JSSG 2009a

Downloaded from http://www.everyspec.
com
NOT MEASUREMENT
SENSITIVE
JSSG-2009A
20 November 2013
SUPERSEDING
JSSG-2009
30 October 1998
DEPARTMENT OF DEFENSE
JOINT SERVICE SPECIFICATION GUIDE
AIR VEHICLE SUBSYSTEMS
This specification guide is for guidance only.

Do not cite this document as a requirement.
Comments, suggestions, or questions on this document should be addressed to

AFLCMC/ENRS, 2145 MONAHAN WAY, WRIGHT-PATTERSON AFB OH 45433-7017
USA or e-mailed to AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.
Since contact information can change, you may want to verify the currency of this
address information using the ASSIST Online database at https://assist.dla.mil.
AMSC N/A FSC 15GP

DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.
Downloaded from http://www.everyspec.com
JSSG-2009A
FOREWORD
JOINT SERVICE SPECIFICATION GUIDE (JSSG) RELEASE NOTE
This specification guide is predicated on a performance-based business environment

approach to product development. It is intended to be used in the preparation of performance
specifications. The JSSG Suite includes this document; JSSG-2000, Air System; JSSG-2001,
Air Vehicle; JSSG-2005, Avionics; JSSG-2006, Structures; JSSG-2007, Engines; JSSG-2008,
Vehicle Control and Management; JSSG-2010, Crew Systems; and JSSG-2011, Air Vehicle /
Ship Integration. The JSSG Suite Compact Disc is available from AFLCMC/ENRS,
2145 MONAHAN WAY, WPAFB OH 45433-7017 USA; DSN 674-5476; COMMERCIAL (937)
904-5476; AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.
The following direction and guidance is applicable to this document:
1. This specification guide, in conjunction with its companion JSSGs, is intended for use by
Government and Industry program teams as guidance in developing program-unique
specifications. This document may not be placed on contract.
2. The complete set of JSSGs establish a common framework to be used by Government-

Industry Program Teams in the Aviation Sector to develop program-unique requirements
documents for Air Systems, Air Vehicles, and major Subsystems. Each JSSG contains a
compilation of candidate references; generically-stated requirements; verification criteria; and
associated rationale, guidance, and lessons learned for the program teams’ consideration. The
JSSGs identify typical requirements for a variety of aviation roles and missions. By design, the
JSSG sample language for “requirements” and "verification criteria" are written as generic
templates, with blanks that need to be completed to make the requirements meaningful.
Program teams need to review the JSSG rationale, guidance, and lessons learned to:
(1) determine which requirements are relevant to their application; and (2) fill in the blanks with
appropriate, program-specific requirements.
3. This document consists of two parts. Part 1 of this document is a template to develop the
program-unique performance specification. As a generic document, it contains requirement
statements for the full range of aviation sector applications. It must be tailored to delete non-
applicable requirements to form the program-unique specification. In addition, where blanks
exist, these blanks must be filled-in for the program-unique specification to form a complete and
consistent set of requirements to meet program objectives. Part 2 of this document is a
handbook which provides the rationale, guidance, and lessons learned relative to each
statement in Part 1. The section 4 verification requirements must be tailored to reflect an
understanding of: (1) the design solution, (2) the identified program milestones, (3) the
associated level of maturity which is expected to be achieved at those milestones, and (4) the
specific approach to be used in the design and verification of the required products and
processes. It must be recognized that the rationale, guidance, and lessons learned are not only
generic in nature but also document what has been successful in past programs and practices.
This must not be interpreted to limit new practices, processes, methodologies, or tools.
ii
JSSG-2009A
PART 1 CONTENTS
1. SCOPE ............................................................................................................... 1
1.1 SCOPE ............................................................................................................... 1
1.2 STRUCTURE ..................................................................................................... 1
1.3 HANDBOOK ....................................................................................................... 1
1.4 DEVIATIONS ...................................................................................................... 1
1.5 ENVIRONMENTAL IMPACT .............................................................................. 1
1.6 RESPONSIBLE ENGINEERING OFFICE .......................................................... 2
2. APPLICABLE DOCUMENTS ............................................................................. 2
2.1 GENERAL .......................................................................................................... 2
2.2 GOVERNMENT DOCUMENTS.......................................................................... 2
2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS .................................... 2
2.3 ORDER OF PRECEDENCE............................................................................... 3
2.4 STREAMLINING................................................................................................. 3
3. REQUIREMENTS............................................................................................... 4
3.1 DEFINITION ....................................................................................................... 4
3.1.1 FUNCTIONAL DIAGRAM ................................................................................... 4
3.1.2 INTERFACE DRAWING ..................................................................................... 4
3.2 CHARACTERISTICS.......................................................................................... 4
3.2.1 SECURITY ......................................................................................................... 4
3.2.2 COMPUTER RESOURCES ............................................................................... 4
3.2.3 OBSERVABLES ................................................................................................. 5
3.2.3.1 ELECTROMAGNETIC EMISSIONS................................................................... 5
3.2.4 SURVIVABILITY ................................................................................................. 5
3.2.5 RELIABILITY ...................................................................................................... 5
3.2.6 MAINTAINABILITY ............................................................................................. 5
3.2.7 INTEGRITY AND ENVIRONMENT .................................................................... 5
3.2.7.1 SERVICE LIFE AND USAGE ............................................................................. 5
3.2.7.1.1 DESIGN SERVICE LIFE .................................................................................... 5
3.2.7.2 ENVIRONMENT ................................................................................................. 5
3.2.7.3 CRASH WORTHINESS...................................................................................... 6
3.2.7.4 MATERIALS AND PROCESSES ....................................................................... 6
3.2.7.4.1 COATINGS AND FINISHES............................................................................... 6
3.2.7.4.2 PROHIBITED MATERIALS AND PROCESSES ................................................ 6
3.2.7.4.3 PRODUCIBILITY ................................................................................................ 6
3.2.7.4.4 DAMAGE TOLERANCE ..................................................................................... 6
3.2.7.4.4.1 SAFETY AND MISSION CRITICAL FUNCTIONS ............................................. 6
3.2.7.4.4.2 DAMAGE TOLERANT - FAIL SAFE EVIDENT SUBSYSTEMS
AND COMPONENTS ......................................................................................... 6
3.2.7.4.4.3 MECHANICAL COMPONENT DAMAGE TOLERANCE .................................... 6
3.2.7.5 STRENGTH ........................................................................................................ 7
3.2.7.6 DURABILITY AND ECONOMIC LIFE ................................................................ 7
3.2.7.6.1 CORROSION ..................................................................................................... 7
3.2.7.6.2 HIGH CYCLE FATIGUE (HCF) .......................................................................... 7
3.2.7.6.3 LOW CYCLE FATIGUE (LCF)............................................................................ 7
3.2.7.6.4 DIELECTRIC MATERIALS ................................................................................. 7
3.2.7.6.5 CREEP ............................................................................................................... 7
3.2.8 TRANSPORTABILITY ........................................................................................ 7
3.2.9 INTEGRATED DIAGNOSTICS........................................................................... 7
3.2.9.1 FAULT DETECTION AND ISOLATION .............................................................. 8
3.2.10 NAMEPLATE AND PRODUCT MARKING ......................................................... 8
iii
JSSG-2009A
3.3 DESIGN AND CONSTRUCTION ....................................................................... 8

3.3.1 INTERCHANGEABILITY .................................................................................... 8
3.3.2 NON-INTERCHANGEABILITY ........................................................................... 8
3.3.3 SAFETY.............................................................................................................. 8
3.3.3.1 SAFETY CRITERIA ............................................................................................ 8
3.3.3.2 FOREIGN OBJECT DAMAGE (FOD) ................................................................ 9
3.3.3.3 SOFTWARE SAFETY ........................................................................................ 9
3.3.3.4 ACOUSTIC NOISE ............................................................................................. 9
3.3.4 ELECTROMAGNETIC ENVIRONMENTAL EFFECTS (E3) ............................... 9
3.3.5 STANDARDIZATION.......................................................................................... 9
3.3.6 ENVIRONMENTAL............................................................................................. 9
3.3.7 HEALTH ............................................................................................................. 9
3.3.8 INSTALLATION HAZARDS REDUCTION ......................................................... 9
3.4 SUBSYSTEM CHARACTERISTICS ................................................................ 10
3.4.1 LANDING SUBSYSTEM .................................................................................. 10
3.4.2 HYDRAULIC POWER SUBSYSTEM ............................................................... 10
3.4.3 AUXILIARY POWER SUBSYSTEM ................................................................. 10
3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEMS .............................................. 10
3.4.5 FUEL SUBSYSTEM ......................................................................................... 10
3.4.6 AERIAL REFUELING SUBSYSTEM ................................................................ 10
3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................... 10
3.4.8 ELECTRICAL POWER SUBSYSTEM.............................................................. 10
3.4.9 MECHANICAL SUBSYSTEMS ........................................................................ 10
3.4.10 CARGO, AERIAL DELIVERY, AND
SPECIAL OPERATIONS SUBSYSTEM........................................................... 10
3.4.11 VERTICAL TAKEOFF AND LANDING – SHORT TAKEOFF
AND LANDING POWER DRIVE SUBSYSTEMS ............................................. 10
3.4.12 PROPELLER SUBSYSTEM ............................................................................. 11
3.4.13 PNEUMATIC SUBSYSTEM ............................................................................. 11
3.4.14 ADDITIONAL SUBSYSTEMS AND FUNCTIONS ............................................ 11
4. VERIFICATION ................................................................................................ 12
4.1 DEFINITION ..................................................................................................... 12
4.1.1 FUNCTIONAL DIAGRAM ................................................................................. 12
4.1.2 INTERFACE DRAWING ................................................................................... 12
4.2 CHARACTERISTICS........................................................................................ 12
4.2.1 SECURITY ....................................................................................................... 12
4.2.2 COMPUTER RESOURCES ............................................................................. 12
4.2.3 OBSERVABLES ............................................................................................... 12
4.2.3.1 ELECTROMAGNETIC EMISSIONS................................................................. 12
4.2.4 SURVIVABILITY ............................................................................................... 12
4.2.5 RELIABILITY .................................................................................................... 12
4.2.6 MAINTAINABILITY ........................................................................................... 12
4.2.7 INTEGRITY AND ENVIRONMENT .................................................................. 13
4.2.7.1 SERVICE LIFE AND USAGE ........................................................................... 13
4.2.7.1.1 DESIGN SERVICE LIFE .................................................................................. 13
4.2.7.2 ENVIRONMENT ............................................................................................... 13
4.2.7.3 CRASH WORTHINESS.................................................................................... 13
4.2.7.4 MATERIALS AND PROCESSES ..................................................................... 13
4.2.7.4.1 COATINGS AND FINISHES............................................................................. 13
4.2.7.4.2 PROHIBITED MATERIALS AND PROCESSES .............................................. 13
4.2.7.4.3 PRODUCIBILITY .............................................................................................. 13
iv
JSSG-2009A
4.2.7.4.4 DAMAGE TOLERANCE ................................................................................... 13

4.2.7.4.4.1 SAFETY AND MISSION CRITICAL FUNCTIONS ........................................... 13
4.2.7.4.4.2 DAMAGE TOLERANT - FAIL SAFE EVIDENT SUBSYSTEMS AND
COMPONENTS ................................................................................................ 13
4.2.7.4.4.3 MECHANICAL COMPONENT DAMAGE TOLERANCE .................................. 14
4.2.7.5 STRENGTH ...................................................................................................... 14
4.2.7.6 DURABILITY AND ECONOMIC LIFE .............................................................. 14
4.2.7.6.1 CORROSION ................................................................................................... 14
4.2.7.6.2 HIGH CYCLE FATIGUE (HCF) ........................................................................ 14
4.2.7.6.3 LOW CYCLE FATIGUE (LCF).......................................................................... 14
4.2.7.6.4 DIELECTRIC MATERIALS ............................................................................... 14
4.2.7.6.5 CREEP ............................................................................................................. 14
4.2.8 TRANSPORTABILITY ...................................................................................... 14
4.2.9 INTEGRATED DIAGNOSTICS......................................................................... 14
4.2.9.1 FAULT DETECTION AND ISOLATION ............................................................ 14
4.2.10 NAMEPLATE AND PRODUCT MARKING ....................................................... 14
4.3 DESIGN AND CONSTRUCTION ..................................................................... 15
4.3.1 INTERCHANGEABILITY .................................................................................. 15
4.3.2 NON-INTERCHANGEABILITY ......................................................................... 15
4.3.3 SAFETY............................................................................................................ 15
4.3.3.1 SAFETY CRITERIA .......................................................................................... 15
4.3.3.2 FOREIGN OBJECT DAMAGE (FOD) .............................................................. 15
4.3.3.3 SOFTWARE SAFETY ...................................................................................... 15
4.3.3.4 ACOUSTIC NOISE ........................................................................................... 15
4.3.4 ELECTROMAGNETIC ENVIRONMENTAL EFFECTS (E3) ............................. 15
4.3.5 STANDARDIZATION........................................................................................ 15
4.3.6 ENVIRONMENTAL........................................................................................... 15
4.3.7 HEALTH ........................................................................................................... 16
4.3.8 INSTALLATION HAZARDS REDUCTION ....................................................... 16
4.4 SUBSYSTEM CHARACTERISTICS ................................................................ 16
4.4.1 LANDING SUBSYSTEM .................................................................................. 16
4.4.2 HYDRAULIC POWER SUBSYSTEM ............................................................... 16
4.4.3 AUXILIARY POWER SUBSYSTEM ................................................................. 16
4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEMS .............................................. 16
4.4.5 FUEL SUBSYSTEM ......................................................................................... 16
4.4.6 AERIAL REFUELING SUBSYSTEM ................................................................ 16
4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................... 16
4.4.8 ELECTRICAL POWER SUBSYSTEM.............................................................. 16
4.4.9 MECHANICAL SUBSYSTEMS ........................................................................ 16
SPECIAL OPERATIONS SUBSYSTEM........................................................... 16
AND LANDING POWER DRIVE SUBSYSTEMS ............................................. 17
4.4.12 PROPELLER SUBSYSTEM ............................................................................. 17
4.4.13 PNEUMATIC SUBSYSTEM ............................................................................. 17
4.4.14 ADDITIONAL SUBSYSTEMS AND FUNCTIONS ............................................ 17
5. PACKAGING .................................................................................................... 18
6. NOTES ............................................................................................................. 18
6.1 INTENDED USE ............................................................................................... 18
6.2 ACQUISITION REQUIREMENTS .................................................................... 18
6.3 DEFINITIONS ................................................................................................... 18
v
JSSG-2009A
6.4 ACRONYMS ..................................................................................................... 23

6.5 SUBJECT TERM (KEY WORD) LISTING ........................................................ 24
6.6 CHANGES FROM PREVIOUS ISSUE ............................................................. 25
6.7 RESPONSIBLE ENGINEERING OFFICE ........................................................ 25
vi
JSSG-2009A
JOINT SERVICE SPECIFICATION GUIDE
AIR VEHICLE SUBSYSTEMS

This specification guide is approved for use by all Departments and Agencies of the
Department of Defense.
1. SCOPE
1.1 Scope.
This specification establishes the item definition, performance, operating characteristics,

reliability, maintainability, physical characteristics, general design, installation, and interface
requirements for Air Vehicle Subsystems. This specification also establishes the analysis,
inspection, demonstrations, and test procedures required by the Using Service for satisfactory
completion and acceptance of subsystem component qualifications at the SFR, PDR, CDR, FF,
and SVR Milestones. This specification also establishes the content and format to be used by
the Using Service or contractor for preparation of the acquisition or model specification.
The (TBS) Air Vehicle is composed of airframe, propulsion, avionics, crew station, flight
controls, vehicle management system, and subsystems. This specification addresses only the
subsystems. The purpose of (TBS) air vehicle subsystems is to provide mechanization,
hydraulic, electrical, auxiliary, and pneumatic power, landing provisions, electronics and
airframe cooling, fuel, and fire protection.
1.2 Structure.
This specification complies with Guidance for Preparation and Use of Joint Services Guide
Specifications, AEB 96-1.
1.3 Handbook.
This specification has an accompanying tailoring handbook to be used for contractual purposes
in the development of air vehicle subsystems requirements.
1.4 Deviations.
Deviations from this specification which will result in improvement of the system performance,
reduced life cycle cost, reduced developmental cost, or where the requirements of this
specification result in compromise in operational capability, should be brought to the attention of
the Using Service.
1.5 Environmental impact.
Air Vehicle Subsystems will be designed such that their operation, maintenance, and repair may
be accomplished without violating the most stringent environmental regulations applicable to
locations where subsystems are used or supported. Compliance with environmental regulations
will not prevent subsystems from achieving and sustaining mission performance capability.
1
JSSG-2009A
Materials, processes, and environmental control equipment necessary to meet these

environmental requirements must currently be available in the Using Service’s maintenance and
supply system. The design will not use environmentally unsuitable materials such as ozone
depleting fluorocarbons, chlorofluorocarbons, and halons, or highly volatile organic compounds
in solvents and coatings during development, production, operation, maintenance, or repair. The
Environmental Protection Agency maintains an online list of toxic chemicals and hazardous
substances on its Ozone Layer Depletion Website at http://www.epa.gov/ozone/snap/ that
should be consulted. The Significant New Alternatives Policy (SNAP) Program available
thereon identifies substitutes for ozone depleting chemicals.
The contractor will conduct an environmental analysis of air vehicle subsystems.
1.6 Responsible engineering office.
The responsible engineering office (REO) for this specification is AFLCMC/EZFA, WRIGHT-
PATTERSON AFB, OH 45433-7017; DSN 785-2023, COMMERCIAL (937) 255-2023;
AFLCMC.EZF.MAILBOX@US.AF.MIL.
2. APPLICABLE DOCUMENTS
2.1 General.
The documents listed in this section are specified in sections 3, 4, or 5 of this specification. This
section does not include documents cited in other sections of this specification or recommended
for additional information or as examples. While every effort has been made to ensure the
completeness of this list, document users are cautioned that they must meet all specified
requirements of documents cited in sections 3, 4, or 5 of this specification, whether or not they
are listed.
2.2 Government documents
2.2.1 Specifications, standards, and handbooks.

The following specifications, standards, and handbooks form a part of this document to the
extent specified herein. Unless otherwise specified, the issues of these documents are those
cited in the solicitation or contract.
DEPARTMENT OF DEFENSE SPECIFICATIONS

JSSG-2000 Air System Joint Service Specification Guide
JSSG-2001 Air Vehicle Joint Service Specification Guide
DEPARTMENT OF DEFENSE STANDARD

MIL-STD-130 Identification Marking of U.S. Military Property
2
JSSG-2009A
(Copies of these documents are available online at http://quicksearch.dla.mil or from the

Standardization Document Order Desk, 700 Robbins Avenue, Bldg 4D, Philadelphia PA 19111-
5094.)
2.3 Order of precedence.
Unless otherwise noted herein or in the contract, in the event of a conflict between the text of
this document and the references cited herein, the text of this document takes precedence.
Nothing in this document, however, supersedes applicable laws and regulations unless a
specific exemption has been obtained.
2.4 Streamlining.
This specification has been streamlined. The documents listed herein which are required for
acquisition have the same status as those referenced directly in section 2 (first tier). All other
documents referenced through tiering may be used for guidance and information.
3
JSSG-2009A
3. REQUIREMENTS
3.1 Definition.
The (TBS 1) air vehicle shall perform the identified table I functions and meet the
requirements for safety, mission reliability, and vehicle growth as specified in (TBS 2) .
TABLE I. Subsystems functions.
(TBS 3) .
3.1.1 Functional diagram.

Functional diagrams for the (TBS) shall be provided.
3.1.2 Interface drawing.

Interface drawings for the (TBS) shall be provided.
3.2 Characteristics
3.2.1 Security.
Subsystem security shall be in accordance with (TBS) .
3.2.2 Computer resources.

The computer resources, hardware and software, dedicated to the control of air vehicle
subsystems shall support allocated air vehicle subsystem functional requirements. Computer
resources hardware defined as, electric/electronic sensor data collection devices (data input),
electric and electronic effector devices (data output), analog, digital communication paths (serial
and parallel data buses), data processing elements (general or specialized CPUs), and power
supply characteristics shall be defined by computer resources. Computer resources software,
defined as High Order Language (HOL), software development and testing tools (software
environment), and software development processes shall be characterized by computer
resources. Computer resources hardware and software shall be designed as an open
architecture that is expandable, upgradable and compatible with other computer resources
within the air vehicle to maintain security requirements.
The computer resources shall support the (TBS) level maintenance concept.
A hardware and software obsolescence plan shall be implemented for computer resources to
address maintenance of the air vehicle.
4
JSSG-2009A
3.2.3 Observables.
Subsystem IR, acoustics, radar, and visual observable requirements shall be as follow: (TBS) .
3.2.3.1 Electromagnetic emissions.
Electromagnetic emissions shall be in accordance with (TBS) .
3.2.4 Survivability.
The air vehicle subsystems shall be designed and integrated into the air vehicle to meet the
survivability requirements of the air vehicle as specified in (TBS 1) . Specific subsystem
allocated and derived susceptibility and vulnerability requirements shall be as follow: (TBS 2) .
3.2.5 Reliability.
The air vehicle subsystem requirements shall be consistent with JSSG-2001 Air Vehicle
“Reliability” requirements.
3.2.6 Maintainability.
The air vehicle subsystem maintainability requirements shall be in accordance with JSSG-2001.
3.2.7 Integrity and environment
3.2.7.1 Service life and usage
3.2.7.1.1 Design service life.
The subsystem design service life shall be in accordance with JSSG-2001 Air Vehicle “Design
service life”.
3.2.7.2 Environment.
Each subsystem shall meet the performance requirements of this specification before, during,
and after exposure to any operational combination of the following natural and induced
environments:
a. Natural environment: (TBS 1) .
b. Induced environment. The induced environments for the air vehicle subsystems shall be
developed using the above natural environment and the environment imposed on the
subsystems by the air vehicle design and its operating environment. Induced
environments shall be established for all modes of operation or non-operation including
normal operation, intermittent operation (transient operation), non-operation, storage and
transport. These induced environments shall include (TBS 2) .
5
JSSG-2009A
3.2.7.3 Crash worthiness.
Subsystems shall be in accordance with JSSG-2001, Air Vehicle “Crash worthiness”.
3.2.7.4 Materials and processes.
The materials and processes shall ensure adequate strength, durability, and damage tolerance
capabilities of components as required (TBS) . (See 6.3).
3.2.7.4.1 Coatings and finishes.
Surfaces shall be coated and finished in accordance with JSSG-2001, Air Vehicle Joint Service
Specification Guide.
3.2.7.4.2 Prohibited materials and processes.
The following materials and processes shall be prohibited:
a. Chlorofluorocarbons (CFCs)
b. (TBS) .
3.2.7.4.3 Producibility.
The selected fabrication techniques, design parameters, and tolerances shall enable the
product to be fabricated, assembled, inspected and tested with repeatable quality. A change in
manufacturing process, vendor, vendor location shall be subject to a re-verification process.
3.2.7.4.4 Damage tolerance.
(See 6.3.)
3.2.7.4.4.1 Safety and mission critical functions.

User service specified subsystems and components that perform safety or mission critical
functions shall be damage/fault tolerant. Damage/fault tolerance shall be achieved by (TBS) .
(See 6.3.)
3.2.7.4.4.2 Damage tolerant - fail safe evident subsystems and components.

Damage tolerant - fail safe evident subsystems and components shall be specified.
3.2.7.4.4.3 Mechanical component damage tolerance.

Safety or mission critical components shall maintain adequate damage tolerance in the
presence of the maximum undetected maintenance or manufacturing defect as (TBS) .
6
JSSG-2009A
3.2.7.5 Strength.
Component strength shall be (TBS) .
3.2.7.6 Durability and economic life.
Subsystems shall be durable and economically maintainable throughout the service life.
(See 6.3.)
3.2.7.6.1 Corrosion.
Corrosion shall not degrade the operational readiness or mission performance of the subsystem
during the service life.
3.2.7.6.2 High cycle fatigue (HCF).
Subsystems shall not fail when subject to the combined steady state and vibratory induced
stresses that occur anywhere within the operating envelope and during ground, flight, and
logistics operations.
3.2.7.6.3 Low cycle fatigue (LCF).
Subsystems shall not fail when subject to the combined steady state and cyclic stresses due to
repetitive cycles whether thermally induced, induced by mechanical start and stop cycles or
both, or applied loads.
3.2.7.6.4 Dielectric materials.
Dielectric materials when exposed to maximum predicted voltage shall not fail.
3.2.7.6.5 Creep.
Subsystems shall not fail due to component creep. Part creep shall not interfere with
disassembly, reassembly or function of the subsystem.
3.2.8 Transportability.
Transportability shall be in accordance with JSSG-2001, Air Vehicle “Transportability”.
3.2.9 Integrated diagnostics.

Hardware and software, when required by the Air Vehicle Subsystems Specification, shall be
provided to monitor and record subsystem performance during flight and ground operation, and
to provide data in an organized format for ground analytical condition checkout capability,
component life tracking (if required), warranties, and scheduling maintenance actions. The
malfunction of any diagnostic hardware or software shall not affect subsystem performance or
operability. The diagnostic capability shall be compatible with the air vehicle maintenance
system. The subsystem diagnostic system shall be completely functional after failure of any
other subsystem or subsystem component.
7
JSSG-2009A
3.2.9.1 Fault detection and isolation.
Diagnostics shall provide (TBS) percent detection and isolation of all faults. The on-board
subsystem diagnostics shall provide fault detection and isolation to the faulty LRU/WRA as
required to meet the reliability and maintainability requirements of JSSG-2001. Subsystems
shall be compatible with the mission critical functions of the on-board diagnostic system that
monitors mission and safety critical parameters. The on-board subsystem diagnostics shall not
cause failure of any other mission or safety critical system.
3.2.10 Nameplate and product marking.

Subsystems equipment, assemblies, modules, and parts shall be marked legibly with
machine/man-readable markings per MIL-STD-130 and such that component removal is not
necessary to read the data plate. The machine-readable markings are required for parts whose
cost exceeds five thousand dollars, parts that are serially managed, or parts that are mission
critical. These markings shall be as permanent as the normal life expectancy of the item and be
able to withstand the environmental tests and cleaning procedures specified for the item to
which they are affixed. The type and length of product identification characters on the data plate
shall be compliant with MIL-STD-130 and applicable requirements documents referenced
therein for format compatibility. The contractor shall upload the Item Unique Identification (IUID)
assigned numbers and information into the Government UID (Unique Identification) database
according to the Using Service’s guidance and procedures.
3.3 Design and construction.
Design and construction shall be in accordance with JSSG-2001.
3.3.1 Interchangeability.
Subsystem equipment, which is to be interchangeable and the level of interchangeability shall
be defined.
3.3.2 Non-interchangeability.
It shall not be possible to misconnect electrical or fluid inputs or outputs with like items from the
same or other subsystem equipment.
3.3.3 Safety.
Subsystem safety features shall be provided to optimize the safety of the pilot, maintenance,
and support personnel within the constraints of operational effectiveness, time, and cost.
3.3.3.1 Safety criteria.
Subsystem safety criteria shall be defined.
8
JSSG-2009A
3.3.3.2 Foreign object damage (FOD).
Subsystem tolerance of foreign object damage shall be defined.
3.3.3.3 Software safety.
Air vehicle subsystem Software Safety Critical Items shall be identified and separated or
partitioned from other less critical software.
3.3.3.4 Acoustic noise.

The contractor shall establish acoustic noise level limits for noise producing or noise
transmitting air vehicle subsystems required to meet the acoustic noise level limits for air vehicle
established in JSSG-2001.
3.3.4 Electromagnetic environmental effects (E3).

Subsystem electromagnetic environmental effects shall be in accordance with JSSG-2001.
3.3.5 Standardization.
Standardization principles shall be used to the maximum extent possible without compromise in
design, performance, operability, or economic life of the subsystem.
3.3.6 Environmental.
Environmental requirements for the Air Vehicle Subsystems shall be those specified in the Air
System Joint Service Specification Guide, JSSG-2000, “Environmental,” as applicable.
3.3.7 Health.
Health requirements for the Air Vehicle Subsystems shall be those specified in the Air System
Joint Service Specification Guide, JSSG-2000, “Health,” as applicable.
3.3.8 Installation hazards reduction.

The following designs shall be applied to subsystem installations:
a. Subsystem installation and associated equipment designs shall be such that normal
operation of the subsystem will not contribute to or result in fire and explosion hazards.
b. Subsystem installations and associated equipment designs shall be such that fire and
explosion hazards due to failure or accident are minimized.
c. Subsystem installation boundaries common to the air vehicle exterior shall be designed
such that fire will not readily spread between subsystems due to the natural airflow over
the air vehicle.
9
JSSG-2009A
3.4 Subsystem characteristics
3.4.1 Landing subsystem.

Reference appendix A.
3.4.2 Hydraulic power subsystem.

Reference appendix B.
3.4.3 Auxiliary power subsystem.

Reference appendix C.
3.4.4 Environmental control subsystems.

Reference appendix D.
3.4.5 Fuel subsystem.

Reference appendix E.
3.4.6 Aerial refueling subsystem.

Reference appendix F.
3.4.7 Fire and explosion hazard protection subsystem.

Reference appendix G.
3.4.8 Electrical power subsystem.

Reference appendix H.
3.4.9 Mechanical subsystems.

Reference appendix I.
3.4.10 Cargo, aerial delivery, and special operations subsystem.

Reference appendix J.
3.4.11 Vertical takeoff and landing – short takeoff and landing power drive subsystems.
Reference appendix K.
10
JSSG-2009A
3.4.12 Propeller subsystem.

Reference appendix L.
3.4.13 Pneumatic subsystem.

Reference appendix M.
3.4.14 Additional subsystems and functions.

Reference appendix X.
11
JSSG-2009A
4. VERIFICATION
4.1 Definition.
The basic objective of verification requirements is to verify that the air vehicle subsystem
performance and operability requirements specified in section 3 have been met. This section
specifies the method(s) of verification for each section 3 subsystem requirement. Requirements
shall be verified incrementally (TBS) .
Functional diagrams shall be verified.

Interface drawing shall be verified by (TBS) .
4.2 Characteristics
4.2.1 Security.
Subsystem security shall be verified by (TBS) .

The functional requirements allocated to and implemented by computer resources shall be

verified by (TBS) .
4.2.3 Observables.
Subsystem IR, acoustics, radar, and visual observable requirements shall be verified (TBS) .
The EME requirement shall be verified (TBS) .

The survivability requirements shall be verified as follows: (TBS) .

4.2.5 Reliability.
Reliability requirement shall be verified by (TBS) .

The maintainability requirements shall be verified by (TBS) .
12
JSSG-2009A
Design service life shall be verified in accordance with JSSG-2001.
The subsystems shall be capable of meeting the performance requirements of this specification
before, during, and after exposure to the natural and induced environments as verified by
analyses, tests, and demonstrations.
Subsystem crash worthiness shall be verified through analysis and test.
Material and process requirements shall be verified (TBS) .
Surface coatings and finishes shall be verified to be in accordance with JSSG-2001.
It shall be verified by (TBS) that prohibited materials and processes are not used.
The producibility shall be verified by (TBS) .
4.2.7.4.4 Damage tolerance

It shall be verified that all subsystems that perform safety or mission critical functions are
damage and fault tolerant in the presence of material defects, manufacturing and processing
defects, or maintenance/service induced damage. Damage and fault tolerance shall be verified
by (TBS) .

Subsystem damage tolerance of fail safe-evident subsystems shall be verified by (TBS) .
13
JSSG-2009A

The damage tolerance requirements shall be verified by analysis and test.
4.2.7.5 Strength.
Strength requirements shall be verified by (TBS) .
The durability and economic life shall be verified by (TBS) .
Corrosion protection and control measures shall be verified by (TBS) .

It shall be verified that subsystems subjected to the combined steady state and vibratory
induced stresses that occur anywhere within the operating envelope and during ground, flight,
and logistics operations do not fail.
Low cycle fatigue shall be verified by (TBS) .
Verification of specific dielectric materials when exposed to maximum predicted voltage shall be
by (TBS) .
4.2.7.6.5 Creep.
Subsystems creep characteristics shall be verified by (TBS) .

Transportability requirements shall be verified by (TBS) .

Integrated diagnostics requirements shall be verified by (TBS) .
Fault detection and isolation shall be verified by (TBS) .
The requirement of 3.2.10 shall be verified by inspection.
14
JSSG-2009A
Design and construction requirements shall be verified by (TBS) .

Interchangeability shall be verified by (TBS) .

Non-interchangeability shall be verified by (TBS) .

4.3.3 Safety.
Subsystems safety features to optimize the safety of pilot, maintenance, support personnel, and
the air vehicle shall be verified by (TBS) .
The defined safety criteria shall be verified by (TBS) .
Defined subsystem tolerance to FOD shall be verified by (TBS) .
It shall be verified that air vehicle subsystem Software Safety Critical Items are identified and
separated or partitioned from other less critical software (TBS) .
Acoustic noise levels shall be verified by (TBS) .

The E3 performance of the subsystems shall be verified through a combination of inspection,

analysis, and test.
The application of standardization principles shall be verified by inspection.
Environmental verification requirements for the Air Vehicle Subsystems shall be those specified
in the Air System Joint Service Specification Guide, JSSG-2000, “Environmental Verification,”
as applicable.
15
JSSG-2009A
4.3.7 Health.
Health verification requirements for the Air Vehicle Subsystems shall be those specified in the
Air System Joint Service Specification Guide, JSSG-2000, “Health verification,” as applicable.
By analysis and inspection it should be verified that installation hazards reduction designs have
been used to the fullest extent practicable to prevent the occurrence of fire and explosion due to
the uncontrolled presence of (TBS 1) . The adequacy of the provided design should be
verified by (TBS 2) .

4.4.1 Landing subsystem.
16
JSSG-2009A
Reference appendix X (to be included, as necessary).
17
JSSG-2009A
5. PACKAGING
5.1 Packaging.
For acquisition purposes, the packaging requirements shall be as specified in the contract or
order (see 6.2). When packaging of materiel is to be performed by DoD or in-house contractor
personnel, these personnel need to contact the responsible packaging activity to ascertain
packaging requirements. Packaging requirements are maintained by the Inventory Control
Point's packaging activities within the Military Service or Defense Agency, or within the military
service’s system commands. Packaging data retrieval is available from the managing Military
Department's or Defense Agency's automated packaging files, CD-ROM products, or by
contacting the responsible packaging activity.
6. NOTES
(This section contains information of a general or explanatory nature that may be helpful, but is
not mandatory.)
6.1 Intended use.
The requirements in this specification are intended for the development of subsystems in air
vehicles designed to perform combat and support missions in environments unique to military
weapons systems.
6.2 Acquisition requirements.
Acquisition documents should specify the following:

a. Title, number, and date of this specification.
6.3 Definitions.
Methods of verification
Inspection: Inspection consists of visual examination, physical manipulation, weighing and

measurement, as required to verify the hardware item conforms to the design requirements, and
includes review of documentation that controls the configuration.
Analysis: Analysis is a technical evaluation of equations, graphs, data, etc. Verification by

analyses should be used when it is not feasible to perform tests to obtain the required data.
Analysis should also be used when testing is not warranted for verification of requirements,
such as the capability of simple components to withstand accelerated loads.
Stress analysis: The air vehicle finite element model can be used as the basis for stress
generated by airframe interactions (e.g., actuator hinge movements, leading edge flap side
loads, etc.). Supplemental, vendor finite element models can be used as the basis for the
stress analysis of individual components and design details, where needed. The stress analysis
can also be used as a basis to determine the adequacy of structural changes throughout the life
18
JSSG-2009A
of the subsystem and to determine the adequacy of the subsystem structure for new loading
conditions that result from increased weight or new mission requirements.
Durability analysis: Durability analyses address economic issues. Analysis should be

performed to show individual subsystem components will perform for the required environments
specified herein. These analyses could verify that the development of cracking, corrosion,
wear, deterioration, etc., will not adversely affect subsystem performance within the required
maintenance-free operational periods specified herein.
Damage tolerance: Damage tolerance analyses (see next definition) address safety issues.
The approach to damage tolerance philosophy is based on the assumption that damage
tolerance critical parts contain pre-existing material and/or manufacturing flaws or defects.
These manufacturing flaws include any quality characteristics that contribute to a failure mode
of the equipment. Therefore, it may be assumed that damage tolerance critical parts contain the
maximum acceptable manufacturing defects, including initial cracks - size 0.05 in., excessive
tube ovality - max ovality 5 percent (5%), solder slump/solder void of 25 percent (25%) or
current board reworked 3 times. Note, this is a more general definition of damage tolerance
than is usually associated with the discipline of fracture mechanics. These assumptions are
then analyzed for the worst case to determine the part’s damage tolerance.
The intent of Airplane Damage Tolerant Requirements is to ensure the maximum acceptable
initial damage will not progress to a condition which would endanger flight safety during the
service life of the air vehicle.
Similarly, the intent of the Integrity Program’s Damage Tolerant Requirement is to ensure the
maximum acceptable initial damage will not progress to a condition that compromises flight
safety during the service life of the subsystem equipment. In addition, the Damage Tolerant
Requirement applies to Mission Critical Equipment.
When applied, the Integrity Process will accomplish the Damage Tolerance intent through:
a. Proper material selection and control
b. Control of stress levels
c. Use of damage-resistant design concepts
d. Manufacturing process control
e. Use of qualified inspection procedures.
Tolerance analysis: The objective of tolerance analysis is to predict the effect on circuit
performance of the tolerances inevitably associated with manufactured components.
Demonstration: Demonstration is a test where success is determined by a ”GO” or ”NO-GO”

criteria.
Test: Test is the verification that a requirement is met by a thorough exercise of the subsystem
or item. This includes actual measurement of unit performance with calculations/analysis as
required and under controlled and recorded environment, as applicable.
19
JSSG-2009A
Durability: Test articles must represent production configurations as closely as is necessary to

ensure test validity. Durability testing may be combined with other functional tests.
Because most subsystems consist of many components, the verification of the durability and
economic life must be accomplished by analysis and test of components and a further
consideration of the system or subsystem as a whole.
Process control: This is an element of verification that provides objective evidence of

controlled processes. Examples of evidence may be in the form of control charts derived from
application of SPC, or data from automated inspection, non-destructive evaluation, data from
machines operating under adaptive control, or periodic testing of production samples.
Mission critical item: The mission critical item is an item whose failure alone may generate a
significant adverse impact to air vehicle survivability or result in less than acceptable handling
qualities during air-to-air combat and weapon delivery launch flight phases as defined. The
failure of an individual mission critical item would jeopardize the ability to disengage from a
combat engagement successfully.
Mission essential item: This is an item whose fault-free operation is procedurally required
from launch through recovery of a combat or training mission. All equipment contained in the
Mission Essential Subsystems List (MESL) should be designated as mission essential items.
Safety critical: This is an aspect of the design engineering process that requires careful
judgment and judicious evaluation because of the potential risk to safety. “Safety of Flight” and
“Flight Critical” are terms equivalent to “Safety Critical.”
Safety critical function: This is a function that, if performed incorrectly or not performed, may
result in death, loss of the air vehicle, severe injury, severe occupational illness, or major
system damage.
Safety critical item: This is an item that contributes to a safety-critical function and whose
failure alone may result in death or loss of the system (air vehicle).
Safety significant item. This is an item that contributes to a safety-critical function.
Economic life: The economic life of an asset is the time interval that minimizes the asset’s
total equivalent annual costs. The economic life is also referred to as the “minimum-cost life” or
the “optimum replacement interval.”
Materials and processes selection and characterization: The materials and processes
specified for the subsystems should be selected for compatibility of design, manufacturing, and
assembly while maintaining design integrity and reliability. Special attention should be paid to
the use of materials which minimized materials problems encountered in the past with the other
air vehicle subsystems. New and improved materials and processes which avoid stress
corrosion and brittle fracture, coupled with a design philosophy which recognizes such problem
areas, could result in increased durability.
Test requirements verification: This paragraph defines the various demonstrations, tests, and
other methods of verification which should be utilized to verify quality conformance to section 3
requirements.
20
JSSG-2009A
EMD test program: The EMD test program consists of laboratory, ground, and flight tests. The
basic objective of the test program is to verify that the air vehicle subsystem design will satisfy
the requirements of the air vehicle specification.
Subsystem verifications should be conducted at contractor-, vendor-, or government-furnished

facilities. Subsystem verifications include:
a. inspections and analyses, performance demonstrations, pre-qualification (safety-of-
flight), formal qualification tests, and pre-delivery tests conducted on the respective
components or subsystems; and
b. subsystem compatibility, performance demonstrations, and system-level testing is to
provide confidence that the functional and physical compatibility of the integrated
subsystems has been achieved and supports system performance requirements.
Special tests:
Laboratory: Laboratory testing should be conducted on all Air Vehicle Subsystem Equipment.
Major laboratory test articles include the following:
a. Integrated Vehicle Systems Simulator (Iron Bird)
b. Environmental Control System, Avionics and Cockpit Simulator
c. Electrical System Hot Mockup
d. Fuel System Simulator
e. Fire and Overheat System Simulator
f. Software Development Lab
g. Landing Gear Simulator
h. APS Test Stand
i. Hydraulic and pneumatic system simulator (Iron Bird)
j. Integrated diagnostic and controls simulator
k. Thermal Management System simulator.
21
JSSG-2009A
Subsystem level: The air vehicle subsystem performance and operability verification should
be conducted:
a. Subsystem performance verifications, using elements of the subsystem to verify that
specified performance levels have been achieved.
b. Subsystem operability verifications, utilizing elements of the subsystem to demonstrate

that the subsystem has achieved minimum specified levels of reliability, maintainability,
safety, interface compatibility, and supportability with planned resources, training, and
support equipment.
Methods of verification: Methods of verification are inspection, analysis, demonstration,

tests, or process control, or a combination thereof.
Test article: Test articles represent production configurations as close as necessary to

ensure test validity. Prior to subsequent testing, each test article should have successfully
passed the applicable acceptance test.
In-process verification
Qualification: Qualification should be by the methods identified. Testing is generally

classified as functional and environmental, but there are other tests classified by discrete
disciplines; for example; reliability, maintainability, and safety.
Functional tests: The subsystems and components should be operated for a period of time
sufficient to establish stability of performance. The performance and functional
characteristics of the equipment should then be measured and data recorded.
Environmental tests: The subsystems and components should be subjected to specified

natural and induced environments in specified combinations and cycles, with performance
monitored.
Safety of flight: Certification of satisfactory completion of safety-of-flight testing should be

submitted to the Customer prior to delivery of the first air vehicle.
Acceptance: Acceptance tests should be conducted. Acceptance tests should verify

baseline functional characteristics.
TEMPEST: Refers to investigation, study, and control of compromising emanations from

telecommunications and automated information systems equipment. Compromising
emanations are unintentional signals that, if intercepted and analyzed, would disclose the
information transmitted, received, handled, or otherwise processed by information-
processing equipment.
Transmissions: Transmission systems includes all parts between the engine and the load
absorbers. This includes gearboxes, shafting, universal joints, couplings, rotors, brake
assemblies, clutches (overrunning, friction, and dog), supporting bearings for shafting and
any attendant accessory pads or drives. Transmission oil cooling fan drives when driven by
a component of the system are considered a part of the transmission system. The oil cooler
is not considered part of the transmission, unless it is an integral part of a gearbox.
22
JSSG-2009A
6.4 Acronyms.
The following list contains the acronyms/abbreviations contained within Parts 1 and 2 of this
document.
AFGS Air Force Guide Specification
AISI American Iron and Steel Institute
APS Auxiliary Power Subsystem
APU Auxiliary Power Unit
BIT Built-in Test
BTU British Thermal Unit
CD-ROM Compact Disk – Read Only Memory
CDR Critical Design Review
CFC Chlorofluorocarbons
CPU Central Processing Unit
da/dn Incremental crack growth per cycle
DoDISS Department of Defense Index of Specifications and Standards
DSN Defense System Network
E3 Electromagnetic Environmental Effects
EMC Electromagnetic Compatibility
EMD Engineering Manufacturing Development
EME Electromagnetic Effects
EMI Electromagnetic Interference
FAA Federal Aviation Administration
FF First Flight
FMECA Failure Modes and Effects Criticality Analysis
FOD Foreign Object Damage
FRACAS Failure Reporting and Corrective Action System
HCF High Cycle Fatigue
HOL High Order Language
IBIT Initiated Built-in Test
IUID Item Unique Identification
JSSG Joint Service Specification Guide
LCC Life Cycle Cost
LCF Low Cycle Fatigue
LRU Line Replaceable Unit
23
JSSG-2009A
MAIT Minimum Autogenous Ignition Temperature

MECSIP Mechanical Equipment and Subsystems Integrity Program
MHGIT Minimum Hot Gas Ignition Temperature
MTBF Mean Time Between Failures
NALDA Naval Aviation Logistic Data Analysis
NATO STANAG North Atlantic Treaty Organization Standardization Agreement
NBC Nuclear, Biological, Chemical
PBIT Periodic Built-in Test
PDR Preliminary Design Review
RCS Radar Cross Section
R&D Research and Development
REO Responsible Engineering Office
SAE Society of Automotive Engineers
SBIT Start-up Built-in Test
SFR System Functional Review
SPC Statistical Process Control
SVR System Verification Review
TBD To Be Determined
TBS To Be Supplied
TO Technical Order
UID Unique Identification
USA United States Army
USAF United States Air Force
USN United States Navy
VTOL-STOL Vertical Take-off and Landing – Short Take-off and Landing
WRA War Reserve Assembly
6.5 Subject term (key word) listing.
Aerial refueling
Auxiliary power
Cargo
Corrosion
Crash worthiness
Creep
24
JSSG-2009A
Electrical power subsystem

Environmental control
Explosion hazard
Fire
Fuel
Hydraulic
Integrity
Interchangeability
Landing gear
Maintainability
Mechanical subsystem
Observables
Pneumatic
Producibility
Propeller subsystem
Reliability
Strength
Transportability
VTOL-STOL
6.6 Changes from previous issue.
The margins of this specification are marked with vertical lines to indicate where changes from
the previous issue were made. This was done as a convenience only and the Government
assumes no liability whatsoever for any inaccuracies in these notations. Bidders and
contractors are cautioned to evaluate the requirements of this document based on the entire
content irrespective of the marginal notations and relationship to the last previous issue.
The office responsible for the development and technical maintenance of this specification is
AFLCMC/EZFA, WRIGHT-PATTERSON AFB OH 45433-7017 USA; DSN 785-2023,
COMMERCIAL (937) 255-2023; AFLCMC.EZF.MAILBOX@US.AF.MIL. Requests for additional
information about this specification can be obtained from AFLCMC/ENRS, 2145 MONAHAN
WAY, WRIGHT-PATTERSON AFB OH 45433-7017 USA; DSN 674-5476; COMMERCIAL
(937) 904-5476; AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.
25
JSSG-2009A
PART 2 CONTENTS
1. SCOPE ............................................................................................................. 68
1.1 SCOPE ............................................................................................................. 68
1.2 STRUCTURE ................................................................................................... 68
1.3 HANDBOOK ..................................................................................................... 68
1.4 DEVIATIONS .................................................................................................... 68
1.5 ENVIRONMENTAL IMPACT ............................................................................ 68
1.6 RESPONSIBLE ENGINEERING OFFICE ........................................................ 69
2. APPLICABLE DOCUMENTS ........................................................................... 69
2.1 GENERAL ........................................................................................................ 69
2.2 GOVERNMENT DOCUMENTS........................................................................ 69
2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS .................................. 69
2.2.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS, AND
PUBLICATIONS ............................................................................................... 70
2.3 NON-GOVERNMENT PUBLICATIONS ........................................................... 70
2.4 ORDER OF PRECEDENCE............................................................................. 71
2.5 STREAMLINING............................................................................................... 71
3. REQUIREMENTS............................................................................................. 72
4. VERIFICATIONS .............................................................................................. 72
3.1 DEFINITION ..................................................................................................... 72
4.1 DEFINITION ..................................................................................................... 76
3.2.1 SECURITY ....................................................................................................... 79
4.2.1 SECURITY ....................................................................................................... 80
3.2.3 OBSERVABLES ............................................................................................... 81
4.2.3 OBSERVABLES ............................................................................................... 82
3.2.4 SURVIVABILITY ............................................................................................... 83
4.2.4 SURVIVABILITY ............................................................................................... 84
3.2.5 RELIABILITY .................................................................................................... 85
4.2.5 RELIABILITY .................................................................................................... 86
3.2.7.2 ENVIRONMENT ............................................................................................... 90
4.2.7.2 ENVIRONMENT ............................................................................................... 98
26
JSSG-2009A
3.2.7.3 CRASH WORTHINESS.................................................................................... 99

