of expected manoeuvres where the arresting system may operate, including landing (fly-in
engagements, brake overruns, etc.) and take-off (e.g. Rejected Take-off (RTO));
c. The range of expected conditions where the arresting system may operate, including all expected
aircraft weights, CofG positions and speeds, air velocities (including crosswinds, tailwinds, etc.), surface
conditions, and environmental conditions;

1. System Description Documents (SDD) should define the arresting systems (if any) with which the
aircraft is permitted to operate, and the permitted manoeuvres that utilise such systems.
2. SDD should define the aspects of the aircraft design which allow operation with arresting systems.
3. Analysis should demonstrate that the aircraft can perform the permitted manoeuvres with the permitted
arresting systems, and should define the resulting loads through the aircraft for all expected operating
conditions.
4. Analysis should demonstrate that the loads associated with critical manoeuvres and critical arresting
systems are reacted through the aircraft structure without permanent deformation of any part of the
aircraft or arresting system.
demonstrate that critical manoeuvres using critical arresting systems decelerates the aircraft to a stop
without permanent deformation of any part of the aircraft or arresting system.
Information Sources
A.3.4.1.8.1.1 thru Reference: 00-970 P1 2.4.3
A.3.4.1.8.1.8/A.4.4.1.8.1.1 thru 00-970 P1 2.5.22
A.4.4.1.8.1.8 Hook/Arresting
00-970 P1 4.11.24
system information
MIL-A-18717 00-970 P1 4.11.26
MIL-A-83136 00-970 P1 4.11.35
00-970 P1 L46 3.5.7
00-970 P13 3.6.7
00-970 P13 3.6.8
00-970 P13 3.6.20
00-970 P13 3.6.24
00-970 P13 3.6.25
00-970 P13 3.6.26
00-970 P13 S4 L10
00-970 P13 S4 L10
00-970 P9 UK471a
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.5.11.2 Arresting hook system.

The arresting hook system (where fitted) shall provide sufficient hook hold-down force and damping to
prevent the hook skipping over the arresting cable, for all expected landing configurations and attitudes.

a. The minimum expected height of the arresting cable from the ground, taking account of the effect of
depression of the cable by aircraft wheels, effects of landing off-centre, and the range of cable tensions
that may be encountered;
b. The maximum height of the arresting hook pivot point from the ground, taking account of expected
variations in aircraft weight and CofG position, aerodynamic forces and engine thrust.

1. System Description Documents (SDD) should define the provisions for arresting hook hold-down and
damping.
2. Analysis should demonstrate that the arresting hook cannot skip over an arresting cable for all
expected landing configurations and attitudes.
demonstrate that the arresting hook does not skip over an arresting cable for critical landing
configurations and attitudes.
4. System Safety Assessment (SSA) should demonstrate that the risk of the arresting hook skipping over
an arresting cable is acceptable.
Information Sources
A.3.4.1.8.1.1 thru Reference: 00-970 P1 2.4.3
A.3.4.1.8.1.8/A.4.4.1.8.1.1 thru 00-970 P1 2.5.22
A.4.4.1.8.1.8 Hook/Arresting
00-970 P1 4.11.24
system information
MIL-A-18717 00-970 P1 4.11.26
MIL-A-83136 00-970 P1 4.11.35
AFGS-87139: 3.2.7.1 Arresting 00-970 P1 L46 3.5.7
hook system 00-970 P13 3.6.7
00-970 P13 3.6.8
00-970 P13 3.6.20
00-970 P13 3.6.24
00-970 P13 3.6.25
00-970 P13 3.6.26
00-970 P13 S4 L10
00-970 P9 UK471a
STANAG 4671 U590
Reference:
FAA Doc: EASA CS
Reference:
8.5.11.3 Hook actuation.

If an arresting hook is fitted, it shall be possible for flight crew to lower, and if necessary, raise the hook
within an acceptable time. An indication shall also be provided to inform the flight crew of the hook
position.

a. Defining an acceptable time limit for hook extension and retraction;
b. Ensuring that the provided means to control the hook is appropriate;
c. Ensuring that indications provided to flight crew clearly and unambiguously identify whether the hook is
secured in deployed and retracted positions.

1. System Description Documents (SDD) should define the means for actuation of the hook provided to
the flight crew, and the required time for deployment and retraction of the hook.
2. Analysis should demonstrate that the time to deploy and retract the hook is acceptable for all flight
conditions.
3. Rig, ground and flight testing should demonstrate the accuracy of the performed analysis and should
demonstrate that the time to deploy and retract the hook is acceptable for critical flight conditions, and
that indications provided to the flight crew clearly communicate the position and status of the hook.
4. Technical Publications should identify the procedure for extending and retracting the arresting hook.
Information Sources
A.3.4.1.8.5 thru Reference: 00-970 P1 L41
A.3.4.1.8.8/A.4.4.1.8.5 thru 00-970 Pt 13 3.6.12
A.4.4.1.8.8
00-970 Pt 13 3.6.14
MIL-A-18717
00-970 Pt 13 S4 L10
MIL-A-83136
AFGS-87139: 3.2.7.1 Arresting STANAG
hook system. Reference:
FAA Doc: EASA CS

Reference:
8.5.11.4 Snag prevention.

The aircraft shall be designed such that no part of the aircraft except the arresting hook, including
structure, landing gear or stores, snags the arresting cable under normal operating conditions and with
any landing gear set rolling on rims (e.g. following tyre failure(s)).

a. The maximum height of the arresting cable from the ground, taking into account the various arresting
systems with which the aircraft is permitted to operate;
b. The minimum height of aircraft structure and stores from the ground, taking into account the various
permitted loading configurations, aircraft weights, CofG positions and aerodynamic forces.
c. Critical positions of movable parts of the aircraft (e.g. control surfaces, landing gear doors, etc.)

1. Analysis should identify the clearance between critical parts of the aircraft and the ground during
ground operations and should demonstrate that no part of the aircraft except the arresting hook can snag
on arresting cables under any expected operating condition including with any landing gear set rolling on
rims (e.g. following tyre failure(s)).
2. Rig, ground and flight testing should demonstrate the accuracy of performed analysis by verifying the
clearance between critical parts of the aircraft and the ground during ground operations.
Information Sources
DoD/MIL Doc: MIL-A-18717 Def-Stan 00-970 00-970 P1 4.11.33
MIL-A-83136 Reference: 00-970 P1 4.13.7
AFGS-87139: 3.2.7.1 Arresting 00-970 P1 4.13.8
hook system. 00-970 P1 S4 L43
00-970 P1 S4 L60
00-970 P1 6.1.18
00-970 P13 S4 L10
00-970 P7 S1 L300 2.1
00-970 P7 S1 L302/2 8.1
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.5.11.5 Drag parachutes.

Drag parachutes (where fitted) shall provide adequate drag force to decelerate the aircraft without
causing excessive loads or damage to the aircraft, or an unacceptable effect on the handling/stability of
the aircraft under any permitted operating condition.

a. The full range of operating conditions within which drag parachute operation is permitted, including
aircraft loading conditions (mass and CofG position), aircraft speeds, environmental conditions (e.g.
temperature, rain, snow, dust, etc.), wind velocities and gust conditions.
b. Providing automatic and/or manual means for jettison of the drag parachute.
c. The stability of the parachute, and variation in the resulting loads on the aircraft's structure.

1. System Description Documents (SDD) should define the provisions made for deployment of drag
parachutes.
2. Analysis should demonstrate that drag parachutes can be deployed and decelerate the aircraft
effectively without causing excessive loads or damage to the aircraft, or an unacceptable effect on the
handling/stability of the aircraft under any permitted operating condition.
3. Analysis should demonstrate that the loads that can be induced by the drag parachute do not cause
permanent deformation of any part of the aircraft.
demonstrate that the drag parachute can be deployed during landing without causing excessive loads or
damage to the aircraft, or an unacceptable effect on the handling/stability of the aircraft under any
permitted operating condition.
5. Technical Publications should detail the procedure for operating drag parachutes, and should clearly
define any limitations or restrictions associated with their use.
Information Sources
Comm'l Doc:
A.3.4.1.8.2/A.4.4.1.8.2 Drag 00-970 P1 2.4.3
Information Sources
Chutes; and AFGS-87139 Reference: 00-970 P1 2.5.22
3.2.7.2 Drag Chutes. 00-970 P1 4.11.24
MIL-D-9056
00-970 P1 4.11.26
00-970 P1 4.11.35
00-970 L42 4.6
00-970 L46 3.5.7
00-970 P13 3.13.2
00-970 P13 3.13.3
00-970 P13 3.13.5-3.13.7
00-970 P13 3.13.9-3.13.11
00-970 P13 3.13.14
00-970 P13 3.13.15
00-970 P9 UK471a
00-970 P9 UK471d
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.5.11.6 Auxiliary deceleration systems.

Any other auxiliary deceleration systems (thrust reversers, speed brakes, etc.) shall provide adequate
aircraft deceleration without causing any unsafe condition due to system operation or failure under any
expected operating condition.

a. Concurrent use of multiple deceleration systems;
b. Maximising aircraft control;
c. The full range of resulting loads arising from operation of deceleration systems, and where systems
can be operated concurrently, combination of these loads;

1. System Description Documents (SDD) should define the various deceleration systems fitted to the
aircraft, including systems where deceleration is a secondary function (e.g. flight control surfaces).
2. Analysis should demonstrate that concurrent operation of aircraft deceleration systems cannot result in
excessive loads on the aircraft structure.
demonstrate that concurrent operation of deceleration systems does not result in excessive loads on the
aircraft or unacceptable handling characteristics.
4. Technical Publications should detail the procedures for operation of deceleration systems, and any
restrictions or limitations on their concurrent operation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: AFGS-87139: 3.2.7.1 Arresting Def-Stan 00-970 00-970 P1 2.3.21
hook system; and 3.2.7.2 Drag Reference: 00-970 P1 2.4.3
chutes. 00-970 P1 2.5.22
00-970 P1 4.11.24
Information Sources
00-970 P1 4.11.26
00-970 P1 4.11.35
00-970 P1 L46 3.5.7
00-970 P1 5.1.53
00-970 P1 5.1.54
00-970 P1 5.1.55
00-970 P1 5.1.138
00-970 P9 UK471a
00-970 P9 UK471d
STANAG 4671.933
Reference:
CS 23.1155
CS 25.109
CS 25.125
CS 25.507
CS 25.933
CS 25.934
CS 25.1155
CS 29.62
8.5.11.7 Merged with 8.5.11.1.

8.5.12. Ground handling.
8.5.12.1 Jacking provisions.
Aircraft jacking points (where required) shall enable the aircraft to be raised to a height such that required
maintenance activities can be conducted effectively. Where necessary, any restrictions/limitations
associated with jacking of the aircraft (e.g. permitted jacks, aircraft weight, CofG position, environmental
condition, ground slope, wind velocities, operation of flying control surfaces, etc.) shall be stated in the
appropriate manual.

a. Critical combinations of aircraft weight and CofG;
b. The minimum and maximum required heights for jacking for maintenance activities;
c. Ensuring that jacking points are compatible with maintenance jacks that meet appropriate standards
(e.g. AS4775B).

1. System Description Documents (SDD) should define the provided provisions for aircraft jacking,
including the minimum and maximum permitted jacking heights.
2. Analysis should demonstrate that jacking of the aircraft in accordance with defined procedures cannot
result in any unsafe condition (e.g. over-stress of aircraft parts, failure of any approved jack, or
unintentional movement of the aircraft).
demonstrate that the aircraft can be jacked safely in accordance with defined procedures.
4. Technical Publications should define the procedures for safe aircraft jacking, including any
restrictions/limitations associated with jacking of the aircraft (e.g. aircraft weight, CofG position,
environmental condition, ground slope, wind velocities, operation of flying control surfaces, etc.).
Information Sources
Comm'l Doc:
A.3.4.1.2.2.1.1/A.4.4.1.2.2.1.1 Reference: 00-970 P1 4.4.11-4.4.16
Axle jacking; and 00-970 P7 L308 S3
A.3.4.1.2.2.1.2/A.4.4.1.2.2.1.2
STANAG 3098
Fuselage jacking
Reference: 4671.507
AFGS-87139: 3.2.8.1 Jacking
NATO STANAG 3098
Reference: CS 25.519(b)
8.5.12.2 Merged with 8.5.12.1.

8.5.12.3 Towing.
Aircraft towing points (where required) shall enable the aircraft to be towed and pushed safely in all
expected directions, in all expected aircraft conditions and on all expected ground surfaces, including
slopes. Where necessary, any restrictions/limitations associated with towing or pushing of the aircraft
(e.g. towing/pushing equipment, towing/pushing speeds, aircraft weight, CofG position, environmental
condition, ground slope, wind velocities, operation of flying control surfaces, etc.) shall be stated in the
appropriate manual.

b. Ensuring that towing points are compatible with towing equipment that meet appropriate standards
(e.g. ARP1915E);
c. Incorporating design features that prevent load transmitted to the aircraft from causing structural
damage (e.g. shear pins);
d. Ensuring that towing points are readily accessible for ground personnel and are appropriately marked;
e. Ensuring compatibility with any steering systems.

1. System Description Documents (SDD) should define the provided provisions for aircraft towing and
pushing.
2. Analysis should demonstrate that towing/pushing of the aircraft in accordance with defined procedures
cannot result in any unsafe condition (e.g. over-stress of aircraft parts, failure of any approved
towing/pushing equipment, or unintentional movement of the aircraft).
demonstrate that the aircraft can be towed and pushed safely in accordance with defined procedures.
4. Technical Publications should define the procedures for safe aircraft towing and pushing, including any
restrictions/limitations associated with towing/pushing of the aircraft (e.g. towing/pushing equipment,
towing/pushing speeds, aircraft weight, CofG position, environmental condition, ground slope, wind
velocities, operation of flying control surfaces, etc.).
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: NATO STANAG 3278 Def-Stan 00-970 00-970 P1 3.11.4-3.11.7
NATO STANAG 4101 Reference: 00-970 P1 4.4.21-4.4.23
MIL-STD-805 00-970 P7 L308 S4
JSSG-2009 Appendix A: 00-970 P7 L308/1 S2.1
A.3.4.1.2.2.1.3/A.4.4.1.2.2.1.3
Landing gear towing; STANAG 3278
A.3.4.1.2.2.1.5/A.4.4.1.2.2.1.5 Reference: 4101
Towing interface 4671.509
AFGS-87139: 3.2.8.2 Towing
CS 25.745
8.5.12.4 Emergency towing.

Aircraft towing points shall be provided to enable the aircraft to be towed and pushed safely in an
emergency, with the aircraft loaded at the maximum permitted weight and critical CofG positions, in any
environmental condition and over the roughest ground that may reasonably be expected.

a. Specifying permitted equipment for emergency towing;
b. Minimising any damage to the aircraft that may result from emergency towing;
c. Ensuring that towing points are readily accessible for ground personnel and are appropriately marked;
d. Ensuring compatibility with any steering systems.

1. System Description Documents (SDD) should define the provided provisions for aircraft emergency
towing and pushing.
2. System Safety Analysis should demonstrate that risk associated with emergency towing/pushing of the
aircraft in accordance with defined procedures is acceptable.
3. Technical Publications should define the procedures for safe aircraft emergency towing and pushing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 3.11.4-3.11.7
A.3.4.1.2.2.1.4/A.4.4.1.2.2.1.4 Reference: 00-970 P1 4.4.21-4.4.23
Emergency towing 00-970 P7 L308 S4
AFGS-87139: 3.2.8.2 Towing
00-970 P7 L308/1 S2.1
STANAG 4671.509
Reference:
CS 25.745
8.5.12.5 Mooring.
Aircraft mooring points (where required) shall enable the aircraft to be moored safely at any permitted
aircraft weight. Where necessary, any restrictions/limitations associated with mooring of the aircraft (e.g.
permitted mooring equipment, CofG position, environmental condition, wind velocities, operation of flying
control surfaces, etc.) shall be stated in the appropriate manual.

a. The number of mooring points required;
b. Different mooring patterns, attachment details and mooring methods;
c. Mooring on land and on board ships.

1. System Description Documents (SDD) should define the provided provisions for aircraft mooring.
2. Analysis should demonstrate that mooring of the aircraft in accordance with defined procedures cannot
result in any unsafe condition (e.g. over-stress of aircraft parts, failure of any approved mooring
equipment, or unintentional movement of the aircraft).
demonstrate that the aircraft can be moored safely in accordance with defined procedures.
4. Technical Publications should define the procedures for safe aircraft mooring including any
restrictions/limitations associated with mooring of the aircraft (e.g. permitted mooring equipment, CofG
position, environmental condition, wind velocities, operation of flying control surfaces, etc.).
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix A: Def-Stan 00-970 00-970 P1 3.12.2-3.12.5
A.3.4.1.2.2.1.6/A.4.4.1.2.2.1.6 Reference: 00-970 P1 3.12.10
Mooring provisions STANAG
AFGS-87139: 3.2.8.3. Mooring 4671.415
Reference:
8.5.12.6 Specialised systems.

Specialised landing gear systems (where required) shall be safe for all expected functions. Where
necessary, any restrictions/limitations associated with operation or use of such specialised equipment
shall be stated in the appropriate manual.

a. The purpose and functions of such specialised landing gear systems, and the missions or operational
situations for which the systems could be used;
b. Aircraft handling characteristics with specialised landing gear systems installed;
c. The various ways in which the incorporation of such specialised systems could affect the aircraft's
existing systems/structure.

1. System Description Documents (SDD) should define any specialised landing gear systems which are
fitted or may be fitted to the aircraft.
2. System Safety Assessment (SSA) should demonstrate that the risk associated with aircraft operation,
including ground operations, landing and take-off with specialised landing gear in any possible
configuration/position is acceptable.
3. Analysis should demonstrate that loads arising from aircraft operation including ground operations,
landing and take-off with specialised landing gear in any possible configuration/position cannot result in
failure/detachment of any part of the specialised system or permanent deformation of any other part of
the aircraft.
demonstrate that the aircraft can be operated safely with specialised landing gear in any possible
configuration/position.
4. Technical Publications should define the procedures for operation of specialised landing gear systems,
including any restrictions/limitations associated with their use (e.g. aircraft weight, CofG position,
Information Sources
Comm'l Doc:
A.3.4.1.10.1 thru Reference:
A.3.4.1.10.2/A.4.4.1.10.1 thru STANAG
A.4.4.1.10.2 Flotation and 4671.477-481
snow ski gear Reference: 4671.497
AFGS-87139: 3.2.9.1 General
CS 23.751
CS 25.1309
CS 27.505
CS 27.737
CS 27.751
CS 29.505
CS 29.737
CS 29.751
8.5.12.7 Merged with 14.2.3.

8.5.12.8 Merged with 8.5.2.2.
8.5.12.9 Ground Foreign Object Damage (FOD).
The landing gear shall be arranged to minimise the risk of Foreign Object Damage (FOD) or water
ingestion to the engines or auxiliary power unit during take-off, landing and taxiing.

a. The relative position of the engine inlets / auxiliary power unit inlet and the landing gear;
b. The various foreign objects that could damage the engines or auxiliary power unit, including those
present on ground surfaces (gravel, mud, etc.), and those that could result from failure of aircraft parts
(e.g. tyre/wheel shrapnel).

1. Analysis should demonstrate that the arrangement of the landing gear is such that FOD or water
ingestion to the engines or auxiliary power unit is minimised during take-off, landing and taxiing.
2. System Safety Analysis (SSA) should demonstrate that the risk of FOD or water ingestion due to the
location of the landing gear is acceptable, including failures of the landing gear.
demonstrate that the location of the landing gear does not cause any unacceptable FOD or water
ingestion to the engines or auxiliary power unit.
Information Sources
Comm'l Doc:
A.3.4.1.2.3/A.4.4.1.2.3 Ground Reference:
FOD STANAG
AFGS-87139: 3.2.1.1 General, 4671.1091
Reference:
3.2.1.2 Arrangement; and
3.2.1.3 Clearances.
CS 27.1091
CS 29.1091
8.5.12.10 Structural Interface.

The landing gear systems shall be compatible with the aircraft structure, weight, balance and interfacing
subsystems. This includes ensuring the arrangement, location and interface supports the aircraft at all
specified loading conditions, for all specified operating conditions, within specified environmental
conditions.

a. The most adverse combination of C of G and gross weight;
b. Environmental conditions, to be agreed and verified;
c. Specified operating conditions, to be agreed and verified;
d. Specified loading conditions, to be agreed and verified;
e. Loads from operation over the roughest ground that may reasonably be expected in normal operation;
f. Brake torque characteristics,
g. The brake metering system and its components,
h. Hydraulic flow requirements,
i. Aircraft and landing dynamic characteristics, including shock absorber, brake, and tyre dynamics;
j. Total aeroplane stopping performance requirements;
k. Relevant characteristics of the tyres;
l. The aircraft electrical and electronic systems;
m. Aircraft interface requirements to be agreed and verified.

1. System Interface Documents (SID) should define all interfaces between the landing gear and other
parts of the aircraft, including both structures and systems interfaces.
2. Analysis should demonstrate that the loads through the landing gear resulting from any expected
operating condition are reacted through the aircraft structure without any permanent deformation of any
part of the aircraft.
3. System Safety Analysis (SSA) should demonstrate that the risk associated with integration of landing
gear power operated systems into the aircraft systems is acceptable.
demonstrate that operation of the aircraft in critical operating conditions is safe, and does not result in
permanent deformation of any part of the aircraft, or failure of any power supply system or power
operated system.
Information Sources
Comm'l Doc: Level II Interface and
Functional Requirements as
stated in contractual interface
documentation.
DoD/MIL Doc: AFGS-87139: 3.2.1.1 General; Def-Stan 00-970 00-970 P1 4.11.2
3.2.1.2 Arrangement; and Reference: 00-970 P1 4.12.6
3.2.1.3 Clearances. STANAG 4671.23-4671.29
Reference:
FAA Doc: 14CFR reference: 23.471- EASA CS CS 23.23-23.29
23.511, 25.471-25.519 Reference: CS 25.23-25.29
CS 27.25
CS 27.27
CS 29.25
CS 29.27
8.5.12.11 Landing gear system integrity.

No credible combination of failure of the landing gear (including single-point failures, dormant failures,
and failure of any interfacing system) shall result in any uncommanded or unsafe effect or function of the
landing gear.

a. Integrity of the structure, braking, steering control and retraction / extension systems;
b. The inclusion of sufficient redundancy within the given systems;
c. The use of reserve power supply for power operated systems;
d. Any reasonably credible combination of failures in externally provided power or governing control logic
(for example electrical, hydraulic, etc.);
e. Any reasonably credible combination of failures in interfacing systems;
f. Acceptable levels of risk.

1. System Interface Documents (SID) should define all interfaces between the landing gear and other
parts of the aircraft, including both structures and systems interfaces, and the risk of functional failure of
those interfacing structures/systems.
2. System Safety Analysis (SSA) should demonstrate that the risk associated with credible combinations
of failure of the landing gear and interfacing structures/systems is acceptable, and that no uncommanded
or unsafe effect or function of the landing gear can result.
3. Rig, ground and flight testing should demonstrate that severe risks do not result in uncommanded or
unsafe effects or functions of the landing gear.
Information Sources
Comm'l Doc: Level II single
point/redundancy
requirements.
Information Sources
DoD/MIL Doc: JSSG-2009: 3.2.7 - 3.2.7.6.5, Def-Stan 00-970 00-970 P1 4.11.62
4.2.7 - 4.2.7.6.5 Reference:
STANAG 4671.1309
Reference:
FAA Doc: TSO C77b EASA CS CS 23.471-23.511
CS 25.471-25.511
CS 25.1309
CS 27.471-27.521
CS 27.1309
CS 29.471-29.521
CS 29.1309
8.5.12.12 Damage tolerance.

No partial failure of the landing gear (due to fatigue, leakage, corrosion, defects, damage, etc.) shall result
in reduction of flight safety.

a. The typical loading spectra, temperatures, and humidity expected in service;
b. The identification of principal structural elements and detailed design points, the failure of which could
cause catastrophic failure.

1. System Safety Analysis (SSA) should demonstrate that no partial failure results in reduction of flight
safety.
Information Sources
Comm'l Doc: Level II Damage Tolerance
requirements.
3.2.2.2 Shock absorption; and Reference:
3.2.2.3 Tail bumpers. STANAG 4671.57
Reference:
CS 27.571
CS 27.573
CS 29.571
CS 29.573
8.5.12.13 Failures and leakage.

Failure and partial failure (e.g. leakage) of the landing gear system or components shall be evident to the
flight and/or maintenance personnel.

a. The required inspection schedule, to minimise aircraft operation with failures;
b. Incorporation of Built In Test Equipment (BITE).

1. Technical Publications should define the inspection procedures and schedule for landing gear systems.
2. System Safety Assessment (SSA) should demonstrate that risk associated with aircraft operation,
including the effect of dormant landing gear failures, is acceptable.
Information Sources
Comm'l Doc: Level II Damage Tolerance
requirements and
Maintainability requirements.
3.2.2.2 Shock absorption; and Reference: 00-970 P1 4.4.6
3.2.2.3 Tail bumpers. 00-970 P1 4.4.7
STANAG 4671.57
Reference:
25.571 Reference: CS 23.1309
CS 25.571
CS 25.611
CS 27.571
CS 27.573
CS 27.611
CS 29.571
CS 29.573
CS 29.611
8.5.12.14 Lift points.

Aircraft lifting points (where required) shall enable the aircraft to be lifted to a height such that required
maintenance activities can be conducted effectively. Where necessary, any restrictions/limitations
associated with lifting of the aircraft (e.g. permitted lifting equipment, aircraft weight, CofG position,
environmental condition, ground slope, wind velocities, operation of flying control surfaces, etc.) shall be
stated in the appropriate manual.

b. The minimum and maximum required heights for lifting for maintenance activities;
c. Ensuring that lifting points are compatible with lifting equipment that meet appropriate standards (e.g.
AS5944).

1. System Description Documents (SDD) should define the provided provisions for aircraft lifting,
including the minimum and maximum permitted lifting heights.
2. Analysis should demonstrate that lifting of the aircraft in accordance with defined procedures cannot
result in any unsafe condition (e.g. over-stress of aircraft parts, failure of any approved lifting equipment,
or unintentional movement of the aircraft).
demonstrate that the aircraft can be lifted safely in accordance with defined procedures.
4. Technical Publications should define the procedures for safe aircraft lifting, including any
restrictions/limitations associated with lifting of the aircraft (e.g. aircraft weight, CofG position,
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1472, paragraphs Def-Stan 00-970 00-970 P1 3.11.2
5.9.11.3 through 5.9.11.3.9 Reference: 00-970 P1 4.4.10
(unverified) 00-970 P1 4.4.17 to 4.4.20
00-970 P7 L308 2.1
STANAG 4671.507
Reference:
FAA Doc: EASA CS
Reference:
8.5.12.15 Operator interface.

Adequate means at crew/operator station shall be available to the flight crew to assess the operational
condition of the landing and deceleration systems.


2. Rig, ground and flight testing should demonstrate the effectiveness of the provided operator interface.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P 4.15
Reference:
STANAG 4671.729
4671.1835
CS 25.729
(AMC 25.729(c))
CS 25.1322
CS 27.729
CS 29.729
8.5.12.16 Technical manuals.

operation of the landing gear system
1. The level of detail necessary to provide accurate technical information while remaining concise;
2. The information, at the appropriate level of detail, required to allow personnel to operate and maintain

information.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1585
CS 25.1583
CS 25.1585
CS 25.1587
CS 27.1585
CS 29.1585
8.5.12.17 Qualification testing.

All landing gear and deceleration system components, either individually or as part of a landing gear and
deceleration subsystem, shall pass all required qualification tests to ensure their suitability for use in all
expected usage and environmental conditions.

a. A wide variety of qualification tests such as: proof, burst, vibration, containment, over-speed,
acceleration, explosive atmosphere, pressure cycling, and temperature cycling.
b. Conducting qualification in accordance with appropriate existing standards, where such standards
exist; and,
c. Creating appropriately detailed procedures for qualification where existing standards do not exist.

1. Qualification Test Procedures (QTP) should define the qualification tests necessary to demonstrate the
suitability of components to perform their intended function;
2. Qualification Test Reports (QTR) should record the conduct and results of qualification testing in
accordance with the relevant QTP or other existing, relevant standard;
3. Declarations of Design Performance (DDP) should record the scope of qualification, the intended
function, and suitability to perform that function for each component; and,
4. Rig, ground and flight testing should demonstrate the correct function of all components when installed
as part of the system.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.12.4
00-970 P1 4.14.19
00-970 P1 4.14.20
STANAG 4671.723-4671.727
Reference:
CS 27.723-27.727
CS 29.723-29.727
8.5.12.18 Installation.
The landing gear system as installed to the aircraft shall pass all required tests to demonstrate its
suitability for use in all expected usage and environmental conditions.

a. Ensuring all tests must be conducted on systems which are fully representative of the type design;
b. Functioning of both normal and emergency systems.

1. Test Procedures should define the tests necessary to demonstrate the suitability of the landing gear to
perform its intended functions;
2. Test Reports should record the conduct and results of testing in accordance with the relevant Test
Procedure.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.11.76
STANAG 4671.729
Reference:
Information Sources
CS 27.729
CS 29.729
8.5.13 Parachute landing system.

8.5.13.1 Safe and reliable operation.
Parachute landing systems (where fitted) shall be safe and reliable.
Note that parachute landing systems are parachute systems designed to provide means for aircraft
landing, as opposed to parachutes which slow the aircraft, for example during landing, as covered by
section 8.5.11.5.

a. Appropriate levels of safety and reliability, taking into account the frequency and circumstance of
parachute landing system operation.

1. System Description Documents (SDD) should define any provided parachute landing system(s).
2. System Safety Analysis (SSA) should demonstrate that the risk associated with operation of the
parachute landing system is acceptable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 Part 9
Reference: 00-970 UK FW.U599a
4671 USAR.U292
4671 USAR.U293
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
8.5.13.2 Aborted landing.

At any stage of the parachute landing procedure prior to deployment of the landing parachute, it shall be
possible to abort the parachute landing and continue to normal flight.

a. The range of aircraft operating conditions through which the parachute landing procedure may be
initiated, and therefore aborted.
b. Any specific flight handling or performance requirements applicable to the transition from aborted
landing to safe continued flight.
1. Technical Publications should define the parachute landing procedure, including the stages through
which landing may be aborted, and any procedures required for safe continued flight.
2. System Safety Assessment (SSA) should demonstrate that the risk associated with aborting parachute
landing from any stage prior to deployment of the parachute is acceptable.
3. Analysis should demonstrate that it is possible to abort a parachute landing at any stage prior to
parachute deployment and return to safe continued flight at any expected operating condition.
4. Rig and flight testing should demonstrate the accuracy of performed analysis and should demonstrate
that it is possible to abort a parachute landing at any stage prior to parachute deployment and return to
safe continued flight at critical operating conditions.
Information Sources
Comm'l Doc:
Reference:
Reference:
FAA Doc: EASA CS
Reference:
8.5.13.3 Merged with 5.1.1.

8.5.13.3.1 Parachute deployment.
Parachute deployment systems/devices shall not adversely affect the airworthiness of other aircraft
systems or the structural integrity of the aircraft.

a. The airworthiness of all power supply systems and power operated systems in the vicinity of the
parachute landing system, and those systems which interface with the parachute landing system;
b. Parachute deployment loads in combination with existing aircraft loads and their effect on static and
fatigue strength.

1. System Safety Assessment (SSA) should demonstrate that the installation, operation and failure of
parachute landing systems (including parachute deployment systems) does not adversely affect the
airworthiness of existing aircraft systems.
2. Analysis should demonstrate that the incorporation of parachute deployment loads into existing aircraft
loads does not compromise the structural integrity of the aircraft, or unacceptably reduce the aircraft's
fatigue life.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
CS 25.1301
Information Sources
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
8.5.13.4 Minimization of dragging.

Dragging of the aircraft following parachute landing shall be minimized.

a. The full range of conditions in which parachute landing may be performed, including surface conditions,
wind velocities and aircraft weights;
b. The effect of inadvertent landing in an unexpected attitude (e.g. inverted);
c. The incorporation of design features to minimize dragging, including detachment/jettison of parachutes
following landing.

1. Analysis should demonstrate that any dragging following parachute landing is acceptable in any
permitted parachute landing condition.
2. Rig and flight testing should demonstrate the accuracy of performed analysis and should demonstrate
that any dragging following parachute landing is acceptable, and the correct function of any preventative
design features.
Information Sources
Comm'l Doc:
Reference:
Reference:
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
8.5.13.5 Environmental exposure.

The parachute landing system shall be unaffected by any environment to which the aircraft may be
exposed.

a. All environments to which the aircraft may be exposed including those within which the aircraft may
operate as well as other environments, for example those present during aircraft transportation or
storage.

1. Analysis should demonstrate that the parachute landing system is suitably resistant to all expected
environments.
2. Technical Publications should detail any maintenance activity that may be required to protect the
parachute landing system against specific harsh environments, for example those that may occur during
aircraft transportation or storage.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 S6.2.40 - 6.2.61
Reference: 00-970 P1 S7.2.2 - 7.2.3,
00-970 P7 S2 Supplement 4
L732 1.4.1
Reference:
CS 25.613
CS 25.1309
CS 27.307
CS 27.603
CS 29.307
CS 29.603
8.6. AUXILIARY/EMERGENCY POWER SYSTEM(S) (APS/EPS).

Auxiliary Power Systems (APS) are systems which routinely provide power (mechanical, electrical,
hydraulic, pneumatic, etc.) for other aircraft systems (e.g. engines), but which do not provide propulsion.
APS may be used on the ground and/or in flight.
Emergency Power Systems (EPS) are systems which provide power (mechanical, electrical, hydraulic,
pneumatic, etc.) for other aircraft systems in the event of an emergency. Like APS, EPS do not provide
propulsion, and may be used on the ground and/or in flight. Typical EPS include emergency batteries,
and Ram Air Turbines (RAT).
Some APS may also be considered to be EPS, if their use in an emergency is considered essential for
continued safe flight.
8.6.1 Suitability of components.

APS/EPS components shall be safe for their intended use and environment.

a. All appropriate safety criteria, which may include:
i. Design Service Life;
ii. Environment;
iii. Crash-worthiness;
.iv. Material and Processes (including chemical/mechanical compatibility of toxic substances & fuels such
as hydrazine);
v. Coatings and Finishes;
vi. Use of Prohibited Materials and Processes;

vii. Producibility;
viii. Damage Tolerance;
ix. Strength;
x. Durability and Economic Life;
xi. Corrosion;
xii Fatigue;
xiii. Dielectric Materials;
xiv. Creep.
b. The level(s) of safety to be met, taking into account the overall design and usage of the aircraft, levels
of system redundancy, requirements for maintenance, and any other factor that could affect the required
level of safety.

1. System Description Documents (SDD) should detail the APS/EPS installed on the aircraft, and the
components which make up each system.
2. System Safety Assessments (SSA) should detail the safety requirements to be met by each APS/EPS,
and should demonstrate that the safety requirements are adequately met, taking into account appropriate
safety criteria.
3. Declaration of Design Performance (DDP) should demonstrate that each APS/EPS component meets
the relevant design and safety requirements.
4. Rig, ground and flight testing should demonstrate that the APS and/or EPS installed on the aircraft
functions correctly through its intended use and in its intended environment.
Information Sources
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970 00-970 P1 S4 L93 (Equipment
3.2.7 - 3.2.7.6.5, 4.2.7 - Reference: Construction)
4.2.7.6.5 00-970 P1 5.1.42
00-970 P1 5.1.44
00-970 P1 5.1.33-5.1.39
00-970 P1 S6 (Equipment
Requirements)
00-970 P1 8.1.3
00-970 P7 S7 L700
00-970 P7 S10 L1001
00-970 P7 S10 L1002
STANAG 4671.USAR 1353
Reference:
FAA Doc: 14CFR reference: 23.573; EASA CS CS 23.1309
23.1309; 25.1309; 25.571; Reference: CS 25J.1207
27.1309; 29.1309 CS 25.571
CS 25.1309
CS 27.1309
CS 29.1309
CS-APU 80
CS-APU 210
CS-E 500-590
Information Sources
CS-E-1000
8.6.2 System operation.

The APS and EPS shall operate safely through all expected (normal and emergency) operating
conditions.

a. Acceptable operating characteristics, taking into account interfacing system requirements;
b. The effect of normal and emergency conditions, for example flight in abnormal flight configurations and
flight at and beyond Never Exceed Speeds (VNE);
c. The effect of environmental conditions including hot and cold environments, dust, sand, salt spray, etc.

1. System Description Documents should detail the conditions in which operation of the APS and EPS is
permitted, in particular those conditions where APS/EPS operation is automatic.
2. Systems Interface Documents (SID) should detail the interface characteristics between the APS/EPS
and power transmission system, including the effects of abnormal operation.
3. Analysis should demonstrate that the APS/EPS provides power with acceptable characteristics
throughout all expected operating conditions.
demonstrate the correct functioning of power transmission systems and power operated systems when
powered by the APS and/or EPS.
Information Sources
Comm'l Doc:
Appendix C: C.3.4.3, C.4.4 Reference: 00-970 P1 5.2.136
00-970 P1 5.2.137
00-970 P7 S7 L700
00-970 P7 S10 L1001
00-970 P7 S10 L1002
STANAG
Reference:
25.901, 25.903 (f), Reference: CS 25J903(a)
25.1167(a),(c) TSO C77b 4.4.1 CS 25J939(a)
- 4.5.2
CS 25J943, 25J951, CS
25J952, CS 25J1019, CS
25J1023, CS 25J1025, CS
25J1106, CS 25J1521, CS
25J1527
CS-APU-40; CS-APU-80
CS-APU 210
CS-APU 410 420; 430; 440;
450; 460 and 470
CS-E Sub part A#
CS-E 520
Information Sources
8.6.2.1 Safety features.

The APS and EPS shall incorporate safety features to control and mitigate the risks associated with their
operation to an acceptable level.

a. System failure modes;
b. The required level(s) of safety, taking into account the overall design and usage of the aircraft and any
other factor that could affect the required level of safety.
c. Conditions for the correct functioning of any safety features installed.
d. Ensuring that failure of APS/EPS or any associated power conversion or transmission components
cannot result in the failure of other power generation, supply or operated systems.

1. System Safety Assessments (SSA) should detail the risks associated with each APS/EPS, the safety
requirements to be met by each APS/EPS, and should demonstrate that the safety requirements are
adequately met, taking into account appropriate safety criteria.
2. Rig, ground and flight testing should demonstrate that the APS and/or EPS installed on the aircraft,
including its safety features, functions correctly when used as intended in its intended environment.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix C: Def-Stan 00-970 00-970 P1, S1, 1.1.34
C.3.4.3.12.1, C.4.4.3.12.1 Reference: 00-970 P1 4.15.27
00-970 P7 S7 L712
00-970 P7 S7 L705
Reference:
FAA Doc: TSO C77b 4.6.2 EASA CS CS 25J.1141(c)
Reference: CS 25J.1189
CS-APU 270
CS-APU 280
CS-APU 450
CS-APU 460
CS-APU 530
CS-E 50
CS-E 400
CS-E 830
CS-E 860-870
CS-E 920
8.6.3 Functional and physical compatibility.

The APS and EPS shall be functionally and physically compatible to the aircraft in which it is to be
integrated.
a. Appropriate aspects of functional compatibility, taking into account the aircraft and APS/EPS design,
including power outputs, voltage, phase, frequency, pressures, RPM etc.
b. Appropriate aspects of physical compatibility, taking into account the aircraft and APS/EPS design,
including size, weight, clearance, vibration, materials compatibility etc.

1. System Description Documents (SDD) should detail the physical and functional characteristics of the
APS and/or EPS. This should include nominal, maximum and minimum power outputs, the size and
weight of the APS and/or EPS, and the location of installation.
2. Technical Publications should detail the process for installation and functional testing of the APS and/or
EPS.
3. Rig, ground and flight testing should demonstrate that the APS and/or EPS can be installed correctly in
accordance with the associated Technical Publications, and should demonstrate that the APS and/or EPS
functions correctly when installed.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970 00-970 P7 S7 L700
3.27; 4.2.7; 3.2.7.4.4; 4.2.7.4.4; Reference: 00-970 P1 S8 (Gas Turbine
3.2.7.7.5; 4.2.7.7.5; Appendix APU Installation Par. 8.0.1;
C: C.3.4.3, C.4.4.3 8.0.3 and 8.1.3)
23.1309, 25.901, 25.1309, Reference: CS 25.1167
25.903 (f), 27.1309, 29.1309 CS 25J939
TSO C77b 4.4.1 - 4.5.2,
CS 25J1163
Sections 6 and 7
CS 25.1309 Equipment,
Systems and Installations
CS 27.1309
CS 29.1309
CS-APU-40
CS-E 20
8.6.4 System safety

The APS and EPS shall be designed in such a way that the probability of failure of any component that
could present an unacceptable hazard, or unacceptable risk to the safety of personnel or that could
prevent continued safe flight is extremely remote.

a. Design and maintenance philosophies which minimise the risk of failure of the APS and/or EPS
(damage tolerance, safe life, etc.).
b. Possibility for failure of components which would present a hazard to safety of personnel or continued
safe flight, including the uncontained failure of high-energy rotors and whipping/flailing of failed hydraulic
and pneumatic lines.
1. System Description Documents (SDD) should highlight the incorporation of high-energy rotors, and
other components whose failure would present a hazard to safety of personnel or continued safe flight, in
the design of the APS and/or EPS.
2. Failure Modes and Effects Analysis (FMEA) should detail the failure modes of the APS and/or EPS,
and should detail the subsequent effects of their failure.
3. System Safety Assessments (SSA) should demonstrate that the incorporation of the APS and/or EPS
to the aircraft does not present a hazard to safety of personnel or continued safe flight.
4. Analysis should demonstrate that the failure of the APS and/or EPS does not result in any unexpected
effects (for example that high-energy rotors are successfully contained).
5. Rig testing should demonstrate the accuracy of the analysis performed, and should demonstrate that
failure of the APS and/or EPS does not result in any unexpected effects (for example that high-energy
rotors are successfully contained).
Information Sources
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970 00-970 P1 S1 1.1.34
3.3.3, 4.3.3; Appendix C: Reference: 00-970 P1 S1 1.1.39
C.3.4.3.10.1, C.4.4.3.10.1 00-970 P7 S1 L100
00-970 P7 S7 L700
00-970 P7 S7 L705
STANAG 4671 USAR 1309
FAA Doc: 14CFR reference: 23.903 (b); EASA CS CS 25.1309(b), 25.1461
23.1461, 25.901(c); 25.1461; Reference: CS-APU 210, 290 and 470
25.1167 (a),(c); TSO C77b CS-E 80 and 510
(5.1)
AC 20-128, TSO C77b: 5.9;
6.6; 6.7; 6.8
8.6.4.1 Merged with 8.6.4.

8.6.5 Vibration.
Through all expected operating conditions, the APS and EPS shall be suitable for the vibration
environment as installed on the aircraft, and shall not introduce vibration to the aircraft that could affect
the integrity of surrounding structure or systems.

a. The existing vibration environment, including sources, magnitudes and frequencies, and its effect on
the APS and/or EPS.
b. Vibrations resulting from installation and operation of the APS and/or EPS in normal, emergency and
failed modes.

1. Analysis should demonstrate that the APS and/or EPS is suitable for the vibration environment to
which it is installed, through all expected operating conditions.
2. Fatigue analysis should demonstrate that the installation of the APS and/or EPS does not appreciably
affect the structural or systems integrity of the APS/EPS or surrounding structures or systems.
3. Rig, ground and flight testing should demonstrate the accuracy of the analysis performed, that the
vibration environment to which the APS and/or EPS is installed is acceptable, and that the APS/EPS does
not introduce vibrations that could appreciably affect the structural or systems integrity of the APS/EPS or
surrounding structures or systems.
Information Sources
Comm'l Doc:
Appendix C: C.3.4.3.10.2, Reference: 00-970 P1 8.1.3
C.4.4.3.10.2 00-970 P7 S7 L700
00-970 P7 S10 L1002
STANAG
Reference:
FAA Doc: 14CFR reference: 25.901 (c), EASA CS CS 25J.1193
25.903 (f) TSO C77b 5.10 Reference: CS-APU 80
CS-APU 300
CS-E 100
CS-E 650
8.6.5.1 Merged with 8.6.2 for operational aspects and 8.6.3 for functional and physical aspects.
8.6.6 EPS Performance.
The EPS shall be capable of responding to failures and providing sufficient power within an appropriate
time to allow continued safe flight.

a. The time required for the EPS to respond to failures, including the time for pilot action (if any), and
system start-up.
b. Prioritisation of power supply types, for example prioritising power to systems which are more critical to
continued safe flight.

1. System Description Documents (SDD) should detail the required time for EPS response to system
failures, highlighting the time required between the failure of a primary system and the sufficient supply of
power by the EPS.
2. System Safety Analysis (SSA) should demonstrate that the time required between failure of a primary
power supply system and the sufficient supply of power by the EPS is acceptable for continued safe flight.
3. Rig, ground and flight testing should demonstrate that the operation of the EPS following a failure of
each primary power source allows continued safe flight.
Information Sources
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970 00-970 P1 6.6.18-6.6.19
Appendix C: C.3.4.3.4, Reference: 00-970 P1 8.1.3
C.4.4.3.4 00-970 P7 S7 L706
00-970 P7 S10 L1001
00-970 P7 S10 L1002
FAA Doc: 14CFR reference: 23.943, EASA CS CS-APU 440
25.901 (f), 25.943 CS-E 370
Information Sources
TSO C77b: 4.1, 4.4.1, 4.4.2, Reference:
4.4.3, 4.7
8.6.7 Safety considerations.

Installation of the APS and EPS shall take into account:
a. Structural mounting;
b. Wiring and plumbing support, routeing, and clearances;
c. System/component and compartment drainage;
d. System/component and compartment cooling and ventilation;
e. System/components designed for appropriate levels of fire hardening;
f. Accessibility to all required inspection and servicing features and areas.

a. Maintaining appropriate margins of safety throughout expected aircraft and APS/EPS operation.
b. Taking deviations from nominal dimensions (adverse tolerances, manufacturing concessions, etc.) into
account.

1. System Description Documents (SDD) should provide detail regarding: APS and/or EPS structural
mounting; wiring and plumbing support; routeing and clearances; system/component and compartment
drainage; system/component and compartment cooling and ventilation; system/components designed for
appropriate levels of fire hardening; and accessibility to all required inspection and servicing features and
areas.
2. Rig, ground and flight testing should demonstrate that the installation of APS and/or EPS is
appropriate, and that provisions for inspection and servicing provide adequate clearance for all required
maintenance activities.
Note that criteria 8.6.7.1-8.6.7.6 of MIL-HDBK-516C have been subsumed into this EMACC criterion.
Information Sources
Comm'l Doc: For b. above: ARP994,
Tubing/Plumbing Routing -
tubing and line support, routing
and clearance requirements
SAE AS50881A, Wiring,
Aerospace Vehicle - wiring
support and routing
requirements
For a. above: 3.2.7; 4.2.7; Reference: 00-970 P1 4.26.22
3.2.7.4.4; 4.2.7.4.4; 3.2.7.5; 00-970 P1 4.26.27
4.2.7.5 00-970 P1 4 L86
For b., c., and d. above: 3.3.8; 00-970 P1 5.1.70-5.1.72
4.3.8 00-970 P7 S7 L700
For e. above: 3.3.3; 4.3.3; 00-970 P7 S7 L712
3.3.8; 4.3.8; and Appendix G: STANAG 4671.USAR 901
G.3.4.7; G.4.4.7 Reference: 4671.USAR 1353
Information Sources
For f. above: 3.2.6; 4.2.6
FAA Doc: For a. above: 14CFR EASA CS CS 23.1181-1203
references: 25.901 (c), (d); and Reference: CS 25J.901
TSO C77b: 4.8, 5.1.3, 5.2.5 CS 25J.952
For b. above: 14CFR
CS 25J.953
references: 23.993, 23.1017,
25.901 (c), 25.993, 25.1017 CS 25J.961
For c. above: 14CFR CS 25J.977
references: 25.1187; and TSO CS 25J.991
C77b: 5.27, 5.42, 5.52 For d.
CS 25J.993
above: 14CFR references:
23.1041 - 23.1045, 23.1103 CS 25J.994
(a), 25.1041 - 25.1045, CS 25J.995
25.1103 (a); and TSO C77b CS 25J.997
(5.3) For e. above: 14CFR
CS 25J.1011
references: 23.1181 - 23.1203,
25.1181 - 25.1207; and TSO CS 25J.1017
C77b (5.2) For f. above: CS 25J.1019
14CFR references: 23.901, CS 25J.1021
23.1021, 25.901,
CS 25J.1025
25.102123.901, 23.1021,
25.901, 25.1021 CS 25J.1041-25.J1045
CS 25J.1103
CS 25J.1106
CS 25J.1165
CS 25J.1181-25.J1207
CS 25J.1337
CS 25J.1551
CS 25J.1557
CS-APU 30
CS-APU 210
CS-APU 220
CS-APU 270
CS-APU 300
CS-APU 310
CS-E 80
CS-E 100
CS-E 130
CS-E 250
CS-E 270
CS-E 340
CS-E 690
8.6.8 Flammable fluid ingestion/exhaust gas impingement.

APS and EPS inlets and exhausts hazards (including air flow velocities, temperatures, acoustics, and
exhaust by-products) shall be acceptable.

a. Hazards to personnel, including ground crew, flight crew and passengers.
b. Hazards to aircraft systems and structure.

1. Functional Hazard Assessment (FHA) should identify the hazards associated with the APS and/or EPS
inlets and outlets.
2. System Safety Assessment (SSA) should demonstrate that the hazards associated with the APS
and/or EPS inlets and outlets are acceptable, and that appropriate controls and/or mitigations are in place
to reduce the resulting risk for each hazard.
3. Rig, ground and flight testing should demonstrate that the hazards associated with inlets and exhausts
of APS and/or EPS are acceptable.
Information Sources
Appendix C: C.3.4.3.11, Reference: 00-970 P1 5.1.74
C.4.4.3.11 00-970 P7 S7 L700
00-970 P7 S7 L712
00-970 P7 S10 L1002
FAA Doc: 14CFR reference: 23.1091; EASA CS CS 25J.939(c)
23.1103; 23.1121; 23.1123, Reference: CS 25J.1091
25.1091, 25.1103; 25.1121; CS 25J.1103
25.1123
CS 25J.1121
TSO C77b: 5.3.1, 5.3.3, 5.6
CS 25J.1123
CS 27.1091-1093, 27.1121-
1123
CS 29.1091-1109, 29.1121-
1125
CS-APU 230
CS-APU 260
CS-APU-80
CS-APU-470
CS-E 510

Adequate controls and displays shall be available to notify the flight crew of the APS and EPS and its
necessary functions to warn for hazardous conditions.

b. All required APS and EPS functions and tracked parameters (e.g. voltage, current, pneumatic/hydraulic
pressure, shaft speed, etc.);
c. The location of the sensors should be carefully considered so that true parameters will be indicated;
d. Ensuring all displays and controls meet the specified requirements (arrangement, location, type, size,
guards etc.).

2. Rig, ground and flight testing should demonstrate that controls perform their intended function(s) and
that displays provide accurate and useful information to the crew.
Information Sources
Comm'l Doc:
Appendix C: C.3.4.3.8, Reference: 00-970 P1 4.19
C4.4.3.8 00-970 P1 5.1.18
00-970 P1 5.1.22-5.1.23
00-970 P1 8.1.3
Reference:
FAA Doc: 14CFR reference: 23.1141; EASA CS CS 25J.903
23.1142; 23.1549; 25.1141; Reference: CS 25J.1141
25.1142; 25.1549 CS 25J.1305
CS 25J.1549
CS-APU 100
CS-E 50
CS-E 60
CS-E 510
8.6.13 Component life/usage tracking.

APS and EPS life/usage parameters which affect the continuing airworthiness of the aircraft shall have
appropriate means for tracking.

a. All life/usage parameters which may affect the continuing airworthiness of the aircraft, such as those
arising from the adoption of 'Safe Life' or 'Damage Tolerant' design philosophies.
b. Appropriate means of tracking, taking into account the frequency of operation/usage of the aircraft and
the installed APS/EPS. Such means may include automatic recording (e.g. an active Health and Usage
Monitoring System (HUMS)), manual recording of aircraft parameters (flight hours, flight cycles, etc.), or
manual means of recording APS/EPS specific parameters (e.g. number of Auxiliary Power Unit starts).

1. System Description Documents (SDD) should highlight APS and/or EPS lifing/usage parameters,
including their means for tracking.
2. System Safety Assessments (SSA) should identify any specific controls or mitigations which rely on the
management of APS and/or EPS lifing/usage parameters.
3. Maintenance Technical Publications should include means for the tracking and management of APS
and/or EPS lifing/usage parameters, acceptable limits for each parameter, and procedures to follow in the
event of reaching each lifing/usage parameter's associated limit.
Information Sources
DoD/MIL Doc: JSSG-2009: Def-Stan 00-970
3.2.7.4.4, 4.2.7.4.4, 3.2.7.6, Reference:
4.2.7.6 STANAG 4671.USAR 1529
Reference:
FAA Doc: 14CFR reference: 23.1522; EASA CS CS 25 Appendix H 25.43
23.1549; G23.3; 25.1522; Reference: CS A27.3, A29.3
25.1549 : H25.3, A27.3 and CS-APU 150
A29.3
CS-APU 310
TSO C77b: 4.3; 4.4.1; 4.6.1;
CS-E 515
5.7

operation of the APS and EPS.


information.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: Def-Stan 00-970
3.3.3; 3.6.2; 4.3.3 Reference:
Reference:
FAA Doc: 14CFR reference: 23.1581 - EASA CS
Information Sources
23.1585; G23.3 - G23.4; Reference: CS 25.1581 (a) (2)
23.1541; 25.1541; 25.1581 - CS 25.1585
25.1585; H25.3 - H25.4
CS 25J1501
CS 25J1521
CS 25.J1583
CS 25 Appendix H 25.3
CS 25 Appendix H 25.4
CS-APU 20
CS-APU 30
CS-E 20
CS-E 30
CS-E 510
8.6.15 Merged with 8.6.2.1.

8.6.15 Merged with 8.6.2.1.
8.7. AIR-TO-AIR REFUELLING (AAR) SYSTEM.

The refuelling of Rotary Wing platforms on the ground (i.e. Rotors Running) is specifically excluded from
this section and covered in Section 8.3 (Fuel Systems).
8.7.1 AAR operations.

AAR systems shall allow safe and successful AAR with the targeted tanker/receiver aircraft and its AAR
system(s).

a. The role(s) that the aircraft will undertake in any AAR operations, which may include both dispense
(tanker) and receipt roles.
b. The aircraft with which AAR operations may be conducted, which may include fixed wing and rotary
types.
c. The AAR systems/equipment that may be utilised by the aircraft with which AAR operations will be
conducted (flying boom, hose and drogue, etc.).
d. Dimensional, physical, electrical, and material compatibility between each AAR interface.

1. System Description Documents (SDD) should detail the AAR system(s) fitted to the aircraft.
2. SDD should detail the aircraft and AAR system types with which the aircraft can perform AAR
operations.
3. Technical Publications should provide procedures for safe and successful AAR operations, for each
tanker and/or receiver with which the aircraft is cleared to perform AAR operations.
4. Rig, ground and flight testing should demonstrate that the interfacing aircraft and their AAR systems
are able to interface safely and successfully.
Information Sources
Comm'l Doc: ATP-56
DoD/MIL Doc: JSSG-2001: 3.4.7.2.1, Def-Stan 00-970 00-970 P13 S3 3.5
3.4.7.2.2 Reference: 00-970 P7 S2 L701/4
Information Sources
JSSG-2009 Appendix F STANAG 3447
JSSG-2001B: 3.4.6.2.1, Reference: 3847
3.4.6.2.2 3971
7191
FAA Doc: EASA CS
Reference:
8.7.1.1 Technical manuals.

Flight, operator, and maintenance manuals shall include normal, back-up and emergency operating
procedures, limitations, restrictions, servicing, and maintenance information to support safe AAR
operations.

d. Ensuring alignment and consistency between the aircraft's Technical Publications and the publications
of the aircraft with which it will perform AAR operations.

information, including appropriate inspection criteria for wear/damage of each AAR component.
continuing airworthiness of the aircraft."
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.4.7.2.1, Def-Stan 00-970
JSSG-2001: 3.4.7.2.2 Reference: 00-970 P13 S3 3.5
JSSG-2001B: 3.4.6.2.1, 00-970 P13 S3 3.5.79
3.4.6.2.2 00-970 P1 7.5
00-970 P13 S4 L9
00-970 P7 S2 L1005
00-970 P7 S2 L701
STANAG 3447
Reference: 3971
FAA Doc: Note: Use 14CFR reference EASA CS CS 25 Subpart G (Operating
Information Sources
sections corresponding to Reference: Limitations and Information)
Structural and Installation
requirements. Use all systems
14CFR references as
applicable, i.e., Electrical.
8.7.1.1.1 Life-limited components.

A safe life shall be defined for all AAR components whose proper functioning is essential to maintain the
flight safety of the aircraft and/or the safe usage of the AAR system.

a. All components directly installed as part of the AAR system, and any other aircraft components
essential to maintain the flight safety of the aircraft and/or the safe usage of the system.
b. The maximum wear rates expected in service, taking into account frequency of AAR operation, rates of
fuel dispense and/or receipt and environmental conditions.