4.2.7.3 CRASH WORTHINESS.................................................................................. 100
3.2.7.4 MATERIALS AND PROCESSES ................................................................... 100
4.2.7.4 MATERIALS AND PROCESSES ................................................................... 101
3.2.7.4.1 COATINGS AND FINISHES........................................................................... 101
4.2.7.4.1 COATINGS AND FINISHES........................................................................... 101
3.2.7.4.2 PROHIBITED MATERIALS AND PROCESSES ............................................ 102
4.2.7.4.2 PROHIBITED MATERIALS AND PROCESSES ............................................ 104
3.2.7.4.3 PRODUCIBILITY ............................................................................................ 104
4.2.7.4.3 PRODUCIBILITY ............................................................................................ 105
3.2.7.4.4 DAMAGE TOLERANCE ................................................................................. 106
4.2.7.4.4 DAMAGE TOLERANCE ................................................................................. 106
3.2.7.4.4.1 SAFETY AND MISSION CRITICAL FUNCTIONS ......................................... 106
4.2.7.4.4.1 SAFETY AND MISSION CRITICAL FUNCTIONS ......................................... 107
AND COMPONENTS ..................................................................................... 107
AND COMPONENTS ..................................................................................... 108
3.2.7.4.4.3 MECHANICAL COMPONENT DAMAGE TOLERANCE ................................ 108
4.2.7.4.4.3 MECHANICAL COMPONENT DAMAGE TOLERANCE ................................ 109
3.2.7.5 STRENGTH .................................................................................................... 110
4.2.7.5 STRENGTH .................................................................................................... 110
3.2.7.6 DURABILITY AND ECONOMIC LIFE ............................................................ 111
4.2.7.6 DURABILITY AND ECONOMIC LIFE ............................................................ 112
3.2.7.6.1 CORROSION ................................................................................................. 113
4.2.7.6.1 CORROSION ................................................................................................. 114
3.2.7.6.2 HIGH CYCLE FATIGUE (HCF) ...................................................................... 114
4.2.7.6.2 HIGH CYCLE FATIGUE (HCF) ...................................................................... 115
3.2.7.6.3 LOW CYCLE FATIGUE (LCF)........................................................................ 115
4.2.7.6.3 LOW CYCLE FATIGUE (LCF)........................................................................ 116
3.2.7.6.4 DIELECTRIC MATERIALS ............................................................................. 116
4.2.7.6.4 DIELECTRIC MATERIALS ............................................................................. 117
3.2.7.6.5 CREEP ........................................................................................................... 117
4.2.7.6.5 CREEP ........................................................................................................... 117
3.2.8 TRANSPORTABILITY .................................................................................... 118
4.2.8 TRANSPORTABILITY .................................................................................... 118
3.2.9 INTEGRATED DIAGNOSTICS....................................................................... 119
4.2.9 INTEGRATED DIAGNOSTICS....................................................................... 120
3.2.9.1 FAULT DETECTION AND ISOLATION .......................................................... 120
4.2.9.1 FAULT DETECTION AND ISOLATION .......................................................... 121
3.2.10 NAMEPLATE AND PRODUCT MARKING ..................................................... 122
4.2.10 NAMEPLATE AND PRODUCT MARKING ..................................................... 123
3.3 DESIGN AND CONSTRUCTION ................................................................... 123
4.3 DESIGN AND CONSTRUCTION ................................................................... 123
3.3.1 INTERCHANGEABILITY ................................................................................ 124
4.3.1 INTERCHANGEABILITY ................................................................................ 124
3.3.2 NON-INTERCHANGEABILITY ....................................................................... 125
4.3.2 NON-INTERCHANGEABILITY ....................................................................... 125
3.3.3 SAFETY.......................................................................................................... 125
27
JSSG-2009A
4.3.3 SAFETY.......................................................................................................... 126

3.3.3.1 SAFETY CRITERIA ........................................................................................ 127
4.3.3.1 SAFETY CRITERIA ........................................................................................ 127
3.3.3.2 FOREIGN OBJECT DAMAGE (FOD) ............................................................ 127
4.3.3.2 FOREIGN OBJECT DAMAGE (FOD) ............................................................ 128
3.3.3.3 SOFTWARE SAFETY .................................................................................... 128
4.3.3.3 SOFTWARE SAFETY .................................................................................... 129
3.3.3.4 ACOUSTIC NOISE ......................................................................................... 129
4.3.3.4 ACOUSTIC NOISE ......................................................................................... 129
3.3.4 ELECTROMAGNETIC ENVIRONMENTAL EFFECTS (E3) ........................... 130
4.3.4 ELECTROMAGNETIC ENVIRONMENTAL EFFECTS (E3) ........................... 131
3.3.5 STANDARDIZATION...................................................................................... 133
4.3.5 STANDARDIZATION...................................................................................... 133
3.3.6 ENVIRONMENTAL......................................................................................... 134
4.3.6 ENVIRONMENTAL......................................................................................... 134
3.3.7 HEALTH ......................................................................................................... 135
4.3.7 HEALTH ......................................................................................................... 135
3.3.8 INSTALLATION HAZARDS REDUCTION ..................................................... 136
4.3.8 INSTALLATION HAZARDS REDUCTION ..................................................... 153
3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 154
4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 154
3.4.1 LANDING SUBSYSTEM ................................................................................ 154
4.4.1 LANDING SUBSYSTEM ................................................................................ 154
3.4.2 HYDRAULIC POWER SUBSYSTEM ............................................................. 154
4.4.2 HYDRAULIC POWER SUBSYSTEM ............................................................. 154
3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 155
4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 155
3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEMS ............................................ 155
4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEMS ............................................ 155
3.4.5 FUEL SUBSYSTEM ....................................................................................... 155
4.4.5 FUEL SUBSYSTEM ....................................................................................... 155
3.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 155
4.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 155
3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................. 155
4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................. 155
3.4.8 ELECTRICAL POWER SUBSYSTEM............................................................ 156
4.4.8 ELECTRICAL POWER SUBSYSTEM............................................................ 156
3.4.9 MECHANICAL SUBSYSTEMS ...................................................................... 156
4.4.9 MECHANICAL SUBSYSTEMS ...................................................................... 156
SPECIAL OPERATIONS SUBSYSTEM......................................................... 156
SPECIAL OPERATIONS SUBSYSTEM......................................................... 156
AND LANDING POWER DRIVE SUBSYSTEMS ........................................... 156
AND LANDING POWER DRIVE SUBSYSTEMS ........................................... 156
3.4.12 PROPELLER SUBSYSTEM ........................................................................... 156
4.4.12 PROPELLER SUBSYSTEM ........................................................................... 156
28
JSSG-2009A
3.4.13 PNEUMATIC SUBSYSTEM ........................................................................... 157

4.4.13 PNEUMATIC SUBSYSTEM ........................................................................... 157
3.4.14 ADDITIONAL SUBSYSTEMS AND FUNCTIONS .......................................... 157
4.4.14 ADDITIONAL SUBSYSTEMS AND FUNCTIONS .......................................... 157
TABLES
TABLE I. SUBSYSTEMS FUNCTIONS ........................................................................... 72

TABLE II. INCREMENTAL VERIFICATION...................................................................... 77
TABLE III. HIGH CYCLE FATIGUE ................................................................................. 115
FIGURES
FIGURE 1. JOINT VALUES OF HIGH TEMPERATURE WITH HIGH HUMIDITY ............. 93

FIGURE 2. SOLAR RADIATION INTENSITY ..................................................................... 94
FIGURE 3. IN-FLIGHT SUPERCOOLED CLOUD ICING ENVIRONMENT
(LAYER AND CONVECTION) .......................................................................... 96
APPENDICES CONTENTS
APPENDIX A: LANDING SUBSYSTEM ................................................................................ 158

APPENDIX B: HYDRAULIC POWER SUBSYSTEM ............................................................. 315
APPENDIX C: AUXILIARY POWER SUBSYSTEM ............................................................... 366
APPENDIX D: ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 423
APPENDIX E: FUEL SUBSYSTEM ....................................................................................... 601
APPENDIX F: AERIAL REFUELING SUBSYSTEM .............................................................. 728
APPENDIX G: FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................ 812
APPENDIX H: ELECTRICAL POWER SUBSYSTEM............................................................ 907
APPENDIX I: MECHANICAL SUBSYSTEMS ...................................................................... 935
APPENDIX J: CARGO, AERIAL DELIVERY, AND
SPECIAL OPERATIONS SUBSYSTEM....................................................... 1005
APPENDIX K: VERTICAL TAKEOFF AND LANDING (VTOL) — SHORT TAKEOFF
AND LANDING (STOL) POWER DRIVE SUBSYSTEMS ............................ 1038
APPENDIX L: PROPELLER SUBSYSTEM ......................................................................... 1077
APPENDIX M: PNEUMATIC SUBSYSTEM ......................................................................... 1117
29
JSSG-2009A
CONTENTS APPENDIX A: LANDING
A.1 SCOPE ........................................................................................................... 158

A.1.1 SCOPE ........................................................................................................... 158
A.1.2 STRUCTURE ................................................................................................. 158
A.1.3 APPENDIX ..................................................................................................... 158
A.1.4 DEVIATIONS .................................................................................................. 158
A.1.5 ENVIRONMENTAL IMPACT .......................................................................... 159
A.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 159
A.2 APPLICABLE DOCUMENTS ......................................................................... 159
A.2.1 GOVERNMENT DOCUMENTS...................................................................... 159
A.2.1.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 159
A.2.1.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS,
AND PUBLICATIONS..................................................................................... 161
A.2.2 NON-GOVERNMENT PUBLICATIONS ......................................................... 161
A.2.3 ORDER OF PRECEDENCE........................................................................... 162
A.2.4 STREAMLINING............................................................................................. 162
A.3 REQUIREMENTS........................................................................................... 163
A.4 VERIFICATIONS ............................................................................................ 163
A.3.1 DEFINITION ................................................................................................... 163
A.4.1 DEFINITION ................................................................................................... 163
A.3.2 CHARACTERISTICS...................................................................................... 163
A.4.2 CHARACTERISTICS...................................................................................... 163
A.3.3 DESIGN AND CONSTRUCTION ................................................................... 163
A.4.3 DESIGN AND CONSTRUCTION ................................................................... 163
A.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 163
A.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 163
A.3.4.1 LANDING SUBSYSTEM ................................................................................ 163
A.3.4.1.1 LANDING GEAR ............................................................................................ 163
A.4.4.1 LANDING SUBSYSTEM ................................................................................ 164
A.4.4.1.1 LANDING GEAR ............................................................................................ 164
A.3.4.1.1.1 GEAR ARRANGEMENT ................................................................................ 165
A.4.4.1.1.1 GEAR ARRANGEMENT ................................................................................ 166
A.3.4.1.1.2 PITCH STABILITY .......................................................................................... 167
A.4.4.1.1.2 PITCH STABILITY .......................................................................................... 168
A.3.4.1.1.3 EXTENDED CLEARANCES........................................................................... 169
A.4.4.1.1.3 EXTENDED CLEARANCES........................................................................... 169
A.3.4.1.1.4 RETRACTION CLEARANCES ....................................................................... 170
A.4.4.1.1.4 RETRACTION CLEARANCES ....................................................................... 171
A.3.4.1.1.5 ANTI-ROTATION IN RETRACTED POSITION .............................................. 172
A.4.4.1.1.5 ANTI-ROTATION IN RETRACTED POSITION .............................................. 172
A.3.4.1.1.6 CLEARANCE WITH FLAT TIRE AND FLAT STRUT ..................................... 173
A.4.4.1.1.6 CLEARANCE WITH FLAT TIRE AND FLAT STRUT ..................................... 174
A.3.4.1.1.7 GEAR STABILITY .......................................................................................... 174
A.4.4.1.1.7 GEAR STABILITY .......................................................................................... 176
A.3.4.1.1.8 ALIGNMENT................................................................................................... 176
A.4.4.1.1.8 ALIGNMENT................................................................................................... 177
A.3.4.1.1.9 GROWTH ....................................................................................................... 177
30
JSSG-2009A
A.4.4.1.1.9 GROWTH ....................................................................................................... 178

A.3.4.1.1.10 SERVICE LIFE ............................................................................................... 179
A.4.4.1.1.10 SERVICE LIFE ............................................................................................... 181
A.3.4.1.2 GROUND OPERATION ................................................................................. 181
A.4.4.1.2 GROUND OPERATION ................................................................................. 181
A.3.4.1.2.1 GROUND FLOTATION .................................................................................. 181
A.4.4.1.2.1 GROUND FLOTATION .................................................................................. 185
A.3.4.1.2.2 GROUND HANDLING .................................................................................... 186
A.4.4.1.2.2 GROUND HANDLING .................................................................................... 186
A.3.4.1.2.2.1 JACKING PROVISIONS AND CONDITIONS ................................................ 186
A.4.4.1.2.2.1 JACKING PROVISIONS AND CONDITIONS ................................................ 186
A.3.4.1.2.2.1.1 AXLE JACKING .............................................................................................. 186
A.4.4.1.2.2.1.1 AXLE JACKING .............................................................................................. 186
A.3.4.1.2.2.1.2 FUSELAGE JACKING .................................................................................... 187
A.4.4.1.2.2.1.2 FUSELAGE JACKING .................................................................................... 187
A.3.4.1.2.2.1.3 LANDING GEAR TOWING............................................................................. 187
A.4.4.1.2.2.1.3 LANDING GEAR TOWING............................................................................. 188
A.3.4.1.2.2.1.4 EMERGENCY TOWING................................................................................. 189
A.4.4.1.2.2.1.4 EMERGENCY TOWING................................................................................. 190
A.3.4.1.2.2.1.5 TOWING INTERFACE ................................................................................... 190
A.4.4.1.2.2.1.5 TOWING INTERFACE ................................................................................... 192
A.3.4.1.2.2.1.6 MOORING PROVISIONS............................................................................... 192
A.4.4.1.2.2.1.6 MOORING PROVISIONS............................................................................... 194
A.3.4.1.2.3 GROUND FOD ............................................................................................... 194
A.4.4.1.2.3 GROUND FOD ............................................................................................... 195
A.3.4.1.3 STRUCTURE ................................................................................................. 195
A.4.4.1.3 STRUCTURE ................................................................................................. 195
A.3.4.1.3.1 GENERAL PROVISIONS ............................................................................... 195
A.4.4.1.3.1 GENERAL PROVISIONS ............................................................................... 195
A.3.4.1.3.1.1 MATERIAL SELECTION ................................................................................ 195
A.4.4.1.3.1.1 MATERIAL SELECTION ................................................................................ 197
A.3.4.1.3.1.2 ROUGHNESS AND RUNWAY REPAIR PROFILE CRITERIA ...................... 197
A.4.4.1.3.1.2 ROUGHNESS AND RUNWAY REPAIR PROFILE CRITERIA ...................... 199
A.3.4.1.3.1.3 FAILURE TOLERANCE ................................................................................. 199
A.4.4.1.3.1.3 FAILURE TOLERANCE ................................................................................. 200
A.3.4.1.3.1.4 STRENGTH .................................................................................................... 201
A.4.4.1.3.1.4 STRENGTH .................................................................................................... 201
A.3.4.1.3.1.5 DURABILITY .................................................................................................. 202
A.4.4.1.3.1.5 DURABILITY .................................................................................................. 203
A.3.4.1.3.1.6 CORROSION PROTECTION ......................................................................... 203
A.4.4.1.3.1.6 CORROSION PROTECTION ......................................................................... 203
A.3.4.1.3.1.7 FLAT TIRE AND FLAT STRUT OPERATION ................................................ 204
A.4.4.1.3.1.7 FLAT TIRE AND FLAT STRUT OPERATION ................................................ 205
A.3.4.1.3.1.8 ENERGY ABSORPTION ................................................................................ 205
A.4.4.1.3.1.8 ENERGY ABSORPTION ................................................................................ 206
A.3.4.1.3.1.9 RIDE QUALITY............................................................................................... 207
A.4.4.1.3.1.9 RIDE QUALITY............................................................................................... 208
A.3.4.1.3.1.10 LANDING GEAR SERVICING........................................................................ 208
A.4.4.1.3.1.10 LANDING GEAR SERVICING........................................................................ 209
31
JSSG-2009A
A.3.4.1.3.1.11 REPEATED OPERATION .............................................................................. 210

A.4.4.1.3.1.11 REPEATED OPERATION .............................................................................. 211
A.3.4.1.3.1.12 FRICTION CONTROL .................................................................................... 211
A.4.4.1.3.1.12 FRICTION CONTROL .................................................................................... 212
A.3.4.1.3.1.13 REPAIRABILITY ............................................................................................. 213
A.4.4.1.3.1.13 REPAIRABILITY ............................................................................................. 214
A.3.4.1.3.1.14 EMPENNAGE PROTECTION ........................................................................ 214
A.4.4.1.3.1.14 EMPENNAGE PROTECTION ........................................................................ 215
A.3.4.1.4 VELOCITY AND DIRECTIONAL CONTROL ................................................. 216
A.4.4.1.4 VELOCITY AND DIRECTIONAL CONTROL ................................................. 216
A.3.4.1.4.1 BRAKING ....................................................................................................... 216
A.4.4.1.4.1 BRAKING ....................................................................................................... 217
A.3.4.1.4.2 DIRECTIONAL CONTROL ............................................................................. 217
A.4.4.1.4.2 DIRECTIONAL CONTROL ............................................................................. 219
A.3.4.1.4.3 EMERGENCY DIRECTIONAL CONTROL ..................................................... 220
A.4.4.1.4.3 EMERGENCY DIRECTIONAL CONTROL ..................................................... 220
A.3.4.1.4.4 BRAKING AND SKID CONTROL ................................................................... 221
A.4.4.1.4.4 BRAKING AND SKID CONTROL ................................................................... 221
A.3.4.1.4.4.1 BRAKING CONTROL INTERFACE ............................................................... 221
A.4.4.1.4.4.1 BRAKING CONTROL INTERFACE ............................................................... 222
A.3.4.1.4.4.2 ALTERNATE INDEPENDENT BRAKING ...................................................... 223
A.4.4.1.4.4.2 ALTERNATE INDEPENDENT BRAKING ...................................................... 224
A.3.4.1.4.4.3 SKID CONTROL............................................................................................. 225
A.4.4.1.4.4.3 SKID CONTROL............................................................................................. 227
A.3.4.1.4.4.4 SKID CONTROL WITH POWER INTERRUPTION ........................................ 228
A.4.4.1.4.4.4 SKID CONTROL WITH POWER INTERRUPTION ........................................ 228
A.3.4.1.4.4.5 ANTI-SKID ENGAGEMENT AND DISENGAGEMENT .................................. 229
A.4.4.1.4.4.5 ANTI-SKID ENGAGEMENT AND DISENGAGEMENT .................................. 230
A.3.4.1.4.5 NOSE WHEEL STEERING ............................................................................ 230
A.4.4.1.4.5 NOSE WHEEL STEERING ............................................................................ 230
A.3.4.1.4.5.1 STEERING CHARACTERISTICS .................................................................. 230
A.4.4.1.4.5.1 STEERING CHARACTERISTICS .................................................................. 233
A.3.4.1.4.5.2 RESPONSE TO NOSE WHEEL STEERING FAILURE ................................. 234
A.4.4.1.4.5.2 RESPONSE TO NOSE WHEEL STEERING FAILURE ................................. 234
A.3.4.1.4.5.3 EMERGENCY STEERING ............................................................................. 235
A.4.4.1.4.5.3 EMERGENCY STEERING ............................................................................. 236
A.3.4.1.5 ACTUATION CONTROL ................................................................................ 236
A.4.4.1.5 ACTUATION CONTROL ................................................................................ 236
A.3.4.1.5.1 RETRACTION AND EXTENSION ACTUATION INTERFACE. ...................... 236
A.4.4.1.5.1 RETRACTION AND EXTENSION ACTUATION INTERFACE. ...................... 237
A.3.4.1.5.2 GEAR DOOR ACTUATION AND LOCKING. ................................................. 237
A.4.4.1.5.2 GEAR DOOR ACTUATION AND LOCKING. ................................................. 239
A.3.4.1.5.3 SINGLE FAILURE CRITERIA. ....................................................................... 239
A.4.4.1.5.3 SINGLE FAILURE CRITERIA. ....................................................................... 240
A.3.4.1.5.4 ACTUATION REVERSAL............................................................................... 240
A.4.4.1.5.4 ACTUATION REVERSAL............................................................................... 241
A.3.4.1.5.5 AIRSPEED OPERATIONAL CRITERIA ......................................................... 242
A.4.4.1.5.5 AIRSPEED OPERATIONAL CRITERIA ......................................................... 242
A.3.4.1.5.5.1 RETRACTION ................................................................................................ 242
32
JSSG-2009A
A.4.4.1.5.5.1 RETRACTION ................................................................................................ 243

A.3.4.1.5.5.2 EXTENSION ................................................................................................... 244
A.4.4.1.5.5.2 EXTENSION ................................................................................................... 246
A.3.4.1.5.6 OPERATION WITH LOSS OF DOOR ............................................................ 246
A.4.4.1.5.6 OPERATION WITH LOSS OF DOOR ............................................................ 247
A.3.4.1.5.7 EMERGENCY EXTENSION........................................................................... 247
A.4.4.1.5.7 EMERGENCY EXTENSION........................................................................... 249
A.3.4.1.5.8 ACTUATION INDICATION ............................................................................. 250
A.4.4.1.5.8 ACTUATION INDICATION ............................................................................. 250
A.3.4.1.5.8.1 GEAR POSITION STATUS INDICATIONS .................................................... 250
A.4.4.1.5.8.1 GEAR POSITION STATUS INDICATIONS .................................................... 253
A.3.4.1.5.9 LANDING GEAR POSITION RESTRAINT ..................................................... 254
A.4.4.1.5.9 LANDING GEAR POSITION RESTRAINT ..................................................... 254
A.3.4.1.5.9.1 GEAR POSITION RESTRAINT ...................................................................... 254
A.4.4.1.5.9.1 GEAR POSITION RESTRAINT ...................................................................... 256
A.3.4.1.5.10 GROUND SAFETY RESTRAINT ................................................................... 257
A.4.4.1.5.10 GROUND SAFETY RESTRAINT ................................................................... 258
A.3.4.1.6 GROUND OPERATION INTERFACE ............................................................ 258
A.4.4.1.6 GROUND OPERATION INTERFACE ............................................................ 259
A.3.4.1.7 RESTRAINT CAPABILITY ............................................................................. 260
A.4.4.1.7 RESTRAINT CAPABILITY ............................................................................. 260
A.3.4.1.8 AUXILIARY DECELERATION DEVICES ....................................................... 261
A.4.4.1.8 AUXILIARY DECELERATION DEVICES ....................................................... 261
A.3.4.1.8.1 ARRESTING HOOK SYSTEMS ..................................................................... 261
A.4.4.1.8.1 ARRESTING HOOK SYSTEMS ..................................................................... 261
A.3.4.1.8.1.1 AIR VEHICLE ARRESTMENT PERFORMANCE .......................................... 261
A.4.4.1.8.1.1 AIR VEHICLE ARRESTMENT PERFORMANCE .......................................... 262
A.3.4.1.8.1.2 FLY-IN ENGAGEMENT CRITERIA ................................................................ 262
A.4.4.1.8.1.2 FLY-IN ENGAGEMENT CRITERIA ................................................................ 263
A.3.4.1.8.1.3 PROBABILITY OF SUCCESSFUL ENGAGEMENT ...................................... 263
A.4.4.1.8.1.3 PROBABILITY OF SUCCESSFUL ENGAGEMENT ...................................... 264
A.3.4.1.8.1.4 LATERAL FREEDOM OF HOOK ................................................................... 265
A.4.4.1.8.1.4 LATERAL FREEDOM OF HOOK ................................................................... 266
A.3.4.1.8.1.5 HOOK RETRACTED CRITERIA .................................................................... 267
A.4.4.1.8.1.5 HOOK RETRACTED CRITERIA .................................................................... 267
A.3.4.1.8.1.6 POSITION INDICATION................................................................................. 268
A.4.4.1.8.1.6 POSITION INDICATION................................................................................. 269
A.3.4.1.8.1.7 MAINTENANCE AND INSTALLATION CRITERIA ........................................ 269
A.4.4.1.8.1.7 MAINTENANCE AND INSTALLATION CRITERIA ........................................ 270
A.3.4.1.8.1.8 HOOK ACTUATION CRITERIA ..................................................................... 270
A.4.4.1.8.1.8 HOOK ACTUATION CRITERIA ..................................................................... 271
A.3.4.1.8.2 DRAG CHUTES ............................................................................................. 271
A.4.4.1.8.2 DRAG CHUTES ............................................................................................. 271
A.3.4.1.8.2.1 AIR VEHICLE DRAG CHUTE PERFORMANCE ........................................... 271
A.4.4.1.8.2.1 AIR VEHICLE DRAG CHUTE PERFORMANCE ........................................... 272
A.3.4.1.9 SHIPBOARD COMPATIBILITY ...................................................................... 272
A.4.4.1.9 SHIPBOARD COMPATIBILITY ...................................................................... 272
A.3.4.1.9.1 LANDING GEAR CATAPULT COMPATIBILITY ............................................ 273
A.4.4.1.9.1 LANDING GEAR CATAPULT COMPATIBILITY ............................................ 274
33
JSSG-2009A
A.3.4.1.9.2 ARRESTED LANDINGS COMPATIBILITY .................................................... 274

A.4.4.1.9.2 ARRESTED LANDINGS COMPATIBILITY .................................................... 275
A.3.4.1.9.3 DECK OPERATIONS ..................................................................................... 275
A.4.4.1.9.3 DECK OPERATIONS ..................................................................................... 276
A.3.4.1.9.4 SKI JUMPS..................................................................................................... 276
A.4.4.1.9.4 SKI JUMPS..................................................................................................... 277
A.3.4.1.9.5 PARKING BRAKE .......................................................................................... 277
A.4.4.1.9.5 PARKING BRAKE .......................................................................................... 277
A.3.4.1.10 SPECIALIZED SUBSYSTEMS....................................................................... 278
A.4.4.1.10 SPECIALIZED SUBSYSTEMS....................................................................... 278
A.3.4.1.10.1 FLOATATION GEAR ...................................................................................... 279
A.4.4.1.10.1 FLOATATION GEAR ...................................................................................... 279
A.3.4.1.10.2 SNOW SKI GEAR .......................................................................................... 280
A.4.4.1.10.2 SNOW SKI GEAR .......................................................................................... 280
A.3.4.1.11 COMPONENTS .............................................................................................. 281
A.4.4.1.11 COMPONENTS .............................................................................................. 281
A.3.4.1.11.1 TIRES ............................................................................................................. 281
A.4.4.1.11.1 TIRES ............................................................................................................. 281
A.3.4.1.11.1.1 AIR VEHICLE TIRE PERFORMANCE ........................................................... 281
A.4.4.1.11.1.1 AIR VEHICLE TIRE PERFORMANCE ........................................................... 283
A.3.4.1.11.1.2 SERVICE LIFE ............................................................................................... 284
A.4.4.1.11.1.2 SERVICE LIFE ............................................................................................... 285
A.3.4.1.11.1.3 RETREAD AND CARCASS PERFORMANCE .............................................. 285
A.4.4.1.11.1.3 RETREAD AND CARCASS PERFORMANCE .............................................. 287
A.3.4.1.11.1.4 GROWTH WITHIN TIRE ................................................................................ 287
A.4.4.1.11.1.4 GROWTH WITHIN TIRE ................................................................................ 288
A.3.4.1.11.1.5 MULTIPLE TIRE OPERATION WITH FAILURES .......................................... 288
A.4.4.1.11.1.5 MULTIPLE TIRE OPERATION WITH FAILURES .......................................... 289
A.3.4.1.11.2 WHEELS ........................................................................................................ 290
A.4.4.1.11.2 WHEELS ........................................................................................................ 290
A.3.4.1.11.2.1 AIR VEHICLE WHEEL PERFORMANCE ...................................................... 290
A.4.4.1.11.2.1 AIR VEHICLE WHEEL PERFORMANCE ...................................................... 291
A.3.4.1.11.2.2 SERVICE LIFE ............................................................................................... 292
A.4.4.1.11.2.2 SERVICE LIFE ............................................................................................... 293
A.3.4.1.11.2.3 BRAKE OVERHEAT CAPABILITY ................................................................. 294
A.4.4.1.11.2.3 BRAKE OVERHEAT CAPABILITY ................................................................. 294
A.3.4.1.11.2.4 NONFRANGABILITY CRITERIA (FLAT TIRE OPERATION) ........................ 295
A.4.4.1.11.2.4 NONFRANGABILITY CRITERIA (FLAT TIRE OPERATION) ........................ 295
A.3.4.1.11.2.5 BIAS AND RADIAL TIRE COMPATIBILITY ................................................... 296
A.4.4.1.11.2.5 BIAS AND RADIAL TIRE COMPATIBILITY ................................................... 296
A.3.4.1.11.2.6 PRESSURE-RELEASE CRITERIA ................................................................ 297
A.4.4.1.11.2.6 PRESSURE-RELEASE CRITERIA ................................................................ 297
A.3.4.1.11.3 BRAKES ......................................................................................................... 298
A.4.4.1.11.3 BRAKES ......................................................................................................... 298
A.3.4.1.11.3.1 AIR VEHICLE STOPPING AND TURN-AROUND PERFORMANCE ............ 298
A.4.4.1.11.3.1 AIR VEHICLE STOPPING AND TURN-AROUND PERFORMANCE ............ 301
A.3.4.1.11.3.2 WEAR INDICATOR AND SERVICING CRITERIA ......................................... 302
A.4.4.1.11.3.2 WEAR INDICATOR AND SERVICING CRITERIA ......................................... 303
A.3.4.1.11.3.3 STRUCTURAL FAILURE CRITERIA ............................................................. 304
34
JSSG-2009A
A.4.4.1.11.3.3 STRUCTURAL FAILURE CRITERIA ............................................................. 304

A.3.4.1.11.3.4 SECONDARY BRAKING CAPABILITY (FAIL-SAFE) .................................... 305
A.4.4.1.11.3.4 SECONDARY BRAKING CAPABILITY (FAIL-SAFE) .................................... 306
A.3.4.1.11.3.5 FIRE PREVENTION CRITERIA ..................................................................... 306
A.4.4.1.11.3.5 FIRE PREVENTION CRITERIA ..................................................................... 307
A.3.4.1.11.3.6 REFURBISHMENT CRITERIA ....................................................................... 307
A.4.4.1.11.3.6 REFURBISHMENT CRITERIA ....................................................................... 308
A.3.4.1.11.3.7 TEMPERATURE INTERFACE CRITERIA ..................................................... 308
A.4.4.1.11.3.7 TEMPERATURE INTERFACE CRITERIA ..................................................... 309
A.3.4.1.11.3.8 SERVICE LIFE AND REPLACEMENT CRITERIA ......................................... 309
A.4.4.1.11.3.8 SERVICE LIFE AND REPLACEMENT CRITERIA ......................................... 310
A.3.4.1.11.3.9 DRAG CHUTE SERVICE LIFE ...................................................................... 311
A.4.4.1.11.3.9 DRAG CHUTE SERVICE LIFE ...................................................................... 311
A.5 PACKAGING .................................................................................................. 312
A.6 NOTES ........................................................................................................... 312
A.6.1 INTENDED USE ............................................................................................. 312
A.6.2 ACQUISITION REQUIREMENTS .................................................................. 312
A.6.3 ACRONYMS ................................................................................................... 312
A.6.4 SUBJECT TERM (KEY WORD) LISTING ...................................................... 313
A.6.5 INTERNATIONAL STANDARDIZATION AGREEMENT
IMPLEMENTATION........................................................................................ 313
A.6.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 313
A.6.7 CHANGES FROM PREVIOUS ISSUE ........................................................... 314
35
JSSG-2009A
CONTENTS APPENDIX B: HYDRAULIC POWER
B.1 SCOPE ........................................................................................................... 315

B.1.1 SCOPE ........................................................................................................... 315
B.1.2 STRUCTURE ................................................................................................. 315
B.1.3 APPENDIX ..................................................................................................... 315
B.1.4 DEVIATIONS .................................................................................................. 315
B.1.5 ENVIRONMENTAL IMPACT .......................................................................... 316
B.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 316
B.2 APPLICABLE DOCUMENTS ......................................................................... 316
B.2.1 GENERAL ...................................................................................................... 316
B.2.2 GOVERNMENT DOCUMENTS...................................................................... 316
B.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 316
B.2.3 NON-GOVERNMENT PUBLICATIONS ......................................................... 317
B.2.4 ORDER OF PRECEDENCE........................................................................... 318
B.2.5 STREAMLINING............................................................................................. 318
B.3 REQUIREMENTS........................................................................................... 319
B.4 VERIFICATIONS ............................................................................................ 319
B.3.1 DEFINITION ................................................................................................... 319
B.4.1 DEFINITION ................................................................................................... 319
B.3.2 CHARACTERISTICS...................................................................................... 319
B.4.2 CHARACTERISTICS...................................................................................... 319
B.3.3 DESIGN AND CONSTRUCTION ................................................................... 319
B.4.3 DESIGN AND CONSTRUCTION ................................................................... 319
B.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 319
B.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 319
B.3.4.1 LANDING SUBSYSTEM ................................................................................ 319
B.4.4.1 LANDING SUBSYSTEM ................................................................................ 319
B.3.4.2 HYDRAULIC POWER SUBSYSTEM ............................................................. 319
B.4.4.2 HYDRAULIC POWER SUBSYSTEM ............................................................. 321
B.3.4.2.1 HYDRAULIC POWER SUBSYSTEM GENERAL REQUIREMENTS ............. 322
B.4.4.2.1 HYDRAULIC POWER SUBSYSTEM GENERAL REQUIREMENTS ............. 322
B.3.4.2.1.1 FLUID SELECTION ........................................................................................ 322
B.4.4.2.1.1 FLUID SELECTION ........................................................................................ 324
B.3.4.2.1.2 SYSTEM FLUID CAPACITY .......................................................................... 325
B.4.4.2.1.2 SYSTEM FLUID CAPACITY .......................................................................... 326
B.3.4.2.1.3 SYSTEM FLUID MONITORING ..................................................................... 326
B.4.4.2.1.3 SYSTEM FLUID MONITORING ..................................................................... 327
B.3.4.2.1.4 SYSTEM PRESSURE .................................................................................... 327
B.4.4.2.1.4 SYSTEM PRESSURE .................................................................................... 328
B.3.4.2.1.4.1 PUMP INLET PRESSURE ............................................................................. 328
B.4.4.2.1.4.1 PUMP INLET PRESSURE ............................................................................. 329
B.3.4.2.1.4.2 SYSTEM START PRESSURIZATION ........................................................... 329
B.4.4.2.1.4.2 SYSTEM START PRESSURIZATION ........................................................... 330
B.3.4.2.1.4.3 SYSTEM PRESSURE INDICATION .............................................................. 330
B.4.4.2.1.4.3 SYSTEM PRESSURE INDICATION .............................................................. 330
B.3.4.2.1.4.4 SYSTEM LOW-PRESSURE WARNING ........................................................ 331
B.4.4.2.1.4.4 SYSTEM LOW-PRESSURE WARNING ........................................................ 331
36
JSSG-2009A
B.3.4.2.1.5 PRESSURE CONTROL ................................................................................. 332

B.4.4.2.1.5 PRESSURE CONTROL ................................................................................. 332
B.3.4.2.1.5.1 PEAK PRESSURE ......................................................................................... 333
B.4.4.2.1.5.1 PEAK PRESSURE ......................................................................................... 333
B.3.4.2.1.5.2 PRESSURE RIPPLE ...................................................................................... 334
B.4.4.2.1.5.2 PRESSURE RIPPLE ...................................................................................... 335
B.3.4.2.1.5.3 BACK PRESSURE ......................................................................................... 336
B.4.4.2.1.5.3 BACK PRESSURE ......................................................................................... 337
B.3.4.2.1.6 SYSTEM LEVEL CONTAMINATION PREVENTION ..................................... 337
B.4.4.2.1.6 SYSTEM LEVEL CONTAMINATION PREVENTION ..................................... 339
B.3.4.2.1.6.1 CONTAMINATION CONTROL MAINTAINABILITY ....................................... 339
B.4.4.2.1.6.1 CONTAMINATION CONTROL MAINTAINABILITY ....................................... 340
B.3.4.2.1.6.2 CLEANLINESS LEVEL OF DELIVERED SYSTEMS ..................................... 341
B.4.4.2.1.6.2 CLEANLINESS LEVEL OF DELIVERED SYSTEMS ..................................... 341
B.3.4.2.1.7 SYSTEM AIR REMOVAL ............................................................................... 342
B.4.4.2.1.7 SYSTEM AIR REMOVAL ............................................................................... 345
B.3.4.2.1.8 MOISTURE EXCLUSION ............................................................................... 345
B.4.4.2.1.8 MOISTURE EXCLUSION ............................................................................... 346
B.3.4.2.1.9 LEAKAGE CONTROL .................................................................................... 346
B.4.4.2.1.9 LEAKAGE CONTROL .................................................................................... 348
B.3.4.2.1.10 EMERGENCY OPERATION .......................................................................... 348
B.4.4.2.1.10 EMERGENCY OPERATION .......................................................................... 349
B.3.4.2.1.11 PROOF PRESSURE ...................................................................................... 349
B.4.4.2.1.11 PROOF PRESSURE ...................................................................................... 350
B.3.4.2.1.12 BURST PRESSURE....................................................................................... 350
B.4.4.2.1.12 BURST PRESSURE....................................................................................... 351
B.3.4.2.1.13 LOW-TEMPERATURE OPERATION ............................................................. 351
B.4.4.2.1.13 LOW-TEMPERATURE OPERATION ............................................................. 352
B.3.4.2.1.14 HIGH-TEMPERATURE OPERATION ............................................................ 352
B.4.4.2.1.14 HIGH-TEMPERATURE OPERATION ............................................................ 353
B.3.4.2.1.14.1 THERMAL RELIEF ......................................................................................... 353
B.4.4.2.1.14.1 THERMAL RELIEF ......................................................................................... 354
B.3.4.2.1.15 FIRE AND EXPLOSION HAZARD PROOFING ............................................. 354
B.4.4.2.1.15 FIRE AND EXPLOSION HAZARD PROOFING ............................................. 355
B.3.4.2.1.16 SURVIVABILITY-VULNERABILITY (S-V) ...................................................... 355
B.4.4.2.1.16 SURVIVABILITY-VULNERABILITY (S-V) ...................................................... 356
B.3.4.2.1.16.1 RESISTANCE TO GUNFIRE ......................................................................... 356
B.4.4.2.1.16.1 RESISTANCE TO GUNFIRE ......................................................................... 357
B.3.4.2.1.17 CLEARANCE.................................................................................................. 357
B.4.4.2.1.17 CLEARANCE.................................................................................................. 358
B.3.4.2.2 INTERFACE REQUIREMENTS ..................................................................... 358
B.4.4.2.2 INTERFACE REQUIREMENTS ..................................................................... 359
B.3.4.2.2.1 ELECTRICAL POWER SYSTEM INTERFACE.............................................. 359
B.4.4.2.2.1 ELECTRICAL POWER SYSTEM INTERFACE.............................................. 359
B.3.4.2.2.2 SUPPORT EQUIPMENT (SE) INTERFACE .................................................. 360
B.4.4.2.2.2 SUPPORT EQUIPMENT (SE) INTERFACE .................................................. 360
B.3.4.2.2.3 INSTRUMENTATION INTERFACE(S) ........................................................... 361
B.4.4.2.2.3 INSTRUMENTATION INTERFACE(S) ........................................................... 361
B.5 PACKAGING .................................................................................................. 363
37
JSSG-2009A
B.6 NOTES ........................................................................................................... 363

B.6.1 INTENDED USE ............................................................................................. 363
B.6.2 ACQUISITION REQUIREMENTS .................................................................. 363
B.6.3 DEFINITIONS ................................................................................................. 363
B.6.4 ACRONYMS ................................................................................................... 364
B.6.5 SUBJECT TERM (KEY WORD) LISTING ...................................................... 365
B.6.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 365
B.6.7 CHANGES FROM PREVIOUS ISSUE ........................................................... 365
TABLES
TABLE B-I. PUMP PRESSURE RIPPLE, PEAK TO PEAK .............................................. 335

TABLE B-II. CONTAMINATION LEVELS ........................................................................... 342
CONTENTS APPENDIX C: AUXILIARY POWER
C.1 SCOPE ........................................................................................................... 366

C.1.1 SCOPE ........................................................................................................... 366
C.1.2 STRUCTURE ................................................................................................. 366
C.1.3 APPENDIX ..................................................................................................... 366
C.1.4 DEVIATIONS .................................................................................................. 366
C.1.5 ENVIRONMENTAL IMPACT .......................................................................... 367
C.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 367
C.2 APPLICABLE DOCUMENTS ......................................................................... 367
C. 2.1 GENERAL ...................................................................................................... 367
C.2.2 GOVERNMENT DOCUMENTS...................................................................... 367
C.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 367
C.2.3 NON-GOVERNMENT PUBLICATIONS ......................................................... 368
C.2.4 ORDER OF PRECEDENCE........................................................................... 369
C.2.5 STREAMLINING............................................................................................. 369
C.3 REQUIREMENTS........................................................................................... 370
C.4 VERIFICATIONS ............................................................................................ 370
C.3.1 DEFINITION ................................................................................................... 370
C.4.1 DEFINITION ................................................................................................... 370
C.3.2 CHARACTERISTICS...................................................................................... 370
C.4.2 CHARACTERISTICS...................................................................................... 370
C.3.3 DESIGN AND CONSTRUCTION ................................................................... 370
C.4.3 DESIGN AND CONSTRUCTION ................................................................... 370
C.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 370
C.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 370
C.3.4.1 LANDING SUBSYSTEM ................................................................................ 370
C.4.4.1 LANDING SUBSYSTEM ................................................................................ 370
C.3.4.2 HYDRAULIC SUBSYSTEM............................................................................ 370
C.4.4.2 HYDRAULIC SUBSYSTEM............................................................................ 370
C.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 371
C.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 372
38
JSSG-2009A
C.3.4.3.1 SECONDARY AIR VEHICLE POWER ........................................................... 372

C.4.4.3.1 SECONDARY AIR VEHICLE POWER ........................................................... 372
C.3.4.3.1.1 MECHANICAL POWER TRANSMISSION ..................................................... 372
C.4.4.3.1.1 MECHANICAL POWER TRANSMISSION ..................................................... 373
C.3.4.3.1.2 POWER GENERATION ................................................................................. 374
C.4.4.3.1.2 POWER GENERATION ................................................................................. 375
C.3.4.3.2 APS STARTING ............................................................................................. 375
C.4.4.3.2 APS STARTING ............................................................................................. 377
C.3.4.3.2.1 APS START SYSTEM CAPACITY ................................................................. 377
C.4.4.3.2.1 APS START SYSTEM CAPACITY ................................................................. 378
C.3.4.3.2.2 APS START SYSTEM CHARGING ............................................................... 378
C.4.4.3.2.2 APS START SYSTEM CHARGING ............................................................... 379
C.3.4.3.2.3 APS START SYSTEM RECYCLE .................................................................. 379
C.4.4.3.2.3 APS START SYSTEM RECYCLE .................................................................. 380
C.3.4.3.3 MAIN ENGINE STARTING............................................................................. 380
C.4.4.3.3 MAIN ENGINE STARTING............................................................................. 381
C.3.4.3.3.1 ALTERNATIVE POWER SOURCES.............................................................. 383
C.4.4.3.3.1 ALTERNATIVE POWER SOURCES.............................................................. 384
C.3.4.3.3.2 STARTING CONDITIONS .............................................................................. 384
C.4.4.3.3.2 STARTING CONDITIONS .............................................................................. 385
C.3.4.3.3.3 IN-FLIGHT STARTING ASSIST ..................................................................... 385
C.4.4.3.3.3 IN-FLIGHT STARTING ASSIST ..................................................................... 386
C.3.4.3.3.4 START CYCLE CONTROL ............................................................................ 387
C.4.4.3.3.4 START CYCLE CONTROL ............................................................................ 387
C.3.4.3.3.5 START CYCLE TERMINATION ..................................................................... 388
C.4.4.3.3.5 START CYCLE TERMINATION ..................................................................... 388
C.3.4.3.3.6 START DUTY CYCLE .................................................................................... 389
C.4.4.3.3.6 START DUTY CYCLE .................................................................................... 390
C.3.4.3.4 EMERGENCY POWER .................................................................................. 390
C.4.4.3.4 EMERGENCY POWER .................................................................................. 391
C.3.4.3.4.1 EMERGENCY POWER OPERATION............................................................ 391
C.4.4.3.4.1 EMERGENCY POWER OPERATION............................................................ 392
C.3.4.3.5 APS OPERATION FOR AIR VEHICLE GROUND SUPPORT ....................... 393
C.4.4.3.5 APS OPERATION FOR AIR VEHICLE GROUND SUPPORT ....................... 393
C.3.4.3.5.1 ENGINE MOTORING ..................................................................................... 394
C.4.4.3.5.1 ENGINE MOTORING ..................................................................................... 395
C.3.4.3.5.2 SYSTEMS GROUND OPERATIONAL POWER ............................................ 395
C.4.4.3.5.2 SYSTEMS GROUND OPERATIONAL POWER ............................................ 396
C.3.4.3.5.3 MAINTENANCE LIMITATIONS ...................................................................... 396
C.4.4.3.5.3 MAINTENANCE LIMITATIONS ...................................................................... 397
C.3.4.3.5.4 NOISE ............................................................................................................ 397
C.4.4.3.5.4 NOISE ............................................................................................................ 398
C.3.4.3.5.5 DECOUPLING ................................................................................................ 399
C.4.4.3.5.5 DECOUPLING ................................................................................................ 399
C.3.4.3.6 FUELS ............................................................................................................ 400
C.4.4.3.6 FUELS ............................................................................................................ 400
C.3.4.3.7 LUBRICATING OIL......................................................................................... 401
C.4.4.3.7 LUBRICATING OIL......................................................................................... 402
C.3.4.3.8 APS CONTROLS AND INDICATORS............................................................ 402
39
JSSG-2009A
C.4.4.3.8 APS CONTROLS AND INDICATORS............................................................ 402

C.3.4.3.8.1 APS CONTROLS ........................................................................................... 402
C.4.4.3.8.1 APS CONTROLS ........................................................................................... 403
C.3.4.3.8.2 APS STATUS AND HEALTH INDICATIONS ................................................. 404
C.4.4.3.8.2 APS STATUS AND HEALTH INDICATIONS ................................................. 404
C.3.4.3.9 POWER INTERRUPTIONS............................................................................ 405
C.4.4.3.9 POWER INTERRUPTIONS............................................................................ 405
C.3.4.3.10 APS UNIQUE INTEGRITY ............................................................................. 406
C.4.4.3.10 APS UNIQUE INTEGRITY ............................................................................. 406
C.3.4.3.10.1 ROTATING EQUIPMENT AND CONTAINMENT ........................................... 406
C.4.4.3.10.1 ROTATING EQUIPMENT AND CONTAINMENT ........................................... 407
C.3.4.3.10.2 CRITICAL SPEEDS........................................................................................ 407
C.4.4.3.10.2 CRITICAL SPEEDS........................................................................................ 408
C.3.4.3.11 EXHAUST SYSTEMS .................................................................................... 409
C.4.4.3.11 EXHAUST SYSTEMS .................................................................................... 409
C.3.4.3.12 APS SAFETY ................................................................................................. 410
C.4.4.3.12 APS SAFETY ................................................................................................. 410
C.3.4.3.12.1 PROTECTIVE FEATURES ............................................................................ 410
C.4.4.3.12.1 PROTECTIVE FEATURES ............................................................................ 411
C.3.4.3.12.2 FUEL ACCUMULATION................................................................................. 413
C.4.4.3.12.2 FUEL ACCUMULATION................................................................................. 413
C.3.4.3.13 APS NON-OPERATING CONDITIONS ......................................................... 414
C.4.4.3.13 APS NON-OPERATING CONDITIONS ......................................................... 414
C.3.4.3.14 INTERFACES ................................................................................................. 415
C.4.4.3.14 INTERFACES ................................................................................................. 419
C.5 PACKAGING .................................................................................................. 421
C.6 NOTES ........................................................................................................... 421
C.6.1 INTENDED USE ............................................................................................. 421
C.6.2 ACQUISITION REQUIREMENTS .................................................................. 421
C.6.3 ACRONYMS ................................................................................................... 421
C.6.4 SUBJECT TERM (KEY WORD) LISTING ...................................................... 422
C.6.5 INTERNATIONAL STANDARDIZATION AGREEMENT
IMPLEMENTATION........................................................................................ 422
C.6.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 422
C.6.7 CHANGES FROM PREVIOUS ISSUE ........................................................... 422
TABLES
TABLE C-I. APS PROTECTIVE FEATURES .................................................................... 412

TABLE C-II. THRESHOLD LIMIT VALUES ........................................................................ 419
40
JSSG-2009A
CONTENTS APPENDIX D: ENVIRONMENTAL CONTROL
D.1 SCOPE ........................................................................................................... 423

D.1.1 SCOPE ........................................................................................................... 423
D.1.2 STRUCTURE ................................................................................................. 423
D.1.3 APPENDIX ..................................................................................................... 423
D.1.4 DEVIATIONS .................................................................................................. 423
D.1.5 ENVIRONMENTAL IMPACT .......................................................................... 424
D.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 424
D.2 APPLICABLE DOCUMENTS ......................................................................... 424
D.2.1 GENERAL ...................................................................................................... 424
D.2.2 GOVERNMENT DOCUMENTS...................................................................... 424
D.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 424
D.2.2.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS,
D.2.3 NON-GOVERNMENT PUBLICATIONS ......................................................... 426
D.2.4 ORDER OF PRECEDENCE........................................................................... 427
D.2.5 STREAMLINING............................................................................................. 427
D.3 REQUIREMENTS........................................................................................... 428
D.4 VERIFICATIONS ............................................................................................ 428
D.3.1 DEFINITION ................................................................................................... 428
D.4.1 DEFINITION ................................................................................................... 428
D.3.2 CHARACTERISTICS...................................................................................... 428
D.4.2 CHARACTERISTICS...................................................................................... 428
D.3.3 DESIGN AND CONSTRUCTION ................................................................... 428
D.4.3 DESIGN AND CONSTRUCTION ................................................................... 428
D.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 428
D.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 428
D.3.4.1 LANDING SUBSYSTEM ................................................................................ 428
D.4.4.1 LANDING SUBSYSTEM ................................................................................ 428
D.3.4.2 HYDRAULIC SUBSYSTEM............................................................................ 428
D.4.4.2 HYDRAULIC SUBSYSTEM............................................................................ 428
D.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 428
D.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 428
D.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 429
D.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 430
D.3.4.4.1 PRESSURIZATION ........................................................................................ 431
D.4.4.4.1 PRESSURIZATION ........................................................................................ 432
D.3.4.4.1.1 OCCUPIED COMPARTMENT PRESSURE SCHEDULE .............................. 433
D.4.4.4.1.1 OCCUPIED COMPARTMENT PRESSURE SCHEDULE .............................. 436
D.3.4.4.1.2 UNOCCUPIED COMPARTMENT, BAY, AND
EQUIPMENT PRESSURE SCHEDULES ...................................................... 437
D.4.4.4.1.2 UNOCCUPIED COMPARTMENT, BAY, AND
EQUIPMENT PRESSURE SCHEDULES ...................................................... 439
D.3.4.4.1.3 RATE OF OCCUPIED COMPARTMENT PRESSURE CHANGE .................. 440
D.4.4.4.1.3 RATE OF OCCUPIED COMPARTMENT PRESSURE CHANGE .................. 441
D.3.4.4.1.4 COMPARTMENT POSITIVE AND NEGATIVE PRESSURE RELIEF ............ 442
D.4.4.4.1.4 COMPARTMENT POSITIVE AND NEGATIVE PRESSURE RELIEF ............ 443
D.3.4.4.1.5 OCCUPIED COMPARTMENT PRESSURE RELEASE ................................. 444
41
JSSG-2009A
D.4.4.4.1.5 OCCUPIED COMPARTMENT PRESSURE RELEASE ................................. 446

D.3.4.4.1.6 OCCUPIED COMPARTMENT LEAKAGE RATE ........................................... 446
D.4.4.4.1.6 OCCUPIED COMPARTMENT LEAKAGE RATE ........................................... 448
D.3.4.4.1.7 OCCUPIED COMPARTMENT PRESSURE SOURCE .................................. 449
D.4.4.4.1.7 OCCUPIED COMPARTMENT PRESSURE SOURCE .................................. 451
D.3.4.4.2 TEMPERATURE CONTROL .......................................................................... 452
D.4.4.4.2 TEMPERATURE CONTROL .......................................................................... 452
D.3.4.4.2.1 COOLING ....................................................................................................... 452
D.4.4.4.2.1 COOLING ....................................................................................................... 452
D.3.4.4.2.1.1 OCCUPIED COMPARTMENT IN-FLIGHT COOLING ................................... 452
D.4.4.4.2.1.1 OCCUPIED COMPARTMENT IN-FLIGHT COOLING ................................... 456
D.3.4.4.2.1.2 OCCUPIED COMPARTMENT GROUND COOLING ..................................... 457
D.4.4.4.2.1.2 OCCUPIED COMPARTMENT GROUND COOLING ..................................... 458
D.3.4.4.2.2 HEATING........................................................................................................ 459
D.4.4.4.2.2 HEATING........................................................................................................ 459
D.3.4.4.2.2.1 OCCUPIED COMPARTMENT IN-FLIGHT HEATING .................................... 459
D.4.4.4.2.2.1 OCCUPIED COMPARTMENT IN-FLIGHT HEATING .................................... 459
D.3.4.4.2.2.2 OCCUPIED COMPARTMENT GROUND HEATING ..................................... 460
D.4.4.4.2.2.2 OCCUPIED COMPARTMENT GROUND HEATING ..................................... 461
D.3.4.4.2.3 AVIONIC AND EQUIPMENT COMPARTMENT
TEMPERATURE CONTROL .......................................................................... 461
D.4.4.4.2.3 AVIONIC AND EQUIPMENT COMPARTMENT
TEMPERATURE CONTROL .......................................................................... 466
D.3.4.4.2.4 AVIONIC GROUND OPERATION.................................................................. 468
D.4.4.4.2.4 AVIONIC GROUND OPERATION.................................................................. 470
D.3.4.4.2.5 OCCUPIED COMPARTMENT AIR DISTRIBUTION ...................................... 472
D.4.4.4.2.5 OCCUPIED COMPARTMENT AIR DISTRIBUTION ...................................... 474
D.3.4.4.2.6 AVIONIC COOLANT DISTRIBUTION ............................................................ 485
D.4.4.4.2.6 AVIONIC COOLANT DISTRIBUTION ............................................................ 486
D.3.4.4.2.7 OCCUPIED COMPARTMENT AIR VELOCITY.............................................. 487
D.4.4.4.2.7 OCCUPIED COMPARTMENT AIR VELOCITY.............................................. 487
D.3.4.4.2.8 OCCUPIED COMPARTMENT FLOW SHUTOFF .......................................... 488
D.4.4.4.2.8 OCCUPIED COMPARTMENT FLOW SHUTOFF .......................................... 488
D.3.4.4.2.9 TRANSIENT TEMPERATURE CONTROL .................................................... 489
D.4.4.4.2.9 TRANSIENT TEMPERATURE CONTROL .................................................... 489
D.3.4.4.2.9.1 TRANSIENT GROUND COOL-DOWN .......................................................... 489
D.4.4.4.2.9.1 TRANSIENT GROUND COOL-DOWN .......................................................... 490
D.3.4.4.2.9.2 TRANSIENT GROUND WARM-UP................................................................ 491
D.4.4.4.2.9.2 TRANSIENT GROUND WARM-UP................................................................ 491
D.3.4.4.2.10 THERMAL CONTROL OF OTHER COMPARTMENTS,
STRUCTURE, SKIN, EQUIPMENT, AND SUBSYSTEMS ............................ 492
D.4.4.4.2.10 THERMAL CONTROL OF OTHER COMPARTMENTS,
D.3.4.4.3 ECS CREW STATION INTERFACE .............................................................. 494
D.4.4.4.3 ECS CREW STATION INTERFACE .............................................................. 497
D.3.4.4.4 SURFACE TOUCH TEMPERATURES .......................................................... 499
D.4.4.4.4 SURFACE TOUCH TEMPERATURES .......................................................... 500
D.3.4.4.5 VENTILATION ................................................................................................ 501
D.4.4.4.5 VENTILATION ................................................................................................ 501
42
JSSG-2009A
D.3.4.4.5.1 OCCUPIED COMPARTMENT NORMAL VENTILATION .............................. 501

D.4.4.4.5.1 OCCUPIED COMPARTMENT NORMAL VENTILATION .............................. 503
D.3.4.4.5.2 OCCUPIED COMPARTMENT EMERGENCY VENTILATION
AND SMOKE REMOVAL ............................................................................... 504
D.4.4.4.5.2 OCCUPIED COMPARTMENT EMERGENCY VENTILATION
AND SMOKE REMOVAL ............................................................................... 504
D.3.4.4.5.3 AVIONIC EQUIPMENT AND EQUIPMENT COMPARTMENT
EMERGENCY COOLING ............................................................................... 505
EMERGENCY COOLING ............................................................................... 506
D.3.4.4.5.4 SUIT VENTILATION AND PRESSURIZATION .............................................. 506
D.4.4.4.5.4 SUIT VENTILATION AND PRESSURIZATION .............................................. 507
D.3.4.4.5.5 CAPSULE PRESSURIZATION AND VENTILATION ..................................... 507
D.4.4.4.5.5 CAPSULE PRESSURIZATION AND VENTILATION ..................................... 510
D.3.4.4.5.6 CARGO AND OTHER COMPARTMENT VENTILATION .............................. 510
D.4.4.4.5.6 CARGO AND OTHER COMPARTMENT VENTILATION .............................. 511
D.3.4.4.6 CONTAMINATION ......................................................................................... 512
D.4.4.4.6 CONTAMINATION ......................................................................................... 512
D.3.4.4.6.1 OCCUPIED COMPARTMENT CONTAMINATION ........................................ 512
D.4.4.4.6.1 OCCUPIED COMPARTMENT CONTAMINATION ........................................ 513
DUST CONTROL ........................................................................................... 515
DUST CONTROL ........................................................................................... 516
D.3.4.4.6.3 NUCLEAR, BIOLOGICAL, AND CHEMICAL CONTAMINATION .................. 517
D.4.4.4.6.3 NUCLEAR, BIOLOGICAL, AND CHEMICAL CONTAMINATION .................. 518
D.3.4.4.7 MOISTURE AND HUMIDITY CONTROL ....................................................... 520
D.4.4.4.7 MOISTURE AND HUMIDITY CONTROL ....................................................... 520
D.3.4.4.7.1 OCCUPIED COMPARTMENT MOISTURE CONTROL ................................. 520
D.4.4.4.7.1 OCCUPIED COMPARTMENT MOISTURE CONTROL ................................. 521
D.3.4.4.7.2 OCCUPIED COMPARTMENT HUMIDITY CONTROL .................................. 521
D.4.4.4.7.2 OCCUPIED COMPARTMENT HUMIDITY CONTROL .................................. 522
D.3.4.4.7.3 AVIONIC EQUIPMENT AND EQUIPMENT COMPARTMEN
MOISTURE CONTROL .................................................................................. 523
MOISTURE CONTROL .................................................................................. 525
D.3.4.4.7.4 MOISTURE CONTROL OF OTHER COMPARTMENTS,
D.4.4.4.7.4 MOISTURE CONTROL OF OTHER COMPARTMENTS,
D.3.4.4.8 TRANSPARENT AREA FOG AND FROST PROTECTION ........................... 527
D.4.4.4.8 TRANSPARENT AREA FOG AND FROST PROTECTION ........................... 530
D.3.4.4.9 RAIN REMOVAL ............................................................................................ 532
D.4.4.4.9 RAIN REMOVAL ............................................................................................ 537
D.3.4.4.10 TRANSPARENCY CLEANING....................................................................... 538
D.4.4.4.10 TRANSPARENCY CLEANING....................................................................... 540
D.3.4.4.11 ICE PROTECTION ......................................................................................... 540
D.4.4.4.11 ICE PROTECTION ......................................................................................... 547
D.3.4.4.12 BLEED AIR ..................................................................................................... 549
43
JSSG-2009A
D.4.4.4.12 BLEED AIR ..................................................................................................... 549

D.3.4.4.12.1 OVERBLEED PROTECTION ......................................................................... 549
D.4.4.4.12.1 OVERBLEED PROTECTION ......................................................................... 549
D.3.4.4.12.2 BLEED AIR SOURCE SHUT OFF ................................................................. 550
D.4.4.4.12.2 BLEED AIR SOURCE SHUT OFF ................................................................. 551
D.3.4.4.12.3 BLEED AIR DISTRIBUTION CONTROL ........................................................ 551
D.4.4.4.12.3 BLEED AIR DISTRIBUTION CONTROL ........................................................ 552
D.3.4.4.12.4 ISOLATION AND CROSSOVER CONTROL ................................................. 552
D.4.4.4.12.4 ISOLATION AND CROSSOVER CONTROL ................................................. 553
D.3.4.4.12.5 REVERSE FLOW PREVENTION................................................................... 555
D.4.4.4.12.5 REVERSE FLOW PREVENTION................................................................... 555
D.3.4.4.12.6 BLEED AIR PRESSURE REGULATION........................................................ 556
D.4.4.4.12.6 BLEED AIR PRESSURE REGULATION........................................................ 557
D.3.4.4.12.7 BLEED AIR TEMPERATURE CONTROL ...................................................... 558
D.4.4.4.12.7 BLEED AIR TEMPERATURE CONTROL ...................................................... 559
D.3.4.4.12.8 BLEED AIR LEAK DETECTION ..................................................................... 559
D.4.4.4.12.8 BLEED AIR LEAK DETECTION ..................................................................... 561
D.3.4.4.12.9 BLEED AIR PRESSURE RELIEF .................................................................. 562
D.4.4.4.12.9 BLEED AIR PRESSURE RELIEF .................................................................. 563
D.3.4.4.12.10 UNCONTROLLED BLEED AIR ...................................................................... 563
D.4.4.4.12.10 UNCONTROLLED BLEED AIR ...................................................................... 564
D.3.4.4.13 THERMAL SYSTEM PROTECTION .............................................................. 565
D.4.4.4.13 THERMAL SYSTEM PROTECTION .............................................................. 566
D.3.4.4.14 STRUCTURAL INTEGRITY ........................................................................... 567
D.4.4.4.14 STRUCTURAL INTEGRITY ........................................................................... 567
D.3.4.4.14.1 PROOF PRESSURE ...................................................................................... 567
D.4.4.4.14.1 PROOF PRESSURE ...................................................................................... 568
D.3.4.4.14.2 BURST PRESSURE....................................................................................... 569
D.4.4.4.14.2 BURST PRESSURE....................................................................................... 570
D.3.4.4.14.3 ROTATING EQUIPMENT STRUCTURAL INTEGRITY ................................. 570
D.4.4.4.14.3 ROTATING EQUIPMENT STRUCTURAL INTEGRITY ................................. 572
D.3.4.4.15 GROUND INTERFACES ................................................................................ 573
D.4.4.4.15 GROUND INTERFACES ................................................................................ 573
D.3.4.4.15.1 GROUND TEST PROVISIONS ...................................................................... 573
D.4.4.4.15.1 GROUND TEST PROVISIONS ...................................................................... 574
D.3.4.4.15.2 GROUND CONNECTIONS ............................................................................ 575
D.4.4.4.15.2 GROUND CONNECTIONS ............................................................................ 576
D.3.4.4.15.3 GROUND SERVICING ................................................................................... 577
D.4.4.4.15.3 GROUND SERVICING ................................................................................... 577
D.3.4.4.16 HOT SURFACE TEMPERATURE.................................................................. 578
D.4.4.4.16 HOT SURFACE TEMPERATURE.................................................................. 579
D.3.4.4.17 GROWTH ....................................................................................................... 580
D.4.4.4.17 GROWTH ....................................................................................................... 582
D.5 PACKAGING .................................................................................................. 583
D.6 NOTES ........................................................................................................... 583
D.6.1 INTENDED USE ............................................................................................. 583
D.6.2 ACQUISITION REQUIREMENTS .................................................................. 583
D.6.3 COMPONENT INFORMATION ...................................................................... 583
D.6.3.1 BEARINGS ..................................................................................................... 583
44
JSSG-2009A
D.6.3.2 AIR CYCLE MACHINES................................................................................. 584

D.6.3.3 BLEED DUCTS .............................................................................................. 585
D.6.3.4 PNEUMATIC ACTUATED COMPONENTS ................................................... 585
D.6.3.5 HEAT EXCHANGERS .................................................................................... 587
D.6.3.5.1 RAM AIR HEAT EXCHANGERS .................................................................... 588
D.6.3.5.2 AIR TO LIQUID HEAT EXCHANGERS .......................................................... 589
D.6.3.5.3 LIQUID TO LIQUID HEAT EXCHANGERS .................................................... 589
D.6.3.6 WATER BOILERS .......................................................................................... 590
D.6.3.7 DUCT COUPLINGS ....................................................................................... 592
D.6.3.8 PRESSURIZATION CONTROL VALVES ...................................................... 594
D.6.3.9 LIQUID COOLING LOOPS............................................................................. 594
D.6.3.10 VAPOR CYCLE LOOPS................................................................................. 596
D.6.3.11 FANS .............................................................................................................. 597
D.6.3.12 COMPONENT PERFORMANCE DATA......................................................... 597
D.6.3.13 COMPONENT QUALIFICATION BY SIMILARITY ......................................... 598
D.6.4 ACRONYMS ................................................................................................... 598
D.6.5 SUBJECT TERM (KEY WORD) LISTING ...................................................... 599
D.6.6 INTERNATIONAL STANDARDIZATION AGREEMENT
IMPLEMENTATION........................................................................................ 600
D.6.7 RESPONSIBLE ENGINEERING OFFICE ...................................................... 600
D.6.8 CHANGES FROM PREVIOUS ISSUE ........................................................... 600
TABLES
TABLE D-I. COOLING GUIDELINES ................................................................................ 455

TABLE D-II. CLAMP FAILURES......................................................................................... 593
FIGURES
FIGURE D-1. CABIN PRESSURE FOR COMBAT AIR VEHICLES ..................................... 434
FIGURE D-2. F-5F COCKPIT AIR DISTRIBUTION SYSTEM .............................................. 476
FIGURE D-3. F-15 COCKPIT AIR DISTRIBUTION .............................................................. 477
FIGURE D-4. F-15 COCKPIT AIR DISTRIBUTION .............................................................. 478
FIGURE D-5. ORIGINAL A-10 COCKPIT AIR DISTRIBUTION ........................................... 479
FIGURE D-6. NEW A-10 DISTRIBUTION DUCT ROUTING ................................................ 480
FIGURE D-7. REVISED A-10 COCKPIT FLOW PATTERN ................................................. 481
FIGURE D-8. CABIN AIR DISTRIBUTION SYSTEM INSTALLATION ................................. 482
FIGURE D-9. CABIN AIR DISTRIBUTION ........................................................................... 483
FIGURE D-10. FLIGHT DECK CONDITIONED AIR DISTRIBUTION SYSTEM .................... 484
FIGURE D-11. VENTILATION FLOW RATE AS A FUNCTION OF CABIN VOLUME ........... 502
FIGURE D-12. UPPER AIR TEMPERATURE PROFILES FOR DESIGN OF
WINDSHIELD DEFOGGING SYSTEM .......................................................... 529
45
JSSG-2009A
CONTENTS APPENDIX E: FUEL
E.1 SCOPE ........................................................................................................... 601

E.1.1 SCOPE ........................................................................................................... 601
E.1.2 STRUCTURE ................................................................................................. 601
E.1.3 APPENDIX ..................................................................................................... 601
E.1.4 DEVIATIONS .................................................................................................. 601
E.1.5 ENVIRONMENTAL IMPACT .......................................................................... 602
E.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 602
E.2 APPLICABLE DOCUMENTS ......................................................................... 602
E.2.1 GENERAL ...................................................................................................... 602
E.2.2 GOVERNMENT DOCUMENTS...................................................................... 602
E.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 602
E.2.2.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS,
E.2.3 NON-GOVERNMENT PUBLICATIONS ......................................................... 606
E.2.4 ORDER OF PRECEDENCE........................................................................... 607
E.2.5 STREAMLINING............................................................................................. 607
E.3 REQUIREMENTS........................................................................................... 608
E.4 VERIFICATIONS ............................................................................................ 608
E.3.1 DEFINITION ................................................................................................... 608
E.4.1 DEFINITION ................................................................................................... 608
E.3.2 CHARACTERISTICS...................................................................................... 608
E.4.2 CHARACTERISTICS...................................................................................... 608
E.3.3 DESIGN AND CONSTRUCTION ................................................................... 608
E.4.3 DESIGN AND CONSTRUCTION ................................................................... 608
E.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 608
E.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 608
E.3.4.1 LANDING SUBSYSTEM ................................................................................ 608
E.4.4.1 LANDING SUBSYSTEM ................................................................................ 608
E.3.4.2 HYDRAULIC SUBSYSTEM............................................................................ 608
E.4.4.2 HYDRAULIC SUBSYSTEM............................................................................ 608
E.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 608
E.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 608
E.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 608
E.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 608
E.3.4.5 FUEL SUBSYSTEM ....................................................................................... 609
E.4.4.5 FUEL SUBSYSTEM ....................................................................................... 609
E.3.4.5.1 GENERAL REQUIREMENTS ........................................................................ 609
E.4.4.5.1 GENERAL REQUIREMENTS ........................................................................ 609
E.3.4.5.1.1 FUEL DESIGNATION..................................................................................... 609
E.4.4.5.1.1 FUEL DESIGNATION..................................................................................... 611
E.3.4.5.1.2 MATERIAL FUEL RESISTANCE ................................................................... 612
E.4.4.5.1.2 MATERIAL FUEL RESISTANCE ................................................................... 613
E.3.4.5.1.3 FUEL CONTAMINATION ............................................................................... 614
E.4.4.5.1.3 FUEL CONTAMINATION ............................................................................... 617
E.3.4.5.1.3.1 FUEL SYSTEM ICING CONTINUOUS OPERATION .................................... 618
E.4.4.5.1.3.1 FUEL SYSTEM ICING CONTINUOUS OPERATION .................................... 619
E.3.4.5.1.4 FUEL TEMPERATURES ................................................................................ 621
46
JSSG-2009A
E.4.4.5.1.4 FUEL TEMPERATURES ................................................................................ 622

E.3.4.5.1.5 PROOF PRESSURES.................................................................................... 623
E.4.4.5.1.5 PROOF PRESSURES.................................................................................... 624
E.3.4.5.1.6 BURST PRESSURE....................................................................................... 625
E.4.4.5.1.6 BURST PRESSURE....................................................................................... 626
E.3.4.5.1.7 SURGE PRESSURE ...................................................................................... 626
E.4.4.5.1.7 SURGE PRESSURE ...................................................................................... 629
E.3.4.5.1.8 THERMAL EXPANSION RELIEF ................................................................... 630
E.4.4.5.1.8 THERMAL EXPANSION RELIEF ................................................................... 630
E.3.4.5.1.9 EXTERNAL FUEL LEAKAGE......................................................................... 631
E.4.4.5.1.9 EXTERNAL FUEL LEAKAGE......................................................................... 631
E.3.4.5.1.10 COMPARTMENT DRAINS AND FUEL LEAKAGE PATH CONTROL ........... 632
E.4.4.5.1.10 COMPARTMENT DRAINS ............................................................................. 633
E.3.4.5.1.11 ELECTRICAL FAULT AND EXPLOSIVE ATMOSPHERE ............................. 634
E.4.4.5.1.11 ELECTRICAL FAULT AND EXPLOSIVE ATMOSPHERE ............................. 635
E.3.4.5.1.12 FAILURE CRITERIA....................................................................................... 636
E.4.4.5.1.12 FAILURE CRITERIA....................................................................................... 637
E.3.4.5.1.13 FUEL PLUMBING........................................................................................... 637
E.4.4.5.1.13 FUEL PLUMBING........................................................................................... 638
E.3.4.5.1.13.1 FUEL LINE SUPPORT AND ROUTING ......................................................... 639
E.4.4.5.1.13.1 FUEL LINE SUPPORT AND ROUTING ......................................................... 640
E.3.4.5.1.14 SUBSYSTEM ISOLATION ............................................................................. 640
E.4.4.5.1.14 SUBSYSTEM ISOLATION ............................................................................. 641
E.3.4.5.2 ENGINE FEED ............................................................................................... 642
E.4.4.5.2 ENGINE FEED ............................................................................................... 642
E.3.4.5.2.1 ENGINE FUEL FEED INTERFACE................................................................ 642
E.4.4.5.2.1 ENGINE FUEL FEED INTERFACE............................................................... 643
E.3.4.5.2.2 FUEL AVAILABILITY ...................................................................................... 644
E.4.4.5.2.2 FUEL AVAILABILITY ...................................................................................... 647
E.3.4.5.2.3 FLOW PERFORMANCE ................................................................................ 648
E.4.4.5.2.3 FLOW PERFORMANCE ................................................................................ 649
E.3.4.5.2.4 EMERGENCY FEED ...................................................................................... 650
E.4.4.5.2.4 EMERGENCY FEED ...................................................................................... 651
E.3.4.5.2.4.1 PRIMING ........................................................................................................ 651
E.4.4.5.2.4.1 PRIMING ........................................................................................................ 652
E.3.4.5.2.5 FEED TANK AVAILABLE FUEL ..................................................................... 652
E.4.4.5.2.5 FEED TANK AVAILABLE FUEL ..................................................................... 653
E.3.4.5.2.6 ENGINE FUEL LINE SHUT OFF CAPABILITY .............................................. 653
E.4.4.5.2.6 ENGINE FUEL LINE SHUT OFF CAPABILITY .............................................. 655
E.3.4.5.3 AUXILIARY POWER UNIT (APU) OR
JET FUEL STARTER (JFS) INTERFACE ...................................................... 656
E.4.4.5.3 AUXILIARY POWER UNIT (APU) OR
JET FUEL STARTER (JFS) INTERFACE ...................................................... 656
E.3.4.5.4 FUEL MANAGEMENT.................................................................................... 657
E.4.4.5.4 FUEL MANAGEMENT.................................................................................... 659
E.3.4.5.4.1 FUEL TRANSFER .......................................................................................... 660
E.4.4.5.4.1 FUEL TRANSFER .......................................................................................... 661
E.3.4.5.4.2 REFUEL CONTROL MODE ........................................................................... 661
E.4.4.5.4.2 REFUEL CONTROL MODE ........................................................................... 662
47
JSSG-2009A
E.3.4.5.5 FUEL QUANTITY MEASUREMENT AND INDICATION ................................ 662

E.4.4.5.5 FUEL QUANTITY MEASUREMENT .............................................................. 663
E.3.4.5.6 FUEL TANK .................................................................................................... 664
E.4.4.5.6 FUEL TANK .................................................................................................... 664
E.3.4.5.6.1 FUEL EXPANSION SPACE (ULLAGE).......................................................... 664
E.4.4.5.6.1 FUEL EXPANSION SPACE (ULLAGE).......................................................... 665
E.3.4.5.6.2 FUEL TANK LOW POINT DRAINAGES ........................................................ 666
E.4.4.5.6.2 FUEL TANK LOW POINT DRAINAGES ........................................................ 667
E.3.4.5.6.3 FUEL TANK CLEANLINESS .......................................................................... 667
E.4.4.5.6.3 FUEL TANK CLEANLINESS .......................................................................... 668
E.3.4.5.6.4 INTEGRAL TANK SEALING .......................................................................... 669
E.4.4.5.6.4 INTEGRAL TANK DESIGN ............................................................................ 671
E.3.4.5.6.5 BLADDER TANK CAVITY .............................................................................. 671
E.4.4.5.6.5 BLADDER TANK CAVITY .............................................................................. 672
E.3.4.5.6.6 INTERNAL AUXILARY FUEL TANKS REMOVABLE TANK SUPPORT ....... 673
E.4.4.5.6.6 INTERNAL AUXILARY FUEL TANKS REMOVABLE TANK SUPPORT ....... 673
E.3.4.5.6.7 EXTERNAL TANKS........................................................................................ 674
E.4.4.5.6.7 EXTERNAL TANKS........................................................................................ 675
E.3.4.5.6.8 EXTERNAL TANKS INSTALLATION TIME ................................................... 675
E.4.4.5.6.8 EXTERNAL TANKS INSTALLATION TIME ................................................... 676
E.3.4.5.6.9 EXTERNAL TANK CAPABILITY .................................................................... 676
E.4.4.5.6.9 EXTERNAL TANK CAPABILITY .................................................................... 677
E.3.4.5.6.10 SELF-SEALING TANK ................................................................................... 677
E.4.4.5.6.10 SELF-SEALING TANK ................................................................................... 678
E.3.4.5.6.11 FUEL TANK LOCATION AND SEPARATION ................................................ 679
E.4.4.5.6.11 FUEL TANK LOCATION AND SEPARATION ................................................ 680
E.3.4.5.6.12 TANK ACCESS DOORS ................................................................................ 680
E.4.4.5.6.12 TANK ACCESS DOORS ................................................................................ 681
E.3.4.5.6.13 CRASHWORTHINESS................................................................................... 681
E.4.4.5.6.13 CRASHWORTHINESS................................................................................... 682
E.3.4.5.7 FUEL TANK INERTING AND EXPLOSION SUPPRESSION ........................ 682
E.4.4.5.7 FUEL TANK INERTING AND EXPLOSION SUPPRESSION ........................ 685
E.3.4.5.8 REFUELING AND DEFUELING ..................................................................... 685
E.4.4.5.8 REFUELING AND DEFUELING ..................................................................... 685
E.3.4.5.8.1 GROUND REFUELING RATE ....................................................................... 685
E.4.4.5.8.1 GROUND REFUELING RATE ....................................................................... 687
E.3.4.5.8.2 RECEIVER AERIAL REFUELING RATE ....................................................... 687
E.4.4.5.8.2 RECEIVER AERIAL REFUELING RATE ....................................................... 688
E.3.4.5.8.3 REFUELING POWER CONDITIONS ............................................................. 688
E.4.4.5.8.3 REFUELING POWER CONDITIONS ............................................................. 689
E.3.4.5.8.4 PRESSURE REFUELING .............................................................................. 689
E.4.4.5.8.4 PRESSURE REFUELING .............................................................................. 690
E.3.4.5.8.5 ADAPTER LOCATION ................................................................................... 691
E.4.4.5.8.5 ADAPTER LOCATION ................................................................................... 691
E.3.4.5.8.6 REFUELING ADAPTER LEAKAGE PREVENTION ....................................... 692
E.4.4.5.8.6 REFUELING ADAPTER LEAKAGE PREVENTION ....................................... 692
E.3.4.5.8.7 GRAVITY REFUELING .................................................................................. 693
E.4.4.5.8.7 GRAVITY REFUELING .................................................................................. 693
E.3.4.5.8.8 HOT REFUELING .......................................................................................... 694
48
JSSG-2009A
E.4.4.5.8.8 HOT REFUELING .......................................................................................... 695

E.3.4.5.8.9 HELICOPTER IN FLIGHT REFUELING (HIFR) ............................................. 695
E.4.4.5.8.9 HELICOPTER IN FLIGHT REFUELING (HIFR) ............................................. 696
E.3.4.5.8.10 FUEL SUBSYSTEM REFUELING PRE-CHECK ........................................... 696
E.4.4.5.8.10 FUEL SUBSYSTEM REFUELING PRE-CHECK ........................................... 697
E.3.4.5.8.11 STATIC DISCHARGE IN FUEL TANKS......................................................... 697
E.4.4.5.8.11 STATIC DISCHARGE IN FUEL TANKS......................................................... 699
E.3.4.5.8.12 DEFUELING METHOD(S).............................................................................. 700
E.4.4.5.8.12 DEFUELING METHOD(S).............................................................................. 701
E.3.4.5.8.13 DEFUELING RATE ........................................................................................ 701
E.4.4.5.8.13 DEFUELING RATE ........................................................................................ 702
E.3.4.5.8.14 DEFUELING CRASHED AIR VEHICLE ......................................................... 702
E.4.4.5.8.14 DEFUELING CRASHED AIR VEHICLE ......................................................... 703
E.3.4.5.9 FUEL VENTING ............................................................................................. 703
E.4.4.5.9 FUEL VENTING ............................................................................................. 706
E.3.4.5.9.1 VENT LEAKAGE ............................................................................................ 707
E.4.4.5.9.1 VENT LEAKAGE ............................................................................................ 708
E.3.4.5.9.2 VENT OUTLET LOCATION ........................................................................... 708
E.4.4.5.9.2 VENT OUTLET LOCATION ........................................................................... 709
E.3.4.5.10 FUEL DUMP ................................................................................................... 710
E.4.4.5.10 FUEL DUMP ................................................................................................... 711
E.3.4.5.11 FUEL USED AS A HEAT SINK ...................................................................... 712
E.4.4.5.11 FUEL USED AS A HEAT SINK ...................................................................... 713
E.3.4.5.12 CONTROLS AND MONITOR ......................................................................... 714
E.4.4.5.12 CONTROLS AND MONITOR ......................................................................... 714
E.3.4.5.12.1 LOW LEVEL FUEL WARNING....................................................................... 714
E.4.4.5.12.1 LOW LEVEL FUEL WARNING....................................................................... 715
E.3.4.5.12.2 FUEL TEMPERATURE INDICATIONS .......................................................... 716
E.4.4.5.12.2 FUEL TEMPERATURE INDICATIONS .......................................................... 716
E.3.4.5.12.3 LOW FUEL PRESSURE INDICATION........................................................... 717
E.4.4.5.12.3 LOW FUEL PRESSURE INDICATION........................................................... 717
E.3.4.5.12.4 FUEL UNBALANCE INDICATION.................................................................. 718
E.4.4.5.12.4 FUEL UNBALANCE INDICATION.................................................................. 718
E.3.4.5.12.5 GROUND REFUELING CONTROLS ............................................................. 719
E.4.4.5.12.5 GROUND REFUELING CONTROLS ............................................................. 720
E.5 PACKAGING .................................................................................................. 721
E.6 NOTES ........................................................................................................... 721
E.6.1 INTENDED USE ............................................................................................. 721
E.6.2 ACQUISITION REQUIREMENTS .................................................................. 721
E.6.3 COMPONENT INFORMATION ...................................................................... 721
E.6.3.1 LEVEL CONTROL .......................................................................................... 721
E.6.3.2 BOOST PUMPS ............................................................................................. 722
E.6.4 ACRONYMS ................................................................................................... 725
E.6.5 SUBJECT TERM (KEY WORD) LISTING ...................................................... 726
E.6.6 INTERNATIONAL STANDARDIZATION AGREEMENT
IMPLEMENTATION........................................................................................ 726
E.6.7 RESPONSIBLE ENGINEERING OFFICE ...................................................... 727
E.6.8 CHANGES FROM PREVIOUS ISSUE ........................................................... 727
49
JSSG-2009A
TABLES
TABLE E-I. FUEL CONTAMINANTS................................................................................. 620

TABLE E-II. TEMPERATURE ENVIRONMENT ................................................................. 622
TABLE E-III. FUEL LINE SUPPORT DISTANCE ................................................................ 639
TABLE E-IV. PRESSURE REFUELING TIMES .................................................................. 686
CONTENTS APPENDIX F: AERIAL REFUELING
F.1 SCOPE ........................................................................................................... 728

F.1.1 SCOPE ........................................................................................................... 728
F.1.2 STRUCTURE ................................................................................................. 728
F.1.3 APPENDIX ..................................................................................................... 728
F.1.4 DEVIATIONS .................................................................................................. 728
F.1.5 ENVIRONMENTAL IMPACT .......................................................................... 729
F.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 729
F.2 APPLICABLE DOCUMENTS ......................................................................... 729
F.2.1 GENERAL ...................................................................................................... 729
F.2.2 GOVERNMENT DOCUMENTS...................................................................... 729
F.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 729
F.2.3 ORDER OF PRECEDENCE........................................................................... 730
F.2.4 STREAMLINING............................................................................................. 730
F.3 REQUIREMENTS........................................................................................... 731
F.4 VERIFICATIONS ............................................................................................ 731
F.3.1 DEFINITION ................................................................................................... 731
F.4.1 DEFINITION ................................................................................................... 731
F.3.2 CHARACTERISTICS...................................................................................... 731
F.4.2 CHARACTERISTICS...................................................................................... 731
F.3.3 DESIGN AND CONSTRUCTION ................................................................... 731
F.4.3 DESIGN AND CONSTRUCTION ................................................................... 731
F.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 731
F.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 731
F.3.4.1 LANDING SUBSYSTEM ................................................................................ 731
F.4.4.1 LANDING SUBSYSTEM ................................................................................ 731
F.3.4.2 HYDRAULIC SUBSYSTEM............................................................................ 731
F.4.4.2 HYDRAULIC SUBSYSTEM............................................................................ 731
F.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 731
F.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 731
F.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 731
F.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 731
F.3.4.5 FUEL SUBSYSTEM ....................................................................................... 731
F.4.4.5 FUEL SUBSYSTEM ....................................................................................... 731
F.3.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 732
F.4.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 733
F.3.4.6.1 GENERAL SUBSYSTEM REQUIREMENTS ................................................. 734
F.4.4.6.1 GENERAL SUBSYSTEM REQUIREMENTS ................................................. 734
F.3.4.6.1.1 OTHER SUBSYSTEM INTERFACES ............................................................ 734
50
JSSG-2009A
F.4.4.6.1.1 OTHER SUBSYSTEM INTERFACES ............................................................ 735

F.3.4.6.1.2 SINGLE FAILURES ........................................................................................ 735
F.4.4.6.1.2 SINGLE FAILURES ........................................................................................ 736
F.3.4.6.1.3 OPERATING FUEL PRESSURE ................................................................... 737
F.4.4.6.1.3 OPERATING FUEL PRESSURE ................................................................... 737
F.3.4.6.1.4 SUBSYSTEM ISOLATION ............................................................................. 738
F.4.4.6.1.4 SUBSYSTEM ISOLATION ............................................................................. 738
F.3.4.6.1.5 REMOVED GROUP B HARDWARE .............................................................. 739
F.4.4.6.1.5 REMOVED GROUP B HARDWARE .............................................................. 740
F.3.4.6.1.6 FUEL SUBSYSTEM ISSUES ......................................................................... 740
F.4.4.6.1.6 FUEL SUBSYSTEM ISSUES ......................................................................... 741
F.3.4.6.1.7 FIRE PROTECTION CONSIDERATIONS ..................................................... 741
F.4.4.6.1.7 FIRE PROTECTION CONSIDERATIONS ..................................................... 742
F.3.4.6.1.8 AIR VEHICLE CENTER OF GRAVITY AND FLIGHT CONTROL
AND HANDLING QUALITIES......................................................................... 742
F.4.4.6.1.8 AIR VEHICLE CENTER OF GRAVITY AND FLIGHT CONTROL
AND HANDLING QUALITIES......................................................................... 742
F.3.4.6.1.9 COMMUNICATION CAPABILITY................................................................... 743
F.4.4.6.1.9 COMMUNICATION CAPABILITY................................................................... 744
F.3.4.6.1.10 SUPPORT EQUIPMENT INTERFACE .......................................................... 744
F.4.4.6.1.10 SUPPORT EQUIPMENT INTERFACE .......................................................... 745
F.3.4.6.2 RECEIVER AERIAL REFUELING SUBSYSTEMS ........................................ 746
F.4.4.6.2 RECEIVER AERIAL REFUELING SUBSYSTEMS ........................................ 746
F.3.4.6.2.1 GENERAL RECEIVER AERIAL REFUELING
SUBSYSTEM REQUIREMENTS ................................................................... 746
F.4.4.6.2.1 GENERAL RECEIVER AERIAL REFUELING
SUBSYSTEM REQUIREMENTS ................................................................... 746
F.3.4.6.2.1.1 TANKER COMPATIBILITY............................................................................. 746
F.4.4.6.2.1.1 TANKER COMPATIBILITY............................................................................. 746
F.3.4.6.2.1.2 RECEIVER AERIAL REFUELING RATE ....................................................... 747
F.4.4.6.2.1.2 RECEIVER AERIAL REFUELING RATE ....................................................... 749
F.3.4.6.2.1.3 REFUEL CONTROL MODE ........................................................................... 750
F.4.4.6.2.1.3 REFUEL CONTROL MODE ........................................................................... 750
F.3.4.6.2.1.4 FUEL PARAMETERS..................................................................................... 751
F.4.4.6.2.1.4 FUEL PARAMETERS..................................................................................... 751
F.3.4.6.2.1.5 LOW OBSERVABLE (LO) PARAMETERS .................................................... 751
F.4.4.6.2.1.5 LOW OBSERVABLE (LO) PARAMETERS .................................................... 752
F.3.4.6.2.2 RECEPTACLE RECEIVER AERIAL REFUELING SUBSYSTEMS ............... 752
F.4.4.6.2.2 RECEPTACLE RECEIVER AERIAL REFUELING SUBSYSTEMS ............... 752
F.3.4.6.2.2.1 TYPE OF RECEPTACLE INSTALLATION..................................................... 752
F.4.4.6.2.2.1 TYPE OF RECEPTACLE INSTALLATION..................................................... 760
F.3.4.6.2.2.1.1 RECEPTACLE ACTUATION PROVISION(S) ................................................ 760
F.4.4.6.2.2.1.1 RECEPTACLE ACTUATION PROVISION(S) ................................................ 761
F.3.4.6.2.2.1.2 RECEPTACLE ACTUATION AIRSPEED AND ALTITUDE ENVELOPE ....... 762
F.4.4.6.2.2.1.2 RECEPTACLE ACTUATION AIRSPEED AND ALTITUDE ENVELOPE ....... 762
F.3.4.6.2.2.1.3 RECEPTACLE ACTUATION TIMES .............................................................. 763
F.4.4.6.2.2.1.3 RECEPTACLE ACTUATION TIMES .............................................................. 764
F.3.4.6.2.2.1.4 SLIPWAY ILLUMINATION ............................................................................. 764
F.4.4.6.2.2.1.4 SLIPWAY ILLUMINATION ............................................................................. 765
51
JSSG-2009A
F.3.4.6.2.2.2 LOCATION OF RECEPTACLE INSTALLATION ............................................ 766

F.4.4.6.2.2.2 LOCATION OF RECEPTACLE INSTALLATION ............................................ 767
F.3.4.6.2.2.3 RECEPTACLE INSTALLATION DRAINAGE ................................................. 767
F.4.4.6.2.2.3 RECEPTACLE INSTALLATION DRAINAGE ................................................. 768
F.3.4.6.2.2.4 RECEPTACLE INSTALLATION SEALING AND FAIRING ............................ 769
F.4.4.6.2.2.4 RECEPTACLE INSTALLATION SEALING AND FAIRING ............................ 769
F.3.4.6.2.2.5 STRUCTURAL LOADS .................................................................................. 770
F.3.4.6.2.2.6 RECEPTACLE INSTALLATION MAINTENANCE .......................................... 772
F.4.4.6.2.2.6 RECEPTACLE INSTALLATION MAINTENANCE .......................................... 773
F.3.4.6.2.2.7 RECEPTACLE MODES ................................................................................. 773
F.4.4.6.2.2.7 RECEPTACLE MODES ................................................................................. 774
F.3.4.6.2.2.7.1 DISCONNECT FUNCTION ............................................................................ 774
F.4.4.6.2.2.7.1 DISCONNECT FUNCTION ............................................................................ 775
F.3.4.6.2.2.7.2 RESET FUNCTION ........................................................................................ 776
F.4.4.6.2.2.7.2 RESET FUNCTION ........................................................................................ 777
F.3.4.6.2.2.7.3 MANUAL OVERRIDE STATUS...................................................................... 777
F.4.4.6.2.2.7.3 MANUAL OVERRIDE STATUS...................................................................... 778
F.3.4.6.2.2.8 THROUGH-THE-BOOM VOICE INTERCOMMUNICATION CAPABILITY .... 779
F.4.4.6.2.2.8 THROUGH-THE-BOOM VOICE INTERCOMMUNICATION CAPABILITY .... 780
F.3.4.6.2.2.9 TANKER PRESSURE REGULATION FAILURES ......................................... 781
F.4.4.6.2.2.9 TANKER PRESSURE REGULATION FAILURES ......................................... 782
F.3.4.6.2.2.10 REVERSE REFUELING ................................................................................. 782
F.4.4.6.2.2.10 REVERSE REFUELING ................................................................................. 783
F.3.4.6.2.2.11 RECEPTACLE NOISE LEVEL ....................................................................... 784
F.4.4.6.2.2.11 RECEPTACLE NOISE LEVEL ....................................................................... 784
F.3.4.6.2.3 PROBE RECEIVER AERIAL REFUELING .................................................... 785
F.4.4.6.2.3 PROBE RECEIVER AERIAL REFUELING .................................................... 785
F.3.4.6.2.3.1 TYPE OF PROBE INSTALLATION ................................................................ 785
F.4.4.6.2.3.1 TYPE OF PROBE INSTALLATION ................................................................ 786
F.3.4.6.2.3.1.1 TYPE OF PROBE NOZZLE ........................................................................... 786
F.4.4.6.2.3.1.1 TYPE OF PROBE NOZZLE ........................................................................... 787
F.3.4.6.2.3.1.2 PROBE ACTUATION PROVISIONS .............................................................. 788
F.4.4.6.2.3.1.2 PROBE ACTUATION PROVISIONS .............................................................. 788
F.3.4.6.2.3.1.3 PROBE ACTUATION AIRSPEED AND ALTITUDE ENVELOPE ................... 789
F.4.4.6.2.3.1.3 PROBE ACTUATION AIRSPEED AND ALTITUDE ENVELOPE ................... 790
F.3.4.6.2.3.1.4 PROBE ACTUATION TIMES ......................................................................... 791
F.4.4.6.2.3.1.4 PROBE ACTUATION TIMES ......................................................................... 791
F.3.4.6.2.3.2 PROBE LOCATION........................................................................................ 792
F.4.4.6.2.3.2 PROBE LOCATION........................................................................................ 793
F.3.4.6.2.3.2.1 PROBE ALIGNMENT ..................................................................................... 794
F.4.4.6.2.3.2.1 PROBE ALIGNMENT ..................................................................................... 794
F.3.4.6.2.3.2.2 PROBE CLEARANCE .................................................................................... 795
F.4.4.6.2.3.2.2 PROBE CLEARANCE .................................................................................... 796
F.3.4.6.2.3.3 PROBE COMPARTMENT FLUID ACCUMULATION ..................................... 796
F.4.4.6.2.3.3 PROBE COMPARTMENT FLUID ACCUMULATION ..................................... 797
F.3.4.6.2.3.4 PROBE ILLUMINATION ................................................................................. 797
F.4.4.6.2.3.4 PROBE ILLUMINATION ................................................................................. 798
52
JSSG-2009A

F.3.4.6.2.3.6 PROBE MAINTENANCE ................................................................................ 802
F.4.4.6.2.3.6 PROBE MAINTENANCE ................................................................................ 802
F.3.4.6.2.3.6.1 FIXED PROBE NOZZLE COVER .................................................................. 803
F.4.4.6.2.3.6.1 FIXED PROBE NOZZLE COVER .................................................................. 803
F.3.4.6.2.3.6.2 PROBE MAST PROTECTION ....................................................................... 804
F.4.4.6.2.3.6.2 PROBE MAST PROTECTION ....................................................................... 804
F.3.4.6.2.3.6.3 AIR VEHICLE PROBE ATTACHMENT POINT COVER ................................ 805
F.4.4.6.2.3.6.3 AIR VEHICLE PROBE ATTACHMENT POINT COVER ................................ 805
F.3.4.6.2.3.6.4 FUEL SPILLAGE ............................................................................................ 806
F.4.4.6.2.3.6.4 FUEL SPILLAGE ............................................................................................ 807
F.3.4.6.2.3.7 PROBE NOISE LEVEL................................................................................... 807
F.4.4.6.2.3.7 PROBE NOISE LEVEL................................................................................... 808
F.5 PACKAGING .................................................................................................. 809
F.6 NOTES ........................................................................................................... 809
F.6.1 INTENDED USE ............................................................................................. 809
F.6.2 ACQUISITION REQUIREMENTS .................................................................. 809
F.6.3 DEFINITIONS ................................................................................................. 809
F.6.4 ACRONYMS ................................................................................................... 810
F.6.5 SUBJECT TERM (KEY WORD) LISTING ...................................................... 810
F.6.6 INTERNATIONAL STANDARDIZATION AGREEMENT
IMPLEMENTATION........................................................................................ 811
F.6.7 RESPONSIBLE ENGINEERING OFFICE ...................................................... 811
F.6.8 CHANGES FROM PREVIOUS ISSUE ........................................................... 811
FIGURES
FIGURE F-1. BOOM NOZZLE MATING DIMENSIONS ....................................................... 753

FIGURE F-2. NOZZLE LATCHING AND VOICE COIL RECESSES ................................... 755
FIGURE F-3. BOOM NOZZLE ARTICULATION .................................................................. 757
FIGURE F-4. TANKER NOZZLE INDUCTION COIL TOLERANCES .................................. 758
FIGURE F-5. TANKER NOZZLE INDUCTION COIL POLE FACE POSITIONS .................. 759
CONTENTS APPENDIX G: FIRE AND EXPLOSION HAZARD PROTECTION
G.1 SCOPE ........................................................................................................... 812

G.2 APPLICABLE DOCUMENTS ......................................................................... 813
G.3 REQUIREMENTS........................................................................................... 817
G.4 VERIFICATIONS ............................................................................................ 817
G.3.4.7.1 HAZARD RESISTANCE ................................................................................. 824
G.4.4.7.1 HAZARD RESISTANCE ................................................................................. 825
G.3.4.7.2 FIRE AND EXPLOSION HAZARD PREVENTION ......................................... 826
G.4.4.7.2 FIRE AND EXPLOSION HAZARD PREVENTION ......................................... 827
G.3.4.7.3 ISOLATION AND SEPARATION OF COMBUSTIBLES
AND IGNITION SOURCES ............................................................................ 827
G.4.4.7.3 ISOLATION AND SEPARATION OF COMBUSTIBLES
AND IGNITION SOURCES ............................................................................ 832
G.3.4.7.4 COOLING AND VENTILATION ...................................................................... 832
53
JSSG-2009A
G.4.4.7.4 COOLING AND VENTILATION ...................................................................... 835

G.3.4.7.5 DRAINAGE ..................................................................................................... 836
G.4.4.7.5 DRAINAGE ..................................................................................................... 838
G.3.4.7.6 ELECTRICAL BONDING AND LIGHTNING PROTECTION .......................... 839
G.4.4.7.6 ELECTRICAL BONDING AND LIGHTNING PROTECTION .......................... 841
G.3.4.7.7 POST-CRASH FIRE PREVENTION .............................................................. 841
G.4.4.7.7 POST-CRASH FIRE PREVENTION .............................................................. 846
G.3.4.7.8 FIRE AND EXPLOSION HAZARD DETECTION ........................................... 847
G.4.4.7.8 FIRE AND EXPLOSION HAZARD DETECTION ........................................... 848
G.3.4.7.9 DETECTION SYSTEM PERFORMANCE ...................................................... 848
G.4.4.7.9 DETECTION SYSTEM PERFORMANCE ...................................................... 852
G.3.4.7.10 DETECTION SYSTEM FAILURES ................................................................ 852
G.4.4.7.10 DETECTION SYSTEM FAILURES ................................................................ 853
G.3.4.7.11 DETECTOR OUTPUT .................................................................................... 854
G.4.4.7.11 DETECTOR OUTPUT .................................................................................... 854
G.3.4.7.12 FALSE ALARM ............................................................................................... 855
G.4.4.7.12 FALSE ALARM ............................................................................................... 856
G.3.4.7.13 DETECTION SET POINT ............................................................................... 856
G.4.4.7.13 DETECTION SET POINT ............................................................................... 857
G.3.4.7.14 DETECTION INDICATION CLEARANCE ...................................................... 858
G.4.4.7.14 DETECTION INDICATION CLEARANCE ...................................................... 858
G.3.4.7.15 DETECTION REPEATABILITY ...................................................................... 859
G.4.4.7.15 DETECTION REPEATABILITY ...................................................................... 859
G.3.4.7.16 FIRE AND EXPLOSION HAZARD CONTROL LOCATION ........................... 860
G.4.4.7.16 FIRE AND EXPLOSION HAZARD CONTROL LOCATION ........................... 862
G.3.4.7.17 COMBUSTIBLE FLUID CONTROL ................................................................ 863
G.4.4.7.17 COMBUSTIBLE FLUID CONTROL ................................................................ 864
G.3.4.7.18 VENTILATION TERMINATION ...................................................................... 865
G.4.4.7.18 VENTILATION TERMINATION ...................................................................... 866
G.3.4.7.19 ELECTRICAL IGNITION SOURCE CONTROL ............................................. 866
G.4.4.7.19 ELECTRICAL IGNITION SOURCE CONTROL ............................................. 867
G.3.4.7.20 FIRE BARRIERS ............................................................................................ 867
G.4.4.7.20 FIRE BARRIERS ............................................................................................ 870
G.3.4.7.21 FIRE HARDENING ......................................................................................... 871
G.4.4.7.21 FIRE HARDENING ......................................................................................... 872
G.3.4.7.22 SMOKE AND OTHER HAZARDOUS VAPOR CONTROL ............................. 872
G.4.4.7.22 SMOKE AND OTHER HAZARDOUS VAPOR CONTROL ............................. 873
G.3.4.7.23 OVERHEAT CONTROL ................................................................................. 874
G.4.4.7.23 OVERHEAT CONTROL ................................................................................. 874
G.3.4.7.24 ENGINE AND AUXILIARY POWER UNIT COMPARTMENT FIRE
EXTINGUISHING ........................................................................................... 875
G.4.4.7.24 ENGINE AND AUXILIARY POWER UNIT COMPARTMENT FIRE
EXTINGUISHING ........................................................................................... 883
G.3.4.7.25 HABITABLE COMPARTMENT FIRE EXTINGUISHING ................................ 884
G.4.4.7.25 HABITABLE COMPARTMENT FIRE EXTINGUISHING ................................ 887
G.3.4.7.26 NON-HABITABLE COMPARTMENT FIRE EXTINGUISHING ....................... 887
G.4.4.7.26 NON-HABITABLE COMPARTMENT FIRE EXTINGUISHING ....................... 889
G.3.4.7.27 EXPLOSION SUPPRESSION ........................................................................ 890
G.4.4.7.27 EXPLOSION SUPPRESSION ........................................................................ 897
54
JSSG-2009A
G.3.4.7.28 DRY BAY AND VOID COMPARTMENT FIRE