1. System Description Documents (SDD) should detail the AAR components whose proper functioning is
essential to maintain the flight safety of the aircraft and/or the safe usage of the AAR system, and the
defined safe life for each component.
2. Rig, ground and flight testing should demonstrate that failure of essential components does not occur
before the end of their defined safe life.
3. Technical Publications should define the safe life of each essential component, and procedures for
their installation and removal.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:
8.7.1.1.2 Merged with 8.7.1.1.1.

8.7.1.2 Merged with 8.7.1.
8.7.1.2.1 Probe obstructions.
The area around the AAR probe/ receptacle shall be free from obstructions that might cause damage to
the aircraft, or become a hindrance to the AAR operation.

a. Ensuring that fastener heads are flush with the surrounding surface;
b. Ensuring that any structure and panels in the vicinity of the AAR Probe/Receptacle cannot snag or
otherwise interfere with the AAR boom or drogue;
c. Any hose and suspension devices.
1. Rig, ground and flight testing should demonstrate that the AAR probe/receptacle and surrounding
structure and panels does not snag dispensing AAR equipment (e.g. boom/drogue).
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: 3.3.11, 4.3.11 Def-Stan 00-970 00-970 P13 S3 3.5.5-3.5.6
JSSG-2010: 3.5.3.3, 4.5.3.3 Reference: 00-970 P13 S3 3.5.14
00-970 P13 S4 L9
STANAG 3447
Reference: 3487
7191
FAA Doc: EASA CS
Reference:
8.7.1.3 Loads at the refuelling interface.

The AAR system interface, its attachment to airframe structure, and the structure surrounding the
interface shall withstand loads throughout the defined flight envelope and during normal and abnormal
AAR operations (engagement, disengagement and fuel transfer) without the tanker/receiver interface(s)
being damaged or creating FOD due to failure.

a. For boom and receptacle AAR subsystems, loads expected during normal engagements within the
defined contact envelope and normal disengagements within the disconnect envelope; loads experienced
when a single failure occurs in the latching mechanism of the receptacle and the boom nozzle must be
forcibly pulled out of the receptacle in all flight conditions.
b. For probe and drogue AAR subsystems, loads expected during normal engagements/disengagements
at the most severe receiver closure/fallback rates; those experienced due to inadvertent/off-centre
engagements/disengagements; and those experienced when a single failure occurs in the latching
mechanism of the AAR coupling and the probe nozzle must be forcibly pulled out of the receptacle in all
flight conditions.

1. System Description Documents (SDD) should detail the AAR equipment, its interface with the aircraft,
and the structure through which AAR refuelling loads are reacted.
2. Structural analysis should demonstrate that the AAR refuelling equipment, its interface with the aircraft,
and surrounding structure do not undergo excessive or permanent deformation.
3. Rig, ground and flight testing should demonstrate the accuracy of the performed structural analysis,
and should demonstrate that AAR operation does not result in excessive or permanent deformation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.4.7.2.1, Def-Stan 00-970 00-970 P13 S4 L9
3.4.7.2.2 Reference:
JSSG-2001B: 3.4.6.2.1, STANAG
3.4.6.2.2 (unverified - NL516) Reference:
JSSG-2009 Appendix F:
F.3.4.6.2.2.5, F.4.4.6.2.2.5,
F.3.4.6.2.3.5, F.4.4.6.2.3.5
Information Sources
JSSG-2006: 3.4.1.7, 4.4.1.7
AFGS-87154 load guidance
MIL-A-8865A: 3.9.1.3.1 and
3.9.2.2 for load guidance
8.7.1.4 Crewmember/operator cues.

Cues (visual or equivalent) shall be provided to assist the receiver aircraft to accomplish the AAR process
under all anticipated attitudes and environmental conditions.

1. Ensuring that the cues provide sufficiently detailed information to assist AAR operations without
confusing operators.
2. Ensuring that the type(s) of cues provided are appropriate for the AAR operations anticipated.

1. System Description Documents (SDD) should detail the cues provided for receiver operators.
2. Technical Publications should detail procedures for AAR rendezvous, including the cues provided by
the tanker aircraft for the receiver aircraft and their meaning.
3. Flight simulation and flight testing should demonstrate that AAR rendezvous can be accomplished
successfully and safely under all expected AAR operating conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 3.5
F.3.4.6.2.1.3, F.4.4.6.2.1.3 Reference: 00-970 P13 3.5.59
JSSG-2010: 3.2.14, 4.2.14 00-970 P13 S4 L9 6.5.1
(Unverified) 00-970 P1 4.19
00-970 P1 4.19.38
00-970 P13 3.5.7
STANAG
Reference:
8.7.1.4.1 Marking durability.

Visual cues used for AAR (e.g. markings and exterior lights) shall be compatible with their expected
environmental conditions and fluid exposures (fuel, hydraulic fluid, cleaning solvents, etc.).

a. Compatibility of markings with existing surface finish scheme;
b. Degradation of the aircraft's surface finish;
c. Ensuring that lights continue to work and be visible (without degradation or colour change) when
subjected to environmental effects;
d. Weathering, corrosion, abrasion, mechanical damage;

e. Maintenance activities including washing;
f. Induced environment: contaminants such as fuel, oils, solvents etc.;
g. Natural Environmental; sunlight, rain, pressure, ice etc.

1. Declarations of Design and Performance (DDP) should identify the environmental conditions for which
the AAR visual cues are approved to operate within.
2. Qualification Test Reports (QTR) should demonstrate that AAR visual cues are compatible with their
expected environment without degradation for the duration of the prescribed maintenance interval.
Information Sources
Comm'l Doc:
00-970 P13 3.5.7
00-970 P13 S4 L9 6.5.1
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.1.4.2 Exterior lighting.

Exterior lights shall be provided for the guidance of aircrew, operators and automated systems during
AAR operation.

a. For receiver receptacle based subsystems, receptacle/slipway illumination, illumination of the surface
area immediately aft of the receptacle, wing leading edge illumination, and illumination of surface features
possibly in the path of the boom;
b. For tanker boom-based subsystems, boom nozzle illumination, flood light illumination, wing and
underbody illumination, wing pod and engine nacelle illumination, and receiver pilot director/status lights;
c. For receiver probe-based subsystems; probe illumination;
d. For tanker drogue based subsystems, drogue illumination, flood light illumination, wing, underbody and
root-end of hose to show markings illumination, wing pod and engine nacelle illumination in conjunction
with drogue subsystem status lights;
e. Rendezvous lights;
f. Refuelling sequencing and tanker subsystem status lights;
g. Crew's field of view, reflections and glare;
h. Lighting within drogues should not require power from the tanker for operation;
i. Need for compatibility with Night Vision Imaging Systems
j. Ground/Ship based lighting for HIFR.

1. System Description Documents (SDD) should detail the lighting provided to facilitate safe AAR
operations.
2. Flight simulation and flight testing should demonstrate that the provided lighting facilitates safe AAR
operations.
Information Sources
Comm'l Doc:
Reference: 00-970 P13 3.5.41
00-970 P13 3.5.56
00-970 P13 3.5.74
00-970 P1 4.17.6
00-970 P13 3.5.30-3.5.35
00-970 P13 S4 L9
00-970 P7 S12 L104
00-970 P7 S2 L1005
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.1.4.3 Merged with 8.7.1.4.2

8.7.1.4.4 Exterior lighting intensity.
The intensity of each exterior light or light group shall be variable to meet the needs of the interfacing
tanker/receiver aircraft, and shall be Night Vision Device (NVD) compatible.

a. Ability of the system to be controlled in response to differing ambient lighting conditions;
b. Tanker/receiver orientation and changes in orientation during refuelling operation.
Considerations fo preparation of AMC:

1. System Description Documents (SDD) should highlight the variability of AAR lighting and their NVD
compatibility.
2. Flight simulation and flight testing should demonstrate that the variability of the AAR lighting, and its
NVD compatibility allows for successful and safe AAR operations under all expected lighting conditions,
both with and without the use of NVD.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.1.4.5 Merged with 8.7.1.4.4.

8.7.1.4.6 Merged with 8.7.1.4.1
8.7.1.4.7 Viewing systems.
Viewing systems (if used) shall permit safe AAR operations.
a. Ensuring that failure of a viewing system is obvious to operators, and could not lead to the operators
becoming unaware of an unsafe condition.
b. Preventing the obscuration or other degradation of viewing systems.

1. System Description Documents (SDD) should detail any viewing systems incorporated for AAR.
2. Functional Hazard Assessment (SSA) should demonstrate that hazards associated with use of viewing
systems for AAR operations are acceptable.
3. Failure Modes and Effects Analysis (FMEA) should demonstrate that hazards associated with the full
or partial failure of viewing systems is acceptable for tanker and receiver aircraft.
4. System Safety Assessment (SSA) should demonstrate that hazards associated with the integration of
viewing systems and their use during AAR operations are acceptable and appropriately controlled and
mitigated.
5. Technical Publications should provide procedures for the use of viewing systems during AAR
operations.
Information Sources
Reference:
STANAG
Reference:
CS 27.1301
CS 29.1301
8.7.1.5 Communication system.

Communication system(s), including data communication systems, shall be available to transmit data /
information between tanker and receiver aircraft during the AAR operation in the required time frame.

a. The relative close proximity of transmitter and receiver communication systems;
b. The need to restrict some forms of communication such as HF during AAR operations;
c. The need to transmit / receive classified information securely or covertly.

1. System Description Documents (SDD) should detail the communication system(s) to be utilised during
AAR operations.
2. Technical Publications should provide procedures for the conduct of AAR operations including
communication between tanker and receiver aircraft.
3. Flight simulation and flight testing should demonstrate that AAR operations can be conducted
effectively and safely, including effective communication between aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.4.7.2.1, Def-Stan 00-970 00-970 P1 4.17.6
3.4.7.2.2 00-970 P13 3.5.22
Information Sources
JSSG-2001B 3.4.6.2.1, Reference: 00-970 P13 3.5.29
3.4.6.2.2 (unverified NL516) 00-970 P13 3.5.30
AFGS-87154 00-970 P13 3.5.34
00-970 P13 S4 L9
STANAG
Reference:
Reference:
8.7.1.6 Identification of fuels.

Permitted fuel types for AAR shall be defined.

a. Fuel specifications and tolerances including permitted deviations;
b. The use of additives;
c. The need to transport, pump and transfer different types of fuel including those not useable by the host
aircraft;
d. Compatibility of different fuels with AAR system components;
e. Segregation of different types of fuel.
f. Adequate isolation between AAR fuel and aircraft fuel, when separation is required.

1. System Description Documents (SDD) should detail the types of fuel permitted for AAR operations,
highlighting any restrictions applicable during carriage of any fuel type.
2. Technical Publications should detail the fuel types permitted for AAR operations and any restrictions
applicable to each fuel type.
3. Rig, ground and flight testing should demonstrate that the aircraft and AAR system(s) can operate
safely with any permitted fuel type.
Information Sources
Comm'l Doc:
3.4.7.2.2 Reference: 00-970 P13 S4 L9
JSSG-2001B: 3.4.6.2.1, STANAG
NAVAIR 00-80T-110 section
2.4.4 and 3.6.5
FAA Doc: EASA CS
Reference:
8.7.1.6.1 Verify that any data communication system provided on the aircraft is compatible with the
aircraft involved in the operation.

a. Potential impacts on flight control and electrical systems on the host tanker as well as targeted
tanker(s)/receiver(s);
b. The relative close proximity of transmitters and receivers used in the communication systems;
c. The need to restrict some forms of communication such as HF during AAR operations;
d. The need to transmit / receive classified information securely or covertly.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.4.7.2.1,3.4.7.2.2 Def-Stan 00-970 00-970 P1 6.10
- (Unverified) Reference: 00-970 P13 S4 L9 6.4.4
JSSG 2009 Appendix F: 00-970 P13 3.5.2.1
F.4.4.6.2.2.8 00-970 P13 3.5.28
00-970 P13 3.5.2
STANAG
Reference:
Reference:
8.7.1.7 Delivery pressure and flow rate.

As a receiver, the aircraft (including AAR receipt subsystem) shall withstand the maximum pressure and
flow-rate, including the effects of single failures and surge. As a tanker, the maximum dispense pressure
and flow-rate shall be defined and constrained within the design limits of intended receivers, including the
effects of single failures and surge.

a. Providing capability to regulate or limit dispense and receipt pressures and flow rates;
b. Ensuring adequate capacity and capability of the fuel vent system;
c. Effects of surge, including effects of pump start-up and shut-down, valve closures (in tanker and
receiver aircraft), and disengagement AAR at maximum rate of flow.

1. System Description Documents (SDD) should detail the maximum permitted pressures and flow rates
for AAR receipt, at the AAR inlet, and the maximum expected pressures and flow rates for AAR dispense
at the AAR outlet. In each case, such detail should include the magnitude and frequency of any surge
pressures.
2. Technical Publications should detail the procedures for AAR operations, including any detail necessary
to limit the pressure and/or flow rates of AAR dispense/receipt, and/or prevention of surge pressures.
3. Analysis should demonstrate that during AAR operation at the maximum permitted flow rate and
pressure, the various flow rates and pressures throughout the aircraft fuel system do not exceed their
design allowables.
demonstrate that AAR operations, including disengagement of AAR during AAR at the maximum flow rate
does not result in permanent deformation of any part of the aircraft.
Information Sources
Comm'l Doc:
3.4.7.2.2 (Unverified) Reference: 00-970 P1 5.2.3
00-970 P1 5.2.4
00-970 P1 S5 L4
00-970 P1 S5 L7
Information Sources
00-970 P13 S4 L9 1.3.3
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.1.8 Merged with 8.7.1.7

8.7.1.9 Fuel spray.
Fuel spillage/spray during AAR operations shall not prevent safe AAR operation.

a. AAR operation throughout the permitted flight envelope, including normal and abnormal conditions and
attitudes;
b. Fuel spray dispersion pattern created during engagement and disengagement of the AAR interfaces;
c. Abnormal disengagements at full flow rates;
d. Effect on other aircraft in the vicinity;
e. Impact of single point failures including breakage of AAR probe/nozzle.

1. Rig and flight testing should demonstrate that any fuel spillage/spray during AAR operations is
acceptable, and does not inhibit the safe flight of tanker or receiver aircraft.
2. System Safety Assessment (SSA) should demonstrate that the risk associated with fuel spray/spillage
is appropriately controlled and mitigated.
Information Sources
JSSG-2001B: 4.2.3 Reference: 00-970 P13 3.5.15
00-970 P13 3.5.21
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.1.10 Flight stability and handling qualities.

The aircraft shall demonstrate satisfactory flight stability and handling characteristics throughout the
aircraft's cleared AAR flight envelope at all permitted configurations in all permitted roles (tanker /
receiver).

a. Movement in Centre of Gravity (CofG) during engagement and refuelling operation;
b. Instability due to probe / boom deployment or proximity to tanker or other refuelling aircraft;
c. Variations in aircraft configurations;
d. Stability of tanker's hose, boom and probe.
1. Technical Publications should provide procedures for AAR operations including any
restrictions/limitations on flight handling.
2. Flight simulation and flight testing should demonstrate the aircraft's ability to perform AAR operations
successfully and safely throughout the aircraft's cleared AAR flight envelope at all permitted
configurations.
Information Sources
Comm'l Doc:
3.3.11.1.1 Reference: 00-970 P13 3.5.21
JSSG-2009 Appendix F: 00-970 P13 3.5.23
F.3.4.6.2.2.2 00-970 P13 3.5.79
STANAG
Reference:
FAA Doc: EASA CS CS 23 Subpart B
Reference: CS 25 Subpart B
CS 25 Subpart G
CS 27 Subpart B
CS 29 Subpart B
8.7.1.11 Merged with Section 15.

8.7.1.12 Equipment safing.
It shall be possible to inhibit/disengage any aircraft system which could pose a hazard during AAR.

a. Ensuring that procedures are in place to control and/or mitigate hazards through the
inhibition/disengagement of aircraft systems.
b. Ensuring that methods for inhibition/disengagement of hazardous aircraft systems is appropriate, which
may include automating shut-down of hazardous systems on AAR rendezvous.

1. System Description Documents (SDD) should highlight aircraft equipment/systems which pose a
hazard to AAR operations, and their means of inhibition/disengagement.
2. Technical Publications should detail procedures for the inhibition/disengagement of aircraft systems
prior to or during AAR operations.
3. System Safety Assessment (SSA) should demonstrate that hazards associated with aircraft systems
and AAR operations are suitably controlled and mitigated.
Information Sources
Reference:
STANAG
Reference:
CS 27.1301
Information Sources
CS 29.1301
8.7.1.13 Spatial clearance between participating aircraft.

There shall be adequate clearance between AAR aircraft to allow for safe AAR operations.

a. The effect of performing AAR operations throughout all conditions for which AAR is permitted, including
altitudes, weather conditions, flight rules, etc.
b. The effect of modifications to tanker and/or receiver aircraft which could reduce the available
clearance.

1. System Description Documents (SDD) should detail the nominal and minimum clearance between
tanker and receiver aircraft.
2. Technical Publications should provide procedures for safe AAR, including detail on achieving and
maintaining adequate clearance between aircraft.
3. Flight simulations and flight testing should demonstrate that the clearance between aircraft during AAR
operations (in receipt and/or tanker roles as applicable) is safe throughout the AAR operation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P13 S4 L9, 6.1
Reference:
STANAG ATP 3.3.4.2(B)
Reference:
FAA Doc: EASA CS
Reference:
8.7.2 Safe installation and operation.

AAR operations, in receiver and/or tanker roles as applicable, shall meet an appropriate level of safety. In
addition, no single failure shall result in loss of control or loss of the aircraft.

a. Defining an appropriate level of safety to be met, taking into account the type of the aircraft, its roles,
and the frequency with which AAR operations will be conducted.
b. Effects of operation and failure of aircraft systems, and any subsequent effect on other aircraft
systems.
c. Hazards associated with fuel, fuel systems, and potential leaks and subsequent ignition risks, and
provision of adequate ventilation/drainage to prevent hazardous build-up.

1. The aircraft specification should detail the level of safety to be met for AAR.
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that single failures in any aircraft
system (including the AAR system) cannot not result in loss of control or loss of the aircraft.
3. System Safety Assessment (SSA) should demonstrate that hazards associated with the aircraft and
AAR operations are suitably controlled and mitigated, and that the overall level of safety is acceptable.
Information Sources
DoD/MIL Doc: JSSG-2009: 3.2.7.4.4.1, Def-Stan 00-970 00-970 P13 S3 3.5.39-3.5.41
4.2.7.4.4.1, 3.2.7.4.4.2, Reference: 00-970 P13 S4 L9
4.2.7.4.4.2, 3.3.8, 4.3.8 STANAG
MIL-STD-87166: 3.1.3 and
Reference:
4.1.3 guidance on expected
environments (cancelled; use
for
guidance)
FAA Doc: EASA CS CS 23.561, 23.1309
CS 25.789
CS 25.1309
CS 27.561, 27.1309
CS 29.561, 29.1309
8.7.2.1 Minimization of hazards.

The AAR system shall be designed to minimise hazards from lightning, static electricity, fuel leaks,
ignition sources and ground potential differences.

a. Ensuring that each hazard is identified and appropriately controlled and mitigated, to provide an
acceptable level of safety.
b. Static electricity resulting from the potential difference between aircraft.

1. Functional Hazard Assessment (FHA) should identify the hazards associated with lightning, static
electricity, fuel leaks, ignition sources and ground potential differences.
2. System Safety Assessment (SSA) should demonstrate that hazards associated with lightning, static
electricity, fuel leaks, ignition sources and ground potential differences are appropriately controlled and
mitigated.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P1 4.27.36-4.27.39
F.3.4.6.1.7, F.4.4.6.1.7 Reference: 00-970 P13 S3 3.5.16
00-970 P13 S3 3.5.18
00-970 P13 S3 3.5.26
00-970 P13 S3 3.5.39
00-970 P13 S4 L9
00-970 P1 S6
59-113 and 411 (for EMI/EMC)
STANAG
Reference:
FAA Doc: EASA CS CS 23.581, 23.1316
CS 25.954
Information Sources
CS 25.1316
CS 27.954, 27.1316
CS 29.954, 29.1316
8.7.2.1.1 Receptacle pressure box.

Receptacle installations shall have a fuel- and vapour-proof pressure box to collect any fuel spray that
may occur during AAR. Probe compartments shall be fuel- and vapour-proof so that any fuel and vapour
which may collect as a result of AAR operations is not able to migrate to other areas.

a. Venting and drainage of pressure box or probe compartments to prevent the build-up of hazardous
quantities of fuel.
b. Isolation from potential ignition sources, including lightning.

1. System Description Documents (SDD) should detail the pressure box and/or probe compartment
design, demonstrating that the pressure box collects fuel spray, and that the probe compartment prevents
migration of fuel to other areas of the aircraft.
2. Functional Hazard Assessment (FHA) should demonstrate that the design of the pressure box and/or
probe compartment provides adequate protection against ignition hazards.
Information Sources
DoD/MIL Doc: JSSG-2009: 3.3.8, 4.3.8; and Def-Stan 00-970 00-970 P1 4.26.5
Appendix F: F.3.4.6.2.2.4, Reference: 00-970 P13 S3 3.5.16
F.4.4.6.2.2.4 00-970 P13 S3 3.5.26
00-970 P13 S4 L9
STANAG 3614
Reference:
Reference:
8.7.2.1.2 Compartment drainage.

It shall be possible to drain the AAR compartments (receptacle pressure box, probe compartment, pod
compartments, Hose Drogue Unit, etc.) without causing hazards to the aircraft, other aircraft or creating a
potential hazard to personnel in all flight and ground conditions.

a. Ensuring that the capacity of the compartment is adequate to prevent over-flow.
b. Ensuring that the process for drainage of the compartment is easily achievable and safe.

1. System Description Documents (SDD) should detail the provisions for drainage of each AAR
compartment.
2. Technical Publications should detail the procedures for safe drainage of each AAR compartment.
3. Rig, ground and flight testing should demonstrate that drainage of each AAR compartment is
achievable in accordance with the defined procedures in ground and flight as applicable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: 3.3.8, 4.3.8; and Def-Stan 00-970 00-970 P1 4.3.8
Appendix F: F.3.4.6.2.2.3, Reference: 00-970 P1 4.26.19
F.4.4.6.2.2.3 00-970 P13 S4 L9
STANAG
Reference:
CS 29.975
8.7.2.1.3 Merged with 8.7.2.1.1.

8.7.2.1.4 Merged with 8.7.2.1.2.
8.7.2.1.5 Merged with 8.7.2.
8.7.2.1.6 Merged with 8.7.2.1.2.
8.7.2.1.7 Refuelling pump dry run capability.
Dry running of any AAR pump (i.e. the running of a pump not submerged in fuel) shall not create a
potential ignition source.

a. The effect of failure of any safety device designed to prevent the dry running of AAR pumps.
b. The effect of running pumps when partially submerged and wholly unsubmerged.

1. Qualification Test Reports (QTR) should demonstrate that AAR pumps do not present a potential
ignition source under prolonged dry run conditions.
2. Rig, ground and flight testing should demonstrate that the dry running of AAR pumps does not cause
an unacceptable rise in temperature of the pump or any surrounding area.
3. System Safety Assessment (SSA) should demonstrate that the risk of ignition due to the dry running of
any AAR pump is suitably controlled and mitigated.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.2.1, 3.3.10.1.1 Def-Stan 00-970 00-970 P1 4.27.23-4.27.40
JSSG-2009 Appendix G: Reference: 00-970 P13 3.5.14
3.4.7.6, 4.4.7.6 00-970 P13 S4 L9 5.2.2
STANAG 3614
Reference:
CS 25.1316
8.7.2.1.8 Secondary barrier.

A secondary liquid and vapour-tight barrier shall be in place between the AAR fuel tanks and all identified
fire and ignition hazard areas and inhabited areas.

a. Providing means to highlight the failure of the primary barrier.

1. Zonal Hazard Assessment (ZHA) should identify the fire and ignition hazard areas of the aircraft, and
the inhabited areas of the aircraft.
2. System Description Documents (SDD) should detail the primary and secondary vapour-tight barriers in
place between AAR tanks and fire and ignition hazard areas and inhabited areas.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix E: Def-Stan 00-970 00-970 P13 S3 3.5.26
E.3.4.5.6.11, E.4.4.5.6.11; and Reference:
Appendix F: F.3.4.6.1.6, STANAG
F.4.4.6.1.6, F.3.4.6.1.7,
F.4.4.6.1.7 Reference:
FAA Doc: EASA CS
Reference:
8.7.2.1.9 Merged with 8.7.2.1.

8.7.2.1.10 Merged with 8.7.2.1.
8.7.2.2 Aircraft flight control/handling qualities.
Flight control/handling qualities of the aircraft shall not be unacceptably degraded when the AAR sub-
system is installed or operating under normal AAR and single-failure conditions.

a. Normal installation and operating conditions the aircraft (in tanker and/or receiver role) in isolation, with
the AAR sub-system in either stowed or deployed configuration
b. Ensuring that satisfactory flight stability and handling qualities are achievable for the tanker/receiver
AAR interface within the specified AAR envelope.

1. Technical Publications should detail any flight handling limitations or restrictions with the AAR fitted, or
when performing AAR operations.
2. Flight simulation and flight testing should demonstrate that the handling qualities of the aircraft are
acceptable with AAR equipment fitted, and during AAR operations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 Section
F.3.4.6.2.2.2, F.4.4.6.2.2.2, Reference: 3.5
F.3.4.6.2.3.2, F.4.4.6.2.3.2 STANAG
Reference:
FAA Doc: 14CFR reference: 23 Subpart EASA CS CS 23 Subpart B
B, 25 Subpart B, 27 Subpart B, Reference: CS 25 Subpart B
29 Subpart B CS 25 Subpart G
CS 27 Subpart B
Information Sources
CS 29 Subpart B
8.7.2.2.1 Flight control/handling qualities degradation.

Failure of the AAR system preventing return to a fully stowed configuration shall not degrade flight
handling qualities below safe limits, or prevent continued safe flight and landing.

a. Failure of both receipt and dispense subsystems in the extended positions.
b. The operation of jettison systems, and the result of failure of such systems.

1. System Description Documents (SDD) should detail any design features incorporated to prevent
degradation in flight handling qualities resulting from failure of AAR sub-systems.
2. System Safety Assessments (SSA) should demonstrate that the risk associated with failure of AAR
retraction sub-systems is acceptable.
3. Flight simulation and flight testing should demonstrate that flight handling qualities are acceptable
following failure of the AAR system preventing return to a fully stowed configuration, and during jettison of
AAR equipment (if applicable).
Information Sources
DoD/MIL Doc: JSSG-2001: 3.3.11.1.1.1 Def-Stan 00-970 00-970 P13 3.5.39
Reference: 00-970 P13 3.5.51
00-970 P13 S4 L9
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.2.2.2 Ram air turbine failure.

Ram Air Turbines (RAT) incorporated as part of the AAR system shall not unacceptably degrade flight
control/handling qualities of the aircraft or prevent continued safe flight and landing.

a. Operation of the RAT in all flight phases.
b. Asymmetrical RAT operation.
c. Failure of the RAT in a deployed, stationary configuration.

1. System Description Documents (SDD) should provide detail regarding any RAT(s) installed as part of
the AAR system, and any associated safety devices.
2. Functional Hazard Assessment (FHA) should demonstrate that the hazards associated with the RAT
cannot cause unacceptable system effects or flight handling qualities.
3. Failure Modes and Effects Analysis (FMEA) should demonstrate that the hazards associated with
failure of the RAT are acceptable, and cannot prevent continued safe flight and landing.
4. Flight simulation and flight testing should demonstrate that installation, operation and failure of the
RAT(s) does not prevent continued safe flight and landing.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 S4 L9
3.4.6.1.1, 4.4.6.1.1, 3.4.6.1.2, Reference: 00-970 P13 S3, 3.5.18
4.4.6.1.2 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.7.2.2.3 Jettison of stores/pods.

Jettison of AAR equipment shall not result in unacceptable flight handling qualities, or prevent continued
safe flight or landing.

a. Defining an overall level of safety to be met, taking into account likely operational reasons for jettison of
AAR equipment, and the frequency with which such jettison is expected.
b. Ensuring that the flight handling qualities of the aircraft following jettison of AAR equipment supports
the expected aircraft missions following such jettison.

1. The aircraft specification should specify the requirement for jettison of AAR equipment if applicable.
2. System Description Documents (SDD) should detail provisions for jettison of AAR equipment (if
required).
3. Functional Hazard Assessment (FHA) should demonstrate that hazards associated with jettison of AAR
equipment are acceptably controlled and mitigated.
4. Rig, ground and flight testing should demonstrate that AAR equipment can be successfully and safely
jettisoned.
5. Flight simulation and flight testing should demonstrate that flight handling qualities during and following
jettison of AAR equipment are acceptable, and that jettison of AAR equipment does not prevent continued
safe flight or landing.
Information Sources
Reference:
STANAG
Reference:
CS 27.1309
CS 29.1309
8.7.2.2.4 Hose jettison function.

It shall be possible to jettison any portion of AAR hose in a safe and timely manner without resulting in
unsafe flight handling qualities, or preventing continued safe flight or landing.
a. Defining an overall level of safety to be met, taking into account likely operational reasons for jettison of
AAR hose, and the frequency with which such jettison is expected.
b. Ensuring that the flight handling qualities of the aircraft following jettison of AAR hose supports the
expected aircraft missions following such jettison.

1. System Description Documents (SDD) should detail provisions for jettison of AAR hose.
2. Functional Hazard Assessment (FHA) should demonstrate that hazards associated with jettison of AAR
hose are acceptably controlled and mitigated.
3. Rig, ground and flight testing should demonstrate that AAR hose can be successfully and safely
jettisoned.
4. Flight simulation and flight testing should demonstrate that flight handling qualities during and following
jettison of AAR hose are acceptable, and that jettison of AAR hose does not prevent continued safe flight
or landing.
Information Sources
DoD/MIL Doc: Def-Stan 00-970 00-970 P13 S4 L9
Reference: 00-970 P13 S3, 3.5.57
STANAG
Reference:
CS 27.1309
CS 29.1309
8.7.2.3 Egress with unstowed equipment.

The in-flight egress, ground emergency egress, and assisted egress of any crewmember of either tanker
or receiver aircraft shall not be hindered when the AAR system interface cannot be returned to its fully
stowed configuration.

a. All methods of egress, including ejection or use of any provided emergency escape.
b. Failure of AAR equipment in any combination of un-stowed configuration (for example more than 1
hose extended).

1. Functional Hazard Assessment (FHA) should demonstrate that hazards associated with emergency
egress with AAR equipment in an un-stowed configuration are acceptable.
2. Technical Publications should provide procedures for emergency egress with AAR equipment fitted
and in an un-stowed condition.
3. Rig, ground and flight testing should demonstrate that emergency egress is not hindered by the AAR
equipment in an un-stowed condition.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 S4 L9 7.4.1
Information Sources
F.3.4.6.2.2.2, F.4.4.6.2.2.2, Reference:
F.3.4.6.2.3.2, F.4.4.6.2.3.2 STANAG
Reference:
CS 25.1309
CS 27.1309
CS 29.809, 29.1309
8.7.2.4 Built-in-test and fault isolation.

AAR systems shall incorporate Built In Test (BIT) functions and fault isolation provisions to maximise the
safety of AAR operations.

a. Ensuring that the use of BIT functions and fault isolation provisions is simple and can be utilised at all
appropriate times (during ground maintenance, pre-flight checks, AAR rendezvous, etc.).

1. System Description Documents (SDD) should detail BIT functions and fault isolation provisions
incorporated into the design of the AAR system.
2. Technical Publications should detail procedures for the use of AAR BIT functions and fault isolation
provisions.
3. Rig, ground and flight testing should demonstrate that AAR BIT functions and fault isolation provisions
function as intended.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: 3.2.9, 3.2.9.1, Def-Stan 00-970 00-970 P13 S4 L9 6.5.1
4.2.9 Reference: 00-970 P13 S4 L9 8.2.1
00-970 P13 S4 L9 7.4.1
STANAG
Reference:
CS 27.1309
CS 29.1309
8.7.3 Removal of AAR equipment.

The aircraft shall have acceptable handling qualities and safety of flight in all permitted configurations of
the AAR equipment.

a. Removable hardware, which may include AAR pods, fuel tanks and AAR probe installations;
b. All permitted flight configurations (e.g. partial installation of the AAR system).

1. System Description Documents (SDD) should detail the permitted flight configurations.
2. System Safety Assessment (SSA) should demonstrate that hazards associated with the AAR system in
all allowable configurations of the AAR hardware are acceptable and appropriately controlled and
mitigated.
3. Technical Publications should provide procedures for use of the AAR system and any flight handling
limitations/restrictions, for all allowable configurations of the AAR system.
Information Sources
Reference:
STANAG
Reference:
CS 27.1301
CS 29.1301
8.7.3.1 Removal of AAR equipment effect on other-system interfaces

With AAR equipment removed, interfaces with other systems (e.g., electrical, hydraulic and fuel) shall be
safe.

a. Electrical, hydraulic and fuel system components, leads, pipes and assemblies, ensuring that all
interfaces are properly covered, sealed, isolated, etc.

1. System Description Documents (SDD) should detail the various configurations in which AAR
equipment installation is permitted, and for each configuration, provisions for the isolation of system
interfaces not in use.
2. Technical Publications should provide procedures for the isolation of system interfaces when not in
use.
3. Rig, ground and flight tests should demonstrate that interface isolation is effective when all or part of
the AAR system is removed.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: F.3.4.6.1.5, Def-Stan 00-970 00-970 P13
F.4.4.6.1.5; G.3.4.7.3, Reference:
G.4.4.7.3 STANAG
Reference:
CS 27.1309
CS 29.1309
8.7.3.2 Merged with 8.7.3.

8.7.3.3 AAR equipment removal effect on operation of other systems.
Removal of AAR equipment shall not unacceptably degrade the operation of the other aircraft systems.

a. Electrical, hydraulic and fuel system components, leads, pipes and assemblies;
b. Impact of removal or the AAR equipment on the operation of the remaining aircraft systems.

1. System Description Documents (SDD) should detail the various configurations in which AAR
equipment installation is permitted, and should highlight any degradation in any aircraft system due to
partial installation or removal of the AAR system.
2. Technical Publications should detail any limitations/restrictions in place due to partial installation or
removal of the AAR system.
3. Rig, ground and flight tests should demonstrate that all aircraft systems operate acceptably with the
AAR system partially installed or removed.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.3.11.1.1- Def-Stan 00-970 00-970 Part 13 Section 3, 3.5
JSSG-2009: F3.4.6.1.5, STANAG
F.4.4.6.1.5 Reference:
MIL-STD-1797
CS 27.1309
CS 29.1309

8.7.4.1 Exposure of components to proof pressure.
AAR system plumbing/components shall withstand exposure to the specified proof pressure without
resulting in excessive or permanent deformation, fuel leakage and/or degradation of system performance.

a. Ensuring that appropriate proof pressures are defined, which should be greater than the maximum
expected system pressure, including pressure transients (surges).

1. System Description Documents (SDD) should define the proof pressure of the AAR system.
2. Analysis should demonstrate that pressures in the AAR system do not exceed the defined proof
pressure, including all expected operating conditions.
3. Analysis should demonstrate that AAR system components and their supports are able to withstand
the defined proof pressure without excessive or permanent deformation, fuel leakage and/or degradation
of system performance.
demonstrate that AAR system pressures do not exceed the defined proof pressure, and that the AAR
system operates without excessive or permanent deformation, fuel leakage and/or degradation of system
performance.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: ARSAG 00-03-01, "Pressure Def-Stan 00-970 00-970 P13 3.5.9
Defs & Terms, Mar '03.doc" 3.5 Reference: 00-970 P13 3.5.10
and 4.7 (unverified) 00-970 P13 S4 L9
JSSG-2009 Appendix F:
STANAG
F.3.4.6.1.3, F.4.4.6.1.3
Reference:
FAA Doc: EASA CS
Reference:
8.7.4.2 Functional modes.

Critical operational functions and functional modes shall be provided in the AAR system to ensure the
AAR operations can be conducted without creating hazards to aircraft or personnel.

a. Initiation of safe emergency disconnects of the AAR system when required by either party (tanker or
receiver) when in AAR contact;
b. Safe cessation of fuel flow when in contact;
c. Emergency extensions or retractions of the AAR probe system.

1. Functional Hazard Assessment (FHA) should state the critical operational functions and functional
modes and demonstrate that hazards associated with AAR operations are acceptable.
2. System Safety Assessment (SSA) should capture the hazards associated with critical operational
functions and functional modes associated with AAR operations, and show that they are are acceptable
and appropriately controlled and mitigated.
3. Ground and flight testing should demonstrate that the functional modes permitting AAR can be
conducted without causing loss of aircraft or creating hazards to personnel.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 S4 L9 6.5.1
F.3.4.6.2.2.7, F.4.4.6.2.2.7, Reference: 00-970 P13 S4 L9 8.2.1
F.3.4.6.2.3.1.2, F.4.4.6.2.3.1.2 STANAG
Reference:
FAA Doc: EASA CS CS 23.1301, 23.1309
CS 25.1301
CS 25.1302
CS 25.1309
CS 27.1301, 27.1309
CS 29.979, 29.1301, 29.1309
8.7.4.3 AAR Operator Control

Adequate controls shall be provided and properly located for the appropriate crewmember(s)/operator(s)
to activate and safely control the critical functions of the AAR system.
a. Critical functions.
b. Anthropometric ranges of AAR operators.

1. System Description Documents (SDD) should detail the controls provided to flight crew for the control
of AAR functions.
2. System Safety Assessment (SSA) should demonstrate the crew member/operator(s) ability to carry out
the critical AAR operational functions.
3. Functional Hazard Assessment (SSA) should demonstrate the crew member/operator(s) ability to carry
out the critical operational functions and functional modes and demonstrate that hazards associated with
AAR operations are acceptable.
4. Workload and Anthropometric assessment should demonstrate that the crewmember(s)/operator(s)
can safely activate and control the various functions of the AAR system.
5. Flight simulation and flight testing should demonstrate that controls are suitably located and provide the
crew with the ability to safely initiate and control AAR functions.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 3.5
F.3.4.6.2.1.3, F.4.4.6.2.1.3 Reference: 00-970 P13 3.5.59
JSSG-2010: 3.2.14, 4.2.14 00-970 P13 S4 L9 6.5.1
(Unverified) 00-970 P1 4.19
00-970 P1 4.19.38
00-970 P13 3.5.7
STANAG
Reference:
CS 25.1353
CS 27.771
CS 29.771, 29.1353
8.7.4.4 Display provisions.

Displays shall be provided and properly located to provide the appropriate crewmember(s)/operator(s)
with the information necessary to safely perform AAR operations.

a. Display visibility, location, and background/ambient lighting conditions, taking into account day and
night operation;
b. Clarity of displays and, if relevant, choice of colours and icons (consider international standards and
interoperability requirements).

1. System Description Documents (SDD) should detail the AAR displays provided, the various indications
and other information that the displays provide to crew, and the situations/logic that will lead to each
indication.
2. Technical Publications should provide procedures for safe AAR operations, including detail on the
various indications that could be provided to aircrew, and the actions that aircrew should subsequently
take.
3. Rig, ground and flight testing should demonstrate that displays function as expected, and that AAR
operations can be conducted safely in accordance with the provided procedures, using the provided
displays effectively.
Information Sources
Comm'l Doc:
00-970 P13 3.5.7
00-970 P13 S4 L9 6.5.1
STANAG
Reference:
CS 27.1321
CS 29.1321
8.7.4.5 Display lighting.

The intensity of displays shall be variable and compatible with Night Vision Devices (NVD) where such
devices are permitted for use on the aircraft.

a. An appropriate range of intensity variation, taking into account the type and role of the aircraft, and the
possibility for reducing intensity to the point that it may become difficult to discern the content of displays
accurately.
b. The types of NVD with which the displays should be compatible.

1. System Description Documents (SDD) should detail the provisions for variation of AAR display
intensity, and compatibility with NVD.
2. Flight simulation and flight testing should demonstrate that displays function as intended, providing
adequate intensity variation, and NVD compatibility.
Information Sources
Comm'l Doc:
4.5.2.1.2 (Unverified) Reference: 00-970 P1 4.15.48
STANAG 3224
Reference: 3800
FAA Doc: EASA CS
Reference:
8.7.5 Compatibility with other systems.

Installation and operation of the AAR system shall not unacceptably degrade the operation, function,
performance, or safety of other aircraft systems.

a. Aircraft systems with which the AAR system has direct interfaces, such as hydraulic, electrical, fuel,
and avionics systems, including fuel management sub-systems.
b. Aircraft systems with which the AAR system does not have direct interfaces, but which it may otherwise
affect, such as flying controls.
c. The effect of AAR pressures in aircraft fuel systems, and hazards associated with any resulting leaks in
either (AAR or fuel) system.

1. System Description Documents (SDD) should detail the systems with which the AAR system has direct
interfaces, and any other systems which the AAR system may affect.
2. Systems Interface Documents (SID) should detail the parameters at each interface between the AAR
system and other systems.
3. Analysis should demonstrate, for each aircraft system, that the load induced by the AAR system does
not result in unacceptable performance of the aircraft system, or any other power-operated system.
demonstrate that the performance of all aircraft systems remains acceptable throughout AAR operations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 S4 L9
F.3.4.6.1.1, F.4.4.6.1.1 Reference:
STANAG
Reference:
CS 27.1309
CS 29.1309
8.7.5.1 Merged with 8.7.5.

8.7.5.2 Merged with 8.7.1.6.
8.7.5.3 Merged with 8.7.1.5.
8.7.5.4 Field of view.
The field of view of the crew member(s)/operator(s)/automated system(s) shall be adequate for AAR
operations, and other aircraft operations.

a. Normal operation of the AAR system (i.e. probe or pod fitted / stowed / extended);
b. Failure of retractable elements to return to the fully stowed configuration;
c. Safety critical flight phases.

1. Analysis should demonstrate that any restriction in the field of view in any direction, caused by the
installation or use of AAR equipment is acceptable.
2. Flight simulation and flight testing should demonstrate that the installation and use of AAR equipment
does not cause unacceptable restriction in the available field of view, and cannot prevent continued safe
flight or landing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.3.2.1, 4.3.2.1 Def-Stan 00-970 00-970 P1 4.17.6
(unverified) Reference: 00-970 P13 3.5.22
JSSG-2009 Appendix F STANAG
3.4.6.2.3.2 Reference:
FAA Doc: EASA CS
Reference:
8.7.5.5 Merged with 8.7.5.

8.7.5.6 Effects of electrical failure(s).
Electrical failures within the AAR system shall not prevent the continued safe function of the aircraft
electrical system, or any other power-operated system.

a. Providing a means to electrically isolate the AAR system from the main electrical system in the event
that a failure occurs.

1. System Description Documents (SDD) should detail provisions for the electrical isolation of AAR
equipment from the aircraft's electrical system.
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that any electrical failure of the AAR
system cannot lead to failure of the aircraft's electrical system, or prevent operation of any other power-
operated system.
3. Technical Publications should provide procedures for the electrical isolation of the AAR system, and,
where appropriate, its sub-elements.
4. Rig, ground and flight testing should demonstrate that the AAR system can be electrically isolated in
accordance with defined procedures.
Information Sources
DoD/MIL Doc: JSSG-2009 Appendix F: Def-Stan 00-970 00-970 P13 3.5.18
F.3.4.6.1.1, F.4.4.6.1.1 Reference: 00-970 P1 S6
STANAG
Reference:
CS 27.1309
CS 29.1309
8.7.5.7 Merged with 8.7.5.

8.7.5.8 Merged with 8.7.5.
8.7.5.9 Merged with 8.7.5.
8.7.5.10 Merged with 8.7.2.2.1.
8.7.5.11 Merged with 8.7.2.2.4.
8.7.5.12 Merged with 8.7.5.
8.7.5.13 Merged with 8.7.5.
8.8 MECHANISMS
This section covers the design, installation, integration and compatibility of all mechanical actuation
subsystems that provide motion and position locking functions for stowable and deployable surfaces such
as folding wing panels, folding rotor blade systems, folding tail rotors/pylons in ground and air applications
for both operational and maintenance purposes. Additionally, equipment involved in the securing,
fastening, and mechanizing of aircraft doors, hatches, ramps, etc. is also covered; including items such
as locks, latches, bearings, hinges, linkages, indicators, and actuators.
Equipment that is mechanical in form, fit, and function, but not covered by any other system-level
requirements should be included herein.
8.8.1 Functionality.
Mechanisms shall perform their intended function(s) throughout all expected operating environments and
conditions.

a. The failure of power supply systems, actuators, and linkages, and the resulting effect on aircraft
functions.
b. The varying operating environments through which operation is expected, including temperatures,
humidities, dust and sand, frosting and icing, and operation under load.

1. System Description Documents (SDD) should detail the mechanisms incorporated in the design of the
aircraft, their source of power, and their function(s).
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that the risk of failure of each
mechanism is acceptable.
3. Rig, ground and flight testing should demonstrate that mechanisms operate as intended through all
expected operating conditions.
Information Sources
DoD/MIL Doc: JSSG-2009: Appendix I, Def-Stan 00-970 00-970 P1 4.19.59
3.4.9.1, 3.4.9.4 Reference: 00-970 P1 4.20.1
MIL-M-87222 Mechanical 00-970 P1 4.20.7
Systems for Aircraft Doors and 00-970 P1 4.20.8
Canopies - inactive for new 00-970 P1 4.20.10
design 00-970 P1 4.20.18
00-970 P1 4.23.9
00-970 P1 4.23.10
00-970 P1 4.23.40
STANAG 4671.601
Reference: 4671.783
4671.843
4671.905
4671.1301
4671.1309
Information Sources
CS 23.807
CS 23.843
CS 23.905
CS 23.1301
CS 23.1309
CS 25.601
CS 25.807
CS 25.809
CS 25.810
CS 25.843
CS 25.1301
CS 25.1309
CS 27.601
CS 27.807
CS 27.1301
CS 27.1309
CS 29.601
CS 29.783
CS 29.809
CS 29.1301
CS 29.1309
8.8.2 Effects of jams.

The jamming of mechanisms (e.g. due to inadvertent interference between parts) shall not result in
damage or permanent deformation to any latch or support structure.

a. The various locations at which a mechanism could jam, and the resulting forces throughout the
mechanism, and on any latches or support structure.
b. Preferred points of failure of the mechanism, taking into account its fail-safe design, maximisation of
airworthiness, and provisions for access for maintenance.

1. Structural analysis (static, dynamic and kinematic) should identify the point(s) of failure of the
mechanism and the loads through each mechanism component, latch and supporting structure through
expected and possible ranges of movement.
2. Rig testing should demonstrate the accuracy of the performed analysis, and should demonstrate that
the jamming of mechanisms cannot result in damage or permanent deformation of any latch or support
structure.
Information Sources
3.4.9.1, 3.4.9.4 Reference: 00-970 P1 4.20.8
Information Sources
Canopies: 3.1.4.9; 3.1.5.9; STANAG 4671.601
4.1.4.9; 4.1.5.9 - inactive for Reference: 4671.1301
new design 4671.1309
Reference: CS 23.783,
CS 23.807
CS 23.1301
CS 23.1309
CS 25.601
CS 25.783
CS 25.809
CS 25.1301
CS 25.1309
CS 27.601
CS 27.807
CS 27.1301
CS 27.1309
CS 29.601
CS 29.783
CS 29.809
CS 29.1301
CS 29.1309
8.8.3 Failure effects.

Failure of any mechanism shall not cause the loss of control of the aircraft, or prevent continued safe
flight and landing.

a. The varying modes through which each mechanism could fail, taking into account the loads through
each mechanism at all points in their travel.
b. All possible effects of failure, including direct effects (e.g. the failure of actuated flight control surfaces)
and indirect effects (damage to surrounding structure and equipment, severing of hydraulic lines,
electrical cables, fuel lines, etc.).
c. The effective mitigation of failure, for example ensuring that the failure of a primary mechanism does
not cause the failure of a secondary (back-up) mechanism.

1. System Description Documents (SDD) should detail any design features which provide controls and/or
mitigations for the failure of mechanisms.
2. Structural analysis (static, dynamic and kinematic) should identify the point(s) of failure of the
mechanism, and the travel of the mechanism at each failure.
3. Failure Modes and Effects Analysis (FMEA) should demonstrate that the failure of any mechanism
cannot cause the loss of control of the aircraft, or prevent continued safe flight and landing.
4. Rig, ground and flight testing should demonstrate that any controls and/or mitigations provided to
reduce the risk of failure of any mechanism functions correctly.
Information Sources
Information Sources
3.4.9.1, 3.4.9.4 Reference: 00-970 P1 4.20.7
Canopies: 3.1.2.4; 4.1.2.4 - 00-970 P1 4.23.9
inactive for new design 00-970 P1 4.23.22
STANAG 4671.601
Reference: 4671.783
4671.1301
4671.1309
CS 23.1301
CS 23.1309
CS 25.601
CS 25.783
CS 25.1301
CS 25.1309
CS 27.601
CS 27.1301
CS 27.1309
CS 29.601
CS 29.783
CS 29.1301
CS 29.1309
8.8.4 Independence from flight controls.

Operation (commanded, inadvertent or uncommanded) of any non flight control system mechanism shall
not restrict or prevent the correct operation of any flight control system mechanism.

a. All non flight control system mechanism, and any potential interference or other conflict that could arise
with any flight control system mechanism.
b. Potential interference or other conflict at the pilot/crew interface, at the flight control surface, and at any
point in between.

1. System Description Documents (SDD) should demonstrate independence between flight control
system mechanisms and mechanisms for other systems/functions.
2. Zonal Safety Assessment (ZSA) should confirm the independence between flight control system
mechanisms and mechanisms for other systems/functions.
3. Flight simulation, ground and flight testing should demonstrate that operation of other controls does not
restrict or prevent the correct operation of any flight control system mechanism.
Information Sources
Information Sources
3.4.9.1.3, 3.4.9.4, 3.4.9.3 Reference: 00-970 P1 4.20.7
Canopies: 3.1.2.6; 4.1.2.6 - 00-970 P1 4.23.9
STANAG 4671.601
Reference: 4671.783
4671.1301
4671.1309
CS 23.783
CS 23.1301
CS 23.1309
CS 25.601
CS 25.607
CS 25.783
CS 25.1301
CS 25.1309
CS 27.601
CS 27.607
CS 27.1301
CS 27.1309
CS 29.601
CS 29.607
CS 29.783
CS 29.1301
CS 29.1309
8.8.5 Fail-safe latching.

No single failure shall allow any latch to open inadvertently.

a. Failures of each latch, and other failures that could lead to the inadvertent opening of latches (e.g.
failure of hinges that could cause excessive loads on latches).

1. Structural analysis should identify the point(s) of failure of latches and any other part that could directly
cause the inadvertent opening of latches.
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that the failure of latch or any other
part does not cause the inadvertent opening of latches.
Information Sources
3.4.9.1.3, 3.4.9.4 Reference: 00-970 P1 4.20.7
Information Sources
Canopies: 3.1.5.1; 4.1.4.2 - 00-970 P1 4.23.40
STANAG 4671.601
Reference: 4671.783
4671.1301
4671.1309
CS 23.1301
CS 23.1309
CS 25.601
CS 25.783
CS 25.1301
CS 25.1309
CS 27.601
CS 27.1301
CS 27.1309
CS 29.601
CS 29.783
CS 29.1301
CS 29.1309
8.8.6 Interrelation of latching and locking systems.

Any locking system shall be incapable of locking, or indicating it is locked, unless all the latches are
properly latched in the fully secured position.

a. The latching and locking sequence, and the effect of any latch not being in the fully secured position.
b. Ensuring that any locked indications are only provided when all latches are fully secured, and locked.

1. System Description Documents (SDD) should detail any provision for the locking of latches, and means
preventing the locking of latches in an unsecured position.
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that the failure of any latch in an
unsecured position cannot lead to the locking of latches or indication of a locked mechanism.
Information Sources
3.4.9.1, 3.4.9.4 Reference: 00-970 P1 4.20.7
Canopies: 4.1.5.7 - inactive for 00-970 P1 4.23.10
new design
STANAG 4671.601
Information Sources
Reference: 4671.783
4671.1301
4671.1309
CS 23.1301
CS 23.1309
CS 25.601
CS 25.783
CS 25.1301
CS 25.1309
CS 27.601
CS 27.1301
CS 27.1309
CS 29.601
CS 29.783
CS 29.1301
CS 29.1309
8.8.7 Door pressurisation interlock.

All aircraft doors, whose inadvertent opening would present a probable hazard to continued safe flight
and landing, shall have provisions to prevent depressurisation or inadvertent pressurisation of the aircraft
to an unsafe level when the doors are closed but not fully secured (closed, latched, and locked).

a. The levels of depressurisation and inadvertent pressurisation considered hazardous to the continued
safe flight and landing of the aircraft.
b. Means for preventing the inadvertent opening of aircraft doors that are closed but not secured.
c. Means for preventing the depressurisation of the aircraft cabin when aircraft doors are closed but not
secured.
d. Means for preventing the inadvertent pressurisation of the aircraft cabin when aircraft doors are closed
but not secured.

1. System Description Documents (SDD) should detail the provided means to prevent the inadvertent
opening of aircraft doors, and the depressurisation and inadvertent pressurisation when the aircraft doors
are closed but not secured,
2. Rig, ground and flight testing should demonstrate that when any aircraft door that could affect
continued safe flight and landing is closed but not secured:
a. The door cannot be inadvertently opened.
b. The aircraft cabin cannot depressurise.
c. The aircraft cabin cannot inadvertently pressurise.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: Appendix I, Def-Stan 00-970 00-970 P1.4.20.1
3.4.9.1, 3.4.9.4 Reference: 00-970 P1 4.20.7
Information Sources
Systems for Aircraft Doors and STANAG 4671.601
Canopies: 3.1.5.8; 4.1.5.8 - Reference: 4671.1301
inactive for new design 4671.1309
CS 23.1309
CS 25.365
CS 25.601
CS 25.783
CS 25.1301
CS 25.1309
CS 27.601
CS 27.1301
CS 27.1309
CS 29.601
CS 29.1301
CS 29.1309

Adequate information shall be available to notify the flight crew of the status of aircraft door and
mechanism security; i.e. that an unsafe indication is provided when a door/mechanism, latching, or
locking system is unsecured, and that a safe indication is provided when aircraft doors and other
mechanisms are secured

b. Ensuring that changes in the aircraft door/mechanism status are highlighted to the crew in a clear and
unambiguous manner.
c. Ensuring that any required pilot/crew input or intervention is clearly and unambiguously identified.
d. Ensuring that, where pilot/crew action is required in accordance with an emergency procedure,
checklist or other Technical Publication, the relevant section of the Technical Publication is clearly defined
such that the pilot/crew can intervene with minimal delay.

1. System Description Documents (SDD) should identify the indications/displays provided to crew
including where appropriate the conditions that would lead to specific indications.
2. System Description Documents (SDD) should clearly define the possible system operating conditions
and the operating parameters that trigger each condition.
3. Analysis (e.g. System Simulations) should demonstrate that system status information and changes in
system operating conditions are provided to the crew throughout all foreseeable aircraft operating
conditions.
4. Rig and/or Ground Testing should verify the accuracy of the performed analysis, including the effect of
system/equipment failures.
5. Flight Simulations, Ground Testing and/or Flight Testing should verify that the system status
information and changes in operating conditions are displayed clearly and unambiguously, and that
emergency procedures, checklists and other Technical Publications can be used effectively.
Information Sources
Comm'l Doc:
3.4.9.1, 3.4.9.4 Reference: 00-970 P1 4.20.7
Systems for Aircraft Doors and STANAG 4671.601
Canopies: 3.1.7.1; 4.1.7.1 - Reference: 4671.783
inactive for new design 4671.1301
4671.1309
CS 23.1301
CS 23.1309
CS 25.601
CS 25.783
CS 25.1301
CS 25.1309
CS 27.601
CS 27.1301
CS 27.1309
CS 29.601
CS 29.783
CS 29.1301
CS 29.1309
8.8.9 Merged with 9.1

8.8.10 Door seals.
All door seals shall prevent rain or water leakage into the aircraft during all flight and ground operations,
and while the aircraft is parked and depressurised under storm conditions.

a. The effect of variation in aircraft attitude, and positions of moveable components.
b. The effect of reasonably expected deterioration of seals prior to their replacement.

1. System Description Documents (SDD) should detail provisions for the prevention of water ingress.
2. Rig, ground and flight testing should demonstrate the effectiveness of seals or other devices, and
should demonstrate that no water enters the cabin on the ground or in flight during storm conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009: Appendix I: Def-Stan 00-970 00-970 P1 4.3.4
3.4.9.1.10; 3.4.9.4 Reference: 00-970 P1 4.20.1
Information Sources
Canopies: 3.1.10.2; 4.1.10.2 - 00-970 P13 3.11.21
inactive for new design STANAG 4671.601
Reference: 4671.609
4671.1301
4671.1309
CS 23.1301
CS 23.1309
CS 25.601
CS 25.609
CS 25.1301
CS 25.1309
CS 27.601
CS 27.609
CS 27.1301
CS 27.1309
CS 29.601
CS 29.609
CS 29.1301
CS 29.1309

8.8.12 Locking of structural load path mechanisms.
Mechanisms that also provide a structural load path, shall be fail-safe. I.e. failure of the mechanism shall
not result in failure of the structural load path.
a. Ensuring that mechanisms fail in a suitable position, for example with a flight control surface in a
central position.
b. Ensuring that any locking required to secure a failed mechanism is either automatic or easily
achievable by the pilot/crew and documented in necessary technical publications.