AND EXPLOSION PROTECTION.................................................................. 897
G.4.4.7.28 DRY BAY AND VOID COMPARTMENT FIRE
AND EXPLOSION PROTECTION.................................................................. 898
G.3.4.7.29 CONTROL SYSTEMS ACTUATION DISPLAY
AND OPERATING DEVICES ......................................................................... 899
G.4.4.7.29 CONTROL SYSTEMS ACTUATION DISPLAY
AND OPERATING DEVICES ......................................................................... 901
G.3.4.7.30 CONTROL SYSTEMS INTEGRITY ASSURANCE PROVISIONS ................. 901
G.4.4.7.30 CONTROL SYSTEMS INTEGRITY ASSURANCE PROVISIONS ................. 902
G.3.4.7.31 GROUND FIRE FIGHTING ............................................................................ 903
G.4.4.7.31 GROUND FIRE FIGHTING ............................................................................ 903
G.5 PACKAGING .................................................................................................. 904
G.6 NOTES ........................................................................................................... 904
TABLES
TABLE G-I. MINIMUM CONDITIONS FOR IGNITION OF

ABRADED METAL PARTICLES .................................................................... 845
TABLE G-II. SPARKING CHARACTERISTICS OF
COMMON CONSTRUCTION METALS ......................................................... 845
TABLE G-III. PHYSICAL PROPERTIES OF SELECTED AGENTS .................................... 881
TABLE G-IV. TYPES OF AIR VEHICLE FIRE EXTINGUISHING SYSTEMS ...................... 882
CONTENTS APPENDIX H: ELECTRICAL POWER
H.1 SCOPE ........................................................................................................... 907

H.1.1 SCOPE ........................................................................................................... 907
H.1.2 STRUCTURE ................................................................................................. 907
H.1.3 APPENDIX ..................................................................................................... 907
H.1.4 DEVIATIONS .................................................................................................. 907
H.1.5 ENVIRONMENTAL IMPACT .......................................................................... 908
H.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 908
H.2 APPLICABLE DOCUMENTS ......................................................................... 908
H. 2.1 GENERAL ...................................................................................................... 908
H.2.2 GOVERNMENT DOCUMENTS...................................................................... 909
H.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 909
H.2.3 NON-GOVERNMENT PUBLICATIONS ......................................................... 910
H.2.4 ORDER OF PRECEDENCE........................................................................... 910
H.2.5 STREAMLINING............................................................................................. 910
H.3 REQUIREMENTS........................................................................................... 911
H.4 VERIFICATIONS ............................................................................................ 911
H.3.1 DEFINITION ................................................................................................... 911
H.4.1 DEFINITION ................................................................................................... 911
H.3.2 CHARACTERISTICS...................................................................................... 911
H.4.2 CHARACTERISTICS...................................................................................... 911
H.3.3 DESIGN AND CONSTRUCTION ................................................................... 911
55
JSSG-2009A
H.4.3 DESIGN AND CONSTRUCTION ................................................................... 911

H.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 911
H.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 911
H.3.4.1 LANDING SUBSYSTEM ................................................................................ 911
H.4.4.1 LANDING SUBSYSTEM ................................................................................ 911
H.3.4.2 HYDRAULIC SUBSYSTEM............................................................................ 911
H.4.4.2 HYDRAULIC SUBSYSTEM............................................................................ 911
H.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 911
H.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 911
H.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 911
H.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 911
H.3.4.5 FUEL SUBSYSTEM ....................................................................................... 911
H.4.4.5 FUEL SUBSYSTEM ....................................................................................... 911
H.3.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 911
H.4.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 911
H.3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................. 912
H.4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................. 912
H.3.4.8 ELECTRICAL POWER SUBSYSTEM............................................................ 912
H.4.4.8 ELECTRICAL POWER SUBSYSTEM............................................................ 914
H.3.4.8.1 ELECTRICAL POWER CHARACTERISTICS ................................................ 915
H.4.4.8.1 ELECTRICAL POWER CHARACTERISTICS ................................................ 917
H.3.4.8.2 CAPACITY...................................................................................................... 917
H.4.4.8.2 CAPACITY...................................................................................................... 919
H.3.4.8.3 EXTERNAL GROUND POWER COMPATIBILITY ......................................... 920
H.4.4.8.3 EXTERNAL GROUND POWER COMPATIBILITY ......................................... 921
H.3.4.8.4 POWER DISTRIBUTION................................................................................ 922
H.4.4.8.4 POWER DISTRIBUTION................................................................................ 923
H.3.4.8.5 CONTROL AND PROTECTION ..................................................................... 924
H.4.4.8.5 CONTROL AND PROTECTION ..................................................................... 926
H.5 PACKAGING .................................................................................................. 927
H.6 NOTES ........................................................................................................... 927
H.6.1 INTENDED USE ............................................................................................. 927
H.6.2 ACQUISITION REQUIREMENTS .................................................................. 927
H.6.3 COMPONENT INFORMATION ...................................................................... 927
H.6.3.1 WIRING .......................................................................................................... 927
H.6.3.2 BATTERIES.................................................................................................... 928
H.6.3.3 GENERATORS .............................................................................................. 932
H.6.3.4 CONVERTERS............................................................................................... 933
H.6.4 DEFINITIONS ................................................................................................. 933
H.6.5 ACRONYMS ................................................................................................... 933
H.6.6 SUBJECT TERM (KEY WORD) LISTING ...................................................... 933
H.6.7 INTERNATIONAL STANDARDIZATION AGREEMENT
IMPLEMENTATION........................................................................................ 934
H.6.8 RESPONSIBLE ENGINEERING OFFICE ...................................................... 934
H.6.9 CHANGES FROM PREVIOUS ISSUE ........................................................... 934
56
JSSG-2009A
CONTENTS APPENDIX I: MECHANICAL
I.1 SCOPE ........................................................................................................... 935

I.1.1 SCOPE ........................................................................................................... 935
I.1.2 STRUCTURE ................................................................................................. 935
I.1.3 APPENDIX ..................................................................................................... 935
I.1.4 DEVIATIONS .................................................................................................. 935
I.1.5 ENVIRONMENTAL IMPACT .......................................................................... 935
I.1.6 RESPONSIBLE ENGINEERING OFFICE ...................................................... 936
I.2 APPLICABLE DOCUMENTS ......................................................................... 936
I.2.1 GENERAL ...................................................................................................... 936
I.2.2 GOVERNMENT DOCUMENTS...................................................................... 936
I.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS ................................ 936
I.2.2.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS,
I.2.3 NON-GOVERNMENT PUBLICATIONS ......................................................... 937
I.2.4 ORDER OF PRECEDENCE........................................................................... 938
I.2.5 STREAMLINING............................................................................................. 938
I.3 REQUIREMENTS........................................................................................... 939
I.4 VERIFICATIONS ............................................................................................ 939
I.3.1 DEFINITION ................................................................................................... 939
I.4.1 DEFINITION ................................................................................................... 939
I.3.2 CHARACTERISTICS...................................................................................... 939
I.4.2 CHARACTERISTICS...................................................................................... 939
I.3.3 DESIGN AND CONSTRUCTION ................................................................... 939
I.4.3 DESIGN AND CONSTRUCTION ................................................................... 939
I.3.4 SUBSYSTEM CHARACTERISTICS .............................................................. 939
I.4.4 SUBSYSTEM CHARACTERISTICS .............................................................. 939
I.3.4.1 LANDING SUBSYSTEM ................................................................................ 939
I.4.4.1 LANDING SUBSYSTEM ................................................................................ 939
I.3.4.2 HYDRAULIC SUBSYSTEM............................................................................ 939
I.4.4.2 HYDRAULIC SUBSYSTEM............................................................................ 939
I.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 939
I.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................... 939
I.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 939
I.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................... 939
I.3.4.5 FUEL SUBSYSTEM ....................................................................................... 939
I.4.4.5 FUEL SUBSYSTEM ....................................................................................... 939
I.3.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 939
I.4.4.6 AERIAL REFUELING SUBSYSTEM .............................................................. 939
I.3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................. 940
I.4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ................. 940
I.3.4.8 ELECTRICAL POWER SUBSYSTEM............................................................ 940
I.4.4.8 ELECTRICAL POWER SUBSYSTEM............................................................ 940
I.3.4.9 MECHANICAL SUBSYSTEMS ...................................................................... 940
I.4.4.9 MECHANICAL SUBSYSTEMS ...................................................................... 940
57
JSSG-2009A
I.3.4.9.1 AIR VEHICLE DOORS, HATCHES, HINGED ACCESS PANELS,

AND RAMPS SUBSYSTEM ........................................................................... 941
I.4.4.9.1 AIR VEHICLE DOORS, HATCHES, HINGED ACCESS PANELS,
AND RAMPS SUBSYSTEM ........................................................................... 942
I.3.4.9.1.1 AIR VEHICLE DOOR MAINTENANCE .......................................................... 943
I.4.4.9.1.1 AIR VEHICLE DOOR MAINTENANCE .......................................................... 943
I.3.4.9.1.2 POWERED DOOR POSITION ....................................................................... 944
I.4.4.9.1.2 POWERED DOOR POSITION ....................................................................... 944
I.3.4.9.1.3 LATCHING ..................................................................................................... 945
I.4.4.9.1.3 LATCHING ..................................................................................................... 946
I.3.4.9.1.4 LOCKING ....................................................................................................... 946
I.4.4.9.1.4 LOCKING ....................................................................................................... 947
I.3.4.9.1.5 PRESSURIZATION ........................................................................................ 947
I.4.4.9.1.5 PRESSURIZATION ........................................................................................ 948
I.3.4.9.1.6 UNLOCKING UNDER PRESSURIZATION .................................................... 948
I.4.4.9.1.6 UNLOCKING UNDER PRESSURIZATION .................................................... 949
I.3.4.9.1.7 PRESSURIZATION PREVENTION DEVICE FAILURES ............................... 949
I.4.4.9.1.7 PRESSURIZATION PREVENTION DEVICE FAILURES ............................... 950
I.3.4.9.1.8 DOOR STATUS MONITORING ..................................................................... 950
I.4.4.9.1.8 DOOR STATUS MONITORING ..................................................................... 951
I.3.4.9.1.9 DOOR CONTROL .......................................................................................... 952
I.4.4.9.1.9 DOOR CONTROL .......................................................................................... 953
I.3.4.9.1.10 SEALING ........................................................................................................ 953
I.4.4.9.1.10 SEALING ........................................................................................................ 954
I.3.4.9.1.11 RAMP LOAD CYCLE TIME ............................................................................ 954
I.4.4.9.1.11 RAMP LOAD CYCLE TIME ............................................................................ 954
I.3.4.9.1.12 EXTENDING AND HOLDING THE CARGO RAMP ....................................... 955
I.4.4.9.1.12 EXTENDING AND HOLDING THE CARGO RAMP ....................................... 955
I.3.4.9.1.13 WEAPONS BAY DOOR ................................................................................. 956
I.4.4.9.1.13 WEAPONS BAY DOOR ................................................................................. 956
I.3.4.9.1.14 WEAPONS BAY DOOR PERFORMANCE .................................................... 957
I.4.4.9.1.14 WEAPONS BAY DOOR PERFORMANCE .................................................... 957
I.3.4.9.2 AIRFRAME BEARINGS ................................................................................. 958
I.4.4.9.2 AIRFRAME BEARINGS ................................................................................. 959
I.3.4.9.2.1 CAPACITY...................................................................................................... 960
I.4.4.9.2.1 CAPACITY...................................................................................................... 960
I.3.4.9.2.2 INSTALLATION AND RETENTION................................................................ 961
I.4.4.9.2.2 INSTALLATION AND RETENTION................................................................ 961
I.3.4.9.2.3 ANTIFRICTION BEARINGS ........................................................................... 962
I.4.4.9.2.3 ANTIFRICTION BEARINGS ........................................................................... 963
I.3.4.9.2.4 PLAIN BEARINGS.......................................................................................... 963
I.4.4.9.2.4 PLAIN BEARINGS.......................................................................................... 965
I.3.4.9.3 FASTENER SUBSYSTEM ............................................................................. 965
I.4.4.9.3 FASTENER SUBSYSTEM ............................................................................. 966
I.3.4.9.3.1 FASTENED JOINT ALLOWABLES ................................................................ 967
I.4.4.9.3.1 FASTENED JOINT ALLOWABLES ................................................................ 967
I.3.4.9.3.2 FASTENER THREADS .................................................................................. 968
I.4.4.9.3.2 FASTENER THREADS .................................................................................. 968
I.3.4.9.3.3 FASTENER USAGE LIMITATIONS ............................................................... 969
58
JSSG-2009A
I.4.4.9.3.3 FASTENER USAGE LIMITATIONS ............................................................... 970

I.3.4.9.3.4 EXTERNALLY THREADED FASTENER USAGE LIMITATIONS .................. 971
I.4.4.9.3.4 EXTERNALLY THREADED FASTENER USAGE LIMITATIONS .................. 973
I.3.4.9.3.5 NUT USAGE LIMITATIONS ........................................................................... 973
I.4.4.9.3.5 NUT USAGE LIMITATIONS ........................................................................... 974
I.3.4.9.3.6 BLIND FASTENER USAGE LIMITATIONS .................................................... 975
I.4.4.9.3.6 BLIND FASTENER USAGE LIMITATIONS .................................................... 976
I.3.4.9.3.7 FASTENER SIZING ....................................................................................... 976
I.4.4.9.3.7 FASTENER SIZING ....................................................................................... 977
I.3.4.9.3.8 HEAD ANGLE ................................................................................................ 978
I.4.4.9.3.8 HEAD ANGLE ................................................................................................ 979
I.3.4.9.3.9 FASTENERS USED IN SINGLE POINT LINKAGES ..................................... 979
I.4.4.9.3.9 FASTENERS USED IN SINGLE POINT LINKAGES ..................................... 980
I.3.4.9.3.10 FASTENER DRIVE AND WRENCHING ELEMENT CONFIGURATION ....... 981
I.4.4.9.3.10 FASTENER DRIVE AND WRENCHING ELEMENT CONFIGURATION ....... 982
I.3.4.9.3.11 FASTENERS USED IN DOORS AND ACCESS PANELS ............................. 982
I.4.4.9.3.11 FASTENERS USED IN DOORS AND ACCESS PANELS ............................. 983
I.3.4.9.4 UTILITY ACTUATION SUBSYSTEM ............................................................. 983
I.4.4.9.4 UTILITY ACTUATION SUBSYSTEM ............................................................. 985
I.3.4.9.4.1 GROUND WIND ENVIRONMENT ................................................................. 987
I.4.4.9.4.1 GROUND WIND ENVIRONMENT ................................................................. 988
I.3.4.9.4.2 POSITIVE LOCKING FEATURES.................................................................. 989
I.4.4.9.4.2 POSITIVE LOCKING FEATURES.................................................................. 990
I.3.4.9.4.3 COCKPIT POSITIVE ENGAGEMENT INDICATION ...................................... 991
I.4.4.9.4.3 COCKPIT POSITIVE ENGAGEMENT INDICATION ...................................... 991
I.3.4.9.4.4 ACTUATION CONTROL ................................................................................ 992
I.4.4.9.4.4 ACTUATION CONTROL ................................................................................ 993
I.3.4.9.4.5 MAINTAINER SAFETY .................................................................................. 993
I.4.4.9.4.5 MAINTAINER SAFETY .................................................................................. 994
I.3.4.9.4.6 GROUND POWER OPERABILITY ................................................................ 994
I.4.4.9.4.6 GROUND POWER OPERABILITY ................................................................ 995
I.3.4.9.4.7 ACTUATION TIME ......................................................................................... 995
I.4.4.9.4.7 ACTUATION TIME ......................................................................................... 996
I.3.4.9.4.8 SURFACE INTERFERENCE PREVENTION ................................................. 996
I.4.4.9.4.8 SURFACE INTERFERENCE PREVENTION ................................................. 997
I.3.4.9.4.9 REPLACEABLE ATTACHMENTS.................................................................. 997
I.4.4.9.4.9 REPLACEABLE ATTACHMENTS.................................................................. 998
I.3.4.9.4.10 FOLDED AND STOWED POSITION CLEARANCE ...................................... 998
I.4.4.9.4.10 FOLDED AND STOWED POSITION CLEARANCE ...................................... 999
I.3.4.9.4.11 MANUAL DEPLOYMENT AND DRIVE INPUT .............................................. 999
I.4.4.9.4.11 MANUAL DEPLOYMENT AND DRIVE INPUT ............................................ 1000
I.3.4.9.4.12 EXTERNAL SECURING............................................................................... 1000
I.4.4.9.4.12 EXTERNAL SECURING............................................................................... 1001
I.3.4.9.4.13 VISUAL POSITIVE ENGAGEMENT IDENTIFICATION ............................... 1002
I.4.4.9.4.13 VISUAL POSITIVE ENGAGEMENT IDENTIFICATION ............................... 1002
I.5 PACKAGING ................................................................................................ 1003
I.6 NOTES ......................................................................................................... 1003
I.6.1 INTENDED USE ........................................................................................... 1003
I.6.2 ACQUISITION REQUIREMENTS ................................................................ 1003
59
JSSG-2009A
I.6.3 ACRONYMS ................................................................................................. 1003

I.6.4 SUBJECT TERM (KEY WORD) LISTING .................................................... 1003
I.6.5 RESPONSIBLE ENGINEERING OFFICE .................................................... 1004
I.6.6 CHANGES FROM PREVIOUS ISSUE ......................................................... 1004
CONTENTS APPENDIX J: CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS
J.1 SCOPE ......................................................................................................... 1005

J.1.1 SCOPE ......................................................................................................... 1005
J.1.2 STRUCTURE ............................................................................................... 1005
J.1.3 APPENDIX ................................................................................................... 1005
J.1.4 DEVIATIONS ................................................................................................ 1005
J.1.5 ENVIRONMENTAL IMPACT ........................................................................ 1006
J.1.6 RESPONSIBLE ENGINEERING OFFICE .................................................... 1006
J.2 APPLICABLE DOCUMENTS ....................................................................... 1006
J.2.1 GENERAL .................................................................................................... 1006
J.2.2 GOVERNMENT DOCUMENTS.................................................................... 1007
J.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS .............................. 1007
J.2.2.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS,
AND PUBLICATIONS................................................................................... 1007
J.2.3 NON-GOVERNMENT PUBLICATIONS ....................................................... 1008
J.2.4 ORDER OF PRECEDENCE......................................................................... 1008
J.2.5 STREAMLINING........................................................................................... 1008
J.3 REQUIREMENTS......................................................................................... 1009
J.4 VERIFICATIONS .......................................................................................... 1009
J.3.1 DEFINITION ................................................................................................. 1009
J.4.1 DEFINITION ................................................................................................. 1009
J.3.2 CHARACTERISTICS.................................................................................... 1009
J.4.2 CHARACTERISTICS.................................................................................... 1009
J.3.3 DESIGN AND CONSTRUCTION ................................................................. 1009
J.4.3 DESIGN AND CONSTRUCTION ................................................................. 1009
J.3.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1009
J.4.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1009
J.3.4.1 LANDING SUBSYSTEM .............................................................................. 1009
J.4.4.1 LANDING SUBSYSTEM .............................................................................. 1009
J.3.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1009
J.4.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1009
J.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1009
J.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1009
J.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1009
J.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1009
J.3.4.5 FUEL SUBSYSTEM ..................................................................................... 1009
J.4.4.5 FUEL SUBSYSTEM ..................................................................................... 1009
J.3.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1009
J.4.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1009
J.3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1010
J.4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1010
J.3.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1010
60
JSSG-2009A
J.4.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1010

J.3.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1010
J.4.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1010
J.3.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1010
J.4.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1011
J.3.4.10.1 GENERAL CARGO REQUIREMENTS ........................................................ 1012
J.4.4.10.1 GENERAL CARGO REQUIREMENTS ........................................................ 1012
J.3.4.10.1.1 CARGO RESTRAINTS................................................................................. 1012
J.4.4.10.1.1 CARGO RESTRAINTS................................................................................. 1017
J.3.4.10.1.2 EASE OF LOADING AND UNLOADING ...................................................... 1018
J.4.4.10.1.2 EASE OF LOADING AND UNLOADING ...................................................... 1019
J.3.4.10.1.3 EXTERNAL CARGO CAPABILITY............................................................... 1019
J.4.4.10.1.3 EXTERNAL CARGO CAPABILITY............................................................... 1020
J.3.4.10.2 AERIAL DELIVERY ...................................................................................... 1022
J.4.4.10.2 AERIAL DELIVERY ...................................................................................... 1022
J.3.4.10.2.1 STATIC LINE CAPABILITY .......................................................................... 1022
J.4.4.10.2.1 STATIC LINE CAPABILITY .......................................................................... 1023
J.3.4.10.2.2 STATIC LINE RETRIEVAL ........................................................................... 1024
J.4.4.10.2.2 STATIC LINE RETRIEVAL ........................................................................... 1025
J.3.4.10.2.3 AERIAL DELIVERY GO – NO GO INDICATION .......................................... 1025
J.4.4.10.2.3 AERIAL DELIVERY GO – NO GO INDICATION .......................................... 1026
J.3.4.10.2.4 BUNDLE RELEASE ..................................................................................... 1027
J.4.4.10.2.4 BUNDLE RELEASE ..................................................................................... 1028
J.3.4.10.3 SPECIAL OPERATIONS .............................................................................. 1028
J.4.4.10.3 SPECIAL OPERATIONS .............................................................................. 1028
J.3.4.10.3.1 SEARCH AND RESCUE OPERATIONS ..................................................... 1028
J.4.4.10.3.1 SEARCH AND RESCUE OPERATIONS ..................................................... 1029
J.3.4.10.3.2 ROPE SUSPENSION OPERATIONS COMPATIBILITY .............................. 1030
J.4.4.10.3.2 ROPE SUSPENSION OPERATIONS COMPATIBILITY .............................. 1031
J.5 PACKAGING ................................................................................................ 1033
J.6 NOTES ......................................................................................................... 1033
J.6.1 INTENDED USE ........................................................................................... 1033
J.6.2 ACQUISITION REQUIREMENTS ................................................................ 1033
J.6.3 COMPONENT INFORMATION .................................................................... 1033
J.6.3.1 GUIDE RAILS AND ROLLERS .................................................................... 1033
J.6.3.2 CARGO WINCH ........................................................................................... 1034
J.6.3.3 TREADWAY FLOOR .................................................................................... 1034
J.6.3.4 CARGO RAMP EXTENSIONS (RAMP TOES). ........................................... 1035
J.6.3.5 STABILIZER STRUTS.................................................................................. 1035
J.6.3.6 PASSENGER SEATS. ................................................................................. 1035
J.6.4 DEFINITIONS. .............................................................................................. 1036
J.6.5 ACRONYMS. ................................................................................................ 1037
J.6.6 SUBJECT TERM (KEY WORD) LISTING .................................................... 1037
J.6.7 RESPONSIBLE ENGINEERING OFFICE .................................................... 1037
J.6.8 CHANGES FROM PREVIOUS ISSUE ......................................................... 1037
61
JSSG-2009A
TABLES
TABLE J-I. CARGO RING LOAD CAPACITIES ............................................................. 1012

TABLE J-II. TIEDOWN FITTINGS DIMENSIONS ........................................................... 1013
TABLE J-III. U.S. AIR FORCE FIXED-WING RESTRAINT CRITERIA ............................ 1016
TABLE J-IV. CARGO RESTRAINT CRITERIA FOR
U.S. NAVY/MARINE CORPS FIXED-WING AIRCRAFT ............................. 1016
CONTENTS APPENDIX K: VERTICAL TAKEOFF AND LANDING (VTOL) —

SHORT TAKEOFF AND LANDING (STOL) POWER DRIVE
K.1 SCOPE ......................................................................................................... 1038

K.1.1 SCOPE ......................................................................................................... 1038
K.1.2 STRUCTURE ............................................................................................... 1038
K.1.3 APPENDIX ................................................................................................... 1038
K.1.4 DEVIATIONS ................................................................................................ 1038
K.1.5 ENVIRONMENTAL IMPACT ........................................................................ 1039
K.1.6 RESPONSIBLE ENGINEERING OFFICE .................................................... 1039
K.2 APPLICABLE DOCUMENTS ....................................................................... 1039
K.2.1 GENERAL .................................................................................................... 1039
K.2.2 GOVERNMENT DOCUMENTS.................................................................... 1039
K.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS .............................. 1039
K.2.3 NON-GOVERNMENT PUBLICATIONS ....................................................... 1040
K.2.4 ORDER OF PRECEDENCE......................................................................... 1041
K.2.5 STREAMLINING........................................................................................... 1041
K.3 REQUIREMENTS......................................................................................... 1042
K.4 VERIFICATIONS .......................................................................................... 1042
K.3.1 DEFINITION ................................................................................................. 1042
K.4.1 DEFINITION ................................................................................................. 1042
K.3.2 CHARACTERISTICS.................................................................................... 1042
K.4.2 CHARACTERISTICS.................................................................................... 1042
K.3.3 DESIGN AND CONSTRUCTION ................................................................. 1042
K.4.3 DESIGN AND CONSTRUCTION ................................................................. 1042
K.3.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1042
K.4.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1042
K.3.4.1 LANDING SUBSYSTEM .............................................................................. 1042
K.4.4.1 LANDING SUBSYSTEM .............................................................................. 1042
K.3.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1042
K.4.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1042
K.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1042
K.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1042
K.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1042
K.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1042
K.3.4.5 FUEL SUBSYSTEM ..................................................................................... 1042
K.4.4.5 FUEL SUBSYSTEM ..................................................................................... 1042
K.3.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1042
K.4.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1042
K.3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1043
62
JSSG-2009A
K.4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1043

K.3.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1043
K.4.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1043
K.3.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1043
K.4.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1043
K.3.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1043
K.4.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1043
K.3.4.11 VTOL-STOL POWER DRIVE SUBSYSTEMS ............................................. 1043
K.4.4.11 VTOL-STOL POWER DRIVE SUBSYSTEMS ............................................. 1044
K.3.4.11.1 VIBRATION AND DYNAMICS...................................................................... 1049
K.4.4.11.1 VIBRATION AND DYNAMICS...................................................................... 1050
K.3.4.11.2 MISALIGNMENT .......................................................................................... 1051
K.4.4.11.2 MISALIGNMENT .......................................................................................... 1052
K.3.4.11.2.1 DRIVE SHAFT SUPPORTS ......................................................................... 1053
K.4.4.11.2.1 DRIVE SHAFT SUPPORTS ......................................................................... 1053
K.3.4.11.3 ROTOR BRAKING, POSITIONING, AND HOLDING ................................... 1054
K.4.4.11.3 ROTOR BRAKING, POSITIONING, AND HOLDING ................................... 1056
K.3.4.11.4 LUBRICATION ............................................................................................. 1059
K.4.4.11.4 LUBRICATION ............................................................................................. 1062
K.3.4.11.5 POWER TRAIN CONDITION MONITORING .............................................. 1064
K.4.4.11.5 POWER TRAIN CONDITION MONITORING ............................................... 1065
K.3.4.11.6 DURABILITY ................................................................................................ 1066
K.4.4.11.6 DURABILITY ................................................................................................ 1067
K.3.4.11.7 ENGAGEMENT AND DISENGAGEMENT OF LOAD ABSORBERS ........... 1069
K.4.4.11.7 ENGAGEMENT AND DISENGAGEMENT OF LOAD ABSORBERS ........... 1069
K.3.4.11.8 LOSS-OF-LUBRICANT OPERATION (LOSS OF LUBRICATION) .............. 1071
K.4.4.11.8 LOSS-OF-LUBRICANT OPERATION (LOSS OF LUBRICATION) .............. 1071
K.3.4.11.9 ROTOR MESHING ....................................................................................... 1072
K.4.4.11.9 ROTOR MESHING ....................................................................................... 1073
K.3.4.11.10 ACCESSORY DRIVES................................................................................. 1073
K.4.4.11.10 ACCESSORY DRIVES................................................................................. 1074
K.5 PACKAGING ................................................................................................ 1075
K.6 NOTES ......................................................................................................... 1075
K.6.1 INTENDED USE ........................................................................................... 1075
K.6.2 ACQUISITION REQUIREMENTS ................................................................ 1075
K.6.3 ACRONYMS ................................................................................................. 1075
K.6.4 SUBJECT TERM (KEY WORD) LISTING .................................................... 1076
K.6.5 RESPONSIBLE ENGINEERING OFFICE .................................................... 1076
K.6.6 CHANGES FROM PREVIOUS ISSUE ......................................................... 1076
TABLES
TABLE K-I. TEST STAND LOADING SPECTRUM DISTRIBUTION .............................. 1046

TABLE K-II. SURFACE DURABILITY .............................................................................. 1067
63
JSSG-2009A
CONTENTS APPENDIX L: PROPELLER
L.1 SCOPE ......................................................................................................... 1077

L.1.1 SCOPE ......................................................................................................... 1077
L.1.2 STRUCTURE ............................................................................................... 1077
L.1.3 APPENDIX ................................................................................................... 1077
L.1.4 DEVIATIONS ................................................................................................ 1077
L.1.5 ENVIRONMENTAL IMPACT ........................................................................ 1078
L.1.6 RESPONSIBLE ENGINEERING OFFICE .................................................... 1078
L.2 APPLICABLE DOCUMENTS ....................................................................... 1078
L.2.1 GENERAL .................................................................................................... 1078
L.2.2 GOVERNMENT DOCUMENTS.................................................................... 1078
L.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS .............................. 1078
L.2.3 ORDER OF PRECEDENCE......................................................................... 1079
L.2.4 STREAMLINING........................................................................................... 1079
L.3 REQUIREMENTS......................................................................................... 1080
L.4 VERIFICATIONS .......................................................................................... 1080
L.3.1 DEFINITION ................................................................................................. 1080
L.4.1 DEFINITION ................................................................................................. 1080
L.3.2 CHARACTERISTICS.................................................................................... 1080
L.4.2 CHARACTERISTICS.................................................................................... 1080
L.3.3 DESIGN AND CONSTRUCTION ................................................................. 1080
L.4.3 DESIGN AND CONSTRUCTION ................................................................. 1080
L.3.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1080
L.4.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1080
L.3.4.1 LANDING SUBSYSTEM .............................................................................. 1080
L.4.4.1 LANDING SUBSYSTEM .............................................................................. 1080
L.3.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1080
L.4.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1080
L.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1080
L.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1080
L.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1080
L.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1080
L.3.4.5 FUEL SUBSYSTEM ..................................................................................... 1080
L.4.4.5 FUEL SUBSYSTEM ..................................................................................... 1080
L.3.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1080
L.4.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1080
L.3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1081
L.4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1081
L.3.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1081
L.4.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1081
L.3.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1081
L.4.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1081
L.3.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1081
L.4.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1081
L.3.4.11 VTOL-STOL POWER DRIVE SUBSYSTEM ................................................ 1081
L.4.4.11 VTOL-STOL POWER DRIVE SUBSYSTEM ................................................ 1081
L.3.4.12 PROPELLER SUBSYSTEM ......................................................................... 1081
L.4.4.12 PROPELLER SUBSYSTEM ......................................................................... 1084
64
JSSG-2009A
L.3.4.12.1 CONTROL SIGNALS ................................................................................... 1097

L.4.4.12.1 CONTROL SIGNALS ................................................................................... 1098
L.3.4.12.2 PROPULSION INTERFACE......................................................................... 1099
L.4.4.12.2 PROPULSION INTERFACE......................................................................... 1100
L.3.4.12.3 GROUND HANDLING .................................................................................. 1101
L.4.4.12.3 GROUND HANDLING .................................................................................. 1101
L.3.4.12.4 PERFORMANCE CHARACTERISTICS....................................................... 1102
L.4.4.12.4 PERFORMANCE CHARACTERISTICS....................................................... 1103
L.3.4.12.5 CONTROL OF PROPELLER ....................................................................... 1103
L.4.4.12.5 CONTROL OF PROPELLER ....................................................................... 1105
L.3.4.12.6 VIBRATION AND BALANCE ........................................................................ 1106
L.4.4.12.6 VIBRATION AND BALANCE ........................................................................ 1108
L.5 PACKAGING ................................................................................................ 1110
L.6 NOTES ......................................................................................................... 1110
L.6.1 INTENDED USE ........................................................................................... 1110
L.6.2 ACQUISITION REQUIREMENTS ................................................................ 1110
L.6.3 COMPONENT INFORMATION .................................................................... 1110
L.6.3.1 PROPELLER ANTI-ICING SYSTEM ............................................................ 1110
L.6.3.2 PITCH-CHANGING SYSTEM ...................................................................... 1113
L.6.3.3 LUBRICATION SYSTEM.............................................................................. 1113
L.6.3.4 HYDRAULIC SYSTEM ................................................................................. 1114
L.6.3.5 PROPELLER ROTATING ASSEMBLY ........................................................ 1114
L.6.4 DEFINITIONS ............................................................................................... 1115
L.6.5 ACRONYMS ................................................................................................. 1115
L.6.6 SUBJECT TERM (KEY WORD) LISTING .................................................... 1116
L.6.7 RESPONSIBLE ENGINEERING OFFICE .................................................... 1116
L.6.8 CHANGES FROM PREVIOUS ISSUE ......................................................... 1116
TABLES
TABLE L-I. PROPULSION SYSTEM LOAD FACTORS ................................................. 1083

TABLE L-II. TRANSIENT SCHEDULE............................................................................. 1089
TABLE L-III. CYCLIC TESTS ............................................................................................ 1091
65
JSSG-2009A
CONTENTS APPENDIX M: PNEUMATIC
M.1 SCOPE ......................................................................................................... 1117

M.1.1 SCOPE ......................................................................................................... 1117
M.1.2 STRUCTURE ............................................................................................... 1117
M.1.3 APPENDIX ................................................................................................... 1117
M.1.4 DEVIATIONS ................................................................................................ 1117
M.1.5 ENVIRONMENTAL IMPACT ........................................................................ 1118
M.1.6 RESPONSIBLE ENGINEERING OFFICE .................................................... 1118
M.2 APPLICABLE DOCUMENTS ....................................................................... 1118
M.2.1 GENERAL .................................................................................................... 1118
M.2.2 GOVERNMENT DOCUMENTS.................................................................... 1118
M.2.2.1 SPECIFICATIONS, STANDARDS, AND HANDBOOKS .............................. 1118
M.2.2.2 OTHER GOVERNMENT DOCUMENTS, DRAWINGS,
AND PUBLICATIONS................................................................................... 1119
M.2.3 NON-GOVERNMENT PUBLICATIONS ....................................................... 1119
M.2.4 ORDER OF PRECEDENCE......................................................................... 1120
M.2.5 STREAMLINING........................................................................................... 1120
M.3 REQUIREMENTS......................................................................................... 1121
M.4 VERIFICATIONS .......................................................................................... 1121
M.3.1 DEFINITION ................................................................................................. 1121
M.4.1 DEFINITION ................................................................................................. 1121
M.3.2 CHARACTERISTICS.................................................................................... 1121
M.4.2 CHARACTERISTICS.................................................................................... 1121
M.3.3 DESIGN AND CONSTRUCTION ................................................................. 1121
M.4.3 DESIGN AND CONSTRUCTION ................................................................. 1121
M.3.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1121
M.4.4 SUBSYSTEM CHARACTERISTICS ............................................................ 1121
M.3.4.1 LANDING SUBSYSTEM .............................................................................. 1121
M.4.4.1 LANDING SUBSYSTEM .............................................................................. 1121
M.3.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1121
M.4.4.2 HYDRAULIC SUBSYSTEM.......................................................................... 1121
M.3.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1121
M.4.4.3 AUXILIARY POWER SUBSYSTEM ............................................................. 1121
M.3.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1121
M.4.4.4 ENVIRONMENTAL CONTROL SUBSYSTEM ............................................. 1121
M.3.4.5 FUEL SUBSYSTEM ..................................................................................... 1121
M.4.4.5 FUEL SUBSYSTEM ..................................................................................... 1121
M.3.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1121
M.4.4.6 AERIAL REFUELING SUBSYSTEM ............................................................ 1121
M.3.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1122
M.4.4.7 FIRE AND EXPLOSION HAZARD PROTECTION SUBSYSTEM ............... 1122
M.3.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1122
M.4.4.8 ELECTRICAL POWER SUBSYSTEM.......................................................... 1122
M.3.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1122
M.4.4.9 MECHANICAL SUBSYSTEMS .................................................................... 1122
M.3.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1122
M.4.4.10 CARGO, AERIAL DELIVERY, AND SPECIAL OPERATIONS .................... 1122
M.3.4.11 VTOL-STOL POWER DRIVE SUBSYSTEM ................................................ 1122
66
JSSG-2009A
M.4.4.11 VTOL-STOL POWER DRIVE SUBSYSTEM ................................................ 1122

M.3.4.12 PROPELLER SUBSYSTEM ......................................................................... 1122
M.4.4.12 PROPELLER SUBSYSTEM ......................................................................... 1122
M.3.4.13 PNEUMATIC SUBSYSTEM ......................................................................... 1122
M.4.4.13 PNEUMATIC SUBSYSTEM ......................................................................... 1123
M.3.4.13.1 GAS .............................................................................................................. 1124
M.4.4.13.1 GAS .............................................................................................................. 1125
M.3.4.13.2 PRESSURE .................................................................................................. 1125
M.4.4.13.2 PRESSURE .................................................................................................. 1126
M.3.4.13.3 STATUS INDICATION.................................................................................. 1126
M.4.4.13.3 STATUS INDICATION.................................................................................. 1127
M.3.4.13.4 MOISTURE CONTENT ................................................................................ 1127
M.4.4.13.4 MOISTURE CONTENT ................................................................................ 1128
M.5 PACKAGING ................................................................................................ 1129
M.6 NOTES ......................................................................................................... 1129
M.6.1 INTENDED USE ........................................................................................... 1129
M.6.2 ACQUISITION REQUIREMENTS ................................................................ 1129
M.6.3 COMPONENT INFORMATION .................................................................... 1129
M.6.3.1 CLEARANCE................................................................................................ 1129
M.6.3.2 ACTUATORS ............................................................................................... 1130
M.6.3.3 MULTIPLE CONTROL VALVES .................................................................. 1130
M.6.3.4 FITTINGS ..................................................................................................... 1130
M.6.3.5 SEALS .......................................................................................................... 1131
M.6.3.6 TUBING ........................................................................................................ 1132
M.6.3.7 RELATIVE MOTION ..................................................................................... 1132
M.6.3.8 AIR COMPRESSORS .................................................................................. 1133
M.6.3.9 AIR BOTTLES .............................................................................................. 1134
M.6.3.10 ELECTRIC MOTORS ................................................................................... 1135
M.6.3.11 SNUBBING ................................................................................................... 1135
M.6.3.12 CHEMICAL DRYERS ................................................................................... 1135
M.6.3.13 FILTERS ....................................................................................................... 1136
M.6.4 ACRONYMS ................................................................................................. 1136
M.6.5 SUBJECT TERM (KEY WORD) LISTING .................................................... 1136
M.6.6 RESPONSIBLE ENGINEERING OFFICE .................................................... 1136
M.6.7 CHANGES FROM PREVIOUS ISSUE ......................................................... 1137
67
JSSG-2009A
HANDBOOK FOR AIR VEHICLE SUBSYSTEMS
JOINT SERVICES SPECIFICATION GUIDE
1. SCOPE
1.1 Scope.
This handbook provides tailoring guidance and background information for individual
paragraphs of the Air Vehicle Subsystems Specification (AVSS). The handbook has been
developed and coordinated by technical personnel from the Air Force, Navy, and Army and has
been approved as an official guide for use by Government personnel for assistance in tailoring
the AVSS for acquisition and model specifications. This handbook is a mandatory part of the
specification guide. The information contained herein is intended for guidance only.
1.2 Structure.
The handbook structure replicates the structure of the Air Vehicle Subsystems Specification
except it places each corresponding section 3 requirement and section 4 verification together.
1.3 Handbook.
This handbook provides tailoring guidance and background information for individual
paragraphs of the Air Vehicle Subsystems Specification Guide. Guidance gives
recommendations on how to tailor the specification paragraph. Where (TBS) appears, the
guidance paragraph provides recommended values or text that the Using Service may use to
insert in the (TBS) . When contractors are expected to fill-in the (TBS) , the Guidance
paragraph will so state. The Using Service makes the final decision on whom fills in the (TBS)
in the specification. Finally, Lessons Learned are provided to give insight to past events which
could impact the tailoring of the specification.
1.4 Deviations.
Deviations from this specification which will result in improvement of the system performance,
reduced life cycle cost, reduced developmental cost, or where requirements of the specification
results in compromise in operational capability, should be brought to the attention of the Using
Service.
1.5 Environmental impact.
68
JSSG-2009A
should be consulted. The Significant New Alternatives Policy (SNAP) Program available thereon
identifies substitutes for ozone depleting chemicals.
The responsible engineering office (REO) for this Handbook is AFLCMC/EZFA, WRIGHT-
PATTERSON AFB, OH 45433-7017 USA; DSN 785-2023, COMMERCIAL (937) 255-2023;
2. APPLICABLE DOCUMENTS
2.1 General.
The documents listed in this section are specified in sections 3 and 4 of this handbook. This
section does not include documents cited in other sections of this guide specification or
recommended for additional information or as examples. While every effort has been made to
ensure the completeness of this list, document users are cautioned that they must meet all
specified requirements of documents cited in sections 3 and 4 of this handbook, whether or not
they are listed.
2.2 Government documents

2.2.1 Specifications, standards, and handbooks.
The following specifications, standards, and handbooks form a part of this handbook to the

JSSG-2000 Air System Joint Services Specification Guide
JSSG-2001 Air Vehicle Joint Services Specification Guide
DEPARTMENT OF DEFENSE STANDARDS
MIL-STD-130 Identification Marking of U.S. Military Property
MIL-STD-882 System Safety Program Requirements
69
JSSG-2009A
MIL-STD-1472 Human Engineering Design Criteria for Military Systems,

Equipment & Facilities
MIL-STD-1798 Mechanical Equipment and Subsystems Integrity Program
DEPARTMENT OF DEFENSE HANDBOOKS
MIL-HDBK-189 Reliability Growth Management
MIL-HDBK-310 Global Climatic Data for Developing Military Products
MIL-HDBK-454 Electronic Equipment, General Guidelines for
Standardization Document Order Desk, 700 Robbins Avenue, Building 4D, Philadelphia PA
19111-5094.)
2.2.2 Other Government documents, drawings, and publications.

The following other Government documents, drawings, and publications form a part of this
document to the extent specified herein. Unless otherwise specified, the issues of these
documents are those cited in the solicitation or contract.
USAF TECHNICAL REPORT
AFCRL-TR-74-0603 World-Wide Extremes of Humidity with Temperatures between 85
and 120 Degrees F, Accession Number ADA007676
(Copies of this document are available from www.dtic.mil; the Defense Technical Information
Center, 8725 John J. Kingman Road, Fort Belvoir VA 22060-6218; Phone: (703) 767-8274;
DSN 427-8274.)
2.3 Non-Government publications.

The following documents form a part of this document to the extent specified herein. Unless
otherwise specified, the issues of these documents are those cited in the solicitation or contract.
SAE INTERNATIONAL
SAE AIR 1826 Acoustical Consideration for Aircraft Environmental Control
System Design
SAE AS 5202 Port or Fitting End, Internal Straight Thread
(Copies of these documents are available from www.sae.org; SAE International,
400 Commonwealth Drive, Warrendale PA 15096-0001 USA; and www.ihs.com to qualified
users.)
70
JSSG-2009A
2.4 Order of precedence.

2.5 Streamlining.
The Air Vehicle Subsystems Specification has been streamlined. The documents listed in this
handbook which are required for acquisition have the same status as those referenced directly
in section 2 (first tier). All other documents referenced through tiering, may be used for
guidance and information only.
71
JSSG-2009A
3. REQUIREMENTS
4. VERIFICATIONS
3.1 Definition.
The (TBS 1) air vehicle shall perform the identified table I functions and meet the
requirements for safety, mission reliability, and vehicle growth as specified in (TBS 2) .
TABLE I. Subsystems functions.
(TBS 3)
REQUIREMENT RATIONALE (3.1)
Defining the applicable subsystems with their required functions establishes the linkage and
allocates key functional requirements of the air vehicle with that of the individual subsystems to
be developed. This linkage will form the basis from which the lower-tier component specification
requirements will be derived.
REQUIREMENT GUIDANCE (3.1)
TBS 1 should specify the air vehicle.
TBS 2 should reference the applicable air vehicle document that contains the overall
requirements for safety, mission reliability, and vehicle growth.
TBS 3 is a table that identifies the individual subsystem functions that are to be provided for the
air vehicle and assigns the key required air vehicle functions that are explicit in or derived from
the air vehicle specifications. A partial example of conventional manned air vehicle subsystems
is shown below:
SUBSYSTEM FUNCTION
Auxiliary Power - Auxiliary power generation for self-sufficient

normal ground and maintenance operations
- Main Engine Starting
- Emergency Power Generation
-Power Transmission (Engine shaft horsepower

to airframe)
72
JSSG-2009A
Fire Protection Crew Safety
- Air Vehicle Survivability
- Fuel Tank Inerting
-- Fire Prevention
-- Fire Detection
-- Fire Suppression
-- Bleed Air Leak Detection
Environmental Control - Pressurization
- Air Conditioning & Control
- Environmental Protection
-- Fog & Frost Protection
-- Rain Removal
-- Ice Protection
-Engine Bleed Air Distribution & Control
Fuel - Fuel Storage
- Fuel Management & Delivery
- Aerial Refueling
- Additional Functions as requirements dictate
Hydraulics - Hydraulic Power Generation and Distribution

for use in:
-- Primary Flight Control actuation
-- Utility subsystem actuation
-- Additional Functions as requirements

dictate
73
JSSG-2009A
Landing Gear - Air vehicle Ground Maneuvering & Recovery
- Steering
- Braking
- Additional functions as requirements dictate
VTOL/STOL power drive - Propellers
Propellers - Provide thrust (e.g., propellers, rotors, fans)
Additional Subsystems as requirements

dictate
A more integrated solution, however, may allocate, assign, or group a different combination of
functions such as in the following partial example:
SUBSYSTEM FUNCTION
Thermal/Energy Management Module - Auxiliary power generation for self-sufficient

normal ground and maintenance operations
- Main Engine Starting
- Emergency Power Generation
- Pressurization
- Air Conditioning & Control
- Environmental Protection
-- Fog & Frost Protection
-- Rain Removal
-- Ice Protection
- Thermal Management
74
JSSG-2009A
Accessory Drive - Power Transmission (Engine shaft

horsepower to airframe)
Fuel - Fuel Storage
- Fuel Management & Delivery
- Aerial Refueling
- Additional Functions as requirements dictate
Hydraulics - Hydraulic Power Generation and Distribution

for use in:
-- Primary Flight Control actuation
-- Utility subsystem actuation
-- Additional Functions as requirements

dictate
Landing Gear - Air Vehicle Ground Maneuvering & Recovery
- Steering
- Braking
VTOL/STOL power drive - Propellers
Propellers - Provide thrust (e.g., propellers, rotors, fans)
Additional Subsystems as requirements

dictate
REQUIREMENT LESSONS LEARNED (3.1)

(TBD)
75
JSSG-2009A
4.1 Definition.
The basic objective of verification requirements is to verify that the air vehicle subsystem
performance and operability requirements specified in section 3 have been met. This section
specifies the method(s) of verification for each section 3 subsystem requirement. Requirements
shall be verified incrementally (TBS) .
VERIFICATION RATIONALE (4.1)
The purpose of incremental verification is to install design development discipline, provide

engineering and program management with events and progress criteria for continually
assessing the design effort toward achievement of contractual subsystem requirements, and to
ensure key system engineering risk reduction activities are successfully accomplished prior to
each demonstration milestone.
VERIFICATION GUIDANCE (4.1)
TBS should be filled in with verification cross-reference table. Table II is an example of a

verification cross reference table, composed of five sections: Requirement Section,
Requirement Reference, Requirement Criticality, Verification Section and Verification
Method/Event. The requirement section should be a numerical listing of all section 3
requirements. The requirement reference should restate the respective requirement parameter
from section 3. The requirement criticality should document whether the requirement, as
designated by the User, is a critical system requirement. If the requirement is critical, then all
the subordinate allocated requirements within and across the lower level specifications should
carry the same rating. For critical subsystem requirements, the final incremental verification
should culminate in a test. The verification section should be a numerical listing of all
verifications for section 3 requirements. The verification method/event designate the method of
verifying (I - inspection, A - analysis, D - demonstration, T- test, or P - process control) the
requirement to show design maturity at designated events (SFR, PDR, CDR, FF, SVR and any
other event necessary for the proper incremental verification of the subsystem and its
components). The method of verification should be specified for each milestone event.
76
JSSG-2009A
TABLE II. Incremental verification.