1. System Description Documents (SDD) should detail fail-safe provisions for all mechanisms that also
provide a structural load path, and the range of positions the mechanisms may fail in.
2. Structural analysis should confirm that failure of any mechanism that also provides a structural load
path does not result in failure of that structural load path.
3. Aerodynamic analysis and/or testing should demonstrate that the failure of any mechanism in any
possible position, but while still acting as a structural load path, does not result in loss of control or
prevent the continued safe flight and landing of the aircraft.
Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: JSSG-2009, Appendix I: Def-Stan 00-970 00-970 P1 3.4.15
3.4.9.1.10; 3.4.9.4; 3.4.9.4.2; Reference:
4.4.9.4.2 STANAG
Reference:
FAA Doc: EASA CS
Reference:

8.8.14 Utility actuation control.
Utility actuation mechanisms (those mechanisms provided for functions not critical to flight) shall permit
controlled operation of normal and emergency functions and shall provide separate means for motion
control and locking.

a. Ensuring adequate separation between motion control and locking, such that both actuation power and
control for moving the mechanism to its commanded position are independent from the power and control
used to hold the mechanism in a given state.
b. Preventing inadvertent actuation of mechanisms, including through controls (e.g. by the incorporation
of guards) and through extraneous interference (e.g. electromagnetic interference).

1. System Description Documents (SDD) should detail any utility systems and their mechanisms,
highlighting the separate controls for their actuation and their locking.
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that failure of the actuation means or
locking means of any utility system does not result in a hazardous effect that could prevent continued
safe flight and landing.
3. Rig, ground and flight testing should demonstrate that the controls provided for utility systems allows
for controlled actuation and locking of its mechanisms.
Information Sources
DoD/MIL Doc: JSSG-2009, Appendix I: Def-Stan 00-970
3.4.9.1.10; 3.4.9.4; 3.4.9.4.4; Reference:
4.4.9.4.4 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.15 Safety devices for manual operation.

Actuation subsystems that have provision for manual operation shall include safety devices in order to
prevent injury to maintainers in case of inadvertent application of power during a manually powered
operation and shall incorporate means of controlling deployment speed to a specified safe rate.

a. Preventing inadvertent mechanism operation (incorporation of mechanical locks, circuit breaker lock-
out collars, manually operated valves, etc.);
b. Ensuring that manual system operation does not require personnel access near power-operated
moving parts;

1. System Description Documents (SDD) should detail any provisions for manual operation of
mechanisms and the safety devices provided to maximise the safety of its operator.
2. System Safety Assessment (SSA) should demonstrate that the risk of injury when operating any
manually operated mechanism is acceptable.
3. Technical Publications should detail procedures for the operation of manually operated mechanisms,
highlighting any parts of the procedure required to ensure the safety of personnel.
4. Rig and ground testing should demonstrate that manually operated mechanisms can be operated in
accordance with the Technical Publications effectively and safely.
Information Sources
3.4.9.1.10; 3.4.9.4; 3.4.9.4.5; Reference:
4.4.9.4.5 STANAG
Reference:
CS 27.1309
CS 29.1309
8.8.16 Utility actuation systems with ground power.

Utility actuation mechanisms (those mechanisms provided for functions not critical to flight) shall be
capable of operating from ground power, and separately, from aircraft power.

a. Ensuring adequate system/mechanism performance for each and all sources of power, including
transitions from one source of power to another.
b. Ensuring that system safety is unaffected by the source of power, including the control, indication and
sequencing of mechanisms.

1. System Description Documents (SDD) should detail any utility systems and their power supplies.
2. Rig, ground and flight testing should demonstrate the correct function of each utility system, and where
possible during aircraft operation the concurrent operation of multiple utility systems using each and all
sources of power, including transition from one power source to another.
Information Sources
Comm'l Doc:
3.4.9.1.10; 3.4.9.4; 3.4.9.4.6; Reference:
4.4.9.4.6 STANAG
Reference:
FAA Doc: EASA CS
Information Sources
Reference:
8.8.17 Actuation time.

All actuation subsystems shall:
a. Safely perform their specific functions within the specified times and number of cycles;
b. Repeatedly perform their specific functions within an acceptable interval; and,
c. Have an acceptable expected life, taking into account the performance and expected usage of the
mechanism.

a. The actuation times and cycles for each subsystem;
b. Ensuring the time between successive operations of the same cycle is not degraded over time and can
be consistently repeated, throughout the design service life;
c. Ensuring the time between initiation of the command to the completion of the action is within the design
allowable;
d. Ensuring specified times and cycles are compatible with the aircraft operational requirements;
e. Ensuring that common cycles between related systems that operate in conjunction with one another
are taken into account.

1. System Description Documents (SDD) should detail the actuation time and/or number of actuation
cycles required for each mechanism.
2. Equipment testing should demonstrate that actuators and mechanisms can withstand the required
number of cycles without failure.
3. Technical Publications should define replacement intervals for mechanisms and their actuators.
Information Sources
Comm'l Doc:
3.4.9.1.10; 3.4.9.4; 3.4.9.4.7; Reference:
4.4.9.4.7 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.18 Actuation without damage.

Utility actuation mechanisms shall prevent damage to adjacent movable surfaces (e.g. flaps) during
folding and unfolding operations.

a. Use of mechanical interlocks or control logic to prevent actuation power/movement when other
mechanical surfaces or flight control surfaces are in a position to be damaged or compromised;
b. Environmental effects (such as wind, temperature and snow/ice).
1. System Description Documents (SDD) should detail the design features incorporated to prevent utility
actuation mechanisms from causing damage to movable surfaces during folding and unfolding
operations.
2. Technical Publications should detail procedures to prevent damage to moveable surfaces during
folding and unfolding operations.
3. Rig and ground testing should demonstrate that folding and unfolding operations can be performed in
accordance with defined procedures without causing interference or damage between utility mechanisms
and moveable surfaces.
Information Sources
Comm'l Doc:
3.4.9.1.10; 3.4.9.4; 3.4.9.4.8; Reference:
4.4.9.4.8 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.19 Actuation subsystem attachment location.

Actuation subsystem attachments shall not form an integral part of aircraft structure, such that failure of
attachments does not cause failure of structure, and such that attachments are replaceable without the
replacement of aircraft structure.

a. Ensuring that fastening means for securing attachments to structure allow for the replacement of
attachments.
b. Providing frangible design features to ensure that attachment points fail before any excessive or
permanent deformation of aircraft structure.
c. Providing adequate access to attachment points to allow for their installation and removal.

1. System Description Documents (SDD) should detail the attachment means for each mechanism,
highlighting separation from aircraft structure.
2. Structural analysis should demonstrate that overload of a mechanism causing failure of the attachment
point cannot result in excessive or permanent deformation of aircraft structure.
3. Technical Publications should detail the procedures for replacement of each mechanism attachment
point.
Information Sources
Comm'l Doc:
3.4.9.1.10; 3.4.9.4; 3.4.9.4.9; Reference:
4.4.9.4.9 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.20 Mechanism clearances.

Sufficient clearance shall be maintained between mechanisms and other parts of the aircraft and the
ground such that inadvertent interference/contact is impossible throughout the travel of the mechanisms
in all ground and flight conditions.

a. Critical combinations of landing gear deflections (including flat tyres, compressed landing gear, etc.)
and aircraft loading conditions.
b. Variation in mechanisms throughout the aircraft's life, including the effects of wear, adjustment of parts,
and variation in part dimensions (i.e. tolerances).
c. Environmental effects (such as wind, temperature and snow/ice).

1. Structural analysis should demonstrate that inadvertent interference/contact is impossible throughout
the travel of mechanisms in all ground and flight conditions.
2. Rig, ground and flight testing should verify the accuracy of analysis performed and should demonstrate
that inadvertent interference/contact between mechanisms does not occur in critical ground and flight
conditions.
3. Technical Publications should detail procedures for adjusting mechanisms to ensure that inadvertent
interference/contact does not occur, taking into account the effects of flight conditions.
Information Sources
Comm'l Doc:
3.4.9.1.10; 3.4.9.4; 3.4.9.4.10; Reference:
4.4.9.4.10 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.21 Manual actuation provisions for ground operations.

Mechanisms used during ground operations or maintenance shall have manual means of operation to
allow operation during power-off conditions.

a. Provisions to prevent hazards to maintenance personnel or damage critical components that could
cause blade/wing/tail surface control loss or damage to electrical connectors, control lines, or such during
normal, manual, or externally powered blade-folding and spreading;
b. Power-off conditions due to maintenance, or emergency conditions (e.g. failed power units);
c. Externally-applied-load backdrive protection;
d. Maintainer-induced overload protection;
e. Ensuring successful operation with a coating of ice covering any locking mechanism or
locked/unlocked indicating mechanism.

1. System Description Documents (SDD) should detail the means provided for manual operation of
mechanisms used during ground operation, and the means provided for manual operation of other
mechanisms used during maintenance.
2. Technical Publications should detail procedures for use of manual operation means for mechanisms to
be used during ground operations, and those to be used during maintenance.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009, Appendix I: Def-Stan 00-970 00-970 P1 4.20.11
3.4.9.1.10; 3.4.9.4; 3.4.9.4.11; Reference:
4.4.9.4.11 STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.22 Clear display of locked/unlocked status.

The locked-unlocked condition of mechanisms used during ground operations shall be visually displayed,
externally, internally, or both if appropriate, by purely mechanical, non-electric means.

a. Direct visual inspection of the locking mechanism itself;
b. Use of flags, distinctively coloured cylinders, and distinctively coloured portions of the aircraft surface
that are revealed by the actuating mechanism itself for external identification;
c. Identification during day or night conditions;
d. Ensuring devices are visible from any position that a maintainer could be expected to be at during the
actuation cycle.

1. System Description Documents (SDD) should detail the means provided to indicate the locked-
unlocked condition of mechanisms to ground crew.
2. Technical Publications should detail procedures for working around mechanisms, highlighting the
means for ensuring that mechanisms are secured, and the indications provided to ground crew.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 I: 3.4.9.4.13; Def-Stan 00-970 00-970 P1 4.20.7
STANAG 4671.783
Reference:
CS 29.783
8.8.23 Securing of aircraft doors on the ground.

For ground operation with power off, means shall be provided to hold the aircraft doors in the open or
closed position. Manually operated hold-open latches provided to secure doors in the open position, shall
incorporate a lock, and shall be located in an area which personnel can access safely. Subsequent power
operation of the doors, with these means left in place, shall not result in damage.
a. Ensuring that the means for holding the doors in the open or closed position are either automatic, or
that the procedure for their use is clearly displayed.

1. System Description Documents (SDD) should detail the design features incorporated to secure the
aircraft doors in the open and closed positions.
2. Structural analysis should demonstrate that, with the doors secured in the open or closed positions,
actuation of the doors does not result in excessive or permanent deformation of any part.
3. Technical Publications should detail procedures for the securing of the aircraft doors in their open and
closed positions, and releasing such security to enable to opening or closing of the doors.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 3.4.9.1.c, 3.4.9.1.13 Def-Stan 00-970 00-970 P1 4.20.3
Reference: 00-970 P1 4.20.11
STANAG 4671.783
Reference:
CS 29.783
8.8.24 Aborted and resumed operation of controls.

Door controls shall be capable of stopping or reversing door movement at any time in the cycle at the
option of the operator by selecting the appropriate control option. In the event of power loss / interruption
in any associated system, doors shall not change position; and door controls shall go to the stop position
and not require reprogramming upon resumption of power.

a. The consequence of hydraulic, pneumatic, electrical or mechanical failures;
b. Use of a positive mechanical device to prevent change in selected door positions due to hydraulic fluid
bleeding down after hydraulic system power is shut off or loss of electrical power.

1. System Description Documents (SDD) should detail controls provided for the operation of doors, and
the effect of aborting and resuming door actuation.
2. Failure Modes and Effects Analysis (FMEA) should demonstrate that the effects of failure (e.g. loss of
power) does not result in an unacceptable risk.
3. Rig, ground and flight testing should demonstrate that doors function as expected in ground and, where
applicable, flight conditions.
Information Sources
DoD/MIL Doc: JSSG 3.4.9.1.2, 3.4.9.1.9.a, Def-Stan 00-970
3.4.9.1.9.d Reference:
STANAG
Reference:
Information Sources
CS 27.1309
CS 29.1309

8.8.26 In-flight actuation prevention for ground only systems.
Actuation systems designed for ground-only operation shall incorporate means to prevent in-flight
actuation. All mechanical and powered locks and actuators shall be designed to prevent undesired
surface positioning in flight. In the case of flight critical surfaces, control of any fold sequence shall require
two separate and deliberate actions.

a. Utilising a “weight-on-wheels” (WOW) switch to prevent operation of ground-only actuating
subsystems.
b. Ensuring that the incorporated means of preventing actuation in flight provides adequate protection.

1. System Description Documents (SDD) should detail the means to prevent operation in flight for all
ground-only systems and mechanisms.
2. SDD should detail the design features incorporated to prevent undesired surface positioning in flight.
3. SDD should detail the inputs requured to control flight-critical fold mechanisms, ensuring that at least
two separate and deliberate actions are required.
4. Failure Modes and Effects Analysis (FMEA) should demonstrate that the risk of failure of any protection
means for ground-only systems/mechanisms is acceptable.
5. System Safety Analysis (SSA) should demonstrate that the hazards associated with in-flight operation
of ground-only systems/mechanisms, undesired surface positioning in flight, and inadvertent folding are
adequately controlled and mitigated.
Information Sources
I.3.4.9.4.2/I.4.4.9.4.2 Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.27 Prevention of inadvertent actuation.

Actuation systems shall incorporate positive locking features which do not depend on any power source
to remain engaged to prevent inadvertent actuation following the activation and subsequent relief of
safety devices such as thermal switches, fuses etc.

a. Ensuring that the locking features provide adequate mitigation of risk of inadvertent actuation, taking
into account the effect of such inadvertent actuation on flight safety.
1. System Description Documents (SDD) should detail the positive locking features which prevent
inadvertent actuation following the activation and subsequent relief of safety devices.
2. System Safety Analysis (SSA) should demonstrate that the risk associated with inadvertent operation
of mechanisms following the activation and subsequent relief of safety devices is adequately controlled
and mitigated.
3. Rig, ground and flight testing should demonstrate that mechanisms cannot be inadvertently operated
following the activation and subsequent relief of safety devices.
Information Sources
I.3.4.9.4.2/I.4.4.9.4.2 Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
8.8.28 Strength of removable devices for mechanism securing.

Removable devices fitted for the purpose of securing mechanisms and surfaces in any given position
shall have strength equal to or exceeding that of the aircraft.

a. Removable surface securing devices used in lieu of integral locks;
b. Ensuring external securing devices are designed to reduce or eliminate the possibility of FOD during
removal/installation;
c. Ensuring external bladefold securing devices are transportable within the aircraft vehicle to remote
staging and operating areas;
d. Use in situations where high wind/sea state conditions occur and it is not feasible to move the aircraft
vehicle to a safer location or within a hangar;
e. Withstanding maintainer induced loads (such as potential jam/forcing conditions), as well as normal
environmental loads, such as wind, or shipboard movement.

1. System Description Documents (SDD) should detail any provisions for removable devices for securing
mechanisms or surfaces.
2. Structural analysis should demonstrate that the removable devices are stronger than the part(s) of the
aircraft which they secure.
3. Technical Publications should detail the procedures for the installation and removal of removable
devices and the maintenance activities that can take place with and without such removable devices
installed.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG 3.4.9.4.12 Def-Stan 00-970
Reference:
STANAG
Reference:
Information Sources
FAA Doc: EASA CS
Reference:
8.8.29 Performance of bearings.

Airframe bearing selection and installation shall permit safe mechanical operation / function in each
application, and shall be capable of:
a. Joining mechanical elements;
b. Transmitting design loads through the full range of the system operating parameters;
c. Permitting rotation, misalignment, or both while maintaining a specified dimensional relationship
between the joined elements;
d. Reducing friction and wear; with appropriate limits for deviation/tolerance.

a. Selecting standard bearings in all applications, wherever possible, in order to minimise the cost of
procurement and testing, reduce schedule and technical risk, and obtain multiple sources of supply;
b. The use of existing bearing selection parameters, such as MIL-HDBK-1599 Table 201-VII;
c. Ensuring bearings are durable, and are suitable for each application (e.g. whether to use anti-friction or
plain bearings).

1. System Description Documents (SDD) should detail the use of bearings, including their type and size.
2. Structural analysis should demonstrate that selected bearings are suitable for their application.
3. Rig, ground and flight testing should demonstrate that mechanisms function correctly, and that
bearings do not fail or excessively wear.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009 App 1.3.4.9.2 Def-Stan 00-970 00-970 P1 4.5
MIL-HDBK-1599 Reference:
STANAG 4671.603
Reference: 4671.613
4671.657
4671.693
CS 23.657
CS 23.693
CS 25.603
CS 25.613
CS 25.657
CS 25.693
CS 27.603
CS 27.613
CS 29.603
CS 29.613
8.8.30 Life limit of bearings.

Each flight safety critical bearing shall have defined safe life limits which account for their operation in
worst case environmental conditions.

a. Worst case operating conditions for each bearing, taking into account frequency of actuation,
environmental effects, and effects of operation under load.
b. Ensuring that bearings are fail-safe, i.e. that failure of a bearing does not result in failure of a flight
critical mechanism.

1. System Description Documents (SDD) should highlight each flight critical bearing.
2. Technical Publications should include safe life limits for each flight safety critical bearing, and
procedures for their replacement.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2009, Appendix I: Def-Stan 00-970 00-970 P1 4.5
I.3.4.9.2/I4.4.9.2 Reference:
MIL-HDBK-1599 STANAG 4671.603, 4671.613, 4671.657,
Reference: 4671.693
CS 23.657
CS 23.693
CS 25.603
CS 25.613
CS 25.657
CS 25.693
CS 27.603
CS 27.613
CS 29.603
CS 29.613
8.8.31 Endurance of mechanisms.

Safety of Flight critical mechanisms shall have sufficient endurance to preclude adverse safety effects
throughout their service life.

a. Worst case operating conditions for each mechanism, taking into account frequency of actuation,
environmental effects, and effects of operation under load.
b. Ensuring that mechanisms are fail-safe, i.e. that failure of a mechanism does not result in total failure of
the subsystem.

1. System Description Documents (SDD) should highlight each flight critical mechanism.
2. Fatigue analysis should demonstrate that mechanisms and their attachments points withstand the
loads applied throughout their service life.
3. Technical Publications should include safe life limits for each flight safety critical mechanism, and
procedures for their replacement.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 S4 4.5.4
Reference: 00-970 P1 S4 4.12.27
00-970 P7 S2 Supplement 4
L407 Para 2.1
STANAG
Reference:
CS 23.627
CS 25.603
CS 25.619
CS 27.603
CS 27.619
CS 29.603
CS 29.619
8.8.32 No binding or jamming of flight critical mechanisms.

Safety of flight critical mechanisms shall not cause binding or jamming with surrounding structure or any
portion of the system under expected operating conditions.

a. Temperature effects;
b. Air loads;
c. Landing loads;
d. Structural deflections;
e. Tire condition;
f. Landing gear condition; and,
g. Critical combinations of manufacturing tolerances and/or wear.

1. Structural analysis (static, dynamic and kinematic) should demonstrate that the loads through each
safety of flight critical mechanism component does not cause binding or jamming with surrounding
structure or any portion of the system, through expected and possible ranges of movement.
2. Rig testing should demonstrate the accuracy of the performed analysis, and should demonstrate that
safety of flight critical mechanisms do not jam under expected operating conditions.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Information Sources
FAA Doc: EASA CS
Reference:
8.9 CARGO HOOK SYSTEMS.
8.9.1 No adverse effects on safety.

Cargo Hook systems shall be safe for their intended use.

a. Usage parameters for the cargo hook equipment (weight limits, duration and frequency of use, aircraft
and lifted item(s) accelerations, etc.);
b. Interfaces with the aircraft, and the effect of installation and use of the equipment on the aircraft,
including effects on structures, crew workload, normal and emergency egress, flight handling qualities
(including resonance and turbulence), operating procedures (normal and emergency), etc.;
c. The level of safety to be considered appropriate, taking into consideration the aircraft, its
roles/missions, and the intended and expected operation of the cargo hook equipment.

1. Aircraft Specifications should identify the requirement for cargo hook equipment, including the required
type(s) of equipment (sling mount, suspension mount, fixed, retractable, etc.), and the safety
requirements to be met;
2. Systems Interface Documents (SID) should define the interfaces between the cargo hook equipment
and the aircraft;
3. Technical Publications should provide procedures for use of cargo hook equipment, and should take
account of effects of incorporation of such equipment (e.g. effects on flight handling, normal and
emergency egress, operating procedures, maintenance procedures, etc.);
4. System Safety Assessment (SSA), and associated safety artefacts (Loss Models, Risk Registers, etc.)
should demonstrate that the risk associated with incorporation of cargo hook equipment is acceptable;
5. Analysis should demonstrate that the cargo hook equipment and supporting aircraft structure is suitably
strong for the equipment's expected use (see also Section 5);
demonstrate that the design of the cargo hook equipment, and its integration to the aircraft is acceptable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P7 S2 L205
contact for this discipline (listed Reference: 00-970 P7 S2 L205/1
in section A.2) 00-970 P7 S2 L205/2
00-970 P7 S3 L1017
STANAG 2445
Reference: 2286
FAA Doc: 14CFR reference Parts 27 and EASA CS CS 27.865
29 Reference: CS 29.865
8.9.2 Pilot/operator control of cargo hook system.

Adequate controls and displays shall be available to the pilot/operator to indicate the status of the cargo
hook system to the required personnel (e.g. pilot and/or loadmaster), and controls shall be provided for
the release of cargo in normal, automatic and emergency modes.

advisory information;
b. Cargo hook status information appropriate to the aircraft's type, role and missions, in all weathers,
operating environments, day and night;
c. The controls necessary to allow for the normal, emergency and automatic release of cargo,
incorporating appropriate guards to prevent inadvertent release;
d. Ensuring that any required pilot input or intervention is clearly and unambiguously identified.

1. Aircraft Specifications should identify the requirement for cargo hook indications and controls;
2. Systems Interface Documents (SID) should define the interfaces between the cargo hook equipment
and the aircraft;
5. System Safety Assessment (SSA), and associated safety artefacts (e.g. Failure Modes and Effects
Analysis) should demonstrate that the effect of aircraft failures and any resulting cargo hook hazard is
acceptable;
6. Rig ground and flight testing should demonstrate that controls perform their intended function(s) and
that displays provide accurate and useful information to the crew and that the design of the cargo hook
equipment, and its integration to the aircraft is acceptable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P7 S2 L105 11.3
contact for this discipline (listed Reference: 00-970 P7 S3.9 L714 2.4
in section A.2) 00-970 P7 L205 2.7
STANAG
Reference:
FAA Doc: 14CFR references: 133 EASA CS CS 27.865(b)
Amendment No. 133-11, 133 Reference: CS 27.865(c)
Amendment No. 133-9 CS 29.865(b)
(Rotorcraft External-Load
CS 29.865(c)
Operations)
8.9.3 Securing of cargo.

Processes for the securing of cargo to the cargo hook system shall be defined in the appropriate
manual(s), and shall be safe.

a. Usage parameters for the cargo hook equipment (types of loads to be lifted, lifting procedures, etc.);
b. Incorporation of markings and placards on the aircraft;
c. The level of safety to be considered appropriate, taking into consideration ground and flight crew, the
aircraft, its roles/missions, and the intended and expected operation of the cargo hook equipment;
d. The maximum and minimum loads for safe movement of cargo.

1. Aircraft Specifications should identify the requirement for cargo hook equipment, including the required
type(s) of equipment (sling mount, suspension mount, fixed, retractable, etc.), and the safety
requirements to be met;
emergency egress, operating procedures, maintenance procedures, maximum and minimum loads for
safe movement of cargo, etc.);
should demonstrate that the risk associated with incorporation of cargo hook equipment is acceptable;
4. Rig, ground and flight testing should demonstrate that the loads can be secured to the cargo hook
system effectively and safely.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P7 S2 L205
in section A.2) 00-970 P7 S2 L205/2
00-970 P7 S3 L1017
STANAG 2445
Reference: 2286
FAA Doc: 14CFR references: 133 EASA CS CS 27.25
Rotorcraft External-Load Reference: CS 27.865
Operations, subpart D- CS 27.1581
Airworthiness Requirements,
CS 27.1583
sec.133.45
CS 29.25
CS 29.865
CS 29.1581
CS 29.1583
8.9.4 Merged with Section 13.


limitations and restrictions, including the maximum and minimum safe loads for movement of cargo.
information.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to the technical point of Def-Stan 00-970 00-970 P7 S2 L205
in section A.2) 00-970 P7 S2 L205/2
STANAG
Reference:
CS 27.1581
CS 27.1583
Appendix A27.3
CS 29.25
CS 29.865
CS 29.1581
CS 29.1583
8.10 HOIST/WINCH SYSTEMS.
8.10.1 No adverse effects on safety.

Hoist/winch systems shall be safe for their intended use.

a. Usage parameters for the hoist/winch equipment (personnel and/or weight limits, duration and
frequency of use, aircraft and hoisted/winched item(s) accelerations, etc.);
including effects on structures, crew workload, normal and emergency egress, flight handling qualities,
operating procedures (normal and emergency), etc.;
roles/missions, and the intended and expected operation of hoist/winch equipment.

1. Aircraft Specifications should identify the requirement for hoist/winch equipment, including the required
type(s) of equipment (rescue hoists, cargo winches, etc.), and the safety requirements to be met;
2. Systems Interface Documents (SID) should define the interfaces between the hoist/winch equipment
and the aircraft;
3. Technical Publications should provide procedures for use of hoist/winch equipment, and should take
should demonstrate that the risk associated with incorporation of hoist/winch equipment is acceptable;
5. Analysis should demonstrate that the hoist/winch equipment and supporting aircraft structure is suitably
strong for the equipment's expected use (see also Section 5);
demonstrate that the design of the hoist/winch equipment, and its integration to the aircraft is acceptable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P7 S3.9 L714
contact for this discipline (listed Reference: 00-970 P7 S2 L723
in section A.2) 00-970 P7 S3 L1017
00-970 P7 S3 L1017/1
STANAG
Reference:
8.10.2 Operation under all load conditions.

Hoist/winch equipment shall operate correctly under all expected (including both normal and emergency)
loading conditions.

a. The effect of varying loads on the extension and retraction of the hoist/winch, including loads above the
maximum expected cable breaking strength.
b. Operation throughout the flight envelope (airspeeds, attitudes, aircraft weights and C of G positions,
etc.) for which hoist/winch operation is permitted;
c. Effects on the aircraft (performance, flight handling, static and dynamic structural, electrical, hydraulic,
pneumatic, etc.) from deployment at varying lengths, and from extension and retraction of the hoist/winch;
d. Ensuring that effect of operating the hoist/winch outside normal limits is acceptable (e.g. stoppage of
the motor rather than failure of the cable).
1. Aircraft Specifications should identify the requirement for hoist/winch equipment, including performance
and operational requirements to be met;
2. Systems Interface Documents (SID) should define the interfaces between the hoist/winch equipment
and the aircraft;
3. Technical Publications should provide procedures for use of hoist/winch equipment, including
performance and operating limitations;
5. Analysis should demonstrate that the hoist/winch equipment and supporting aircraft structure is suitably
strong for the equipment's expected performance (see also Section 5);
demonstrate the acceptable performance of the hoist/winch equipment and supporting systems and
structure.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P7 S3.9 L714
contact for this discipline (listed Reference: 00-970 P7 S2 L723
in section A.2) 00-970 P7 S3 L1017
00-970 P7 S3 L1017/1
STANAG
Reference:
8.11 ABSEIL BOLSTER / FAST ROPE INSERTION/EXTRACTION SYSTEM (FRIES).
8.11.1 Insertion and extraction of personnel.

Equipment installed for the purpose of insertion and/or extraction of personnel using a stationary rope or
similar arrangement (Abseil Bolsters, FRIES, etc.) shall be safe for its intended use.

a. Usage parameters for the insertion/extraction equipment (number of personnel, duration and frequency
of use, aircraft and personnel accelerations, etc.);
including effects on structures, crew workload, normal and emergency egress, flight handling qualities,
operating procedures (normal and emergency), etc.;
roles/missions, and the intended and expected operation of insertion/extraction equipment.
d. Ability of crewmembers to supervise and observe FRIES operation effectively
e. Ability of crewmembers to terminate FRIES or Abseil operations immediately, should safety be
jeopardised

1. Aircraft Specifications should identify the requirement for insertion/extraction equipment, including the
required type(s) of equipment (Abseil Bolster, FRIES, etc.), and the safety requirements to be met;
2. Systems Interface Documents (SID) should define the interfaces between the insertion/extraction
equipment and the aircraft;
3. Technical Publications should provide procedures for use of insertion/extraction equipment, and should
take account of effects of incorporation of such equipment (e.g. effects on flight handling, normal and
should demonstrate that the risk associated with incorporation of insertion/extraction equipment is
acceptable;
5. Analysis should demonstrate that the insertion/extraction equipment and supporting aircraft structure is
suitably strong for the equipment's expected use (see also Section 5);
demonstrate that the design of the insertion/extraction equipment, and its integration to the aircraft is
acceptable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: US Army Publication: TC 21-24 Def-Stan 00-970 00-970 P7 S2 L205/1
– RAPPELLING – Issued Reference: 00-970 P7 S2 L407/4
1/9/2008 00-970 P7 S3.9 L714 (2.1.4)
US Marine Corps Handbook
00-970 P7 S3 L1017
MCRP 3-11.4A (Helicopter
00-970 P7 S3 L1017/1
Rope Suspension Techniques
STANAG 2445
(HRST) Operations) dated
Reference:
August 2003
SECTION 9 - CREW SYSTEMS

The crew systems area consists of the following elements: pilot interface, aircrew station
(accommodations, lighting, furnishings, and equipment), human-machine interface, UAV/ROA control
station (operator accommodations, lighting, and equipment), the life support system, the emergency
escape and survival system, the transparency system, crash survivability, and air transportability.
1. Escape system requirements and validation
2. Crew station layout/geometry review
3. Human factors
4. Failure modes, effects, and criticality analysis (FMECA)
5. Life support system requirements and validation
6. Crash survivability requirements and validation
7. Lighting system design, analysis, test reports
8. Transparency integration
9. Air transportability, cargo, and airdrop systems
10. Load analyses
11. Aeroservoelastic analyses
12. Test plans
13. Test reports
14. Proof test results
15. Simulation test, modelling and results
9.1. ESCAPE AND EGRESS SYSTEM.

This section covers the provision of means whereby the occupant(s) can leave the aircraft during in-flight,
water, and ground emergencies.
• Escape systems & assisted escape systems (ejection seat, parachutes, escape capsules or
modules etc.);
• Escape path clearance systems (canopy jettison (including thrusters and rockets);
• Emergency escape exits and routes;
• Emergency egress assist devices (slides, descent reels, life rafts, rope etc.);
• Onboard and ground rescue egress equipment (crash axe, canopy penetrator, fire rescue
axe, powered saw etc.)
Some criteria in this chapter are supported in the text by examples of specific considerations. These
examples are by no means to be considered as exhaustive.
Verification should at least consider:
• The number or aircraft occupants;

• The anthropometric range and mass of the aircrew;
• Consistency of exit sign design.
9.1.1 Escape system safety compatibility.

The escape system, or means to effect emergency escape, shall allow safe operation and egress from
the aircraft and/or control station ; and shall be integrated and compatible with the aircraft and/or control
station
Emergency egress systems shall be free of physical restrictions that could prevent occupants from rapidly
releasing from their restraint systems, departing their seats, traversing egress routes, and passing
through emergency exits.
If escape path clearance mechanisms are used they shall minimise the risk to aircrew and their
equipment. The escape path shall permit the safe egress of the most critical combination of aircrew and
equipment specified for use with that escape system.

a. Absence of rigid objects (i.e. canopies and hatches) are located in the ejection path.
b.. Arrangement of any movable objects which can enter the path are arranged so that they are moved
out of the ejection path upon ejection.
c. All attitudes and speeds encountered in the flight envelope.
d. Loads and accelerations imposed to the body.
e. Environmental hazards on the escape path or due to the clearance mechanisms.
f. Failure of the escape path clearance system.
g. Escape path clearance interference with the crew tasks.
h. The anthropometric range and mass of the aircrew.
i. Inadvertent operation.
j. Location and design of emergency controls.
k. The use of command ejection system.
l. Escape path clearance independenance of any other system.

m. Ability to see outside the exit when exit is closed.
n. Ability to see the ground where the evacuee might land.
o. Engine(s) running at ground idle.

1. Rig and ground tests should demonstrate the escape system compatibility throughout the designated
envelope with extreme permutations of crew anthropometry and mass properties.
2. Ground testing should demonstrate emergency egress with human subjects to verify he ability to safely
operate required systems and egress the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-3: 3.3.4 (Note: Def-Stan 00-970 00-970 P1 4.23.8-4.23.11
Unverified - no access to JSSG Reference: 00-970 P1 4.23.14-4.23.25
2010-3) 00-970 P1 4.23.32-4.23.36
JSSG-2010-7: 3.7.3.5.3
00-970 P1 4.23.40-4.23.49
Information Sources
JSSG-2010-11: 3.11.7, 00-970 P1/5 S4 L63
3.11.7.2, 7.3.3.3.5.3 (Note: 00-970 P 13 1.6.15.8
Unverified - no access to JSSG 00-970 P 13 1.6.15.9
2010 - 8, 9, 11, 13, 14)
NATO Working Party 61 ARGARD 330
STANAG
Reference:
CS 23.807
CS 25.803
CS 25.807
CS 25.809
CS 25.810
CS 27.805
CS 27.807
CS 29.803
CS 29.805
CS 29.807
CS 29.809
9.1.1.1 Escape system reliability.

Aircraft escape systems and subsystems shall be designed and demonstrated to meet the specified
reliability and confidence.

a. Escape systems including ejection seats, capsules, modules, and escape path clearance systems.
b. Subsystems including Cartridge Actuated and Pyrotechnic Actuated Devices (CAD/PAD).
c. A programme of reliability tests.
d. Specified system and subsystem reliability levels.
e. Specified confidence intervals.

1. Rig and ground tests should demonstrate the escape system reliability throughout the designated
envelope with extreme permutations of crew anthropometry and mass properties.
2. Rig and ground tests should demonstrate emergency egress with human subjects to verify the ability to
safely operate required systems and egress the aircraft.
3. System Description Documents (SDD) should verify integration and compatibility with the aircraft and
other subsystems.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010 (Unverified - Def-Stan 00-970 00-970 P1 4.22.67
restricted access to parts of Reference: 00-970 P1 4.23.34
JSSG-2010) 00-970 P1 S4 L75 Par. 18
Information Sources
MIL-C-83124 (Unverified) STANAG
MIL-C-83125 (Unverified) Reference:
MIL-C-83126 (Unverified)
CS 27.1309
CS 29.1309
9.1.2 Escape exits and routes.

Each crew and passenger area shall contain escape exits and escape routes of appropriate size, type,
number, location and ease of opening, to permit rapid emergency evacuation of all aircraft occupants
following landing / ditching of the aircraft . It shall be possible for all occupants to egress the aircraft ,
within specified time limits.

a. Size, type, number, location and ease of opening of exits.
b. Specified time limits for ground / ditching evacuation (typically 30-90 seconds).
c. Evacuation when all exits are functional, and when only half of the exits are functional.
d. Conducting an evacuation demonstration utilising the maximum number of occupants for which
certification is desired.
e. Evacuation with landing gear extended or retracted.
f. Ensuring window-type emergency exits are not obstructed by seats or seat backs.
g. Minimum passenger aisle width.
h. Aircrew and passenger clothing and personal equipment.
i. Passenger entrance, crew, and service doors may be considered as emergency exits if they meet the
requirements.
j. The use of devices for ground emergency egress assist.
k. The number of seats abreast on each side of the aisle.
l. Emergency evacuation routes for service compartment located below the main deck, which may be
occupied during the taxi or flight but not during takeoff or landing.
m. Ensuring integral stairs in emergency exits do not impair the effectiveness of emergency egress.
n. The possibility of the aircraft being on fire, and at maximum seating capacity.
o. Engine(s) running at ground idle.
p. The impact of a lockable pilot compartment door.

1. Rig and ground tests should demonstrate the escape system throughout the designated envelope with
extreme permutations of crew anthropometry and mass properties.
safely operate equired systems and egress the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: NATO Draft Working Party 61B Def-Stan 00-970 00-970 P1 4.20.2
JSSG-2010 (Unverified - Reference: 00-970 P1 4.22.3
restricted access to parts of 00-970 P1 4.23.2
JSSG-2010) 00-970 P1 4.23.4
Information Sources
00-970 P1 4.23.6
00-970 P1 4.23.7
00-970 P1 4.23.44
00-970 P1/5 S4 L63
00-970 P 13 1.6.15.8
00-970 P 13 1.6.15.9
STANAG
Reference:
FAA Doc: 14CFR reference 25.803 EASA CS CS 23.803
CS 23.807
CS 23.813
CS 23.815
CS 25.772
CS 25.803
CS 25.807
CS 25.810
CS 25.813
CS 25.815
CS 25.817
CS 25.819
CS 27.805
CS 27.807
CS 29.803
CS 29.805
CS 29.807
CS 29.813
CS 29.815
9.1.3 Emergency exit markings.

All emergency exits shall be adequately marked so that their intended use and their means of operation
are readily apparent to air crew and passengers and also, where appropriate, to rescue personnel
approaching the aircraft from outside.

a. Ensuring the design of exit signs are consistent throughout the aircraft .
b. Ensuring the identity and location of each passenger emergency exit are recognisable from a distance.
c. Identification in different light conditions, i.e. darkness, dense smoke.
d. Colour of external and internal markings.
e. Colour contrast.
f. Reflectance.

Information Sources
Information Sources
Comm'l Doc:
3.11, 4.11, 3.12, 4.12, 3.13, Reference:
4.13, 3.14, 4.14 (Note: STANAG
Unverified - no access to JSSG 3230
2010 - 8, 9, 11, 13, 14) Reference:
FAA Doc: 14CFR reference: 23.803- EASA CS CS 23.807(b)
23.815, 25.801-25.819, Reference: CS 23.811
23.1411, 23.1415, 25.1411, CS 25.809
25.1415, 25.813, 23.813, 25
CS 25.810
Appendix F; 25 Appendix J
25.1423 CS 25.811
CS 27.807(b)
CS 29.811
9.1.4 Ground/ditching emergency egress devices.

Emergency egress assist devices (slides, descent reels, life rafts, rope etc), their stowage and means of
deployment shall be demonstrably safe. This includes safe use by the intended air crew and passengers;
and ensuring deployment handles/actuators capable of creating a safety-of-flight (SOF) or injury hazard
are designed to prevent inadvertent actuation.

a. The number and anthropometric range of occupants.
b. The egress time requirements.
c. The operational environmental requirements.
d. Applicable physical and power integration requirements.
e. The use of different emergency assist devices may be dependant upon:
i. The type and size of exit.
ii. Whether it is intended for use by passengers or air crew.
iii. The height of the exit from the ground.
f. Engine(s) running at ground idle.

Information Sources
Comm'l Doc:
3.11, 4.11, 3.12, 4.12, 3.13, Reference:
4.13, 3.14, 4.14 (Note: STANAG
Unverified - no access to JSSG
2010 - 8, 9, 11, 13, 14) Reference:
23.815, 25.801-25.819, Reference: CS 23.1415
23.1411, 23.1415, 25.1411, CS 25.810
25.1415
CS 25.1411
CS 25.1415
CS 27.1411
Information Sources
CS 27.1415
CS 29.1411
CS 29.1415
9.1.5 Ground/ditching emergency processes and procedures.

Emergency egress and rescue processes and procedures shall be developed, incorporated in system
documentation, and implemented in training. This shall include provision of documentation that informs
and enables ground/ditching egress procedures for aircrew, passengers and rescue personnel.

a. Ensuring ground/ditching egress processes provide timely egress for aircrew and passengers.
b. Effectiveness of processes for rescue personnel including canopy, hatch/door removal by external
actuation or cutting.
c. Engine(s) running at ground idle.

Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.8, 4.8, 3.9, 4.9, Def-Stan 00-970
3.11, 4.11, 3.12, 4.12, 3.13, Reference:
4.13, 3.14, 4.14 (Note: STANAG
Unverified - no access to JSSG
2010 - 8, 9, 11, 13, 14) Reference:
23.815, 25.801-25.819, Reference: CS 23.1585
23.1411, 23.1415, 25.1411, CS 25.1581
25.1415
CS 25.1585
CS 27.1581
CS 27.1585
CS 29.1581
CS 29.1585
9.1.6 Emergency egress/rescue equipment.

Egress equipment shall be provided to aid escape in the event exits are blocked, damaged, or when exit
opening actuation fails.

a. Provision of onboard devices such as crash axe, canopy penetrator, etc.
b. Ground rescue tools such as fire rescue axe, powered saw.

safely operate required systems or devices and egress the aircraft when exits are blocked, damaged, or
when exit opening actuation fails.
Information Sources
Comm'l Doc:
DoD/MIL Doc: No information available in Def-Stan 00-970
current JSSG. Information to Reference:
be included in next revision of STANAG
JSSG.
Reference:
FAA Doc: 121.309, 121.310 EASA CS
Reference:
9.2. CREW STATIONS AND AIRCRAFT INTERIORS.

This section covers the design, arrangement and geometry of aircrew station accommodations,
furnishings and equipment. This element also covers UAV Control Station (UAS) requirements, where
appropriate.
• Arrangement and location of controls, displays and other human interfaces;

• Fields of view (minimising reflections, glare etc.);
• Control operability, including range of travel, restriction of movement;
• Materials used for aircraft and crew station interiors (flame resistance, non-toxic);
• Intercommunication;
• Speech intelligibility.
• Differing visual requirements of single seater, tandem or side by side configurations;

• The anthropometric range and mass of the aircrew;
• Type and role of aircraft i.e. commercial, fighter, attack, bomber, transporter, maritime
reconnaissance;
• Mission activities/tasks including take-off, landing and aerial refuelling.
9.2.1 Crew station arrangement.

Controls and displays shall be arranged and located to provide convenient operation (functional and
visible). Controls and displays shall be arranged and located to provide convenient operation (functional
and visible).

a. The physiological aspects of design, including anthropometric range of occupants and/or operators.
b. The normal reach and sight of the operator when harnessed in his seat and wearing the appropriate
clothing and equipment specified for that particular aircraft .
c. Controls, which are in regular use in flight, should not be positioned aft of the pilot's shoulder line.
d. Location of the controls and pilot with respect to the plane of rotation of propellers.
e. Grouping and arrangement of flight instruments with respect to the pilot's forward vision.

1. System Description Documents (SDD) should detail that the anthropometric requirements are met.
2. Rig and ground tests should demonstrate appropriate Human Machine Interface (HMI) with mission
equipped human subjects representative of the intended anthropometric range.
Information Sources
Comm'l Doc:
3.3, 4.3, 3.4, 4.4, 3.5, 4.5, 3.14, Reference: 00-970 P1 4.19.44
4.14 (Note: Unverified - no 00-970 P1 4.19.46
access to JSSG 2010 - 1, 2, 3,
00-970 P1 4.19.48-4.19.50
4, 14)
JSSG-2001: 3.4.3.1.1, typical 00-970 P1 4.19.51
anthropometric dimensions 00-970 P7 S1 L105 3.1
and ranges considered STANAG 4671.1703
acceptable to accommodate Reference: 4671.1721
the US pilot population 4671.1731
JSSG-2001: 3.4.3.1.5,
guidance on controls and
displays
MIL-STD-1472, section 5.6,
design criteria and features
recommended to provide
human accommodation
CS 23.1321
CS 25.771
CS 25.777
CS 25.1321
CS 27.771
CS 27.777
CS 27.1321
CS 29.771
CS 29.777
CS 29.1321
9.2.1.1 Controls and display readability.

All displays and indications shall be easily legible from the operator's position, for the full range of
ambient lighting conditions.

a. The physiological aspects of design, including varying operator's eye positions given the
anthropometric range of occupants;
b. Readability of displays under all expected illumination conditions , including during NVG operations if
required;
c. The effect of reflection on clarity of information;
d. Minimising reflection of instruments and consoles in windshields and other enclosures;
e. The expected electronic display brightness level at the end of an electronic display indicator's useful
life;
f. Minimising direct or indirect glare from lights.

Information Sources
Comm'l Doc:
3.3, 4.3, 3.4, 4.4, 3.5, 4.5, 3.14, Reference: 00-970 P1 4.15.54
4.14 (Note: Unverified - no 00-970 P1 4.15.55
access to JSSG 2010 - 1, 2, 3,
00-970 P1 4.16.5
4, 14)
MIL-STD-1472, section 5.2 00-970 P1 4.19.46
addresses visual displays of 00-970 P1 4.19.51
various types 00-970 P1 L105.15.2
STANAG 4671.1721
Reference:
FAA Doc: 14CFR references: 23.777, EASA CS CS 23.777(b)
CS 27.777(b)
CS 29.777
9.2.1.2 Interior and exterior fields of view.

The aircraft shall provide the aircrew with sufficient interior and exterior fields of view to safely perform all
flight and mission-critical functions and tasks, and avoid ground or flight obstacles. The flight crew shall
have an unobstructed view of the flight instruments and other critical components and displays. The
unimpaired external vision and/or transmitted visual indications available to the aircrew shall be free from
unsafe blind spots that can introduce hazardous conditions, and shall meet the specified requirements
and minimum angles appropriate to aircraft class, type and operational role.
For UAVs, the design of the control station shall facilitate the command and control of the UAV by the
UAV crew for safe operations.

a. External vision / rectilinear plot.
b. The zero reference in azimuth.
c. Different crew seating configurations i.e. single seater, tandem or side by side.
d. Type and role of aircraft , i.e. commercial, fighter, attack, bomber, transporter, maritime
reconnaissance.
e. Mission activities/tasks including takeoff, landing and aerial refuelling.
f. Location of controls, consoles, instrument panels, headup display ancillary equipment and other
structures where they do not critically restrict vision.
g. Seat adjustment to allow the pilot to place his eyes at the level of the aircraft design eye position.
h. Avoiding blind spots from posts, canopy bow, windshield frames, heads up display (HUD) supports,
etc.
i. The physiological aspects of design, including anthropometric range of occupants and/or operators.

Information Sources
Comm'l Doc:
3.3, 4.3, 3.4, 4.4, 3.5, 4.5, 3.14, Reference: 00-970 P1 4.16.19
4.14 (Unverified) 00-970 P1 4.17.2
JSSG-2010: 4.3.2, rectilinear
00-970 P1 4.17.4
plots (Unverified)
00-970 P1 4.17.6-4.17.10
JSSG-2010-3: 3.3.2, rectilinear
00-970 P1 4.17.12-15
plots (Unverified)
00-970 P1/5 S4 L63,
JSSG-2001: 3.4.3.1.7 and
00-970 P1/5 S4 L104 2.1
3.4.3.1.8, interior and exterior
00-970 P1/5 S4 L104 2.2
vision, respectively
00-970 P1/5 S4 L104 3.6
00-970 P1/5 S4 L104 4
STANAG 4671.1701
Reference:
FAA Doc: 14CFR references: 23.771- EASA CS CS 23.773(a)
23.781, 25.771-25.781 Reference: CS 25.773
CS 27.773(a)
CS 29.773(a)
9.2.2 Controls and display usability.

Each control shall be designed, located and arranged, with respect to the pilots' and/or operators' seat, to
allow unrestricted movement throughout the full range of travel, without interference from other controls,
structures, aircrew bodies, their clothing or equipment. Controls shall be operable by the full
anthropometric range of aircrew population. This shall include operation of all controls essential for crew
survival (including ejection controls) from crewmember restrained positions under all flight conditions,
aircraft attitudes and throughout the complete range of "g" force loads.
For UAVs, controls shall located and arranged so that the UAV crew, when at their workstation have full
and unrestricted movement of each control without interference from either their clothing or the UCS
structure. Controls needed for continued safe flight and landing shall remain available to the UAV crew in
normal, abnormal and emergency conditions.

a. The physiological aspects of design, including anthropometric range of occupants.
b. Sufficient clearance between controls to permit unrestricted operation by the largest specified gloved
hand.
c. Sufficient clearance to prevent interference between the largest specified flight boot and aircraft
structure for the yaw control.
d. The location and actuation of the stick/wheel control to consider arm reach.
e. Ensuring ejection controls (automatic and/or manual) are readily accessible and activation is possible
with either hand.
f. Provisions are incorporated to guard against accidental activation of ejection system/controls.
g. Specified flight conditions and aircraft attitudes.

equipped human subjects representative o the intended anthropometric range.
Information Sources
Comm'l Doc:
3.3, 4.3, 3.4, 4.4, 3.5, 4.5, 3.14, Reference: 00-970 P1 4.16.5-4.16.9
4.14 (Unverified) 00-970 P1 4.16.18
JSSG-2001: 3.4.3.1.1, typical
00-970 P1 4.19.2
anthropometric dimensions
00-970 P1 4.19.31-4.19.32
and ranges considered
00-970 P1 S4 L63
acceptable to accommodate
the US pilot population
STANAG 4671.1731
JSSG-2010-3: 4.3.3, Table VI,
Reference:
definition and application of
zones (Unverified)
23.781, 25.771-25.781 Reference: CS 23.779
CS 25.777
CS 25.779
CS 27.777
CS 27.779
CS 29.777
CS 29.779
9.2.3 Aircrew alerting systems.

Visual caution and warning displays shall be located in the operator's prime field of vision, and shall alert
the operator of all hazardous situations in a fashion that permits rapid detection sufficient for the operator
to take actions necessary for safe flight.

a. Locating visual cautions and warnings within the 30° cone of vision of the operator's normal line of
sight as much as possible.
b. Alerting the operator to all specified hazardous situations which could present a hazard to the safety of
the occupants, endanger human life, or cause substantial damage to the aircraft.

Information Sources
Comm'l Doc:
DoD/MIL Doc: FAA References: 14 CFR Def-Stan 00-970 00-970 P1 4.15.35
references: 23.1321-23.1322, Reference: 00-970 P1 4.15.49
25.1321-25.1322 00-970 P1 4.15.59
STANAG 4671.1721
23.1322, 25.1321-25.1322 Reference: CS 23.1322
CS 25.1321
CS 25.1322
CS 27.1321
CS 27.1322
CS 29.1321
CS 29.1322
9.2.4 Emergency markings.

Emergency action controls shall be appropriately marked, in accordance with the specified requirements.

a. Emergency controls to be included.
b. Outlining functional groups.
c. Ensuring no other controls are the same colour as emergency controls.

1. System Description Documents (SDD) should detail that proper marking of emergency action controls
has been verified by inspection and analysis of program documentation including cockpit, crew and
operator station layout drawings or mockups, as well as inspection of hardware, manufacturing drawings
and engineering drawings.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.1, 4.1, 3.2, 4.2, Def-Stan 00-970 00-970 P1 4.15.22-4.15.25
3.3, 4.3, 3.4, 4.4, 3.9.7, 3.14, Reference: 00-970 P9 UK 1555a
4.14 (Unverified) 00-970 P19 UK 1845
STANAG 4671.1845
Reference: 3230

23.1561, 25.1555, 25.1561 Reference: CS 25.1555
ASCC Air Standard 10/23E CS 27.1555
(Unverified) CS 29.1555

9.2.6 Interior finishes, components and equipment.
Materials (including finishes or decorative surfaces applied to the materials) used for aircraft interiors shall
be at least flame resistant and non toxic.Consideration should be given to:
a. Interior compartments occupied by crew or passengers (including lavatories and galleys).

b. Areas that are not continuously occupied (including cargo and baggage compartments).
c. Flame propagation, burn-through and smoke limiting requirements.

d. Additional requirements for aircraft with passenger capacities of 20 or more.

1. System Description Documents (SDD) should detail the materials used in the aircraft's interior.
2. Coupon testing should demonstrate that the materials used in the aircraft's interior are flame resistant
and non-toxic, meeting the appropriate flame propagation and burn-through resistance, toxicity and
smoke limiting requirements.
Information Sources
Comm'l Doc:
3.3, 4.3, 3.4, 4.4, 3.5, 4.5, 3.14, Reference:
4.14 (Unverified) STANAG
JSSG-2001: 3.4.3.1.1, typical
Reference:
anthropometric dimensions
and ranges considered
acceptable to accommodate
the US pilot population
JSSG-2010-3: 4.3.3, Table VI,
definition and application of
zones (Unverified)
23.781, 25.771-25.781 Reference: CS 23.855
CS 25.853
CS 25.855
CS 27.853
CS 27.855
CS 29.853
CS 29.855
9.2.7 Communication systems.

A means of intercommunication shall be provided between the flight-deck, other aircrew, ground
personnel and military and/or civilian airspace controllers.

a. A means for the flight-deck to alert aircrew when required.
b. An intercom system accessible for immediate use at any crew station.
c. Provision of two way communication between all crew compartments.
d. Communication with aircrew outside of the air vehicle for use by ground personnel, if required.
e. Incorporation of a passenger address system.

1. Flight and ground tests should demonstrate functionality of communication systems.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-4 (Unverified) Def-Stan 00-970 00-970 P1 4.15.7
Reference:
STANAG
Reference:
FAA Doc: 14CFR references: 121.319 EASA CS
Reference:
9.2.8 Speech intelligibility.

All audio communication systems shall have speech intelligibility of sufficient quality to ensure safe and
effective aircraft operation.

a. The efficiency of communications needed and the type material to be transmitted.
b. Specified communications requirements (depending on level of intelligibility needed):
i. Phonetically Balanced (PB) word test, typically 43-90%.
ii. Modified Rhyme Test (MRT), typically 75-97%.
iii. Minimum Articulation Index (AI), typically 0.3-0.7.

1. Flight and ground tests should demonstrate communication systems have sufficient speech
intelligibility in the worst case noise environments.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.15.79
00-970 P1 S4 L65
00-970 P1 S4 L66
00-970 P1 S6 L1 Sec 2
00-970 P1 S1 L108
STANAG
Reference:
FAA Doc: EASA CS
Reference:
9.3. AIRCRAFT LIGHTING.

This section covers the provision, controllability and luminance of all internal and external aircraft light
systems and illumination. Aircraft lighting allows crewmembers to see information from displays and
instruments, to operate controls, to move safely throughout and emergency egress the compartment and
to perform all other mission-critical functions where sight is necessary.
• External and internal illumination (cargo compartment, loading and ramp areas,
passageways, passenger seating area, avionics bays, auxiliary power plant compartment
etc.);
• Emergency lighting;
• Intensity, balance and luminance of interior lighting;
• External lights necessary to permit operation in commercial airways (taxi & landing, position,
riding, anti-collision etc.);
• Readability and discernability of instruments;
• Compatibility with NVIS and LEP.
• All environmental lighting conditions;

• The chromaticity requirements;
• Average luminance ratio.
9.3.1 Lighting system performance.

Aircraft lighting systems shall provide adequate illumination (both internal and external) for crew, wing
men, passengers, maintainers, and ground support personnel to perform all anticipated tasks safely,
throughout all environmental lighting conditions.

a. Normal ingress and emergency egress.
b. All compartments and areas.
c. Emergency lighting.
d. Chart, utility and worktable lighting.
e. Where applicable, provision of required lighting to perform troop jumps (i.e. three light system).
f. Cockpit floodlighting system, if fitted.
g. Aerial refuelling (See Section 8.7.1.4.2).
h. All illuminance requirements.

1. System Description Documents (SDD) should detail the photometric and radiometric performance
requirements.
2. Rig and ground tests should demonstrate the adequacy of the lighting system, both internal and
external to the cockpit, and control station and crew stations, through Lighting Mockup, System
Integration Laboratory (SIL), and aircraft evaluations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-5: 3.5.2.1.1, Def-Stan 00-970 00-970 P1 4.15.54
3.5.2.1.8.4, 3.5.2.1.8.6, Reference:
3.5.2.1.8.6.1-3, 3.5.3.7, 3.5.3.8 STANAG
MIL-STD-1472F: 5.2.1.2 and 4671.1705
Reference:
5.8.2.1 thru 5.8.2.3 and Table
Information Sources
XVI, criteria for the operator
station lighting system
(Unverified)
MIL-STD-3009: 4.2.2 table 1,
criteria for the operator station
lighting system (Unverified)
23.1401, 25.1381-25.1403 Reference: CS 23.1381
CS 23.1383
CS 25.812
CS 25.1381
CS 25.1383
CS 27.1381
CS 27.1383
CS 29.812
CS 29.1381
CS 29.1383
9.3.2 Lighting controllability and uniformity.

Internal lighting shall be fully controllable and uniform and shall not permit glare, shadows, or reflections
that interfere either with the aircrew member's interior or exterior vision.

a. Specified average luminance ratio (typically 2:1).
b. Minimising reflections from the canopy, windshields, and windows.
c. The possibility to control the intensity of illumination of all instruments and panels from full intensity to
zero.
d. Provision of individual dimmer switches within easy reach of each crew member to control the lighting
at his station.
e. Grouping dimmer switches together where more than one is required at a crew station.
f. Wing icing detection lights

1. System Safety Assessment (SSA) should detail the luminance and specular reflective performance
requirements.
2. Rig and ground tests should demonstrate the adequacy of the lighting system, both internal and
external to the cockpit, and control station and crew stations, through lighting mockup, System Integration
Laboratory (SIL), and aircraft evaluations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-5: 3.5.2.1.1 -3 Def-Stan 00-970 00-970 P1 4.15.55
.5.2.1.4 Reference: 00-970 P1 4.15.63
STANAG 4671.1705
Reference: 3224 Annex B
23.1401, 25.1381-25.1403 CS 23.1383
Information Sources
CS 25.1383(a)
CS 25.1403
CS 27.1381
CS 27.1383
CS 29.1381
CS 29.1383
9.3.3 Exterior Lighting.