REQUIREMENT/VERIFICATION CROSS-REFERENCE MATRIX
Verification
Section
Requirement Requirement Section 4 Method/Event
3
Reference Criticality Verification
Reqts.
N/A SFR PDR CDR FF SVR Other
3.1 AVSS definition C 4.1

3.2 AVSS 4.2
characteristics
3.3 Design and 4.3
construction
3.4.1 Landing 4.4.1
3.4.2 Hydraulic power 4.4.2
3.4.3 Auxiliary power 4.4.3
3.4.4 Environmental 4.4.4
control
3.4.5 Fuel 4.4.5
3.4.6 Aerial refueling 4.4.6
3.4.7 Fire and explosion 4.4.7
hazard protection
3.4.8 Electrical power 4.4.8
3.4.9 Mechanical 4.4.9
3.4.10 Cargo, aerial 4.4.10
delivery, and
special operations
3.4.11 VTOL-STOL 4.4.11
power drive
3.4.12 Propellers 4.4.12
3.4.13 Pneumatics 4.4.13
3.4.14 Additional 4.4.14
subsystems
and functions
Requirement Criticality: C – Critical, N – Non-Critical

Method of Verification: I – Inspection, A – Analysis, D – Demonstration, T – Test, P – Process Control
Events:
N/A – Not Applicable
SFR – System Functional Review
PDR – Preliminary Design Review
CDR – Critical Design Review
FF – First Flight
SVR – System Verification Review
Other – Include all events necessary for incremental verification of subsystems and components.
77
JSSG-2009A
VERIFICATION LESSONS LEARNED (4.1)

(TBD)
Functional diagrams for the (TBS) shall be provided.
REQUIREMENT RATIONALE (3.1.1)
Diagrams are needed to evaluate functional and physical characteristics.
REQUIREMENT GUIDANCE (3.1.1)
TBS should be filled with the subsystem for which procurement is being considered. Item
diagrams for each subsystem should be included in the air vehicle specification.
REQUIREMENT LESSONS LEARNED (3.1.1)
Diagrams are useful design tools.
Functional diagrams shall be verified.
VERIFICATION RATIONALE (4.1.1)
Diagrams are needed for verification to assure subsystem functional and physical correctness.
VERIFICATION GUIDANCE (4.1.1)

Functional diagrams should be verified by inspection.
VERIFICATION LESSONS LEARNED (4.1.1)

(TBD)
Interface drawings for the (TBS) shall be provided.
Interface between airframe and subsystem/component(s) must be established and controlled to

ensure compatibility. Interface drawings are required to ensure physical compatibility between
subsystems, components and airframe.
78
JSSG-2009A
TBS should be filled with interface drawings for each subsystem.
Past air vehicle procurements have benefited from the inclusion of interface drawings.
Fluid drains, drain characteristics, and collection requirements have been included on interface
drawings. Component clearances have also been included.
Interface drawing shall be verified by (TBS) .
Drawings are needed for verification to assure physical compatibility between subsystems/
components and airframe.

TBS should be accomplished by inspection.
(TBD)
3.2 Characteristics
4.2 Characteristics
3.2.1 Security.
Subsystem security shall be in accordance with (TBS) .
This is a flowdown requirement from JSSG-2001, Air Vehicle Joint Services Specification Guide.
TBS should be in accordance with the JSSG-2001 requirement.
REQUIREMENT LESSON LEARNED (3.2.1)
(TBD)
79
JSSG-2009A
4.2.1 Security.
Subsystem security shall be verified by (TBS) .

(TBD)

(TBD)
(TBD)
The computer resources, hardware and software, dedicated to the control of air vehicle
subsystems shall support allocated air vehicle subsystem functional requirements. Computer
resources hardware defined as, electric/electronic sensor data collection devices (data input),
electric and electronic effector devices (data output), analog, digital communication paths (serial
and parallel data buses), data processing elements (general or specialized CPUs), and power
supply characteristics shall be defined by computer resources. Computer resources software
defined as, High Order Language (HOL), software development and testing tools (software
environment), and software development processes shall be characterized by computer
resources. Computer resources hardware and software shall be designed as an open
architecture that is expandable, upgradable and compatible with other computer resources
within the air vehicle to maintain security requirements.
The computer resources shall support the (TBS) level maintenance concept.
A hardware and software obsolescence plan shall be implemented for computer resources to
address maintenance of the air vehicle.
Hardware characteristics such as bus bandwidth, bus type, input device impedance/voltage
range, output device impedance/voltage range, and CPU type must be “owned” by one design
group. This stops proliferation of hardware and forces commonality.
Hardware and software processing resources should be an open, expandable architecture using
a minimum number of module types.
80
JSSG-2009A
TBS: Computer resources should support the air vehicle subsystem diagnostics, fault detection,
fault isolation, fault reconfiguration, and life management requirements.
See JSSG-2001, Air Vehicle Computer Systems, for additional guidance.

(TBD)
The functional requirements allocated to and implemented by computer resources shall be

verified by (TBS) .

(TBD)
TBS: The functional requirements implemented into computer resources should be verified by
stand-alone computer resource testing air vehicle. Additional functional verification should be
accomplished during system-level tests described in each subsystem.
Architectural requirements and the expansion capability should be verified by analysis. An

analysis of the module types should verify that the minimum number of modules is used
consistent with the need to partition functions and to minimize overall hardware complexity.
A testability analysis should verify that the air vehicle subsystem computer resources support
the fault detection, fault isolation, and reconfiguration requirements. Specific functional
requirements should be verified as called out in the specified requirement section.
The support-level maintenance should be verified by testability analysis and demonstration on

the VSS. The electrical design should be analyzed to verify that electrical failures can be
detected and isolated to the quantitative level required to support air vehicle requirements.

(TBD)
3.2.3 Observables.
Subsystem IR, acoustics, radar, and visual observable requirements shall be as follow: (TBS) .
This is a flowdown requirement from JSSG-2001.
81
JSSG-2009A

TBS should be in accordance with JSSG-2001, “Susceptibility“.
In the past, the dynamic RCS signature of the rotating blades on propellers have been a
significant design observable consideration.
4.2.3 Observables.
Subsystem IR, acoustics, radar, and visual observable requirements shall be verified (TBS) .
This verification is to ensure survivability.
TBS should be filled in with analysis of model measured data, analysis of EMC radiated
emissions data, and data collected during ground and flight tests.

(TBD)
Electromagnetic emissions shall be in accordance with (TBS) .
REQUIREMENT RATIONALE (3.2.3.1)
REQUIREMENT GUIDANCE (3.2.3.1)

TBS should be in accordance with the JSSG-2001 requirement.
REQUIREMENT LESSONS LEARNED (3.2.3.1)

(TBD)
The EME requirement shall be verified (TBS).
82
JSSG-2009A
VERIFICATION RATIONALE (4.2.3.1)

(TBD)
VERIFICATION GUIDANCE (4.2.3.1)
TBS: The EME requirement should be verified by analysis of EMC radiated emissions test.
VERIFICATION LESSONS LEARNED (4.2.3.1)

(TBD)
The air vehicle subsystems shall be designed and integrated into the air vehicle to meet the
survivability requirements of the air vehicle as specified in (TBS 1) . Specific subsystem
allocated and derived susceptibility and vulnerability requirements shall be as follow: (TBS 2) .
The air vehicle subsystems must be able to withstand and perform in the intended environment
in order for the air vehicle to be effective.
TBS 1: JSSG-2001, along with the applicable paragraphs and any associated supplemental
program specific documents identifying vulnerability/survivability requirements, should be
referenced.
TBS 2: The following hazards and vulnerability areas should be considered as to how the
subsystems would contribute to the total air vehicle performance:
- Ballistic impact from conventional munitions and missile fragmentation
- Chemical and Biological agents to include decontamination agents
- Lasers and other directed energy weapons such as high power microwave
- Nuclear
- Birds
- Observables
-- IR, UV, and EM radiation
-- Radar Cross Section (RCS)
-- Visible, such as smoke and vapor trails.
83
JSSG-2009A
Survivability is divided into two areas: vulnerability (provisioning so that once hit, damage is
minimized) and susceptibility (provisioning such that you do not get hit).
VULNERABILITY AREAS SUSCEPTIBILITY AREAS
- Ballistic impact ... - Observables ...
- Chemical and Biological - Stealth

- Lasers - Countermeasures
- Nuclear - Chaff
- Birds

(TBS)
The survivability requirements shall be verified as follows: (TBS) .
Verification that the subsystems can meet their allocated requirements is necessary for air
vehicle verification.
TBS: Vulnerability techniques should be verified by inspection of design drawings and tests.
The specific vulnerability reduction techniques used to enhance the survivability of the
subsystem should be verified in accordance with tailored verification methods which are specific
for the threat environments. The susceptibility reduction techniques should be verified as
specified in JSSG-2001.

(TBD)
84
JSSG-2009A
3.2.5 Reliability.
The air vehicle subsystem requirements shall be consistent with JSSG-2001 Air Vehicle
“Reliability” requirements.

The primary reliability requirement is the mission reliability requirement. It is derived, by

allocation, from the mission reliability statement in the operational requirements. It cannot be
measured satisfactorily in the R&D environment. It assumes mature equipment under field
operating conditions and would require the completion of many missions to obtain a high
confidence measurement. It is for this reason that Mean Time Between Failure (MTBF)
measurements are used. The MTBF requirement is related to the mission success requirement
through the reliability equation. The MTBF required to meet the mission success requirement is
increased 15 to 20 percent (15-20%) to allow for failures induced by operational and
maintenance problems handling damage, etc.
The required reliability is not generally achieved in development: when achieved it is generally
well into production after all correctable problems have been resolved and necessary
improvements have been retrofitted into delivered equipment. Reliability is a growth process. It
starts at a low level and grows as failures and problems are observed and corrected. Reliability
is a growth process and is discussed in MIL-HDBK-189, Reliability Growth Management.
Recognizing the growth process, two sets of reliability are generally used; the first represents
the operational requirement while the second applies strictly to the development phase of the
program.
Reliability does not just occur; it must be planned for. Reliability activities that must be planned
and performed might include:
Subcontractor and Supplier Control
Failure Reporting and Corrective Action System (FRACAS)
Reliability Analysis and Prediction
Failure Modes, effects, and Criticality Analysis
Identification and Control of Critical Items
Development, Qualification, and Production Tests.
A more complete list of reliability activities and instructions on their implementation are found in
MIL-STD-785B, Reliability Program for Systems and Equipment, Development and Production.
The selection of reliability activities will be determined by the reliability requirements, program
requirements and/or constraints, and past experience.
85
JSSG-2009A
The key to achieving the required degree of reliability growth is to accelerate the occurrence
and correction of correctable failures in the system. In some cases a system is dedicated to
performing reliability development tests at simulated operational environments. These tests are
run in parallel with other development tests. All failures are processed through the FRACAS,
corrective action is defined and installed in the test hardware to provide verification. Otherwise,
data from all tests, laboratory and flight, must be processed through FRACAS to determine the
required corrective actions. After development and into production, the process continues using
data from factory, flight, and operational tests.

(TBD)
4.2.5 Reliability.
Reliability requirement shall be verified by (TBS) .

Verification is an element of the Reliability Program for air vehicle subsystems and provides
information and data for the verification process. Reliability is a design attribute and is achieved
principally by applying appropriate controls to every step of the design process, and by applying
appropriate quality controls to the manufacture of the item so that the inherent reliability of the
design will not be degraded. A good prediction will indicate the feasibility of meeting the
reliability requirements. The prediction process should be thoroughly understood so that the
prediction can be analyzed to identify problems that should be corrected before the design is
mechanized.
TBS should be filled in according to JSSG-2001.
The FMECA should be used to identify the critical failure modes that require correction. The
FRACAS should be used in all development testing to analyze all failures and identify those
needing correction. Special laboratory reliability tests might be required for some critical
component items to assure that their performance is compatible with the subsystem reliability
and life requirements. No special reliability test is recommended for the subsystems, but data
for all tests at the subsystem and higher levels should be utilized to enlarge the reliability data
base and provide a continuing measurement of reliability.
One factor that should not be overlooked is experience; the extent to which the reliability history
of previous subsystem designs might apply to this design. A “new” subsystem design might be
merely a physical rearrangement of the components in a previous design. This factor should be
carefully studied to make effective use of prior experience.
Test methods of the past have not yielded high confidence measurements of subsystem
reliability. The verification methods discussed herein do not represent a break with the past so
that the confidence level of the reliability measurements will continue to be low. The procedures
86
JSSG-2009A
discussed and recommended here emphasize the early identification and correction of problems
that might seriously impact the field reliability of the subsystem.
General practice has been to subject the subassemblies and components to extensive
qualification testing then perform functional verifications, including, reliability in flight test as part
of the air vehicle contractors development test program. This might be called hybrid testing
since it is performed in many steps throughout the development process. Tests and analyses
are selected and structured so as to optimize the test time required and be beneficial to costs.
The air vehicle subsystem maintainability requirements shall be in accordance with JSSG-2001.

This is a flowdown requirement from JSSG-2000, Air System Joint Services Specification
Guide.
The subsystem design maintainability should be capable of meeting subsystem or air vehicle
availability goals for the mission and mission mix profile. Maintainability Qualitative and
Quantitative requirements should be specified.
The diagnostic capabilities necessary to meet subsystem maintainability requirements should

be specified.
All excluded maintenance and repair functions should be listed.
Subsystem design should permit maximum use of non-destructive inspection techniques and
multi-purpose test and inspection equipment. Inspection provisions, including access
envelopes, should be shown on the subsystem item diagrams.
Required tooling should be held to a minimum. Ideally, the subsystem should be capable of
being maintained with a set of standard hand tools to the maximum extent possible. Where
provisions for standard hand tools are not feasible, the design should provide, wherever
possible and cost effective, for special tools and test equipment that are available and in use on
other in-service subsystems of the same type.
Subsystems should be designed to be maintained by at least the central ninety percent (90%) of
the maintainer population (5th percentile female stature through 95th percentile male stature)
wearing a full complement of personal protective equipment, under all defined environmental
conditions (including day/night), and all defined operational scenarios at operating bases and
deployed locations.
87
JSSG-2009A
The capability for battle damage repair should be considered. Combat damage repair design
techniques should utilize tools and materials found at organizational and intermediate levels if
practical.
All subsystem components should be permanently marked to indicate all instrumentation and oil
connections. Components and items of the subsystems requiring routine servicing or
adjustment should be made readily accessible without removal of other parts. Each line
replaceable unit (LRU) should be removable from the system without removal of other LRU’s.
Parts subject to wear and which require replacement prior to expected life achievement of the
system component, should be individually replaceable.
Subsystem components should be accessible for inspection, cleaning, adjustment, or

replacement, with tools normally found in a mechanic's toolbox, while installed and without
removal of other components or structures. Exceptions should be identified.
Safety wire and cotter keys should not be used at an organizational level.
Clearance provisions for installing hose nipples or flared tube fittings have been a problem in
the past.
In the past, safety wire and cotter keys have punctured and torn NBC protective gear exposing
personnel to possible contamination.
The maintainability requirements shall be verified by (TBS) .

The maintainability requirement is a flowdown from JSSG-2001.

TBS should be filled in with Verification Requirements of JSSG-2001.

(TBD)
88
JSSG-2009A
The subsystem design service life shall be in accordance with the JSSG-2001, “Design service
life”.
REQUIREMENT RATIONALE (3.2.7.1.1)

REQUIREMENT GUIDANCE (3.2.7.1.1)
The subsystems should be designed to satisfy the performance requirements of this

specification for the design service life of the air vehicle.
Operational service life data should be used for developing subsystems and components
design, analysis, and test criteria. Validity of information should be verified.
Reliability, durability and service life of subsystems are all dependent on Service usage. The
design usage will be supplied by the using service as part of the request for proposal. The
contractors should identify any recommended changes based on their experience to the using
service for consideration. It is recommended that the contractors conduct trade studies to
establish cost (Life Cycle Cost - LCC, Weight, Performance) as a function of structural life
(inspection intervals, economic life). The results of these trade studies should be presented to
the using service for consideration to establish a preferred design service life.
If specific design usage requirements are not specified by the using service, the contractor
should convert the airframe mission profile information supplied by the using service to
Subsystem usage profiles as required (e.g., to convert airplane thrust requirements for profile
segments into engine power settings). The design usage should be included as part of the
contract specifications.
The design usage should include:

a. Missions and Mission Mix (both training and operational)
b. Usage parameters
c. Externally applied forces
d. Ambient temperature extremes and ambient temperature distribution for principal sited
bases
89
JSSG-2009A
e. Mix of ship and shore based operations

f. Storage and shipment.
REQUIREMENT LESSONS LEARNED (3.2.7.1.1)
(TBD)
Design service life shall be verified in accordance with JSSG-2001.
VERIFICATION RATIONALE (4.2.7.1.1)

(TBD)
VERIFICATION GUIDANCE (4.2.7.1.1)
Operational service life should be verified by analysis and test.
VERIFICATION LESSONS LEARNED (4.2.7.1.1)

(TBD)
Each subsystem shall meet the performance requirements of this specification before, during,
and after exposure to any operational combination of the following natural and induced
environments:
a. Natural environment: (TBS 1) .
b. Induced environment. The induced environments for the air vehicle subsystems shall be
developed using the above natural environment and the environment imposed on the
subsystems by the air vehicle design and its operating environment. Induced
environments shall be established for all modes of operation or non-operation including
normal operation, intermittent operation (transient operation), non-operation, storage,
and transport. These induced environments shall include: (TBS 2) .
This is a flowdown requirement from the JSSG-2001. The intent is to provide a definition of the
natural and induced environments under which the air vehicle is expected to operate. The air
vehicle designer must add induced effects to determine overall subsystem exposure.

TBS 1 should be filled in with the following guidance, except for air vehicle operating in limited
geographical areas:
90
JSSG-2009A
Air vehicle subsystems should be designed to meet the entire specified requirement while
operating under the worst expected natural extremes. These design conditions are usually
based upon MIL-HDBK-310, formerly MIL-STD-210, which established extreme climatic design
criteria for military equipment intended for worldwide usage.
The difficulty in applying MIL-HDBK-310 is in selecting the severity of the extreme to be used.
Systems being designed for specialized applications or limited usage may be designed to more
lenient requirements as determined by the program office. Listed below are the natural
environments, which must be considered during the analysis, design, and test of air vehicle
subsystems. Generally, many of these environmental conditions are specified in the air vehicle
specification based upon the operational requirements. The project engineer must review these
requirements to determine if all the appropriate environmental conditions have been specified,
and if not, address them in this paragraph. The engineer must be sure the requirements
specified are consistent with those established by the program office; i.e., if the program office
selects the MIL-HDBK-310 10-percent (10%) extreme flight operation high temperature, the
1-percent (1%) extreme flight operation humidity would probably not be appropriate. MIL-HDBK-
310 defines the 1-percent (1%) extreme, 10-percent (10%) extreme, etc., and how the design
criteria were established. The handbook should be consulted when this requirement is being
prepared. The engineer must make it clear that these values represent the extremes and that
the equipment is expected to meet specification at all conditions less than (or greater than) the
extremes.
Listed below are the environmental conditions that typically should be given for air vehicle
subsystems. When values are not provided in the air vehicle specification, the following values
are recommended for unlimited, worldwide usage:
Note: Since MIL-HDBK-310 is a handbook, it is not contractually binding. If any of the values
below are to be contractually binding, including the tables, they must be directly inserted into the
specification as requirements.
a. Ground operation high temperature. 120 F (MIL-HDBK-310, Worldwide Surface
Environment 1-percent (1%) extreme)
b. Ground operation low temperature. -60 F (MIL-HDBK-310, Worldwide Surface
Environment 20-percent (20%) extreme)
c. Flight operation high temperature. (MIL-HDBK-310, 5.3.1.1.2, Worldwide Air 1-percent
(1%) extreme)
d. Flight operation low temperature. (MIL-HDBK-310, 5.3.1.2.2, Worldwide Air 1-percent
(1%) extreme)
e. Ground operation of high absolute humidity with high temperature. The “GROUND”
curve on figure 1 should be used. This curve represents data from MIL-HDBK-310,
Worldwide Surface Environment 1-percent (1%) extreme, and is based on the curves
developed in Air Force Cambridge Research Laboratories Report AFCRL-TR-74-0603,
dated 5 December 1974.
f. Ground operation high relative humidity. (MIL-HDBK-310, Worldwide Surface
Environment 1-percent (1%) extreme [table VI])
g. Flight operation high humidity. (MIL-HDBK-310, 5.3.1.2.2, Worldwide Air 1-percent (1%)
extreme)
91
JSSG-2009A
h. In-flight operation of high absolute humidity with high temperature. The “IN-FLIGHT”
curve on figure 1, herein, should be used. This curve represents the 1-percent (1%)
extreme of figure 14 from the Air Force Cambridge Research Laboratories Report
AFCRL-TR-74-0603, dated 5 December 1974. The curve is for sea level conditions.
Extrapolating the curve to altitude conditions should be considered. The report also
provides other frequencies of occurrences.
i. Low humidity for all ground and flight conditions: zero percent (0%).
j. Ground operation rainfall rate. (MIL-HDBK-310, 5.1.11.2, Worldwide Surface
Environment 0.5-percent (0.5%) extreme.) In addition, externally mounted equipment
should be operable without significant degradation in performance and should sustain no
physical damage, during periods of extreme rainfall with a rate of 1.8 mm/min and with
intermittent wind.
k. Flight operation rainfall rate. (MIL-HDBK-310, 5.3.2.5.2, Worldwide Air 0.5-percent
(0.5%) extreme)
l. Solar radiation intensity. As defined on figure 2, herein. This data was extracted from
figure 10 of WADC Technical Report 55-254. The upper limit is consistent with the
ASHRAE Handbook – Fundamentals Volume (1989 edition, page 27.2), which gives the
solar intensity at the outer edge of the atmosphere as between 449.6 BTU/hr-ft2
(1418.2 W/m2) in mid-winter and 419.9 BTU/hr-ft2 (1324.5 W/m2) in mid-summer. The
lower limit has been adjusted to reflect the MIL-HDBK-310 (table II) value of 355 BTU/hr-
ft2 (119.8 W/m2).
92
JSSG-2009A
95.0
90.0 GROUND
85.0
IN-
80.0 FLIGHT
75.0
70.0
Dew Point Deg F
65.0
60.0
55.0
50.0
45.0
40.0
35.0
30.0
32
36
40
44
48
52
56
60
64
68
72
76
80
84
88
92
96
100
104
108
112
116
120
Dry Bulb Deg F
FIGURE 1. Joint values of high temperature with high humidity.
93
JSSG-2009A
450
Solar Radiation Intensity Btu/hr-ft^2

425
400
375
350
325
300
0
10
20
30
40
50
60
70
Altitude - 1,000 ft
FIGURE 2. Solar radiation intensity.
m. Ground hot soak conditions. MIL-HDBK-310, Worldwide Surface Environment Daily

Cycle of Temperature and Other Elements, 1 percent (1%) extreme (MIL-HDBK-310,
table I). This should be used for requirements where longer-term duration is an issue
such as storage and start-up from hot soaked condition. Worldwide Surface Environment
Daily Cycle of Temperature and Other Elements, 1 percent (1%) extreme (MIL-HDBK-
310, table IV) should also be used where humidity may be a factor.
n. Atmospheric pressure. Pressure altitudes from 1,300 ft (396 m) below sea level to the
operational ceiling of the vehicle. Use of 1,300 ft (396 m) below sea level allows for both
normal atmospheric pressure changes and those geographic areas with below sea-level
elevations.
o. Salt spray. A sea salt fallout of at least 27 kg/ha/yr should be used.
p. Icing conditions:
1. In-flight. The icing environments should be those represented on figure 3, herein, for
in-flight icing from supercooled droplets. The particle droplet distribution must be
considered and can be approximated by the "Langmuir B" distribution modified for
cloud type, maritime, and orographic effects. The duration of exposure should not be
less than 45 minute with 90 minutes a worst-case desired exposure capability. The
guidance information given in "Air vehicle Icing Handbook" DOT/FAA/CT-88/8-1 is
the most up-to-date central source of icing design data to date (beyond ADS-4), is
94
JSSG-2009A
updated on a regular basis by the FAA and the SAE AC-9C Icing Subcommittee, and
should be used for air vehicle design. The specification should include in-cloud and
precipitating hydrometeors such as supercooled liquid droplets, basic ice crystals,
crystal aggregations, freezing rain, sleet, graupel, hail, and snow. Airframe
configurational phenomena such as condensation icing and vortex icing should be
addressed.
2. Ground. The icing environments should be those represented in the Ground
Environment of MIL-HDBK-310. The subsystem specification should consider effects
during/after exposure due to (layer and accretion of precipitating, blowing and
recirculating snow; sleet; hail; graupel; freezing rain; slush; and de-icing/anti-icing
fluid residual using the references cited above.
3. Ship. The icing environments should be those represented in the Naval Surface and
Air Environment of MIL-HDBK-310. Use the references cited above to develop the
subsystem specification with consideration to effects during/after exposure due to
accretion of precipitating, blowing, and recirculating snow; sleet; hail; graupel;
freezing rain; slush; and de-icing/anti-icing fluid residual.
(a.) Salt spray. Protection against sea salt fallout of at least 27 kg/ha/yr should be
provided.
(b.) Fungus. Fungus types for operation and stowage should be defined using
MIL-STD-810 as a guide.
95
JSSG-2009A
FIGURE 3. In-flight supercooled cloud icing environment (layer and convection).
TBS 2 should be filled in with the following guidance on induced environments: MIL-STD-810,
although a test specification, is helpful in establishing many of the requirements.
a. External Ground Temperature. Using the ground ambient temperatures established
above the contractor should be required to develop the induced environment accounting
for such effects as radiative and convective heating off of tarmacs and air vehicle
exhaust that may be recirculated back to the air vehicle. Where air vehicle operate from
96
JSSG-2009A
different types of environments such as air vehicle carriers, a separate requirement for
the individual environments should be considered.
b. External Skin and Ram Temperature. Using the in-flight ambient temperatures
established above the contractor should be required to develop the induced environment
accounting for aerodynamic heating of the skin and boundary layer air.
c. Operating Temperature
d. High Temperature (internal)
e. Low Temperature (internal)
f. Temperature Shock
g. Vibration (including gunfire where applicable)
h. Acceleration
i. Shock
j. Acoustic Noise
k. Humidity
l. Low Pressure (altitude)
m. Fungus
n. Sand and Dust
o. Explosive Atmosphere
p. Leakage (immersion)
q. Attitude
r. Pitching, Rolling, Yawing Angular Velocities and Accelerations and Load Factors (up,
down, aft, forward, and side)
s. Electromagnetic
t. Typically, the contractor is required to develop this data for regions and compartments in
the air vehicle using MIL-STD-810 as a guide and to submit it for government approval.
When levying this requirement, a contract data item should be prepared to require the
data to be delivered and approved. Electromagnetic environment is not covered in
MIL-STD-810.
On the V-22 FSD air vehicle, the induced environment resulting from hot exhaust from the
engines being deflected into the air vehicle on the ground resulted in the air temperatures at
inlets being much higher than predicted, resulting in failure to meet cabin, cockpit and avionics
specified temperatures.
C-130H air vehicles stationed at Dyess AFB TX experienced extreme clogging of heat
exchangers on the ram airside with sand and dust. This clogging was found to be due to the
high fin density and location of the ram air inlet in the plane of rotation of the propellers and near
the ground.
97
JSSG-2009A
The subsystems shall be capable of meeting the performance requirements of this specification
before, during, and after exposure to the natural and induced environments as verified by
analyses, tests, and demonstrations.

The intent of this requirement is to verify the capability of the subsystem to withstand and
operate in the natural and induced environments to which it will be subjected.

All individual components and/or subsystems of the air vehicle should be analyzed and/or tested
to verify compatibility with the natural and induced environments. The following will not apply to
all subsystems or part of subsystems. Such factors as whether they are internal or external or
have electronic equipment or not should be considered. The potential effect of the
environmental factor on the subsystem will also vary from subsystem to subsystem and
component to component. This can only be determined during the design process. The
contractor should be required to submit a data item to specify which environmental tests will be
run on which subsystems and their components. Combining environments in tests should be
considered where the interaction of factors may be critical. It may be considered for cost
effectiveness where verification is not compromised. MIL-STD-810 should be used as a guide
to develop verification requirements.
a. Ground operation high temperature
b. Ground operation low temperature
c. Flight operation high temperature
d. Flight operation low temperature
e. Ground operation high absolute humidity with high temperature
f. Ground operation high relative humidity
g. Flight operation high humidity
h. Low humidity
i. Ground operation rainfall rate
j. Flight operation rainfall rate
k. Solar radiation intensity
l. Ground hot soak conditions
m. High temperature (internal)
n. Low temperature (internal)
o. Temperature Shock
p. Vibration (including gunfire where applicable)
q. Acceleration
98
JSSG-2009A
r. Shock
s. Acoustic Noise
t. Low Pressure (altitude)
u. Fungus
v. Salt Fog (carrier based air vehicle should add sulfur to this)
w. Sand and Dust
x. Explosive Atmosphere
y. Leakage (immersion)
z. Solar Radiation
aa. Icing/Freezing Rain
bb. Electromagnetic - Should be in accordance with JSSG-2001.
The experience of one-type fighter in recovery from spins, hard landings, and arrested landings
shows the acceleration and shock limits (MIL-STD-810) to which the air vehicle was tested were
exceeded. After one incident, a method of post-flight inspection had to be instituted to ensure
there was no damage to the mechanical equipment (rotating, valves).
Subsystems shall be in accordance with JSSG-2001, “Crash worthiness”.

This is a flowdown requirement from the JSSG-2001, “Crash worthiness”.
Crash worthiness should be considered during the initial design phase by selecting the most
effective mix of crash resistance factors including the following:
a. retention of high mass components, equipment, and cargo;
b. occupant environment hazards; and
c. post crash hazards.
Specific subsystems contributing to crash protection include crash resistant fuel systems,
energy absorbing landing gear, crash resistant cargo restraint systems, and air vehicle flotation
systems. Relative to rotary wing air vehicle, all gearbox support structures should prevent the
gearbox from being displaced into occupied space at crash load factors equal to or less than
those specified for a survivable air vehicle crash.
99
JSSG-2009A

(TBD)
Subsystem crash worthiness shall be verified through analysis and test.


Verification should be in accordance with JSSG-2001, “Safety verification.”

(TBD)
The materials and processes shall ensure adequate strength, durability, and damage tolerance
capabilities of components as required (TBS) .

Some materials do not ensure adequate strength, durability, and damage tolerance capabilities
due to corrosion, degradation, toxic vapors, out gassing, nutrients for fungi.
TBS: Durability considerations should include low cycle fatigue, high cycle fatigue, current-
carrying capacity, dielectric materials margins, and corrosion resistance.
Damage tolerance considerations should include fracture toughness, crack growth rate, stress
corrosion cracking, and corrosion resistance.
Elastomers and other materials exposed to lubricants, fluids and chemical agents used to
operate and maintain the subsystem should be compatible with such fluids throughout the entire
system temperature range without experiencing detrimental swelling, shrinkage, hardening or
other forms of material deterioration.
(TBD)
100
JSSG-2009A
Material and process requirements shall be verified (TBS) .

(TBD)
TBS: Verification of the materials and processes requirements could be by material data
analysis and characterization testing. Material characterization testing may include yield
strength, ultimate strength, S/N data, da/dn testing, etc., for various materials and processing
variables as required by strength, durability, damage tolerance, and other analysis methods.
Historical data may be used in lieu of material characterization testing if available.

(TBD)
Surfaces shall be coated and finished in accordance with the air vehicle specification.

This is a flowdown requirement from JSSG-2001, “Exterior color”.

Coatings and finishes should be in accordance with JSSG-2001, “Exterior color”.

(TBD)
Surface coatings and finishes shall be verified to be in accordance with JSSG-2001.


Verification should be by inspection.
101
JSSG-2009A

(TBD)
The following materials and processes shall be prohibited:

a. Chlorofluorocarbons (CFCs)
b. (TBS).
The prohibition of certain materials is intended to assure that materials and processes that could
cause system degradation or hazards to personnel are eliminated.
TBS: The following materials and processes should be considered:

a. magnesium;
b. silicon rubber;
c. room temperature vulcanizing rubber which comes in contact with lubricants, and
d. ge-sensitive elastomers;
e. unstabilized, austenitic steels above 700 F;
f. cold-rolled stainless steel at a temperature of more than 50 below the recovery
temperature;
g. precipitation hardenable stainless steels above 750 F;
h. nickel on heat exchangers where a sulfur environment will be encountered such as on
air vehicle carriers and where the temperature will exceed 600 F.
Castings. Castings should be clean, sound, and free from blow holes—excess porosity, cracks,
and other defects that may reduce the physical properties below design requirements.
Magnesium and magnesium alloys. Marine atmospheric exposure and most acids and salts
attack magnesium alloys rapidly. They are also highly susceptible to galvanic corrosion when in
contact with most other metals. Corrosion problems of this nature were experienced on
pneumatic controls and other components of the F-104 air vehicle. The corrosion caused
plugging or orifices and resulted in having to change components to eliminate the magnesium.
Therefore, magnesium and its alloys should be avoided. When it must be used, the contractor
must take the necessary precautions to prevent corrosion problems.
Corrosion-resistant steel. Prolonged exposure to high temperatures can result in the

sensitization and intergranular corrosion of certain stainless steels. A good example is 19-9DL
102
JSSG-2009A
stainless steel, which the USAF has had to replace in the bleed air systems of the F-4 and
F-111 air vehicles and the Navy in F-4 and F-14 air vehicles.
Cadmium-plated material. The USAF experienced failures of cadmium-plated bolts on the B-52
bleed air system. High heat-treated cadmium-plated bolts, when installed in a high-stress, high-
temperature environment for an extended period, are subject to diffusion of the cadmium into
the base metal, resulting in cadmium embrittlement. Bolts in which cadmium embrittlement has
occurred will fail at a much lower load than their allowable strength. By limiting cadmium-plated
material application to temperatures less than 450 F, cadmium embrittlement failures can be
avoided.
Cadmium vapors and dust are highly toxic and should not be used in applications where the
cadmium vapors or dust could be delivered to the occupied compartments during normal
conditions or following component failure. A near-accident on the C-130 was attributed to
cadmium poisoning of the crew following failure of a cooling turbine with a cadmium-plated
turbine nozzle. The crew became nauseous and the pilot lost consciousness and was
hospitalized for 2 years. The same toxic conditions exist for beryllium.
Neoprene. Another experience on the B-52 was the use of neoprene-covered insulation on low-
temperature ducts. Corrosion of the duct surfaces occurred, caused by hydrochloric acid that
results from the combination of condensate and chloride ions emitted from the neoprene at
elevated temperatures. Neoprene can be used satisfactorily at temperatures up to 250 F. It
should not, however, be used at temperature above the boiling point of water when in contact
with or in close proximity to any material that is sensitive to chlorides, such as stainless steel.
Organic materials. Materials that are nutrients for fungi should be avoided because of the
problems of preventing the growth of fungus and the resulting decomposition of the material.
Typical problems caused by fungi are:
a. Micro-organisms digest organic materials as a normal metabolic process, thus degrading
the substrate, reducing the surface tension, and increasing moisture penetration.
b. Enzymes and organic acids produced during metabolism diffuse out of the cells and onto
the materials and cause metal corrosion, glass etching, hardening of grease, and other
physical and chemical changes to the materials.
c. The physical presence of microorganisms produces living bridges across components,
which may result in electrical failures.
Adhesives, tapes and sealants should not decompose, break down, degrade, or outgas to
combine with moisture to form corrosive compounds. The USAF has had numerous instances
where adhesives, tapes have been used on systems and have ultimately decomposed and
combined with moisture to form corrosive compounds. It is extremely important that all
materials used be carefully selected and fully investigated for each application. The following
examples serve to emphasize this requirement:
An adhesive was used as an assembly aid to install insulation on ducting for the F-111 air
vehicle. This adhesive broke down when heated and in the presence of moisture formed an
acid that corroded the ducting.
103
JSSG-2009A
The ends of ducts on the F-101 were wrapped with a pressure-sensitive tape before they were
covered with insulation. When heated, the chloride in the tape formed hydrochloric acid and
corroded the duct.

It shall be verified by (TBS) that prohibited materials and processes are not used.

(TBD)

(TBD)

(TBD)
The selected fabrication techniques, design parameters, and tolerances shall enable the
product to be fabricated, assembled, inspected and tested with repeatable quality. A change in
manufacturing process, vendor, vendor location shall be subject to a re-verification process.
This requirement is directed toward achieving a design that is compatible with the realities of the
manufacturing capability of the defense industrial base. Producibility is a coordinated effort by
design engineering and manufacturing engineering to create a functional design that can be
easily and economically manufactured. The requirement documents establish what the system
must accomplish. These statements are the performance objectives for the system.
Subsequent statements in the requirement documents describe the physical, functional, and
support framework for the system. These statements operate as constraints on the design. The
relationship between the performance objectives and the constraints establish the potential
standards of producibility for the design.
The issue of design producibility and capabilities of the production system should be specifically
considered when tailoring the system specification and other contractual requirements for the
development contract.
104
JSSG-2009A
Certain design practices can make a substantial contribution to attaining a high level of
producibility in the system. Among these are:
a. Simplicity of design – eliminate components of an assembly by building their function
into other components or into integral components through application of unique
manufacturing processes.
b. Standardization of materials and components – a wide variety of off-the-shelf materials
and components are available which, when incorporated in the design, reduce cost and
increase availability.
c. Manufacturing process capability analysis – determine the available manufacturing
capacity, and its capability to produce the desired end item without special controls.
This includes an analysis of process variability.
d. Design flexibility – offer a number of alternative materials and manufacturing processes
to produce an acceptable system.
If the beneficial effects on the design process, unit production cost and system producibility are
to be realized, the procuring activity will need to emphasize producibility activity and be willing to
allow time and funds for the accomplishment of design trade studies which are the foundation of
the producibility effort.
The producibility shall be verified by (TBS) .

Verification is employed to mitigate the risk associated with production, to ensure the ability to
maintain design tolerances during the manufacturing process, and to confirm that the contractor
has a process to control quality in production.
TBS: Verification of producibility should be based on inspections, demonstrations, analyses and

tests. The level of inspection, demonstration, analysis and test should be dependent on the
criticality of the system or component.

(TBD)
105
JSSG-2009A

User service specified subsystems and components that perform safety or mission critical
functions shall be damage/fault tolerant. Damage/fault tolerance shall be achieved by
(TBS) .
REQUIREMENT RATIONALE (3.2.7.4.4.1)

Since damage tolerance is the ability of a system, subsystem or component to resist failure due
to the presence of flaws, cracks, or other damage for a specified period of operation, this
requirement protects safety and mission critical subsystems and components from potentially
degrading effects of handling damage and material, manufacturing and processing anomalies
which could result in premature failures and loss of air vehicle.
REQUIREMENT GUIDANCE (3.2.7.4.4.1)

Damage tolerance requirements should be applied to subsystems that perform safety or mission
critical functions and to individual safety or mission critical components.
TBS: Looking at the wide variety of air vehicle systems, subsystems, and individual safety and
mission critical components, damage and fault tolerance requirements should be met by the
following approaches:
a. Redundant or fail-safe-evident design
b. Damage tolerance design approaches in which the subsystem continues to function in
the presence of material defects, manufacturing and processing defects or
maintenance/service induced damage.
REQUIREMENT LESSONS LEARNED (3.2.7.4.4.1)
In the past, damage tolerance requirements have supplemented LCF requirements during
design and development. Significant damage tolerance, to the level required by the
specification, was then designed into the subsystem or critical components. Damage tolerance
requirements were stated in terms of hours or cycles after the specified damage has been
incurred. These parts have then been referred to as “damage tolerant designed.”
Damage tolerant design does not imply or require scheduled in-service inspections. However,
some subsystems may be designed for damage tolerance under structural integrity programs
such as MECSIP (Mechanical Equipment and Subsystems Integrity Program) which may
employ scheduled in-service inspections.
106
JSSG-2009A

It shall be verified that all subsystems that perform safety or mission critical functions are damage
and fault tolerant in the presence of material defects, manufacturing and processing defects, or
maintenance/service induced damage. Damage and fault tolerance shall be verified by (TBS) .
VERIFICATION RATIONALE (4.2.7.4.4.1)

Safety and mission critical functions must be verified to assure that the required functions are
actually met.
VERIFICATION GUIDANCE (4.2.7.4.4.1)

TBS: Safety and mission critical requirements should be verified by tests which will assure
continuation of the functions with the specified damage for the specified duration.
VERIFICATION LESSONS LEARNED (4.2.7.4.4.1)
(TBD)

Damage tolerant - fail safe evident subsystems and components shall be specified.

Fail safe evident refers to situations where on some subsystems or components, damage
tolerance may be more appropriately achieved by assuring that the failure is detectable and a
redundant system provides for mission completion and “get home” capability.

Those subsystems and components that are damage tolerant -fail safe - evident should be
identified. Fail-safe evident subsystem design may be achieved by redundancy which assures
that failure within a subsystem does not result in loss of the air vehicle or mission capability,
both of which should be maintained by a backup or secondary subsystem. The loss of
redundancy should be evident in flight and on the ground to personnel conducting routine
maintenance.
(TBD)
107
JSSG-2009A

Subsystem damage tolerance of fail safe-evident subsystems shall be verified by (TBS) .

Damage tolerant-fail safe evident designs must be verified to assure that the failure is evident
and that safety or mission critical functions will actually be met by the backup or secondary
system.

TBS: Subsystem damage tolerance should be verified by analysis to verify redundancy of the
fail-safe system design. Verification that failure will be evident in flight should be achieved by a
Failure Modes, Effects and Criticality Analysis (FMECA) of the subsystem. Verification that
failure will be evident to personnel conducting routine maintenance should be by demonstration.
(TBD)

Safety or mission critical components shall maintain adequate damage tolerance in the
presence of the maximum undetected maintenance or manufacturing defect as (TBS) .

Damage tolerance is the ability of a component to resist failure due to the presence of flaws,
cracks, or other damage for a specified period of operation. The damage tolerance requirement
protects safety and mission critical subsystems and components from potentially degrading
effects of handling damage and material, manufacturing, and processing anomalies that could
result in premature failures.
TBS: Damage tolerant design should be achieved by design to a maximum anticipated

undetected maintenance or manufacturing induced defect and a functional capability for
specified duration. Both the assumed defect size and the operational duration should be
specified by the procuring agency. The size of the defects typically dictated by the minimum
defect size detectable by production or in-service inspection methods. The period of damage
tolerance is often stated in terms of scheduled in-service inspection. It may be desirable to no
scheduled inspections during the design life. Since damage tolerance is conventionally stated
as an average capability, the magnitude of which is twice the minimum capability for forged
parts, the required period of damage tolerance operation is often stated as two design service
lives. This would insure a damage tolerant operation with minimum capability for one design
service life. The weight penalty that may be incurred to achieve this may not be feasible.
Therefore the period of average damage tolerant operation may be specified as equal to the
108
JSSG-2009A
design service life with a minimum damage tolerant capability equal to one-half (1/2) the design
service life. Scheduled inspections at one-half (1/2) the design service life could then be
conducted at the discretion of the user to ensure damage tolerant operation for the entire
service life.

In the past, damage tolerance of safety and mission critical components has been achieved by
damage tolerant design methods such as slow crack growth, leak before burst or composite
impact design. Slow crack growth can be assured by control of stress levels, choice of damage
tolerant materials, use of fracture mechanics methods, and manufacturing and process controls.
The key design assumption is that a low cycle fatigue crack is present at any or all surface or
subsurface locations in the most unfavorable location and orientation.
The MIL-STD-1798 for Mechanical Equipment and Subsystems Integrity Program can be used
for reference on relevant damage tolerance requirements for air vehicle subsystems. This
document was created to address damage tolerance and structural integrity concerns regarding
mechanical equipment and subsystems.

The damage tolerance requirements shall be verified by analysis and test.

Damage tolerant designs must be verified to ensure safety- and mission-critical functions will
actually be met.

Safety- and mission-critical requirements should be verified by analysis and tests that will
ensure continuation of the functions with the specified defects for the specified duration. Early
analysis and test will enable identification of and focus on structurally sensitive areas and will
minimize occurrences of deficiencies later in development. Final verification may be by
component or subsystem test.

(TBD)
109
JSSG-2009A
3.2.7.5 Strength.
Component strength shall be (TBS) .

(TBD)
TBS: The components within each subsystem should not exhibit permanent set due to flight,
ground, and limit load conditions.
In addition, the component structure should not temporarily deform to the extent that functional
performance is significantly degraded within the flight and ground operating envelope
conditions.
The components should not experience catastrophic failure when subjected to ultimate loads or
combinations of ultimate loading.

(TBD)
4.2.7.5 Strength.
Strength requirements shall be verified by (TBS) .

(TBD)
TBS: Verification of the strength requirements should be by analysis or test, or both.

a. Stress analysis. Stress analysis will determine the stresses, deformation, and margins
of safety resulting from the loads (including over speed, over pressure, burst pressure,
vibration, etc.) and environments imposed on both the electronic and mechanical
components of the subsystem.
The ability of the subsystem component to support the critical loads and to meet the
specified strength requirements and performance requirements will be established by
analysis. In addition, the stress analysis will be used as a basis for durability and
damage tolerance analyses, selection of critical component parts for design
development tests, material review actions, and selection of loading conditions to be
used in the subsystem structural test program.
110
JSSG-2009A
b. Stress testing (mechanical components only). Static load tests of components and
associated parts should verify that the static strength requirements are met. The applied
test loads, including ultimate loads should reflect those loads resulting from operational
and maintenance loading conditions.
(TBD)
Subsystems shall be durable and economically maintainable throughout the service life.

(TBD)
Limited life criteria should be established based on the optimization of durability life analysis
(which determines the repair and replacement interval from a structural fatigue or wear
standpoint), durability testing, an economic life analysis (which determines the optimum repair
and replace interval from a cost standpoint), or a weight impact analysis.
The provisions could allow for durability and economic life less than the design service life, but
must be incorporated into the subsystem unique integrity requirements.
Durability analysis should demonstrate adequate durability margins for safety critical, mission
critical, and durability critical subsystems to ensure that no structural failure will occur in one
lifetime; therefore, analysis should predict that no structural failures will occur for at least two
design service lifetimes.
Durability for mechanical components should be adequate to resist fatigue damage (cracking
and delamination), wear and deterioration, thermal degradation, and corrosion during
operational and maintenance use such that the operational and maintenance capability of the
subsystems is not degraded to functional impairment for the durability, and economic life.
Durability for electrical components should be adequate to resist vibration fatigue, thermal
fatigue, electrical derating, dielectric material failure, and corrosion during operational use such
that the operational and maintenance capability of the subsystems is not degraded to functional
impairment for the durability and economic life.
Subsystem durability and economic life should not be degraded by wear or deterioration of
components, elements, seals, and major bearing surfaces.
111
JSSG-2009A

The policy for propulsion system components has always been to base all material properties
on minimum material capability.
In the past, rolling element bearings in magnesium, aluminum, or composite housings have
been required to be installed in liners which are retained or locked by a positive method to
prevent rotational and axial motion.

The durability and economic life shall be verified by (TBS) .

(TBD)

TBS: The durability and economic life of subsystems should be verified by analysis and test.
a. Economic analysis. A life cycle analysis should be performed on components to
determine the optimum economic life from a cost standpoint. The result of this analysis,
which includes maintenance, spare part procurement, down time should define the
economic life of the subsystem.
b. Durability analysis. Analysis should be conducted to show that the durability life of the
subsystem is at least equal to the economic life. These analyses should verify that the
development of cracking, corrosion, wear, deterioration would not adversely affect
subsystem performance within the economic life of the subsystem. Durability analysis
should include the assumption of the average manufacturing defects for typical
manufacturing quality. Analysis should also be performed on the electronic assemblies
assuming the maximum undetectable manufacturing process defects for use in
sensitivity analysis and variability reduction.
c. Durability tests. Durability testing should be conducted to verify that the specific
durability requirements are met. The loading must simulate the major environmental and
operational spectrum, which influence failure. Any critical areas, not previously identified
by analyses or development tests, should be identified. Any special inspection and
identification requirements necessary to achieve the durability life could be derived from
this test.
Accelerated testing may be performed, if it is shown by analysis, test, or historical data
that the usage-environment-imposed produced damage levels equivalent to the damage
level produced by the usage environment as specified.
In all cases, installation details should be included. Test loads and environments should
represent the equivalent usage specified herein in representative sequence of
application, to simulate service. Test duration should demonstrate confidence in
112
JSSG-2009A
achieving durability and therefore should not be less than the equivalent of one times the
durability and economic life for electronic equipment, and two times the durability and
economic life for mechanical equipment. In no case should the test time be less than
one equivalent lifetime. The success criteria for durability testing are the completion of
one durability and economic life, as well as, meeting the operational periods without
maintenance associated with that life.
Failures caused by operator error, test equipment malfunction, or unrealistic test loads
should not be counted as a durability test failure. All failures should be analyzed and
appropriate corrective action taken.
Development testing should verify the durability life. The development tests should be
performed on selected sample configurations (production representative) and should
consist of production representative mounting designs and manufacturing processes.
Off-the-shelf hardware whose previous durability test levels have been analyzed as
meeting or exceeding the equipment’s environments and usage requirements may be
used without additional durability testing.

(TBD)
Corrosion shall not degrade the operational readiness or mission performance of the subsystem
during the service life.

This is a flowdown requirement from the JSSG-2001, “Environmental resistance”.
Subsystems should operate in the corrosion producing usage and environments as specified.
Corrosion that affects the operational readiness of the subsystems should not occur during the
service life for the usage and environment specified.
Corrosion prevention, including finishes, and coatings, should be resistant to surface damage
and should remain effective during the service life for the usage and environment specified.
The use of dissimilar metals in contact with each other should be suitably protected against
galvanic corrosion. Dissimilar metals are defined in MIL-STD-889.