The aircraft shall be provided with all external lights necessary to permit operation without restriction.

a. Operation within civil airspace, which includes provision of taxi and landing lights, navigation lights,
riding (anchor) lights (where applicable) and an anti-collision light system.
b. Ensuring each light meets the specified performance requirements for location, arrangement,
coverage, aimability, colour and intensity.
c. Ensuring the colour chromaticity meets the International Commission on illumination chromaticity.
d. Visibility of each riding (anchor) light to be agreed and verified (typically 3ú2 km - 4.0 km) (at night
under clear atmospheric conditions).

1. System Description Documents (SDD) should detail the taxi and landing lights, navigation lights, riding
(anchor) lights (where applicable) and an anti-collision light performance requirements.
2. Rig and ground tests should demonstrate the adequacy of the lighting system through lighting mockup,
System Integration Laboratory (SIL), and aircraft evaluations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-5: 3.5.3.1, Def-Stan 00-970 00-970 P1 6.7.1-6.7.17
3.5.3.2.1, 3.5.3.2.2, 3.5.3.4 Reference:
STANAG 3224 Annex C
Reference: 4671.1383-4671.1404
23.1401, 25.1381-25.1403 Reference: CS 25.1383-25.1401
CS 27.1383-27.1399
CS 29.1383-29.1401
9.3.4 Lighting for flight-critical tasks.

Aircraft lighting shall be sufficient to illuminate all visual displays, signals, instruments etc. related to flight-
critical tasks throughout all environmental lighting conditions; and if applicable, shall be compatible with
NVIS and Laser Eye Protection (LEP).

a. Aircraft lighting luminance requirements.
b. Verification of LEP and NVIS compatibility.
c. The effects of direct or indirect glare, and / or reflections.
d. Ensuring lights do not have a direct or indirect affect on the image intensification capabilities of the
NVIS.
e. Readability and discernability of instruments, including ensuring all illuminated instrument indicia are
daylight readable when not energised (with the exception of self-luminous displays).
f. The physiological aspects of design, including anthropometric range of occupants.

1. Declaration of Design Performance (DDP) should detail that electronic and/or electro-optical displays
meet the levels for luminance, chromaticity, and daylight contrast specified in the System Requirements
Document (SRD).
2. Rig and ground tests should demonstrate the readability and discernibility of instruments through
lighting mockup, System Integration Laboratory (SIL), and aircraft evaluations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-5 Def-Stan 00-970 00-970 P1 6.7.1
JSSG-2010: 3.1, 4.1, 3.2, 4.2, Reference:
3.3, 4.3, 3.4, 4.4, 3.5, 4.5, 3.14, STANAG 3828
4.14 Reference: 4671.1705
JSSG-2010-5: 3.5.2.1.8,
cockpit and crew station
lighting
MIL-STD-3009: 5.7.2.2,
addresses NVIS compatible
aircraft lighting and Visual
acuity charts (Unverified)
23.1401, 25.1381-25.1403 Reference: CS 25.1381-25.1403
CS 27.1381-27.1401
CS 29.1381-29.1401
9.4. HUMAN FACTORS

This section covers recognition of human factors engineering principles within the aircraft design to
enable the crewmember to monitor and control the system flight path management, navigation, caution,
warning, advisory, communications, identification, propulsion, and mission and utilities subsystems,
without undue discomfort or fatigue, and to reduce the potential for, and minimise the consequences of, a
crew-induced error.
• Location and arrangement of the primary flight display suite;

• Accuracy and completeness of flight and technical manuals;
• Presentation of emergency checklists and procedures
• Crew system interfaces;
• Sound pressure levels.
• Acceptable crew workload limits;

• Workload, task and hazard analysis;
• The anticipated range of environmental conditions;
• The anthropometric range of occupants and/or operators.
9.4.1 Functional operations and workload.

Aircrew, operator and maintenance tasks and/or functional operations, and procedures and/or pilot /
aircraft interfaces shall be demonstrably safe.

a. Workload and hazard analysis to ensure trained personnel can perform the tasks in a safe manner;
b. Ensuring all identified hazards have been reduced to a level consistent with safe operation of the
system;
c. Acceptable crew workload limits;
d. Ensuring all tasks / procedures are defined and documented;
e. Operation over the anticipated range of environmental conditions.

1. Rig and ground tests should verify that trained personnel can perform the tasks in a safe manner,
through function and task analysis using fully trained and qualified operators and maintainers.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.1, 4.1, 3.2, 4.2 Def-Stan 00-970
(Unverified - no access to Reference:
JSSG-2010-1 or 2) STANAG
JSSG-2010-1 - Handbook 4671.1701
Reference:
3.2.1 and 4.2.1 for Method of
Compliance. Table 2 of the
document provides a list of
Figures of Merit (Unverified)
JSSG-2001: 3.4.3
Human/vehicle interface
MIL-HDBK-46855, guidance on
human workload assessment
techniques (Unverified)
23.1322, 25.1321-25.1322 Reference:
9.4.1.1 Primary flight display suites.

The primary flight display suite shall afford crewmembers with the necessary flight and navigational data
required to safely perform all basic and unique flight manoeuvres, in both normal and emergency
conditions.
a. Flight and navigational data required depending on aircraft type and role. This may include, but is not
limited to the following: airspeed, heading, altitude, attitude, angle-of-attack, vertical speed.
b. Flight manoeuvres which typically include takeoff, navigation and landing.
c. Provision of at least one set of Primary Flight Reference (PFR) data per operators station.
i. Systems that operate the first pilot's instruments should be independent from other flight crew stations.
d. Ensuring Head-Up Displays (HUD), Helmet Mounted Displays (HMD) and Head-Down Displays (HDD)
are installed iaw the required standards.

1. Analysis of hardware, engineering design drawings and documents should demonstrate that Primary
Flight Display design is appropriate.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Air Force Flight Standards Def-Stan 00-970 00-970 P1 4.16.18
Agency white paper (Single Reference: 00-970 P1 4.19.2
Medium Flight Instrument 00-970 P1 4.19.46
Display Endorsement Process,
Jan 01) provides procedures STANAG 4671.1723
for requesting and getting PFR Reference:
endorsement (Unverified)
JSSG-2010-3: 3.2, 4.2
(Unverified)
MIL-STD-1787: Appendix E,
Figures 91, 92, and 93 list the
parameters for basic flight
performance, unusual attitude
and recovery performance, and
dynamic maneuvering
performance (Unverified)
23.1322, 25.1321-25.1322 Reference: CS 23.1311
CS 25.1303
CS 25.1333
CS 27.1303
CS 29.1303
9.4.2 Relevant documentation.

All aircraft documentation shall not be in conflict with system descriptions and procedures (normal and
emergency) and actual system performance. Technical manuals/orders and publications shall be
accurate, in accordance with the aircraft design and complete for all tasks that may impact flight safety.
Emergency procedures shall be clearly identified, and corrective action shall not create other hazardous
situations. All procedures or pilot/vehicle interfaces shall be accomplished within acceptable crew
workload limits.

a. Ensuring all documentation is produced to the required standard.
b. Identifying and segregating approved parts of any documented instruction, procedure, limitation etc.
from each unapproved part (if applicable).

1. System Safety Assessment (SSA) should verify emergency procedures are identified and documented
and are compared to results from the subsystem integration testing, human use analysis, and failure and
degraded modes analysis.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.1, 4.1, 3.2, 4.2 Def-Stan 00-970
MIL-DTL-7700G, Flight Reference:
manuals/checklists accordance STANAG 4671.1581
Reference:
23.1589, 25.1581-25.1587 Reference: CS 25.1581-25.1587
CS 27.1581-27.1589
CS 29.1581-29.1589
9.4.3 Merged with 9.2.1.2

9.4.4 Crew system interface.
Crew system interfaces shall be designed and installed to reduce the potential for and minimise the
consequences of human error. This includes consideration of human factors engineering principles in
order to prevent confusion, distraction and fatigue which may cause inadvertent operation. Crew system
interfaces shall provide a means of simple correction in the event of a crew-induced error.

a. The physiological aspects of design, including anthropometric range of occupants and/or operators.
b. Pilot-vehicle and human-computer interfaces.
c. Grouping and arrangement of interfaces including displays, controls etc.
d. Ensuring emergency controls are adequately protected.
e. Selecting control knobs of distinctive shape to assist both visual and tactual identification.
f. Operating controls with cold or gloved hands.
g. Ensuring Armament Control Systems incorporate protection against inadvertent firing or release of
weapons or countermeasures.

1. System Description Documents (SDD) should detail the crew system interface.
2. System Safety Assessment (SSA) should demonstrate adequate analysis of crew system interfaces.
3. Subsystem integration testing, human use analysis, failure and degraded modes analysis, and crew
system simulation and documentation should demonstrate adequate crew system interfaces.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1472F 5.1 through Def-Stan 00-970 00-970 P1 4.15.2-4.15.64
5.4 and 5.4.3, guidance for the Reference: 00-970 P1 4.19.46
human factors design of 00-970 P1 4.19.51
Information Sources
equipment that minimizes the STANAG 4671.1701
occurrence of human error. Reference: 4671.1733
MIL-STD-1472F: 5.1.14,
design guidance for human
computer interface and
associated methods for the
minimization of human error.
JSSG-2001: 3.4.3
Human/vehicle interface
CS 25.777
CS 25.781
CS 27.777
CS 29.777(a)

9.4.6 Exposure to sound.
Sound pressure exposure levels in areas of the aircraft occupied by personnel during flight shall not
exceed safe limits, in order to prevent hearing damage and to allow effective communication.

a. Internal noise levels, typically not more than 85 dB(A)
b. Ensuring noise levels are controlled as required by human factors requirements.
c. Combined noise levels from the air conditioning system and all other sources, i.e. engine, are lower
than the maximum acceptable levels.
d. Individual hearing protection.

1. Rig, ground and flight testing should demonstrate that internal noise levels do not exceed safe limits.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.15.78-4.15.79
00-970 P1 4.15.81
00-970 P1 4.24.30
00-970 P1/5 S4 L65-66
STANAG 4671.1703
Reference:
CS 27.771
CS 29.771
9.5. LIFE SUPPORT SYSTEMS.

This section covers the installation, integration, interface and functionality of aircraft life support systems
and personal protective equipment. Life support systems provide aircraft occupants with breathing and
anti-g provisions, and natural, induced, and combat hazard protection for aircraft missions; during and
after any in-flight emergency; and as appropriate after escape from the aircraft. This may include oxygen
systems which provide protection against hypoxia, inhalation of toxic smoke and fumes, and the effects of
high 'g' accelerations; pressure suits for protection against high altitude / depressurization; ocular
protection against foreign matter, irritants, or laser threats; ballistic protection systems for aircraft
occupants, particularly armour; protection from the effects of Nuclear, Biological, Chemical (NBC) and/or
laser environments; and floatation and drowning prevention.
• Physiological requirements of life support systems;

• Emergency oxygen systems;
• Flotation devices and signalling equipment.
• Natural and induced environmental conditions, and specifically those which degrade human
physical and cognitive capabilities;
• The specified worst-case crewmember breathing scenario, to be agreed and verified.
9.5.1 Life support functionality.

Aircraft life support systems and personal protective equipment shall be designed, installed and
integrated, such that they are fully functional and accessible for the intended personnel and passengers
throughout the operational envelope of the aircraft.

a. Hypoxia, toxic smoke and fumes.
b. Effect of high 'g' accelerations.
c. Effect of high altitude / depressurization.
d. Effect of foreign matter and irritants.
e. Ballistic threats.
f. Nuclear, Biological, Chemical and/or Laser environments.
g. Anthropometric range of occupants.

1. Rig and ground tests should demonstrate life support system integration and functionality, from the
standpoint of the overall system performance and installation.
Information Sources
Comm'l Doc:
3.10, 4.10, 3.13, 4.13 Reference: 00-970 P13 3.10
Information Sources
JSSG-2010-9 Personal 00-970 P13 3.11
Protective Equipment STANAG 3198
Handbook 3.9.1, 4.9.1 Reference:
23.1441, 25.1301, 25.1441 Reference: CS 23.1441
CS 25.1301
CS 25.1441
CS.27.1301
CS 29.1301
9.5.2 Life support physiology.

Aircraft life support systems and personal protective equipment shall include sufficient provisions and
protection to satisfy the specified physiological requirements, in order to permit aircraft occupants to
maintain control under all anticipated environmental conditions. The physiological needs of aircraft
occupants shall be met in normal flight, as defined by the mission roles of the aircraft; during and after
any in-flight emergency; and as appropriate after escape from the aircraft.

a. Specified physiological requirements.
b. Natural and induced environmental conditions, and specifically those which degrade human physical
and cognitive capabilities.
c. Maintaining core body temperature, including protection from cold weather/water.
d. Preventing hypoxia without inducing unacceptable physiological effects, such as acceleration
atelectasis or delayed optic barotrauma.
e. Breathing gas pressures and concentrations to meet respiratory demands without imposing excessive
resistance to breathing.
f. Mask cavity temperature and pressure.
g. Protection from chemical or biological threats.
h. Maintaining consciousness during manoeuvring loads and for extreme cabin altitudes.
i. Floatation and drowning prevention for an unconscious crewmember.
j. Fire protection/resistance properties of aircrew personal protective equipment and clothing.

1. System Description Documents (SDD) should detail physiological requirements.
2. Human testing in mockups, simulators and production representative systems should verify
physiological requirements are met.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.6, 4.6, 3.9, 4.9, Def-Stan 00-970 00-970 P1 S6.13
3.13, 4.13 (Unverified - no Reference: 00-970 P13 S3.10
access to JSSG-2010: 6, 9, 13) 00-970 P13 S3.11
JSSG-2010: 3.10, 4.10
00-970 P1/5 S6 L29
JSSG-2010-9: Personal
STANAG 3198
Protective Equipment
Reference:
Handbook (Unverified - no
Information Sources
access to JSSG-2010-9)
23.1441, 25.1301, 25.1441 Reference: CS 25.1441
9.5.3 Life support interfaces.

Where aircraft life support systems interface with other aircraft subsystems, no operational mode of any
life support system shall degrade other subsystems sufficiently to cause an unsafe condition; and no
operational or failure mode of subsystems shall cause a life support system failure, or condition that can
injure occupants, fail to meet physiological needs, or prevent sustained flight.

a. Specified design limits for the life support system where there is an interface with other subsystems.
b. The effect of a software/firmware failure to subsystems that interface with the oxygen subsystem such
as built-in-test.

1. Rig and ground tests should demonstrate the life support system's interface with other subsystems.
Demonstrations should include using mock-ups and simulations, and on-aircraft and/or control station
system check-outs.
2. Failure Modes Effects and Criticality Analysis (FMECA) should identify potential failure mode causes,
including those that could be induced by life support system or subsystem operations.
Information Sources
Comm'l Doc:
3.10, 4.10, 3.13, 4.13 Reference: 00-970 P13 3.10
JSSG-2010-9 Personal 00-970 P13 3.11
Protective Equipment STANAG
Handbook (Unverified - no Reference:
access to JSSG-2010-9)
23.1441, 25.1301, 25.1441 Reference: CS 25.1441
9.5.4 Emergency oxygen.

The oxygen system, which is used in the event of an emergency shall provide a supply of breathing gas
to all aircraft occupants. The duration of supply shall be sufficient to protect all occupants during descent
for the maximum time possible. As a minimum this shall be the longest anticipated time taken to descend
from the maximum altitude to a safe altitude. Emergency oxygen flow should be automatically initiated
and alert the occupants that it is activated.

a. The longest anticipated time to descend to 10,000 ft from the maximum altitude.
b. The worst-case crewmember breathing scenario.
c. Whether the cabin is pressurised or depressurised.

1. System Description Documents (SDD) should detail the emergency oxygen system capabilities.
2. Rig and ground tests should demonstrate the emergency oxygen system capabilities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.10.2.2 Other Def-Stan 00-970 00-970 P1 6.13.5.31-6.13.5.32
oxygen subsystems Reference:
JSSG-2010: 3.13, 4.13 STANAG 3198 S4b. Par. 11
(Unverified - no access to Reference:
JSSG-2010-13)
Refer to technical point of
contact for this discipline (listed
in section A.2)
9.5.4.1 Emergency oxygen-escape.

An emergency oxygen supply shall be available for use during high altitude escape and shall have
sufficient stored oxygen capacity to protect crew members during descent for the maximum time possible.
As a minimum this shall be the longest anticipated time taken to descend from the maximum altitude to a
safe altitude. Emergency oxygen flow shall be automatically initiated and supplied to crew members on
escape.

a. The longest anticipated time to descend to 10,000 ft from the maximum altitude.
b. The specified worst-case crewmember breathing scenario.

1. System Description Documents (SDD) should detail emergency oxygen requirements.
2. Rig and ground tests should demonstrate oxygen requirements are met. Testing should consist of
initial simulated human exposures to operational environments, followed by human testing in mockups
and simulators.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 6.13.5.31-6.13.5.32
Reference:
STANAG 3198 S4b. Par. 12
Reference:
FAA Doc: EASA CS
Reference:
9.5.5 Life raft operation.

Emergency floatation devices (life rafts, life preservers etc.) shall be plainly marked as to their method of
operation. All survival equipment shall be approved, and shall be plainly marked for identification and
method of operation. Emergency floatation and signalling equipment shall be installed so that it is readily
available to the crew and passengers. This includes stowage provisions, which shall be marked for the
benefit of occupants and to facilitate easy removal of the equipment. Each signalling device shall be
accessible, function satisfactorily and free of any hazard in its operation.

a. Life raft provision on aircraft with extended overwater operations;
b. Placing markings and instructions as near as possible to the relevant control, release mechanism etc.;
c. Survival equipment including pyrotechnic signalling devices (i.e. flares);
d. Size and colour or lettering / numbering shall meet the specified requirements.

1. System Safety Assessment (SSA) should verify the existence of markings and instructions by aircraft
and article inspections. Floatation accessibility is verified by mockup demonstrations and functional tests
of floatation deployment and inflation systems.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-11: 3.11.7.3 Def-Stan 00-970 00-970 P1 P1 6.8.18
(Unverified - no access to Reference: 00-970 P1 7.4.13
JSSG-2010-11) 00-970 P1/5 S6 L34
STANAG
Reference:
23.1561, 23.1415, 121.339 Reference: CS 23.1415
CS 23.1561
CS 25.1411
CS 25.1415
CS 25.1561
CS 27.1411
CS 27.1415
CS 27.1561
CS 29.1411
CS 29.1415
CS 29.1561
9.5.6 Life raft release.

Each life raft released automatically or by a crew member shall be attached to the aircraft by a static line
to keep it alongside the aircraft . This line shall be sufficiently weak to break away from the aircraft to
prevent submerging the raft when the aircraft becomes submerged.

a. Ensuring intergration with the aircraft is such that probability of inadvertant inflation during egress is
minimised.

1. System Safety Assessment (SSA) should verify the physical characteristics of the aircraft flotation
system.
Information Sources
Information Sources
Comm'l Doc:
Reference: 00-970 P1 6.8.14
00-970 P1 6.8.21
00-970 P1/5 S6 L34
STANAG
Reference:
23.1561, 23.1415, TSO C70a Reference: CS 25.1415
CS 27.1415
CS 29.1415
9.5.7 Firefighting equipment and protection

The aircraft shall be equipped with breathing and eye protection equipment, fire-fighting equipment, and
fire extinguishers appropriate for the expected use.

a. Ensuring equipment is conveniently located and readily accessible by the crew.

1. System Safety Assessment (SSA) should verify availability and accessibility of fire protection
equipment by inspection of operator/crew equipment provisions and the aircraft system configuration.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516: 8.2, 8.4 and Def-Stan 00-970 00-970 Pt 13 Sec 1.4
section 14 Reference: 00-970 Pt 13 Sec 1.6.12
JSSG-2010: 3.7, 4.7 00-970 Pt 13 Sec 1.6.13 to
JSSG 2010-9: 3.9.3 1.6.13.2
FAA References: 14 CFR STANAG
references: 25.851 Reference:
CS 23.1439
CS 25.851
CS 25.1197
CS 25.1439
CS 29.851
CS 29.1197
CS 29.1439
9.6. TRANSPARENCY INTEGRATION.

This section covers the installation, integration, interface and operation of aircraft transparency systems,
including criteria relevant to crew exterior vision and crew protection from the external environment.
Included with the scope of the this section are:
• Remote camera systems, flat transparency windows, windscreens, and/or canopy systems;
• Transparency/canopy frames, canopy actuators, canopy latch/locking systems.
9.6.1 Transparency system integration with the escape system.

Canopies, or other transparency systems, along with their associated support structure, actuation,
latching, and locking mechanisms shall be compatible with the aircraft escape system to permit safe
egress and escape.

a. Canopies, or other transparency systems, and their associated mechanisms cannot be rendered
inoperative through ice accretion.
b. Canopies, or other transparency systems, and their associated mechanisms cannot be rendered
inoperative through thermal effects on the ground. See Line 9.6.3 for thermal effects in flight.

1. Flight tests, computer modeling and inspections of engineering drawings, should demonstrate
transparency system compatibility with the escape system.
Information Sources
Comm'l Doc: For a new transparency in an
existing aircraft, it is
recommended that reference
be made to the existing aircraft
specifications.
DoD/MIL Doc: JSSG-2010-14: 3.14, 4.14 Def-Stan 00-970 00-970 P1 4.18.3
JSSG-2010-11 Reference: 00-970 P1 4.19.28
MIL-STD-1474 00-970 P1 4.20.2-4.20.4
00-970 P1 4.20.10-4.20.14
00-970 P1 4.23.20-4.23.23
00-970 P1 4.23.40-4.23.45
STANAG
Reference:
CS 27.807
9.6.2 Transparency system survivability.

The transparency system shall meet the survivability requirements for bird strike impact.

a. Defining the meaning of a birdstrike in terms of bird weight, combined velocity, impact angle etc.
b. Acceptable breakage characteristics of the transparency.
c. Remote camera system susceptibility to bird strike.
1. Structural analysis should demonstrate that maximum stresses due to a bird strike are below material
allowables.
2. Rig and ground tests of full scale bird strikes at worst case impact locations should demonstrate no
transparency or backup structural failure is sufficient to cause loss of the aircraft, or crew member
incapacitation, or loss of remote camera system functionality.
Information Sources
Comm'l Doc: ASTM F330, Bird Impact
Testing of Aerospace
Transparent Enclosures
JSSG-2006-3.2.24.1 Reference: 00-970 P1 4.9.6
00-970 P1 4.9.7
00-970 P1 4.18.8
00-970 P13 1.1.2.5
STANAG 4671.775
Reference:
CS 25.773
CS 25.775
CS 27.775
CS 29.631
CS 29.775
9.6.3 Transparency system structural/thermal capabilities.

The structural/thermal capability of the transparency system shall be adequate for all loads and flight
conditions.

a. Structural impacts including impact loads from hail.
b. Wire strikes are a significant hazard for certain platform types, and although more properly an
operating risk, consideration should be given to mitigating their effects;
c. The potential effect of specialised coatings;
d. The ability of the transparency to withstand ice shed from propeller tips.

1. Rig and ground tests should demonstrate the structural and thermal capabilities of the aircraft
transparencies.
Information Sources
Comm'l Doc:
JSSG-2006-3.2.22 Reference: 00-970 P1 4.18.8
00-970 P13 1.1.2.5
STANAG 4671.775
Reference:
Information Sources
CS 25.875
9.6.4 Transparency system shape compatibility.

Transparency system shape shall be compatible, and not interfere, with crew-member and equipment
positions and motions used during normal and emergency conditions.

a. Use of specialized cockpit equipment,.
b. Transferring equipment from one crew member to another.
c. Inertial reactions to accelerations.

1. Rig and ground tests should demonstrate the extent of any scratching or crazing as the result of any
activities or positions that may cause contact.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.16.6
00-970 P1 4.23.46
STANAG
Reference:
FAA Doc: 14CFR references: 23.775, EASA CS
25.775 Reference:
9.6.5 Optical characteristics of the transparency system.

The optical characteristics of the transparencies (windshield, canopy, windows, and enclosures for flight
critical remote camera systems and sensors, as applicable), shall be compatible with the safety-critical
optical systems used by the aircrew and provide a safe optical environment for the crew.

a. Optical characteristics such as transmissivity, angular deviation, optical distortion, haze, multiple
imaging, binocular disparity, birefringence, and minor optical defects
b. Specialised coatings.

1. Rig and ground tests should demonstrate transparency system optical characteristics by optical test of
coupon samples and representative first articles.
2. Rig and ground tests should demonstrate that the pilot and/or operator visibility is sufficient in all
relevant operational lighting conditions (including NVIS lighting) to maintain vehicle control and perform
critical tasks.
Information Sources
Comm'l Doc:
Information Sources
JSSG-2010-14: 3.1.4.1, for Reference: 00-970 P1 4.18.6
additional transparency optical 00-970 P1 4.18.18
characteristics and 00-970 P7 S1 L104 3.1
recommended values STANAG 4671.775
Reference:
CS 27.773
CS 29.773
9.6.6 Canopy deployment power.

The power required to open the canopy shall be available under normal and emergency conditions, and
manual actuation of the canopy shall be possible when aircraft or external power is not available.

a. Provision of external means to open canopy by a ground rescue crew.
b. Entering and leaving the aircraft with all power off.

1. Rig and ground tests should demonstrate deployment power availability and manual capabilities.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.23.23
00-970 P1 6.6.2
00-970 P1 6.6.6
00-970 P1 6.6.8
00-970 P1 6.6.88
STANAG
Reference:
25.775 Reference:
9.6.7 Transparency system integration with the environmental management system.

The environmental management system interface shall provide necessary defogging, pressurization,
heating, cooling, humidity control, and ventilation of the transparency system under normal and
emergency conditions.

a. Ensuring provisions are incorporated to sufficiently remove rain, snow, ice, and fog from
transparencies.

1. Rig and ground tests should demonstrate the capability of removing fog, ice, snow, or rain from the
transparency through system tests in simulated flight conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-14: 3.14, 4.14; Def-Stan 00-970 00-970 P1 4.17.2
JSSG 2010-3: 3.3.2, 4.3.2 Reference: 00-970 P1 4.17.3
00-970 P1 4.24.2
00-970 P1 4.24.6
00-970 P1 4.24.28-4.24.29
00-970 P1 4.24.50
00-970 P1 4.24.53-4.24.54
00-970 P13 1.1.2.1
STANAG 4671.775
Reference:
CS 25.1438
CS 27.773
CS 29.773
9.6.8 Transparency system external degradation

Provision shall be made to ensure that the pilots' transparencies remain adequately clear from obscurants
at all times, and that such provisions do not cause temporary or permanent optical degradation of the
transparencies.

a. Rain removal;
b. Removal of insect debris, dust, dirt, sand, and salt from sea spray;
c. De-fogging and de-icing;
d. Anti-fogging, anti-icing, and snow removal.

1. Rig and ground tests should demonstrate the capability of removing external debris and precipitation
from the transparency through system tests in simulated flight conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-14: 3.14, 4.14 Def-Stan 00-970 00-970 P1 4.17.8-4.17.15
Reference: 00-970 P1 4.17.23
00-970 P1 4.18.18
00-970 P7 S1 L104 2.3
00-970 P13 1.1.2.1
00-970 P13 1.1.2.2
00-970 P13 1.1.2.5
00-970 P13 1.5.1.23
00-970 P13 1.5.1.24
STANAG 4671.775
Reference:
25.775 CS 23.775
Information Sources
CS 27.773
CS 29.773
9.7. CRASH SURVIVABILITY.

This section covers the provision of suitable and sufficient crash protection and procedures in order to
minimise injury to the pilot, air crew, and passengers in the event of an aircraft crash scenario.
• The seating system(s) design (including energy absorbing seats, stretchers);

• Restraint system design and configuration;
• Functionality of exits post crash;
• Injury prevention from items of mass (including engines, gearboxes, rotor blades etc.);
• Provision of fire fighting equipment (fire extinguishers, breathing and eye protection
equipment etc.);
• Ditching provisions (including floatation devices);
• Pre crash warnings and crash recovery procedures;
• Crew extraction devices.
• The number or aircraft occupants;

• Ensuring that body mass figures used are appropriate, and allow a sufficient margin for fully
equipped troops;
• Type and role of aircraft;
• The ability of personnel to operate appropriate emergency devices while wearing personal
protective equipment; this relates to aircrew and rescue crews.
9.7.1 Seating system load capabilities.

The seating system, or systems including stretchers, to be used on the aircraft shall be appropriate for
their proposed use. The design of the floor and load paths to the seat, or stretcher, attachments shall be
capable of sustaining the loads of the seat or stretcher system in applicable crash load conditions.

a. Body mass, including kit, of seat occupants.
b. Static and dynamic load conditions.

1. Rig and ground tests should demonstrate that the seat and restraint system, with associated aircraft
structure, meets the standard with a seated occupant.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.7, 4.7 Def-Stan 00-970 00-970 P1 4.22.2
JSSG-2006-3.4.2.11 Reference: 00-970 P7 L307
STANAG
Reference:
23.562, 25.561, 25.562, 25.563 Reference: CS 23.562
CS 23.785
CS 25.561
CS 25.562
CS 25.785
CS 27.561
CS 27.562
CS 27.785
CS 29.561
CS 29.562
CS 29.785
9.7.2 Seating stroke clearance envelopes.

There shall be no intrusion into the stroke clearance envelope of energy absorbing seats that could
impede the seat stroke.

a. Equipment.
b. Structure.
c. Other materiel including stowage of carry-on kit.
d. The ability of occupants to tuck feet under the seat.
e. The physiological aspects of design, including anthropometric range of occupants.

1. Rig and ground tests should demonstrate the stroke clearance envelope, indicating the occupied stroke
volume for the design impact velocity of the aircraft and ensuring that volume exists and is unobstructed
in the aircraft design.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
CS 29.785
9.7.3 Restraint systems loads.

The escape system environment and the requisite crash loading of the seats, or stretchers, shall be
defined. The restraint system shall be defined in terms of properly restraining the seat or stretcher
occupant for each defined environment.

a. Type of seat restraint - lap belt, or lap and shoulder;
b. Aircraft occupants may be in a stretcher, or litter, as opposed to a seat;
c. Ensuring that body mass figures used are appropriate, and allow a sufficient margin for fully equipped
troops;
d. Ensuring that there is sufficient margin between required allowances for body mass now and projected
body mass for lifetime of the platform.

1. Rig and ground tests should demonstrate that the restraint system properly restrains the occupant.
Information Sources
Comm'l Doc:
JSSG-2006-3.4.2.11 Reference: 00-970 P1 4.21
00-970 P1 4.22.2
00-970 P1 4.22.42
00-970 P1 4.22.43
00-970 P7 S1 L111
STANAG
Reference:
23.562, 25.561, 25.562, 25.563 Reference: CS 23.562
CS 23.785
CS 25.561
CS 25.562
CS 25.785
CS 27.561
CS 27.562
CS 27.785
CS 29.561
CS 29.562
CS 29.785
9.7.4 Occupant strike envelope.

The strike envelope of the occupant during defined crash loads shall be kept free of objects, including
deforming platform structure, that are risks to survival or which may cause serious injury rendering the
crewmember(s), or other occupants, unable to perform post-crash egress functions.

1. System Description Documents (SDD) should detail design crash loads.
2. Rig and ground tests should demonstrate that occupant body translation is determined for design crash
loads and that no objects in the crew station that would cause major injury are within that translation
volume. Analytical models of human body motion under crash load conditions should verify that no strike
hazards exist.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.7, 4.7 Def-Stan 00-970 00-970 P1 4.15.17-4.15.18
Reference: 00-970 P1 4.22.9-4.22.13
00-970 P1 4.22.20
00-970 P1 4.22.44
STANAG
Reference:
23.562, 25.561, 25.562, 25.563 Reference: CS 23.562
CS 23.785
CS 25.561
CS 25.562
CS 25.785
CS 27.561
CS 27.562
CS 27.785
CS 29.561
CS 29.562
CS 29.785
9.7.5 Post crash operational exits.

The design crash loads for the aircraft shall be defined and it shall be shown that the designated
emergency exits are operable up to, and including, these defined loads.

1. Rig and ground tests should demonstrate that all aircraft exits function following application of loads up
to and including design crash loads.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.22.6
00-970 P1 4.22.8
00-970 P1 4.22.44
00-970 P1 4.22.56
STANAG
Reference:
23.562, 25.561, 25.562, 25.563 Reference: CS 23.807
CS 25.563
CS 25.801
Information Sources
CS 25.809
CS 26.801
CS 27.801
CS 28.801
CS 29.783
CS 29.801
CS 29.809
9.7.6 Items of mass.

Under emergency landing, ditching, and crash load conditions, items of mass shall not cause serious
injury to occupants or prevent their escape by any recognised escape route. Items of mass shall include
cargo or baggage carried by the aircraft .

a. Ultimate loads for structural installations for normal and emergency operations/conditions.
b. Installed equipment in passenger compartments.

1. System Description Documents (SDD) should detail the aircraft system level crash condition
requirements.
2. Analyses and/or rig and ground tests should demonstrate that aircraft component installations do not
pose a serious injury hazard.
Information Sources
Comm'l Doc:
JSSG-2006-3.4.2.11 Reference: 00-970 P1 4.22.46
00-970 P1 4.22.49-4.22.50
00-970 P1 4.22.51-4.22.52
STANAG
Reference:
23.562, 25.561, 25.562, Reference: CS 23.787
25.563, 25.787, 25.789, CS 25.561
23.787, 25.801, 25.1411,
CS 25.787
25.1421
CS 25.789
CS 25.1421
CS 27.561
CS 27.787
CS 29.561
CS 29.787
Information Sources
Comm'l Doc:
Information Sources
Reference:
STANAG
Reference:
FAA Doc: 14CFR references: 25.851 EASA CS
Reference:
9.7.7 Ditching provisions.

Where certification with 'ditching provision' is required, the requisite safety equipment shall be installed.
On all aircraft without assisted escape systems this shall include sufficient life rafts for all occupants, and
individual floatation devices for each occupant.

a. Number and location of life rafts.
b. Provision of over capacity of life rafts to account for damage or access after ditching.
c. Numbers and location of other safety equipment which might be required by ditching provisions.
d. Any structural damage due to ditching shall not adversely affect survivability including launch of life
rafts.

1. System Safety Assessment (SSA) should verify normal and emergency operations for all intended
aircraft occupants through analyses and intergration testing from the standpoint of the overall system
performance and installation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010: 3.7, 4.7 Def-Stan 00-970 00-970 P1 6.8
Reference:
STANAG
Reference:
23.562, 25.561, 25.562, 25.563 Reference: CS 23.1415
CS 25.563
CS 25.801
CS 25.1411
CS 25.1415
CS 27.801
CS 27.1411
CS 27.1415
CS 29.801
CS 29.1411
CS 29.1415
9.7.8 Pre-crash warning system.

A method to provide a pre-crash warning between aircrew and all other compartments shall be available.
The warning shall be available in all occupied, or occupiable sections of the aircraft, without aircrew or
other occupants leaving their seated position.

a. Making redundant warning - visual and auditory for example.
b. Provision of warnings at all duty stations, in toilets, galleys, and all other areas where crew or
passengers might be expected.

1. System Description Documents (SDD) should detail the ability to convey a warning indication to all
crew and passengers.
2. Technical Publications should detail the process to activate the warning system.
3. Rig and ground tests should demonstrate the operation of the warning system from seated positions.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.15.33
00-970 P1 4.15.39
00-970 P1 6.6.88
00-970 P13 1.2.4.1- 1.2.5.1
STANAG
Reference:
FAA Doc: Def Stan 00-970 Pt 1 Sec EASA CS CS 23.771
4.15.6 Reference: CS 25.819
Def Stan 00-970 Pt 1 Sec CS 25.1307
4.15.33 CS 25.1423
Def Stan 00-970 Pt 1 Sec CS 29.1307
4.15.39
Def Stan 00-970 Pt 1 Sec
6.6.88
Def Stan 00-970 Pt 13 Sec
1.2.4.1 and 1.2.5.1
9.7.9 Occupiable volume reduction in rotary wing aircraft.

For rotary wing aircraft, occupiable volume reduction resulting from design crash loads shall provide
reasonable protection against occupant injury; this applies to structural deformation, and other intrusion
into occupiable space.

a. The mounting of engines, transmissions, fuel cells, rotor masts, and other high mass objects.
b. Impact conditions such as rollover about the aircraft's pitch or roll axes.

1. Structural test and analysis and crash load tests should verify that the design meets occupant volume
requirements.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.3.10.2.1, Def-Stan 00-970 00-970 P1 4.15.17-4.15.18
4.3.10.2.1 Reference: 00-970 P1 4.22.9-4.22.13
Information Sources
JSSG-2010-7: 3.7.3.2.1 00-970 P1 4.22.29-4.22.41
00-970 P1 4.22.51-4.22.52
STANAG
Reference:
CS 27.785
CS 27.787
CS 29.561
CS 29.562
CS 29.785
CS 29.787
9.7.10 Emergency crew extraction mechanisms.

The mechanisms used for emergency crew extraction and for fire fighting shall be properly marked, easily
identified, and shall be operable while wearing personal protective equipment.

a. Ejection mechanisms.
b. Emergency exit use by aircrew, passengers, and rescue crews.
c. Lighting of emergency exits and fire fighting equipment.

1. Rig and ground tests should demonstrate the ability to operate required emergency egress and rescue
mechanisms.
2. Technical Publications should detail the process to operate required emergency egress and rescue
mechanisms.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1472: 5.5, 5.6 Def-Stan 00-970 00-970 P13 1.6.11.5
JSSG-2001: 3.4.3, 4.4.3 Reference: 00-970 P13 1.6.12.1
JSSG-2010-9: 3.9.5, 4.9.5 00-970 P13 1.6.13.1-1.6.13.2
JSSG-2010-13: 3.13.6, 4.13.16 00-970 P13 1.6.15.1
00-970 P13 1.6.15.3
00-970 P13 1.6.15.5
00-970 P13 1.6.15.6
00-970 P13 1.6.15.7
STANAG 3230
Reference:
CS 23.1557
CS 23.1561
CS 25.811
CS 25.812
Information Sources
CS 25.1557
CS 25.1561
CS 27.1557
CS 27.1561
CS 29.811
CS 29.812
CS 29.1557
CS 29.1561
9.8. LAVATORIES, GALLEYS, AND AREAS NOT CONTINUOUSLY OCCUPIED.

This section covers aircraft compartments, and areas that may be accessible to crew, passengers or
maintainers, but that may not be occupied at all times during flight.
1. That food service carts, refuse carts, and waste containers used to receive any combustible materials
contain a fire ignited within.
2. That all compartments have separate and approved smoke and/or fire detectors to alert the crew at the
pilot or flight engineer station for both in-flight and ground operations; that each compartment has
dedicated hand fire extinguishers; and that if unoccupied cargo holds are present, fire protection and fire
detection/suppression requirements are met.
3. That the fire alarm and intercom/public address system can be heard in all lavatories, galleys, and
other compartments.
4. That the human factors design for operation of installed equipment minimises the probability of human
error that could create a safety hazard in the aircraft.
5. That all equipment installed in lavatories, galleys, and other areas can be safely operated in the aircraft
environment, and is designed to withstand all potential aircraft environmental exposures, including rapid
decompression, without creating a safety hazard.
6. That occupants cannot become trapped in lavatories, galleys, and other compartments during
emergency evacuation situations, and that emergency lighting is available to aid egress.
9.8.1 Combustible material containment.

Food service carts, refuse carts, and waste containers used to receive any combustible materials shall be
capable of containing any fire likely to occur within it.

a. Fire resistant material.
b. Minimising the use of openings for ventilation, entry, or other use in fire containment areas.

1. System Description Documents (SDD) should detail the fire retardant requirements for combustible
materials containers.
2. Rig tests should demonstrate the ability of the disposal receptacle to contain fires under all probable
conditions of wear, misalignment, and ventilation expected in service.
Information Sources
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
CS 29.853
9.8.2 Smoke and fire detectors & extinguishers.

All aircraft and/or control station compartments shall have separate and approved smoke and/or fire
detectors to alert the crew at the pilot, operator or flight engineer station for both in-flight and ground
operations. Each aircraft and/or control station compartment shall have dedicated hand fire extinguishers,
and if unoccupied cargo holds are present, fire protection and fire detection/suppression requirements
shall be met.

a. Ensuring fire extinguishers are readily accessible for use.
b. Ensuring no extinguishing agent likely to enter personnel compartments will be hazardous to the
occupants.
c. Built-in fire extinguishing systems.

1. System Description Documents (SDD) should detail the smoke detectors, fire extinguishers, and fire
protection/detection/suppression systems installed throughout the aircraft and/or control station.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-7: 3.7.3.4 Def-Stan 00-970 00-970 P1 4.26.55
JSSG-2009 Appendix G: Reference: 00-970 P1 4.26.56
3.4.7.9 00-970 P1 4.26.60
00-970 P1 4.26.61-4.26.62
STANAG
Reference:
25.857, 25.858, 25.859, 25.854 Reference: CS 23.859
CS 25.851
CS 25.854
CS 25.855
CS 25.857
CS 25.858
CS 25.859
CS 27.855
CS 27.859
CS 29.855
CS 29.859
9.8.3 Intercom/ public address system.

The fire alarm and intercom/public address system shall be audible in all lavatories, galleys, and other
compartments not continuously occupied.

a. Ensuring system volume is sufficient to be detected in all compartments, during all normal flight noise
levels.
b. Capability to provide independance of alarm and intercom or PA systems from any required
crewmember interphone system.

1. Rig and ground tests should demonstrate the fire alarm, intercom, and public address systems
functionality under all approved operating configurations and conditions.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
9.9.4 Merged with 9.4.1 for equipment and 9.4.2 for supporting documentation.
9.8.4 Safe operation under aircraft environmental exposures.
All equipment installed in lavatories, galleys, and other areas not continuously occupied shall be safe to
operate in the aircraft environment, and shall be designed to withstand all potential aircraft environmental
exposures, including rapid decompression, without creating a safety hazard.

a. Where locking mechanisms are installed, capability exists to be unlocked from the outside without the
aid of special tools.
b. Ensuring enclosed spaces, such as lavatories and compartments, have emergency lighting to permit
the occupants to perform flight safety critical functions and escape during a loss of electrical power.
c. Ensuring that lighting automatically operates upon loss of power.

1. System Description Documents (SDD) should detail for requirements for functionality of areas not
continuously occupied in all approved operating configurations and conditions.
2. Rig and ground tests should demonstrate the function and performance of emergency lighting during
loss of electrical power.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.3.5
00-970 P1 4.3.6
Information Sources
STANAG
Reference:
CS 25.789
CS 25.1301
CS 25.1309
CS 25.1365
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
9.8.5 Occupant entrapment.

It shall not be possible for occupants to become trapped in lavatories, galleys, or other compartments
during emergency evacuation situations. Emergency lighting shall be available to aid egress.

a. Ensuring each enclosed cabin with passenger accommodations has adequate access to external
doors.

1. Rig and ground tests should demonstrate availibility of emergency egress from lavatories, galleys, or
other compartments.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-PRF-85676 Def-Stan 00-970 00-970 P1 4.22.3
Reference: 00-970 P13 1.6.11.5
STANAG
Reference:
CS 25.803
CS 25.812
CS 25.819
CS 25.820
CS 29.803
CS 29.812
SECTION 10 - DIAGNOSTICS SYSTEMS

This section covers the functionality and integration of aircraft diagnostics; and specifically the detection,
isolation, and reporting of loss or degradation of system functions. Some diagnostic systems covered
include, but are not limited to, built-in-tests (BIT), built-in-test-equipment (BITE) and health and usage
monitoring systems (HUMS).
10.1. FAILURE MODES.
10.1.1 Identification and detection.

Critical functional failure modes shall be identified, and provisions incorporated within the aircraft design
for their detection.

a. Conducting a recognised System Safety Analysis ( SSA);
b. Conducting Failure Modes, Effects & Criticality Analysis (FMECA), or acceptable similar analysis, in
order to identify all safety and mission critical failures;
c. Identifying all possible modes of failure, including malfunctions and damage from external sources;
d. The probability of multiple failures, and the probability of undetected faults;
e. The resulting effects on the aircraft and third parties, considering the stage of flight and operating
conditions;
f. The air crew's capability of determining faults.

1. System Safety Analysis (SSA), supported by other safety artefacts as appropriate (e.g. FMECA) should
identify all safety and mission critical failures including damage from external sources, probabilities of
multiple failures and undetected faults, and the resulting effects on aircraft safety and airworthiness.
Information Sources
Comm'l Doc: SAE AIR 4845 details the
FMECA process.
SAE ARP4761
JSSG-2001: 3.3.7, 3.3.7.1 Reference: 00-970 P1 4.12.8
FAA References: 14 CFR 00-970 P1 6.2.35
references: 23.1301, 23.1309, 00-970 P7 L725 4
23.1351, 25.1301, 25.1309,
25.1351, 27.1309, 29.1309 STANAG 4671.1309
23.1309, 23.1351, 25.1301, Reference: CS 25.1309
25.1309, 25.1351 CS 27.1309
Information Sources
CS 29.1309
10.1.2 Timely reporting.

Detection of critical functional failures, including built-In-test (BIT) features, shall activate caution and
warning functions and message indicators in a timely manner, to enable appropriate corrective action to
be taken.

a. Ensuring that cautions and warnings are provided in time to preclude further uncontrolled degradation
to safety, mission accomplishment, and survivability;
b. Use of visual and/or aural indication;
c. Ensuring systems and controls and associated monitoring and warning means are designed to
minimise crew errors.
d. A warnings philosophy for new designs which standardises the warnings criticality level with the
matching warning indication and recording criteria.

1. System Description Documents (SDD) should detail the caution and warning functions and message
indicators associated with each of the aircraft critical functional failures.
2. System Safety Analysis (SSA) should include caution and warning functions, including the effects of
likely delays in corrective action (automatic or manual).
Information Sources
DoD/MIL Doc: JSSG-2000: 3.3.2 Def-Stan 00-970 00.970 P1 2.5.30
JSSG-2001: 3.3.7, 3.3.7.1 Reference: 00-970 P1 4.4.7
FAA References: 14 CFR 00-970 P7 L207 8.5
references: 23.1301, 23.1309, 00-970 P7 L725 3
23.1351, 25.1301, 25.1309, 00-970 P9 UKU 249e
25.1351, 27.1301, 27.1309, STANAG 4671.1309
27.1351, 29.1301, 29.1309, Reference: 4671.1728
29.1351 4671.1787
23.1309, 23.1351, 25.1301, Reference: CS 23.1309
25.1309, 25.1351 CS 23.1351
CS 25.1301
CS 25.1309
CS 25.1351
CS 27.1301
CS 27.1309
CS 27.1351
CS 29.1301
CS 29.1309
CS 29.1351
10.2. OPERATION.
10.2.1 Safety of flight parameters.

Diagnostic systems shall accurately monitor all appropriate safety-of-flight (SOF) parameters, in order to
permit proper diagnosis.

a. The fidelity & integrity of both aircraft and ground diagnostic systems.

1. System Description Documents (SDD) should detail the diagnostic provisions for all SOF parameters,
including their accuracy.
Information Sources
Comm'l Doc:
FAA References: 14 CFR Reference: 00-970 P9 USAR U1787
references: 23.1301, 23.1309, STANAG 4671.1607
23.1351, 25.1301, 25.1309, Reference: 4671.1787
25.1351, 27.1301, 27.1309,
27.1351, 29.1301, 29.1309,
29.1351
EASA CS 23.1301, 23.1309,
23.1351, 25.1301, 25.1309,
25.1351, 27.1301, 27.1309,
27.1351, 29.1301, 29.1309,
29.1351
23.1309, 23.1351, 25.1301, Reference:
25.1309, 25.1351
10.2.1.1 Critical parameter calibration.

Diagnostic sensor operation and calibration procedures shall maintain accurate measurement of all
critical parameter values, within specified tolerances.

a. Establishing specified tolerances for each critical parameter values being monitored;
b. Ensuring diagnostic sensor calibration methods deliver the required integrity.

1. System Description Documents (SDD) should detail the diagnostic sensors incorporated in the design
of the aircraft and their tolerances and calibration procedures.
2. Technical Publications (e.g. Aircraft Maintenance Manual) should detail the procedures for calibration
of each aircraft diagnostic sensor,
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.3.2 Def-Stan 00-970
Information Sources
JSSG-2001: 3.3.7,3.3.7.1 Reference:
FAA References: 14 CFR STANAG
references: 23.1301, 23.1309, Reference:
23.1351, 25.1301, 25.1309,
25.1351, 27.1301, 27.1309,
27.1351, 29.1301, 29.1309,
29.1351
EASA CS 23.1301, 23.1309,
23.1351, 25.1301, 25.1309,
25.1351, 27.1301, 27.1309,
27.1351, 29.1301, 29.1309,
29.1351
23.1309, 23.1351, 25.1301, Reference:
25.1309, 25.1351
10.2.2 Diagnostics system safety.

Failure of the diagnostic system itself shall not adversely affect safety-of-flight (SOF), induce undetected
failures, or otherwise damage the aircraft .

a. Ensuring the diagnostic system design is minimally invasive;
b. Ensuring systems and controls are designed to minimise crew errors;
c. Ensuring dangerous-condition-prevention devices do not limit flight within the Operational Flight
Envelope.
d. Ensuring the failure of diagnostic function does not directly or indirectly reduce SOF.

1. System Description Documents (SDD) should detail the interfaces between diagnostic systems and
other aircraft systems.
2. System Safety Assessment (SSA) should demonstrate that failure of aircraft diagnostic systems does
not reduce aircraft safety below the level of safety that would be met without a diagnostic system
installed.
Information Sources
JSSG-2001: 3.3.7,3.3.7.1 Reference:
JSSG-2001 Air vehicle: 3.3.7 STANAG 4671.1309
Diagnostics Reference:
AFGS 87256 Integrated
Diagnostics provides general
guidance regarding diagnostics
23.1309, 23.1351, 25.1301, Reference: CS 23.1309
25.1309, 25.1351 CS 23.1351
CS 25.1301
Information Sources
CS 25.1309
CS 25.1351
CS 27.1301
CS 27.1309
CS 27.1351
CS 29.1301
CS 29.1309
CS 29.1351
10.2.3 Safety systems health reporting.
All critical safety systems shall be monitored to ensure they are fully functional throughout the aircraft
flight envelope.

a. Use of Built-In-Test (BIT) and/or continuous health monitoring.

1. System Description Documents (SDD) should detail provisions for the status monitoring of all critical
safety systems and should confirm that system status is monitored throughout the flight envelope.
Information Sources
DoD/MIL Doc: JSSG-2000: 3.3.2 Def-Stan 00-970 00-970 P9 UK1309
JSSG-2001: 3.3.7,3.4.4.1.6 Reference:
STANAG 4671.1309
Reference:
23.1309, 23.1351, 25.1301, Reference: CS 23.1309
25.1309, 25.1351 CS 23.1351
CS 25.1301
CS 25.1309
CS 25.1351
CS 27.1301
CS 27.1309
CS 27.1351
CS 29.1301
CS 29.1309
CS 29.1351
10.2.4 Operation and maintenance manuals.

operation of diagnostic systems.


information.
Information Sources
DoD/MIL Doc: JSSG-2000: 3.6.2 Def-Stan 00-970
FAA References: 14 CFR Reference:
references: 23.1301, 23.1309, STANAG 4671.1581
23.1351, 25.1301, 25.1309, Reference: 4671.1787
25.1351, 27.1301, 27.1309,
27.1351, 29.1301, 29.1309,
29.1351
23.1309, 23.1351, 25.1301, Reference: CS 23.1309
25.1309, 25.1351 CS 23.1351
CS 25.1301
CS 25.1309
CS 25.1351
CS 27.1301
CS 27.1309
CS 27.1351
CS 29.1301
CS 29.1309
CS 29.1351
CS 29.1465
10.2.5 Flight Data Recorder / Cockpit Voice Recorder

Aircraft shall be equipped with Flight Data Recorders (FDR) and Cockpit Voice Recorders (CVR) where
appropriate.

a. The essential parameters to be recorded as determined by the National Regulatory Authority.
b. Any potential security aspects associated with the required installation and parameters to be recorded.
c. Location of microphone for audio recordings.
d. Power supply to recording device.

e. Prevention of erasure, or over-writing, of recording after a crash impact.
f. Crash survivability of recording device.
g. Any conspicuity requirements, including underwater detection if required.
h. Ability for pre-flight checking of recorder to ensure correct functioning.

1. System Description Documents (SDD) should detail the provision of FDR and CVR.
2. Technical Publications (e.g. Aircraft Maintenance Manual) should detail the procedures for pre-flight
checking of the recorders.
Information Sources
Comm'l Doc:
DoD/MIL Doc: 14 CFR: 23.1457, 23.1459, Def-Stan 00-970
25.1457, 25.1459, 27.1457, Reference:
27.1459, 29.1457, 29.1459 STANAG
Reference:
FAA Doc: EASA CS
CS 23.1459
CS 25.1457
CS 25.1459
CS 27.1457
CS 27.1459
CS 29.1457
CS 29.1459
SECTION 11 - AVIONICS
avionics system.
(Note: For subsystems that use computer resources, see section 15 for additional, specific criteria.)
11.1. AVIONICS ARCHITECTURE.
11.1.1 Avionics subsystems architecture.

Avionics Subsystems shall have the number and type of sensors, data processors, data buses, controls
and displays, and communications devices adequate for Safety of Flight and air traffic management
considerations.

a. Air data systems, including provisions for displaying primary flight parameters;
b. Propulsion system instrumentation, with the ability to monitor performance, fuel status, and integrity of
the system;
c. Display of other aircraft or management system parameters as required for safe flight;
d. An installed interoperable communications subsystem capable of supporting Safety of Flight and Air
Traffic Management operations with the required integrity (including security) and continuity of service
throughout the intended missions;
e. A navigation subsystem capable of meeting Safety of Flight and Air Traffic Management performance,
integrity, availability and continuity of service requirements for long range reference, local area reference,
and landing/terminal reference;
f. An installed surveillance and identification subsystem capable of meeting the Safety of Flight and Air
Traffic Management performance, integrity, and continuity of service requirements for identification,
relative positioning, trajectory, timing, and intent;
g. Normal, Emergency and Critical Failure Mode conditions.
h. Operation in, or in the vicinity of, a volcanic ash cloud.

1. System Description Documents (SDD) should detail the number and type of sensors, data processors,
data buses, controls and displays, and communications devices which form part of the avionics
subsystem(s).
2. Component qualification, application of appropriate HW and SW development standards, rig, ground
and flight testing should demonstrate that the avionics subsystem(s) support the correct function of
aircraft systems.
Information Sources
Comm'l Doc: For air data system: RTCA
DO-236A, guidance on
Information Sources
CNS/ATM related air data
system requirements
For radio subsystems:

RTCA DO-186A is the civil
standard for VHF radio
RTCA DO-219
RTCA SC-189
For navigation subsystems:

RTCA DO-236A, for CNS/ATM
related navigation system
requirements
RTCA DO-200A: 2.3.2, 2.3.3,
2.3.5, and 2.4.1 (RNP Data
Processing)
RTCA DO-236
For surveillance and

identification subsystems:
RTCA DC-181C is the civil
standard for Mode S
RTCA DO-185A Is the civil
standard for TCAS II
RTCA DO-212
DoD/MIL Doc: JSSG-2005: 3.2.1.5 and Def-Stan 00-970 00-970 P1 6.3.2
4.2.1.5 Reference: 00-970 P1 6.3.4
RTCA DO-178C
RTCA DO-254 STANAG 4671.1301
4671.1723
4671.1725
FAA Doc: AC-23.1301, 23.1309, EASA CS CS 23.1301

25.1301, 25.1309, RTCA DO- Reference: CS 25.1301
200A CS 27.1301
AC 27-1B, Certification of
CS 29.1301
Normal Category Rotorcraft
AC 29-2C, Certification of
Transport Category Rotorcraft
AC 20-145 Guidance for
Integrated Modular Avionics
(IMA)
AC 20-130A, Airworthiness
Approval of Navigation or
Flight Management Systems
Integrating Multiple Navigation
Information Sources
Sensors
For air data system:
FAA IG 91-RVSM, 7.c(4),
7.C(5), 7.c(8), 7.d, 8.b(5),
8.b(6), 8.b(7), 8.c, and 8.d.
(RVSM)
AC-23.1323, 23.1325,
23.1326, 25.1323, 25.1325,
25.1326
AC 90-97 7 (Baro VNAV)
AC 20-129 6 (RNAV VNAV)
For propulsion system
instrumentation:
13.1305, 23.1309, 25.1301,
25.1305, 25.1309 and FAA
AC-1307-1C section 8.5
provide more extensive
guidance.
AC-27-1 and AC-29-2 provide
guidance on helicopter
equipment, primarily in subpart
"F"
For display system guidance:
AC 23.1301, 23.1309,
23.1351d, 25.1301, 25.1309,
25.1351d
23.1307, 25.1301 and 25.1307
provide additional guidance.
“F”
For radio subsystems:
AC 20-140, Guidelines for
Design Approval of Aircraft
Data Communications
Systems
For navigation subsystems:
AC-25.1303, AC 90-96
AC_90-96 (BRNAV only)
AC_90-96A (Draft containing
both BRNAV and PRNAV
requirements)
FAAO 8400.12A 10.a-b, & 15a
(RNP-10)
Information Sources
AC 20-129 Airworthiness
Approval of Vertical Navigation
(VNAV) Systems for use in the
U.S. National Airspace System
(NAS) and Alaska, 9-12-88, 6
(RNAV VNAV)
For surveillance and
identification subsystems: TSO
C112, AC 20-131A, TSO
C151a
11.1.2 Redundancy.
Failure of any single sensor, connection, processor, or display unit with any credible combination of
failures shall not result in loss of safety-critical data or display of unsafe or misleading data.

a. Normal, Emergency and Critical Failure Mode conditions;

1. Failure Modes and Effects Analysis (FMEA),as part of the Safety Asessment should demonstrate that
the failure of any single sensor, connection, processor, or display unit does not result in loss of safety-
critical data or display of unsafe or misleading data.
and flight testing should demonstrate the accuracy of the performed analysis and should demonstrate that
failure of any single sensor, connection, processor, or display unit does not result in loss of safety-critical
data or display of unsafe or misleading data.
Information Sources
Comm'l Doc: SAE ARP4761 sections 4.2
FMEA, 4.4 CCA, 4.4.2 PRA,
and 4.4.3 CMA
STANAG 4671.1309
23.1331, 25.1309, 25.1331 Reference: CS 23.1311
14CFR references: 23.1309, CS 23.1331
23.1311, 23.1331, 25.1309, CS 25.1309
25.1331 CS 25.1331
AC-27-1 and AC-29-2 provide CS 27.1309
guidance on helicopter CS 29.1309
equipment, primarily in subpart CS 29.1331
"F"
11.1.3 Data buses.

Data buses shall have sufficient redundancy, reliability, and integrity to meet system safety and flight-
critical requirements, and shall preclude the loss of safety-critical functioning, the display of unsafe or
misleading information to the operator or maintainer, and any undetected failure modes.

b. Multiple, independent paths for critical signals.

1. System Description Documents (SDD) should detail provisions for redundancy, reliability and integrity,
and should demonstrate that such provisions meet system safety and flight-critical requirements.
2. Failure Modes and Effects Analysis (FMEA) as part of the Safety Asessment should demonstrate that
data bus design precludes the loss of safety-critical functioning, the display of unsafe or misleading
information to the operator or maintainer, and any undetected failure modes.
aircraft systems.
Information Sources
Reference: 00-970 P7 L725/2
STANAG 4671.1309
Reference:
FAA Doc: AC-27-1 and AC-29-2 provide EASA CS CS 23.1309
guidance on helicopter Reference: CS 25.1309
"F"
CS 29.1309
For prevention of loss of flight
critical functioning: AC-
23.1301, 23.1309, 25.1301,
25.1309
For prevention of unsafe or
misleading information:
AC-23.1301, 23.1309,
23.1311, 25.1301, 25.1309
23.1309, 23.1311, 25.1301,
25.1309
For prevention of undetected
failure modes: AC-23.1301,
23.1309, 25.1301, 25.1309
11.1.4 Deterministic operation.

The overall avionics system shall operate in a predictable, deterministic and bounded manner and limit
latency of any time-critical data, including primary flight data, as needed to support all safety-critical
functions.

a. Defining and achieving limits appropriate to the design of the avionics system such as latency limits,
signal attenuation and/or data loss rates.

1. System Description Documents (SDD) should detail the identified design limits for each avionics
system, and the likely causes and effects of operation outside of such limits.
2. Systems Interface Documents (SID) should define the avionics interface characteristics for each
interfacing system, including relevant design limits and the likely effects of operation outside of such
limits.
3. System Safety Assessment (SSA) should demonstrate that the avionics system operates in a
predictable, deterministic or bounded manner supporting all safety-critical functions.
aircraft systems.
Information Sources
DoD/MIL Doc: JSSG-2005: 3.3.5, 4.3.5 Def-Stan 00-970 00-970 P7 L725/2
For undetected failure modes, Reference:
and timing or latency STANAG 4671.1309
anomalies: JSSG- Reference: 4671.1331
2005:3.2.1.3.2, 4.2.1.3.2 4671.1723
For interface/interconnect
failures: JSSG-2005: 3.2.2.2,
4.2.2.2, 3.2.2.3, 4.2.2.3
23.1329, 23.1335, 25.1301, Reference: CS 23.1331
25.1309, 25.1329, 25.1335 CS 25.1309
CS 25.1331
CS 27.1309
CS 29.1309
"F"
CS 29.1331
AC 20-145, Guidance for
(IMA) that Implement TSO-
C153 Authorized Hardware
Elements.
11.1.5 Modes of operation.

All modes of operation of the avionics system shall be safe, taking into account the effect of undetected
failure modes, timing or latency anomalies, and failures of interfaces and interconnections.

a. All identified modes of operation, and resulting effects on system interfaces due to operation in back-up
or emergency modes.
b. Ensuring that any degradation in function or reliability resulting from operation in back-up or emergency
modes does not result in unacceptable degradation in flight handling qualities or airworthiness.

1. System Description Documents (SDD) should define the various modes of operation of the avionics
system, including any back-up or emergency modes, and the effects that such operation has on system
interfaces.
2. System Safety Assessment (SSA) should demonstrate that all modes of operation of the avionics
system are safe while specifically taking into account the effect of undetected failure modes, timing or
latency anomalies, and failures of interfaces and interconnections.
aircraft systems.
Information Sources
For undetected failure modes, Reference: 00-970 P1 6.2.36
and timing or latency 00-970 P7 L725 4.1
anomalies: JSSG-2005: STANAG 4671.1309
3.2.1.3.2, 4.2.1.3.2 Reference: 4671.1607
For interface/interconnect
failures: JSSG-2005: 3.2.2.2,
4.2.2.2, 3.2.2.3, 4.2.2.3
23.1329, 23.1335, 25.1301, Reference: CS 23.1329
25.1309, 25.1329, 25.1335 CS 25.1309
CS 25.1329
CS 27.1309
CS 27.1329
"F"
CS 29.1309
AC 20-145, Guidance for
CS 29.1329
(IMA) that Implement TSO-
C153 Authorized Hardware
Elements.
11.1.6 Diagnostics.
Integrated avionics diagnostic systems shall provide fault coverage, low false alarm rates, fault isolation
and fault detection such that bad data and failed components that would unacceptably degrade aircraft
safety are detected.

a. Ensuring that incorporated diagnostic systems and functions are appropriate to the design of the
avionics system and the systems with which it interfaces, taking into account the effect on flight safety of
failure of the diagnostic system..
1. System Description Documents (SDD) should detail the provision of diagnostic systems in the design
of the avionics system, including the fault coverage, false alarm rates, fault isolation and fault detection
capabilities of the diagnostic system.
2. System Safety Assessment (SSA) should demonstrate that avionics diagnostic systems adequately
support aircraft safety.
Information Sources
DoD/MIL Doc: JSSG-2005: 3.2.1.3.2, Def-Stan 00-970 00-970 P7 L725 3.4/3.5
STANAG 4671.1787
Reference:
FAA Doc: AC-23.1309, 25.1309 EASA CS
14CFR reference 23.1309, Reference:
25.1309
"F"
11.2. AVIONICS SUBSYSTEMS.
11.2.1 Critical information.

Flight, status and warning information shall be provided to the crew in a timely, clear and unambiguous
form.

a. Legibility of primary flight displays. Ensure that primary flight information is provided to the crew at all
times and is readable in all mission environments (including NVG where applicable) and lighting
conditions (including full sunshine on displays, sun in the eyes, and total darkness);
b. Accuracy. Ensure that accuracy of flight-critical information meets SOF requirements;
c. Warnings, cautions, and advisories. Ensure that cautions and warnings are legible in all mission
environments and are provided in an organized, prioritized system, and that the presentation of high-
priority information is not masked by older or lower priority warnings and cautions;
d. Symbology. Ensure that instruments and symbols used to display flight-critical information employ
accepted formats, directions, etc.;
e. BIT features. Ensure that BIT features of equipment alert the flight crew of flight-critical equipment
status.

1. System Description Documents (SDD) should detail the flight, status and warning information provided
to the crew.
and flight testing should demonstrate that the flight, status and warning information provided to the crew
is provided in a timely, clear and unambiguous form.
Information Sources
Comm'l Doc:
DoD/MIL Doc: DoD/MIL Doc: Def-Stan 00-970 00-970 P1 6.2.1-6.2.6
Reference: 00-970 P1 6.2.33
AFI 11-202 Vol 3: 2.6, 2.6.1, STANAG 4671.1309
2.6.1.1, 2.6.1.2, and 2.6.1.2.1 Reference: 4671.1323
MIL-HDBK-87213 section 3.1.1 4671.1327
JSSG-2005: 3.2.1.8, 4.2.1.8, 4671.1721
3.2.1.8.1, and 4.2.1.8.1 4671.1727
4671.1785
MIL-HDBK-87213: 3.2.1.25.4.1 3705
and App A
JSSG-2005: 3.2.1.8.5,
4.2.1.8.5
MIL-HDBK-87213
MIL-STD-1787 section 4.2

MIL-STD-1787 Appendix A
JSSG-2005: 3.2.1.3.2,
4.2.1.3.2
FAA Doc:
AC-27-1 and AC-29-2
AC 23.1301, 23.1309, 23.1351,
25.1301, 25.1309, 25.1351
23.1311, 23.1321, 25.1321
23.1309, 23.1351, 25.1301,
25.1309, 25.1351, 23.1311,
23.1321, 25.1321
23.1311, 23.1323, 23.1325,
23.1326, 23.1327, 25.1323,
25.1325, 25.1326, 25.1327
23.1311, 23.1322, 25.1322
AC-1311-1A section 9
14CFR reference 23.1321,
23.1541, 25.1321, 25.1541
23.1309, 25.1309
FAA Doc: AC-27-1 and AC-29-2 provide EASA CS CS 23.1309
guidance on helicopter Reference: CS 23.1321
“F”
CS 23.1323
For legibility of primary flight
CS 23.1326
displays:
CS 23.1327
AC 23.1301, 23.1309, 23.1351,
Information Sources
25.1301, 25.1309, 25.1351 CS 23.1541
23.1311, 23.1321, 25.1321 CS 25.1309
14CFR references: 23.1301, CS 25.1321
23.1309, 23.1351, 25.1301, CS 25.1322
25.1309, 25.1351, 23.1311, CS 25.1323
23.1321, 25.1321 provide CS 25.1326
related FAA criteria CS 25.1327
For accuracy: 14CFR CS 25.1541
reference 23.1311, 23.1323, CS 27.1309
23.1325, 23.1326, 23.1327, CS 27.1321
25.1323, 25.1325, 25.1326, CS 27.1322
25.1327 CS 27.1323
For warnings, cautions, and CS 27.1327
advisories: 14CFR reference CS 27.1541
23.1311, 23.1322, 25.1322 CS 29.1309
For symbology: CS 29.1321
AC-1311-1A section 9 CS 29.1322
14CFR reference 23.1321, CS 29.1323
23.1541, 25.1321 and 25.1541 CS 29.1326
For BIT features: 14CFR CS 29.1327
reference 23.1309, 25.1309 CS 29.1541
11.2.2 Reliability/redundancy of controls.

Avionic controls, such as those for controlling avionic modes and system function, shall have adequate
redundancy and/or reliability in order to maintain required control of safety critical functions.

a. Ensuring that provisions for redundancy and reliability of controls takes into account the criticality and
effects of failure of such controls.

1. System Description Documents (SDD) should detail the avionic controls and incorporated provisions
for redundancy and reliability.
2. System Safety Assessment (SSA) should demonstrate that the redundancy and reliability of avionic
controls is appropriate, taking into account the effects of failure on the aircraft and its systems.
Information Sources
DoD/MIL Doc: JSSG-2005: 3.2.1.8.6, Def-Stan 00-970 00-970 P 1/5 S2
4.2.1.8.6 Reference: 00-970 P 1/6 S6 L12
FAA References: 14 CFR STANAG 4671.1731
23.1309, 25.1309 Reference:
FAA Doc: AC-25.777 EASA CS CS 23.1309
AC-27-1 and AC-29-2 provide Reference: CS 25.1309
guidance on helicopter CS 27.1309
“F”
11.2.3 Safety and flight critical control functions.

Safety and flight critical control functions shall ensure safety of flight integrity and continuity of service
throughout all intended missions, and shall ensure that hazardously misleading information is identified
and not displayed to the operator.
a. Appropriate integration of off-board system command and control.

b. Automatic and semi-automatic (man-in-the-loop) landing.
c. Formation flight.
d. Guidance.
e. Other control used for safety and flight critical functions.

1. System Description Documents (SDD) should define all safety and flight critical control functions, and
should identify provisions which ensure the integrity and continuity of service throughout all intended
missions.
2. SDD should define provisions for the identification of hazardously misleading information, and the
provisions used to prevent the display of such information to the operator.
3. System Safety Analysis (SSA) should demonstrate that the integrity and continuity of safety and flight
critical control functions is sufficient to ensure SOF.
aircraft systems.
Information Sources
Reference:
STANAG 4671.1309
Reference: 4671.1601-4671.1617
FAA Doc: 14CFR reference 23.1301, EASA CS CS 23.1309
23.1309, 25.1301, 25.1309 Reference: CS 25.1309
AC 29-140, Guidelines for CS 27.1309
Design Approval of Aircraft CS 29.1309
Data Communications
Systems
11.2.4 Operational environment.

The avionics system, including its subsystems and equipment, shall operate safely and effectively
throughout the expected operational environment.

a. System, subsystems and equipment environmental qualification to the full aircraft operating envelope.
b. Ensuring that pre-existing qualification of Commercial/Military Off-The-Shelf (COTS/MOTS) equipment
is adequate, and where appropriate performing additional qualification to account for the operating
environment of the military aircraft such as high manoeuvre loads, high vibration and shock loads and
operation at supersonic speeds.
c. Electromagnetic Compatibility (EMC), including operation in High Intensity Radiated Fields (HIRF).
d. Heating of external probes.

1. The Aircraft Specification should define the environments within which the aircraft will operate.
2. System Description Documents (SDD) should define the operating environment of the avionics system,
including its subsystems and equipment throughout the aircraft through critical operating conditions.
3. Declaration of Design and Performance should demonstrate that avionics equipment operates safely
and effectively in their given location and throughout all expected operating conditions.
4. Qualification Test Plans and associated Reports (QTR & QTP) should identify the environmental
requirements for the avionics system, subsystems and equipment, and should demonstrate that the
system, subsystem and equipment operates safely and effectively in their given location and throughout
all expected operating conditions.
5. Rig, ground and flight testing should demonstrate that the avionics system, subsystem and equipment
operates safely and effectively in their given location and throughout all expected operating conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2005: 3.2.3, 4.2.3 Def-Stan 00-970 00-970 P1 S6.2
MIL-STD-810 can be used as Reference: 00-970 P1 6.2.40-6.2.61
guidance in selection and 00-970 P7 L725 2.3.1
tailoring of appropriate 00-970 P7 L725 6.1-6.4
requirements for specified STANAG 4671.1309
environments. Reference:
MIL-STD-810 provides
guidance and test methods for
verification.
FAA References: 14 CFR

23.1309, 25.1309, 27.1309 and
29.1309
FAA Doc: AC-23.1309, 25.1309 EASA CS CS 23.1309
CS 27.1309
CS 29.1309
RTCA DO-160
11.2.5 Electrical power quality.

The avionics system shall operate safely throughout the range of expected power supply characteristics
(see also criterion 12.1.4).

a. Power supply characteristics (voltage, frequency, impedance, current, etc.) through normal, back-up
and failure operating conditions.
b. Prioritisation of SOF-critical avionics functions.
1. System Description Documents (SDD) should detail the power-supply of the avionics system, including
any particular power-supply characteristics for the system, subsystems or equipment.
2. Systems Interface Documents (SID) should define the power-supply characteristics for the interface
between the avionics system and its power supply/supplies.
3. Rig, ground and flight testing should demonstrate that the avionics system operates safely throughout
the range of expected power supply characteristics.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2005: 3.2.2.5, 4.2.2.5 Def-Stan 00-970 00-970 P1 6.2.35
Reference: 00-970 P1 6.2.36
00-970 P1 6.2.37
00-970 P7 L725 4.1
STANAG 4671.1309
FAA Doc: AC-23.1351, 25.1351 EASA CS CS 23.1351
CS 27.1351
CS 29.1351
RTCA DO-160
11.3. AVIONICS INSTALLATION.
11.3.1 Avionics installation.

The installation of the avionics system, including its arrangement and crashworthiness, shall support
SOF.

b. Independence of appropriate flight critical services such as separate flight crew stations.

1. System Description Documents (SDD) should detail the installation of avionics systems including the
arrangement and crashworthiness of subsystems and equipment.
2. Structural analysis (static and/or dynamic) should demonstrate the appropriate arrangement and
crashworthiness of the avionics system, including its subsystems and equipment.
3. System Safety Analysis (SSA) should demonstrate that the overall level of safety of the installation of
the avionics system is acceptable, taking into account any particular risks associated with its design and
installation.
Information Sources
RTCA DO-160
DoD/MIL Doc: JSSG-2005: 3.2.3, 4.2.3 Def-Stan 00-970 00-970 P1 6.2.9-6.2.18
Reference: 00-970 P7 L725 2.3.1
STANAG 4671.1309
Reference:
Information Sources
23.1321, 25.1309, 25.1321 Reference: CS 23.1321
CS 25.1309
CS 25.1321
CS 25.1333
CS 27.1309
CS 27.1321
CS 29.1309
CS 29.1321
11.3.2 Operation and maintenance manuals.

flight, including emergency operations.


information.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG -2005: 3.2.2, 4.2.2 Def-Stan 00-970
Reference:
STANAG 4671.1501
25.1501 Reference: CS 25.1501
AC 27-1B, Subpart G, CS 27.1501
Certification of Normal CS 29.1501
Category Rotorcraft
11.3.3 Antenna performance.

Aircraft antennae subsystems shall ensure that aircraft flight-critical functions are retained, that unsafe
information is not displayed to the operator or maintainer, and that availability and continuity of service is
adequate to support SOF.

a. Ensuring adequate gain and coverage for transmission and receiving functions.
b. Normal, emergency and failure conditions.

1. System Description Documents (SDD) should detail the design of antenna subsystems and should
demonstrate provisions for retention of flight critical functions, prevention of display of unsafe information
to operators/maintainers, and maintaining availability and continuity of service to support SOF.
2. Rig, ground and flight testing should demonstrate that antenna subsystems ensure that aircraft flight-
critical functions are retained, that unsafe information is not displayed to the operator or maintainer, and
that availability and continuity of service is adequate to support SOF.
Information Sources
Comm'l Doc:
Reference: 00-970 P7 L707 2.1
STANAG 4671.1309
4671.1615
CS 27.1309
CS 29.1309
SECTION 12 - ELECTRICAL SYSTEM

electrical system. It covers both the electrical power generation system and electrical wiring system,
including power distribution.
(Note: For subsystems that use computer resources, see section 15 for additional specific criteria.)
12.1. ELECTRIC POWER GENERATION SYSTEM.

The electric power generating system includes electrical power sources, main power buses, transmission
cables, and associated control, regulation and protective devices.
For airborne, shipborne or ground applications, the electric power generating system includes electrical
power sources, main power buses, transmission cables, and associated control, regulation and protective
devices.
12.1.1 Power quantity.

Sufficient electrical power shall be available to meet the aircraft systems power requirements during all
modes of operation and potential failure conditions, including operation from emergency back-up systems
(e.g. batteries).

a. Individual electrical load power requirements of systems at normal flight, normal ground, maintenance,
environmental extremes, peak and failure mode conditions.
b. The compound electrical load power requirements of all systems at normal, peak and failure mode
conditions.
c. The balance of electrical loads across distribution systems and power generation systems, including
redundancy for flight critical systems.
d. The need to shed non-essential electrical loads in a safe manner in order to preserve essential
systems electrical supply in the event of failure.
e. Systems future growth and development requirements.
f. System transients due to switching, fault clearing.

1. Electrical Loads Analysis should demonstrate that sufficient power is available. This requires
consideration of all sources, and includes evaluating battery rate(s) of discharge.
Information Sources
Comm'l Doc: For guidance/principles
regarding aspects of assuring
effective and proper electric
power generation system
design, integration and
compatibility:
Information Sources
SAE AS50881
ARINC Report 609
NFPA 70
For electric power quality:
SAE AS1831
DoD/MIL Doc: For guidance/principles Def-Stan 00-970 00-970 P1 6.6.2

regarding aspects of assuring Reference: 00-970 P1 6.6.16
effective and proper electric 00-970 P1 6.6.18
power generation system
design, integration, STANAG
compatibility and electrical Reference:
system capacity
MIL-E-7016
AFGS-87219
MIL-STD-7080
MIL-HDBK-454
ADS-51-HDBK chapter/section
4-8.6
MIL-STD-464
For electric power quality:
MIL-STD-704
MIL-HDBK-704
MIL-STD-1399-300
JSSG-2009:
Appendix C C.3.4.3.5.2,
C.4.4.3.5.2
Appendix H H.3.4.8.2,
H.4.4.8.2
FAA Doc: 14CFR references: EASA CS CS 23.1351
23.1351 Reference: CS 23.1353
25.1351 CS 25.1310
CS 25.1351
CS 27.1351
CS 29.1351
12.1.1.1 Notification of battery discharge.

There shall be a means to notify the crew if an electrical malfunction is causing the continuous discharge
of any safety of flight battery system.

a. Providing voltage and current information.

1. System Description Documents should detail the notifications provided to aircrew for electrical
malfunctions.
2. Rig and ground testing should demonstrate that notifications provided to aircrew for electrical
malfunctions are clear and unambiguous.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P9/13 3
Reference:
STANAG 4671.1809
Reference:
FAA Doc: EASA CS
Reference:
12.1.2 Safe operation of generation system.

The operation of the electric power generation system and its component parts shall be safe.

a. Adequate implementation of cooling and ventilation provisions.
b. Status/failure indications including central warning panels.
c. Mechanical/thermal disconnect (as applicable) of generators, converters, inverters, batteries, etc.
d. Cabin pressure failure.
e. Escape of crew and passengers.
f. Overcharging and electrical load analysis.
g. Routeing of fuel, oil and water.
h. Connection of external ground power.
i. Corrosion, toxic substances and gases from batteries.

1. System Safety Assessment (SSA) should demonstrate, using Functional Hazard Assessment (FHA)
and Failure Modes, Effects and Criticality Analysis (FMECA), that the system is safe.
Information Sources
regarding design and operation Reference: 00-970 P1 6.6.2
of safe electrical generation 00-970 P1 6.6.28
systems:
00-970 P1 6.6.34
AFGS-87219
00-970 P1 6.6.87
MIL-G-21480
00-970 P7 C706 4.2.2
MIL-HDBK-454
00-970 P7 C706 4.6
MIL-STD-464
00-970 P7 C706 7.4.2
ADS-51-HDBK
Chapter/Section 8-7 STANAG 4671.1351 - 1367
JSSG-2009: Appendix H Reference:
H.3.4.8, H.4.4.8, H.3.4.8.4,
H.4.4.8.4
FAA Doc:
FAA Doc: 14CFR references: EASA CS CS 23.1351-23.1367

23.1351-23.1367 Reference: CS 25.1351-25.1363
25.1351-25.1363 CS 27.1351-27.1367
Information Sources
CS 29.1351-29.1363
12.1.3 Safe operation of integrated electrical power system.

Operation of the integrated electrical power system for normal and emergency modes shall be safe.

a. Normal and emergency modes.
b. Use of actual or simulated drives and loads.
c. All flight and control configurations.
d. Transition between modes.
e. Bus switching.
f. Load shedding.
g. Fault condition operation (detection, clearing, and reconfiguration).
h. Assurance that no single fault affects more than one power source.
i. Electrical loads analysis.
j. Application of external power.
k. Circuit protection.

1. System Safety Assessment (SSA) should demonstrate that operation of the integrated system during
normal and emergency modes is safe.
Information Sources
regarding/affecting design and Reference: 00-970 P1 6.6.6
operation of safe integrated 00-970 P1 6.6.15
electrical systems:
AFGS-87219 STANAG 4671.1351 - 1367
MIL-STD-464 Reference:
MIL-E-7016
ADS-51-HDBK
(Chapter/Section 8-7)
JSSG-2009: Appendix H
H.3.4.8, H.4.4.8, H.3.4.8.4,
H.4.4.8.4, H.3.4.8.5, H.4.4.8.5
FAA Doc: 14CFR references: EASA CS CS 23.1351-23.1367
23.1351-23.1367; Reference: CS 25.1351-25.1363
25.1351-25.1363 CS 27.1351-27.1367
CS 29.1351-29.1363
12.1.4 Power quality.

The required power quality shall be maintained for all operating conditions and load combinations.

a. Voltage stability.
b. Frequency stability.
c. Impedance stability.
d. Current stability.
e. Power quality under electrical generation system failure mode conditions.

1. System Interface Documents (SID) should detail the power quality characteristics for each supplied
system.
2. Electrical Loads Analysis should demonstrate that adequate power quality is maintained for all supplied
systems through all operating conditions and load combinations.
3. Rig and ground testing should demonstrate that accuracy of Electrical Loads Analysis and should
demonstrate that adequate power quality is maintained for Safety Of Flight (SOF) critical systems through
critical operating conditions and load combinations.
Information Sources
Comm'l Doc: SAE AS1831 for
guidance/principles
regarding/affecting design and
operation of electrical systems
to provide compatible and
predictable electric power
quality.
DoD/MIL Doc: Comm'l Doc: Def-Stan 00-970 00-970 P1 6.6.1
SAE AS1831 for Reference: 00-970 P1 6.6.6
guidance/principles 00-970 P1 6.6.12
regarding/affecting design and 00-970 P1 6.6.16
operation of electrical systems 00-970 P7 C706 2.7.1-2.7.3
to provide compatible and 00-970 P7 C706 3.2-3.3
predictable electric power STANAG 4671.1351
quality. Reference:
DoD/MIL Doc:
For guidance/principles
regarding/affecting design and
operation of electrical systems
to provide compatible and
predictable electric power
quality:
AFGS-87219
MIL-STD-464
MIL-STD-704
MIL-HDBK-704
MIL-STD-1399-300
ADS-51-HDBK chapter/section
7
H.3.4.8.1, H.4.4.8.1
MIL-HDBK-704 for test
methods and procedures for
verification of power quality
23.1351-23.1367 Reference: CS 23.1353
Information Sources
25.1351-25.1363 CS 23.1357
CS 25.1351
CS 25.1353
CS 25.1355
CS 25.1357
CS 25.1363
CS 27.1351
CS 27.1353
CS 29.1351
CS 29.1353
CS 29.1355
CS 29.1363
12.1.5 Uninterruptible power.

Independent, uninterruptable power sources shall be available to satisfy the requirements of essential
redundancy for flight-critical functions following failure of the primary power system and that there are no
points where a single failure or a reasonable combination of failures could result in total loss of power
anywhere in the power system (including circuit boards).

a. All Safety Of Flight (SOF) critical functions, including those on-aircraft and within Ground Control
Stations (GCS).

1. System Safety Assessment (SSA) should demonstrate that adequate independence/redundancy is
provided such that electric power is reliably delivered to essential systems and equipment under both
normal and adverse operating conditions.
Information Sources
Nil Reference: 00-970 P1 6.6.6
DoD/MIL Doc: 00-970 P7 C706 2.4
For guidance/principles 00-970 P7 C706 2.7.1-2.7.3
regarding/affecting design and STANAG 4671.1351
operation of electrical systems Reference: 4671.1353
for uninterruptible electric
power:
AFGS-87219
MIL-E-7016
NAVSEA TM-S9310-AQ-SAF-
010
H.3.4.8, H.4.4.8
FAA Doc: 14CFR references: EASA CS CS 23.1351 (b)(3)
23.1351-23.1367; Reference: CS 25.1351 (d)
25.1351-25.1363 CS 25.1355
Information Sources
CS 25.1363
CS 29 1351
12.1.6 Battery charging.

Where batteries are employed to provide backup power for Safety Of Flight (SOF) functions, the
installation shall be safe and the method for charging and checking shall be adequate.

a. Ensuring that no explosive or toxic gases emitted by any battery in normal operation, or as the result of
any probable malfunction in the battery subsystem, accumulate in hazardous quantities within the aircraft.
b. Ensuring that safe battery cell temperatures and pressures are maintained during any probable
charging and discharging conditions.
c. Ensuring battery charging systems are designed to automatically control the charging rate of the
battery in order to prevent overheating.
d. Ensuring that, where lithium batteries are installed, adequate charging methods and checks are
provided.

1. System Description Documents (SDD) should detail the incorporation of batteries in the design of the
aircraft electrical power system, including details regarding charging methods and ongoing monitoring of
all parameters that could affect Safety Of Flight (SOF) (e.g. temperature).
2. Rig, ground and flight testing should demonstrate that battery cell temperatures and pressures remain
within safe limits through all expected operating conditions.
3. System Safety Assessment (SSA) should demonstrate, using Functional Hazard Assessment (FHA)
and Failure Modes, Effects and Criticality Analysis (FMECA), that battery sub-systems are safe.
Information Sources
RTCA DO-277
RTCA DO-311
RTCA DO-347
DoD/MIL Doc: Comm'l Doc: Def-Stan 00-970 00-970 P1 6.6.82-6.6.88
Nil Reference: 00-970 P7 C706 7
DoD/MIL Doc: STANAG 4671.1353
For guidance/principles Reference:
regarding/affecting the
integrated design and
operation of battery
subsystems within aircraft
electrical systems:
AFGS-87219
NAVSEA TM-S9310-AQ-SAF-
010
H.6.4.2
23.1351-23.1367; Reference: CS 25.1353(c)
Information Sources
25.1351-25.1363 CS 25.1165
CS 27.1353
CS 29.1353
12.1.6.1 Merged with 12.1.6
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
FAA Doc: 14CFR references: EASA CS
23.1351-23.1367; Reference:
25.1351-25.1363



information.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Comm'l Doc: Def-Stan 00-970 00-970 P1 7.5(all)
Nil Reference:
DoD/MIL Doc: STANAG 4671.1583
Information Sources
affecting/providing awareness
of limitations of aircraft
electrical systems:
MIL-E-7016
23.1301, 23.1309; Reference: CS 25.1583
25.1301, 25.1309
12.1.8 Merged with Line 12.1.7.

12.1.9 Start and reversion to safe state.
The system shall power up in a safe state and in circumstances involving a loss of power, power
transients or fluctuations, the system shall remain or revert to a known safe state.

a. Continuous built-in-test (BIT), fault detection, indication, isolation capability, and fault alarm rates.

1. System Safety Assessment (SSA) should verify that the system will operate properly.
Information Sources
Comm'l Doc:
regarding design with Reference:
knowledge of the states of STANAG
aircraft electrical systems: 4671.1351
AFGS-87219 Reference:
MIL-STD-464
3.4.8.4, 3.4.8.5
23.1351-23.1367; Reference: CS 23.1353
25.1351-25.1363, 25.1309, CS 23.1357
25.1529 CS 25.1351
CS 25.1353
CS 25.1355
CS 25.1357
CS 27.1351
CS 27.1353
CS 27.1357
CS 27.1361
CS 29.1351
CS 29.1355
CS 29.1357
12.2. ELECTRICAL WIRING SYSTEM, INCLUDING POWER DISTRIBUTION.

This element involves all wiring and wiring components (connectors, circuit breakers, etc.) throughout the
aircraft and for UAV, the control station safety of flight-related wiring system. Databuses are excluded
from the scope of this section and covered in Section 11.
12.2.1 Selection of components.

Appropriate electrical system wiring and components shall be suitable for the physical environment in
each area on the aircraft where they are used. Electrical wiring system installation shall be safe regarding
shock hazard protection for personnel.

a. Electrical wiring, including conductor material, coating and insulation system.
b. Electrical system components.
c. Electrical system support devices.
d. Electrical system design.
e. Operating environment:
i. Moisture;
ii. Heat;
iii. Vibration, mechanical abrasion/damage, flexing;
iv. Contamination from oils, fuels, chemicals etc.

1. System Description Documents (SDD) should detail the types of wiring used, and the general routing of
wiring/looms through the aircraft.
2. Declarations of Design and Performance (DDP) should demonstrate that the electrical system wiring
and components are suitable for the physical environment in each area on the aircraft where they are
used.
3. System Safety Assessment (SSA) should demonstrate that wiring and components are safe, taking
into account shock hazards.
Information Sources
Comm'l Doc: For guidance/principles
regarding design of aircraft
electrical wiring systems:
ARINC Report 609
SAE AS50881
SAE ARP1870
SAE ARP4761
NFPA 70
regarding design of aircraft Reference: 00-970 P1 6.6.56
electrical wiring systems and 00-970 P1 6.6.57
the design and selection of
00-970 P1 6.6.59
aircraft electrical system
components: 00-970 P1 6.6.92
AFGS-87219 00-970 P7 C706 2.5
MIL-HDBK-419 00-970 P7 C706 6.1.5-6.1.6
Information Sources
MIL-STD-1310 00-970 P7 C706 6.2.1
MIL-STD-1683 STANAG 4671.1365
MIL-STD-7080 Reference: 4671.1367
MIL-HDBK-299
MIL-HDBK-454
MIL-STD-464
regarding :
H.6.4.1
FAA Doc: 14CFR references: EASA CS CS 23.1365*#
23.1365; Reference: CS 25.1360
25.1353 CS 25.1365
CS 25.1707
CS 25 Subpart H
12.2.2 Ampacity.
Wiring shall be sized properly for the required current handling capability and voltage drop.

a. Cable material properties for both conductor and insulation.
b. Wire diameter.
c. Cable length.
d. Connector type and properties.
e. Cable bundling and separation.

1. Electrical Loads Analysis should demonstrate that wire sizing is sufficient for its associated voltage and
current.
2. Rig testing should demonstrate the accuracy of the performed analysis and should demonstrate that
safe limits are provided for current capacity and voltage drop.
Information Sources
Comm'l Doc:
For guidance/principles Reference: 00-970 P7 C706 6.1.5
regarding proper STANAG 4671.1365(a)
selection/sizing of aircraft Reference:
electrical system wiring
components:
SAE AS50881
NFPA 70
DoD/MIL Doc:
H.6.4.1 for guidance/principles
regarding proper
selection/sizing of aircraft
Information Sources
electrical system wiring
components
FAA Doc: 14CFR references: EASA CS CS 23.1365(a)
23.1365; Reference: CS 25.1703
25.1353 CS 25.1707
CS 25.1711
CS 27.1365(a)
CS 29.1353
12.2.3 Circuit protection.

Proper circuit protection shall be provided for wiring associated with power distribution throughout its
entire run.

a. Circuits contained in or exiting from any electronic enclosures performing intermediate power switching
or distribution functions.

1. System Description Documents (SDD) should include details of circuit protection for aircraft power
distribution systems.
2. Electrical Loads Analysis should demonstrate that the provided circuit protection devices provides
adequate protection against unsafe electrical loads, whilst providing an appropriate margin above normal
operating loads to ensure that such devices are not activated erroneously.
Information Sources
Comm'l Doc:
For guidance/principles Reference: 00-970 P1 6.6.41
regarding design and selection 00-970 P1 6.6.50
of aircraft wiring protection: STANAG 4671.1357
SAE AS50881 Reference:
NFPA 70
DoD/MIL Doc:
regarding design and selection
of aircraft wiring protection:
MIL-HDBK-454
MIL-STD-7080
H.3.4.8.5, H.4.4.8.5
23.1357 Reference: CS 25.1357
25.1357 CS 27.1357
CS 29.1357
12.2.4 Circuit isolation.

Ensure that redundant circuits provided for safety are sufficiently isolated.

a. Potential for differing specifications for aircraft and ground mobile applications.

1. System Safety Assessment (SSA), including Functional Hazard Assessment (FHA) and Failure Modes,
Effects, and Criticality Analysis (FMECA) should demonstrate that there is sufficient isolation of redundant
circuits.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Comm'l Doc: Def-Stan 00-970
regarding provision of isolation STANAG 4671.1309
for aircraft electrical circuits: Reference: 4671.1351
SAE AS50881
SAE ARP4761
NFPA 70
DoD/MIL Doc:
H.6.4.1* for guidance/principles
regarding provision of isolation
for aircraft electrical circuits
FAA Doc: 14CFR references: 23.1301*, EASA CS CS 23.1309
23.1309*; 25.1301*, 25.1309* Reference: CS 25.1309
CS 27.1309
CS 29.1309
12.2.5 Avoidance of single point failures.

The electrical system design shall preclude single-point failures related to wiring.

a. Integrating redundant functions within an electronics enclosure.

1. System Safety Assessment (SSA) should confirm the absence of single point failures.
Information Sources
Comm'l Doc:
For guidance/principles relating Reference: 00-970 P7 C706 2.4
to design of equipment to STANAG 4671.1351
minimize single point failures in Reference:
redundant circuits:
SAE AS50881
SAE ARP4761
NFPA 70
DoD/MIL Doc:
Information Sources
For guidance/principles relating
to design of equipment to
minimize single point failures in
redundant circuits:
MIL-HDBK-454, Guideline 69
H.6.4.1, 6.1
FAA Doc: 14CFR references: 23.1301*, EASA CS CS 23.1351
23.1309*, 23.1351-23.1367*; Reference: CS 25.1351
25.1301*, 25.1309*, 25.1351- CS 27.1351
25.1363*, 25.1529*
CS 29.1351
SFAR No. 88--Fuel Tank
System Fault Tolerance
Evaluation Requirements
12.2.6 Sufficiency of design.

The design of the wiring system installation, including connectors, shall be adequate for all expected

a. Normal and emergency modes.
b. All modes of operation.
c. Operating conditions.
d. Load combinations.
e. Failure conditions.
f. Installation environment.

1. Electrical Loads Analysis should demonstrate that the wiring system installation (including connector) is
suitable for supplied electrical loads under all expected operating conditions.
Effects, and Criticality Analysis (FMECA) should demonstrate that the installation of the wiring system is
safe, taking into account expected operating conditions, load combinations, and failures within the
electrical distribution system.
Information Sources
Comm'l Doc:
regarding good engineering 00-970 P1 6.6.52-6.6.58
design of wiring system 00-970 P7 C706 2.2
installations: 00-970 P7 C706 5.1.1
SAE AS50881 STANAG 3659
NFPA 70 Reference: 4671.1351
DoD/MIL Doc:
regarding good engineering
Information Sources
design of wiring system
installations:
JSSG-2009: 3.3, 3.3.4;
Appendix E E.4.4.5.1.3,
E.3.4.5.1.11, E.4.4.5.1.11,
E.3.4.5.8.7, E.4.4.5.8.7,
E.3.4.5.8.12, E.4.4.5.8.12;
Appendix G G.3.4.7.2,
G.3.4.7.6, G.4.4.7.6;
Appendix H H.6.4.1, 6.1
23.1301, 23.1309, 23.1351- Reference: CS 25.1351
23.1367; CS 25.1703
25.1301, 25.1309, 25.1351- CS 27.1351
25.1363, 25.1529 CS 29.1351
AC 43.13-1B CHG 1 -
Acceptable Methods,
Techniques and Procedures -
Aircraft Inspection and Repair
12.2.6.1 Prevention of ignition.

Wiring in areas containing explosive vapours shall be protected to prevent potential ignition sources.

a. Electrical systems in close proximity to fuel systems;
b. Issues resulting from installation, operational environment, ageing and deterioration of the wiring.

1. System Description Documents (SDD) should the protection provided for all wiring routed in areas
containing explosive vapours.
2. Functional Hazard Assessment (FHA) should demonstrate that hazards associated with the routing of
electrical wiring are acceptable.
Information Sources
Comm'l Doc:
regarding wiring design 00-970 P1 6.2.59
principles/practice for 00-970 P1 6.6.3
prevention of ignition sources: 00-970 P7 C712 3.7.1
SAE AS50881 STANAG 4671.863(b)
NFPA 70 Reference: 4671.1359
DoD/MIL Doc:
Information Sources
regarding wiring design
principles/practice for
prevention of ignition sources:
JSSG-2009: 3.3, 3.3.4;
Appendix E E.4.4.5.1.3*,
E.3.4.5.1.11, E.4.4.5.1.11,
E.3.4.5.8.7*, E.4.4.5.8.7*,
E.3.4.5.8.12, E4.4.5.8.12;
Appendix G G.3.4.7.2,
G.3.4.7.6, G.4.4.7.6;
Appendix H H.6.1
23.1367; 25.1351-25.1363, Reference: CS 25.863
25.1309, 25.1529 CS 25.1703
CS 25.1705
CS 25.1707
CS 25.1713
CS 25.1723
CS 27.863
CS 29.863
12.2.6.2 Faults in safety critical wiring.

Failure within a wiring harness that includes safety-critical wiring shall not cause loss of, or unacceptable
degradation to, any safety-critical functions.

a. Open circuit faults.
b. Shorted/crossed-circuit faults.

1. System Safety Assessment (SSA) and Failure Modes, Effects and Criticality Analysis (FMECA) should
demonstrate that failure within any Safety Of Flight (SOF) critical wiring harness does not cause loss or
unacceptable degradation of any SOF-critical functions
Information Sources
Comm'l Doc:
For guidance/principles leading Reference: 00-970 P1 6.6.3
toward good design practice 00-970 P7 LC706 2.4
and minimization of loss of STANAG 4671.1351
safety-critical functions: Reference:
SAE AS50881
NFPA 70
DoD/MIL Doc:
JSSG-2009: Appendix H H.6.1
Information Sources
for guidance/principles leading
toward good design practice
and minimization of loss of
safety-critical functions.
23.1367; 25.1351-25.1363, Reference: CS 25.1309
25.1309, 25.1529 CS 27.1309
CS 29.1309
12.2.6.3 Wiring separation.

The wiring design and installation procedures shall maintain positive separation of wiring from all fluid or
gas carrying lines, and from mechanical and electrical flight controls.

a. Dynamic G loading.
b. Mechanical system movement.
c. Cable flexing.
d. Thermal effects.
e. Vibration.

1. System Description Documents (SDD) should detail the provisions for separation of electrical
distribution system wiring from fluid or gas carrying lines, and from mechanical and electrical flight
controls.
Information Sources
Comm'l Doc:
regarding the fundamentals of
sound design for effective STANAG 4671.1351
separation of wiring from other Reference: 4671.1365
subsystem components:
SAE AS50881
NFPA 70
DoD/MIL Doc:
JSSG-2009: 3.3.8;
Appendix B B.3.4.2.1.17;
Appendix H H.6.4.1;
Appendix M M.6.4.1 for
guidance/principles regarding
the fundamentals of sound
design for effective separation
of wiring from other subsystem
components
Information Sources
Reference: CS 23.1365(d)
CS 25.1707
CS 27.1351
CS 29.1351
CS 29.1353
12.2.6.4 Chafing.
The routeing design and installation procedures shall be such that the installation of wiring is free from
mechanical damage or chafing conditions.

a. Mechanical system movement.
b. Vibration.
c. Cable flexing.
d. Cable clipping/bundling.

1. System Description Documents (SDD) should detail provisions for prevention of chafing of electrical
distribution system wiring.
Information Sources
Comm'l Doc:
For guidance/principles Reference: 00-970 P1 S6 L14 4.1.3
regarding the prevention of 00-970 P7 C706 6.5.1
wire/cable/harness chafing: STANAG 4671.1351
NFPA 70
DoD/MIL Doc:
JSSG-2009: 3.3.8;
Appendix A A.3.4.1.5.8.1;
Appendix H H.6.4.1;
Appendix L L.3.4.12;
Appendix M M.6.4.1 for
the prevention of
wire/cable/harness chafing
CS 25.1717
CS 27.1351
12.2.6.5 Wiring support.

Wiring design shall provide primary and secondary support for the wiring throughout the installation.

a. Possible differences between specifications for aircraft and ground control systems applications.

1. System Description Documents (SDD) should detail provisions for wiring support.
2. Structural analysis should demonstrate that wiring supports can be subjected to the maximum loads
that would be expected in service without excessive or permanent deformation, taking into account
maximum wiring runs between supports, aircraft deflections under ground and flight loads, etc.
Information Sources
Comm'l Doc:
regarding the provision of 00-970 P7 C706 6.1.4
proper support for wiring: 00-970 P7 C706 6.5.1
SAE AS50881 STANAG 4671.1365
NFPA 70 Reference:
DoD/MIL Doc: For
the provision of proper support
for wiring:
JSSG-2001: 4.3.10.1.1
JSSG-2009: 3.2.6, 3.2.9.2;
Appendix H H.6.4.1, H.6.4.2
FAA Doc: EASA CS CS 23.1365(d)
Reference:
12.2.6.6 Avoidance of damage.

Wiring design shall provide routing and installation to minimize the risk of damage to wiring by cargo,
crew and maintenance personnel.


1. System Description Documents (SDD) should detail provisions for the protection of wiring against
damage by cargo, crew and maintenance personnel.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.1.5 Def-Stan 00-970 00-970 P7 C706 2.5
JSSG-2009: Appendix H.6.4.1 Reference:
Wiring. STANAG 1365 USAR.1367
Reference:
CS 27.685
Information Sources
CS 29.685
12.2.6.8 Bonding and grounding.

All equipment and equipment racks shall be designed for proper electrical bonding and grounding.

a. Appropriate limits for electrical resistance between local ground points and main ground points.
b. Clear ground markings.

1. System Description Documents (SDD) should detail of provisions for electrical bonding and grounding.
2. Electrical Loads Analysis should demonstrate that the resistance of bonding and grounding points and
any leads/straps is suitable for the electrical loads expected in service, taking into account reasonably
expected failures.
Information Sources
Comm'l Doc: For guidance/principles leading
toward maintainable design(s):
SAE AS50881
NFPA 70
SAE ARP1870 for Reference: 00-970 P1 4.27.9
guidance/principles regarding 00-970 P1 6.2.25
the provision of proper 00-970 P7 S7 L706/1 3.1
electrical bonding STANAG 4671.867
DoD/MIL Doc: Reference:
regarding the provision of
proper electrical bonding:
MIL-HDBK-419
MIL-HDBK-454
MIL-STD-464 sections A5.10
and A5.11
MIL-STD-1310
JSSG-2001: 3.2.1, 4.2.1,
3.3.10.1.1, 4.3.10.1.1
JSSG-2009: 3.3, 3.3.4;
Appendix E: E.4.4.5.1.3,
E.3.4.5.1.11, E.4.4.5.1.11,
E.3.4.5.8.7, E.4.4.5.8.7,
E.3.4.5.8.12, E.4.4.5.8.12;
Appendix G: G.3.4.7.2,
G.3.4.7.6, G.4.4.7.6
CS 25.899
CS 25.973
Information Sources
CS 25.1353
CS 25.1715
CS 27.610
CS 29.610
12.2.6.9 Care in modification.

The addition of a modification into existing wiring installations shall not create cracking or conditions for
chafing or other degradation of existing wiring insulation.


1. System Description Documents (SDD) should detail provisions for the prevention of chafing or other
wiring/harness degradations.
Effects and Criticality Analysis (FMECA) should demonstrate that modifications made to, and in the
vicinity of wiring installations do not cause cracking, chafing or other unsafe degradation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Comm'l Doc: Def-Stan 00-970
regarding the prevention of STANAG 4671.1351
wire/cable/harness chafing: Reference:
SAE AS50881
NFPA 70
DoD/MIL Doc:
JSSG-2009: 3.3.8;
Appendix H H.6.4.1;
Appendix M M.6.4.1
Def-Stan 00-970:
00-970 6.6.64
00-970 S6 L14 4.1.3
P7 C706 6.5.1
CS 25.1703
CS 25.1707
CS 27.1351
12.2.6.7 Maintainability.
Maintainability shall be a factor in the design and installation procedures for wiring and components.

a. Ensuring accessibility for inspection is considered in the design.
b. Ensuring all wiring and components are properly identified.

c. Ensuring identification means does not adversely affect the performance or life of the wiring or
components.

1. System Description Documents (SDD) should detail provisions for improving the maintainability of
electrical wiring and components, including but not limited to accessibility and wiring/component
identification.
Information Sources
Comm'l Doc: SAE ARP1870 for
the provision of proper
electrical bonding
DoD/MIL Doc: Comm'l Doc: Def-Stan 00-970 00-970 P7 C706 2.5
For guidance/principles leading Reference:
toward maintainable design(s): STANAG
NFPA 70
DoD/MIL Doc:
For guidance/principles leading
toward maintainable design(s):
JSSG-2001: 3.1.5, 4.1.5,
3.3.10.2.2, 4.1.8.2.5.1,
4.1.8.2.5.2, 4.4.8
JSSG-2009: Appendix H 6.4.1
FAA Doc: EASA CS
Reference:
SECTION 13 - ELECTROMAGNETIC ENVIRONMENTAL

EFFECTS (E3)
This Section covers electro-magnetic compatibility of the platform with its cleared environment and
weapon loads; it considers potential effects from internal and external sources. Consideration is also
given to potentially harmful electro-magnetic effects on personnel, ordnance, and fuel and the associated
required safety margins.
This Section also covers the national and international requirements for meeting the electro-magnetic
spectrum licensing requirements.
13.1. COMPONENT/SUBSYSTEM E3 QUALIFICATION.
13.1.1 Flight/safety critical equipment requirements.

All flight-critical and safety-critical equipment shall comply with all electromagnetic environmental effects
requirements.
a. All electromagnetic environmental effects requirements, including lightning susceptibility, as
appropriate for the particular equipment; this includes conducted and radiated emissions and
susceptibility requirements.
b. Introduction of appropriate mitigations for those equipment that are not shown to be
compliant.Considerations for preparation of AMC:
1. Safety Analysis to identify all parts of aircraft systems which are flight critical and/or safety critical.
2. System Description Documents (SDD) should specify the parts of aircraft systems which are flight
critical and/or safety critical.
3. Demonstrating that all equipment have been included in the EMC/EMI test plan.
4. Demonstrating that all equipment, flight and/or safety critical aircraft systems have been appropiately
tested up to aircraft level.
Information Sources
Comm'l Doc: RTCA DO-160 sections 18
through 22
SAE ARP5412, section 4
DoD/MIL Doc: RTCA DO-160 sections 18 Def-Stan 00-970 00-970 P1 3.10.11
through 22 Reference: 00-970 P1 3.10.13
SAE ARP5412B, section 4 00-970 P1 4.27.1-4.27.40
SAE ARP 5414A, 5416A 00-970 P1 6.1.41
MIL-STD-461, section 5 00-970 P1 6.6.54
MIL-STD-464, section 5.4 00-970 P1 6.6.66
00-970 P1 6.10
STANAG 4671.685(e)
Reference: 4671.867
Information Sources
4671.1309
4671.1431
4671.1605
4671.1717
CS 23.1308
CS 23.1309
CS 23.1431
CS 25.581
CS 25.899
CS 25.1316
CS 25.1317
CS 25.1707
CS 23.1431
CS 27.610
CS 27.1317
CS 29.610
CS 29.1309
CS 29.1317
CS 29.1431
13.1.2
All non-flight-critical equipments shall be identified and shown to not adversely affect the safe operation of
flight critical equipment; and comply with all (conducted, radiated' and 'transient') electromagnetic
environmental effects requirements that are appropriate for the particular equipment, including lightning
susceptibility; this includes both radiated and susceptibility requirements.
Information Sources
Comm'l Doc: RTCA DO-160 sections 18
through 22
DoD/MIL Doc: RTCA DO-160 sections 18 Def-Stan 00-970 00-970 P1 3.10.11
through 22 Reference: 00-970 P1 3.10.13
SAE ARP 5412, section 4 00-970 P1 4.27.1-4.27.40
MIL-STD-461, section 5 00-970 P1 6.1.4
MIL-STD-464, section 5.47 00-970 P1 6.1.41
00-970 P1 6.6.54
00-970 P1 6.6.66
STANAG 4671.685(e)
Reference: 4671.867
4671.1309
4671.1431
4671.1481
4671.1605
4671.1717
Information Sources
CS 23.1309
CS 23.1431
CS 25.581
CS 25.899
CS 25.1316
CS 25.1431
CS 25.1707
CS 27.610
CS 27.865
CS 29.610
CS 29.865
CS 29.1309
CS 29.1431
13.1.3. Merged with 13.1.2
13.2. SYSTEM-LEVEL E3 QUALIFICATION.
13.2.1 Mutual electromagnetic compatibility of equipment and subsystems.

All systems and sub-systems shall be mutually electro-magnetically compatible.

a. Flight-critical and safety-critical systems.
b. Non flight-critical and non safety-critical systems.

1. System Description Documents (SDD) should be provided for all systems.
2. Demonstrating that all systems and sub systems have been included in the EMC/EMI test plan.
3. The EMC/EMI test plan should take cognisance of all systems at a platform level.
4. The EMC/EMI test plan should account for all likely combinations of concurrent system operation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-464, section 5.2 Def-Stan 00-970 00-970 P1 3.10.13
Reference: 00-970 P1 4.27.1-4.27.22
00-970 P1 6.1.4
00-970 P1 6.1.41
00-970 P1 6.6.66
00-970 P1 6.10
STANAG 4671.685
4671.1431
4671.1605
4671.1717
Information Sources
CS 23.1431
CS 25.899
CS 25.1431
CS 25.1707
CS 29.1309
CS 29.1431
13.2.2 Mutual compatibility of antenna-connected and other equipment.

All antenna-connected equipment shall be identified and shown to be compatible with each other and not
degraded beyond their operational bounds by other on or off-board equipment to a level that would affect
safety. To achieve this, the antenna-connected equipment operational bounds shall be defined, and any
margins between the operational bounds and the levels where safety may become affected shall be
identified.

a. All antenna-connected systems ; includingbut not limited to: radios; radars including rad-alt, TFR, ECM
and ECCM systems, and their various modes; GPS systems; navigation systems; surveillance systems.
b. Off-board equipment considered to have the potential to interact with on-board equipment ; including
but not limited to: ATC systems; other aircraft transmitters; terrestrial radio and TV transmitters; military
systems, and all equipment able to generate intended or spurious RF transmissions.

1. System Description Documents (SDD) should identify all antenna-connected systems.
2. The EMC/EMI test plan should take cognisance of all antenna-connected systems.
3. The EMC/EMI test plan should take cognisance of all off-board equipment considered to have the
potential to interact with on-board equipment.
5. The EMC/EMI test plan should account for all likely combinations of on and off-board equipment in
concurrent system operation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-464, Section 5.2 Def-Stan 00-970 00-970 P1 6.1.4
Reference: 00-970 P1 6.1.19
00-970 P1 6.1.41
00-970 P1 6.1.42
00-970 P1 6.10
STANAG 4671.1309
4671.1605
4671.1717
CS 25.1431
CS 25.1707
CS 29.1309
Information Sources
CS 29.1431
13.2.3 Compatibility of aircraft with electromagnetic environment.

The intended external RF electro-magnetic environment for the aircraft shall be defined, and the aircraft
shall be shown to be compatible with this environment.

a. Ground, sea and air based emitters;

1. The EMC/EMI test plan should define how compliance will be demonstrated and what the acceptance
criteria are.
2. Testing, or demonstration of compliance, should be at aircraft level.
Information Sources
Comm'l Doc: SAE ARP5583, sections 5 and
7
DoD/MIL Doc: MIL-STD-464, section 5.3 Def-Stan 00-970 00-970 P1 3.10.11

00-970 P1 6.1.19
00-970 P1 6.10
STANAG 4671.685
Reference: 4671.867
4671.1309
4671.1431
4671.1605
4671.1717
CS 23.1309
CS 23.1431
CS 25.581
CS 25.899
CS 25.1431
CS 27.610
CS 27.865
CS 29.610
CS 29.865
CS 29.1309
CS 29.1431
13.2.4 Lightning effects.

All requirements for meeting lightning protection, both the direct (physical) and indirect (electro-magnetic)
effects, shall be identified, agreed and verified by testing. Potential for ignition of fuel vapours shall be
eliminated.

a. Fuel system components including, but not limited to: refuel/defuel/engine supply components; pumps;
storage and collector tanks; fuel vent system and components; fuel coolers; adjacent EWIS components;
b. Structural protective measures/Bonding;
c. Fuel tank inerting.

1. The EMC/EMI test plan should define how compliance will be demonstrated and what the acceptance
criteria are.
2. Testing, or demonstration of compliance, shall be at aircraft level.
Information Sources
Comm'l Doc: SAE ARP5412, section 4
DoD/MIL Doc: SAE ARP5412B, section 4 Def-Stan 00-970 00-970 P1 3.10.11
SAE ARP 5414A, 5416A Reference: 00-970 P1 4.27 all
MIL-STD-464, section 5.45 00-970 P1 6.10
00-970 P7 L707 5.1.3
00-970 P7 L708
STANAG 4671.863
Reference: 4671.867
4671.954
4671.1309
4671.1605
4671.1717
CS 23.1309
CS 25.581
CS 25.899
CS 25.954
CS 25.1316
CS 25.1707
CS 27.610
CS 27.865
CS 29.610
CS 29.865
CS 29.954
CS 29.1309
13.2.5 EMP protection.