(TBD)
113
JSSG-2009A
Corrosion protection and control measures shall be verified by (TBS) .

TBS: Corrosion prevention and control measures should be established and implemented in
accordance with the air vehicle corrosion control program; the criteria for the selection of
corrosion resistant materials, coatings, and finishes should be defined. Implementation of the
corrosion control program and analysis and testing necessary to meet specific requirements
within the program should verify that the corrosion control system provides resistance to the
environments specified.

(TBD)
Subsystems shall not fail when subject to the combined steady state and vibratory induced
stresses that occur anywhere within the operating envelope and during ground, flight, and
logistics operations.

(TBD)
The equipment should withstand vibration-induced stresses that occur throughout the air
vehicle-operating envelope and during ground, flight, and logistics operations for the
equipment’s durability and economic life for the usage and design environments at installed
location.
Potential flow resonances due to forced air or liquid cooling, and vibration coupled from the
structure into lower level assemblies should be considered.
For purposes of infinite life, table III represents standard design practice for HCF.
114
JSSG-2009A
TABLE III. High cycle fatigue.

MATERIAL LIFE (cycles)
7
Ferrous, Nickel-Base Superalloys 10 cycles
9
Titanium 10 cycles
7
Other Materials 3 x 10 cycles

(TBD)

It shall be verified that subsystems subjected to the combined steady state and vibratory
induced stresses that occur anywhere within the operating envelope and during ground, flight,
and logistics operations do not fail.

(TBD)

The durability and economic life analysis and tests should verify adequate life for the vibration-
induced fatigue life requirements.

(TBD)
Subsystems shall not fail when subject to the combined steady state and cyclic stresses due to
repetitive cycles whether thermally induced, induced by mechanical start and stop cycles or
both, or applied loads.
Low Cycle Fatigue is one of the most severe and costly problems encountered in service. The
intent of the requirement is to insure that the specified design considerations are applied to LCF.
115
JSSG-2009A
Common design practice is to design to at least two times the design service life. Components
should withstand low cycle fatigue throughout the operating envelope of the vehicle and during
ground, flight, and logistics operations for the durability and economic life for the specified
service usage and environment. Components must also withstand mechanical start and stop or
ground-air-ground (GAG) loading cycles.

(TBD)
Low cycle fatigue shall be verified by (TBS) .
The LCF lives must be verified to preclude the occurrence of part failures.
TBS: Verification should be by analysis and testing.

(TBD)
Dielectric materials when exposed to maximum predicted voltage shall not fail.

(TBD)
Dielectric materials used in the electronic equipment should be able to withstand the maximum
predicted voltage without failure when subjected to the electrical power spectra and
environment specified.

(TBD)
116
JSSG-2009A
Verification of specific dielectric materials when exposed to maximum predicted voltage shall be
by (TBS) .

(TBD)
TBS should be filled in with test and circuit tolerance analysis. Historical data may be used in
lieu of test.

(TBD)
3.2.7.6.5 Creep.
Subsystems shall not fail due to component creep. Part creep shall not interfere with
disassembly, reassembly or function of the subsystem.
Creep during service life must be accounted for to ensure that acceptable operation and
maintenance is not impaired.

One approach to accounting for creep is to specify a maximum allowable value. Common
design practice is to allow a value of 0.1 percent to 0.2 percent (0.1%-0.2%) elongation.

(TBD)
4.2.7.6.5 Creep.
Subsystems creep characteristics shall be verified by (TBS) .

Creep verification is required to ensure the subsystem can operate satisfactorily for the service
life.
117
JSSG-2009A

TBS: Design documentation inspection, analysis, or tests should verify compliance with the
creep requirement.

(TBD)
Transportability shall be in accordance with JSSG-2001, “Transportability”.
This is a flowdown requirement from the JSSG-2001, “Transportability”.
The transportability of the subsystems should be in accordance with JSSG-2001. Subsystems

should be suitable for installation and transportation on appropriate static and mobile ground
equipment.
In order to prevent contamination and hazards to personnel and equipment, cover plates have
been furnished for covering all drive openings when driven components were not to be mounted
for shipment. Suitable provisions for covering or plugging all other connection openings were
required to be made.
Transportability requirements shall be verified by (TBS) .
This is a flowdown requirement from the JSSG-2001, “Transportability”.
TBS: Verification should be by analyses or test or both.

(TBD)
118
JSSG-2009A
Hardware and software, when required by the AVSS, shall be provided to monitor and record
subsystem performance during flight and ground operation, and to provide data in an organized
format for ground analytical condition checkout capability, component life tracking (if required),
warranties, and scheduling maintenance actions. The malfunction of any diagnostic hardware or
software shall not affect subsystem performance or operability. The diagnostic capability shall
be compatible with the air vehicle maintenance system. The subsystem diagnostic system shall
be completely functional after failure of any other subsystem or subsystem component.
This is a flowdown requirement from the JSSG-2001, “Integrated diagnostics”. Diagnostic

capability monitors and records subsystem status.
The diagnostic system should be compatible with organizational, intermediate, or depot

maintenance, depending on the level of maintenance that will retrieve and use the data. It may
be completed by the using service to drive the design if a firm maintenance concept has been
established, or the contractor may complete it to allow greater flexibility in optimizing the design.
Diagnostics should be an integral part of the subsystem maintenance system and should be
compatible with both the air vehicle data collection and ground support systems. Diagnostic
data may or may not be retrieved through the air vehicle system, and the description should
state whether or not the air vehicle system is used. All air vehicle subsystem interfaces should
be described in the interface section of this specification. The contractor should describe the
components included as part of the subsystem diagnostic system (such as subsystem data
collection box and sensors, and if applicable, the air vehicle data collection system and ground
support, data transfer system). A detailed description of the diagnostic system is not necessary,
but a sufficient system level description is needed so that the using service and contractor
understand the system’s capability.
The subsystem diagnostic system should include installed airborne equipment, ground
equipment, flight line support equipment, intermediate level support equipment, depot support
equipment, technical publications, manual inspections and personnel required to accomplish the
complete task. However, collecting data is only a small part of the system approach required to
develop an effective diagnostic system. Some details to be considered in the design are the
sensors, signal conditioners, data processor, data storage, crash survivability, data exchange
rate(s), air vehicle mounting, ground based processing station, and programming language.
There has been considerable proliferation of diagnostic ground support equipment. It is

generally recognized that the airborne diagnostic equipment will be somewhat application
unique, but the ground equipment required to extract, transmit, process, and distribute the data
can be adaptable to the application.
Diagnostic system software algorithms and instrument range, system accuracy, time response,
sample rate, and electrical characteristics for each parameter should be provided to the using
service.
119
JSSG-2009A
The USAF has had numerous experiences with engine monitoring systems that did nothing
more than collect data. The data that were collected could not be reduced into useful
information, and some of the more important parameters were not collected.
Integrated diagnostics requirements shall be verified by (TBS) .
This is a flowdown requirement from the JSSG-2001, “Integrated diagnostics”. Verification is

required to assure user needs are satisfied.
TBS: Integrated diagnostics requirements should be verified through a combination of

analyses, inspections and demonstrations.
An analysis should be performed to show that faults can be detected and isolated using a
combination of Startup BIT (SBIT), Periodic BIT (PBIT), Initiated BIT (IBIT), ancillary tools and
test equipment, or computer assisted manual procedures.
It is important that the diagnostic system tested on the subsystem ensures that the system
works properly. An important function of the test should be to establish thresholds for
determining out of range faults, verifying when false faults occur, determining if signal noise is
present, and revealing other problems that may occur. Flight-testing is needed since that is
when the true diagnostic environment and usage will concur.
The contractor should select and demonstrate a number of these fault detection and isolation
procedures.
(TBD)
Diagnostics shall provide (TBS) percent detection and isolation of all faults. The on-board
subsystem diagnostics shall provide fault detection and isolation to the faulty LRU/WRA as
required to meet the reliability and maintainability requirements of JSSG-2001. Subsystems
shall be compatible with the mission critical functions of the on-board diagnostic system that
monitors mission and safety critical parameters. The on-board subsystem diagnostics shall not
cause failure of any other mission or safety critical system.
120
JSSG-2009A
Subsystem diagnostic fault detection and isolation capabilities and equipment and maintenance
effects necessary to accomplish these functions need to be specified.
TBS: Fault detection and isolation rate should be between 90-100 percent (90-100%),
depending on the system. However, for ground based fault detection systems, the fault
detection rate should be between 95 and 100 percent (95-100%).
The list of functions may include; the on-board subsystem diagnostics, inspections, results from
processed diagnostic data, and troubleshooting (automated, computer assisted, or manual).
The goal is to have the on-board system identify any faulty LRU/WRA and have maintenance
personnel only conduct minor troubleshooting tasks on the ground. A higher percentage of the
fault detection and isolation should be accomplished through automated processes to save
maintenance work hours. Evaluating the problem in the field through diagnostics can also save
depot rework hours and other supply costs by reducing the number of “cannot duplicate”
occurrences. Diagnostics should be compatible with existing subsystem maintenance systems,
Core Automated Maintenance System (CAMS), Naval Aviation Logistic Data Analysis (NALDA),
and Aviation Maintenance - Materials - Management System.

(TBD)
Fault detection and isolation shall be verified by (TBS) .
Verification is required to assure diagnostic usefulness as a maintenance, performance

trending, and warranty tool.
TBS: Fault detection and isolation requirements should be verified through a combination of
analyses, inspections, tests and demonstrations.
Testing should be performed throughout the development cycle and should include qualification
testing, test cell testing, and flight-testing. The flight-testing should evaluate the effectiveness of
the entire system including airborne equipment, ground equipment, and data output product
usage. Flexibility of diagnostics during flight-testing should be maintained so that changes can
be made to the system to ensure it is a useful maintenance tool.
121
JSSG-2009A
Many diagnostic systems have been tested from a functional standpoint and adequate hardware
testing has also been performed. However, the software area has been neglected, resulting in
problems after fielding. These problems were due to “bugs” that were not discovered during
functional testing, but surfaced when the system became operational. Thorough testing of the
software is necessary to prevent this from happening.

Subsystems equipment, assemblies, modules, and parts shall be marked legibly with
machine/man-readable markings per MIL-STD-130 and such that component removal is not
necessary to read the data plate. The machine-readable markings are required for parts whose
cost exceeds five thousand dollars, parts that are serially managed, or parts that are mission
critical. These markings shall be as permanent as the normal life expectancy of the item and be
able to withstand the environmental tests and cleaning procedures specified for the item to
which they are affixed. The type and length of product identification characters on the data plate
shall be compliant with MIL-STD-130 and applicable requirements documents referenced
therein for format compatibility. The contractor shall upload the Item Unique Identification (IUID)
assigned numbers and information into the Government UID (Unique Identification) database
according to the Using Service’s guidance and procedures.
All subsystem components require marking or identification. The maximum number of digits or
characters must be limited due to computer limitations used for inventory and logistical control.
ASME Y14.24, ASME Y14.34, ASME Y14.35M, ASME Y14.100, and the most current version of
MIL-STD-130 should be used for guidance. Night vision goggles preclude the need for red
lighting. Whenever possible, the markings should be visible through normal access openings on
the subsystem and aircraft. Modern subsystem programs are moving towards the use of
2-dimensional (2D) markings. ATA Spec 2000, DoD IUID, or other ISO specifications marking
capability can be used for reference.
Components have had to be removed to examine nameplates and markings during inspection
and maintenance due to the poor placement of those markings. The limitation on number of
characters in the part number was identified as impacting select DoD Weapon System
programs.
122
JSSG-2009A

The requirement of 3.2.10 shall be verified by inspection.
Verification of man-readable property marking or identification can be accomplished only by

inspection.
Verify completeness, accuracy, and visibility of the information supplied. Verify machine-
readable information was obtained with properly-calibrated barcode verification equipment.
Machine-readable information must be verified by the supplier through use of a verification
process that ensures conformance to the grading requirements of MIL-STD-130.
(TBD)
Design and construction shall be in accordance with JSSG-2001.
REQUIREMENT RATIONALE (3.3)
REQUIREMENT GUIDANCE (3.3)
Materials, processes, and part integrity, electromagnetic environmental effects, including

electromagnetic compatibility, lightning (for example direct and indirect, grounding and bonding,
electrostatic discharge, hazards of electromagnetic radiation, TEMPEST, high power
microwave, precipitation static) should be considered and specified accordingly.
REQUIREMENT LESSONS LEARNED (3.3)
(TBD)
Design and construction requirements shall be verified by (TBS) .
VERIFICATION RATIONALE (4.3)
123
JSSG-2009A
VERIFICATION GUIDANCE (4.3)
TBS: Design and construction should be verified by test, demonstrations, inspection, and
analysis.
VERIFICATION LESSONS LEARNED (4.3)

(TBD)
Subsystem equipment, which is to be interchangeable and the level of interchangeability shall

be defined.
It is desirable that all equipment having the same part number be interchangeable to reduce
logistic support requirements, minimize maintenance and repair problems, and assure that
subsystem performance and operability are not compromised.
Subsystem equipment, which has been identified as being interchangeable, having the same
manufacturer’s part number should be functionally and physically interchangeable and should
meet all applicable subsystem performance, operability, and durability. Matched or selective fits
may be permitted where necessary to meet design requirements. The use of matched and
selective fits should be held to a minimum. A list of non-interchangeable, matched, and selective
fit equipment should be identified and submitted to the using service during the subsystem
development program to focus attention on these exceptions and force early, improved design
changes.

(TBD)
Interchangeability shall be verified by (TBS) .
Testing and demonstrations are required to evaluate the functional and physical
interchangeably of subsystem equipment.
TBS: Interchangeability requirement should be verified by testing and demonstrations.
124
JSSG-2009A
Interchangeability of subsystem equipment may be evaluated during the course of routine

assembly, maintenance, and testing. Documentation of this evaluation is recommended to
insure complete coverage of all equipment.

(TBD)
It shall not be possible to misconnect electrical or fluid inputs or outputs with like items from the
same or other subsystem equipment.

(TBD)

(TBD)

(TBD)
Non-interchangeability shall be verified by (TBS) .

(TBD)

(TBD)

(TBD)
3.3.3 Safety.
Subsystem safety features shall be provided to optimize the safety of the pilot, maintenance,
and support personnel within the constraints of operational effectiveness, time, and cost.

125
JSSG-2009A
Subsystems should incorporate features to eliminate or control all identified hazards to

acceptable levels of risk and prevent mishaps. Hazard risk acceptability criteria should be
defined. Features should be provided to minimize the number of occurrences of logistics and
operations related mishaps.
Pilot and maintenance personnel should be protected from all identified hazards (for example
toxic and corrosive substances, electrical and mechanical hazards, extremes in temperature,
and hazardous radiation and acoustical hazards). Subsystems should provide personnel
protection in accordance with MIL-HDBK-454, Requirement 1. The MIL-STD-1472 paragraph
on “Hazards and Safety” (5.13) should be used as a guide.
Subsystem hazards should be eliminated or controlled to acceptable levels of risk in accordance

with the requirements of paragraph on “Risk assessment,” “Hazard severity,” and “Hazard
probability” (4.5 through 4.5.2) of MIL-STD-882. The hazard risk assessment matrix contained
in the air vehicle System Safety Program Plan should be used to determine risk acceptability.

(TBD)
4.3.3 Safety.
Subsystems safety features to optimize the safety of pilot, maintenance, support personnel, and
the air vehicle shall be verified by (TBS) .

TBS: Subsystem safety features to optimize the safety of pilot, maintenance support personnel
and the air vehicle should be verified by analyses, inspection and test, as applicable.
Engineering drawings, diagrams, specifications, and safety hazard analyses should be
inspected to assure that functional safety relationships have been identified, that all identified
hazards have been eliminated or controlled to an acceptable level, and that safety design
features have been incorporated including features to minimize operations- and logistics-related
mishaps. Preliminary Technical Orders (T.O.s) should be analyzed during validation to assure,
prior to use, that appropriate cautions, warnings, notes, inspection provisions, and special
emergency procedures have been incorporated and are consistent with those developed by the
system safety analyses. Test data should be inspected to determine the existence of previously
unidentified hazards and to evaluate the sufficiency of established safety provisions.
Protection of pilot and maintenance personnel from all identified hazards (for example, toxic and
corrosive substances, electrical and mechanical hazards, extremes in temperature, radiation
126
JSSG-2009A
and acoustical hazards) should be verified by safety hazards analysis, inspection and test, as
applicable.

(TBD)
Subsystem safety criteria shall be defined.

(TBD)
The appropriate level of redundancy for subsystem operation should be determined. The
system should provide the specified level of redundant operation. For example, the subsystem
could either fail-safe or fail to operate.

(TBD)
The defined safety criteria shall be verified by (TBS) .

(TBD)

(TBD)

(TBD)
Subsystem tolerance of foreign object damage shall be defined.
127
JSSG-2009A

(TBD)
Subsystem design should treat tolerance of FOD as a prime concern, to the greatest extent
practical, consistent with other requirements such as cost, weight and space.

(TBD)
Defined subsystem tolerance to FOD shall be verified by (TBS) .

(TBD)

(TBD)

(TBD)
Air vehicle subsystem Software Safety Critical Items shall be identified and separated or
partitioned from other less critical software.

(TBD)

(TBD)

(TBD)
128
JSSG-2009A
It shall be verified that air vehicle subsystem Software Safety Critical Items are identified and
separated or partitioned from other less critical software (TBS) .

(TBD)

(TBD)

(TBD)
The contractor shall establish acoustic noise level limits for noise producing or noise
transmitting air vehicle subsystems required to meet the acoustic noise level limits for air vehicle
established in JSSG-2001.

This is a flowdown requirement from JSSG-2001. Many aircraft subsystems produced
significant noise. It is important to establish noise levels consistent with air vehicle requirements
in order that the requirements be considered during the design phase of the subsystems.
Correcting noise problems after the air vehicle and its subsystems are already designed can be
costly and have impact on volume and weight constraints.

Noise transmitting portions of subsystems, such as ECS ducts that supply the occupied
compartments, must be considered.

SAE AIR 1826 provides excellent guidelines for acoustical considerations in the design of ECS.
Much of it is applicable to other subsystems as well.
Acoustic noise levels shall be verified by (TBS) .

(TBD)
129
JSSG-2009A

(TBD)

(TBD)
Subsystem electromagnetic environmental effects shall be in accordance with the JSSG-2001.
The Defense Standard MIL-STD-464 requirements should be applied directly to the

subsystems. The architecture of the air vehicle plays an important role in determining the
electromagnetic interaction between onboard items and translation of external environment
stresses (including lightning, external RF fields, and electromagnetic pulse (if required)) to
internal stresses at the electrical interfaces of onboard equipment. This flowdown is generally
based on transfer functions of the external stress outside the air vehicle to internal stresses
expressed as electrical cable currents or field quantities, which are included as part of the
electromagnetic interference (EMI) JSSG-2001 requirements. The Defense Standard MIL-STD-
464 contains detailed rationale, guidance, and lessons learned information for the requirement
areas addressed in subsequent subparagraphs.
Emphasis on systems engineering aspects of E3 is important. In the past, the E3 area was often
viewed as a test and fix effort with little influence on the actual design at the air vehicle level.
With the proper performance of electronics playing a more important role for safety and mission
completion and the extensive use of composite materials in air vehicle structure, it is essential
that the response of the air vehicle to external electromagnetic stresses be analyzed,
understood, and translated into EMI requirements for the subsystems.
The types of requirements, placement of limits, and applicable frequency ranges in MIL-STD-
461D are based on lessons learned on past programs. MIL-STD-461D includes an appendix to
explain the rationale for the requirements and to provide guidance in tailoring the requirements.
There had been a great deal of misunderstanding and confusion in the past regarding MIL-STD-
461D requirements.
Electrical bonding is often one of the first areas reviewed for adequacy when a electromagnetic
compatibility problem develops at the air vehicle-level. Some problems have been fixed simply
by improving the bonding. The actual need for a certain level of bonding is dependent on a
number of issues including shielding topology, type of circuit interfaces, and ground referencing
130
JSSG-2009A
of circuits to the electronics enclosures. The increasing use of differential circuit interfaces
make bonding somewhat less critical because of the better rejection of common mode signals.
Problems have been found on air vehicle from ground loop currents in the electrical power
system coupling into low frequency circuits. Modification of the current return path normally
fixes the problem.
Lightning protection of air vehicle in the past was mostly concerned with direct effect issues to
fuel systems, control surfaces, antennas and radomes. With the increased importance of
electrical and electronic systems onboard air vehicle due to the dependence on these items to
keep the air vehicle flying and to complete missions, indirect effect protection has been
receiving much more emphasis. Also, the use of composite materials in airframe results in
much larger electrical stresses appearing on electrical interfaces internal to the air vehicle
during a lightning event.
The electrical circuit internal to an electrically initiated device is usually a small resistive element
termed a bridgewire. The general concern with electroexplosive circuits is heating of the
bridgewires from induced currents caused by electromagnetic fields potentially resulting in
inadvertent initiation. Some of the factors involved in potential initiation are transmitter power
output, modulation characteristics, operating frequency, antenna characteristics,
electroexplosive wiring configuration (shielding, length, and orientation) and the thermal time
constants of the bridgewire.
The E3 performance of the subsystems shall be verified through a combination of inspection,

analysis and test.
Electromagnetic environmental effects requirements should be verified through an incremental

verification process. ”Incremental” implies that verification that E3 requirements are met in a
continuing process of building an argument (audit trail) throughout development that the design
satisfies the imposed performance requirements. Initial engineering design must be based on
analysis and models. As hardware becomes available, testing of components of the subsystem
can be used to validate and supplement the analysis and models. The design evolves as better
information is generated. When the subsystem hardware is available, inspection, final testing
and follow-on analyses complete the incremental verification process.
It is important to note that testing is often necessary to obtain information that may not be
amenable to determination by analysis. However, testing also is often used to determine a few
data points with respect to a particular performance requirements with analysis (and associated
simulations) filling in the total picture.
131
JSSG-2009A
A tri-service and industry-working group issued the ”D” revision of MIL-STD-462 in January
1993. This group considered many of the lessons learned from past problems with
electromagnetic interference testing and incorporated required changes into the document.
One important area is that the testing is generally better related to measurable and predictable
physical parameters at the air vehicle-level, such as bulk cable currents induced from
electromagnetic fields outside the air vehicle and electrical power quality. MIL-STD-462
contains an appendix which provides guidance on electromagnetic interference testing.
Powerline filtering arrangements in equipment can result in hazardous voltages on the

enclosure if the safety ground is disconnected. Typically, filters will be present on both the high
and return sides that will have capacitance to chassis. If the chassis is floating with respect to
earth ground, the capacitors act as a voltage divider for AC waveforms with half the AC voltage
present on the case with respect to earth. The value of the capacitors determines the amount of
current that may flow.
A concern with safety ground wire routing inside electronic enclosures is the possibility of
creating a coupling mechanism for conducting interference emissions out of the enclosures with
subsequent re-radiation or conducting induced levels from electromagnetic fields into the
enclosure. To ease this concern, safety ground wires should be grounded inside the box in as
short a distance as possible and should be kept away from other wiring.
Flight testing of an air vehicle often begins prior to verification of immunity of the vehicle to
lightning. Under this circumstance, the flight test program must include restrictions to prohibit
flight within a specified distance from thunderstorms, usually 25 miles. Lightning flashes
sometimes occur large distances form the thunderstorm clouds.
Instrumentation used to monitor induced levels and demonstrate safety margins during
electroexplosive subsystem testing needs to effectively simulate the response of the actual
electroexplosive devices. Important parameters are maintaining the electrical impedance of
electroexplosive devices, including their thermal time constants (heating characteristics of the
bridgewires) in assessing responses, and considering the response times of the
instrumentation.
132
JSSG-2009A
Standardization principles shall be used to the maximum extent possible without compromise in
design, performance, operability, or economic life of the subsystem.
This is a flowdown requirement from the JSSG-2001.
Government or industry standard parts should be used whenever possible and identified by their
standard part numbers. Items already in the Government inventory should be used to the
maximum extent possible where suitable for the intended purpose. Variation in similar
components or parts should be held to the absolute minimum. Proprietary designs should be
kept to a minimum. Where general-purpose standards are used in critical or high strength
applications, parts should be identified by the manufacturer’s part number. Parts derived from
general purpose standards or Government standards solely on an inspection or selection basis
should be identified by contractor part numbers and all previous identification marks should be
removed.
Government and industry standards and parts developed specifically for a particular type of
subsystem should be used unless they are unsuitable for the intended purpose.
Standard screw thread forms should be used whenever possible. Taper threaded plugs should
not be used in castings and nonferrous parts. Tapered pipe threads may be used only for
permanent plugging of drilled passages or openings in steel.

(TBD)
The application of standardization principles shall be verified by inspection.
Design documentation should be inspected for compliance with the standardization

requirement.

(TBD)
133
JSSG-2009A
Environmental requirements for the Air Vehicle Subsystems shall be those specified in the Air
System Joint Service Specification Guide, JSSG-2000, “Environmental,” as applicable.
Rationale for the need for environmental requirements is explained in the Air System JSSG
Handbook, JSSG-2000.
Guidance for implementation of environmental requirements is included in the Air System JSSG
Lessons learned to justify the need for environmental requirements can be found in the Air
System JSSG Handbook, JSSG-2000.
Environmental verification requirements for the Air Vehicle Subsystems shall be those specified
in the Air System Joint Service Specification Guide, JSSG-2000 “Environmental Verification,” as
applicable.
Rationale for the need for verification of environmental requirements is explained in the Air
Guidance for implementation of verification of environmental requirements is included in the Air

Lessons learned to justify the need for verification of environmental requirements can be found
in the Air System JSSG Handbook, JSSG-2000.
134
JSSG-2009A
3.3.7 Health.
Health requirements for the Air Vehicle Subsystems shall be those specified in the Air System
Joint Service Specification Guide, JSSG-2000, “Health,” as applicable.
Rationale for the need for health requirements is explained in the Air System JSSG Handbook,
JSSG-2000.
Guidance for implementation of health requirements is included in the Air System JSSG
Lessons learned to justify the need for health requirements can be found in the Air System
JSSG Handbook, JSSG-2000.
4.3.7 Health.
Health verification requirements for the Air Vehicle Subsystems shall be those specified in the
Air System Joint Service Specification Guide, JSSG-2000, “Health verification,” as applicable.
Rationale for the need for verification of health requirements is explained in the Air System
Guidance for implementation of verification of health requirements is included in the Air System
Lessons learned to justify the need for verification of health requirements can be found in the Air
135
JSSG-2009A

The following designs shall be applied to subsystem installations:
a. Subsystem installation and associated equipment designs shall be such that normal
operation of the subsystem will not contribute to or result in fire and explosion hazards.
b. Subsystem installations and associated equipment designs shall be such that fire and
explosion hazards due to failure or accident are minimized.
c. Subsystem installation boundaries common to the air vehicle exterior shall be designed
such that fire will not readily spread between subsystems due to the natural airflow over
the air vehicle.
Good subsystem installation design includes the consideration of fire and explosion.

Dump provisions. Fuel system dump provisions should be designed to direct the dumped fuel
away from the air vehicle. Also, should be designed so that dumped fuel will not impinge on any
part of the air vehicle so that fire and explosion hazards will not result, and that dumped fuel will
not re-enter the air vehicle, during any known mission attitude. Location and design of the
dump provisions (mast, chute) should be based on sound aerodynamic considerations. This
guidance also applies to other flammable fluid dump systems.
Protrusions. Powerplant installations should consider the possibility of protrusions into the
airstream acting as flame holders. Under high airflow conditions, protrusions into the airstream
can cause air pockets. In the event of fire, these protrusions may hold isolated flames which
may persist and cause reignition after the extinguishing agent is used. This problem is
associated with both main engines and ancillary units and may be alleviated by the use of
smooth aerodynamic design on the interior and exterior of nacelle installations and the interior
of compartment installations.
Subsystem installation and associated equipment designs should include provisions that will
protect system components, fluid carrying lines and electrical wiring from interference with each
other or the air vehicle structure, or bulkheads, and prevent damage to them. Chafing of lines
and wiring against each other, or the structure can lead to fire and explosion hazards through
leaks in combustible fluid and vent lines and the destruction of the insulation on electrical lines.
Lines and wiring should be properly spaced to prevent interference that will cause the noted
damage. Secure mounting provisions should be used. Resilient material has been used to
protect lines and wiring where they pass through bulkheads. A careful analysis of potential
interference and chafing areas is important to the provision of a safe installation.
System lines and wiring should be routed as directly as practicable to minimize the occurrence
of fire or explosion hazards. This design is applicable to both fluid carrying lines and electrical
wiring. Where practicable, routing flammable fluid system lines through tanks and routing
flammable fluid lines and electrical wiring internal to components will reduce the potential
hazards that may result from fitting failure or line or wiring damage. The intent is to minimize
136
JSSG-2009A
the length of system and equipment lines and wiring that may be subject to damage or that may
fail from normal or accidental means and present fire and explosion hazards through the
uncontrolled presence of flammable fluids, ignition sources, or oxidizers or reducing agents.
Sharp bends and restrictions in fluid lines should be avoided. Tubing should not be installed in
a stressed condition. Tubing installations should be configured so that vibration or deflection of
the tubing attaching structure should not result in tubing damage. Flexible fluid line connections
should be used between the structure and engines and on similar type installations.
The doors for wheel wells and other similar openings should be designed to seal tightly upon
closure to prevent rearward streaming fire from entering and igniting combustible materials
within these compartments.
Oil, hydraulic, and water-alcohol tanks have been designed to withstand a 2000 Deg. F fire for
10 minutes without leakage. Oil, hydraulic, and water-alcohol tanks in compressor sections of
engines have been kept, as far as practicable, toward the front of the compressor and were
located as low as practicable. These have not been located adjacent to burner, turbine, and
tailpipe areas. Oil tanks for auxiliary power plants have been designed to withstand a
2000 Deg. F fire for 10 minutes without leakage.
Magnesium has not been used (see Design and Construction of Aircraft Weapon Systems, SD-
24, Vol. I and Vol. II).
Aluminum alloy has not been used within or close to a potential fire zone for structure or
equipment, the breakdown of which will endanger the integrity of the air vehicle structure or
controls necessary for flight, jeopardize the controllability of the air vehicle, or cause hazardous
spread of fire.
Insulation has been nonabsorbent as a material, or as a material configuration, and designed

and installed so that fluids were not retained on or under it.
Nonmetallic material which is combustible has been used only when use of more fire-resistant
material is impractical. Nonmetallic material should not ignite spontaneously under all
environmental temperatures of installation, and it should be self-extinguishing after removal of a
flame. When used in potential fire zones with fire extinguishing capabilities, it should not
afterglow.
Metallic shock-absorbing elements has been used in potential fire zones, whenever practical,
instead of elements made of elastomeric material. When metallic shock-absorbing elements
could not be used, the elements were designed so that the supported components remained
adequately supported and continued to function effectively, in spite of failure of the nonmetallic
material in the mounting system due to fire.
All nuts, bolts, and fasteners in burner, turbine, and exhaust sections which can cause leakage
of flammable fluid, when loose, have been safety-wired or otherwise mechanically locked.
137
JSSG-2009A
Flammable Fluid Subsystems
Location of fuel tanks above engine compartments has been avoided. If fuel tanks were located
above engine compartments for justifiable reasons, provisions were made to prevent leakage of
fuel into engine compartments or onto exhaust systems. A ventilated and drained space has
been provided between fire wall and tank to afford safe disposal of any fuel leakage from the
tank. Insulation was also provided, if necessary, to prevent ignition within the tank, or in the
shrouded air space, in case of a power plant fire.
Flammable fluid lines in potential fire zones has been reduced to a minimum total length and a
minimum number of connectors. They were arranged as low as practical in the compartment
and away from potential fire sources.
Flammable fluid accessories have been located in potential fire zones only when justifiable
reasons for such locations existed. Flammable fluid accessories which were located in potential
fire zones were designed so that not more than 0.5 gallons of flammable fluid were likely to be
released into an existing fire, as a consequence of an existing fire, within the first five minutes of
a fire. If necessary to accomplish this, flammable fluid accessories have been able to withstand
a flame of 2000°F (1093°C) for five minutes, or flow restrictions were provided, where feasible.
Simultaneous leakage from multiple accessories or tanks is not likely to be released into an
existing fire if accessories or tanks are located remote from each other and so that spread of fire
to both accessories and tanks is unlikely.
Fuel tanks have been located laterally as far from the plane of the propulsion engine turbine as
possible. If fuel tanks were located in the plane of the turbine for justifiable reasons, the turbine
was tested for blade containment up to a speed which produces kinetic energy of the maximum
allowable overspeed of the engine, or strategic armoring around the turbine was provided.
Fuel tank location has been avoided in an area within plus or minus 5 degrees of propeller
planes.
Fuel tanks with walls adjoining the free atmosphere has been avoided in protrusions and
extremities of the aircraft, and in areas less than 12 inches from leading edges and trailing
edges for reasons of lightning protection. Fuel tanks located in these areas for justifiable
reasons, were protected against lightning. Fuel has not been stored in fore or aft extremities,
such as in the nose of the fuselage, or in the nose or aft cone of a wing tip tank.
Fittings have been located above the fuel level, preferably on top of the tank whenever
practicable. Fuel tank shutoff valves have been located as near to the fuel tank outlets as
possible. This location provided the greatest protection against battle damage and fuel line
leakage. If practicable, filler caps, vents, gage units, outlets, etc., were incorporated in one
inspection plate at the top of the tank. Fuel tank fittings in or close to the bottom of the aircraft
were avoided, or provisions were made to minimize the hazards of tank rupture in a crash
landing or due to gunfire.
Fuel lines were routed through fuel tanks and close to heavy structure, wherever possible, to
provide the greatest possible protection against combat damage, and fire hazard resulting from
line leakage. Metallic tubing has not been in contact with the walls of self-sealing tanks, and
138
JSSG-2009A
fuel tank fittings were located that they are as well protected against battle damage as
practicable. Fuel tank fittings have been located as high as practicable in the tank so that battle
damage to a fitting causes a minimum of fuel loss. Fuel tanks have not been located
immediately adjacent to gun compartments; they were separated from such compartments by at
least one liquid and vapor-tight bulkhead in addition to the tank boundary structure. Fuel tank
shutoff valves have been integral with or as close as possible to the tanks. The fuel sequencing
from multiple fuel tanks has been arranged to result in lowest vulnerability to battle damage.
Self-locking units utilizing nonmetallic locking devices have not been used in oil tanks because
of loss of locking characteristics through oil and heat. Nonmetallic have not been used on
tanks containing flammable fluids where frequent threading of the nuts is required.
Bladder cells have been supported by the tank cavity so the bladder is not required to withstand
fluid loads. Negative loads on bladder cells has been avoided by proper vent size and design.
Interior surfaces of bladder cell cavities should be smooth and free of projections which could
cause wear of the bladder, unless provisions are made for protection of the bladder at such
points of unless the construction of the bladder itself provides such protection. Tank fittings and
accessories should have been mounted so that their loading is transmitted to the structural
cavity. The bladder has been sized to fit the cavity without clearance. The tank cavity has
been liquid and vapor-tight, and drained.
Metal structural members such as stiffeners, hat sections, etc., have been kept to a minimum in
cavities for rigid nonmetallic self-sealing tanks. The minimum clearance between metal
structure and the tank has been one inch. However, it may be necessary to use the tops of
stringers for tank support to maintain tank shape. The above requirements with regard to
surrounding structure do not apply to the top surface of the tank. The tank cavity has been
liquid and vapor-tight, drained and ventilated.
All surface of the tank cavity of flexible self-sealing tanks, other than the top surface, have been
lined with plastic panels conforming to MIL-P-8045. The tank cavity has been liquid and vapor-
tight, and should be drained. The cavity structure and the plastic panels have withstood the
forces produced by the passage of projectiles, specified in MIL-T-5576, 4.6.12, through the
confined liquid to such a degree that no additional hazards evolve.
Unsupported sections of lines carrying flammable fluids whose natural frequency would be such
that dangerous amplitudes of vibration might occur in operation have been avoided. Rubber
lined clamps, such as MS21919, have been used to support metal tubing and hoses. Chafing of
lines has been prevented by clamping, or in bulkheads or other structure by grommets.
Grommets, however, have not been used for support of rigid lines. Grommets in firewalls have
withstood a flame of 2000ºF for 15 minutes without flame penetration in installed condition.
Lines have not been supported from each other.
Cut hose and clamps have not been used in any part of a flammable fluid system. Hose
assemblies have been protected by shielding or other means against temperatures in excess of
the maximum specified allowable temperature for the particular hose.
139
JSSG-2009A
Tubes, carrying flammable fluid, with below standard radii have not been used. Tubes have
been provided with bends or other expansion means to avoid rupture during normal services, or
during a fire if located in or close to a fire zone.
Lines have had as few joints as possible, consistent with economical installation requirements.
Fittings for hoses and tubes 3/8-inch I.D. and smaller have been made of steel.
Flammable fluid lines in wheel wells have been installed to have the maximum protection
against rocks, frozen mud or exploding tires.
Excessive internal pressure in components carrying flammable fluids, during normal service, or
during exposure to a fire, if located in a potential fire zone, have been prevented by positive
means.
All filler units for tanks containing flammable fluids, both gravity and pressure fueling type, which
are recessed behind access doors, have incorporated positive provisions whereby the access
doors physically were not secured unless the filler cap or safety cap was properly installed.
Unless specifically authorized, all filler units were sealed to the exterior of the aircraft against the
entrance of flammable fluids or vapors to the interior of the aircraft. If necessary, filler basins
(scuppers) were provided with drains of at least 3/8-inch I.D. The scupper was adequately
sealed to the surrounding structure to prevent spilled fluid from entering the fuselage, engine
compartment, or wing. The cap incorporated provisions for positive locking. Filler caps were
designed so that visual inspection of the installed cap from a distance of at least 10 feet in
daylight gave positive indication that the cap was properly and positively locked in the closed
position. An electric ground receptacle for grounding pressure and gravity fueling nozzles,
conforming to MS 33645, was installed, with the exception that the receptacle was located:
(a) not more than 20 inches or less than 5 inches from the adapter, and (b) not near fuel vents
or openings.
If dipsticks were used in fuel tanks which have provisions for pressure fueling, they were either
made of material which is electrically nonconductive and does not retain an electrostatic surface
charge, or they were contained in an electrically conductive sheath, made of metal screen or
perforated tube, or any other suitable design, which was electrically bonded to the metal filler
adapter and carries away static charges rapidly from the fuel surface in the vicinity of the
dipstick.
All vent and drain exits which carry flammable fluids and vapors overboard were arranged such
that there is no impingement on the aircraft under any normal condition or aircraft operation.
Vent discharge, drain discharge, fueling and defueling nozzles were not located in close
proximity to fittings for air crew oxygen replenishment, engine start and electric power cable
connections. Where the prevention of impingement was impractical, there was no re-entry of
the flammable fluid or vapor into aircraft spaces where a possible source of ignition existed,
considering seams which might “open” during normal operation of the aircraft, throughout the
service life of the aircraft. Further, fuel tank vents were installed so that fluids discharged will
not contact ground equipment normally parked about the aircraft, when servicing the aircraft.
Fuel tank vent exit configurations should such that they do not protrude from the surface of the
aircraft whenever there is a possibility of a lightning clinging on to the exit and causing a flame
propagation to the tank, or adequate protection against lightning should be provided. Vent and
140
JSSG-2009A
drain exits permitted free drainage of fluid from the lines without wetting the skin when the
aircraft is standing on the ground. The line exits were sealed at the aircraft around the
periphery of the line to prevent entrance of fluid or vapor into the aircraft. Vent and drain
discharge were away from engine and rocket exhaust, to the extent necessary to prevent flame
propagation into drained and vented compartments. Fuel tank vent exits were located so that
fuel vapors are not likely to enter areas in the fuselage, wing and power plant during fueling.
Vent line exits for fuel tanks which have provisions for pressure fueling were designed so that
inadvertent blocking of the vent exit by masking tape or by stoppers used for system leakage
checks, was eliminated to the greatest practical extent.
The support structure of tanks containing flammable fluids was designed such that the stresses
in the tank are low. Support in padded cradles is recommended, whenever practicable.
Material for padding was nonabsorbent, and fuel and oil resistant. Supports of tanks containing
flammable fluids, which are located in engine compartments were designed to withstand a
2000ºF fire for 10 minutes without failure. The tank support pads have been able to withstand a
2000ºF fire for five minutes without losing the ability to retain the tank in position under normal
flight loads.
Airscoops into potential fire zones were located and constructed so that flammable fluids and
vapors, or flames, cannot enter a potential fire zone under any reasonable flight attitude.
Electrical Subsystems
Electric equipment was located in potential fire zones only when justifiable reasons for such
location exist.
All electric equipment, and all metal lines within a fuel tank connected to electric equipment,
regardless of size, have been grounded. All electric wires and equipment in fuel tanks has been
designed with the highest degree of protection against sparking, arcing, or overheat under
normal operating and emergency conditions, and during maintenance. Arc-over from electric
equipment or wiring being removed from or installed into fuel tanks has been prevented by
positive means, if such arcs are a potential ignition source. In addition, metal wire conduit wall
thickness, joints, and attachments have carried maximum fault current without dangerous
external heating or conduit burn through under conditions of an internal power fault to the wall of
the conduit or between adjacent wires.
Conduits which are open to the exterior of the tank for breathing purposes, or for easy removal
of the wires have discharged safely any leakage of fuel into the conduit.
All electric equipment in fuel tanks should be explosion-proof.
Electric equipment which can be an ignition source in a normal operating or failed condition has
not been located in compartments containing flammable fluid components, or in compartments
adjacent to fuel tanks, or in compartments into which leakage of flammable vapor from other
compartments was likely due to lack of adequate sealing. Such lack of adequate sealing is
normal in many cases after extended maintenance and service.
141
JSSG-2009A
Leakage of flammable vapors into electrical compartments was avoided, when practicable, by
providing a positive pressure head in the electrical compartment relative to any adjacent
compartment containing flammable fluid components.
All accessory unit such as filters, valves, etc., the weight of operation of which impose adverse
stresses or vibration on tubing carrying flammable fluid, were supported by means other than
the tubing. If rigid connections are used between accessories, then all accessories so
connected should be rigidly mounted on the same base.
Electric motor driven pumps for flammable fluids have used shaft seals and suitable drain
chambers and overboard drains to allow any fluids which leak past the main seal to drain to the
outside before entering the motor. The drain were terminated on the outside of the pump in a
boss in accordance with SAE AS 5202. The only possibility of seal leakage was between the
rubbing members of the seal. In the event that an electric motor is utilized, wherein its rotating
element operates immersed in the fluid, this requirement does not apply. On electric motor
driven pumps, unless the motor operates immersed in fluid, the motor was vented overboard.
The vent line was integral with the pump without connectors. Motor cases of electric motor
driven pumps with immersed motor had a vent hole to the tank cavity, which incorporates a
proven flame arrestor. The electric motors were explosion-proof.
Electric motor driven pumps which, in case of a failure, can reach case temperature higher than
the autogenous ignition temperature of the fluid have incorporated thermal protection. The
thermal protection has cut off the current to the motor so that no point of the motor case
exceeds at any time a temperature which is 50ºF below the autogenous temperature of the fluid.
The thermal protection was not be resettable in flight.
Electric motor driven pumps were such that current cannot be carried from the motor section
into the pump under any failure condition. The electric wires entered the motor through potted
inlets, if the wire inlet was submerged, in normal condition or in case of a failure.
Centrifugal pumps were used rather than positive displacement pumps if necessary to preclude
high-pressure buildup in case of line blockage. High-speed positive displacement pumps were
not used when the pump element may run immersed
Capacitor type fuel quantity gages have complied with the fire protection requirements of MIL-G-
8998.
Quantity indicators in tanks containing flammable fluids have been designed so that no “single
electrical failure” in any part of the circuit, inside or outside the tank, could cause a spark or arc,
with an energy greater than 0.2 millijoules, within the tank. Liquid level switches were in
accordance with the fire protection requirements of MIL-S-21277. If transformers were used for
power supply to the gages in the tank, electrostatic grounded shields were applied between the
two windings, if a short between the primary and secondary winding could cause a spark or arc,
with an energy greater 0.2 millijoules in the tank.
Electric components which were permanently or temporarily located in compartments containing
flammable fluid components with potential leakage, or in compartments adjacent to fuel tanks,
or in compartments into which leakage of flammable vapors from other compartments is likely
due to lack of adequate sealing, should comply with the following requirements:
142
JSSG-2009A
The following technical documents have been used in military aircraft:
Explosion proof
The electric components, including connectors, have been explosion-proof as defined in MIL-E-
5272, Procedure IV. Procedure III of MIL-E-5272 is acceptable only for such components which
cannot develop internal spark producing failures, such as loose wires and contacts, or other
loose objects.
Overheat protection
Overheat protection has been provided for electric components, in case temperatures can
cause ignition of the fluids involved under any potential condition of failure. The thermal
protection has cut off the power to the equipment so that no point exposed to the fluids exceeds
at any time a temperature which is 50ºF below the minimum autogenous ignition temperature of
the fluids. The thermal protection has not been resettable in flight. Where resettable protection
must be used, the thermal protections has been designed on the basis that it may be
continuously reset as rapidly as is practicable after each time the power is cut off.
Short circuit
All bare conductors or other exposed current carrying parts has been adequately protected
against short circuits caused by loose objects. This protection was obtained by locating them in
such a manner that additional protection was not required, or by means of suitable coverings.
Protection by location or covering was not sufficient for terminals, ground studs and similar
components which can cause ignition by sparking or heating because of loose connections.
Allowance was made for cumulative heating over extended periods and all affected materials
were selected to prevent deterioration or electric breakdown under these conditions.
Wires
The installation and routing of electric wires has complied with the fire protection requirements
of MIL-W-5088.
Flammable fluid systems and components have complied with the fire protection requirements
of the following specifications:
Fuel Systems Aircraft, Installation and Test of, MIL-F-17874;
Fuel System Components, General Specification for, MIL-F-8615;
Fuel and Oil Lines, Aircraft, Installation of, MIL-I-18802;
Hydraulic System, Aircraft Requirements for, MIL-H-5440.
Electronic equipment have complied with the fire protection requirements of MIL-E-5400, and
electric wiring has complied with the fire protection requirements of MIL-W-5088.
Installation of fuel and oil lines has complied with the fire protection requirements of MIL-I-
18802.
143
JSSG-2009A
Tank filler caps and adapters has complied with the fire protection requirements of MIL-C-7244.
Pressure fueling adapters has complied with the requirements of MIL-A-6425. Fueling adapters
were properly grounded to the airframe in accordance with MIL-B-5087
Gaseous oxygen systems has complied with the fire protection requirements of MIL-I-8683.
Liquid oxygen systems have complied with the fire protection requirements of MIL-I-19326.
Electric components which are essential for safety of flight, or are required to perform
emergency operations, have not been located in or close to a fire zone. If they must be located
in or close to a fire zone for justifiable reasons, components essential for the safety of flight
have been able to withstand a 2000 F flame of the type likely to be encountered in the area for
at least 15 minutes. Components required to perform emergency operations have been able to
withstand such a flame of 2000 F for at least five minutes, without failure.
Shock mounts for electric components located in potential fire zones have been all-metal.
Wire in fire zones which is essential for safety of flight or for emergency operations have been in
accordance with MS 24284.
Electric components and wires have been located away from oxygen equipment. When such
separation cannot be obtained for justifiable reasons, electric wires and wire bundles have been
provided with frequent supports, including protective conduits if necessary, or other suitable
means of support to prevent a free end of a broken wire from touching any oxygen tube.
Electric wires have not been attached to oxygen components, unless required for electric
operation or monitoring of the component.
The pressure in electrical and electronic components has not, when practicable, been above
that of an adjacent compartment which contains volatile flammable fluid components with
potential leakage, to compensate for the lack of complete sealing which may be expected after
reasonable maintenance and service. Tests have been made to substantiate that flammable
zones run at lower pressures than any adjacent ignition zone.
Nonmetallic material used in or close to electric components which can attain excessive
temperatures due to resistance heating caused by a failure, should not ignite at the maximum
temperature of a failed component. Flammable fluid has not been used in electric equipment
such as ballasts in neon lights.
External power receptacles have been located as remote as possible from points of potential
flammable fluid or vapor release, such as vent and drain exits. They have been located in areas
of the aircraft where flammable vapors from leakage within the aircraft cannot accumulate, or
they were enclosed in a vapor tight compartment.
Hermetically sealed batteries were used only with specific approval. Where used, they were
provided with frangible safety blow-out plugs or the equivalent.
Batteries have had gasketed covers held down by reliable fasteners, in conjunction with the use
of sealed type electric connections. Lead-acid batteries were vented overboard to a place
where ignition or re-entry cannot occur. Nickel-cadmium batteries have been provided with
144
JSSG-2009A
pressure-relief vents to limit internal pressure build-up. Battery vent lines and fittings should be
resistant to the electrolytes and their products of decomposition.
Safe cell temperatures and charging rates have been maintained when the battery is recharged
(after previous complete discharge) at maximum regulated voltage, during a flight of maximum
duration, under the most adverse cooling condition likely to occur in service.
Electro explosive systems
Since safe design of electroexplosive systems such as ejectors, igniters, destructors, flares,
etc., is dependent upon proper design of the initiator system, the following design
recommendations were directed toward initiator systems:
Specifications
Electric initiators have been designed in accordance with the fire protection requirements of
MIL-I-23659.
Initiator systems
An initiator system consists basically of a fusible link (bridge wire), the external power supply
and the triggering device which initiates the firing current. The fusible link generally ignites a
small primer charge which in turn explodes an actuating powder charge. Sensitive, low
electrical energy initiators has been avoided, whenever possible.
Shunt fuses
An electric shunt fuse connected across the bridge wire circuit has been included within the
initiator circuit. This fuse was not more than one fifth of the resistance of the parallel bridge wire
path and its blow-out rating was equip to the minimum all fire current of the bridge. A resistor
may also be installed in series with the complete initiator to provide current limiting during firing
and prevent opening the initiator wiring circuit breaker.
Bridge circuit
The bridge wire circuit was a two-wire, ungrounded system. Where a ground is necessary, the
ground should be made at a single point only.
The external firing circuit wires to the initiator bridge wire was a twisted-pair cable, encased in a
flexible metallic shield. This shield was covered with an insulating sleeve, but was electrically
bonded to the disconnect plug shell at the initiator with a wire as short as possible. The twisted-
pair firing cable to one initiator was not placed within the shielding braid of another initiator firing
cable. Where an isolating relay is used in the firing circuit, it was located as close to the initiator
as is practicable, and it opened both initiator leads.
Initiator shielding and grounding
The initiator was encased in a complete metallic shield container, with a metallic electric
receptacle for external connections. The initiator case was thoroughly electrically grounded to
basic metallic structure by means of the mounting installation.
145
JSSG-2009A
Radio frequency filter