If protection from the effects of an electro-magnetic pulse is required, the appropriate level of protection
and associated acceptance criteria shall be established.

a. Which, if any, systems should be afforded protection from EMP effects.
b. Any nuclear hardening of components that might be required - chips or larger assemblies for example.
c. Whether any extra protection against EMI, over and above the base level, is required.
d. Any requirement for redundant systems for use after experiencing EMP.
1. Analysis of flight critical and/or safety critical equipment EMP susceptibility.
2. Demonstrating that any EMP requirements have been included in the EMC/EMI test plan.
3. Demonstrating that all equipment, flight and/or safety critical aircraft systems have been appropiately
tested up to aircraft level.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-464,section 5.6 Def-Stan 00-970 00-970 P1 4.27
MIL-STD-2169 Reference: 00-970 P1 6.2.60
00-970 P1 6.5.23
00-970 P1 6.10
00-970 P13 3.2.14
00-970 P13 3.11.6- 3.11.11
STANAG 4671.1431
Reference:
FAA Doc: EASA CS
Reference:
13.2.6 Electrostatic charge.

The aircraft design shall be able to control and dissipate the build-up of electrostatic charges caused by
particle impingement, fluid flow, air flow, and other triboelectric charge-generating mechanisms.

a. Ordnance hazards;
b. Personnel shock hazards;
c. Control p-static interference or damage to electronics;
d. The static discharge spark.

1. Analysis of flight critical and/or safety critical equipment/systems susceptibility to electrostatic charge.
2. Demonstrating that any electrostatic charge requirements have been included in the EMC/EMI test
plan.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-464, section 5.8 Def-Stan 00-970 00-970 P1 4.27
Reference: 00-970 P1 6.1.32
00-970 P7 L708
STANAG 4671.867
CS 25.899
CS 25.1715
Information Sources
CS 27.610
CS 29.610
13.2.7 Hazards of electromagnetic radiation.
Sources of electromagnetic radiation shall pose no Hazard of Electromagnetic Radiation to Personnel

(HERP), Hazard of Electromagnetic Radiation to Fuel (HERF), and Hazard of Electromagnetic Radiation
to Ordnance (HERO), and the appropriate manuals shall include safety criteria regarding distance from
on-board and off-board transmitters to personnel and fuel sources.

a. The radiation pattern of on-board emitters.
b. The minimum distance by which the air vehicle must stay away from external transmitters, both on the
ground and in the air.
c. Other sources of high intensity radio frequency radiation.

1. Analysis of radiation pattern of on-board emitters.
2. Demonstrating by test that any electromagnetic safe distances are valid.
Information Sources
7
DoD/MIL Doc: SAE ARP5583, sections 5 and Def-Stan 00-970
7 Reference:
MIL-STD-464, section 5.9 STANAG 4671.1581
DoDI 6055.11, Protection of Reference:
DoD Personnel from Exposure
to Radiofrequency Radiation
and Military Exempt Lasers
TO 31Z-10-4, Electromagnetic
Radiation Hazard
NAVSEA OP 3565,
Electromagnetic Radiation
Hazard
TB MED 523, Control of
Hazards to Health from
Microwave and Radio
Frequency Radiation and
Ultrasound
FAA Doc: EASA CS
Reference:
13.2.8 Electrical bonding.

The electrical bonding shall be adequate to ensure safe air vehicle operation.
a. Minimum impedance.
b. Maximum fault current.
c. Current return path.
d. Shock hazard.
e. RF potential.

1. Analysis of current return path.
2. Demonstration by test of bonding performance.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-464, section 5.11 Def-Stan 00-970 00-970 P1 4.27
Reference: 00-970 P7 L708
STANAG 3659
4671.1431
4671.1605
4671.1717
4671.867

CS 23.1431
CS 25.581
CS 25.899
CS 25.1316
CS 25.1707
CS 27.610
CS 27.865
CS 27.1309
CS 29.610
CS 29.865
CS 29.1309
Nil. This line has been deleted.
Information Sources
7
DoD/MIL Doc: MIL-STD-464, sections 5.3 and Def-Stan 00-970 00-970 P13 3.2.14
5.4 Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
13.2.9 Electromagnetic spectrum licensing and certification.

The system shall meet the electromagnetic spectrum licensing requirements in accordance with national
and international regulations, and have received electromagnetic spectrum certification.

1. Analysis of radiation of on-board emitters.
2. Demonstration by test of bonding performance.
Information Sources
Comm'l Doc:
DoD/MIL Doc: DoDD 4650.1, Management Def-Stan 00-970 Joint Service Publication (JSP_
and Use of the Radio Reference: 602 Lflt 1038
Frequency Spectrum DD Form
1494, Application for STANAG
Frequency Allocation
Joint Service Publication (JSP) Reference:
602 Lflt 1038
National procedures
FAA Doc: EASA CS
Reference:
SECTION 14 - SYSTEM SAFETY

This section details the criteria to establish, verify, and implement a comprehensive and robust system
safety programme.
14.1. SYSTEM SAFETY PROGRAM.

This section covers the implementation of a comprehensive and robust system safety programme, which
spans the system lifecycle. The aim of the system safety programme is to identify any associated system
hazards / risks, and to eliminate them where possible, or mitigate the risks such that the residual risks are
at acceptable levels.
• Included within the scope of this section are:

• Integration of the safety programme with systems engineering processes;
• The implementation of a hazard tracking system;
• The comprehensiveness of safety analysis and processes.
examples are by no means to be considered as exhaustive. However, all criteria should at least consider
the use of the latest safety standards, guidance and techniques.
14.1.1 System safety process.

An effective system safety programme shall be implemented to manage all hardware, software, and
human system integration risks, iaw specified standards, in order to achieve acceptable mishap risk,
within the constraints of operational effectiveness and suitability, time, and cost.

a. Use of the latest safety standards and guidance.

1. System Safety Assessment (SSA) should demonstrate that a system safety approach has been
documented through inspection of technical and programmatic documents.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 1.1, 4.1, 4.2, Def-Stan 00-970 00-970 P7 L732 3.3.1
4.3, 4.4, 4.5 Reference: 00-56
DoDI 5000.2 Enclosure 3 STANAG 4671.1309
Table E3.T1, for details of Reference:
PESHE content and relation to
system safety
14CFR references: system
Information Sources
safety sections of Parts 23, 25,
27, 29
AC 23.1309-1E
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS CS 25 AMC 25.19 7
safety sections of Parts 23, 25, Reference: CS 25 AMC 25.901 5
27, 29 CS 25 AMC 25.1309
CS 23.1309
CS.25.1309
CS 27.1309
CS 29.1309
14.1.1.1 System safety requirements.

The system safety programme shall be integrated effectively into all aspects of the systems engineering
lifecycle, throughout all acquisition phases, in order to ensure its beneficial influence on requirements,
design and ultimately the safety of the system.

a. Ensuring the system safety programme is not considered in isolation.
b. Ensuring system safety requirements, analyses, time lines and other milestones are in synchronisation
with the rest of the program.

1. System Safety Assessment (SSA) should demonstrate that a system safety approach has been
documented through technical and programmatic documents.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 4.1 Def-Stan 00-970 00-56
14CFR references: system Reference:
safety sections of Parts 23, 25, STANAG 4671.AMC1309 (b)
27, 29 Reference:
AC 23.1309-1E
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS CS 25 AMC 25.1309
safety sections of Parts 23, 25, Reference: CS 23.1309
27, 29 CS.25.1309
CS 27.1309
CS 29.1309
14.1.1.2 Covered by 14.2.10 (changed or modified equipment) and 14.2.1 (hazard identification and
mitigation)
Information Sources
Comm'l Doc:
DoD/MIL Doc: Covered by 14.2.10 Def-Stan 00-970 Covered by 14.2.10
Reference:
Information Sources
STANAG Covered by 14.2.10
Reference:
FAA Doc: 14CFR references: system EASA CS Covered by 14.2.10
safety sections of Parts 23, 25, Reference:
27, 29
14.1.1.3 Hazard/risk tracking and risk acceptance.

A tracking system shall be maintained throughout the system life cycle in order to record hazards / risks
identified during the system safety process; their closure actions and/or risk reduction / mitigation; and
residual risks and risk acceptance.

a. Use of a closed loop hazard tracking system / hazard log.

1. System Safety Assessment (SSA) should demonstrate that appropriate closed loop hazard tracking
system and the risk acceptance processes are in place by inspection of safety program documentation.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 4.1, 4.2, 4.3, Def-Stan 00-970 00-970 P13 1.7.1
4.4, 4.5 Reference: 00-970 P13 1.8.1
14CFR references: system 00-56
safety sections of Parts 23, 25, STANAG 4671 AMC.1309(b)
27, 29 Reference:
AC 23.1309-1E
AC 25.1309-1A
27, 29 CS.25.1309
CS 27.1309
CS 29.1309
14.1.1.4 System safety program implementation.

The system safety programme shall be comprehensive, and as a minimum, shall address; flight safety,
ground/industrial safety, explosives and ordnance safety (non-nuclear munitions), range safety, nuclear
safety, radiation/laser safety, test safety and support, software safety, materials, failure modes and effects
testing and built-in-test, fail safe design, and support equipment.

a. Assessing safety design deficiencies uncovered during flight mishap or fault investigations;
b. Ensuring flight mishap rates for system do not exceed threshold limits that are established for program;
c. Establishing an FOD prevention program to minimise the risk of FOD during assembly;
d. Conducting weapons testing, certification, and obtainment of explosive hazard classifications;
e. Ensuring the appropriate safety and design standards are followed, and that safe processes are
employed;
f. Establishing the key safety design requirements;
g. System safety organisation participation in test planning and post-test reviews to analyse all test-
related hazards and recommended corrective actions to ensure hazard closeout or mitigation;
h. Risks associated with use of new/alternate/substituted materials or material deficiencies.
i. Operation in, or in the vicinity of, a volcanic ash cloud.
j. Requirements to satisfy Extended Range Twin Operations (ETOPS) where appropriate.

1. System Safety Assessment (SSA) and supporting documentation should specifically address, where
applicable; flight safety, ground/industrial safety, explosives and ordnance safety (non-nuclear munitions),
range safety, nuclear safety, radiation/laser safety, test safety and support, software safety, materials,
failure modes and effects testing and built-in-test, fail safe design, and support equipment..
Information Sources
Comm'l Doc: For f. above: ANSI Z 136.1 for
definitions of key laser safety
design requirements
SAE ARP4761
DoD/MIL Doc: MIL-STD-882D: 1.1, 4.1, 4.2, Def-Stan 00-970 00-56
4.3, 4.4, 4.5 Reference:
14CFR references: system STANAG 4671 AMC.1309(b)
27, 29
AC 23.1309-1E
AC 25.1309-1A
For f. above: ANSI Z 136.1 for
definitions of key laser safety
design requirements
For c. above: DOD Standard
6055.9-STD and DoD TO-11A-
1-47
For e. above: DoD Directive
3150.2, 23 Dec 1996, 4.1 lists
the four key design standards.
For f. above: MIL-STD-1425A
and MIL-HDBK-828
For h. above: Section 14.3 of
this document
27, 29 CS.25.1309
a. Flight safety
CS 27.1309
b. Ground/industrial safety
CS 29.1309
c. Explosives and ordnance
safety; non-nuclear munitions
d. Range safety
e. Nuclear safety
f. Radiation/laser safety
g. Test safety and support
h. Software safety
Information Sources
i. Materials
j. Failure modes and effects
testing and built-in-test
k. Fail safe design
l. Support equipment
14.2. SAFETY DESIGN REQUIREMENTS.

This section outlines a number of air vehicle safety design criteria which are required in order to ensure
the aircraft is 'safe'. The objective of safety design requirements is to achieve acceptable mishap risk
through a systematic application of design guidance from standards, specifications, regulations, design
handbooks, safety design checklists, and other sources.
• Risks caused by single-point failures;

• Aircraft redundant systems design;
• Consideration of human factors within design and appreciation of human error;
• Safety implications of operating in extreme environmental conditions;
• System installation;
• Isolation of hazardous substances, components and operations;
• Ensuring risks are re-assessed following design changes.
Considerations include:
• The agreed level of acceptable risk;

• Potential risks to personnel, equipment or property, and / or the environment;
• Following the latest safety standards, guidance and techniques.
14.2.1 Hazard identification/control/resolution process

A systematic safety assessment process shall be employed to identify and characterise potential hazards,
devise corrective actions, and conduct residual risk assessments.
The safety assessment process should be planned and managed to provide the necessary assurance
that all relevant failure conditions have been identified and that all reasonably credible combinations of
failures which could cause those failures conditions have been considered.

a. Identify hazards through a systematic hazard analysis process, following recognised safety
assessment techniques.
b. Analysis of system hardware and software, the environment (in which the system will exist), and the
intended use or application (including applications of negative acceleration).
c. Use of historical hazard and mishap data, including lessons learned from other systems.
1. System Safety Assessment (SSA) should demonstrate that a hazard identification/control/resolution

process is employed, by inspection of safety process documentation and review of safety analyses and
system safety group proceedings.
Information Sources
4.4, 4.5, Appendix A Reference:
14CFR references: system STANAG 4671 AMC.1309(b)
27, 29
AC 23.1309-1E
AC 25.1309-1A
MIL-STD-882E
FAA Doc: 14CFR references: system EASA CS CS 25.1315
safety sections of Parts 23, 25, Reference: CS 25 AMC 25.1309
27, 29 CS 23.1309
CS.25.1309
CS 27.1309
CS 29.1309
14.2.2 Mitigation of mishap risks.

All mishap risks associated with the aircraft design shall be eliminated where possible, or controlled such
that the residual risks are reduced to an acceptable level.

a. Risks to personnel, equipment or property, and / or the environment.
b. Eliminating and / or controlling risks iaw agreed standards and best practice.
c. Implementation of a safety hazard tracking database / hazard log.
d. The level of acceptable risk, to be agreed and verified.
e. Risk to 3rd parties.

1. System Safety Assessment (SSA) should include a process to mitigate hazards with "unacceptable"
mishap risk by detailing the system safety documents, technical documents, test documents,
programmatic documents, safety hazard tracking database and the residual risk acceptance process.
Information Sources
4.4, 4.5, 4.6, Appendix C; Reference:
Appendix A, A.4.3.3.1.1 shows STANAG
unacceptable conditions; Table 4671 AMC.1309(b)
A-IV shows mishap risk Reference:
categories & acceptance levels
27, 29
AC 23.1309-1E
Information Sources
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS CS25 AMC 25.1309
27, 29 CS.25.1309
CS 27.1309
CS 29.1309
14.2.3 Single point failure assessment.

All mishap risks associated with single-point failures shall be eliminated where possible, or controlled
such that the residual risks are reduced to an acceptable level.
No aircraft or system loss shall result from a single failure.

a. Use of safety devices that will minimise mishap risk caused by single-point failures (e.g., interlocks,
redundancy, fail safe design, system protection, fire suppression);
b. The level of acceptable risk.

1. System Safety Assessment (SSA) should demonstrate that the risk of all single point failure hazards do
not exceed the hazard baseline set for the program, and that the residual risk has been accepted.
Verification methodology includes inspection of the safety analyses for single point failures and the
relevant data in the closed loop hazard tracking system.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 4.1, 4.2, 4.3, Def-Stan 00-970 00-970 P1 1.1.13
4.4, 4.5, 4.6, Appendix C; Reference: 00-970 P1 3.7.10
Appendix A identifies severity 00-970 P1 4.11.60
levels
00-970 P1 4.12.12
00-970 P1 6.1.28
00-970 P1 6.6.2
27, 29
00-970 Pt 1 6.11.25
AC 23.1309-1E
00-970 Pt 1 6.11.52
AC 25.1309-1A
00-970 Pt 1 6.11.53-6.11.55
00-970 Pt 1 6.12.3-6.12.4
00-970 Pt 1 6.12.6
00-970 Pt 1 6.12.15
00-970 P7 L100 9.1.1
00-970 P7 L204 4.3
00-970 P7 L306 3.3
00-970 P7 L307 3.2.2
00-970 P7 L310 2.2.3
00-56
STANAG 4671.933
4671.1309
4671.1435
Information Sources
4671.1437
27, 29 CS 23.1309
CS 25.629(d)
CS 25.933(a)
CS 25.971(c)
CS 25.1309
CS 27.1309
CS 29.1309
14.2.4 Subsystem protection.

Redundant aircraft subsystems, required to achieve acceptable mishap risks, shall be designed so their
power sources, controls, and critical components are adequately protected using acceptable methods.

a. Ensuring adequate protection by means of physical separation or shielding, or by other acceptable
methods.
b. Requirements to satisfy Extended Range Twin Operations (ETOPS) where appropriate.

1. System Description Documents (SDD) should detail how power sources, controls, and critical
components of redundant subsystems are separated/shielded.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 4, Appendix A Def-Stan 00-970 00-56
safety sections of Parts 23, 25, STANAG 4671 AMC.1309(b)
27, 29 Reference:
AC 23.1309-1E
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS CS 25.1707(k)
safety sections of Parts 23, 25, Reference: CS 23 AMC 23.1309
27, 29 CS 23.1309
CS.25.1309
CS 27.1309
CS 29.1309
AMC 20-06 Rev. 2
14.2.5 Human factors.

All human factors design requirements shall be met; and any safety issues/risks related to human factors
shall be identified and eliminated, or reduced to an acceptable level.

a. The full anthropometric range of air crew and passengers.
b. Aircrew workload, ergonomics and situational awareness.
c. Operations in full NBC or other restrictive clothing, e.g. gloves, respirators etc.
d. The level of acceptable risk.
e. Requirements to satisfy Extended Range Twin Operations (ETOPS) where appropriate.

1. System Description Documents (SDD) should demonstrate that human factors requirements are
incorporated into the design.
2. System Safety Assessment (SSA) should identify safety issues/risks related to human factors and
reduce them to an acceptable level. This is achieved by inspection of safety documentation, safety
analyses and program functional baselines.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 4, Appendix A Def-Stan 00-970 00-970 P1 4.23.32
MIL-STD-1472 gives the Reference: 00-56
human-factor design 00-250
requirements STANAG 4671 AMC.1701
27, 29
AC 23.1309-1E
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS CS 25.783(d)(8)
safety sections of Parts 23, 25, Reference: CS 25 AMC 25.1155 4(c)
27, 29 CS 25 AMC 25.1309
CS 23.1309
CS.25.1309
CS 27.1309
CS 29.1309
AMC 20-06 Rev. 2
14.2.6 Human error.

The risks from failures or hazards, created by human error during the operation and / or support of the
aircraft , shall be minimised through system design, and reduced to an acceptable level.

a. The level of acceptable risk;
b. The use of safeguards to prevent inadvertent operations.

1. System Safety Assessment (SSA) should demonstrate that design safeguards are in place to reduce
the mishap risks associated with human error to acceptable levels, by inspection of safety documents and
analyses and review of the closed loop hazard tracking system.
Information Sources
DoD/MIL Doc: MIL-STD-882D: 4, Appendix A Def-Stan 00-970 00-970 P7 L702/1 1.2
14CFR references: system Reference: 00-56
Information Sources
safety sections of Parts 23, 25, STANAG 4671 AMC.1701
27, 29 Reference:
AC 23.1309-1E
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS CS 25.783(g)
safety sections of Parts 23, 25, Reference: AMC 25.1309
27, 29 CS 23.1309
CS.25.1309
CS 27.1309
CS 29.1309
14.2.7 Environmental conditions.

Risks caused by operation in the worst-case environmental conditions shall be minimised through system
design, and reduced to an acceptable level.

a. The worst-case conditions across the complete range of expected environmental conditions, e.g.
extreme hot and extreme cold.
b. The level of acceptable risk.
c. Operation in, or in the vicinity of, for example, a volcanic ash cloud.

1. System Safety Assessment (SSA) should demonstrate that the safety risk minimization process
addresses effects of worst-case environmental conditions on the design, by review of safety analyses and
environmental/climatic test results/reports.
Information Sources
MIL-STD-810 gives Reference: 00-970 P1 3.1.22
environmental and climatic 00-970 P1 6.1.1
testing requirements 00-970 P1 6.2.40-6.2.61
14CFR references: system 00-970 P1 6.11.61-6.11.85
safety sections of Parts 23, 25, 00-970 P7 L200 1.8
27, 29 00-970 P7 L301 8.3
AC 23.1309-1E 00-56
AC 25.1309-1A STANAG 4671.603(a)
Reference: 4671.607(b)
4671.613(c)
4671.1309(e)
4671.1431(a)
FAA Doc: 14CFR references: system EASA CS CS 23.603(a)
safety sections of Parts 23, 25, Reference: CS 23.607(b)
27, 29 CS 23.613(c)
CS 23.1309(e)
CS 23.1431(a)
CS 25.603(c)
Information Sources
CS 23.607(c)
CS 23.613(c)
CS 23.1309(a)
CS 25.1431(a)
CS 25.1435(a)
CS 27.603(c)
CS 27.607(a)
CS 27.1309
CS 29.603(c)
CS 29.607(a)
CS 29.1309
14.2.8 Assembly/installation hazards.

Risks to personnel, caused by exposure to hazards during the installation process, including those due to
hazardous locations of systems in the aircraft , shall be eliminated, or reduced to an acceptable level.

a. Errors in assembly, installation, or connections which could result in a safety hazard or mishap for the
system;
b. Provision of equipment installation, operation and maintenance processes documentation;
c. The level of acceptable risk.

1. System Safety Assessment (SSA) should demonstrate procedural safety requirements acceptability by
inspection and approval of maintenance process documentation.
Information Sources
14CFR references: system Reference: 00-970 P1 6.1.21
safety sections of Parts 23, 25, 00-970 P7 L203 8.2.1
27, 29 00-56
AC 23.1309-1E STANAG
AC 25.1309-1A Reference:
FAA Doc: 14CFR references: system EASA CS CS M25.3(c)
safety sections of Parts 23, 25, Reference: AMC 25.1309
27, 29 CS 23.1309
CS.25.1309
CS 27.1309
CS 29.1309
14.2.9 Safety design process.

The aircraft shall be designed such that hazardous substances, components, and operations are isolated
from other activities, areas, personnel, and incompatible materials. Any residual risks which cannot be
eliminated through isolation, shall be mitigated and reduced to an acceptable level.

a. Minimising or eliminating hazardous material use where possible;
b. When using potentially hazardous materials, select those materials that pose the least risk throughout
the life cycle of the system;
c. Isolating sources of contaminated air, hazardous exhaust gases, fumes and fuel from fuel tanks etc.;
d. Ensuring equipment is located so that access during operations, servicing, repair, or adjustment
minimises personnel exposure to hazards (e.g., hazardous substances, high voltage, electromagnetic
radiation, and cutting and puncturing surfaces);
e. The level of acceptable risk.

1. System Safety Assessment (SSA) should demonstrate the standard to assure that hazardous
substances, components and operations have been identified and corrective measures taken (e.g.,
separation, shielding, isolation), and/or risks reduced to an acceptable level for the program. Methods
include review of safety analyses and program technical documentation.
Information Sources
14CFR references: system Reference: 00-970 P1 4.26.23
safety sections of Parts 23, 25, 00-970 P1 6.14.3
27, 29 00-970 P7 L307 4.9.4
AC 23.1309-1E 00-970 P7 L700 4.1.10
AC 25.1309-1A 00-970 P7 L702 12.7
00-56
STANAG 4671.1121(a)
Reference: AMC.1309
AMC.1701
27, 29 CS 23.1121
CS 23.1309
CS 25.851
CS 25.967
CS 25.1121
CS 25.1309
AMC 25.1309
CS 27.1309
CS 29.1309
14.2.10 Analysis of changes or modifications.

Where changes or modifications are made to existing equipment or software, the effect on the baseline
mishap risk shall be assessed. Any resulting hazards or changes in risks shall be eliminated or mitigated,
in order to ensure an acceptable level of mishap risk is maintained.
a. Changes to design, configuration, production, or mission requirements (including any resulting system
modifications and upgrades, retrofits, insertions of new technologies or materials, or use of new
production or test techniques).
b. Changes to the environment in which the system operates.
c. Ensuring changes or other modifications do not: create new hazards; impact a hazard that had
previously been resolved; make any existing hazard more severe; or adversely affect any safety-critical
component.

1. System Safety Assessment (SSA) should demonstrate that no changes/modifications to existing
systems will cause an uncceptable level of mishap risk, by inspections of system safety analyses on
changed or modified equipment or software.
Information Sources
DoD/MIL Doc: Reference sections 14.3.3, Def-Stan 00-970 00-56
15.3.3.2, 15.3.3.3 of this Reference:
document STANAG
AC 23.1309-1E
Reference:
AC 25.1309-1A
MIL-STD-882D: 4
Reference: CS.25.1309
CS 27.1309
CS 29.1309
14.2.11 Assess safety of operational contingencies.

The system shall provide and implement operational contingencies in the event of catastrophic, critical
and marginal failures or emergencies involving the system.

a. Pre-determined states and modes following a failure.

1. System Safety Assessment (SSA) should demonstrate that operational contingencies have been
approved by inspection of system safety documentation.
Information Sources
Comm'l Doc:
DoD/MIL Doc: AC 23.1309-1E Def-Stan 00-970
STANAG 4671 USAR 1309
Reference:
CS 27.1309
CS 29.1309
14.2.12 Safety assurance for special military modes of operation.

Special military modes of operation when inactive shall not reduce the aircraft below threshold safety
levels.

a. Weapons or stores arming and release.
b. Operation of electromagnetic spectrum emitters.
c. Physical/functional separation between the special modes when inactive and the basic UAS.

1. System Safety Assessment (SSA) should demonstrate that special military modes of operation of UAS
when inactive meet probability of failure and design and development assurance requirements through
inspections of programmatic, system safety and software safety documents.
Information Sources
Comm'l Doc:
STANAG 4671.USAR.U19
Reference:
CS 27.1309
CS 29.1309
14.2.13 Military requirements for cockpit & cabin design.

The aircraft shall be designed, where appropriate, to include suitable physical protection measures for the
flight deck, resistance to the effects of an explosive or incendiary device, survivability of systems, and the
interior design should facilitate searches.
Consideration should be given to (taken from CS 25.795):

a. Ability of the flight deck door to resist forced entry;
b. Ability of the flight deck door to resist penetration by small arms or fragmentation devices;
c. Limit the effects of an explosive or incendiary device as follows:
i. Limit entry to flight deck of smoke, fumes, or noxious gases;
ii. Limit entry to passenger compartment of smoke, fumes, or noxious gases, or other means to prevent
passenger incapacitation;
iii. Cargo compartment fire suppression system should:
(1) Be capable of suppressing a fire;
(2) Be designed to withstand the following effects:
(a) Impact from a ballistic object;
(b) A 103kPa (15psi) pressure load to component surfaces larger than 0.4 square metres (4 square feet);
(c) A 15 cm displacement applied anywhere along the distribution system where relative movement
between the system and its attachment can occur;
d. Aircraft design should include a designated location where a bomb or other explosive device could be
placed to best protect integrity of the structure and flight critical systems from damage in the case of
detonation;
e. Redundant systems necessary for continued safe flight and landing should be physically separated;
f. Interior designs should incorporate features that will deter concealment or promote discovery of
weapons, explosives, or other objects from a simple inspection in the following areas of the cabin:
i. Areas above the overhead bins;
ii. Toilets must be designed to prevent the passage of solid objects greater than 5 cm (0.2 in) in diameter;
iii. Life preservers or their storage locations must be designed so that tampering is evident.

1. The aircraft specification should include all relevant requirements for physical protection measures for
the flight deck, resistance to the effects of an explosive or incendiary device, survivability of systems, and
the ease of searching the aircraft interior.
2. System Description Documents (SDD) should detail all design features incorporated to provide
physical protection measures for the flight deck, resistance to the effects of an explosive or incendiary
device, survivability of systems, and the ease of searching the aircraft interior.
3. Analysis should demonstrate that the design features provided meet the associated requirements of
the aircraft specification.
4. Testing should demonstrate the accuracy of the performed analysis and should demonstrate that the
required levels of protection, resistance, survivability and searchability have been met.
Information Sources
Comm'l Doc:
STANAG
Reference:
CS 25.1309
CS 27.1309
CS 29.1309
14.3. SOFTWARE SAFETY PROGRAM.

This section covers software safety, and its integration with the overall safety programme.Included within
the scope of this section are:
• Safety Related Software (SRS) i.e. software that relates to a safety function or system;
• Establishing Safety Levels;
• Safety Critical Software (SCS), i.e. software that relates to a safety critical function or system,
the failure of which could cause the highest risk to human life.
Complex Electronic Hardware is considered in Section 15.Note: Software safety is also covered by
Section 15.3
14.3.1 Comprehensive approach to software safety.

A comprehensive software safety program (including all key software safety issues), shall be integrated
into the overall system safety program.

a. Establishing software levels , typically in accordance with prescribed industry standards.
b. Identifying safety critical functions and their associated safety critical software.
c. Analysing and addressing single point failures caused by software.
d. Producing the requisite safety and software plans and other documentation.

1. System Safety Assessment (SSA) should demonstrate by inspection of program safety, software
safety, and software documentation that the comprehensive software safety program has been integrated
into the system safety program in a manner which meets the selected standard.
Information Sources
Comm'l Doc: DO-178B to establish software
integrity levels for commercial
aircraft
SAE ARP4754A
DoD/MIL Doc: Joint Software System Safety Def-Stan 00-970 00-970 P1 6.2.63
Committee, Software System Reference: 00-970 P9 UK1309b
Safety 00-970 P13 1.7.1
Handbook: A Technical &
00-970 P13 1.8.1
Managerial Team Approach,
STANAG 4671 AMC.1309(b)
Dec 1999
Reference:
FAA Doc:
27, 29
AC 23.1309-1E
AC 25.1309-1A
FAA Doc: 14CFR references: system EASA CS AMC 25.1309
27, 29 CS.25.1309
CS 27.1309
CS 29.1309
14.3.2 Planning/accomplishing software safety analyses and assessments.

Appropriate software safety designated analyses shall be performed as part of the software development
process, to satisfy the software safety programme.

a. The types and quantities of required software safety analyses and their delivery schedules.
b. Ensuring the safety analyses programme has a complete systems view, including identification of
software hazards, and associated software risks.
c. Review of baseline software requirements that system safety requirements for software development.
1. System Safety Assessment (SSA) should demonstrate by inspection of system safety, software safety,
and software documentation that the tailored set of analyses and assessments (or equivalent) required by
this section (14.3) are planned for and accomplished.
Information Sources
Comm'l Doc:
Committee, Software System Reference: 00-970 P13 1.7.1
Safety 00-970 P13 1.8.1
Handbook: A Technical &
STANAG 4671 AMC.1309(b)
Managerial Team Approach,
Reference:
Dec 1999
FAA Doc:
27, 29
AC 23.1309-1E
AC 25.1309-1A
27, 29 CS.25.1309
CS 27.1309
CS 29.1309
14.3.2.1 Performance of software safety analyses.

The required software safety analyses preparation shall be accomplished.

a. Ensuring software safety analyses and assessments include the tailored documentation required by
the references of this section (14.3).

1. System Safety Assessment (SSA) should demonstrate by inspection that the delivered software safety
analyses for the program have a complete systems view, including identification of software hazards, and
associated software risks.
Information Sources
Comm'l Doc: SAE ARP4754A
DoD/MIL Doc: AC 23.1309-1E Def-Stan 00-970 00-970 P1 6.2.63
AC 25.1309-1A Reference: 00-55
RTCA DO-178C STANAG 4671 AMC.1309(b)
Reference:
FAA Doc: EASA CS AMC 25.1309
CS.25.1309
CS 27.1309
CS 29.1309
14.3.2.2 Performance of software safety traceability analyses.

The required software safety traceability analyses shall be accomplished.

a. Bi-directional traceability to the identified hazard(s).
b. Ensuring software safety analyses and assessments include the tailored documentation required by
the references of 14.3 (this document).

1. System Safety Assessment (SSA) should demonstrate by inspection of system safety, software safety
and program documentation that the bi-directional software safety traceability analyses amongst
requirements, design, implementation, verification, and hazard have been accomplished.
Information Sources
AC 25.1309-1A Reference: 00-55
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
14.3.3 Evaluation of software for elimination of hazardous events.

Software, as designed or modified, shall not initiate hazardous events or mishaps in either the on or off
(powered) state.

a. Both controlled and / or monitored functions;
b. Implementing of a system safety assessment process which includes evaluation of software and
identification of anomalous software control/monitoring behaviour.

1. System Safety Assessment (SSA) should demonstrate by inspection that the delivered software safety
analyses for the program have a complete systems view, including identification of software hazards, and
associated software risks.
2. Rig/simulation tests of software applications should demonstrate that systems respond as intended.
Information Sources
Comm'l Doc: DO-178B defines software
integrity levels for safety critical
functions
SAE ARP4754A
Committee, Software System Reference: 00-970 P13 3.2.33
Safety 00-970 P13 1.7.1
Information Sources
Handbook: A Technical & 00-970 P13 1.8.1
Managerial Team Approach, 00-55
Dec 1999 STANAG 4671 AMC.1309(b)
FAA Doc: Reference:
27, 29
AC 23.1309-1E
AC 25.1309-1A
27, 29 CS.25.1309
CS 27.1309
CS 29.1309
14.3.4 Commercial off-the-shelf software integrity level confirmation.

Commercial Off-the-Shelf (COTS) and reuse software (which includes application software and operating
systems) shall be developed to the necessary software integrity level.

a. Defining the appropriate software integrity level at the software and/or safety planning stage.

1. System Safety Assessment (SSA) should demonstrate by inspection of program, system safety,
software safety and software engineering documentation that COTS and reuse software is developed to
the necessary software integrity level.
Information Sources
AC 25.1309-1A Reference: 00-055
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
14.3.5 Identification of safety designated/significant software.

Software elements that perform functions related to system hazards shall be identified and handled as
safety related/critical software.

1. System Safety Assessment (SSA) should demonstrate by inspection of program, system safety and
software safety documentation that the identified safety related software elements are handled (labeled,
tracked, implemented, tested, etc.) as required by software/safety planning based on their safety criticality
levels.
Information Sources
AC 25.1309-1A Reference: 00-055
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
14.3.5.1 Assignment of criticality levels.

Each safety designated software function shall be assigned an appropriate criticality level.

a. Ensuring that, if a software function contains multiple software elements, the function is assigned a
criticality level equal to the criticality level of the highest element.

1. System Safety Assessment (SSA) should demonstrate by analysis and inspection of documentation,
that the appropriate level of criticality is assigned to each software function.
Information Sources
AC 25.1309-1A Reference: 00-055
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
14.3.5.2 Testing to criticality levels.

Each safety designated software function shall be developed and tested commensurate with its assigned
criticality level.

1. System Safety Assessment (SSA) should demonstrate by inspection of documentation, that the
appropriate level of development and testing for designated safety software has been performed and
required results were achieved.
Information Sources
Information Sources
AC 25.1309-1A Reference: 00-055
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
14.3.6 Software safety test analyses.

The appropriate software safety test analyses shall be planned and performed.

a. Ensuring that results are recorded using formal procedures and are kept under configuration control.

1. System Safety Assessment (SSA) should demonstrate by inspection of the safety plans that software
safety testing and test analyses have been adequately planned, performed and documented.
Information Sources
Comm'l Doc:
AC 25.1309-1A Reference: 00-055
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
14.3.7 Structural coverage analysis.

Structural Coverage Analysis shall be planned and executed.

a. Ensuring that results are recorded using formal procedures and are kept under configuration control.

1. System Safety Assessment (SSA) should demonstrate by inspection of the test plans that adequate
structural coverage analysis is planned and documented.
2. Test/simulation should demonstrate that adequate structural coverage is in place.
Information Sources
Comm'l Doc:
Information Sources
AC 25.1309-1A Reference: 00-055
Reference:
CS.25.1309
CS 27.1309
CS 29.1309
SECTION 15 - COMPUTER SYSTEMS AND SOFTWARE

computer resources. This includes manned aircraft avionics, as well as airborne and ground segment
avionics for UAVs.
15.1. AIRCRAFT PROCESSING ARCHITECTURE
15.1.1 Safety critical functions (SCFs).

Safety critical functions (SCFs) shall be identified and documented for each aircraft system.

a. Allocation of an integrity level for each system.
b. Identifying all associated system hardware and software.
c. Ensuring that the required safety level has been associated with each of the hardware and software
functions.

1. System Safety Analysis (SSA) should identify each safety critical function.
Information Sources
Comm'l Doc: RTCA DO-178C, RTCA DO-
254
SAE ARP4761
SAE ARP4754A
DoD/MIL Doc: JSSG-2008: 3.1.12, 3.3.1 Def-Stan 00-970 00-970 P0 S4
MIL-STD 882D, sections 4.2, Reference: 00-970 P13 1.7
4.7, 4.8 for further guidance STANAG 4671.1301
concerning identification, Reference: 4671.1309
review and tracking of safety
hazards to establish program
safety definitions
JSSG-2008 Appendix A:
3.1.2.1 for establishing safety
criticality along with CNS/ATM
safety performance references
in the ESC developed Generic
Performance Matrices (10E-5
to 10E-7 hazard rates
depending on flight phase)
FAA Doc: AC 20-115C EASA CS CS 23.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
Information Sources
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.2 SPA requirements.

System Processing Architecture (SPA) safety requirements shall be fully defined and documented.

a. Attributes such as functional requirements, processing demands, timing criticalities, data flow,
interfacing elements, redundancy and fault tolerance.
b. Federated and integrated elements of the SPA.

1. System Safety Assessment should document that all technical and safety SPA risks are appropriately
mitigated/captured.
Information Sources
Comm'l Doc: RTCA DO-178C,
RTCA DO-254
SAE ARP4761
DoD/MIL Doc: JSSG-2008: 3.3.1 Def-Stan 00-970 00-970 P0 S4
JSSG-2008 Appendix A: 3.1.7, Reference: 00-970 P13 1.7
3.1.12, 3.3.1 for further STANAG 4671.1301
guidance concerning Reference: 4671.1309
redundancy, system and
processing architectures
JSSG-2008 Appendix A: 3.3.1
provides processing
architecture design strategies
to mitigate component failures;
3.1.9 contains single point
failure guidance regarding in-
flight hazards and redundancy;
3.1.11.1 addresses safe
operation in the case of
multiple failures
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.3 SPA redundancy.

The SPA shall employ redundancy to preclude the loss of safety critical processing in the event of a
single failure or data channel loss and support fault tolerance requirements.

a. Provision of mitigations for any failure modes identified

1. A full system failure analysis (e.g. FMECA) should determine potential single points of failure.
Information Sources
Comm'l Doc: RTCA DO-178C
RTCA DO-254
SAE ARP4761
JSSG-2008 Appendix A: 3.1.7, Reference: 00-970 P13 1.7
3.1.12, 3.3.1 for further STANAG 4671.1301
guidance concerning Reference: 4671.1309
redundancy, system and
processing architectures
provides processing
architecture design strategies
to mitigate component failures;
3.1.9 contains single point
failure guidance regarding in-
flight hazards and redundancy;
3.1.11.1 addresses safe
operation in the case of
multiple failures
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.4 SCF threads.

All SPA supported Safety Critical Function (SCF) threads shall be identified, documented and completely
traced, and all Safety Supporting Elements (SSEs) of the SPA shall be identified.

a. Identifying Safety Supporting Hardware Elements (SSHEs) relevant to the SCF thread.
b. Identifying non-SSEs relevant to the SCF thread.

1. System Description Documents (SSD) for software should include details of functional thread analysis
for each SCF from the SPA to the SSEs, Safety Supporting Software Elements (SSSEs), SSHEs, and
components.
2. System Description Documents (SSD) for software should include details of automation of the SCF
thread tracing capability to allow repeatability and expansion of analysis.
Information Sources
RTCA DO-254
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.5 Probability of loss of control and hazard mitigations.

The SPA shall be designed to meet Probability of Loss of Control (PLOC), Probability of Loss of Aircraft
(PLOA), SCF processing, hazard mitigations, and reliability requirements.

a. Identifying and recording the quantitative safety targets for the PLOC and PLOA as well as the
requirements of SCF processing, hazard mitigations and reliability.
b. Identifying and recording the fault tolerance requirements for the architecture.
c. Documenting the redundancy scheme based on the requirements.
d. Documenting the voting mechanism for the architecture.

1. System Safety Assessment (SSA) should demonstrate that SPA are designed to meet Probability of
Loss of Control (PLOC), Probability of Loss of Aircraft (PLOA), SCF processing, hazard mitigations, and
reliability requirements
Information Sources
RTCA DO-254
SAE ARP4761
SAE ARP4754A
JSSG-2008 Appendix A: Reference: 00-970 P13 1.7
Paragraph 3.3.1 provides STANAG 4671.1301
Information Sources
guidance for fault tolerant Reference: 4671.1309
processing including fault
detection and redundancy;
3.1.2, 3.1.7 and 3.1.5.7 provide
guidance for allocating
quantitative safety
requirements to subsystem
level in the context of VCMS
and mission avionics allowing
for variability factors; 3.1.9
gives guidance on establishing
redundancy levels based on
control criticality; 3.1.11+ and
3.1.12+ provide detailed
guidance on the establishment
of proper levels of redundancy
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.6 SPA interfaces.

All SSEs of the SPA that interface (physically or functionally) with other processing elements (SSEs or
non-SSEs) shall continue safe operation in the event there is a data channel failure or data corruption
with the interfacing elements.

a. Ensuring data/calculation/system-timing dependencies do not impede system performance in any
operational mode or degrade architectural safety coverage.

1. Rig, ground and flight testing should demonstrate the robustness of the architecture regarding data
channel failure or data corruption with the interfacing elements.
Information Sources
RTCA DO-254
STANAG 4671.1301
Information Sources
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.7 Computer System Integrity Levels (CSILs).

All SCFs shall be fully allocated to elements within the SPA and each element assigned a Computer
System Integrity Level (CSIL) based on the criticality of support that it provides to the SCF.

a. Identifying both the hardware and software components relating to SCFs.
b. Dissimilar systems within redundant SPAs.

1. System Safety Analysis (SSA) should demonstrate that each of the identified SCFs have been
allocated.
2. SSA should include analysis of SPA criticality.
Information Sources
RTCA DO-254
SAE ARP4761
SAE ARP4754A
MIL-STD-882D Appendix A: Reference: 00-970 P13 1.7
A.4.4.2 establishes hardware STANAG 4671.1301
and software analysis in the Reference: 4671.1309
hazard identification process
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.8 CSIL processes.

Every CSIL shall have a corresponding development process defined and applied and each process shall
be adequate to support the safety requirements of the classification.
1. System Safety Assessment (SSA) should demonstrate by analysis that each CSIL process has been
justified.
2. Proof that the defined development process has been followed for each software and hardware
component.
Information Sources
RTCA DO-254
SAE ARP4761
SAE ARP4754A
DoD/MIL Doc: JSSG-2008: 3.3 Def-Stan 00-970 00-970 P0 S4
JSSG-2008 Appendix A: 3.3 Reference: 00-970 P13 1.7
Requirement Guidance and STANAG 4671.1301
Lessons Learned for additional Reference: 4671.1309
information concerning
processing element selection.
3.1.7.3, 3.1.8, 3.1.11, 3.14.4
and 3.2.2.6 provide guidance
for integrating safety critical
VCMS systems with non-safety
critical processing elements
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.9 Data flow and control flow

Interfaces (control and data flow) supporting SPA SSEs shall be clearly defined and documented.

a. Hardware and software SSE.
b. Ensuring that interfaces do not impede or prevent system performance or degrade the system safety
target.

1. Systems Interface Documents (SID) should include relevant details for control and data flow, including
but not limited to: data flow and accuracy, data latency, timing issues, and handshaking protocols.
Information Sources
RTCA DO-254
Information Sources
3.1.7.1 provides guidance for STANAG 4671.1301
identifying subsystem Reference: 4671.1309
interfaces and ensuring
sufficient data communication
timing margins. Paragraph
3.5.7 discusses the application
of integrity processes in the
design of system interfaces
from both the hardware and
software standpoint
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.10 Physical and functional separation.

Physical and functional separation between SSEs and non-SSEs shall be accounted for in the SPA.

1. Clearly identifying all SSE of the architecture.
2. Ensuring that non-SSE of the architecture do not share either hardware or software resources.

1. System Safety Assessment (SSA) shall demonstrate physical and functional separation of SSEs and
non-SSEs.
Information Sources
RTCA DO-254
SAE ARP4761
DoD/MIL Doc: JSSG-2008: 3.1.7.1 Def-Stan 00-970 00-970 P0 S4
3.1.7.1 provides for basic STANAG 4671.1301
partitioning of the architecture Reference: 4671.1309
(hardware and software);
3.1.7.2 gives guidance
regarding "system
arrangement" (architecture
design); 3.1.7.3 directly
addresses isolation of less
critical elements to prevent
their failure from impacting
Information Sources
critical functions
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.11 Notification of loss of critical processing.

The operator shall be notified upon the loss of flight critical processing capability or redundancy in flight
critical processing.

a. Built-In-Test (BIT) detection of loss of redundant processing capabilities for flight critical systems.
b. Prioritization of loss or degraded processing annunciations.
c. Latency time from detection to annunciation for flight critical alerts

1. System Description Documents (SDD) should include details of operator notification due to the loss of
flight critical processing capability or redundancy in flight critical processing.
2. Rig and ground testing should demonstrate that operator notifications (due to the loss of flight critical
processing capability or redundancy in flight critical processing) are displayed correctly.
Information Sources
RTCA DO-254
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.1.12 Uninterruptable power.

Electrical power quantity and quality for the SPA(s) shall be sufficient to maintain continuous operation.
a. Identifying all redundant operations.

b. The architecture design should clearly state the requirement for independence of power supplies to the
redundant operations.

1. Systems Interface Documents (SID) should include relevant details for electrical power quantity and
quality for SPAs.
2. Rig, ground, and flight testing should demonstrate that electrical power quantity and quality remains
within defined limits, sufficient to maintain continuous operation, through all expected operating
conditions.
Information Sources
RTCA DO-254
DoD/MIL Doc: JSSG-2008: 3.2.2.2.2, Def-Stan 00-970 00-970 P0 S4
3.2.2.2.5, 3.3 Reference: 00-970 P13 1.7
JSSG-2008 Appendix A: STANAG 4671.1301
3.2.2.2.2 and 3.2.2.2.5 give Reference: 4671.1309
extensive guidance on aircraft 4671.1351
power system support to safety
critical equipment
CS 23.1351
CS 25.1301
CS 25.1309
CS 25.1351
CS 25.1355
CS 27.1301
CS 27.1309
CS 27.1351
CS 29.1301
CS 29.1309
CS 29.1351
CS 29.1355
AMC 20-115C
15.2 DESIGN AND FUNCTIONAL INTEGRATION OF SPA ELEMENTS.
15.2.1 Functional coupling.

SSEs shall avoid unnecessary coupling.

a. All parameters coupled to SSE threads should be recorded and justified to prevent unnecessary
coupling.
1. System Safety Analysis (SSA) should include analysis of the processing elements to ensure that all
parameters are defined and recorded in the appropriate software documentation.
2. System Safety Analysis (SSA) should include analysis of safety critical functional threads, to record
processing element inter-dependencies.
3. Rig and ground testing should demonstrate that SSEs are not unnecessarily coupled.
Information Sources
RTCA DO-254
SAE ARP4761
3.3.6+ and 3.1.14.6 address STANAG 4671.1301
software structure, partitioning Reference: 4671.1309
and CSCI integration; 3.1.5.1
gives guidance on data latency
issues; 3.1.7 gives overall
architecture design guidance
along with specific data latency
discussions in Lessons
Learned subparagraph l
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.2 Functional autonomy and critical data sources.

The level of autonomy achieved by the flight-essential elements shall be sufficient to preclude loss of
flight-critical functions due to failure in mission or maintenance related elements.

a. The system design should preclude use of single-source safety critical data.
b. The system design should preclude use of single-source non-safety critical data for safety critical
applications.
c. Where use is made of mission or maintenance related elements in flight-critical functions, these shall
be recorded.

1. Rig and ground testing should demonstrate that failure in mission or maintenance related elements
cannot cause loss of flight-critical functions.
Information Sources
Information Sources
RTCA DO-254
JSSG-2008 Appendix A: 3.3.1 Reference: 00-970 P13 1.7
contains guidance addressing STANAG 4671.1301
redundant data path Reference: 4671.1309
management, data validity and
reasonableness; 3.1.7.3 and
3.1.8 provide guidance for
interfacing between safety and
non-safety critical subsystems
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.3 Integration methodology.

The integration methodology used for the SPA SSEs shall be defined and documented, and shall provide
complete verification coverage of SCFs at all levels, for each flight configuration release.

a. An established and proven process to record all aspects of the architecture life cycle (hardware and
software), including but not limited to: requirements, design, build, integration, and testing.
b. The contents of each document in the suite used for a) should be clearly defined.
c. Integration of each element into the complete system.
d. Integration of the complete system into the air vehicle.

1. System Safety Analysis (SSA) should define and document the integration methodology used for the
SPA SSEs.
2. Rig, ground and flight testing should demonstrate correct function for all SCFs.
Information Sources
Comm'l Doc: RTCA DO 178C
RTCA DO-254
SAE ARP4761
JSSG-2008 Appendix A: 4.3 Reference: 00-970 P13 1.7
addresses processing element STANAG 4671.1301
verification and 3.3.1 Reference: 4671.1309
addresses integration;
4.1.14.4, 4.2.2.2 and 4.5.7
specify a build up approach in
Information Sources
verification and testing
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.4 Critical discrepancies.

Safety critical hardware and software discrepancies identified shall be safely corrected or mitigated.

a. Use of a robust and approved design and development control methodology to document and record
all aspects of the design and its testing through to acceptance.
b. The above methodology should ensure that follow-up action on identified discrepancies is tracked
through to a successful conclusion.
c. All interfaces should be well documented and compatible (hardware/hardware, hardware/software, and
software/software).
d. Use of a peer review audit system comprising independent reviewers.

1. System Safety Analysis (SSA) should detail any identified safety critical hardware and software
discrepancies, and should demonstrate that any such discrepancies have been safely corrected or
mitigated.
Information Sources
SAE ARP4761
provides guidance under STANAG 4671.1301
lessons learned for tracking Reference: 4671.1309
and mitigating software
discrepancies
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.5 Simulations, models and tools.

Simulators, models, and tools used in the development, integration, and testing of software and hardware
supporting SCFs shall be appropriately qualified and validated.

a. Identification of source, i.e.: off-the-shelf (commercial or government), modified, or developed for the
application.

1. A test plan including analysis of the effectiveness (accuracy and fidelity) of the output performance for
all simulators, models, and tools.
Information Sources
RTCA DO-254
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.6 Safety interlocks.

Interlocks shall provide safe engagement and disengagement of system modes for flight and ground
operations.

a. Specifics of how each safety interlock is used by each SSE.
b. safety interlocks required for engagement, switching, and disengagement, of single or multiple modes.
c. Safely control mode (enable/prevent) engagement based on ground or flight parameters and to prevent
engagement of incompatible modes.

1. System Description Documents (SDD) should provide details of interlocks which provide safe
engagement and disengagement of air system modes for flight and ground operations.
2. Rig and ground testing should demonstrate the correct function of safety interlocks.
Information Sources
RTCA DO-254
Information Sources
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.7 Single event upset (SEU) susceptibility.

The SPA shall be designed to ensure that SEUs do not cause unsafe conditions.

a. Identification of areas of the flight envelope susceptible to SEU effects.
b. Detection, correction, and prevention techniques to mitigate hazards and the loss of SCFs.

1. System Safety Analysis (SSA) should include assessment of hazards associated with SEUs.
2. Rig and ground testing should demonstrate correct system function throughout any expected SEU.
Information Sources
RTCA DO-254
SAE ARP4761
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.2.8 Security techniques.

Security techniques used shall be implemented safely.
a. The degree of security required and means of implementing it (software or hardware); intrusions could
include malicious (theft, or data corruption) or accidental access.
b. Use of encryption systems.
c. Any security techniques used should be clearly identified in the documentation, and proven not to affect
SSE functionality.
d. Physical security means.

1. System Safety Assessment (SSA) should demonstrate that security techniques used in the SPA are
implemented safely.
Information Sources
RTCA DO-254
SAE ARP4761
3.1.14.6.i and 4.1.14.6.d STANAG 4671.1301
guidance addresses analysis, Reference: 4671.1309
allocation and verification of
security requirements; 3.3.4
directly addresses
unauthorized modification and
tampering with components;
3.3.7 establishes a place for
traceable security
requirements
AFPam 63-1701 provides
guidance for implementation of
Systems Security Engineering
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.3 PROCESSING HARDWARE/ELECTRONICS.
15.3.1 Merged with 15.1.7, 15.1.5 and 15.1.10

15.3.2 Merged with 15.1.10
15.3.3 Merged with 15.1.7, 15.1.5 and 15.1.10
15.3.4 Environmental qualification.
All hardware processing elements shall be capable of safely operating within planned operational
environments.

a. Natural and induced environmental conditions expected for air system locations/envelopes/operational
environments.

1. Rig, ground, and flight testing should demonstrate that processing elements are qualified to defined
environmental requirements.
Information Sources
RTCA DO-254
RTCA DO-160G1
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.4 SOFTWARE DEVELOPMENT PROCESSES.
15.4.1 Software processes.

The software development process for Safety Supporting Software Elements (SSSEs) shall be fully
documented (e.g., Software Development Plan (SDP), Software Safety Plan (SSP)), followed, and
sufficiently suitable to produce software supporting SCFs.

a. Production of a rigorous SSSE development process which is suitable, comprehensive, well defined,
documented and consistently applied.
b. Identifying activities to support the SSSE requirements, design, code, integration, test and release of
products.

1. System Safety Analysis (SSA) and appropriate supporting documentation (e.g., Software Development
Plan (SDP), Software Safety Plan (SSP)) should document the development process for SSSEs, and
should demonstrate that the SSSEs are sufficiently suitable to produce software supporting SCFs.
Information Sources
RTCA DO-254
SAE ARP4761
Reference:
STANAG
Reference:
FAA Doc: AC 20-115C EASA CS AMC 20-115C
Reference:
15.4.2 Traceability.
Each SSSE shall have sufficient bidirectional traceability established for requirements (performance and
interface), design, source code, and test data.

a. SCF bidirectional traceability both vertically (system level to the lowest software level) and horizontally
(across the system/software).

1. System Requirements Documents (SRD) and associated Validation/Verification plans should
demonstrate that bidirectional traceability for requirements and functions are coupled to all levels of
testing.
Information Sources
RTCA DO-254
Reference:
STANAG
Reference:
Reference:
15.4.3 Configuration management.

The configuration/change control management process shall be fully documented, followed, and
sufficiently suitable to control software supporting SCFs.

a. Definition of hardware and software configuration items.
b. Identification of each configuration item's criticality to supported SCFs.

1. System Development Plans (SDP) or other appropriate artefact should document configuration
management/change control processes, and should demonstrate that the processes maintain the integrity
of hardware and software configurations.
Information Sources
RTCA DO-254
Reference:
STANAG
Reference:
Reference:
15.5 SOFTWARE ARCHITECTURE AND DESIGN.
15.5.1 Software architecture.

The software architecture and design shall be defined, shall properly implement the system/software
requirements, and be safe.

a. Allocation of system level requirements to the subsystem and software requirements.
b. Software functions that ensure system integrity (e.g., partition schemes).
c. Software architecture compatibility with the target hardware architecture.

1. System Description Documents (SDD) should define the software architecture and design.
2. Rig and ground testing should demonstrate that system/software requirements are properly
implemented.
3. System Safety Analysis (SSA) should demonstrate that the software architecture and design, and
implementation of system/software requirements is safe.
Information Sources
RTCA DO-254
SAE ARP4761
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
Information Sources
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.2 Software control structure and execution rates.

For each SSSE, the execution rates provided by the executive/control structure (considering priority
assignments and interrupt design) shall be consistently obtainable and sufficient to safely provide the
required performance for all SCFs supported.

a. The executive structure, or operating system, should be developed as safety/flight critical.
b. There is sufficient processing capacity to ensure that all SSE requirements are met despite priority task
assignments and interrupts.

1. Rig and ground testing should demonstrate that allowable data latencies are not exceeded and that
SSE requirements are met, while taking into account system loading, interrupts, and worst case timing
scenarios.
Information Sources
establishes timing and control STANAG 4671.1301
allocations based on Reference: 4671.1309
operational requirements; 3.3.4
addresses synchronization,
deterministic execution and
frame rate issues
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.3 Software architecture attributes and performance.

The software architecture and design, including the initialization, synchronization, timing, data flow,
control flow, interrupt structure, and data structures for all SSSEs shall be safe and sufficient to support
the required processing performance for all SCFs supported.

a. Sub-system/system integration, and identification of potential failure modes.

1. System Safety Analysis (SSA) should demonstrate that the software architecture and design is safe,
taking into account the initialization, synchronization, timing, data flow, control flow, interrupt structure,
worst case execution time, stack analysis, and data structures for all SSSEs.
2. Rig, ground and flight testing should demonstrate that software meets the required execution rates
under worst case timing conditions.
Information Sources
SAE ARP4761
DoD/MIL Doc: JSSG-2001: 3.3.3.1 provides Def-Stan 00-970 00-970 P0 S4
guidance for establishing Reference: 00-970 P13 1.7
adequate computer hardware STANAG
reserve capacity 4671.1301
JSSG-2008: 3.3 Reference: 4671.1309
addresses synchronization,
deterministic execution and
frame rate issues; 3.1.7 gives
overall architecture design
guidance along with specific
data latency discussions in
Lessons Learned
subparagraph l; 3.1.5.1 gives
guidance on data latency
issues
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.4 Dynamic operation.

The following shall be designed to safely operate under all dynamic conditions anticipated: mode inputs,
operational flight modes, failure monitoring and detection techniques, failure management functions,
redundancy management, voting schemes, self-checks, built-in-tests, safety interlock mechanizations,
SSSE interfaces supporting SCFs, health status interfaces, reconfiguration capabilities, and switchover of
command and control data links.

a. Transient effects of mode switching and condition changes.
b. Loss of control due to switchover of command and control data links.
c. Isolation of flight test features and software hooks for laboratory testing to prevent inadvertent
activation in flight.
d. The techniques for assessing self-health.
e. Integration, including sub-system/system integration and system/system integration for all normal and
failure states under all dynamic conditions.

1. Rig and ground testing, including system/subsystem integration tests, and FMET at various levels,
should demonstrate safe system operation taking into account all expected dynamic conditions and
modes throughout the design envelope.
Information Sources
RTCA DO-254
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 25.1701
CS 25.1707
CS 25.1709
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.5 Failure management and redundancy management.

The BIT and redundancy/failure management algorithms shall operate correctly.

a. The software coverage required for the BIT.
b. The required BIT success rate for the software covered.
c. Detection requirements for second and subsequent failures.
d. The failure and redundancy management algorithms successfully managing the failure condition
enabling continued SOF.
e. Failures between systems or sub-systems should be detected and prevented.

1. Rig and ground testing should demonstrate that BIT and redundancy/failure management algorithms
operate correctly.
Information Sources
Comm'l Doc: RTCA DO-178B
DoD/MIL Doc: RTCA DO-178C Def-Stan 00-970 00-970 P0 S4
JSSG-2008: 3.3.6.2 Reference: 00-970 P13 1.7
Information Sources
JSSG-2008 Appendix A: STANAG 4671.1301
3.3.6.2 establishes guidance Reference: 4671.1309
for CSCI failure detection and
execution of BIT; 3.1.13
(Requirement Guidance a. 2.)
defines types of BIT and a list
of typical items tested; 3.1.12
addresses redundancy
management
AC 20-115C
FAA Doc: AC 20-115B EASA CS CS 23.1301
CS 25.1301
CS 25.1309
CS 25.1701
CS 25.1707
CS 25.1709
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.6 Digital system failures.

To preclude SOF issues, the SSSEs shall have adequate techniques for: self-check; failure monitoring;
redundancy management; reconfiguration; voting; transient suppression; overflow protection; anti-
aliasing; saturation interlock; memory protection; and means for preventing failure propagation.

a. Initially agreeing and documenting the architecture design along with the required protection and
resilience attributes.
b. Use of a robust and approved design methodology.

1. Rig and ground testing should demonstrate that SSSEs have adequate techniques for: self-check;
failure monitoring; redundancy management; reconfiguration; voting; transient suppression; overflow
protection; anti-aliasing; saturation interlock; memory protection; and means for preventing failure
propagation.
Information Sources
3.1.11.9, 3.1.13, 3.1.17 and STANAG 4671.1301
3.3.2.1 provide guidance for Reference: 4671.1309
integrity and BIT checks often
implemented in software;
Information Sources
3.1.12.1 gives detailed
guidance for redundancy
management; 3.3.6.2 provides
guidance for robust integrated
CSCI design
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.7 Restart and reset capabilities.

The SSSE designs shall have the necessary provisions to restart and/or reset the system safely while in
flight.

a. The system hardware and software should be designed to work together to allow resets or restarts
without significant effects.
b. The architecture should be structured to allow: the required interrupts; data synchronisation & re-
synchronisation; and system re-initialisation and recovery to a safe state.

1. Rig, ground and flight testing should demonstrate in flight SSSE reset and/or restart capability.
Information Sources
RTCA DO-254
DoD/MIL Doc: JSSG-2008: 3.3 Def-Stan 00-970 00-970 P0 S4
3.1.12.1 discusses redundancy STANAG 4671.1301
management support for Reference: 4671.1309
restart; 3.2.4.6 addresses
software support for failure
recovery; 3.1.17 provides
guidance regarding failure
propagation of computational
failures; 3.3.2.2 discusses
microprocessor timing and
synchronization; 3.3.4 details
issues surrounding
synchronization rates; 4.1.13.2
provides lessons learned in
verification of in-flight
Information Sources
monitoring capability
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.8 Unsafe techniques.

SSSEs shall not utilize or include unsafe techniques or attributes (e.g., patches, de-activated code, lab
test functionality).

a. Configuration control methods.

1. Rig testing should demonstrate code coverage.
2. Inspection of the delivered software should demonstrate that no unsafe techniques or attributes are
included in software design.
3. Software release and change control records should detail all changes made to the software, and
reviews should not find any details of unsafe techniques or attributes.
Information Sources
Comm'l Doc: RTCA DO-178B
RTCA DO-254
SAE ARP4761
DoD/MIL Doc: JSSG-2008: 3.3.7 contains Def-Stan 00-970 00-970 P0 S4
guidance on Software Change Reference: 00-970 P13 1.7
Control STANAG 4671.1301
FAA Doc: AC 20-115C Functional design EASA CS CS 23.1301
integration of processing Reference: CS 23.1309
elements. CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.9 Resource capacity.

There shall be capacity and design margin for all processors, data channels (I/O, buses, etc.), and data
storage devices.

a. Establishing the minimum necessary processing capacity to complete all the SOF critical tasks without
incurring any unsafe system behaviour. This should include data throughput, memory, bus, and I/O
capacity using worst case scenarios;
b. Ensure adequate margin to allow for data latency, bus scheduling, re-start, etc.;
c. Agree spare capacity to allow for future system changes, upgrades, or additional functionality.

1. System Description Documents (SDD) should include details of excess capacity and design margin for
all processors, data channels (I/O, buses, etc.), and data storage devices.
Information Sources
RTCA DO-254
contains guidance regarding STANAG 4671.1301
reserve capacity; 3.1.14.6 Reference: 4671.1309
contains guidance for worst
case throughput and I/O spare;
3.5.7 establishes performance
parameters for spare capacity
and margin
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.5.10 Safety Supporting Software Elements (SSSE) performance.

All SSSEs shall provide acceptable performance and safety.

a. Ensuring software requirements and interfaces are accurate, consistent, unambiguous, stated in
quantifiable terms with tolerances, sufficiently detailed, and verifiable.

1. System Safety Assessment (SSA) should demonstrate the safety of all SSSEs.
2. Rig, ground and flight testing should demonstrate the adequate performance of all functions of SSSEs.
Information Sources
Information Sources
STANAG 4671.1301
CS 25.1301
CS 25.1309
CS 25.1701
CS 25.1707
CS 25.1709
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.6 SOFTWARE QUALIFICATION AND INSTALLATION.
15.6.1 Software test methodology.

Each SSSE shall be tested and integrated in a multi-level approach from the software component level to
the integrated system level and there shall be adequate test coverage at each level of testing.

a. Test coverage at all levels. Levels include:
- Unit testing.
- Component testing.
- Computer Software Configuration Items (CSCI) testing on target hardware.
- CSCI integration testing.
- Subsystems testing.
- Systems integration testing, including operator-in-the-loop testing.
- SCF Thread Testing.
- Iron bird testing.
- Flying test bed testing.
- Aircraft level testing.
- Ground testing.
- Flight testing.

a. A test plan should assess requirements coverage, failure condition testing (out-of-bounds, off-nominal
and robustness) and regression testing, and should document the required testing at each appropriate
level.
Information Sources
STANAG 4671.1301
Information Sources
CS 25.1301
CS 25.1309
CS 25.1701
CS 25.1707
CS 25.1709
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.6.2 Full qualification of software.

All SSSEs released for flight shall be fully qualified.

1. System Requirements Documents (SRD) should include all software requirements, which should be
traceable through to the software programme.
2. SRD should include SOF requirements.
3. System Development Plan (SDP) should document the rigorous and approved software development
methodology, including but limited to.
i. Use of an approved software language, along with approved development and support tools.
ii. Use of formal reviews and audits of the software.
iii. Full and accurate documentation of the software - its development and testing.
iv. Robust configuration control.
v. Full test of each complete software release.
Information Sources
Comm'l Doc: IEEE STD 12207 provides
industry best practice software
development guidance.
RTCA DO-178C
RTCA DO-254
JSSG-2008: 3.1.14.6, 3.2.4.6, Reference: 00-970 P13 1.7
3.3.6+ and 3.3.7+ provide STANAG 4671.1301
guidance regarding software Reference: 4671.1309
design and development for
safety critical systems
ASC Engineering Technical
Guide version 1.1 dated 11
October 2002 established an
integrity program for software
development
Information Sources
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.6.3 Software build process.

The software build process for SSSEs shall be safe.

a. Integration of each element into the complete system.
b. Integration of the complete system into the air vehicle.

1. System Development Plan (SDP) should document the established and proven methodology to be
used to record all aspects of the Operational Flight Profile (OFP) life cycle, including but not limited to:
requirements, design, build, integration, and testing.
Information Sources
addresses breaking down STANAG 4671.1301
complex software into Reference: 4671.1309
manageable CSCIs; 3.2.2.2
discusses subsystem
integration; 4.3 discusses
verification of integrated
processing capabilities; 3.3.1
provides guidance for
integrated architecture design
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.6.4 Software load compatibility.

Adequate configuration management controls shall be in place to ensure proper/ functionally compatible
software loading for the intended use on the aircraft .

a. A matrix of allowable hardware/software versions ; which should encompass all allowable inter and
intra system loads;
b. A robust configuration control process , which should record and manage what software is loaded
where;
c. Provision of a means to easily cross check a) and b) above;
d. Allowable versions of system software, which should be carefully controlled to prevent inappropriate
versions or combinations being loaded onto the aircraft .

1. System Development Plans (SDP) or other appropriate artefact should document configuration
management/change control processes, and should demonstrate that the processes maintain the proper/
functionally compatible software loading for the intended use on the aircraft.
Information Sources
provides guidance regarding STANAG 4671.1301
OFP version control and Reference: 4671.1309
integrity
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
15.6.5 Software load process.

The software loading and load verification processes for all software shall be safe and correct.

a. The SOF OFP should be fully documented and produced using a robust and approved methodology;
b. A robust configuration control process should be employed to record and manage which OFP is loaded
where;
c. A comprehensive test plan for the OFP is developed and followed leading to successful rig and aircraft
ground tests before flight. This should encompass use of approved field loading devices.

1. Technical publications should detail software loading and load verification processes for all software.
2. Rig and ground testing should demonstrate that software can be loaded safely and correctly when
following the defined loading procedure.
Information Sources
Information Sources
gives guidance for single point STANAG 4671.1301
OFP load and verification; Reference: 4671.1309
3.3.7 addresses software
change control; 3.3.8
addresses software
certification of hardware
compatibility; 3.1.14.6
discusses system
invulnerability to software
errors
CS 25.1301
CS 25.1309
CS 27.1301
CS 27.1309
CS 29.1301
CS 29.1309
AMC 20-115C
SECTION 16 - MAINTENANCE
This section includes criteria for servicing and maintenance activity and oversight.
16.1. MAINTENANCE MANUALS/CHECKLISTS.
16.1.1 Servicing instructions.

Servicing instructions shall be provided for all systems that require servicing.
a. All aircraft systems, including fuel, engine oil, hydraulic systems, landing gear struts, tyres, oxygen,
escape system, etc.

1. Instructions for Continued Airworthiness should include requirements for servicing of aircraft systems,
and the procedures for carrying out such servicing.
Information Sources
Comm'l Doc:
JSSG-2001: 3.1.5 Reference: 00-970 P1 4 4.26
STANAG 4671.1501
4671 Appendix G
FAA Doc: 14CFR references: 23.1501, EASA CS CS 23.1501,
23.1529, 25.1501, 25.1503- Reference: CS 23.1523
25.1533, 25.1529, 25.1541, CS 23 Appendix G
25.1543, 25.1557, 25.1563
CS 25.1501
14CFR reference Part 23,
CS 25.1529
Appendix G and Part 25,
CS 25 Appendix H
Appendix H, Instructions for
CS 27.1501
Continued Airworthiness
CS 27.1529
CS 27 Appendix A
CS 29.1501
CS 29.1529
CS 29 Appendix A
16.1.2 Cautions and warnings.

Cautions and warnings shall be included in maintenance manuals, aircrew checklists, and ground crew
checklists.

a. Ensuring the cautions and warnings and associated technical information maximises the safety of
personnel by providing clear and unambiguous instructions for preventative or remedial actions.
1. Instructions for Continued Airworthiness should include clear and unambiguous warnings and cautions.
All associated technical information should inform personnel of the preventative or remedial action that
should be taken.
Information Sources
Comm'l Doc:
DoD/MIL Doc: 14CFR: 23.1501, 23.1529, Def-Stan 00-970 00-970 P1 4.4.25
25.1501, 25.1503-25.1533, Reference:
25.1529, 25.1541, 25.1543, STANAG
25.1557, 25.1563 4671.1501
4671.1541
4671.1581
4671 Appendix G
FAA Doc: 23.1501, 23.1529, 25.1501, EASA CS CS 23.1501
25.1503-25.1533, 25.1529, Reference: CS 23.1529
25.1541, 25.1543, 25.1557, CS 23.1581
25.1563
CS 23.1589
CS 23 Appendix G
CS 25.1501
CS 25.1529
CS 25.1581
CS 25.1591
CS 25 Appendix H
CS 27.1501
CS 27.1529
CS 27.1581
CS 27.1589
CS 27 Appendix A
CS 29.1501
CS 29.1529
CS 29.1581
CS 29.1589
CS 29 Appendix A
16.1.3 Maintenance checklists.

Maintenance checklists shall be available for critical maintenance tasks.

a. Procedures for replenishments such as fuel and oxygen;
b. Towing procedures including restrictions;
c. Jacking and trestling procedures;
d. Engine operation during maintenance (engine running guards and tie down etc.);
e. Flight servicing.

1. Instructions for Continued Airworthiness should include checklists for all critical maintenance tasks.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.6.1, 3.6.2 Def-Stan 00-970
JSSG-2001: 3.1.5 Reference:
14CFR: 23.1501, 23.1529, STANAG 4671.1529
25.1501, 25.1503-25.1533, Reference: 4671 Appendix G
25.1529, 25.1541, 25.1543,
25.1557, 25.1563
FAA Doc: 23.1501, 23.1529, 25.1501, EASA CS CS 23.1529
25.1503-25.1533, 25.1529, Reference: CS 23 Appendix G
25.1541, 25.1543, 25.1557, CS 25.1529
25.1563
CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
CS 29 Appendix A
16.1.4 Support equipment.

Support equipment shall not adversely affect the safety of the aircraft.

a. Equipment or vehicles which are directly connected to the aircraft vehicle or used in close proximity to
it, including but not limited to:
i. Towing arms
ii. Towing vehicles
iii. Ground power sets (electrical, hydraulic, or pneumatic)
iv. Special to type test equipment or rigs
v. Replenishment equipment
vi. Weapon loading vehicles and equipment
vii. Cargo handling vehicles and equipment
b. Authorisation of all support equipment required to support the air vehicle with any limitations
documented;
c. Clear identification of any maintenance requirements for the support equipment and appropriate record
keeping;
d. Abnormal operation of special to type test equipment (STTE).

1. Instructions for Continued Airworthiness should include details of all support equipment approved for
use on the aircraft, including any procedures and limitations associated with their use.
2. Rig and ground testing should demonstrate that all approved support equipment can be used without
adversely affecting the safety of the aircraft, when operated in accordance with defined procedures and
limitations.
Information Sources
Comm'l Doc:
JSSG-2001: 3.1.5 Reference: 00-970 P1 6.11.21
STANAG 4671.635
Information Sources
4671 Appendix G
FAA Doc: 23.1501, 23.1529, 25.1501, EASA CS CS 23.1529

25.1503-25.1533, 25.1529, Reference: CS 23 Appendix G
25.1541, 25.1543, 25.1557, CS 25.1529
25.1563
CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
CS 29 Appendix A
16.1.5 Removal procedures.

Maintenance manuals shall incorporate procedures for system/component removal.

a. Specifying the tooling required for component removal.
b. Including any additional procedures to take account of any removable equipment that might be fitted to
the aircraft (weapons, role equipment, etc.) that may need to be removed prior to the removal of a
component.

1. Aircraft Maintenance Manuals (AMM) should include procedures for system/component removal.
2. Analysis should demonstrate that the AMM includes all necessary procedures for the safe installation
and removal of systems and components, including but not limited to all procedures which support the
safety of the aircraft as documented in System Safety Assessments (SSA).
Information Sources
Comm'l Doc:
STANAG 4671.1529
Reference: 4671 Appendix G
FAA Doc: 14CFR reference Part 23, EASA CS CS 23.1529

Appendix G and 14CFR Reference: CS 23 Appendix G
reference Part 25, Appendix H CS 25.1529
CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
CS 29 Appendix A
16.1.6 Operational testing.

Maintenance manuals shall include procedures for testing of normal/emergency system operation after
removal/replacements of parts.

a. Degree of testing required, dependent on component replaced.
b. Testing required after disturbing systems, e.g. as a means of accessing other areas of the aircraft .
c. Any inter-system testing that may be required.
d. Any requirement for testing after changing a software load.

1. Aircraft Maintenance Manuals (AMM) should include procedures for operational testing of
normal/emergency systems after removal/replacements of parts.
Information Sources
Comm'l Doc:
STANAG 4671.1529
FAA Doc: 14CFR reference Part 23 EASA CS CS 23.1529

CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
CS 29 Appendix A
16.1.7 Troubleshooting procedures.

Maintenance manuals shall provide adequate troubleshooting procedures to diagnose and allow
correction of expected system/component failures.

a. Ensuring any special to type test equipment or tools required are also listed.

1. Aircraft Maintenance Manuals (AMM) should include troubleshooting procedures to diagnose and allow
correction of expected system/component failures.
Information Sources
Comm'l Doc:
STANAG 2445
4671.1529
Information Sources
FAA Doc: 14CFR reference Part 23, EASA CS CS 23.1529
CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
CS 29 Appendix A
16.1.8 Non-destructive inspections.

In-service, non-destructive inspection techniques, inspection intervals, damage limits and detailed repair
procedures shall be included in appropriate technical publications.

a. Use of non-destructive testing methods, such as eddy-current, magnetic-particle, liquid penetrant,
radiographic, and ultrasonic testing.
b. Use of other non-destructive inspection methods such as visual and tactile inspection.
c. Ensuring that inspection intervals and damage limits are appropriate to the type of inspection carried
out.

1. Instructions for Continued Airworthiness should include non-destructive inspection techniques,
inspection intervals, damage limits and detailed repair procedures.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671 G.3
Reference:
FAA Doc: EASA CS CS23 G23.3
Reference: CS25 H25.3
CS27 A27.3
CS29 A29.3
16.2. INSPECTION REQUIREMENTS.
16.2.1 Special inspection procedures.

Special inspection procedures shall be available for unusual or specified conditions.

a. Exceeding operating limits;
b. Severe vibration;
c. Engine stall;
d. Foreign object damage to engine or structure;
e. Excessive loss of oil;
f. Conditions requiring oil sampling and analysis;
g. Severe braking action, hard landing, and running off runway;

h. Air vehicle subject to excessive "g" loads or manoeuvres outside the specified flight envelope;
i. Emergency procedures implemented;
j. Dropped objects or parts.
k. Operation in, or in the vicinity of, a volcanic ash cloud.

1. Instructions for Continued Airworthiness should include inspection procedures for all unusual or
specified conditions as listed in this criterion.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-PRF-5096: 3.2.2.3.1 gives Def-Stan 00-970 00-970 P1 1.1.29
guidance regarding special Reference:
inspections after a specific STANAG
occurrence. 4671.1501
JSSG-2000: 3.6.1, 3.6.2 Reference: 4671.1529
JSSG-2001: 3.1.5 4671 Appendix G

CS 23 Appendix G
CS 25.1501
CS 25.1529
CS 25 Appendix H
CS 27.1501
CS 27.1529
CS 27 Appendix A
CS 29.1501
CS 29.1529
CS 29 Appendix A
16.2.2 Life-limited parts.

Life-limited items and replacement intervals shall be identified using relevant test and development data.

a. Ensuring that all life-limited items have been identified;
b. Ensuring that appropriate lives have been allocated to the item (FMECA and R&M predictions);
c. Ensuring that items are fitted with elapsed time indicators, magnetic chip detectors etc. where possible
to record operational usage;
d. Defining a programme of in-service monitoring to ensure that the assigned predicted life is appropriate
(not too long or too short).

1. Instructions for Continued Airworthiness should include details of life-limited items and replacement
intervals, which should be based on relevant test and development data.
Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: MIL-PRF-5096: 3.2.2.3.1 gives Def-Stan 00-970 00-970 P1 1.1.29
guidance regarding special Reference:
inspections after a specific STANAG
occurrence. 4671.1501
JSSG-2000: 3.6.1, 3.6.2 Reference: 4671.1529
JSSG-2001: 3.1.5 4671 Appendix G
FAA Doc: 23.1501, 23.1529 EASA CS CS 23.1501

CS 23 Appendix G
CS 25.1501
CS 25.1529
CS 25 Appendix H
CS 27.1501
CS 27.1529
CS 27 Appendix A
CS 29.1501
CS 29.1529
CS 29 Appendix A
16.2.3 Inspections and intervals.

All required inspection intervals shall be identified using relevant operational and development (i.e. test)
data.

a. Ensuring the inspection periodicity has been justified;

1. Instructions for Continued Airworthiness (recognised through the Maintenance Planning Documents)
should include details of life-limited items and replacement intervals, which should be based on relevant
test and development data.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.6.1, 3.6.2 Def-Stan 00-970 00-970 Pt 1 3.2.17
JSSG-2001: 3.1.5 Reference: 00-970 Pt 1 3.2.18
MIL-PRF-5096: 3.2.1.1.1 gives 00-970 Pt 1 3.2.19
guidance regarding frequency 00-970 Pt 1 4.4.6
of maintenance items STANAG 4671.1529
Reference: CS 23 Appendix G
CS 25.1529
CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
Information Sources
CS 29 Appendix A
16.3 INSTRUCTIONS FOR CONTINUED AIRWORTHINESS
16.3.1 Preparation of Instructions for Continued Airworthiness

Instructions for Continued Airworthiness shall be prepared.

a. Ensuring that Instructions for Continued Airworthiness contain a section titled Airworthiness Limitations
that is segregated and clearly distinguishable from the rest of the document.

1. Instructions for Continued Airworthiness should include all relevant information, drawings and
processes for maintaining the continued airworthiness of the aircraft.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1529
Reference: CS 23 Appendix G
CS 25.1529
CS 25 Appendix H
CS 27.1529
CS 27 Appendix A
CS 29.1529
CS 29 Appendix A
SECTION 17 - ARMAMENT/STORES INTEGRATION

This section covers the installation, integration, interface and operation of the aircraft armament system,
including guns/rockets, stores and in particular laser systems.
• Fixed and free guns/rockets.

• Stores - A store is any device intended for internal or external carriage, mounted on aircraft
suspension and release equipment, which may or may not be intended to be for in-flight
separation from the aircraft. Stores include missiles, rockets, bombs, nuclear weapons, mines,
fuel and spray tanks (permanently attached and/or detachable), torpedoes, sonobuoys,
dispensers, pods (refuelling, thrust augmentation, gun, electronic countermeasures, etc.), targets,
decoys, chaff and flares, and suspension equipment.
• Laser systems fitted to the aircraft.
• aircraft and personnel protection from third party laser systems.
• Specific safety interlock systems to prevent inadvertent operation of the aircraft armament
system.
Where necessary specific aircraft system integration criteria are included. However, more general system
integration issues (HF, EMC, Electrical etc.) are covered elsewhere in the handbook.
When designing store equipment, the general air worthiness criteria for aircraft equipment and systems,
as well as the overall aircraft flight control and flight performance should always be considered. Some
verify criteria in this chapter are supported in the text by examples of specific considerations. These
examples are by no means to be considered as exhaustive. All criteria should at least be verified for:
• All normal and emergency (failure) conditions.

• All configurations to be certified, including those with other stores, and including all download
configurations.
Where an information source is highlighted, in general it is implied that any higher level requirement on
the same subject stated in the parent paragraphs is applicable too, as well as each lower level
requirement contained in any subparagraph. The links to references are by no means to be considered as
exhaustive.

1. User requirements and design requirements and validation results
4. Component and functional level SOF, qualification and certification tests
6. Plume ingestion/propulsion compatibility tests and plume/gun gas impingement test.
7. Failure modes, effects, and criticality analysis/testing (FMECA/FMET)
8. Hazard analysis and classification including explosive atmosphere analysis/test
9. Safety certification program
10. Computational, theoretical and/or semi-empirical prediction methods
11. Configuration: aerodynamic design and component location
12. Wind tunnel test results and correction methods
13. Mathematical representation of system dynamics
14. Loads analysis, wind tunnel and flight test results

15. Flutter, mechanical stability, aeroelastic, aeroservoelastic and modal analyses, wind tunnel and flight
test results
16. Performance analysis
17. Environmental compatibility analysis and tests including gun fire vibration analysis/test
18. Interface control documents
19. Store separation models, wind tunnel and flight test results
20. Flight manual
21. Flight test plan and test results
22. MIL-HDBK-1763, Aircraft/Stores Compatibility: Systems Engineering Data Requirements and Test
Procedures
23. MIL-HDBK-244, Guide to Aircraft/Stores Compatibility
24. MIL-STD-1760, Aircraft/Store Electrical Interconnection System
25. MIL-A-8591, Airborne Stores, Suspension Equipment and Aircraft-Store Interface (Carriage Phase);
General Design Criteria for
26. SEEK EAGLE engineering data
27. American National Standard for Safe Use of Lasers (ANSI Z136.1)
28. Nuclear Certification Impact Statement (NCIS)
29. Aircraft monitor and control (AMAC) and surveillance tests
30. Nuclear safety analysis report (NSAR)
31. Mechanical compatibility data
32. Electrical compatibility data
33. Certification requirements plan (CRP)
34. Operational flight program (OFP) source code
35. Systems integration lab data/results
36. Cooling analysis and ground/flight test results
37. MIL-STD-1530 Aircraft Structural Integrity Program
38. ASC/EN Stores Integration practice
39. Human factors to consider
40. Crew egress paths to consider
41. Aircraft weight and balance
42. Environmental analysis and test results
43. Store drawings including store mass properties (STAMP sheet)
44. Safety assessment report
45. Airworthiness qualification plan (AQP) (Army unique)
46. Airworthiness qualification specification (AQS) (Army unique)
17.1 GUN/ROCKET INTEGRATION AND INTERFACE.
17.1.1 Gun/rocket induced environments.

The installation and integration of guns/rockets shall not adversely affect the operational function or safety
of the aircraft. This includes the environment induced by operation of the gun/rocket with respect to
muzzle blast and over-pressure, recoil, vibro-acoustics, cooling, egress, human factors and structural
loads.
Consideration of the following shall be given to the location of such installations:

a. The effect of flammable gas as a hazard to the aircraft.
b. The effects of gun firing directly on the engines, structures and other systems and indirectly, by
changes to rotorcraft or equipment permanent magnetism, on compass detector units.
c. The effects of the installation on the aircraft aerodynamics and the safety of the aircraft, crew or
maintenance personnel.
d. The installation purging system.
e. The temperature conditions in the gun and ammunition compartments shall permit the aircraft to utilise
its full flight envelope without restrictions caused by exceeding the max/min. permissible temperatures of
the gun and ammunition.
f. With the exception of the designed openings in the installation, the gun and ammunition compartments
shall be sealed to prevent the ingress of contaminants, particularly when the rotorcraft is on or near the
ground.

1. Verification is accomplished by initial installation testing, qualification testing, physical fit checks, static
ground fire testing, safety analysis, safe separation testing, and live fire testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516B 17.1.1 Def-Stan 00-970 00-970 P13 3.1.5*
MIL-HDBK-244: para 5.1.6, Reference: 00-970 P13 3.2.3*
5.1.9.1, 5.1.9.2, 5.1.9.2.4, 00-970 P13 3.2.18*
5.1.10, 5.2.5, 5.3, 5.3.12.2 00-970 P13 3.2.36
(unverified - Expanded 516 00-970 P13 3.3.1
and NL516) 00-970 P13 3.3.2*
MIL-HDBK-1763: para 4.1.4. 2, 00-970 P13 3.3.7
4.1.4.7, 4.1.4.10; test 160, 270 00-970 P13 3.3.8*
(unverifed- NL516) 00-970 P7 L709 2.2.2
00-970 P7 L709 8
*(unverified- NL516)
AIR 2004E (unverified- FR)

REACH Process (unverified-
FR)
STANAG
Reference:
FAA Doc: EASA CS
Reference:
17.1.2 Gas and plume hazards.

Gun/rocket gases and plume shall not adversely affect the safety of the aircraft, aircrew and maintenance
personnel.

a. SOF hazards, including:
i. The location of gun/rockets to avoid high temperature efflux impinging on the engine or other stores and
release systems.
ii. The location of gun/rockets to avoid contamination of the engine or other stores and release systems.
iii. The muzzle velocity, firing rate and type of propellant used in the gun ammunition or rocket.
iv. The ability of the engine to tolerate ingested gases to suitable limits to be agreed and verified.
v. The effect of metallic particles in the plume on aircraft sensors and stores and release systems.
vi. The design of the engine intake.
vii. Tolerable ingestion of gases or pressure waves caused by gun/rocket operation.
b. Impingement on the aircraft structure/skin and/or stores, including:
i. Unacceptable degradation leading to a reduction in structural integrity
ii. Undesirable aerodynamic characteristics
iii. The location of stores to avoid efflux from gun/rocket gases.
iv. The ventilation/purge system shall not allow the flammable gas concentration to exceed suitable limits
to be agreed and verified
c. A ventilation / purge system, to prevent the accumulation of flammable gas to an explosive level,
including:
i. Gun gases purging flow shall be established before firing commences.
ii. Ventilation of any tank in which empty cases are collected.
iii. Purging of gases shall happen as close to the source as possible.
iv. The ventilation/purge system shall not allow the flammable gas concentration to exceed suitable limits
to be agreed and verified.
v. The ability to withstand without damage any localised ignition that may occur below the suitable limits
to be agreed and verified.

ground fire testing, safety analysis, safe separation testing, and live fire testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516B 17.1.2, Def-Stan 00-970 00-970 P1 6.9.25*
17.1.3, 17.1.4 Reference: 00-970 P13 3.1.5*
MIL-HDBK-244A: para 5.1.9, 00-970 P13 3.2.3*
5.1.10.9 (unverified NL516) 00-970 P13 3.2.18
MIL-HDBK-1763 4.1.4.7.2, 00-970 P13 3.2.19
4.1.4.7, 4.1.4.10; test 160, 270 00-970 P13 3.2.36*
(unverified NL516) 00-970 P13 3.2.37
00-970 P13 3.3.2*
00-970 P13 3.3.7
00-970 P13 3.3.8*
00-970 P13 3.3.12*
00-970 P13 L5 5.1
00-970 P1 L6 5.1
00-970 P13 S4 L6
00-970 P13 S4 L7
Information Sources
00-970 P1 L710/4
00-970 P7 L709 8
00-970 P9 UK587c
00-970 P11 S4.5
STANAG
Reference:
FAA Doc: EASA CS
Reference:
17.1.2.1 Sensor hazards.

Munitions gases and plume shall not create an unsafe condition by obscuring primary sensor or weapons
designation systems (e.g., laser, radar, etc.) when employing munitions.

a. Effects on weapons designation system caused by blast effects, debris and weapons rate of fire.

ground fire testing, safety analysis, safe separation test certification, and live fire testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-244 Def-Stan 00-970 00-970 P13 3
Reference: 00-970 P9 UK587c
STANAG
Reference:
FAA Doc: EASA CS
Reference:

17.2 STORES INTEGRATION.
17.2.1 Store clearance.

The installation, integration and interface of the aircraft and stores, shall not create unsafe conditions
during ground and flight operations, including the position of store stations and creation of an unsafe
environment for maintenance personnel.
The following considerations are to be made when designing stores installations and the location of store
installations:
a. Clearance between stores and surroundings.
b. Store loading and unloading procedures.
c. The armament system shall be such that no single point failure shall adversely affect the safety of the
aircraft. The use of differently sized/oriented connectors to avoid misconnection.
d. The installation of stores shall allow for their safe jettison, or deactivation if required, in order to protect
the aircraft or for operational/safety reasons following a malfunction.
e. The possibility to release mechanically any store and/or its jettisonable carrier without entering the
cockpit (Particularly for Rotorcraft);
f. The store shall not become armed until it has successfully separated from its release unit or launcher.
g. The environment induced by the stores on the aircraft, and by the aircraft on the store during carriage
and launch/separation/jettison.
h. The effect of high temperature efflux from engines, rockets or missiles impinging on the store or its
release system.
i. Contamination of stores and release systems by engine exhaust, fuels, oil or any substance which
could adversely affect the armament system.
j. Unacceptable aircraft flying qualities result from the release of stores.

1. Stores/aircraft interface is verified by test.
2. Stores loading/unloading procedures are verified by demonstration using the stores loading manual.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516B 6.3.1.5, Def-Stan 00-970 00-970 P1 1.1.33*
17.2.1, 17.2.2, 17.2.3 Reference: 00-970 P1 1.1.34*
MIL-HDBK-1763 para 4.1.4.6, 00-970 P1 2.6.7
4.1.4.7, 4.1.4.8, 4.1.4.10, 00-970 P1 2.7.8
4.1.4.11; test 140, 150, 160, 00-970 P1 2.23.5*
220 (unverified NL516) 00-970 P1 2.23*
MIL-HDBK-244A para 5.1.8.1, 00-970 P1 2.24.2
5.1.8.2, 5.1.8.3, 5.1.8.4, 00-970 P1 2.24.18
5.1.10.3, 5.1.10.4, 5.1.10.5.2, 00-970 P1 4.19.40*
5.1.10.9, 5.3.12.1, 5.3.12.2, 00-970 P13 3.1.4
5.3.12.3, 5.4.3 (unverified 00-970 P13 3.1.5*
NL516) 00-970 P13 3.2.1
MIL-STD-1289D 00-970 P13 3.2.6
MIL-STD-464 00-970 P13 3.2.8
MIL-HDBK-1760A 00-970 P13 3.2.9
MIL-STD-1760D 00-970 P13 3.2.10
MIL-STD-331 00-970 P13 3.2.17
MIL-STD-27733 00-970 P13 3.2.18
MIL-STD-8591 00-970 P13 3.2.19
JSSG-2001: 3.3, 10.1.1, 00-970 P13 3.2.20
3.4.2.1.5, and 3.4.2.2 for the 00-970 P13 3.2.34*
testing methodology. 00-970 P7 L100 16
JSSG-2000A 6.3.25
JSSG-2001A 4.1.1.2, 4.4.1.1, *(unverified- NL516)
4.4.1.2, App C 4.4, 4.5 STANAG 3109
Reference: 3230
FAA Doc: EASA CS
Reference:
17.2.2 Safe separation.

Both internal and external stores shall separate safely from the aircraft throughout the aircraft and store
launch/release/jettison flight envelope. The successful separation of stores shall not impart any adverse
flying qualities (including excessive pilot workload) or result in any dangerous flight conditions.

a. Release of internally carried stores shall not be possible until the bomb bay doors are fully open.
b. Indication to the crew in the event of a failed separation (hangfire or misfire).
c. An appropriate release mechanism shall be used (i.e. Ejector Release Unit (ERU) or an
Electromagnetic Release Unit (EMRU)).
d. Operation sequencing (i.e. undercarriage travel)

1. Safe separation is verified by Computational Fluid Dynamics (CFD) models, wind-tunnel testing, safe
separation flight testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-STD-1289 Def-Stan 00-970 00-970 P1 2.6.7
MIL-HDBK-516B 6.3.1.5, Reference: 00-970 P1 2.7.8
17.2.1, 17.2.2, 17.2.3 00-970 P1 2.24.2
MIL-HDBK-244A: para 5.1.1.2, 00-970 P1 2.24.17
5.1.9, 5.3.2, 5.3.6, 5.3.7, 5.3.10 00-970 P1 2.24.18
(unverified NL516) 00-970 P13 3.1.5*
MIL-HDBK-1763: para 4.1.4.5, 00-970 P13 3.2.11*
4.1.4.7, 4.1.4.10; test 110, 140, 00-970 P13 3.2.12*
160, 270, 280 (unverified 00-970 P13 3.2.17*
NL516) 00-970 P13 3.2.18*
JSSG-2000A 6.3.25 00-970 P13 3.2.22*
JSSG-2001A 4.1.1.2, 4.4.1.1, 00-970 P13 3.2.23*
4.4.1.2, App C 4.4, 4.5 00-970 P13 3.2.24*
00-970 P13 3.2.31*
00-970 P13 3.2.34*
00-970 P13 3.3.2*
00-970 P13 3.3.13*
00-970 P13 3.1.4
00-970 P13 3.2.1
00-970 P13 3.2.12
00-970 P13 3.2.17
00-970 P7 L710 5.2
STANAG
Reference:
FAA Doc: EASA CS
Reference:
17.2.3 Store, suspension and release equipment structural integrity.

The aircraft, store and release equipment installations shall meet the strength and stiffness requirements
for operating safely within the aircraft/Store carriage flight envelope.

a. Taxiing with stores.
b. Carriage.
c. Operation.
d. Release.
e. Landing with stores.

1. Store and suspension/release equipment structural integrity are verified by Finite Element Models
(FEM), Computational Fluid Dynamics (CFD) models, wind-tunnel testing, captive carriage flight testing
and ejection/jettison testing.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516B 17.2.3 Def-Stan 00-970 00-970 P1 2.23
MIL-HDBK-244A: para 5.1.6, Reference: 00-970 P13 3.1.5
5.1.10.2, 5.1.10.3, 5.1.10.4, 00-970 P13 3.3.1*
5.1.10.6, 5.2.5, 5.3.10, 5.3.11, 00-970 P7 L710 3.1
5.3.16 (unverified NL516)
MIL-HDBK-1763: para 4.1.4.2, *(unverified- NL516)
4.1.4.4; test 110, 120, 130, STANAG
140, 160, 200, 210, 250, 260, Reference:
(unverified NL516), Test 131
FAA Doc: EASA CS
Reference:
17.2.4 Electrical interfaces.

Electrical interfaces in the armament system shall not cause unsafe stores operation, including
uncommanded jettison, or unsafe interactions with the aircraft in all possible stores configurations.

a. It shall not be possible to make incorrect mechanical or electrical connections.
b. Failure to make any connection properly shall not create a situation where damage to the aircraft can
occur during carriage or after release of the store.
c. Static lines, umbilicals, electrical fuse arming leads, fuse arming cable assemblies, shear wire
assemblies and lanyards shall not become crossed or entangled with the lines of other stores.
d. The use of a Built-In-Test (BIT) facility.

1. Aircraft electrical/logical interfaces are verified by System Integration Laboratory test, EMI/EMC test,
Hazards of Electromagnetic Radiation to Ordnance (HERO) test and flight test.
Information Sources
Comm'l Doc:
Information Sources
DoD/MIL Doc: MIL-HDBK-516B 17.2.4 Def-Stan 00-970 00-970 P13 3.1.4*
MIL-HDBK-244A para 5.1.3, Reference: 00-970 P13 3.1.5*
5.1.4, 5.2.2, 5.2.3, 5.2.4, 5.3.9, 00-970 P13 3.2.1,
5.4.2 (unverified NL516) 00-970 P13 3.2.2*
MIL-HDBK-1760 00-970 P13 3.2.4,
MIL-HDBK-1763: para 00-970 P13 3.2.5*
4.1.4.6.2.g (unverified NL516) 00-970 P13 3.2.6*
00-970 P13 3.2.7*
00-970 P13 3.2.23
00-970 P13 3.2.24
00-970 P13 3.2.35*
00-970 P13 3.4.4*
00-970 P13 3.4.5*
00-970 P9 UK1351c
STANAG
Reference:
FAA Doc: EASA CS
Reference:

17.2.6 Safe store operations.
The combination of stores fitted to the aircraft shall not reduce safety by adversely affecting flight control.

a. The most extreme asymmetric loading of stores (including symmetric thrust);
b. Store hang-up;
c. Sequencing of stores release and jettison;
d. Adverse effects on stability, handling and rolling characteristics.

1. Verification is accomplished by physical fit and function, loading/installation procedures, aeroelastic
ground vibration test, wind tunnel tests, effects of aircraft on captive stores/suspension equipment, effects
of stores/suspension equipment on aircraft, environmental vibration tests, aeroacoustic test, HERO test,
EMI/EMC, ballistic tables, temperature extremes and thermal test, and SIL.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1763 para 4.1.4.3; Def-Stan 00-970 00-970 P1 2.6.7
test 140, 230, 250 (unverified Reference: 00-970 P1 2.7.8
NL516) 00-970 P1 2.9.7
MIL-HDBK-244A para
00-970 P1 2.13.7
5.1.1.1.2, 5.1.7, 5.1.10.6.6,
00-970 P1 2.14.9
5.1.10.6.7, 5.1.10.8, 5.3.7
00-970 P1 2.16.12
(unverified NL516)
00-970 P1 2.20.11
Information Sources
MIL-STD-1289D 00-970 P1 2.24.12*
JSSG-2001: 3.3, 10.1.1, 00-970 P1 2.24.17*
3.4.2.1.5, and 3.4.2.2 for the 00-970 P1 2.24.18*
testing methodology. 00-970 P1 6.9.22*
MIL-STD-464 00-970 P13 3.1.5*
MIL-HDBK-1760A 00-970 P13 3.2.11*
MIL-STD-1760D 00-970 P13 3.2.20*
MIL-STD-331 00-970 P13 3.2.3*
00-970 P13 3.3.1*
STANAG
Reference:
FAA Doc: EASA CS
Reference:
17.2.7 Store configurations.

All cleared stores configurations for the aircraft shall be documented in the aircraft document set.

a. Safe release envelopes and flight limits
b. Proper loading procedures
c. Appropriate store checklists
d. Correct employment data for operational employment planning.

1. Validation/Verification of technical publications (e.g., flight manuals, maintenance manuals)
accomplished by maintainers to ensure proper loading/unloading procedures.
2. Round testing to verify all store configurations.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1763 para 4.4.2.3; Def-Stan 00-970 00-970 P1 7.1.7*
test 100, 240 9unverified Reference: 00-970 P1 7.5.3
NL516)
MIL-HDBK-244A para 5.1.7.2.4
(unverified NL516)
STANAG
MIL-STD-1289D
Reference:
JSSG-2001: 3.3, 10.1.1,
3.4.2.1.5, and 3.4.2.2 for the
testing methodology.
MIL-STD-464
MIL-HDBK-1760A
MIL-STD-1760D
MIL-STD-331
FAA Doc: EASA CS
Reference:

17.2.9 Lost link.
A lost-link condition during a weapons engagement shall be considered and hazards minimized and/or
mitigated.

a. Ensuring that weapon system transitions to a predetermined state and mode in the event of loss or
corruption of the command and control link.

1. Verification is accomplished by analysis (e.g., fault tree analysis, system safety analysis), avionics
tests, and ground and flight demonstrations and tests.
Information Sources
Comm'l Doc:
DoD/MIL Doc: ADS-44-HDBK Def-Stan 00-970 00-970 P9 USAR U1613
Reference:
Reference:
FAA Doc: EASA CS
Reference:
17.3 LASER INTEGRATION AND INTERFACE.
17.3.1 Crew exposure.

Crew and maintenance personnel shall be protected from laser radiation (direct and reflected).

a. The level of laser protection shall ensure exposure is below the limits, which shall be defined and
proved.
b. For UAVs, this shall include ensuring approaching ground staff can be notified should the UAV be laser
energised.
c. Adequate protection of aircrew from 3rd party (including friendly forces) lasers.

1. Minimum crew and maintenance personnel exposure to laser radiation is verified by analyses (e.g.,
laser safety analysis), laser characteristics tests, laser control system (e.g., power on, weight on wheels)
inspection/demonstration, accessibility checks, wire verification, ground test equipment checks, loading
procedures checks, identification of safety equipment and inspection of training procedures.
Information Sources
Comm'l Doc: ANSI Z 136.1, Safe Use of
Lasers, for the safety design
requirements of laser systems.
DoD/MIL Doc: MIL-STD-1425 for the safety Def-Stan 00-970 00-970 P13 3.11.4
design requirements of laser Reference: 00-970 P13 3.11.5
systems. 00-970 P13 3.11.26
Information Sources
MIL-HDBK-828 00-970 P13 3.11.27
AR-11-9, “The Army Radiation 00-970 P13 3.11.30
Safety Program” 00-970 P7 L717
AFOSH STD 48-139, Laser 00-970 P9 UK601d
Radiation Protection Program STANAG 4671.1829
RCC 316-98, Laser Range Reference:
Safety
FAA Doc: 21CFR Part 1040, EASA CS
Performance Standards For Reference:
Light-Emitting Products
17.3.2 Induced environment.

The installation, integration and operation of all lasers shall not adversely affect the safety of the aircraft.

a. The environment induced by laser operations with respect to the aircraft's limitations for vibroacoustics,
thermal loads, and structural loads of the aircraft.
b. The effects from both the laser chemical and any resultant exhaust gases

1. Laser operation compatibility is verified by analyses (e.g., structural, stress, mechanical load, electrical
load, acoustical), explosive environment test and ground and flight demonstrations/tests.
Information Sources
requirements of laser systems
DoD/MIL Doc: MIL-STD-1425 for the safety Def-Stan 00-970 00-970 P13 3.11.26
design requirements of laser Reference: 00-970 P13 3.11.27
systems 00-970 P7 L717
AFOSH STD 48-139, Laser
00-970 P9 UK601d
Radiation Protection Program
STANAG
RCC 316-98, Laser Range
Reference:
Safety
Performance Standards for Reference:

17.3.4 Operation and direction.
The installation of all lasers shall:
• Only allow operation and direction to be controlled by the crew;
• Not result in an unsafe (radiating) condition following failure or malfunction;
• Allow the crew to determine when the laser is operating and also to discern the direction of the beam.
For UAS, consideration shall be given to:

a. Providing an indication in the UAS Control Station which shows the safety status of the UAS so
approaching ground staff can be notified if the UAS is in an unsafe state (e.g. radiation hazard present,
laser energized, etc.)
b. Providing means to ensure lasers do not adversely affect safety following the loss a UAS control link.

1. Laser boresighted alignment, pointing accuracy and display are verified by installation tests, SIL
testing, and ground and flight demonstrations/tests.
Information Sources
requirements of laser systems
DoD/MIL Doc: Refer to MIL-STD-1425 for the Def-Stan 00-970
safety design requirements of Reference:
laser systems STANAG
MIL-HDBK-828 4671.1829
Reference:
AFOSH STD 48-139, Laser
Radiation Protection Program
RCC 316-98, Laser Range
Safety
Performance Standards for Reference:

17.3.6 Airframe contact.
The installation of the laser shall prevent the beam from contacting any part of the aircraft.

a. Laser software and/or hardware inhibitors
b. Ensuring laser energy is not reflected back into the eyes of the pilot, operator, crew, or personnel.
c. Peripherals (i.e., stores, sensors etc.).
Consideration to AMC:
1. Verification is accomplished by initial installation tests, SIL testing, ground and flight test, and laser
operating procedures.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
17.3.7 Ground lasing.

The installation of the laser shall prevent inadvertent lasing when the aircraft is on the ground.

a. Procedures for ground crew.
b. Redundant hardware (e.g., interlocks, interlock switches/weight on wheels), and software (e.g.,
armament, sensor).
For UAS, consideration shall be given to:

a. Providing an indication in the UAS Control Station which shows the safety status of the UAS so
approaching ground staff can be notified if the UAS is in an unsafe state (e.g. radiation hazard present,
laser energized, etc.)

1. Verification is accomplished by initial installation tests, SIL testing, ground and flight test, and laser
maintenance and operating procedures.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1829
Reference:
FAA Doc: EASA CS
Reference:
17.4 Safety interlocks.

Appropriate design measures shall be in place to prevent the unsafe operation of stores.

a. Prevention of armament release whilst the aircraft is on the ground;
b. The use of switch guards and system interlocks;

ground fire testing, safety analysis and safe separation test certification,
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-516 Section 15 Def-Stan 00-970 00-970 P13 3.1.4*
MIL-HDBK-244A: 5.1.5.1, Reference: 00-970 P13 3.1.5*
5.1.5.1.2 00-970 P13 3.2.2*
MIL-STD-1425 00-970 P13 3.2.3
ADS-62-SP 00-970 P13 3.2.12*
ADS-65-HDBK 00-970 P13 3.2.22
00-970 P13 3.2.25
00-970 P13 3.2.26*
00-970 P13 3.2.27*
00-970 P13 3.2.38*
00-970 P13 3.2.39*
00-970 P13 3.3.5*
00-970 P13 3.3.6
00-970 P7 S1 L107
Information Sources
STANAG 3441
Reference: 3558
3605
FAA Doc: EASA CS
Reference:
SECTION 18 - PASSENGER SAFETY

This section covers the provision of safety features and design requirements in order to ensure the safety
of passengers during flight and during emergency situations such as crash landing, ditching etc. Safety
requirements for crew stations normally used for aircrew and mission essential personnel are located in
section 9, Crew Systems.
18.1. SURVIVABILITY OF PASSENGERS.
18.1.1 Passenger seating and restraint systems.

Seats with restraints shall be provided for each passenger. Restraints shall be designed to apply body
loads in a distributed fashion and location that do not cause serious injury in an emergency landing. Each
seat/restraint system shall be designed to protect each occupant during an emergency landing provided
the restraints are used properly. Each passenger restraint system shall have a single point release to
permit passenger evacuation.

a. Ensuring the harness applies restraint to strong parts of the body (e.g., pelvis and chest).
b. The problems of submarining and of dynamic overshoot (or whiplash effect).
c. Multi-directional forces acting singly or together up to the level of human tolerance.
d. Ensuring there are enough seat and restraint systems for all passengers.
e. The anthropometric range of passengers, and maximum weight.
f. Preventing major injuries, such as internal organ damage or skeletal fractures.
g. Providing means to secure each restraint system when not in use to prevent interference with rapid
egress in an emergency.
h. Maximum expected loads in each direction during emergency landings.

1. System Description Documents (SDD) should detail that the seating restraint system meets crash load
requirements and that there are seat and restraint systems for all passengers.
2. Rig and ground tests should demonstrate that Static and dynamic loads do not exceed appropriate
limits, taking into account the comfort of passengers.
3. Declaration of Design Performance (DDP) should detail the maximum allowed occupant weight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-7: 3.7.3.2.2 Def-Stan 00-970 00-970 P1 4.15.11
Reference: 00-970 P1 4.16.11
00-970 P1 4.21.2-4.21.6
00-970 P7 S1 L111
STANAG
Reference:
Information Sources
23.2, 23.562, 23.785, 25.562 Reference: CS 23.785
CS 25.562
CS 25.785
CS 27.562
CS 27.785
CS 29.562
CS 29.785

18.1.3 Stowage compartment structure.
Each stowage compartment shall be designed to contain the maximum weight of its contents; and shall
have means to prevent its contents from becoming a hazard due to shifting, under the most critical load
distributions and ultimate inertia forces (i.e. during an emergency landing).

a. Ultimate inertia forces acting separately relative to the surrounding structure.
b. The type and classification of the aircraft ;
c. The maximum allowed baggage or cargo weight for the compartment.

1. System Description Documents (SDD) should detail all aircraft stowage compartments, the maximum
weight of their contents and the means provided to prevent their contents becoming a hazard due to
shifting.
2. Rig and ground testing and analysis with simulated landing and in-flight load conditions verify that
contents do not cause injury or other passenger hazards.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-A-8865B Def-Stan 00-970 00-970 P1 4.22.44
No information available in Reference: 00-970 P1 4.22.46
current JSSG. Information to STANAG
be included in next revision of Reference:
JSSG
25.787, 25.789, 23.787 Reference: CS 23.787
CS 25.561
CS 25.787
CS 25.789
CS 27.561
CS 27.787
CS 29.561
CS 29.787
18.1.4 External doors.

Each passenger carrying area shall have at least one adequate and easily accessible external door that
is operable from both the inside and outside. Each external door shall be located to avoid hazardous
external areas when appropriate operating procedures are used. There shall be a means to safeguard
each external door against inadvertent opening during flight by persons, by cargo, or as a result of
mechanical or electrical failure.
If a crew member cannot see an entrance or check that it is correctly secured, a 'doors locked/unlocked'
indicator shall be fitted in the cockpit. Means shall be provided to ensure that cabin pressurisation cannot
be initiated unless the doors or hatches are properly closed, latched and locked.

a. Inspection procedures and/or detection systems to ensure doors are fully locked in flight.
b. Ensuring doors are not located in areas likely to be blocked after an emergency gear up landing.
c. Ensuring doors are reasonably free from jamming as a result of fuselage deformation in an emergency
landing.
d. Prevent the entry of unauthorised persons.
e. Hazardous external areas such as proximity to rotors, propellers, engine intakes and exhausts.

1. System Description Documents (SDD) should detail all aircraft doors, highlighting that each passenger
compartment with a seat and restraint system has an external exit with a door that can be opened
internally and externally, and that there is clear indication of a locked or unlocked condition.
2. Rig and ground tests should demonstrate the ability to operate doors internally and externally.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.20.7
00-970 P1 4.23.10
00-970 P7 L102 3
STANAG
Reference:
CS 25.783
CS 25.807
CS 27.783
CS 27.807
CS 29.783
CS 29.807
18.1.5 Exit locking mechanisms.

All exits in passenger areas shall be lockable by aircrew trained to do so, simple to open, and shall not
open in flight unless mission requirements necessitate this function.
A positive means shall be provided to retain the doors, hoods or hatches in an open position.
Consideration should be given to;

a. Ensuring all exits are uncomplicated to open such that no training is required for operation.
b. Means to drain overboard any water which might run off doors, hoods or hatches secured in the open
position.
c. Operation of exits in all expected environmental conditions.

1. System Description Documents (SDD) should detail exit locking mechanisms, highlighting that all exits
in passenger areas are lockable by aircrew, simple to open without training, and will stay locked in flight
when not opened for mission need.
2. Rig and ground tests should demonstrate the expected passenger population's abilities to operate
exits.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-7: 3.7.5.3.1 Def-Stan 00-970 00-970 P1 4.20.3-4.20.6
Reference: 00-970 P1 4.23.10
00-970 P7 3.7
00-970 P7 L102 3.8.2
STANAG
Reference:
25.809, 23.807, 25.813 Reference: CS 23.813
CS 25.807
CS 25.809
CS 25.813
CS 27.807
CS 29.807
CS 29.809
CS 29.813
18.1.6 Provisions for passenger evacuation.

Each non-over-wing emergency exit more than 1.8 m (6 feet) from the ground (with the aircraft on the
ground and the landing gear extended), shall have means to assist passengers to the ground quickly and
safely. For exits opening to wing areas, provisions shall be incorporated to safely assist passengers from
the wing surface to ground level. It shall be possible to use any decent device without passenger training
but with the assistance of aircrew members.

a. Self-supporting slides or equivalent assisting means for each passenger emergency exit.
b. Rope or any other assisting means demonstrated to be suitable for the purpose for air crew emergency
exits.
c. Provision of footholds, handholds and ladders to facilitate passage to the exits.
d. Conducting emergency egress demonstrations using non-trained personnel, representative of the
expected passenger population to verify the ability to safely exit and descend to the ground.

1. System Description Documents (SDD) should detail passenger evacuation routes, highlighting the exits
which are more than 1.8 m (6 feet) above the ground and any non-over-wing exits of that set which have
a means for passenger descent.
2. Rig and ground tests should demonstrate emergency egress using non-trained passengers,
representative of the expected passenger population, to verify the ability to safely exit and descend to the
ground.
Information Sources
Comm'l Doc:
JSSG-2010-13: 3.13.5 pg 67, Reference: 00-970 P7 S1 L102 2.3
68 STANAG
Reference:
121.31a Reference: CS 29.809
18.1.7 Exit weight and actuation.

The weight of each removable passenger exit, and its means of opening shall be conspicuously marked.

1. System Description Documents (SDD) should show that each hatch door is clearly marked with its
means of opening and weight.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-13: 3.13.5 pg 66 Def-Stan 00-970 00-970 P1 4.23.5
Reference: 00-970 P13 1.6.15.3
STANAG
Reference:
CS 27.807
CS 29.811
18.1.8 Emergency lighting system.

An emergency lighting system, independent of the main lighting system, shall provide sufficient
illumination and guidance for passenger and crew emergency evacuation; and shall include illumination of
each exit and its exterior surrounding. The energy required to supply emergency lighting shall be
sufficient to allow complete egress of all passengers and crew before diminishing.

a. Ensuring no beam of light is directed into occupants' eyes in such a way as to compromise their ability
to escape.
b. Emergency escape illumination is continually lighted or automatically energised when an emergency
occurs.
c. Ensuring sufficient luminance is maintained at all exits and in the centre of aisle-ways leading to exits
measured at seat arm rest height and in all aircrew stations and passenger compartments.
d. Ensuring all exit signs, arrows and placards are electrically lighted or self- luminous to the required
levels.
e. Use of floor proximity emergency escape path marking.
f. Compatibility with low light enhancing systems (e.g. NVG).

1. System Description Documents (SDD) should detail the positioning of the lighting system, both internal
and external to the cockpit/crewstations as well as the duration of the emergency lighting.
2. Rig and ground test should demonstrate effective emergency egress and should include evaluation of
the aircraft in night time lighting conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-13: 3.13.5 pg 62, Def-Stan 00-970 00-970 P7 L102 4.1
65 Reference: 00-970 P7 L714 2.1.5
MIL-PRF-85676 00-970 P13 1.6.11.5
STANAG 3870
Reference:
23.812, 25.1351, 25.1353, Reference: CS 23.1351
25.1355, 25.1357, 25.1363 CS 23.1353
CS 25.812
CS 25.1351
CS 25 1353
CS 25.1363
CS 27.807
CS 27.1351
CS 27.1353
CS 27.1355
CS 29.812
CS 29.1351
CS 29.1353
18.1.9 Emergency exit signs.