In addition to metallic shielding of the bridge wire and its twisted-pair shielded wiring, a radio
frequency filter was included within the initiator circuit. The longer the twisted-pair shielded
wiring, the more important the radio frequency filter becomes. The filter may be the
conventional inductor-capacitor network or a “solid state attenuator” incorporated in the bridge
wire leads.
Location of initiators and wiring
The wiring and the initiator have been routed separately from aircraft wiring, especially radio
frequency coaxial cables and heavy ac power cables. The initiator and its wiring were located,
insofar as practicable, within and close to the metallic skin or structure of the vehicle for
shielding purposes. The initiator was not located adjacent to transmitting antennas in the
aircraft.
Accessibility
All initiators were easily accessible and replaceable.
Exploding bridge wire initiating systems
Exploding bridge wire electric initiators employ bridge wires of much larger diameter adjacent to
but not necessarily touching the normal charge of explosive. Since there is no heat sensitive
explosive in contact with the bridge wire, any heating that may result from the passage of
currents caused by stray voltages, electromagnetic radiation, or other accidental causes will
have no effect on this type of initiator.
Bleed Air Subsystems
Ducts and their connections which terminate in the cabin or which are routed through the cabin
have been made of aluminum or equally fire-resistant material. Air ducts passing through
potential fire zones, when allowed to burn through, might give a fire the opportunity to travel
from one fire zone to another or to the rest of the air vehicle, and they may also allow a high air
mass flow to enter the potential fire zone and feed the fire. Such air ducts have been made of
stainless steel or titanium not less than 0.015 inches thick, or equivalent material, where they
pass through fire zones. Air ducts originating in fire zones have been made of stainless steel or
titanium not less than 0.015 inches thick, or equivalent material, for a sufficient distance beyond
the fire barrier to assure that any fire can be contained within the duct. For air ducts originating
in potential fire zones, shutoff means has been provided.
Combustion air ducts have not communicated with the heating airstream unless it is
demonstrated that flames from backfires or reverse burning cannot enter the heating airstream
under any conditions of ground or flight operation, including conditions of reverse flow or
malfunctioning of the heater or its associated components. Combustion air ducts have not
restricted prompt relief of exhaust and backfires which can cause heater failure due to
pressures generated within the heater.
Combustion and ventilating air intakes have been so located that no flammable fluids or vapors
can enter the heating system under any conditions of ground or flight operation either during
normal operation or as a result of failure.
Engine and combustion air inlets have been designed, whenever possible, so that air cannot be
drawn from a compartment with potential flammable leakage during any ground or flight phase.
146
JSSG-2009A
Low pressure in the air inlet ducts relative to pressures in adjacent compartments during ground
runs and low flight speeds can cause ingestion of flammable leakage with resulting engine stall,
flash-back of combustor flames through the compressor, and fire and explosion in the adjacent
compartment. It also causes reverse flow of air in the compartment with the related problems of
improper detector and extinguisher discharge nozzle location.
Hot bleed air and other hot gas ducts and their components have not been located in
compartments containing flammable fluid components with potential leakage, or in
compartments adjacent to fuel tanks, or in compartments into which leakage of flammable vapor
from other compartments is likely, if the following conditions apply:
CONDITION 1: The maximum surface temperature of the bleed air ducts and components,
under any normal or emergency condition, is equal to or higher than the minimum autogenous
ignition temperature (MAIT) minus 50 Deg. F of the flammable fluids in question.
CONDITION 2: The maximum bleed air temperature under any normal or emergency condition
is equal or higher than the minimum hot gas ignition temperature (MHGIT) minus 50 Deg. F of
the flammable fluids in question.
If, for justifiable reasons, bleed air ducts and components must be located in such
compartments, the installation of the ducts has complied with the following requirements, for
above Conditions 1 and 2:
CONDITION 1: The ducts have been located as high within a compartment as practical, and
away from potential flammable fluid leakage. The compartment has been drained, ventilated,
and insulated as indicated in other sections of this document.
CONDITION 2: Bleed air ducts and components have been isolated by fluid and vapor tight,
preferably permanent, barriers
Air bled from the engine to prevent compressor stall has been discharged directly overboard,
and was not discharged inside any airplane compartment. Discharge into turbine and tailpipe
compartments was permitted, except if water-alcohol was added to the compressor air for thrust
augmentation upstream of the bleed air takeoff. The ducts for anti-stall bleed air discharge were
made of steel, or equivalent material, within fire zones.
Oxygen Subsystems
Component temperatures
Oxygen components have been located in or close to potential fire zones, or in other areas
where they could be subjected to temperatures in excess of those specified in the individual
component specification, under normal operating conditions, or in case of a fire, hot duct
rupture, etc. If such location is not possible permanently installed shielding and insulation, if
necessary, has been provided to keep the component temperatures within specification values.
Portable oxygen containers
Portable oxygen containers were stored in areas where the likelihood of a fire is remote, or they
were stored in enclosures which can withstand a fire likely to occur at their location, and they
were insulated so that such fire will not cause discharge of oxygen from the container into the
fire.
147
JSSG-2009A
System layout
The layout of the oxygen system and the location of the components was such that all lines
were as short as practical, and that high-pressure lines were held to a minimum length. Oxygen
containers, however, were not be located immediately adjacent to the crew, and in combat
aircraft they were located, whenever practical, so that they were protected against gunfire.
Flammable fluid components
Insofar as practicable, oxygen lines and components have not been grouped with lines and
components carrying flammable fluids, and were not located above each other. When
necessary to keep potential flammable fluid leakage away from oxygen lines and components,
shrouding was used.
Component clearance
A clearance of at least two inches has been provided between oxygen tubing and components,
and control cables and other flexible moving parts. A clearance of at least ½ inch was provided
between oxygen tubing and components, and other parts of the aircraft under any condition of
operation and accumulation of manufacturing tolerances, unless the oxygen lines and
components were rigidly attached to these parts.
Propellers and turbine rotors
Oxygen containers were not be located within six inches of the plane of rotation of aircraft
propellers or turbine rotors.
Lines and fittings
Aluminum or stainless steel tubing have been used in oxygen systems, and the connectors
were an approved type for use in oxygen systems.
Container support
The oxygen container supports were designed to withstand the same inertia loads as the seats
of the occupants. The container supports in combat aircraft were designed to prevent the
container from tearing loose when hit by gunfire.
Filling provisions
The filler connections were located so there was no possibility of oil coming in contact with the
filler valve. The filler connection was installed within a closed box behind a cover plate with a
dirt and oil-tight seal.
Contaminants such as dirt, lint, metal chips, etc., were prevented from entering filler connections
of the oxygen systems by means of fine mesh or sintered filters installed in the system.
Cleanliness
The entire oxygen system was completely free from oil, grease, and other foreign matter. Open
ends of cleaned and dried tubing and components was plugged at all times. There was no
unplugged opening in the installation at any time, except during attachment or detachment of
parts.
148
JSSG-2009A
Hazardous Subsystems
The systems treated or referenced in this section are potential fire and explosion hazards if not
properly designed, located, or installed.
High speed rotating equipment
Recirculation fans or other high-speed rotating equipment have not contained magnesium parts.
Location
High speed rotating equipment such as starters, auxiliary power units (APUs), drive shafts, etc.,
were located, whenever possible, to prevent damage of flammable fluid components,
explosives, oxygen containers, and in particular fuel tanks by flying fragments in case of
disintegration of a rotating part.
Overspeed protection
If location recommended above was not possible for justifiable reasons, high speed rotating
equipment, except main propulsion engines, was designed to incorporate either one of the
following features:
Containment
Capability of containing all rotor fragments within the equipment under the conditions of the
most adverse “single failure” which causes maximum overspeed at maximum operating
temperature.
Rotor strength
Strength of all rotor parts to withstand a speed which produces 1.50 times the kinetic energy of
a maximum overspeed which can be caused by the most adverse “single failure”, and at
maximum operating temperature.
Aerodynamic speed limitation
Aerodynamic speed limitation such that failure of the rotor cannot occur at a speed producing
1.5 times the kinetic energy of the limit speed and at maximum operating temperature. If the
equipment requires controlled ingestion of air for aerodynamic speed limitation, the equipment
model specification should give all the requirements necessary for satisfactory duct design.
Friction braking
Speed limitation by friction braking between rotor and case such that failure of the rotor cannot
occur at a speed producing 1.50 times the kinetic energy of the maximum limit speed, and at
any operating temperature.
149
JSSG-2009A
Speed limiting device

In order to limit the maximum over speed in the Containment or Rotor Strength sections, two
reliable and independent speed limiting devices was considered. One of these devices may be
the normal speed control and the other one a topping device with the sole purpose of
preventing the equipment from exceeding a predetermined maximum speed. The topping
device has incorporated a “self-exercising”, or a testable feature to prevent sticking from
inactivity. The speed limiting device has been located as close as practicable to the component
which is to be protected against over speed by the device. Any electrical portion of the toping
device was located or protected so that it will not be rendered inoperative by the lubricating oil of
the equipment, under normal operating condition or in case of a “single failure”.
Other hazards
High speed rotating equipment was carefully analyzed for other potential fire hazards such as
ignition of flammable fluids by high case temperature due to normal operation or due to failure,
such as oil starvation and bearing failure. Satisfactory protection was provided if such hazards
exist. High speed rotating equipment was supported in such a manner that imbalance due to
potential failures will not cause failure of the support with consequent fire potentiality.
High speed drive shafts were encased, if necessary to protect flammable fluid components, fuel
tanks, explosives, oxygen containers, etc.
High pressure air systems
Specifications
High-pressure air systems have complied with the fire protection requirements of MIL-P-5518.
General
High pressure air compressor and related components utilizing lubricating oil as piston lubricant
which ultimately is mixed with the compressor air can experience explosions with destructive
results to the equipment and to adjacent components, if not properly designed.
Location
High pressure air compressors and related equipment have been located, whenever possible, to
minimize damage of flammable fluid components, explosives, oxygen containers, and in
particular fuel tanks, by flying fragments in case of any explosion.
Explosion hazards
High pressure air compressors and related equipment have complied with MIL-P-5518. An
explosion hazard report should be submitted as required by MIL-P-5518. Particular attention
should be given in this report to potential hazardous conditions caused by equipment
malfunctions. The oil-air mixture in a compressor, which is pre-charged with compressed bleed
air, may move from “too lean” to “explosive” when the mass airflow is reduced due to a severed
compressor air intake line. The same result can be experienced when the lubricating oil flow to
the cylinders of the compressor is increased due to a malfunction of the lubricating system.
Breakdown of the cooling system due to a fan failure may also cause explosion when the air
temperature exceeds the autogenous ignition temperature of the lubricating oil.
150
JSSG-2009A
Support
Compressors and reservoirs for compressed air have been supported so that compressor
unbalance caused by malfunction, or reservoir damage caused by gunfire, will not result in
failure of a support with resultant fire potentiality.
Explosives
Specifications
Explosives have complied with the fire protection requirements of the following specifications:
Initiators, Electric, Design and Evaluation of, MIL-I-23659;
Design and Evaluation of Cartridges for, Cartridge Actuated Devices, MIL-D-21625;
Installation and Test of Aircraft Pyrotechnic Equipment, General Specification for, MIL-I-8672.
Location
Explosives have not been installed or stowed in the proximity of heat sources if these heat
sources can cause ignition of the explosives under any normal condition, or if a “single failure”
can cause ignition of the explosives. Explosives have not been installed or stowed in the
proximity of potential fire zones. If explosives must be located close to real or potential heat
sources for justifiable reasons, they were adequately protected by permanently installed
insulation, or shields, or both.
Installation
Explosives can be a hazard to manufacturing and maintenance personnel. Designs have
permitted installation of explosives as late as possible in manufacturing sequence, preferably at
the flight line. Explosives have been interchangeable without force or rework.
Engine Starters
Specifications
Turbine starters have complied with the fire protection requirements of MIL-S-7848.
Overspeed Protection
Failure of a starter coupling to disengage after engine lightoff can cause over speed of the
starter. Starter disintegration due to this type of failure and due to failure in the speed control
mechanism has been prevented by over speed protection as indicated above.
Cartridge Starters
In addition to the above requirements, a cartridge starter has complied with the following:
Inadvertent Ignition
A cartridge starter should be suitably protected against inadvertent ignition of the cartridge. It
should be possible to arm the starter only after securing the breech. It should be possible to
disarm the starter at any time prior to actuation.
151
JSSG-2009A
Gas Leakage
There should be no leakage of gases into the starter compartment or into any other
compartment from any part of the starter during or following operation throughout the operating
range.
Overpressure Protection
An overpressure relief device should be incorporated in the starter which will limit the maximum
breech pressure in the event of abnormal cartridge burning. The device should bypass the
turbine. The relief pressure should not exceed the breech proof pressure.
Cartridges
Cartridges should comply with the fire protection requirements of MIL-D-21625.
Gun Installations
General
Gun gases leaving the muzzle and leaking from the breech contain considerable quantities of
unburned combustibles. Appropriate measures have been taken so that the gas-air mixture
within the gun compartment does not fall within the explosive range.
Gun Gas Data
The maximum gun gas release rate into the gun compartment and the maximum content of
combustibles by volume in the gas has been determined and specified by the gun manufacturer.
The lower explosive limit of gun gas is approximately 9 percent (9%) by volume.
Ventilation
If ventilated was used for diluting the gas-air mixture in the gun compartment, air intake was
located away from the gun muzzle to prevent gases from the muzzle from entering the
ventilating air. Gun icing by ventilating air has been prevented. This can be accomplished with
a ventilating system operating only while the gun fires. The ventilating airflow rate has been
high enough to result in an average concentration of combustibles of 4.5 percent (4.5%) with
good mixing, and 2.25 percent (2.25%) with less thorough mixing.
Fuel Tanks
Fuel tanks have not been located immediately adjacent to gun compartments; they were from
such compartments by at least one liquid and vapor tight bulkhead in addition to the tank
boundary structure.
Landing Wheel Brakes
Wheels which serve as housings for highly loaded brakes have been provided with pressure
relief devices actuated by heat. Consideration should also be given to the use of a heat shield
between the brake and the wheel. The purpose of these devices is to prevent tire explosion
caused by brake overheating or by brake fire.
In addition, serious consideration has been given to a brake overheat warning system. Use of a
brake warning system should be based on the type of vehicle, its intended usage, the
characteristic of the brake, and the probability and the consequences of the hazards.
152
JSSG-2009A
External Rockets
External rockets have been installed so that the rocket exhaust was not be a hazard to fuel tank
vent lines. If fuel vent exits cannot be located at a safe distance from the rocket exhaust, the
vent line exits were protected by flame arrestors or other effective means to prevent flame
propagation into the tanks.
Surfaces of rocket exhaust impingement have been designed for heat and corrosion resistance.
Protection was provided, if necessary, for flammable fluid components, fuel tanks, explosives,
etc., located in compartments exposed to the exhaust wake.
By analysis and inspection it should be verified that installation hazards reduction designs have
been used to the fullest extent practicable to prevent the occurrence of fire and explosion due to
the uncontrolled presence of (TBS 1) . The adequacy of the provided design should be
The use of these prevention designs to the fullest extent practicable is necessary to reduce the
need for detection and control provisions. The adequacy of the provided designs must be
verified to eliminate poor designs and avoid costly retrofits.
TBS 1: To prevent hazards resulting from component, line, wiring, etc. interference, line or
wiring routing or line or wiring fabrication and installation should be verified by inspecting the
various subsystem installations throughout the air vehicle ground and flight test program. Past
recommendations have been to conduct these inspection at 50-hour intervals during the flight
test program. When appropriate, additional inspections should be conducted after the following
flight conditions and maneuvers:
a. Simulated and actual weapon delivery
b. Internal gun firing
c. Inflight refueling
d. Maximum positive and negative g maneuvers
e. Maximum roll and sideslip maneuvers
f. Maximum climbs and descents
g. Critical speed brake or thrust reverser actuations.
The adequacy of designs provided to prevent the spread, due to airflow, of fire along the air
vehicle exterior from one subsystem to another may need to be verified by demonstration.
153
JSSG-2009A
TBS 2: The required analysis and inspection should be done along with the analysis and
inspection required by Installation hazards reduction and should be part of a fire and explosion
hazard analysis done to determine the protection required for the total air vehicle.
a. The adequacy of designs provided to prevent normal subsystem operation from
contributing to or resulting in fire and explosion hazards may need to be verified by
demonstration. In the case of fuel dump systems it should be demonstrated by using
dyed fluid that no fuel or fumes impinge on or enter any portion of the air vehicle and
cause unsafe conditions under all normal flight conditions. Record data, including
movies, during selected operating conditions.
b. The adequacy of designs provided to minimize fire and explosion hazards resulting from
failure or accident may be verified by inspection, test or demonstration depending on the
particular design. The test or demonstration may be required to show that flameholders
have been excluded from powerplant installations and that flames from backfires or
reverse burning cannot enter combustion heating airstream.
When using dyed fluids for fuel impingement tests, visually inspect the air vehicle as part of the
impingement determination. Do not rely solely upon motion pictures.
3.4.1 Landing subsystem
4.4.1 Landing subsystem
154
JSSG-2009A
155
JSSG-2009A
156
JSSG-2009A
157
JSSG-2009A
APPENDIX A
APPENDIX A
AIR VEHICLE LANDING SUBSYSTEM
REQUIREMENTS AND GUIDANCE
A.1 SCOPE
A.1.1 Scope.
This appendix provides the requirements, verifications, tailoring guidance, and background
information for the Landing Subsystem provided for in Part 1 of this specification. The appendix
has been developed and coordinated by technical personnel from the Air Force, Navy, and
Army and has been approved as an official guide for use by Government personnel for
assistance in tailoring the air vehicle subsystems specification for acquisition and model
specifications. This appendix is a mandatory part of the specification. The information contained
herein is intended for compliance.
A.1.2 Structure.
The appendix structure replicates the structure of the Air Vehicle Subsystems Specification
A.1.3 Appendix.
This appendix provides tailoring guidance and background information for individual paragraphs
of the Air Vehicle Subsystems Specification. Guidance gives recommendations on how to tailor
the specification paragraph. Where (TBS) appears, the guidance paragraph provides
recommended values or text that the using service may use to insert in the (TBS) . When
contractors are expected to complete the (TBS) , the Guidance paragraph will so state. The
Using Service makes the final decision on whom completes the (TBS) in the specification.
Finally, Lessons Learned are provided to give insight to past events that could impact the
tailoring of the specification.
A.1.4 Deviations.
Projected designs for given applications which will result in improvement of the system
performance, reduced life cycle cost, or reduced developmental cost through deviations from
this guidance, or where requirements of the specification results in compromise in operational
capability, should be brought to the attention of the using service.
158
JSSG-2009A
APPENDIX A
A.1.5 Environmental impact.
A.1.6 Responsible engineering office.
The responsible engineering office (REO) for this appendix is AFLCMC/EZFA, WRIGHT-
PATTERSON AFB OH 45433-7017 USA; DSN 785-3347, COMMERCIAL (937) 255-3347;
A.2 APPLICABLE DOCUMENTS

A.2.1 Government documents
A.2.1.1 Specifications, standards, and handbooks.

The following specifications, standards, and handbooks form a part of this appendix to the
INTERNATIONAL STANDARDIZATION AGREEMENTS
NORTH ATLANTIC TREATY ORGANIZATION

STANAG 3098 Aircraft Jacking
STANAG 3209 Tyre Valve Couplings
STANAG 3278 Aircraft Towing Attachments and Devices
(Copies of these documents are available at http://nsa.nato.int and www.ihs.com to qualified
users.)
159
JSSG-2009A
APPENDIX A

JSSG-2006 Airframe Structures Joint Service Specification Guide
JSSG-2010 Crew Systems Joint Service Specification Guide
MIL-PRF-5041 Tires, Ribbed Tread, Pneumatic, Aircraft, General Specification for
MIL-B-8075 Brake Control Systems, Anti-Skid, Aircraft Wheels; Instruction for
Preparation of Specifications of
MIL-L-8552 Landing Gear, Aircraft Shock Absorber (Air-Oil Type)
MIL-B-8584 Brake Systems, Wheel, Aircraft, Design of
MIL-S-8812 Steering System: Aircraft, General Requirements for
MIL-A-8860 Airplane Strength and Rigidity
MIL-A-8863 Airplane Strength and Rigidity Ground Loads for Navy Acquired
Airplanes
MIL-A-18717 Arresting Hook Installation, Aircraft
MIL-L-22589 Launching System, Nose Gear Type, Aircraft
MIL-T-81259 Tie Downs, Airframe Design, Requirements for
MIL-PRF-83282 Hydraulic Fluid, Fire Resistant, Synthetic Hydrocarbon Base,
Metric

MIL-STD-203 Cockpit Controls Location and Actuation of for Fixed Wing Aircraft
MIL-STD-805 Towing Fitting and Provisions for Fixed Wing Aircraft Design
Requirements
MIL-STD-878 Method of Dimensioning and Determining Clearance for Aircraft
Tires and Rims

MIL-HDBK-1568 Materials and Processes for Corrosion Prevention and Controlling
Aerospace Weapons Systems
MIL-HDBK-1587 Quality Program Requirements for Space and Launch Vehicles

19111-5094 USA.)
160
JSSG-2009A
APPENDIX A
A.2.1.2 Other Government documents, drawings, and publications.

AIR FORCE MANUALS AND DESIGN HANDBOOKS

AFM 86-3 Planning and Design of Theater of Operations Air Bases
AFM 86-8 Airfield and Airspace Criteria
AFM 88-6 Flexible Pavement Design for Airfields
AFML 70-7 Do’s and Don’ts of Materials Applications
AFSC DH 1-6 System Safety
AFSC DH 2-1 Airframe
ARDCM 80-1 Handbook of Information for Aircraft Designers (HIAD)
(Copies of these documents are available to qualified users. Contact
AFLCMC/ENRS, 2145 MONAHAN WAY, WRIGHT-PATTERSON AFB OH 45433-7017 USA;
DSN 674-5476; COMMERCIAL (937) 904-5476;
AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.)
USAF TECHNICAL REPORTS
ASD-TR-68-34 Evaluation of Aircraft Landing Gear Ground Flotation

Characteristics for Operation from Unsurfaced Soil Airfields
(Accession Number AD0843585)
ASD-TR-70-43 Aircraft Ground Flotation Analysis Procedures—Paved Airfields
(Accession Number AD720273)
(Copies of these documents are available at www.dtic.mil to qualified users; Defense Technical
Information Center, 8725 John J. Kingman Rd., Suite 0944, Ft. Belvoir VA 22060-6218 USA.)
A.2.2 Non-Government publications.
SAE INTERNATIONAL
SAE ARP1107 Tail Bumpers for Piloted Aircraft
SAE AS50141 Tube, Pneumatic Tire, Aircraft

users.)
161
JSSG-2009A
APPENDIX A
AMERICAN SOCIETY OF MECHANICAL ENGINEERS

ASME B46.1 Surface Texture
(Copies of this document are available from https://www.asme.org; ASME, Three Park Avenue,
New York NY 10016-5990 USA.)
A.2.3 Order of precedence.
A.2.4 Streamlining.
appendix which are required for acquisition have the same status as those referenced directly in
section 2 (first tier). All other documents referenced through tiering, may be used for guidance
and information only.
162
JSSG-2009A
APPENDIX A
A.3 REQUIREMENTS
A.4 VERIFICATIONS
A.3.1 Definition
A.4.1 Definition
A.3.2 Characteristics
A.4.2 Characteristics
A.3.3 Design and construction
A.4.3 Design and construction
A.3.4 Subsystem characteristics
A.4.4 Subsystem characteristics
A.3.4.1 Landing subsystem.
The landing subsystem covers the technologies, functions, interfaces, systems, and
performance which provide the air vehicle with landing control and ground mobility. More
specifically, this includes the design areas for landing subsystem flight and ground operation,
structural support, and ground velocity and directional control. The landing subsystem provides
the air vehicle with safe and maintainable capabilities of hold position, towing, taxi, takeoff,
landing touchdown, balanced field, critical field length abort, and (emergency) arresting barrier
compatibility.
A.3.4.1.1 Landing gear.
The landing gear subsystem shall provide a safe and reliable means of physically supporting the
air vehicle structure (and any associated loads) during takeoff, landing, taxi, balanced field, and
critical field length abort, hold position, and all other required ground operations at its intended
operational sites. The landing gear also shall provide (TBS) .
When an air vehicle is not in the air, some parts of the air vehicle, by necessity, touch the
ground (or water, if intended to land on water). The parts of the air vehicle that touch the
ground (or water) should be able to support the air vehicle so it remains airworthy and useful.
163
JSSG-2009A
APPENDIX A
When designing landing gear design for a particular air vehicle, one should take into account
such factors as the intended landing surface and operational environment (carrier landings,
unimproved runways), and air vehicle gross weight.
TBS: If the determination is made that the air vehicle will have some sort of landing gear other
that just skids (as on a helicopter), then the requirement blank should be filled in with what sort
of velocity and directional control is desired. That is, braking, braking control, steering control, If
the air vehicle is a helicopter, and skid-type gear is to be used, a determination should be made
whether to utilize standard or non-standard skid gear. Some factors to be used for this
determination are:
a. Mission profile
b. Skid height
c. Crosstube flex
d. Skid wear
e. Standard or non-standard gear (See lessons learned.)
f. Deployment applications.
Extended landing gear should provide some amount of energy absorption to reduce the vertical
velocity of the fuselage under crash conditions.
During conventional conflicts when deployment of helicopters on large transport-type air

vehicles (C-141 or larger) are to be used, standard skid gear is adequate. During non-
conventional conflicts such as guerilla warfare or terrorism, deployment on smaller transport air
vehicles may be a factor thereby increasing restrictions on the helicopter to be transported. The
Army had a requirement during the Middle East conflict to move small teams of armed
reconnaissance helicopters rapidly to locations which would not accommodate large transport
air vehicles. The skids on these helicopters were changed to an underslung crosstube design
and a gear set allowing the helicopter to be lowered and raised as a unit to accommodate the
restricted confines of a smaller transport.
A.4.4.1 Landing subsystem
A.4.4.1.1 Landing gear.
Analysis and tests shall be performed on the landing gear subsystem to insure structural
integrity, endurance, and performance conditions are met.
164
JSSG-2009A
APPENDIX A
A landing gear design analysis may be accomplished to show that all operational requirements
and conditions are adequately addressed for the air vehicle. Taxi, takeoff and landing tests are
accomplished to ensure all operational performance is satisfactory to the user.
The purpose of landing gear tests is to demonstrate the landing gear meets the specified
performance and interface requirements, such as specified extend and retract times, normal
and crash loads, low observables, and compatibility with flotation and skis (if applicable).
The landing gear design analysis shows how the various landing gear subsystems work to
accomplish the required action to assure the air vehicle operates satisfactorily while on the
ground and in transition to and from the air. Flight testing and field-testing should be
accomplished by the airframer and the eventual user to evaluate the landing gear subsystem
suitability for the requested operational mission.
Typical measurements for landing gear include energy absorption, absorption capacity, and
dynamic load characteristics of the landing gear. Landing gear subsystem qualification tests
include drop testing, low- and high-speed testing, braking and brake lock testing, floatation
testing, ski testing, retraction and extension testing.
During air vehicle checkouts and flight testing many designs inconsistencies and design faults
are discovered and corrected before the air vehicle goes into service.
A.3.4.1.1.1 Gear arrangement.

The landing gear for conventional air vehicles shall be arranged so that the airframe structure
will not contact the ground during a ground turn producing (TBS 1) lateral acceleration at the
most critical operational center of gravity configuration.
The landing gear for Vertical Takeoff and Landing (VTOL) and rotary wing air vehicles shall also
be arranged to prevent overturn during ground run-up of engines and during landing under the
following conditions (TBS 2) .
Lateral stability of the air vehicle during ground operation is a primary factor in positioning of the
landing gear. This requirement is necessary to insure acceptable ground operating
characteristics to counter the natural tendency to use a narrow tread landing gear to minimize
weight. Improvement of lateral stability characteristics after assembly of the air vehicle is very
difficult and expensive.
165
JSSG-2009A
APPENDIX A
TBS 1 should be completed by analysis of ground handling requirements of the proposed air
vehicle. A possible approach is to accomplish a dynamic analysis of similar existing air vehicle
to determine lateral acceleration required for overturning. Operational experience can then be
applied to determine suitability of this limit.
TBS 2 should be filled in with consideration given to the following:
It may be necessary to expand this requirement to adequately define overturn stability for VTOL
air vehicles. Side load during landing of VTOL air vehicles may exceed that normally
encountered during ground turns. Ground run-up of helicopters may also present an overturn
stability problem. It is suggested the following words be used: “ ”. The blank should
contain the most adverse condition(s) anticipated for normal operation.
Performance Parameters: The dominant parameters on this requirement are physical

arrangement of the landing gear air vehicle, center of gravity location and strut-tire dynamic
characteristics.
Background and Source of Criteria: The concept for this requirement comes from AFSC DH 2-1,
and is described as turnover angle. Rather than identify a limit on turnover angle, the
requirement is expressed in air vehicle performance. The 63° turnover angle limit in
AFSC DH 2-1 was established to provide approximately a 0.5g side loads turning capability.
This requirement was originated in 1950 or earlier. It should be noted that meeting the 63° limit
does not assure a 0.5g turn capability due to shock strut and tire deflection.
Generally, the criteria applied at 0.5g side load are conservative. It is possible that this can be
further studied and general criteria could be generated for each type or class of air vehicle. The
combination of speed and turning radius, which approaches the limits on safe operation, should
probably drive this requirement. Safety and operating restraints should become the driving
force.
Air vehicle turning capability may be degraded by increased gross weight. Consideration should
be given to growth potential during design of a new air vehicle.
This requirement should be examined during design of growth versions of existing air vehicles
to determine if landing gear changes are required to maintain adequate turning capability.
A.4.4.1.1.1 Gear arrangement.

Air vehicle stability during turns shall be evaluated by a ground handling analysis substantiated
by air vehicle taxi test as follows: (TBS) .
166
JSSG-2009A
APPENDIX A
An analysis supported by limited taxi data, permits exploration of the operational envelope
without incurring risk of tip over and subsequent air vehicle damage. Since the criteria are
based on maximum usage expectation, the results of the analysis will be used to provide
operational limitations. That is, the limits on turning velocities, turning radius for various gross
weights and configuration can be logically established.
TBS: The analysis should show the air vehicle tracking profiles for maximum steering angles
and show that the air vehicle will not turnover or tip up during a turn at the maximum specified
speeds over any given achievable turn radius. Taxi testing and flight test should verify the
performance of the air vehicle over all the operational spectrum.
Measured field data showed that for most operational high speed turns are at .2 g’s or less. With
the F-111 have some maximum turns at .25 g’s. However the .5 g requirement (63 turnover)
will often keep the air vehicle from catching a wing tip during a lateral skid that often occurs in a
ground looping incident.
An additional 600 lbs of metal had to be added to the gear structure on the B-1 to get the struts
far enough apart to meet this requirement. This was levied on the landing gear because the
location of the wheel wells was established by the airframe structure design without
consideration given this requirement.
A.3.4.1.1.2 Pitch stability.

The landing gears shall be arranged to provide pitch stability such that safe air vehicle ground
control is maintained and no part of the air vehicle, other than the landing gear, contacts the
ground under the following conditions: (TBS) .
The most aft center of gravity should be far enough forward of the centroid of the main gear
ground contact area that the air vehicle is stable statically and will not tip back on the tail.
TBS in the requirement blank should take into account air vehicle center of gravity location, fore
and aft pitch characteristics, aerodynamic tail power during takeoff rotation, strut-tire dynamic
characteristics, and aft fuselage design such that tip back or ground contact is precluded.
This requirement includes conditions during engine run-up and during cargo handling fuel
transfer. In the event the air vehicle design permits center of gravity excursions which preclude
meeting this criteria, provisions should be provided to protect the air vehicle from damage due
to uncontrolled ground contact. This is particularly pertinent with air vehicle utilizing variable
167
JSSG-2009A
APPENDIX A
sweep wing geometry during engine run-up. Ground contact is also a possibility due to landing
or rotation for takeoff.
This requirement is a clarified statement of the arbitrary criteria for tip back previously described
in AFSC DH 2-1. In that criteria the main wheel location was limited in a forward direction to a
position where the angle between the most aft center of gravity, main wheel contact, and the
vertical should be at least as large as the maximum tail down landing contact angle, limited by
fully extended wheel contact and the tail bumper or aft fuselage. The intent was to try to insure
that the air vehicle would rotate to a three point attitude upon contact with the ground. It was
arbitrary criteria satisfied by geometric analysis.
Since the F-111 was the first production variable sweep wing air vehicle, the problems with pitch
stability (tip back) were quite critical. Ground handling was most critical for the F-111B, aboard
ship.
A classic example of critical center of gravity location was the C-54, which required a ground
handling strut.
As a conservative rule of thumb, consider placing the main gear so that an angle between a line
joining the center of gravity and the center of main gear contact with a vertical line through this
contact is 15° with a most aft center of gravity configuration.
The B-1A experienced a tip back occurrence during an engine run-up with a faulty fuel transfer
occurring at the same time causing damage to the tail cone.
A.4.4.1.1.2 Pitch stability.

Pitch stability shall be verified by (TBS 1) for the following conditions: (TBS 2) .
Analysis of this condition can most economically be used to verify fore and aft stability. In the
event the performance is marginal, the analysis can be supplemented by a demonstration of a
critical condition on the air vehicle to increase the credibility and acceptability of the analysis.
TBS 1: A static center of gravity force moment analysis should be done to determine air vehicle
ground stability during ground maneuvers, engine run-ups, towing, and jacking.
TBS 2: A dynamic performance analysis should cover all rotational conditions to ensure there is
no gear dynamics that will cause over-rotation. The information used in these analysis should
be supported by laboratory testing and verified by subsequent flight testing.
168
JSSG-2009A
APPENDIX A
(TBD)
A.3.4.1.1.3 Extended clearances.

Clearances shall be provided so that with the landing gear down and locked, and during any
phase of the air vehicle ground operation, there is no contact between the landing gear and any
other part of the air vehicle that results in degradation of life or performance of any air vehicle
component. This requirement applies with the following conditions and restrictions: (TBS) .
Experience has shown that failure to provide adequate clearance between movable parts of the
landing gear and the fixed structure (including stores) will result in operational problems.
Design of the air vehicles for minimum weight and frontal area encourages use of minimum
clearance. While this may be adequate for operation of new equipment under ideal conditions,
it may not be sufficient for operation of a worn system. This requirement is needed to force
consideration of this problem.
TBS should reflect sufficient air vehicle clearances that are influenced and controlled by tire
growth characteristics, strut physical dimensions, strut-servicing limits tire production
dimensional tolerances, gear structural deflections, and gear kinematics.
This requirement is intended to replace the clearance statements and diagrams of

AFSC DH 2-1, AFSC DH 1-6, and MIL-STD-878. It is intended to expand to cover incorrectly-
serviced hardware and the full range of dimensional tolerances.
In past designs, it has been determined that it is good design practice to leave clearance
between the wheel, brake, and tire assemblies and the support structure or fairings. It was
found that it is best to leave clearances, particularly around the tire, to accommodate growth,
maximum production tolerances, and centrifugal forces for rotating tires. Special consideration
should be given to installations utilizing a fork. Prime examples are the F-4 and F-105. Many
aircraft have little or minimum clearance for the landing gear. Prime examples are B-52, F-111,
F-15, EF-111 and other high-density aircraft.
A.4.4.1.1.3 Extended clearances.

Clearance between the landing gear and other air vehicle components shall be verified by
(TBS) .
169
JSSG-2009A
APPENDIX A
The method of verification will depend on the program. If a landing gear simulator is available, it
may be suitable for verification of clearances. Measurement on the air vehicle will usually be
required to verify the values used in the analysis
TBS should be filled as follows: Clearances between the landing gear and all other air vehicles
structure and components should be verified by analysis based on clearances measured on the
air vehicle and adjusted for tolerances, deflections, and wear. Ground clearance after tire
failure and strut deflation should be determined by analysis. The analysis should include
deflection and dynamic effects for the landing gear and airframe, and where applicable, account
for traversing arresting cables. Clearances during arrestment should be demonstrated by air
vehicle operation.
The use of landing gear simulators on many systems have proved useful in establishing
clearances for new and worn gear systems, and allowed fixes to be tested and verified before
being applied on the air vehicle. However, simulators are expensive especially for large air
vehicles and should be justified for verification of other performance requirements, not only this
requirement.
A.3.4.1.1.4 Retraction clearances.

Clearances shall be provided on retractable landing gears so that with the landing gear in the
retracted position and during any transition between the extended and retracted positions, there
is no contact between the landing gear and any other part of the air vehicle, including landing
gear fairing doors, that results in degradation of life or performance of any air vehicle
component. This requirement applies with the following conditions or restrictions: (TBS) .
This is to insure no interference between the landing gear components and the stationary
structure or adjacent wheel well equipment.
TBS should reflect the speed, temperature, altitude, operating condition of tires (stationary or
rotating), air vehicle speed, operating mode of the air vehicle (takeoff, touch and go), and air
vehicle altitude. It should consider malfunctions such as a flat strut.
Requirement influenced and controlled by gear kinematics, component dimensional tolerances,

design of surrounding structure, gear gyroscopic loads and direction of reaction, and air loads.
170
JSSG-2009A
APPENDIX A
There are numerous conditions that potentially cause interference. It is a new requirement and
is not generally found in previous documentation.
Tire growth dimensions should be per the guidance of the Tire and Rim Association.
Gear interference while in transit between fully extended and fully retracted, and vice versa, can
be attributed to numerous factors: oversize components, rotating parts, wear, kinematic stability,
and design clearances. The most uncontrollable and potentially the most dangerous is a
combination of rotating parts and structural stability in transit caused by gyroscopic loads. The
YF-16 is the most recent example.
Part wear or improper servicing can place the gear in the improper position upon entering the
wheel well. The F-15 is a recent example that required aircraft modification.
The C-5A aircraft has experienced clearance problems during inflight rotation and retraction of
the main landing gear strut. These problems were a result of the rolling of the strut during
rotation. Mechanical roll positions would not stop the roll moment caused by the side wind
loads.
A thorough evaluation on the landing gear simulator can help prevent these incidents.
A.4.4.1.1.4 Retraction clearances.

Clearances between the landing gear and other air vehicle components shall be verified by
(TBS) .
If a simulator is provided (strongly recommended), it may be suitable for verification of

clearances. Verification on the air vehicle will usually be required.
TBS is usually filled with analysis, with parameters verified by air vehicle measurements,
followed with air vehicle demonstration during checkout and flight-testing.
The justification of landing gear simulators on new programs has always been difficult due to
program constraints. However, simulators have always proven themselves by uncovering many
component and system problems and deficiencies before they happen in operation. It also
provides a test bed to verify redesigns, fixes, troubleshooting procedures, system control logic,
endurance, service life, checkout, and T.O. procedures.
171
JSSG-2009A
APPENDIX A
A.3.4.1.1.5 Anti-rotation in retracted position.

(TBS) wheels shall be stopped from rotating during retraction or prevented from rotating in
the retracted position.
This requirement is to identify the need to stop rotation of wheels after landing gear retraction.
Wheel rotation may adversely affect air vehicle operation or cause pilot discomfort. Stopping
rotation also minimizes air vehicle damage if the landing gear is retracted with a tire that has a
loose tread.
TBS should be filled in with “All” or “Main”. Normally, all wheels should be stopped. In some
cases it may be cost-effective to stop only the main wheels.
Rotating mass and radius of gyration of the wheel, brake, and tire assembly are important
parameters in assessing this requirement. Gear kinematics and retraction rates have an
influence on the gyroscopic loads. Wheel well clearances are impacted by tire sizes and
dimensional tolerances.
This requirement reflects the statement made in AFSC DH 2-1. It was originally included in
ARDCM 80-1 (Handbook of Information for Aircraft Designers [HIAD]) as a result of fleet retrofit
of the C-133 from trouble generated from free-rotating design.
In addition to the C-133, several other air vehicles have had to provide nose gear snubbers on a
retrofit basis. As mentioned in the rationale, hazards of rotating nose wheels include: excessive
vibration, electronic interference, and stones thrown from the rotating tire treads. The design
solutions have ranged from fuselage mounted snubbers to simple cantilevered devices mounted
on the doors. There have generally been no detrimental effects on the tires. It is recommended
the rubbing be accomplished against the tires rather than against the wheel, which can suffer
defacing damage.
Main gear snubbing is usually achieved by pre-braking associated with gear-up selection. This
reduces or eliminates the gyroscopic loads. Generally, the pressure is relieved with the gear in
the stowed position to preclude extension and touchdown with brake pressure applied.
A.4.4.1.1.5 Anti-rotation in retracted position.

Demonstration that the wheels do not rotate in the retracted position shall be shown by (TBS) .
If snubbing of all or some of the wheels is required. The effectiveness of the proposed snubber
is best demonstrated with actual hardware. A landing gear simulator is a convenient device for
this purpose, however, it is usually evaluated on the air vehicle. On the main gear, it is
172
JSSG-2009A
APPENDIX A
important to evaluate the sequence and timing between brake pressure application and
cessation of wheel rotation.
The TBS should reflect a demonstration that the rotating wheel is stopped before fully retracted
for braked wheels, or stopped when fully retracted for non braked wheels. Retraction should be
commanded with the wheel rotating at a speed not less than 75 percent (75%) of the liftoff
speed at maximum gross weight.
(TBD)
A.3.4.1.1.6 Clearance with flat tire and flat strut.

In the event of flat tire and flat strut, the lowest part of the landing gear structure, door fairing, or
air vehicle components, including external stores shall not be closer than (TBS) from
ground.
The objective is to provide a clearance requirement to insure that no part of the air vehicle will
engage the barrier cable installation when landing under the most adverse sequence of landing
gear failures. By combining tire and strut failures, it will also insure that neither single failure will
cause inadvertent engagement. The recommended ground clearance limit is six inches for
safety considerations.
TBS should reflect the minimum acceptable distance from the ground and or arresting cable
installation to the lowest points on the air vehicle for all phases of its ground operation on
through rotation. For this requirement, the wheel, brake and tire are not considered a part of the
landing gear structure. It is also assumed that the wheel and tire are intact and that the rolling
radius is the flat tire radius.
Air vehicle geometry, wheel, brake, tire sizing, and landing gear configurations are the
controlling parameters in meeting this requirement.
This is an expansion of the existing requirement of AFSC DH 2-1 to include lessons learned on
recent air vehicle accidents.
With the extensive use of arresting systems within the Air Force, most runways are equipped
with arrestment cables at the ends of runways. Some runways also have midpoint barrier
173
JSSG-2009A
APPENDIX A
installations. Therefore, it is very important to not have a rigid member of the air vehicle
extending low enough to engage the barrier cable in the event of a flat tire or a flat strut. The
YF-16 was designed with a gear member extending low enough to engage the cable with a flat
tire. This resulted in significant damage. Six-inch ground clearance under these circumstances
should be a target for design.
A.4.4.1.1.6 Clearance with flat tire and flat strut.

Ground clearance after tire failure and strut deflation shall be determined by analysis.
An analysis is the most economic approach to evaluating ground clearances for all the potential
air vehicle configurations. An analysis would be required to determine the critical combinations
if a test were selected for demonstration.
The analysis should take into account the ground clearance after a tire failure or strut deflation.
The analysis should include deflection and dynamic effects for the landing gear and airframe,
and where applicable, for the arresting cable.
(TBD)
A.3.4.1.1.7 Gear stability.

Landing gear shall have natural or augmented damping so that the amplitude of any landing
gear oscillations after (TBS 1) cycles is reduced to (TBS 2) or less of the original
disturbance, with the following exceptions: (TBS 3) . The damping requirement applies to all
initial displacements of the landing gear under the following conditions: (TBS 4) .
This requirement is necessary to establish an acceptable level of dynamic stability. The primary
concern is the damping of steered landing gear to prevent shimmy. The same criteria also may
be applied to other landing gear oscillations induced by air field roughness or brake system
operation.
TBS 1 and TBS 2 should be completed by requiring the amplitude be reduced to 1/3 of the
original amplitude within three cycles. This has been recognized as standard by the airframe
industry for damping of steered landing gear. Suitability for other oscillations has not been
verified.
174
JSSG-2009A
APPENDIX A
TBS 3 should permit some types of oscillation to be excluded from the general damping criteria.
Examples include brake chatter and squeal and bogie beam pitching. The blank should include
success criteria for each item excluded from the general requirement.
TBS 4 should be used to establish the range of operating conditions to be considered in

application of the damping criteria. This should include air vehicle speed and weight conditions,
type of airfield surface, and wear surfaces worn to the operational limit.
Gear damping characteristics are controlled by tire dynamics characteristics, landing gear
component stiffnesses and damping characteristics, individually and “as installed.” If friction
damping is utilized, wear of the friction surfaces should be assumed and accounted for in the
design. Air vehicle ground speed range defines the range of concern.
The landing gears (main and nose) should be free of detrimental oscillations induced by runway
roughness, tire balance or design, brake vibrations or gear natural responses. The oscillations
include fore and aft, torsional and vertical modes.
This is a tailorable statement for shimmy damping and other vibration, patterned after the
requirement of MIL-S-8812. This requirement has been improperly placed in the Steering
System design specification for years. It is a general landing gear requirement, steered and
non-steered. It was improperly placed in the steering system specification because the nose
gear shimmy damping is most frequently controlled by modification to steering system
components and most shimmy occurs on the nose gear. Originally, the criteria was generated
as a result of Dr. W. J. Moreland’s study of shimmy and published in WADC TN 55-1 in 1955,
and Journal of Aeronautical Sciences, Vol. 21, No. 12, Sec. 54. This was further expanded and
studied by J. Edman of Bendix under contract to WADC and the results were published in
WADC TR 56-197, dated July 1956.
Shimmy and various forms of gear vibration have historically been a serious landing gear
problem. Nose gear shimmy has been a problem on the A-37, T-38, F-5, F-104, F-15, C-141A,
and numerous other air vehicles. Solution of the problems include change of tires, balancing
tires, adding friction dampers, changing hydraulic dampers, improving maintenance and
servicing procedures, and changing materials.
There is industry evidence that main gear shimmy is most likely on dual wheel installations. A
couple of commercial air vehicles have encountered such a problem. The solutions have been
to add additional damping to the system.
Prevention of bogie pitch is generally a design problem of multiple axle (4 wheel and 6 wheel
bogies), and by proper analysis and design, the problem is avoided.
Brake chatter and squeal are landing gear vibration phenomena, but the damping criteria
proposed may not necessarily apply. The source of the vibration is the brake assembly.
Therefore, system response and compatibility is a function of design of that component. See
“Aircraft Landing Gear Brake Squeal and Strut Chatter, Investigation” by F. A. Biehl, The Shock
175
JSSG-2009A
APPENDIX A
and Vibration Bulletin, January 1969, for an explanation of the phenomenon and a method of
analysis.
A.4.4.1.1.7 Gear stability.