The location of each passenger emergency exit shall be indicated by a sign visible to occupants
approaching along the main passenger aisle (or aisles). The quantity and location of each emergency exit
sign shall enable each seated passenger to recognise at least one during adverse conditions that may
occur following a crash. Each emergency exit sign shall be self-illuminated or independently, internally
electrically illuminated.

a. Ensuring exit location indications are also apparent when not lighted under normal flight conditions.
b. Means to assist the occupants in locating the exits in conditions of dense smoke and water.
c. The identity and location of each passenger emergency exit must be recognisable from a sufficient
distance, typically the distance equal to the width of the cabin.

1. System Description Documents (SDD) should detail the location and type/size of emergency exit signs,
and the operating configurations and conditions under which emergency exit signs must be functional.
2. Rig and ground tests should demonstrate that emergency exit signs are appropriate for all operating
configurations and conditions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-13: 3.13.5 pg 68 Def-Stan 00-970 00-970 P1 4.23.5
Reference: 00-970 P7 L714 2.1.5
00-970 P13 1.6.15.3
STANAG
Reference:
23.812, 25.811 Reference: CS 23.812
CS 25.811
CS 25.812
CS 27.807
CS 29.811
CS 29.812
18.1.10 Public address system power.

If required for the category of aircraft, a public address system shall be installed that is powerable when
the air vehicle is in flight or stopped on the ground, including after the shutdown or failure of all engines
and auxiliary power units, or the disconnection or failure of all power sources dependent on their
continued operation.

a. Ensuring the public address system works as required for all approved operating configurations and
conditions.
b. Ensuring a time duration of at least 10 minutes, including an aggregate time duration of at least 5
minutes of announcements made by flight and cabin crew members, considering all other loads which
may remain powered by the same source when all other power sources are inoperative.
c. Ensuring an additional time duration in its standby state appropriate or required for any other loads that
are powered by the same source and that are essential to safety of flight or required during emergency
conditions.

1. System Description Documents (SDD) should detail the type of public address system installed, and
the operating configurations and conditions under which the system must be functional.
2. Rig and ground tests should demonstrate that the public address system is appropriate for all operating
Information Sources
Comm'l Doc:
DoD/MIL Doc: No information available in Def-Stan 00-970 00-970 P1 6.6.6(e)
current JSSG. Information to Reference: 00-970 P1 S6 L1
JSSG.
Reference:
Reference:
18.1.11 Public address system accessibility.

The public address system shall be accessible for immediate use by all aircrew, such that it is capable of
operation within 3 seconds from the time a microphone is removed from its stowage. The system shall be
intelligible at all passenger seats, lavatories, and flight attendant seats and work stations; and shall be
designed so that no unused, unstowed microphone will render the system inoperative. The system shall
be capable of functioning independently of any required crewmember interphone system and is readily
accessible to the crewmember designated to make announcements.

a. Ensuring the public address system works as required for all approved operating configurations and
conditions.
b. Ensuring the public address system has a microphone which is readily accessible to seated air crew,
for each required floor-level passenger emergency exit which has an adjacent air crew member seat.
c. One microphone may serve more than one exit, provided the proximity of the exits allows unassisted
verbal communications between seated cabin crew members.

1. System Description Documents (SDD) should detail provisions for operation of the public address
system by each member of the aircew.
2. Rig and ground tests should demonstrate that the public address system is appropriate for all operating
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-13: 3.13.5 pg 55 Def-Stan 00-970 00-970 P1 S6 L1
Reference:
STANAG
Reference:
Reference:
18.1.12 Marking of safety equipment controls.

Each safety equipment control to be operated by the crew in emergency, such as controls for automatic
liferaft releases, shall be plainly marked as to its method of operation. Each liferaft shall have obviously
marked operating instructions. Approved survival equipment shall be marked for identification and method
of operation.

a. Human factors analysis to verify the ability of control markings to be clearly discerned.
b. The use of illustrations, and pictorial representations to convey operation of critical safety controls
where passenger language abilities vary or are unknown.

1. System Description Documents (SDD) should include details of the markings provided for controls of
safety equipment.
2. Rig and ground tests should demonstrate that the marking of safety equipment is appropriate for all
intended passengers.
Information Sources
Comm'l Doc:
Reference: 00-970 P7 L103 5
00-970 P7 L721 4
STANAG
Reference:
23.1561, 23.1415 Reference: CS 25.1561
CS 27.1561
CS 29.1561
18.1.13 Marking of safety equipment storage.

Each location, such as a locker or compartment, that carries any fire extinguishing, signalling, or other
lifesaving equipment shall be marked accordingly. Stowage provisions for required emergency equipment
shall be conspicuously marked to identify the contents and facilitate the easy removal of the equipment.

a. Human factors analysis to verify the ability of control markings to be clearly discerned.
b. Co-location of fire extinguishing, signalling, or other lifesaving equipment.

1. System Description Documents (SDD) should detail the markings indicating stowage locations of life
saving equipment.
2. Rig and ground tests demonstrate the ability of passengers to discern markings identifying and
instructing methods of removal for safety equipment.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
23.1561, 23.1415 Reference: CS 25.1561
CS 27.1561
CS 29.1561
18.1.14 Flotation devices.

At least one approved, individual flotation device / means (such as removable seat flotation cushions or
under seat life preservers) shall be provided for each occupant, for aircraft flying missions over water.
Each individual floatation device shall be easily accessible by each seated passenger.

a. The functionality of flotation devices, and the ability to deploy, inflate or provide buoyancy.
b. The ability of each passenger to access a flotation device during emergency evacuation.
c. Whether or not the aircraft is certified for ditching.
d. Provision of life lines if required.

1. System Description Documents (SDD) should detail the availability and stowage provisions of
approved flotation devices.
2. Rig and ground tests demonstrate the ability of passengers to access flotation devices. Emergency
egress demonstrations should verify the ability of each passenger to access a flotation device during
emergency evacuation.
Information Sources
Comm'l Doc:
STANAG
Reference:
25.1415 Reference: CS 23.1415
CS 25.1411
CS 25.1415
CS 27.1411
CS 27.1415
CS 29.1411
CS 29.1415
18.1.15 Emergency equipment.

The aircraft shall be outfitted with equipment to deal with in-flight, ground, and ditching emergencies.

a. Ensuring the emergency equipment is tailored for the intended mission of the aircraft.
b. Provision of emergency equipment such as: emergency and floatation equipment, hand-held fire
extinguishers, crash axe, megaphones, medical kits and supplies, automatic external defibrillators,
portable oxygen supply systems, means for emergency evacuation, specialised tools or fracturing
equipment, survival aids and equipment, weapons, communication equipment, signalling and locator
devices, and portable lights.
c. The adequacy of medical kits and supplies for treatment of injuries, medical events, or minor accidents.
d. Different emergency equipment configurations and specified content requirements for different mission
needs.
e. The accessibility of emergency equipment.

1. System Description Documents (SDD) should detail emergency equipment provisions.
2. Rig and ground tests should demonstrate the functional capabilities of equipment, showing that they
are appropriate for their intended purpose.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2010-11 Def-Stan 00-970 00-970 P1 4.15.66
00-970 P7 L105 17
Information Sources
00-970 P7 L105 20
00-970 P7 L105 21
STANAG
Reference:
121.310 Reference:
18.1.16 Signs and placards in passenger compartments.

Signs and placards shall be provided in the passenger compartment to meet the following requirements:
a. Where smoking is prohibited, signs shall be provided that are legible to each passenger.
b. If smoking is allowed, signs stating when it is prohibited shall be installed and operable from either
pilot's seat and visible under all probable conditions of cabin lighting to each person seated in the cabin.
c. Signs stating when seat belts are to be fastened shall be installed and operable from either pilot's seat
and visible under all probable conditions of cabin lighting to each person seated in the cabin.
d. Placards shall be placed on, or adjacent to, the door of each waste receptacle indicating that the
disposal of cigarettes etc is prohibited.
e. Lavatories shall have 'No Smoking' placards adjacent to each ashtray.

1. System Description Documents (SDD) should detail the signs and placards provided in each
passenger compartment.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 Pt 1 Sect 4 paras:
Reference: 4.26.53, 4.26.54
STANAG
Reference:
Reference:
18.2. FIRE RESISTANCE.
18.2.1 Ignition source isolation.

Sources of ignition within cargo compartments shall be located and/or designed to prevent contact with
cargo.

a. Cargo clearances and preventive means of contacting ignition sources, i.e. shielding and insulation.
b. Ensuring all components within the cargo compartments are certified for operation in an explosive
atmosphere.
c. Preventing cargo from breaking loose.
d. Means to prevent cargo or baggage from interfering with the functioning of the fire protective features
of the compartment.

1. System Description Documents (SDD) should detail sources, locations, and configurations of possible
ignition sources.
2. Rig and ground tests should demonstrate the inability of components and systems to ignite flammable
materials, and therefore preclude ignition of an explosive atmosphere.
3. System Safety Assessments (SSA) should detail cargo clearances and preventive means of contacting
ignition sources.
Information Sources
DoD/MIL Doc: No information available in Def-Stan 00-970 00-970 P1 4.26.58
current JSSG. Information to Reference: 00-970 P7 L712
JSSG. 4671.787
AFMAN 24-204(I) identifies Reference: 4671.850
flammability limits for
transported cargo.
25.789, 23.787 Reference: CS 23.855
CS 25.787
CS 25.855
CS 27.787
CS 27.855
CS 29.787
CS 29.855
18.2.2 Oxygen equipment installation.

Oxygen equipment and lines shall not be located in any designated fire zone; nor routed with electrical
wiring. They shall be protected from heat that may be generated in, or escape from, any designated fire
zone and be installed so that escaping oxygen cannot cause ignition of grease, fluid, or vapour
accumulations present in normal operation or as a result of failure or malfunction of any system.
Oxygen pressure sources and lines between the sources and shut-off means shall be protected from
unsafe temperatures. Lines carrying flammable liquids shall be positioned at as great a distance as
practical from the oxygen installation. Precautions shall be taken to prevent fluid impinging on the oxygen
or oxidant system.

a. Design precautions to minimise hazards due to damage.

1. System Description Documents (SDD) should detail the location and routing of oxygen lines for criteria
compliance.
2. Rig and ground tests should demonstrate that adequate heat protection is provided for oxygen
equipment.
3. System Safety Assessments (SSA) should show identification and acceptability of ignition/explosive
hazards through Failure Mode and Effects Criticality Analysis and a System Safety Hazard Analysis.
Information Sources
Information Sources
DoD/MIL Doc: JSSG-2010-7: 3.7.3.4, 3.10, Def-Stan 00-970 00-970 P1 4.26.14
4.10 Reference: 00-970 P1 4.26.41-4.26.45
00-970 P1 6.13
00-970 P7 L712
00-970 P13 1.4
STANAG
Reference:
18.3. PHYSIOLOGY REQUIREMENTS OF OCCUPANTS.

This section covers equipment and systems specific to the physiological requirements of crew and
passengers during flight.
18.3.1 Oxygen.
Aircraft capable of flying above 10,000 feet mean sea level (MSL) shall have means to provide
supplemental oxygen, and shall be capable of delivering it to each passenger. There shall be an
individual dispensing unit for each passenger for whom supplemental oxygen is to be supplied.
For each passenger, the minimum mass flow of supplemental oxygen required at various cabin pressure
altitudes shall not be less than the flow required to maintain, during inspiration and while using oxygen
equipment (including masks) provided, the required mean tracheal oxygen partial pressures.
Oxygen quantities shall be sufficient for the duration of time that passengers may be exposed to the cabin
altitudes indicated.

a. Supplementary oxygen provided from the aircraft , or from a stand-alone system.
b. Minimum mass flow requirements for different cabin pressure altitudes.
c. Ensuring dispensing units provide for effective utilisation of the oxygen being delivered to the unit, are
capable of being readily placed into position on the face of the user (over nose and mouth if required) and
are equipped with a suitable means to retain the unit in position on the face.

1. System Description Documents (SDD) should detail the supplemental oxygen system and the quantity
of oxygen available to each passenger.
2. Rig and ground tests should demonstrate the ability of the supplemental oxygen system to provide
necessary oxygen quantities, duration, and flow rates.
3. System Safety Assessments (SSA) should show the integrity of the oxygen system by identification of
hazards through Failure Mode and Effects Criticality Analysis and a System Safety Hazard Analysis.
Information Sources
DoD/MIL Doc: JSSG-2010-10: 3.10.1, 4.10.1 Def-Stan 00-970 00-970 P1 6.13
Reference:
STANAG
Information Sources
Reference:
23.1441, 23.1443, 23.1445, Reference: CS 23.1443
25.1447, 23.1449, 23.1450, CS 23.1445
25.1441, 25.1443, 25.1445,
CS 23.1447
25.1449, 25.1450, 25.1453
CS 23.1449
CS 23.1450
CS 23.1453
CS 25.1441
CS 25.1443
CS 25.1445
CS 25.1447
CS 25.1449
CS 25.1450
CS 25.1453
18.3.2 First aid.

Approved emergency medical kit(s) shall be installed in the aircraft; and shall be capable of providing
medical support for the designed mission.

a. The adequacy of medical kit contents for treatment of injuries, medical events, or minor accidents.
b. Different medical kit configurations and specified content requirements for different mission needs.
c. The accessibility of the medical kit(s).

1. System Description Documents (SDD) should detail the installation and availability of emergency
medical kits.
2. Rig and ground tests should demonstrate the accessibility of medical kits.
3. System Safety Assessments (SSA) should show that any emergency medical kits have been have
been assessed as appropriate for the aircaft role(s).
Information Sources
Comm'l Doc:
DoD/MIL Doc: No information available in Def-Stan 00-970 00-970 P1 4.15.66
current JSSG. Information to Reference: 00-970 P7 L105 17
JSSG.
Reference:
121.339, 121.310 Reference:
SECTION 19 - MATERIALS
This section covers material selection, application and specification for the entire flight vehicle including
aircraft structure, aircraft subsystems, propulsion systems, electrical power systems, mission systems,
crew systems, and armament/stores systems.

• Material properties and process;
• Corrosion prevention and control;
• NDI requirements;
• Wear and erosion prevention.
• Use of standard engineering methods and formulas, in conjunction with full scale tests, and experience
of the product;
• Ensuring adequate accessibility to areas that may be subject to wear in order to conduct maintenance
and inspection.

1. Design criteria
2. Materials properties data and analysis
3. Environmental effects data and analysis
4. Galvanic compatibility data and analysis
5. Effects of defects data and analysis
6. Hazardous materials data
7. Material trade study results
8. Design of experiments results
9. Statistical process control data
10. Nondestructive inspection (NDI) criteria
11. NDI plan and records
12. NDI probability of detection data
13. Preproduction verification test data
14. First article destructive test data
15. Wear and erosion data
16. Material specifications
17. Process specifications
18. Finish specifications
19. Metallic materials properties development and Standardization (MMPDS)
20. MIL-HDBK-17, Polymer Matrix Composites
21. Material safety data sheets
22. Contractor policies and procedures
23. Quality records
24. Defect/failure data
25. Fracture control plan
26. Fracture critical parts list
19.1 PROPERTIES AND PROCESSES.
19.1.1 Material property evaluation.

Appropriate material selection shall be conducted in order to assure adequate structural properties.
Material property evaluations shall be performed using a combination of recognized and standardized
analyses, tests, inspections, and examinations.

a. Use of standard engineering methods and formulas which are known to produce acceptable results, in
conjunction with full scale tests (ground and/or flight tests) and experience of the product;
b. Ensuring that material properties are adequate and sufficient for all required missions and service
usage;
c. The classification of the structure;
d. The consequence of failure of the structure in terms of the overall integrity of the aircraft;
e. The consequence of the failure of interior items of mass and the supporting structure to the safety of
the occupants;
f. Structural properties such as strength, stiffness, fatigue, crack growth rates, fracture toughness,
corrosion susceptibility.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006, Appendix Def-Stan 00-970 00-970 P1 3.1.10
A.3.2.19, A.4.2.19 Reference: 00-970 P7 L200/1
MIL-HDBK-1587 00-970 P9 USAR 613
STANAG 4671.307
Reference: 4671.603

CS 25.307
CS 25.603
CS 27.307
CS 27.603
CS 29.307
CS 29.603
19.1.2 Material property certification.

Material properties shall be certified as specification compliant and specification properties shall be
represented as minimum values achievable using standardized processes.
Information Sources
Comm'l Doc:
Reference: 00-970 P7 L200/1 2.2.1
Information Sources
00-970 P9 USAR 613
STANAG 4671.603
Reference: 4671.613
FAA Doc: MMPDS EASA CS CS 23.603
14CFR reference: 23.603, Reference: CS 23.613
23.613, 25.603, 25.613 CS 25.603
CS 25.613
CS 27.603
CS 27.613
CS 27.613
ESDU 00932
19.1.3 Material design value.

Robust & recognised design & manufacturing techniques shall be established and applied to characterise
the properties of Material that are suitable for purpose, and shall make adequate allowance, where
applicable.

a. The effects of:
• Product shape and form;
• Production representative processing and manufacturing variability;
• Effects of defects;
• Final assembly interfaces;
• Environmental conditions, such as temperature, humidity, UV, chemical, solvent, fuel, electromagnetic
radiation, and airborne particulates expected in service;
• Repair.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: Appendix Def-Stan 00-970 00-970 P1 4.5.2 - 4.5.4
A.3.2.19.1, A.4.2.19.1 Reference: 00-970 P9 USAR 613
STANAG 4671.603
Reference: 4671.613
FAA Doc: MMPDS EASA CS CS 23.603
14CFR reference: 23.603, Reference: CS 23.613
23.613, 25.603, 25.613 CS 25.603
CS 25.613
CS 27.603
CS 27.613
CS 29.603
CS 29.613
ESDU 00932
19.1.4 Material specification properties.

Material design values shall be based upon acceptable design allowables to prevent structural failure due
to material variability.

a. Factors, such as material shape and form, anisotropy, heat treatment, affecting design allowables from
recognised data sources.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.1.4
STANAG 4671.613
Reference:
CS 27.613
CS 29.613
19.1.5 Environmental effects.

The durability of the aircraft structure and components shall support operation in all environmental
conditions expected in service and shall take into account any potential material property degradation as
a result.

a. All phases of the life cycle, to include manufacture, in-service operation and associated maintenance;
b. Moisture absorption; chemical, solvent, fuel, and lubricant exposure; hydrolytic instability; thermal
exposure; electromagnetic and UV radiation;
c. Processes and joining methods applied to the materials used in the airframe.
d. Provision of slip resistant surface on floors likely to become wet during service.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2001: 3.2.2, 4.2.2, 3.2.3, Def-Stan 00-970 00-970 P1 4.3.2
4.2.3 Reference: 00-970 P1 4.3.4
JSSG-2006: Appendix 00-970 P1 4.3.5
A.3.2.16, A.4.2.16, A.3.11.1, 00-970 P1 4.3.8
A.4.11.1.2.1, A.3.11.2, 00-970 P1 4.3.11
A.4.11.2, A.3.11.3, A.4.11.3, 00-970 P1 4.3.17
A.3.11.4, A.4.11.4 00-970 P1 4.3.33
MIL-HDBK-1568 00-970 P1 4.3.34
MIL-HDBK-1587 00-970 P1 4.3.84
MIL-STD-889 00-970 P1 4.5.6
00-970 P1 4.5.9
00-970 P1 4.6
00-970 P1 4.6.2
00-970 P7 L200 1.8
00-970 P7 L200 4.4
00-970 P7 L403 3.2.5
00-970 P9 USAR 605
STANAG 4671.603
4671.605
Information Sources
Reference: 4671.609
4671.613

23.613, 25.609, 25.613 Reference: CS 23.605
CS 23.609
CS 23.613
CS 25.603
CS 25.605
CS 25.609
CS 25.613
CS 25.793
CS 27.603
CS 27.605
CS 27.609
CS 27.613
CS 29.603
CS 29.605
CS 29.609
CS 29.613
19.1.6 Critical process capability.

Critical fabrication process which require close control shall be performed under an approved process
specification, which allows identification, monitoring, and control of any undesirable variation.

a. Fabrication processes such as heat-treating, quenching, welding, brazing, soldering, forging, gluing.
b. Substantiation of fabrication methods by a test programme.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: Appendix Def-Stan 00-970 00-970 P1 4.6
A.3.2.19.2, A.4.2.19.2, Reference: 00-970 P9 USAR 605
A.3.11.1, A.4.11.1.2.1 STANAG 4671.605
Reference:
CS 27.605
CS 29.605

19.1.8 Damage repair.
The aircraft design shall consider and permit repair of structure and of flight and mission critical systems,
following damage.

a. Giving preference to structural materials which are easily repairable;
b. Ensuring all repairs comply with the relevant design requirements for the whole aircraft;
c. Ensuring high or moderate maintenance items and items subject to wear must be repairable;
d. Battle damage.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: Appendix Def-Stan 00-970 00-970 P1 4.1.41
A.3.2.28, A.4.2.28 Reference: 00-970 P1 4.4.3
00-970 P1 4.4.34 - 4.4.37
00-970 P13 3.9.7
00-970 P7 L200 8.1
STANAG
Reference:
FAA Doc: 14CFR reference 23.611 EASA CS
Reference:
19.1.9 Material failure modes.

Insidious failure modes (e.g., hydrogen embrittlement, crack bifurcation) shall be understood and
accounted for, such that all parts of the aircraft are so designed, protected, assembled, drained and
vented that when it is maintained in accordance with the servicing schedule there will be no unacceptable
loss of airworthiness as a result of induced spontaneous, progressive or delayed cracking.

a. Where possible, selecting materials with lower susceptibilities to corrosion, corrosion fatigue, stress
corrosion or hydrogen embrittlement; and
b. Avoiding unnecessarily strong but susceptible materials.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.3.85
00-970 P7 L200/1 5
00-970 P7 L203/5 2.4
00-970 P7 L406 1.1
00-970 P7 L406/1 4.4.1
STANAG 4671.609
Reference: 4671.613
CS 27.609
CS 29.609
19.2 CORROSION
19.2.1 Corrosion prevention and control practices.

Adequate corrosion prevention and control practices shall be in place.

a. Uniform surface corrosion, pitting, galvanic, crevice, filiform, exfoliation, inter-granular, fretting, high
temperature oxidation (hot corrosion), corrosion fatigue, stress corrosion cracking, and microbially
induced corrosion;
b. Preventing water leaking into, or being driven into, any part of the aircraft;
c. The use of various design alternatives which preclude the traditional galvanic corrosion problems
created by dissimilar metal bushings (e.g., beryllium copper, aluminium bronze) installed in aluminium
structure;
d. The avoidance of using removable graphite composite doors/panels fastened to aluminium alloy
substructure, particularly on upper surfaces where moisture/salt spray can potentially migrate through the
fastener holes and cause corrosion of the aluminium substructure.
Information Sources
Comm'l Doc:
Reference: 00-970 P1 4.3.2
00-970 P1 4.3.4
00-970 P1 4.3.5
00-970 P1 4.3.8
00-970 P1 4.3.11
00-970 P1 4.3.17
00-970 P1 4.3.33
00-970 P1 4.3.34
00-970 P1 4.3.84
00-970 P1 4.6.2
00-970 P7 L402 7.6
00-970 P7 L405/1
00-970 P7 407
STANAG 4671.571
Reference: 4671.609
CS 25.571
CS 25.609
CS 27.571
CS 27.573
CS 27.609
CS 29.571
CS 29.573
CS 29.609
19.2.2 Corrosion prevention systems.

Corrosion prevention systems shall remain effective during the service life, including the mitigation of
environmentally assisted cracking. Specific corrosion prevention and control measures, procedures, and
processes shall be identified and established commensurate with the operational and maintenance
capability.
Information Sources
Information Sources
Comm'l Doc:
Reference: 00-970 P7 L405/1
00-970 P7 L406/1
00-970 P7 L407
STANAG 4671.571
Reference: 4671.609
CS 25.609
CS 27.571
CS 27.573
CS 27.609
CS 29.571
CS 29.573
CS 29.609
19.2.3 Non-metallic corrosion control.

Adequate prevention and control practices shall be in place for non-metallic materials degradation.

a. Preventing galvanic corrosion which occurs where surfaces of composites containing carbon fibres are
in contact with metals.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 4.3.87 - 4.3.101
STANAG 4671.609
Reference:
CS 27.609
CS 27.573
CS 29.609
CS 29.573
19.2.4 Protective finishes.

Finish systems shall provide adequate corrosion protection for the airframe and its components, in order
to maintain the specified operational capability of the aircraft, and ensure it is not degraded because of
finish breakdowns / failures.
Each specific surface treatment, inorganic and organic coating, and other protective finish used for
corrosion prevention and control shall be identified and established.
a. Finishes for all specific parts, surfaces of similar and dissimilar materials, and attaching parts and
fasteners etc.;
b. Treatment / finishing of non-corrosion resisting steels and other metals, e.g. cleaning, painting etc.;
c. Ensuring the selection and application of all organic and inorganic surface treatments and coatings
complies with air quality requirements;
d. Ensuring exterior surfaces remain aerodynamically smooth;
e. Preventing the use of organic coatings (other than fire insulating paints) for temperature control in
inaccessible areas.
Information Sources
Comm'l Doc:
JSSG-2006: Appendix Reference: 00-970 P7 407
A.3.2.20, A.4.2.20, A.3.11.2, STANAG 4671.609
A.4.11.2 Reference:
MIL-HDBK-1568
MIL-STD-7179
MIL-STD-889
23.609, 25.603, 25.609 Reference: CS 25.609
CS 27.609
CS 29.609
19.3 NONDESTRUCTIVE INSPECTION.
19.3.1 Defect characterization and detection.

Prior to conducting non-destructive testing and inspection (NDT/I), the nature of those defects which are
critical to material integrity shall be characterized, and any effects on the probability of detection shall be
assessed.

a. Nature of defects such as: size, shape, location, orientation, and any other properties which will affect
detectability with the methods to be used;
b. Detailed structural analysis to identify structurally critical locations, load paths, and quality criteria
necessary for meeting performance and life requirements.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.575
Reference: 4671.611
19.3.2 NDI assessment criteria.

Non-destructive inspection (NDI) accept/reject criteria shall be validated and correlated with 'effects of
defects' testing.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.575
Reference: 4671.613
19.3.3 NDI manuals.

Non-destructive inspection (NDI) manuals shall be developed to accompany the aircraft, in order to
provide an audit trail of the adequacy, thoroughness, and completeness of NDT/I engineering and
application efforts.
NDI manuals shall include:

a. When, how often, and how the system is to be inspected for service induced damage;
b. Valid NDT/I methods and their application.

a. NDT manuals, which may not be type specific.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 P1 S4 L16
Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
19.3.4 Inspection intervals.

Initial and recurring non-destructive inspection (NDI) intervals shall be established, in order to identify and
characterize specific defect types, sizes, and locations critical to material integrity.

a. Ensuring inspection means for each item are practicable for the inspection interval for the item, such
that:
i. For inspections repeated at short intervals (such as pre-flight or daily inspections) the means of
inspection should be simple, e.g. visual with the aid of easily removable or hinged access panels;
ii. For inspections required only a few times, for example once or twice in the lifetime of the aircraft some
disassembly of structure, e.g. de-riveting a small skin panel is acceptable.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006: Appendix Def-Stan 00-970 00-970 4.7.2
A.3.11.6, A.4.11.6 Reference:
MIL-HDBK-6870 STANAG 4671.573
Information Sources
Reference: 4671.575
4671.611
4671.613
CS 25.571
CS 25.611
CS 27.571
CS 27.573
CS 29.571
CS 29.573
19.4 W EAR AND EROSION.

Specific wear and erosion prevention practices, measures, procedures, and processes shall be identified
and established, commensurate with the operational and maintenance capability, on applicable surfaces
of metals, polymers, elastomers, ceramics, glasses, carbon fabrics, fibres, and combinations or
composites of these materials.

a. Wear mechanisms such as abrasion, fretting, corrosion, and thermal wear, and combinations thereof;
b. Erosion mechanisms such as impinging fluid, solid particles (e.g. sand, dust etc.) and other
environmental conditions (e.g. high sunlight/heat).
c. Eliminating / minimizing combinations of erosive, corrosive, and thermal effects on structures near
heater and engine bleed air, engine exhaust, rocket and missile exhaust, and in the wake of such exhaust
gases;
d. Preventing direct flame impingement from missiles and rockets on aircraft surfaces unless such
surfaces are suitably protected by a coating or device;
e. Applying erosion prevention practices to all surface areas including leading edges, radomes, housings,
and other protrusions as well as to surfaces exposed to particle impingement during take-offs and
landings;
f. The adequacy of practices in protecting against corrosion in the environment in which the parts will
operate, and their effects upon fatigue life;
g. Ensuring adequate accessibility to areas that may be subject to wear in order to conduct maintenance
and inspection;
h. Applying wear prevention practices to all load bearing and load transfer interfaces;
i. Provisions for lubricating of all parts subject to wear;
j. Ensuring items subject to wear are repairable;
k. Limiting the use of dissimilar metals in contact to applications where similar metals cannot be used due
to peculiar design requirements.
SECTION 20 - OTHER CRITERIA

This section covers those equipments which may be used on or with an aircraft but which are not
necessarily part of it, such as mission or role equipment, or carry-on equipment. These equipments
should be assessed and authorised for use on each aircraft that they are required for and any limitations
associated with that use clearly recorded. It also covers those pan-platform criteria that potentially affect
multiple systems and consequently need greater visibility to ensure they are given adequate
consideration. These include ETOPS and flight in, or near, volcanic ash clouds.

1. Design criteria
4. Design approval and system compatibility tests
5. Component and system level qualification and certification tests
7. Hazard analysis and certification
8. Failure modes and effects analysis
9. Avionics integration tests and results
10. System/subsystem self-test design and capabilities
11. Qualification test plans, procedures, and results
12. Ground test results
13. FCA and PCA data
14. Flight manual
15. Software development plan
16. Software development and product specifications
17. Software test plans, test procedures, and test reports
18. Software configuration control/management plan and procedure
19. Flight test reports
20. Environmental analysis and test results
20.1 AIR TRANSPORTABILITY AND AIRDROP.

Air transport and airdrop are aircraft capabilities that enable an aircraft to perform cargo transport as a
prime mission. Cargo includes transported and airdroppable objects and personnel (e.g., passengers and
parachutists). These capabilities involve primary and secondary aircraft structure, size and shape of the
cargo carrying compartment, and aircraft interactions with the cargo mass and weight, especially if cargo
is airdropped during flight.

• The design, size and layout of cargo compartments;
• NAVAIR NATOPS/cargo-loading manuals;
• Cargo restraint mechanisms (i.e. tie-down rings);
• The effects of cargo on aircraft C of G;
• Cargo preparation, handling, carriage, and delivery procedures;
• Personnel airdrop systems;
• Jettisonable cargo.

• The maximum mass to be carried, and its location within or on the aircraft;
• The largest, and heaviest load combinations;
• Different shapes of cargo;
• Air transportation of hazardous materials.
20.1.1 Aircraft structure.

It shall be shown that the aircraft structure can support all loads (internal or external, as applicable)
imposed by the transported items during operational usage.

a. Identification of the maximum mass to be carried, and its location within or on the aircraft;
b. Floor loadings should be considered along with transfer of the loads to the structure;
c. Cargo tie-down, or restraint mechanism, loadings and attachments to structure should be considered;
d. The means by which compliance should be demonstrated- whether full scale model testing or
mathematical simulation.

Analysis and structural testing of subsystems or complete structures should be performed. Structural
testing should verify analytical results such that an acceptable margin of safety is attained for the design
condition.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.1.7.2 Def-Stan 00-970 00-970 P1 3.1
JSSG-2001B: 3.4.5 Reference: 00-970 P1 4.22.49
JSSG-2001B: 3.4.6.2 00-970 P1 4.22.62-4.22.64
JSSG-2006-3.3.4 STANAG 4671.787
JSSG-2006-3.3.3.2 Reference:
FAA Doc: EASA CS 23.787
Reference: 23.1557
23.1583
25.787
25.1557
25.1583
27.787
27.865
27.1557
27.1583
29.787
29.865
29.1557
Information Sources
29.1583
20.1.2 Clearances.
There shall be passageways of sufficient width between properly loaded cargo and the aircraft structure
to enable aircrew access and passenger egress during flight-critical and emergency functions.

a. Dimensions of largest permissible cargo to be established;
b. Producing cargo load plans showing possible locations for largest, and heaviest load combinations;
c. Sufficient width to be judged with worst possible, but allowable, cargo configuration;
d. Movement of cargo during crash/ditching.

Acceptable clearance should exist for aircrew and support personnel access during ground operations
and flight of all required cargo items. Acceptable clearance should exist for passenger egress on flights
required to carry passengers. NOTE: Passenger egress clearances may be different from aircrew and
support personnel access clearances.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.1.7.2 Def-Stan 00-970 00-970 P13 1.6.15.1
MIL-HDBK-1791 illustrates the Reference: 00-970 P1 1.1.2
minimum acceptable aircrew 00-970 P1 4.26.56
access clearances for C-130 00-970 P1 4.22
aircraft. 00-970 P7 L100 1.1
AFI 11-2C-130 Vol 3, addenda 00-970 P7 L307
A, defines C-130 passenger 00-970 P13 1.6.15.1
safety aisle requirements STANAG 3400
MIL-STD-1472 defines Reference:
anthropometric data
CS 25.813
CS 25.815
CS 25.819
CS 25.857
CS 29.813
CS 29.815
20.1.3 Cargo loading limits.

The aircraft cargo-loading manuals for the aircraft shall include shear, bending, crushing, or puncture load
limits such that the cargo does not impart excessive loads into the aircraft structure during any phase of
the loading process.
Information Sources
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.1.7.2 Def-Stan 00-970
JSSG-2001: 3.4.5, 3.4.63 Reference:
NATOPS, TO 1C-XX-9, the STANAG
aircraft loading manuals Reference:
include cargo loading limits in
the desired formats.
FAA Doc: EASA CS

Reference:
20.1.3.1 Restraint system structure.

For internal loads, the cargo floor tie-down rings, or other restraint mechanisms, and the supporting
structure shall be suitably strong, and the load limits shall be included in applicable operators and
maintenance manuals.

a. Ensuring strength levels equal to or in excess of the tiedown devices and are capable of withstanding
specified loads.
b. Ensuring repair of tiedown rings is included in the maintenance manuals.

1. The attachment hardware, pan assemblies, and supporting airframe structure should be verified to
withstand pulling forces greater than the rated capacities of the restraint system.
2. Ring assemblies should be tested in vertical up, lateral, and longitudinal directions plus other directions
as dictated by the analysis.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2006 Def-Stan 00-970 00-970 P1 4
Reference: 00-970 P5 UK25.301a
00-970 P5 UK25.301b
00-970 P7 L200
STANAG 3400
Reference:
FAA Doc: EASA CS 23.561
Reference: 23.787
23.1583
25.561
25.787
25.1583
27.561
27.787
27.1583
29.561
29.787
29.1583
20.1.4 Aircraft weight and balance limits.

Correctly positioned cargo shall meet the weight and balance requirements of the aircraft to establish and
maintain safe flight.

a. The maximum mass to be carried, and its location within or on the aircraft, to be identified, and
published in the appropriate manual.
b. Cargo load plans to be produced showing possible locations for largest, and heaviest load
combinations.

Aircraft weight and balance limits should be verified by analysis, simulation, flight testing and any
combination of methods, conducted at critical and extreme points of the aircraft gross weight, cargo
locations and operating envelope.
Information Sources
Comm'l Doc:
DoD/MIL Doc: NATOPS, TO 1C-XX-1, TO Def-Stan 00-970 00-970 P1 2.1.23
1C-XX-9, TO 1C-xx-5 contain Reference: 00-970 P1 2.1.26
approximate permissible cargo 00-970 P1 3.3.14
centre of gravity graphs
00-970 P1 4.16.24
(chimney curves) for mission
equipped aircraft. 00-970 P5 UK25.143b
JSSG-2000: 3.1.7.2 00-970 P7 L600 3.3.1
JSSG-2001: 3.4.5 STANAG 4671.23
Reference: 4671.787
CS 23.1557
CS 23.1583
CS 23.1589
CS 25.23
CS 25.25
CS 25.27
CS 25.787
CS 25.1557
CS 25.1583
CS 27.25
CS 27.27
CS 27.787
CS 27.1557
CS 27.1583
CS 27.1589
CS 29.25
CS 29.27
CS 29.787
CS 29.1557
CS 29.1583
Information Sources
CS 29.1589
20.1.5 Restraint system function during aerial delivery operations.

With the exception of items designated for airdrop, properly loaded and restrained cargo shall not change
the position of the aircraft's CofG during flight.

a. Ensuring cargo items are secured against movement in all directions.
b. Secure cargo for crash and other severe flight conditions.

1. Restraints should be verified by structural analysis and test of restraining systems
2. Restraint devices and other applicable cargo delivery systems should be verified for use with the
pallets/platforms that will be used in the loading of cargo.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.1.7.2 Def-Stan 00-970 00-970 P1 4
JSSG-2001: 3.4.5, Reference: 00-970 P5 UK25.143b
MIL-HDBK-1791, restraint 00-970 P7 L600 3.3.1
criteria for transported cargo STANAG 3400
MIL-A-8865B, restraint criteria Reference: 4761.787
for transported cargo
CS 25.561
CS 25.787
CS 27.561
CS 27.787
CS 29.561
CS 29.787
20.1.6 Capacity and quantity of cargo restraint provisions.

There shall be restraints of sufficient capacity provided in sufficient quantity to restrain all items of cargo
safely.

a. The quantity of restraints shall be sufficient for the entire cargo, or combination of cargoes;
b. The capacity of the restraints shall be sufficient to restrain the payload to the specified level of
force/acceleration in all directions;
c. Aircraft with crew, passengers and cargo located in the same cabin or on the same deck.

Through analysis and demonstration, the quantity of restraint devices should be shown to be sufficient to
restrain various mass quantities of cargo items. The strength of the restraints should be of a standard or
otherwise approved value.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.1.7.2 Def-Stan 00-970 00-970 P1 4.22.49
JSSG-2001: 3.4.5 Reference: 00-970 P1 4.22.50
JSSG-2006-3.4.2.11 00-970 P5 UK25.301a
MIL-T-25959, standard 00-970 P5 UK25.301b
restraint devices 00-970 P7 L200
MIL-PRF-27260, standard STANAG STANAG 3400
restraint devices Reference:
CS 25.789
CS 27.787
CS 29.787
20.1.7 Manuals.
All the operator and maintenance manuals (e.g. T.O.'s) shall be accurate, consistent with the aircraft
data, and provide the cargo preparation, handling, carriage, and normal and emergency procedures
necessary for safe ground and flight operations.

a. Identifying and validating platform specific aircrew manuals;
b. Identifying and validating platform specific ground crew manuals;
c. Identifying and validating applicable National operating rules or manuals;
d. Identifying and validating applicable International or Treaty manuals.

It should be demonstrated that draft copies of the operator, maintenance and loading manuals can be be
successfully used by properly trained crewmembers to perform necessary functions.
Information Sources
Comm'l Doc:
DoD/MIL Doc: JSSG-2000: 3.1.7.2 Def-Stan 00-970
STANAG
Reference:
CS 25.1583
CS 27.1583
CS 27.1589
CS 29.1583
CS 29.1589
20.1.8 Cargo compartment dimensions.

The aircraft shall be designed to allow enough room to load, transport, and, where required, airdrop
required items safely.

a. Ensuring that sufficient clearance is provided between all cleared cargo loads and the aircraft structure
and fittings;
b. Cargo volume envelope excludes crew and passenger access and escape paths;
c. Ensuring that aircraft manuals reflect the largest allowable dimensions for cargo.

Selected cargo loading demonstrations and analysis of loaded cargo via drawings should indicate that the
clearance envelope is maintained throughout the loading and flight activities.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1791: 4.2, 5.2 Def-Stan 00-970 00-970 P1 1.1.2
JSSG-2009: Appendix J Reference: 00-970 P7 L100 1.1
STANAG
Reference:
FAA Doc: EASA CS
Reference:
20.1.9 Cargo or CG movement in flight.

The aircraft shall be loaded with cargo ready for air-dropping without damage to the airframe; and aircraft
flight safety shall not be hazardously affected by movement of its C of G due to air-dropping of that cargo.

a. The need to provide external stability struts to prevent the aircraft from settling on its tail while being
loaded;
b. The maximum mass to be carried, and its location within or on the aircraft, to be identified and
published in the appropriate manual;
c. Cargo load plans shall be produced showing possible locations for largest, and heaviest load
combinations;
d. Cargo load plans shall identify the order in which the loading should occur to enable subsequent safe
air-drop.

Analysis and test should verify flight safety during airdrop of the designated payload weight at required
airspeeds. Stability and control analyses and testing performed in Section 6 should demonstrate the
ability to maintain safe flight during the exit of the heaviest payloads. Loading demonstrations should
verify that the aircraft has sufficient stability in ground mode to present a stable platform for loading
operations.
Information Sources
Comm'l Doc:
JSSG-2009: Appendix J Reference: 00-970 P1 2.1.26
00-970 P1 3.3.14
00-970 P1 4.16.24
STANAG 4671.23
Information Sources
4671.1583
4671.1589
CS 23.1519
CS 23.1583
CS 23.1589
CS 25.23
CS 25.25
CS 25.27
CS 25.787
CS 25.1519
CS 25.1583
CS 27.25
CS 27.27
CS 27.787
CS 27.1519
CS 27.1583
CS 27.1589
CS 29.25
CS 29.27
CS 29.787
CS 29.1519
CS 29.1583
CS 29.1589
20.1.10 Personnel airdrop system structure.

The aircraft personnel air-drop systems shall be able to withstand the loads imposed by personnel during
air-drop, and possible malfunctions of personnel air-drop equipment.
Consideration should be given to loads associated with:

a. The location of air-drop attachment points and supporting structure;
b. Effects of opening any door or ramp for egress; this would include the use of air deflectors;
c. Mechanisms used to retrieve paratroopers who have jumped but not separated from the aircraft.

Analysis of structural loads verified with instrumented results from flight testing should demonstrate that
the aircraft structure and subsystems are not adversely affected by personnel airdrop and retrieval
operations under a worst case scenario.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1791: 4.2, 5.2 Def-Stan 00-970
JSSG-2009: Appendix J Reference:
JSSG-2006-6.1.2, 6.1.6 STANAG
Reference:
Information Sources
FAA Doc: EASA CS
Reference:
20.1.11 Towed jumper retrieval capability.

The aircraft shall provide the capability to safely recover a paratrooper who has jumped but not separated
from the aircraft.

a. The required force to retract the static line, taking account of:
i. The weight of the paratrooper and their equipment,
ii. The weight and number of Static Lines and Deployment Bags already attached to the retrieval system,
iii. The aerodynamic forces acting on the parachutist and Static Lines and Deployment Bag.
b. The amount of time required to recover the paratrooper.
c. Storage and availability of retrieval equipment.
d. Risk to paratroopers introduced by equipment and other protrusions both inside and on the exterior of
the aircraft.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970
in section A.2) STANAG
Reference:
FAA Doc: EASA CS
Reference:
20.1.12 Personnel airdrop operations.

For airdrop operations the aircraft's aerodynamics shall be designed to ensure that the risk to
paratroopers is minimised, including paratrooper collision, adverse vortex interaction and adverse multi-
ship formation effects.

a. Defining the acceptable risk level for the activity;
b. Determining paratrooper exit spacing/timing to minimise risk;
c. Determining acceptable aircraft proximities during multi-ship formation air-drops;
d. Ensuring that National rules and regulations, or operational procedures, reflect any required safety
limitations.

1. Verification means may include design documentation, risk assessment and computational modelling
of aircraft vortex interaction.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P1 2.17
contact for this discipline (listed Reference: 00-970 P1 2.17.6
in section A.2) 00-970 P1 2.17.8
Information Sources
00-970 P1 2.17.28
00-970 P1 2.17.32
00-970 P1 2.24.19
STANAG
Reference:
FAA Doc: EASA CS
Reference:
20.1.13 Cargo jettison capability.

For authorised air-drop or jettisonable cargo, the loaded items shall be dropped or jettisoned safely during
flight.

a. Defining the acceptable risk level for the activity;
b. Proximity of dropped or jettisoned cargo to aircraft structure after the cargo leaves the aircraft. This
should account for any induced motion such as tumbling;
c. Determining, where necessary, spacing or timing gaps between multiple items of cargo to minimise
risk;
d. Different weights and shapes of cargo;
e. Configuration of aircraft for air-drop or jettison procedures. For example, account should be taken of
flaps and undercarriage position and their effect on airflow;
f. Ensuring that National rules and regulations, or operational procedures, reflect any required safety
limitations.

1. The capability to airdrop the specified types and sizes of cargo should be defined and substantiated
through analysis and flight testing.
2. The ability to jettison items of palletized cargo should be demonstrated and documented.
3. Extensive flight testing should define the range of hardware items and the required parameters
necessary to perform preplanned airdrop and unplanned jettisoning of cargo loads.
4. The range of testing should include maximum and minimum weights, locations, airspeeds, and other
limitations as needed for technical input into the operational manuals.
Information Sources
Comm'l Doc:
JSSG-2009: Appendix J Reference: 00-970 P1 1.1.29
00-970 P1 1.1.30
00-970 P1 2.17.1
00-970 P1 2.17.6
00-970 P1 2.17.8
00-970 P1 2.17.32
00-970 P1 2.24.19
00-970 P5 UK25.3.1.1 00-970
P7 L100 16
STANAG
Information Sources
Reference:
FAA Doc: EASA CS
Reference:
20.1.14 In-flight movement

Any necessary in-flight movement or operation of transported items or role equipment shall not adversely
affect aircraft flight systems or cause injury to aircrew or passengers.

a. All in-flight movements or operation of transported items shall be fully justified;
b. If moved during flight, transported items must remain under strict control at all times;
c. Transported items, if moved, must remain within the weight and balance limits for the aircraft. See Line
9.8.4 for details;
d. Transported items, if moved, must remain within the designated cargo volume of the aircraft keeping
the crew access and passenger escape routes clear at all times. See Line 9.8.2 for details;
e. Transported items, if operated mechanically, must remain within the aircraft weight and balance limits,
and the designated cargo volume. See Lines 9.8.2 and 9.8.4 for details;
f. Transported items, if operated electrically, must be electro-magnetically compatible with the aircraft.
See Section 13 for details;
g. In-flight movement or operation of transported equipment shall only be in accordance with National
rules or operational procedures.

1. Analysis and testing should verify that operation or movement of equipment does not put the aircraft
out of established balance limits if it is relocated or used anywhere within operational possibilities.
2. Transported equipment which, in a dynamic situation, could impose risks to personnel should only be
moved in a manner that affords control of the object at all times.
3. Items with components or materials that could pose a hazard should be drop tested to verify safety of
possible post drop configurations and any release of hazardous materials.
Information Sources
Comm'l Doc:
DoD/MIL Doc: MIL-HDBK-1791: 4.2, 5.2 Def-Stan 00-970
JSSG-2009: Appendix J Reference:
STANAG
Reference:
FAA Doc: EASA CS
Reference:
20.1.15 Mission-specific equipment installation.

In-flight operation of mission-specific equipment shall not adversely affect the safety of the aircraft
system.

a. Ensuring that all other equipment used in association with mission equipment that is not part of the
aircraft installation, such as lifting strops and spreader bars, is:
i. Tested and trialled appropriately and authorised for use on that aircraft.
ii. The aircraft documentation explicitly records which mission-specific equipment is authorised for use on
that aircraft and any operational limitations associated with its use (i.e. operational restrictions such as
speed, height, or weather).
b. Ensuring that any other limitations associated with this equipment, such as allowable weights, strop
angles, use with other equipment, or lifing requirements including re-test should be clearly recorded;
c. Mission specific (cargo and personnel) equipment such as cargo hooks, rescue slings and hoist, H-Bar
and FRIES bar.

1. Hazard analysis and/or test data to verify that no additional safety hazards to the aircraft are induced
by the installation and function of mission specific equipment.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P7 L205/1
in section A.2) STANAG 4671.1481
Reference:
CS 23.1309
CS 25.1309
CS 27.1309
CS 29.1309
20.2 MISSION/TEST EQUIPMENT OPERATIONS AND INSTALLATION.
20.2.1 In-flight operations.

The following items shall not adversely affect the primary SOF functionality of the aircraft:
a. Special non-SOF mission or test equipment and software including instrumentation and wiring.
b. Non-SOF mission-specific equipment and software.
c. Non-essential mission equipment (hardware and software).
d. Carry-on/carry-off equipment that will be operated in flight.

a. Structural capability, flying and handling qualities, electronic compatibility;
b. Ensuring that all items of equipment intended for use on the aircraft, but not part of the aircraft, are
authorised for use in their intended role.
c. Ensuring that all items of equipment authorised for use on the aircraft, but not part of the aircraft, are
clearly documented, along with any limitations to that use such as during particular phases of flight.
d. The impact that any special, essential, or non-essential mission or test equipment might have on the
aircraft or its systems. Particular, but not exclusive, attention should be given to equipment:
i. Floor or rack loading limits.
ii. Power requirements, and any effect that may be reflected back into the aircraft power supply (i.e spikes
etc)
iii. EMC and EMI effects.
iv. Impact or changes to aircraft overall weight or centre of gravity.
v. Potential fire or explosion risks.

e. Ensuring that carry-on/carry-off equipment intended for use or operation in flight is appropriately
authorised and any necessary limitations to that use highlighted and recorded. Particular attention should
be paid to transmitting equipment including Portable Electrical Devices (PEDs) such as laptops, ipads,
mobile phones and other personal electronic devices.
f. Reviewing Section 9.8 ' Air Transportability and Airdrop'.

1. Hazard analysis and/or test data is to verify that no additional safety hazards to the aircraft are induced
by the installation and function of non-SOF equipment.
Information Sources
Comm'l Doc:
Reference:
STANAG 4671.1481
Reference:
FAA Doc: EASA CS
Reference:
20.2.2 Installation safety.

Carriage of cargo or payload shall not adversely affect safety of the aircraft system.

a. Provision of suitable cargo or payload restraint mechanisms.
b. Physical size and weight of cargo or payload, and its floor loading, in comparison to vehicle hold or
compartment.
c. Potential impact on the aircraft overall weight and centre of gravity.
d. Interference with vehicle control systems.
e. Obstruction of crew or passenger exits.
f. Potential fire or explosion risks.
g. Reviewing Section 9.8 ' Air Transportability and Airdrop'.

1. Hazard analysis and/or test data verifies that no additional safety hazards to the aircraft are induced by
the installation and function of cargo and/or payload.
Information Sources
Comm'l Doc:
DoD/MIL Doc: Refer to technical point of Def-Stan 00-970 00-970 P1 3.9.20
contact for this discipline (listed Reference: 00-970 P1 4.26.56
in section A.2) 00-970 P1 4.26.57
00-970 P7 L203 3.3
STANAG 4671.685
Reference: 4671.787
4671.1481
Information Sources
FAA Doc: 14CFR reference sections EASA CS CS 23.685
corresponding to Structural Reference: CS 23.787
and Installation requirements; CS 25.685
and systems as applicable, i.e.,
CS 25.787
Electrical.
20.1.3 Verify that in-flight CS 27.685
operation of mission-specific CS 27.787
personnel and cargo CS 29.685
equipment (e.g., cargo hooks, CS 29.787
rescue slings and hoists, H-bar
and FRIES bar) does not
adversely affect safety of the
air vehicle system.
20.3 PAN-PLATFORM CRITERIA.
20.3.1 Volcanic Ash.

The ability of any aircraft to operate in, or in the vicinity of, a volcanic ash cloud shall be clearly
understood and detailed in the aircraft operating manuals. It is understood that military operational
imperatives may override this regulatory criteria as necessary.

a. Engine abrasion corrosion;
b. Blockage of engine cooling ducts/vents or paths;
c. Aircraft skin and transparency abrasion;
d. Damage to systems from ingestion of particles (air conditioning, electronic cooling, contamination of
surfaces or fluids, etc.)
e. Blockage of air data system (pitot or static systems);
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:
20.3.2 ETOPS.
Where twin-engined civil derived military aircraft, or civil aircraft operated on the military register, are
required to carry out extended range operations they should be suitable certified for ETOPS. However, it
is recognised that military operational requirements may override this regulatory requirement as
necessary. Moreover, it is also recognised that national military airworthiness/aviation authorities may
determine that specific regulatory requirements may not need to be applied to a specific platform.

a. Aircraft configuration;
b. Aircraft duration;
c. Air to air refuelling capabilities;
d. Crew workload and operational implications;
e. Crew and passenger physiological needs including provision of: fluids, food, and suitable toilet facilities
Information Sources
Comm'l Doc:
DoD/MIL Doc: Def-Stan 00-970 00-970 Pt 11 3.E.1040
Reference:
STANAG
Reference:
Reference: CS-E 1040
20.3.3 Level ground position.

There must be means for determining when the aeroplane is in a level position on the ground.

a. Embarked Operations on Ships Vessels etc.
Information Sources
Comm'l Doc:
Reference:
STANAG
Reference:
Reference:

Emacc HDBK Edition 3 1 Endorsed 20180925

Uploaded by

Copyright:

Available Formats

Emacc HDBK Edition 3 1 Endorsed 20180925

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Emacc HDBK Edition 3 1 Endorsed 20180925

Uploaded by

Copyright:

Available Formats

EUROPEAN MILITARY AIRWORTHINESS

CERTIFICATION CRITERIA (EMACC)

Edition Number 3.1

Edition Date 25 September 2018

Edition MAWA Forum /

DOCUMENT CHANGE RECORD

Edition Edition Reason for change Sections or pages

The Status of the document can take 3 values:

Edition will have the following template: Edition X.Y

SECTION 1 - SCOPE ......................................................................................................................................... 8

1.1 Purpose ............................................................................................................................................... 8

SECTION 2 - APPLICABLE DOCUMENTS .................................................................................................... 11

2.1 General ............................................................................................................................................. 11

SECTION 3 - DEFINITIONS & ABBREVIATIONS .......................................................................................... 21

3.1 Definitions ......................................................................................................................................... 21

SECTION 4 - SYSTEMS ENGINEERING ........................................................................................................ 28

4.1 Design criteria. .................................................................................................................................. 29

SECTION 5 - STRUCTURES ........................................................................................................................... 46

5.1 Loads ................................................................................................................................................ 47

SECTION 6 - FLIGHT TECHNOLOGY ............................................................................................................ 83

6.1 Flying qualities. ................................................................................................................................. 84

SECTION 7 - PROPULSION AND PROPULSION INSTALLATIONS .......................................................... 188

7.1 Propulsion Risk Management. ........................................................................................................ 192

SECTION 8 - AIRCRAFT SYSTEMS............................................................................................................. 265

8.1. HYDRAULIC AND PNEUMATIC SYSTEMS. ................................................................................ 265

SECTION 9 - CREW SYSTEMS .................................................................................................................... 458

9.1. ESCAPE AND EGRESS SYSTEM. ............................................................................................... 458

SECTION 10 - DIAGNOSTICS SYSTEMS .................................................................................................... 504

10.1. FAILURE MODES........................................................................................................................ 504

SECTION 11 - AVIONICS .............................................................................................................................. 511

11.1. AVIONICS ARCHITECTURE. ..................................................................................................... 511

SECTION 12 - ELECTRICAL SYSTEM ......................................................................................................... 526

12.1. ELECTRIC POWER GENERATION SYSTEM. ........................................................................... 526

SECTION 13 - ELECTROMAGNETIC ENVIRONMENTAL EFFECTS (E3) ................................................. 548

13.1. COMPONENT/SUBSYSTEM E3 QUALIFICATION. ................................................................... 548

SECTION 14 - SYSTEM SAFETY ................................................................................................................. 558

14.1. SYSTEM SAFETY PROGRAM. .................................................................................................. 558

SECTION 15 - COMPUTER SYSTEMS AND SOFTWARE .......................................................................... 580

15.1. AIRCRAFT PROCESSING ARCHITECTURE ............................................................................ 580

15.5 Software architecture and design. ................................................................................................ 598

SECTION 16 - MAINTENANCE ..................................................................................................................... 611

16.1. MAINTENANCE MANUALS/CHECKLISTS................................................................................. 611

SECTION 17 - ARMAMENT/STORES INTEGRATION ................................................................................ 620

17.1 Gun/rocket integration and interface............................................................................................. 621

SECTION 18 - PASSENGER SAFETY ......................................................................................................... 635

18.1. SURVIVABILITY OF PASSENGERS. ......................................................................................... 635

SECTION 19 - MATERIALS .......................................................................................................................... 649

19.1 Properties and processes. ............................................................................................................ 650

SECTION 20 - OTHER CRITERIA ................................................................................................................. 660

20.1 Air transportability and airdrop. ..................................................................................................... 660

1.2.1 Tailoring to Create the Certification Basis

• The approach to governance and the associated contracting model(s);

1.3 CROSS REFERENCES

1.4 INFORMATION SOURCES

SECTION 2 - APPLICABLE DOCUMENTS

2.2 DEFENCE STANDARDS

• Defence Standard 00-56 - Safety Management Requirements for Defence Systems;

STANAG Edition STANAG Title Relevant Ratified by pMS Ratified with