Landing gear subsystem damping shall be verified analytically and substantiated by (TBS) .
Various component design parameters used in the shimmy analysis are estimated or calculated
because the review is accomplished before the hardware is delivered on a development
program. Therefore, it is necessary to verify the assumptions or calculations by system and
component tests. Then the system response is verified by the ground vibration test of the
installed gear. Frequently, the results are different from that which was estimated and the
analysis should be modified accordingly to establish safety for first actual air vehicle operation.
The blank should be filled with the minimum acceptable program to substantiate the stability
analysis.
TBS: The vertical, fore and aft, and torsional damping should be verified by analysis. The
parameter used in the analysis should be supported by test measurements of actual hardware
and sir vehicle stiffness data.
Many dynamic analysis are dependent on accurate determination of the landing gear and
backup structure stiffness data, which is not always easy to obtain. Often ground vibration test
results (GVT) are used to support the analysis. It is prudent to have an agreed to list of
parameters and how they are measured or determined prior to the conduct of the analysis.
A.3.4.1.1.8 Alignment.
The landing gear shall be aligned relative to the airframe to minimize degradation of the tire,
wheel, or brake life, resulting from misalignment throughout the life of the air vehicle.
This requirement is presented to reflect the desired performance.
Gear design and material selection of the wearing elements are the parameters which control or
influence the ability to meet this requirement. In particular the camber and caster of the gear
should be such as to minimize the yaw and toe-in/toe-out of the wheel and tire assembly.
The geometry of the gear should not allow tire rollover or scuffing.
176
JSSG-2009A
APPENDIX A
There have been cases where the gear design and installation practices allowed excessive
misalignment on new gears as well as where the material selection allowed excessive wear,
allowing excessive misalignment. Both resulted in a degradation in expected tire and wheel life.
Investigations into premature wheel failure and tire wear on both the F-15 and A-10 air vehicles
indicated that the failures or excessive wear were due to improper gear alignment.
Provision of a 360° free swiveling capability best minimizes excessive wear due to tailwheel
misalignment.
A.4.4.1.1.8 Alignment.
Landing gear alignment shall be determined analytically and substantiated by inspection.
Reviews of design drawings and continual monitoring of the development are adequate to
determine compliance with this requirement.
Throughout the design phase the gear alignment should be monitored through inspection of
drawing and the production of the gear and airframe. The tire wear and wheel loads should be
monitored during flight-testing and into initial field demonstration.
(TBD)
A.3.4.1.1.9 Growth.
The landing gear structural arrangement and critical fuselage clearances shall permit a (TBS)
growth in the maximum takeoff weight without major airframe modifications or gear geometry
changes.
Over the lifetime of most air vehicles, the maximum takeoff gross weight has significantly
increased from the original design. To prevent major modifications to airframe, the wheel well
should have sufficient volume (clearance) to install a stronger gear, wheel and brake, and tires.
177
JSSG-2009A
APPENDIX A
Consider strength criteria, gross weight, clearances, volume, gear location and design aspects,
static and fatigue, and pin and lug sizing strut wall thicknesses.
TBS: As a minimum, allow for at least 25 percent (25%) growth in maximum takeoff gross
weight.
There is a history of air vehicle development and difficulties in redesigning wheel well to
accommodate larger gears.
The F-15, F-16, and B-1 had gear redesigns to larger size or load capability to accommodate air
vehicle gross weight increases of 77 percent (77%), 78 percent (78%), and 32 percent (32%),
respectively, from their original designs.
A.4.4.1.1.9 Growth.
Analysis shall be performed to determine maximum air vehicle growth capability as determined
by the clearances and volume available within existing wheel well envelopes, the results of
which shall be supported by inspection.
An analysis of all critical growth loads, at all critical areas where interference with airframe
structures may result, is required. The analysis should show that the dimensional growth of the
landing gear structure will not exceed the established clearances. Inspection should be
performed on the air vehicle to ensure the clearances used in the analysis are maintained.
The analysis should look into the volume and clearance between the gear and wheel well
structure, as well with other gear components are such that the wall, pins, lugs and any other
structural member may be increased such as to support the required increase in air vehicle
gross weight. The analysis should include consideration for rework of joints and pins.
During the design and verification phase the analysis and requirement is often deleted or
ignored. This is due to pressures to achieve lower air vehicle weight and lower cost, which are
in direct conflict with this requirement. Remember that history and air vehicle data shows that
every production air vehicle has grown in weight after it has gone into service. This data may
have to be presented to program management in order to maintain this requirement in
contractual documents.
With existing computer analysis and Computer Aided Design/Computer Aided Manufacturing
(CAD/CAM) capabilities this can be readily accomplished with a good degree of confidence.
178
JSSG-2009A
APPENDIX A
A.3.4.1.1.10 Service life.

With the stated exceptions, the service life shall be (TBS) .
Design life of the landing gear subsystem is a significant driver of life cycle costs. This
requirement is necessary to establish a minimum acceptable service life for design. This is to
insure minimum cost, but acceptable utility of the completed system.
Consumable portions of the landing gear subsystem should be defined due to direct impacts to
the logistics cost and support of the equipment. There are numerous design techniques and
materials available that meet the design conditions that provide varying lengths of service life.
Therefore, the objective of this requirement is to express the logistic needs of the system in a
manner, which will influence the design, and material selected to produce the desired life.
TBS should be filled in with:

a. Landing gear structure: TBS should be stated in terms of the minimum acceptable
number of landings or years of service. The anticipated utilization of the system should
be defined. It may also be desirable to reference or define the logistics support plan for
the major landing gear components. The number selected for this requirement will
usually be the same as used for the basic airframe service life.
b. If tires are used: TBS should be filled in with a service life, due to tread wear only based
on a reference to Tire design load-speed-time figure for the air vehicle application,
showing the number of air vehicle cycles required for a given tire diameter and speed
rating range. This should apply during operation of the air vehicle during which the life
requirement is to be applied.
c. If wheels are used: TBS should reflect an accelerated life performance of a specified
number of miles at a specified overload. This allows a reasonable test program and
produces a limited life wheel. The number selected is a function of the type of air vehicle
on which it will be installed and the overall logistic plan.
d. If brakes are used: TBS should state how many landings that the heat sink material is
capable of sustaining without replacement, the life capability of the structural member of
the brake assembly, and a definition of the operational spectrum that the brake
assembly will see in service. See section 6, “Component information,” for brake
information.
e. If an arresting hook is used: TBS should state the required number of engagements the
hook system will take before replacement as well as list the components that can be
replaced sooner such as “ground contact” items.
f. If a drag chute is used: TBS should state that the life of the drag chute in number of
deployments, how often it should be replaced, and the environmental operating
conditions.
179
JSSG-2009A
APPENDIX A
If damage tolerant criteria is used exclusively, it would eliminate the use of material such as
300M steel which does not have an inspectable flaw size used to verify the two-lifetime
capability with a flaw. Therefore, if this type of material is to be allowed it will be necessary to
maintain the four fatigue life requirements as dictated by Miner’s rule that has successfully been
used on B-1, F-16, F-15, and many other aicraft.
Service life of various landing gear components is a function related to various modes of failure.
The primary modes and causes of failure include structural, corrosion, overload in performance,
wear, inadequate design, erratic performance and abuse.
There are numerous examples of fatigue failures due to stress concentrations due to
inadequate design. Emphasis should be placed on design details to avoid high KT. Fatigue
failures have occurred on virtually every landing gear in the inventory, including B-52, B-66, KC-
135, C-130, C-141, Century Series fighters, F-4, F-111, all trainers, and the A-37. Careful
attention should be paid to lug areas and holes.
Choice of material for the application also has a significant influence on the success of the
application. Selection of the wrong alloy and improper protection system can produce corrosion
and stress corrosion failures. Stress corrosion failures of landing gear components has been
particularly prevalent. Examples include B-52, KC-135, C-141, Century Series fighters, and F-4.
Most of these failures were with aluminum parts heat-treated to the T6 temper. The alloys
which were most susceptible were 7075 and 7079. A large portion of these failures occurred in
components that had high-sustained stresses, such as outer cylinders which were pressurized.
Stress corrosion failures with these alloys were not as prevalent when used as beam members
in axial loading.
Many landing gear structural failures occur in overstressed parts. Examples of landing gears
with overstress failures include virtually every air vehicle in the inventory. This appears be a
very difficult deficiency to avoid. This may result from design errors or from subjecting the
hardware to conditions not considered by the original design. Common design errors include
failure to consider dynamic loading and secondary loading due to deflection of the landing gear
or mounting structure. Any change in air vehicle operational needs during development should
be reviewed for structural implications to avoid designed in deficiencies.
Numerous landing gear failures have been initiated by inadequate process and manufacturing
control. Prime examples are the F-101 pin failures stemming from damage due to grinding of
the chrome plating.
Frequently, major components are lost from the inventory due to insufficient material to permit
rework dictated by corrosion or wear. This consideration and allowance should be included in
the initial design. This consideration is best illustrated by the commercial landing gears for
airline usage. The material for rework is mandatory for airline usage and should be seriously
weighed for evaluation of Air Force applications. Only in cases of extreme weight criticality
should this be waived.
180
JSSG-2009A
APPENDIX A
Use of hard thermoplastic material in the construction of tubing clamps may result in chafing
damage when dirt or sand enters the voids between the tube and clamp. Recommend the use
of elastomeric material or other soft rubbery material in the construction of the clamp.
A.4.4.1.1.10 Service life.

Service life shall be verified by (TBS) .
It is intended to verify this requirement in a manner consistent with the remainder of the
structural verification program. Utilization of laboratory, flight tests, and service tests covers the
total usage spectrum.
TBS should list the particular test and analysis for each individual consideration, since there will
be different types of tests for landing gear structures, tires, wheels, brakes, drag chutes, and
arresting hooks.
Rarely is the spectrum developed and used in analysis and testing of the gear the one
experienced in the field. The efforts in the integrity program is to provide recording and
algorithms capabilities to obtain actual loading of the fleet air vehicles, combine this data in an
analytical program to determine useful life remaining and overhaul criteria.
A.3.4.1.2 Ground operation
A.4.4.1.2 Ground operation
A.3.4.1.2.1 Ground flotation.

The landing gear shall have ground flotation capability to permit the air vehicle (TBS) .
The purpose of this requirement is to insure that the load that the air vehicle applies to the
airfield is compatible with the bearing strength of the airfield surface. Details of the requirement
are very dependent upon the air vehicle mission and basing concepts. The primary
consideration for a large cargo air vehicle, for example, might be to insure ability to operate on
existing commercial jet air vehicle airfields without causing an unacceptable rate of pavement
deterioration. Tactical cargo and fighter air vehicles, on the other hand, may need to be
designed to perform a specified mission on an unpaved airfield.
181
JSSG-2009A
APPENDIX A
In many cases, this airfield compatibility is a primary system characteristic and is addressed in
detail in the System Specification. If this is the case, reference to the System Specification will
be sufficient. Some system documents, however, fail to define the requirement in adequate
engineering terms. If this is the case, this requirement should be expanded to include the
significant engineering parameters. The exact wording should be tailored for each system using
the following parameters.
TBS should clearly state the user’s mission requirements for the type of airfields he wants to
operate on and should reflect the number of times he expects to perform these missions. The
tire pressure should not exceed 300 PSI and the tire footprint area should be a minimum of
50 square inches for operation on bituminous surfaces.
The following should be considered in determining flotation equipment:

a. Air vehicle Gross Weight Condition
b. Air vehicle Center of Gravity Position
c. Type of Airfield Surface (Paved or Unpaved)
d. Strength of Airfield Surface
e. Level of Operation (Frequency or Total Number)
f. Tire Operating Limits.
It should be understood that flotation requirements are usually in conflict with brake sizing,
wheel well volume, and location, and often affect the plane form shape of the air vehicle, as well
as the number of tires and tire pressures used. This is a result of obtaining the largest tire
profile at the lowest possible pressure with the biggest wheel spacing (on multiple wheel
configurations) which force the air vehicle to give a large space to store the gear in during flight.
Flotation criteria were previously identified in AFSC DH 2-1.
Air Vehicle Conditions: In the case of paved airfields, it is usually best to specify the maximum
gross weight that will be used for ground operation. Center of gravity position may not be too
critical for paved airfields, however, specification as nominal, average or most critical makes the
requirement more exact. The gross weight and center of gravity specified for unpaved airfield
operation will usually be specified in terms of a specific mission condition. A specific weight
should not be specified.
a. Type of Airfield Surface. The requirement should at least specify a paved or unpaved
surface. Paved is considered to include rigid concrete surfaces, flexible asphalt surface
and combination rigid and flexible surfaces. Unpaved means bare soil without
vegetation with soil of any combination of sand, silt, or clay. Specification of landing mat
or membrane surfaced airfields is not recommended. Experience has indicated that
performance of these surfaces to applied loads is highly variable and difficult to predict.
Also the type of surface in use at the time the air vehicle becomes operational may be
182
JSSG-2009A
APPENDIX A
much different than that in use at air vehicle conception. Landing mat and membrane
development cycles are not keyed to air vehicle development.
b. Strength of Airfield Surface.
1. Paved Airfields - Possible approaches to this parameter include the following:
(a) Provide a list of the airfields to be used. This will require that a pavement
evaluation report for each airfield be provided to the contractor. This is the most
exact method, but may be difficult to accomplish due to lack of pavement
evaluation data.
(b) Analyze the pavement evaluation reports of airfields to be used and develop a
single chart to summarize most critical pavement characteristics. This has the
same disadvantage as “a” but has an advantage in that it avoids the necessity for
the Air Force to identify positively the final list of airfields to be used.
(c) Analyze an existing operational air vehicle and develop a rigid pavement and a
flexible pavement requirements chart for operation at a condition comparable to
the new air vehicle requirement. See “Aircraft Landing Gear Brake Squeal and
Strut Chatter, Investigation” by F. A. Biehl, The Shock and Vibration Bulletin,
January 1969, for an explanation of the phenomenon and a method of analysis to
develop the chart. This approach has been used successfully. Although less
exact, it permits establishment of a requirement without knowledge or
examination of the exact airfields to be used.
(d) Specify that the airfields to be used are light, medium, or heavy load airfields as
specified by AFM 88-6. The manual, in turn, then provides details of the
pavement construction. A fallacy in this approach is that it assumes that all of
the airfields will comply with AFM 88-6 criteria. In fact, very few military airfields
comply entirely. Commercial and foreign airfields are constructed to different
criteria.
(e) Specify the minimum Load Classification Number (LCN) of airfields to be used.
The LCN method is an index approach used in many foreign countries to match
air vehicle loading to airfield strength. Administrative limits prohibiting operation
of air vehicle with LCN exceeding the airfield LCN are common. If the air vehicle
is to be used extensively on airfields under foreign control, the LCN of the
airfields to be used should be reviewed and an appropriate LCN specified. A
detailed description of LCN can be found in ASCE Transportation Engineering
Journal, November 1973, Page 785. The U.S. Army Corps of Engineers does
not recognize the LCN approach as a valid method of pavement strength rating.
Caution is advised in use of only the LCN approach if the air vehicle is to be
operated in both foreign and U.S. military airfields.
(f) It should be noted that high tire pressures (greater than 300 PSI) used on recent
air vehicles are inflicting irreversible damage to bituminous taxiways. Initial tire
sizing is very important and should allow for future growth without causing
pavement damage.
2. Unpaved Airfields:
(a) The strength of unpaved airfields is usually expressed in terms of California
Bearing Ratio (CBR). The CBR is defined and measured in accordance with
183
JSSG-2009A
APPENDIX A
MIL-STD-621. The U.S. Army Corps of Engineers recommends use of a CBR 4

for design because this is the minimum strength that is suitable for airfield
construction. This concept assumes that an area will not be used for air vehicle
operation unless it is suitable for operation of airfield construction equipment.
Recently, joint Army and Air Force operational analysis has indicated that CBR 6
is a more practical limit to operation. A CBR 9 was used for C-5A and C-17 air
vehicle development. This was selected solely on the basis that it appeared to
provide the same bearing strength as the landing mat on CBR 4 originally
specified. The latter requirement was abandoned because of the inability to
predict accurately landing mat performance to repeated landing.
(b) An alternative to specification of CBR is to use a cone penetrometer reading
known as Airfield Index (AI). CBR measurement is a tedious process not
practical for extensive measurements during air vehicle test on unpaved
surfaces. AI measurements can be made rapidly. Consequently, nearly all air
vehicle test data is presented in terms of AI rather than CBR. AI and CBR
correlation varies from soil to soil. This is because CBR is a measure of confined
bearing strength of soil, whereas AI is a measure of bearing strength plus soil
cohesion. Presently, flotation technology is in a state of transition from CBR to
AI. CBR should be used until a suitable procedure for correlation of ground
flotation to AI is published.
c. Level of Operation. The level of operation intended on a selected airfield type and
strength is a significant factor. Short time overloads of paved airfields may be necessary
or desirable. Specification of unlimited operation for cases that actually involved very
limited use, results in extreme weight and cost penalty to the air vehicle. Design levels
for normal operation on paved airfields may be selected from those specified in AFM 88-
6. The level of operation on unpaved airfields should be determined by analysis of the
mission to be performed. An alternative is to determine the estimated capability of an
existing air vehicle on the specified unpaved surface and then relate the new air vehicle
requirement to the capability of the existing air vehicle.
d. Tire Operating Limits. Frequently, it is desirable to establish a limit on the amount of tire
deflection permitted to meet the ground flotation requirement. Most ground flotation
analysis methods are very sensitive to tire deflection (under inflation). Theoretically, this
provides the required flotation. In practice, it is not achievable because tires will not
perform properly or have satisfactory life. A suggested limit is 40 percent (40%)
deflection for bias ply tires. This should be adjusted, however, in the case of flotation
requirements applied to destination conditions. For example, a cargo air vehicle may of
required to deliver cargo to an unpaved airfield. Tire limits should be applied to the
original takeoff conditions rather than the destination conditions. Enroute deflation to
permit use of low pressure at the destination was applied to the C-5A aircraft. This
approach is not recommended because it adds excessive complexity to landing gear
and wheels.
184
JSSG-2009A
APPENDIX A
A.4.4.1.2.1 Ground flotation.

The flotation capability shall be verified by (TBS) .
Bases for the procedures are results of US Army Corps of Engineers test of pavement and soil
sections. All tests were accomplished at low speeds with ground carts. The failure criteria for
paved airfields are surface cracking. The failure criteria for unpaved airfields are three inches or
permanent rutting. All tests on unpaved surfaces were accomplished by straight rolling on an
unbraked wheel.
Verification of unpaved airfield flotation by demonstration or test is not considered practical.

The primary problem is establishment of a safe airfield with uniform strength characteristics at
the specified value. Flight test of the air vehicle on an unpaved airfield may be desirable to
develop flight handbook procedures, and to qualitatively evaluate system suitability. This test,
however, should not be established as a verification method for the stated flotation requirement.
TBS should be filled in with analysis using standard acceptable industry method for unprepared,
semi-prepared, and prepared runway surfaces. The analysis should reflect the air vehicle
mission requirements for the type of operation requested by the user.
Analysis using the procedures contained in ASD-TR-70-43 for paved airfields and ASD-TR-68-
34 for unpaved airfields or analysis in accordance with the LCN procedure of
ASCE Transportation Engineering Journal, November 1973, or analysis from ICAO Airfield
Design Manual was previously used.
The rigid pavement procedures of ASD-TR-70-43 evaluate concrete stress at the center of the
slab due to a loading at the center of the slab. Air Force Civil Engineering, U.S. Army Corps of
Engineers and Federal Aviation Agency rigid pavement design methods evaluate concrete
stress at the edge of the slab due to a loading at the edge. This approach results in maximum
stress up to 25 percent (25%) greater than the method used by ASD-TR-70-43. This increase is
somewhat offset by assumption of level transfer to adjacent concrete slabs. In the event that
ground flotation requirements are closely related to design of a specific pavement, it may be
best to evaluate the landing gear design by the exact method of the appropriate agency.
It has been often noted that when more than one tire pressure is used to meet the flotation
requirement, the user may be reluctant to change the tire pressure for any individual mission.
Thus, it is more preferable to meet the requirement with the normal tire pressure.
The C-5 had and on-board inflation and deflation system to meet the flotation requirement, this
was subsequently removed due to lack of use and unscheduled maintenance to fix leaks. Thus
consider carefully the use of onboard inflation and deflation devices, and ensure they can meet
maintenance requirements.
185
JSSG-2009A
APPENDIX A
A.3.4.1.2.2 Ground handling
A.4.4.1.2.2 Ground handling
A.3.4.1.2.2.1 Jacking provisions and conditions
A.4.4.1.2.2.1 Jacking provisions and conditions
A.3.4.1.2.2.1.1 Axle jacking.

Axle jacking shall be capable of raising (TBS 1) weight air vehicle high enough to perform
required maintenance while exposed to (TBS 2) crosswind from any direction.
REQUIREMENT RATIONALE (3.4.1.2.2.1.1)
This requirement establishes axle-jacking capability.
REQUIREMENT GUIDANCE (3.4.1.2.2.1.1)
TBS 1 should usually reflect the maintenance operations of the air vehicle dictate the need to
jack a maximum design gross weight air vehicle.
TBS 2 lists a crosswind limit set at a value which can realistically be expected in service usage
and when the user would expect to still be performing maintenance functions requiring jacking.
Arbitrarily, this value should be 15 knots to be consistent with structural design criteria. The
structural load factors will be defined by the applicable structures criteria document.
Air vehicle gross weight, center of gravity location, strength of the jack pad, and attachment are
influences on meeting this operational need.
This requirement is an expansion of MIL-A-8860 criteria to include crosswind limits.
REQUIREMENT LESSONS LEARNED (3.4.1.2.2.1.1)
None.
A.4.4.1.2.2.1.1 Axle jacking.

Jacking capability and provisions shall be evaluated on the air vehicle during the flight test
program to the specified limits of the system. Crosswind compatibility shall be verified by
analysis.
VERIFICATION RATIONALE (4.4.1.2.2.1.1)
The risk and time associated with exposing valuable test air vehicle to high crosswinds during
flight test is too high. Therefore, analysis of crosswind capability is satisfactory. However, it is
important to demonstrate the basic axle jacking capability on the air vehicle to evaluate
component compatibility and design capability.
186
JSSG-2009A
APPENDIX A
VERIFICATION GUIDANCE (4.4.1.2.2.1.1)
Required jacking capability and provisions should be demonstrated on the air vehicle. Jacking
should be demonstrated in the wind available, performance under the full wind velocity should
be verified by analysis. Jacking demonstration should use an air vehicle configured to the most
critical weight and center of gravity location. As a minimum the following demonstrations should
be accomplished using only production support equipment: (1) Replacement of the main wheel,
tire, and brake with tire inflated; (2) Replacement of nose wheel and tire with nose tire initially
deflated; (3) Replacement of main wheel and tire with main tire initially deflated.
VERIFICATION LESSONS LEARNED (4.4.1.2.2.1.1)
If the air vehicle is to be operated in a worldwide environment, then the jacking interface need to
meet the international requirements for international support equipment (such as NATO
Standardization Agreements (STANAGs)).
A.3.4.1.2.2.1.2 Fuselage jacking.

See JSSG-2006, Structures Joint Services Specification Guide, “Maximum Airframe Jacking
Weight” requirement.
A.4.4.1.2.2.1.2 Fuselage jacking

See JSSG-2006, Structures Joint Services Specification Guide, “Maximum Airframe Jacking
Weight” verification.
A.3.4.1.2.2.1.3 Landing gear towing.

Interfaces shall be provided on the landing gear for pushing or towing the air vehicle at (TBS 1)
gross weight up or down a (TBS 2) slope on a (TBS 3) surface.
This is to ensure the air vehicle and the landing gear subsystem can withstand the loads
imparted while towing, and to ensure that the interface between the air vehicle and towing
equipment are adequately defined.
TBS 1 should reflect maximum design gross weight usage. The air vehicle should be able to be
pushed or pulled over a required slope should that reflect the expected usage.
TBS 2 should typically be 3 -slope.
TBS 3 should address towing under maximum conditions should probably be limited to dry
concrete surfaces, but any special case can be reflected in this requirement. Towing at angles
other than straight-ahead is implied by the operational concept of the requirement. Towing
provisions should be compatible with STANAG 3278.
187
JSSG-2009A
APPENDIX A
Details of the tow bar and tow bar attachment, strength of the landing gears for horizontal loads,
runway surface conditions, available coefficient of friction, and angle of load application have
influence on meeting the requirements stated above. The detail characteristics of the towing
vehicle also impacts meeting the requirement.
This requirement is clarification of criteria, which has been implied in MIL-STD-805 and MIL-A-
8862. As stated, it is a new requirement even though a similar requirement has been
individually applied to numerous air vehicles.
Compatibility with the nose gear steering system is a serious consideration. On some gears,
towing is permitted to the limits of the powered system, but any additional input can result in
damage to the steering system. This interface is very important.
Several gears have been damaged because the towing vehicle exceeded the limit drag force,
sheared the safety pin, replaced the pin with a stronger material, then repeated the high drag
force pull. Instead of shearing the pin, the excessive load is reacted by the nose gear and
structural failure occurs. This recently occurred on the F-5.
Depending on the air base, frequent use of the tow bar is a possibility. Therefore, simple and
reliable installation is a clear requirement.
Consideration should be given to the air vehicle brake modulating system to prevent
overloading the nose landing gear and air vehicle backup structure when the air vehicle brakes
are being used during towing. Of special concern is the use of on and off brake pressure at
maximum towing speeds.
A.4.4.1.2.2.1.3 Landing gear towing.

Performance of the towing system shall be verified by (TBS) .
Since there is considerable interface with the Aerospace Ground Equipment (AGE) and the air
vehicle, this requirement is best verified with all the parts operating as a system on the air
vehicle.
TBS: Towing capability should be verified by analysis, inspection of drawings and layouts, and a
ground test demonstration with production and international support equipment. The
demonstration should start with a stationary air vehicle and as a minimum include at least the
following:
a. Towing at the maximum weight, with engines off, at most critical towing angle up the
required slope.
188
JSSG-2009A
APPENDIX A
b. Towing at maximum weight, with engine off, at most critical towing angles down the
required slope.
c. Towing at angles outside of the powered steering range. Emergency fore and aft pulling
provisions should be verified by analysis.
Adequate provisions and documentation should be established to prevent any towing action that
will cause damage to the air vehicle, steering system or the towing implements. If there are
physical stops on the steering system, then either quick disconnected are need on the gear, or
the ground equipment need to have shearpins or some other device to prevent overloading the
gear if towing angle limits are exceeded.
A.3.4.1.2.2.1.4 Emergency towing.

The landing gear shall have the following provisions for emergency towing: (TBS) .
There are options available for emergency towing of the main and nose landing gear. Normally,
this requirement is used for identifying towing lugs or rings.
TBS should reflect the expected gear towing in the fore and aft directions under the emergency
conditions expected to occur in field usage. The interface should be compatible with available
ground equipment, both domestic and international.
Details of the tow vehicle attachment, tow ring design details, strength of the gear, and
operating terrain control meeting this operational need.
This requirement reflects the criteria of MIL-STD-805 and the implied performance of MIL-A-
8862. It is a clarification.
Some recent large air vehicles have received a deviation to equipping each main gear with
emergency towing lugs. However, provisions for installation are provided. The risk that is taken
by this action is the availability of the lugs when the need arises. If the need for emergency
towing arises in a relatively remote area, the probability of having tow lugs located in the
proximity is low.
The probability of needing emergency towing capability is very high for each off-runway
situation. If the air vehicle is remotely dispersed or an emergency is inadvertently encountered
due to an incident, the use of lugs is very likely. This is assuming that the air vehicle is in an
environment for which it is not normally intended to operate.
189
JSSG-2009A
APPENDIX A
A.4.4.1.2.2.1.4 Emergency towing.

Performance of the main gear towing system shall be demonstrated on the air vehicle during the
ground test program.
The capability of using the main gear as a towing attach point to extract that air vehicle from
certain undesirable positions should be specified in accordance to the user expectations.
Towing capability should be verified by analysis, inspection of drawings and layouts, and a
ground test demonstration with production and international support equipment. The
demonstration should start with a stationary air vehicle
(TBD)
A.3.4.1.2.2.1.5 Towing interface.

The interface between the air vehicle and tow vehicle shall be as follows: (TBS) .
This requirement is to define configuration or performance requirements to insure compatibility

of the air vehicle towing fittings and the tow bar or tow vehicle. Other areas to be considered
include steering of the air vehicle during towing and communications between the towing crew
members.
TBS should provide dimensions of towing fittings that are the subject of an international
standardization agreement. Air vehicles intended for worldwide operation should comply to
insure compatibility with towing equipment in various countries (that is, NATO STANAG 3278).
Consider a requirement that the tow fittings be compatible with the appropriate standard tow
bar. This requirement should be coordinated with ground equipment specification requirements.
Normally it should be required that the air vehicle be designed to permit the air vehicle to be
steered by the tow vehicle, it may be desirable to require that this be done without disconnect of
the air vehicle steering system.
Air vehicle size and weight, quantity of air vehicles to be built and type of operation (world-wide
or local) are primary factors to be considered in establishment of this requirement.
190
JSSG-2009A
APPENDIX A
Most of the items covered by this requirement were included in MIL-STD-805 and
AFSC DH 2-1.
a. Most existing air vehicles can be towed without disconnecting the steering, provided that
the normal steering range is not exceeded. Tow bar shear pins are provided to prevent
damage in the event the steer angle is inadvertently exceeded. Experience indicates
that these pins are sometimes replaced by high strength pins and nose gear damage
results from exceeding the steering limit. The steering limit should be clearly marked on
the air vehicle because it is too difficult for the tow operator to detect angle limits or see
markings on the nose gear strut. Air vehicle markings should be at least 5° inside of
absolute mechanical limits.
b. It is possible on most current air vehicle to disconnect the steering during towing so that
the tow angle may exceed the normal steering angle. After disconnect of the steering
system, it should be possible to turn the gear up to +180 from the straightforward
position. A lesser angle (+120 ) may be sufficient for towing, but again could result in
structural damage, if exceeded.
c. The method used to disconnect the steering is very critical. If frequently used, the
resultant wear may increase free play to the point that nose gear shimmy becomes a
problem. Failure to reconnect the steering or incorrect connections have been problems
on some past designs. Automatic disconnect methods avoid most of these problems,
but should also include a method to detect that the landing gear is out of the normal
steering range and return it to the proper position for taxi. Particular attention should be
given to proper detection of the 180 position because most landing gears are unstable if
driven in reverse at high speeds.
d. Nose gear designs, such as the T-37, which require peculiar AGE, such as “stiff knees”
during towing to preclude collapse of the gear have encountered difficulty. Such a
design approach is currently considered to be undesirable. This was highlighted by
AFLC/AFALD in their Lessons Learned.
e. It is difficult for tow vehicle operators to push back a tailless air vehicle. The absence of
a long fuselage makes it difficult for the operator to sense his position relative to the
centerline. This may be additionally problematic if the wheelbase/track ratio is low since
the sensitivity to the tow bar angle is greater. Provide a visual indicator of angle on the
nose strut that is visible to the tow operator. Something as simple as large tick marks
painted at 60, 0, +60 on the upper strut and a single tick mark below the pivot could be
sufficient.
191
JSSG-2009A
APPENDIX A
A.4.4.1.2.2.1.5 Towing interface.

Towing interface shall be verified by (TBS) .
Due to the complex interaction of the air vehicle and support equipment verification should be
accomplished by demonstration.
TBS: Towing interface should be verified by analysis, inspection of drawings and layouts, and a
ground test demonstration with production and international support equipment.
(TBD)
A.3.4.1.2.2.1.6 Mooring provisions.

Mooring provision shall be compatible with (TBS 1) , and shall be capable of withstanding
(TBS 2) with all surfaces locked, at (TBS 3) gross weight.
Landing gear should be compatible with standard mooring patterns. This is a performance
requirement for the landing gear with mooring equipment attached. The amount of crosswind
identified should be the same as that selected for structural design. Nominally, the value is
70 knots and it applies to any gross weight.
TBS 1 should reflect the expected mooring arrangement that the landing gear will see in
service.
Mooring patterns, mooring attachment details, mooring methods, and attachment strength
control this requirement.
TBS 2 should reflect the mooring capability of withstanding a 70-knot wind from any horizontal
direction, with all air vehicle surfaces locked.
TBS 3 should be filled in with all gross weight configurations, Preloading of the mooring
provisions resulting from strut compression beyond the gross weight static position should be
included.
Mooring fitting strength and mooring loads control meeting this requirement.
192
JSSG-2009A
APPENDIX A
The strength requirement is derived from the legacy specification MIL-A-8865. This indicates
mooring in a 70-knot crosswind. The MIL-A-8865 requirement is a direct derivative of MIL-A-
8865, which requires mooring in a 75-mph wind.
Several recent air vehicles have waived the mooring requirements. But, this basically is a Using
Command decision. If the mooring is not to be used to survive in adverse weather, it may be
more expedient to dispatch to air vehicle to other bases rather than to take the risk of weather
damage.
Generally, the gear design uses the same attachment for mooring and emergency towing. The
towing lug makes a convenient attachment for a mooring cable.
The legacy MIL-T-21063 can provide tie down details. The inside diameters of tie down rings
should not be less than one inch.
MIL-T-81259 provides standard mooring patterns.
If at all possible, the same attachment for emergency towing and mooring should be used on
main gears to minimize the weight to accommodate this capability.
Caution should be used in nose gear mooring arrangements to avoid damaging control
equipment when the mooring cables are installed.
193
JSSG-2009A
APPENDIX A
A.4.4.1.2.2.1.6 Mooring provisions.

The mooring provisions shall be verified by (TBS 1) . Mooring conditions shall be verified by
(TBS 2) . Design characteristics and component compatibility shall be evaluated.
AGE - Air vehicle interface is best demonstrated on the actual air vehicle. Analysis cannot
adequately evaluate this characteristic.
TBS 1: Mooring provisions should be verified by analysis, inspection of drawings and layouts,
and a ground test demonstration.
TBS 2 should reflect the ability to moor the air vehicle in a demonstration using only production
support equipment. Resistance to wind loads while moored, including preload of the shock
absorbers, should be verified by analysis.
(TBD)
A.3.4.1.2.3 Ground FOD.

Landing gear forward of engine inlets shall be designed and located to minimize FOD and water
ingestion into the engine.
This requirement is presented to reduce detrimental engine performance due to water or other
contamination thrown by the landing gear during ground operations.

(TBD)
(TBD)
194
JSSG-2009A
APPENDIX A
A.4.4.1.2.3 Ground FOD.

(TBD)

(TBD)

(TBD)

(TBD)
A.3.4.1.3 Structure
A.4.4.1.3 Structure
A.3.4.1.3.1 General provisions.

See JSSG-2006, Structures Joint Service Specification Guide.
A.4.4.1.3.1 General provisions.

See JSSG-2006, Structures Joint Service Specification Guide.
A.3.4.1.3.1.1 Material selection.

Material selection shall be made in accordance with (TBS 1) , except as modified by (TBS 2).
Alloy selection, manufacturing processing, protective finishes, surface finishes, plating methods,
and material properties are important factors in the success of the landing gear design. The
major modes of failure for landing gear equipment are frequently structural and this is a very
important consideration.
TBS 1 should be filled in with requirements from MIL-HDBK-1587 and MIL-HDBK-1568.
TBS 2 should be completed by reference to the document used to tailor the standards.
195
JSSG-2009A
APPENDIX A
The material selection methods and corrosion control plans identified in MIL-HDBK-1587 and
MIL-HDBK-1568 are a compilation of experience and lessons learned by the Air Force Materials
Laboratory and the ASD/Industry counterparts. They evolved into AFML 70-7, “Do’s and Don’ts
of Materials Application.” This unofficial documentation has been directly inserted in several
recent development programs’ System Specifications. It reflects much of the experience of the
landing gear industry and lessons learned in landing gear service difficulties. Much of the
criteria were contained in MIL-L-8552, Amendment 1, and reflect the former Aeronautical
Systems Division/Ogden Air Logistics Center Task Group lessons learned.
a. There have been many lessons learned in landing gear material and processes. Ogden
ALC personnel contributed significant improvements and observations in this area.
b. In addition to guidance provided in MIL-HDBK-1568 and MIL-HDBK-1587, the following
items apply to landing gear design and processing as recommended practices:
c. Where steel forgings are used, use only vacuum arc remelt parts.
d. The preferred method of cold straightening of steel parts hardened to tensile strength of
200,000 psi and above would be to temper the parts while in a straightening fixture.
e. Magnetic particle inspection should be performed on all finished steel parts which are
heat treated in excess of 200,000 psi ultimate tensile strength.
f. Many parts are received with forging laps or inclusions that were in the part at time of
manufacture. These defects may not be detrimental to the service of the part; however,
when the part is magnetic particle inspected at depot after service, inspectors cannot
determine that these indications are forging laps and not fatigue cracks and, therefore,
the part may be rejected.
g. Bushings should be limited to non-ferrous materials for the principal static and dynamic
joints.
h. All joints should be bushed to facilitate depot rework.
i. Considerable numbers of problems have been experienced where bushing materials
have been made from Teflon and phenolic type materials. These should not be used
without verification of wear life expectancy or a rework procedure available for
refurbishment of the bearing. Consideration should be given to the need and also to the
placement of adequate grooves and their configuration for providing lubrication to all
areas of the joint.
j. All surfaces, except holes under 3/4-inch in diameter, of structural forging forged from
stress-corrosion susceptible alloys which, after final machining, exhibit transverse grain
exposed in the surface, should be shot peened or placed in compression by other
suitable means.
k. All interior surfaces of hollow landing gear components, pins, and fasteners should have
suitable corrosion protection to prevent degradation of capability.
l. Areas of components considered to be critical in fatigue should have a surface
roughness in the finished product not to exceed 63 rhr, as defined by ASME B46.1, or
should be shot peened, with a surface roughness prior to peening of not over 125 rhr.
196
JSSG-2009A
APPENDIX A
Unmachined aluminum die forging should be approximately 250 rhr, except surfaces
where flash has been removed.
m. Efforts should be made to reduce stress concentrations such as, using stress relief heat
treatments (except aluminum alloys), try to optimize grain flow orientation, use “wet
installed” inserts and pins and extensive use of surface cold working.
n. Avoid cross drilling of joint pins. Drilling operations result in material surface damage
and stress risers that are difficult to control.
o. Consideration should be given to the location of drain holes to ensure they will properly
drain and reduce the probability of corrosion.
p. The short transverse grain direction, if exposed, should not be subjected to any
sustained tensile loads.
A.4.4.1.3.1.1 Material selection.

Material selection shall be verified.
The landing gear becomes an integral part of the airframe structure and review of materials and
processes is accomplished in the same manner as the rest of the structure.
Material selection should be in accordance with the required standards.
(TBD)
A.3.4.1.3.1.2 Roughness and runway repair profile criteria.

The landing gear shall operate without degradation of performance or service life on surfaces
with the following roughness characteristics: (TBS) .
The roughness of the surfaces to be used by the air vehicle is a major consideration in design of
the landing gear. In all cases it provides the input for design of landing gear response to control
ground loads to a level to provide the required air vehicle life. In the case of operation on
unpaved airfields, it may also establish limits on landing gear arrangement and tire size to
ensure that the air vehicle is not immobilized by the specified roughness.
197
JSSG-2009A
APPENDIX A
TBS should be filled in with one or two aspects of roughness. The first should be a discrete
bump or dip criterion that establishes the maximum roughness to be encountered. The second
is the frequency of occurrences of the various levels or roughness. The air vehicle gross weight
condition and operating requirements should also be stated. In the case of paved airfields, this
is usually all weights to maximum gross weight and all ground speeds to the maximum required
for takeoff and landing. In the case of air vehicles to be operated from unpaved airfields, the
gross weight is usually limited to that required for missions to be performed from unpaved
airfield.
The paved airfield curve should be specified for all air vehicles along with a requirement for
negotiation of one inch step bumps. The semi-prepared (matted soil) airfield curve and a two-
inch step bump should be specified for most air vehicles to be operated on unpaved surfaces.
The unprepared airfield curve and a four-inch step bump are considered severe and are rarely
used.
For forward field operation, bomb damage repair criteria needs to be established. During the
Have Bounce Program bump profiles corresponding to categories A, B, C, D, E, and I bumps
were defined based on repair mat profiles. It was found that most existing air vehicles were
limited to category A or B bump profiles. It was shown through testing that gear could be easily
modified or designed to handle C, D, and even I bumps, if needed. It is recommended that for
wartime operation over bomb damage repair, the gear be designed to category E bump criteria
as a minimum to provide the quickest turnaround for the Rapid Runway Repair (RRR) group
and for the most effective wartime operations.
Performance parameters include gross weight, ground speed, lift characteristics and frequency
of operation on unpaved airfields.
This requirement was previously stated in MIL-A-8862. The criteria are based on airfield
roughness surveys conducted by the Air Force Flight Dynamics Laboratory in the early 1960’s.
The Have Bounce Program defines repair profiles and provides the basis for RRR philosophies.
Wartime operational scenarios should dictate the capabilities needed for operation.
Laboratory testing and on air vehicle demonstration has shown that the gear can be designed,
without any significant impact to gear weight, to handle bomb damage repair profiles of
4.5 inches or more than the runway surfaces. The internal changes can be accomplished on
existing gear designs or incorporated on new designs as required. By being able to handle
greater bump heights the fatigue life of the gears and air vehicle structure are improved and the
time to repair the runway to a condition to launch air vehicles is significantly reduced.
198
JSSG-2009A
APPENDIX A
A.4.4.1.3.1.2 Roughness and runway repair profile criteria.

Performance during and after operation on surfaces of specified roughness shall be verified by
(TBS) .
Performance is a result of a complex interaction of air vehicle systems and the environment.
Consequently, this requirement is best verified by air vehicle test. Testing can be accomplished
on discrete bumps constructed to duplicate the specified roughness. Testing on a specified
random roughness is usually impossible. An approach used in the past is to conduct taxi tests
on two or three airfields to validate a dynamic response analytical model. The requirement is
then verified by the validated analysis.
TBS should reflect an analysis of all expected bump and roughness profiles that the air vehicle
will traverse, during ground operations up through rotations as applicable to the user mission
requirements. The analysis should be substantiated with air vehicle operations over known
bumps and repair profiles.
The significance of airfield roughness to performance of a given air vehicle is somewhat

dependent upon the characteristics of the air vehicle. Analysis should be used to select most
critical roughness for test. Usually a bump or dip wavelength critical for one design will not be
critical for another.
Several simulated rough surfaces have been constructed at Edwards Air Force Base (AFB) for
evaluation of existing air vehicles. These surfaces may not be suitable for test of a new design
because they do not represent the most critical condition. Test on these surfaces, however,
may be useful for validation of a dynamic response analysis model.
Portable surfaces to simulate roughness were constructed for evaluation of the C-5A air vehicle.
These surfaces may be fastened to paved runways for taxi testing. These surfaces were in
storage and available for use as of early 1977. The Air Force program manager at the
Lockheed-Georgia Company should be contacted concerning availability of these surfaces.
A.3.4.1.3.1.3 Failure tolerance.

In the event of landing gear structural failure, the following failure modes shall be prohibited:
(TBS) .
This requirement is to establish limits on structural failure modes to minimize secondary effects.
199
JSSG-2009A
APPENDIX A
TBS should be completed by a statement of prohibited failure modes. It may also be necessary
to further define the conditions of failure. As an example, a statement for a transport air vehicle
might read, “pierce a crew station or passenger seating area, or result in spillage of enough fuel
from any part of the fuel system to constitute a fire hazard. It should be assumed that failure
occurs during takeoff or landing and that landing gear loads are acting in the upward and aft
directions except when the air vehicle departs the runway.”
Equipment affecting safety of flight, if located in the wheel well, should be protected from tire
blowout.
Hydraulic brake lines located on or near the landing gear should be protected against tire
disintegration related damage.
Landing gears should permit rapid replacement of main wheels, tailwheels, or nosewheels.
There are numerous causes of gear structural failure and every precaution is taken to avoid
such events. However, action can be taken by design to control the modes of failure. Every
effort should be taken to keep failed landing gear components from the cockpit area, from
severing hydraulic lines, or from penetrating the fuel tank areas. The results of such an inability
are obvious. This occurred with the F-89 and commercially on the 747. Subsequent redesigns
have corrected these modes of failure.
There was an incident with the KC-135 in which the bogie beam experienced a failure and the
failed parts pierced the water tank adjacent to the wheel well. With proper control of failure
modes, this could have been avoided.
The Navy has experienced numerous landing gear failures that struck the fuel tanks and caused
fires. However, with proper precautions and cautions, this problem has been minimized.
A means should be provided (such as a large washer behind the axle nut) to ensure wheel
retention on the axle in case of a bearing failure.
A.4.4.1.3.1.3 Failure tolerance.

Failure tolerance shall be verified by (TBS) .

(TBD)
Analysis should permit a wide variety of options to be studied and evaluated.
200
JSSG-2009A
APPENDIX A
TBS: An analysis of probable gear failure locations and surrounding air vehicle structure should
be accomplished to minimize adverse effects.
In the past, the cost and risk were too high to permit evaluation by test or demonstration.
A.3.4.1.3.1.4 Strength.
The landing gear subsystem shall not (TBS) .
The landing gear subsystem should be strong enough to support all the operational missions
specified in the air vehicle specification for all environments and conditions it is expected to
operate.
TBS should be stated as follows:

a. Exhibit detrimental permanent set, yielding, or damage due to ground, flight, operational,
and logistics limit load envelopes specified in the air vehicle specifications.
b. The structural components should not temporarily deform to the extent that functional
performance is significantly affected within the flight and ground envelope conditions.
c. Catastrophically fail due to ground, flight, operational, and logistics ultimate load
envelopes, at a 1.5 safety factor, or as specified in the structural loads documents.
(TBD)
A.4.4.1.3.1.4 Strength.
The strength of the landing gear subsystem shall be verified by (TBS) .
Verification of the yield and plastic deformation range of the structure should be such as to
preclude such deformation would prevent landing gear subsystem from performing as
commanded or required to complete the mission.
TBS should reflect the analytical and test method listed in the structural specifications for
verification of air vehicle structure.
201
JSSG-2009A
APPENDIX A
(TBD)
A.3.4.1.3.1.5 Durability.
The Landing Gear structure shall be designed for at least (TBS 1) lifetime representative
spectrums based on operational loads and the air vehicle service life.
The Landing gear systems shall be designed for at least (TBS 2) lifetime representative
Landing Gear components shall be designed for at least (TBS 3) lifetime representative
The Landing Gear actuation system, including the backup structure, actuators, doors and
mechanisms, and locking details, shall be capable of (TBS 4) retraction/extension cycles, of
which (TBS 5) (cycles shall include emergency extensions).
Landing gear subsystem should have design lifetimes to ensure the system will last the life of
the air vehicle.
TBS 1: For non-damage tolerant structure should be four (4), for structure design to damage
tolerant criteria, should be two (2).
TBS 2: System life operation should reflect two (2) lifetimes of operation.
TBS 3: For components that are not considered limited life should be four (4) lifetime capable.
TBS 4: The actuations system and all its components should have the capability of 10,000
cycles.
TBS 5: 500 cycles of the number for TBS 4 are for emergency extensions.
The actuation number of cycles should take into account the number of touch and go cycles as
well as the normal and emergency operation.
(TBD)
202
JSSG-2009A
APPENDIX A
A.4.4.1.3.1.5 Durability.
The durability of the landing gear subsystem shall be verified by (TBS) .
Based on the latest structural design practices and determination of the operational cycles of
the landing gear through all phases of air vehicle operations, the expected life of the gear and
its systems should be determined.
TBS should be filled in with analysis, testing and material properties validation that supports the
required life of the systems needed to meet air vehicle mission and life requirements.
(TBD)
A.3.4.1.3.1.6 Corrosion protection.

(TBD)
(TBD)
(TBD)
(TBD)
A.4.4.1.3.1.6 Corrosion protection.

(TBD)

(TBD)
(TBD)
203
JSSG-2009A
APPENDIX A
(TBD)
A.3.4.1.3.1.7 Flat tire and flat strut operation.

In the event of a flat tire or a depressurized shock absorber, the gear shall be capable of
(TBS) without structural damage to the gear or the air vehicle.
The objective of the requirement is to establish performance capability of the landing gear under
the emergency condition for a selected component failure, which has a reasonably high
probability of occurring.
Consideration is also given to insure that sufficient ground clearance is maintained, particularly
on air vehicles that have external stores and fuel tanks. It is possible to have ground contact
with these stores while performing normal landing and takeoff operations.
TBS should describe an average landing condition. For example, a flat strut-landing
requirement could be a landplane-landing-weight air vehicle landing at 6-feet/second vertical
contact velocity. It will also be necessary to identify ground-handling limits that might be
expected under these conditions.
Air-oil characteristics of the strut, metering pin-orifice combination, wheel frangibility, and
operating techniques have significant impact on this requirement.
This is a new requirement not previously defined, prior to system development. This emergency
capability has been implied and left to the undefined risk of the Using Commands. Some
portion of the criteria has been contained in MIL-A-8862 for flat tire design load conditions.
There has been a requirement for design strength dating back to ANC-2, but only an implied
operational capability that has never been demonstrated.
Frequently, if the gear is not properly positioned upon touchdown, the necessary system
actuations can be jeopardized. Landing with a flat strut, for example, may result in loss of anti-
skid control. Without warning or prior notice, this type of system malfunction can lead to
numerous difficulties.
In the event the condition is unknown to the pilot, no precautions will be taken, so a limit on
performance is necessary to prevent loss of air vehicle.
204
JSSG-2009A
APPENDIX A
A.4.4.1.3.1.7 Flat tire and flat strut operation.

Landing gear energy absorption performance with a deflated strut or flat tire shall be verified by
(TBS) .
Normally, this can be accommodated during the jig drop test program. It provides a controlled
environment with no risk to an air vehicle. In the event difficulties are encountered when
demonstrating this emergency condition, the laboratory is a more suitable environment. In the
event that a test program is not planned, an analysis of the condition is the least that can be
expected.
TBS should reflect verification by analysis and laboratory drop test.
It is difficult to laboratory test both the flat strut and flat tire test and insure there will not be any
damage to the air vehicle. You can test to verify that there will be no damage to the gear during
a flat strut landing, and that the wheel will not come apart when landed with a flat tire. However,
it is too risky to demonstrate on the air vehicle and there will always exist a possibility that there
may be some damage to the air vehicle when it operates with a flat strut or flat tires.
A.3.4.1.3.1.8 Energy absorption.

The landing gear subsystem shall absorb sufficient landing energy such that (TBS 1) is not
exceeded under the following conditions: (TBS 2) .
This requirement is to establish shock absorption performance capable of meeting structural

load criteria defined in the system structural criteria documents.
TBS 1 should reflect the desired sink speed(s).
TBS 2 should be filled in with the air vehicle weight(s).
A number of sink speed and weight combinations can be specified to match a number of
different operating conditions.
Normally, these requirements are established as 10 feet/second sink speed at landplane

landing weight and 6 feet/second at maximum landing weight. If special system design
conditions exist, they should also be reflected in these performance requirements as an addition
to this criteria. In the past, a reserve energy criteria of 12.5 feet/second sink speed at landplane
205
JSSG-2009A
APPENDIX A
landing weight was imposed, with minor failures permitted. This represents a 50 percent (50%)
margin in energy capacity since the velocity function is squared in calculating the absorbed
energy.
The vertical travel of the wheels during operation of the shock absorber struts should be
sufficiently long to insure that ground loads which are based on load factors determined by drop
tests will not be appreciably more critical than other loading conditions for the carry-through
structure.
The sink speed or vertical energy requirements for shock absorber and landing gear design are
currently defined in MIL-A-8863. The standard vertical contact velocity has grown from
9 feet/second to 10 feet/second at landplane landing weight. Both the contact velocity and the
landing weight are frequent items of deviation and discussion. They should be established as a
direct result of operational analysis of the intended air vehicle.
Recent examples of special consideration of sink speed included C-5A and Advanced Medium
Short Take Off and Landing Transport (AMST). The C-5A rightfully assessed the operational
concept and reduced the landplane landing weight contact velocity to 9 feet/second in lieu of the
required 10 feet/second. This better meets the operational usage of the air vehicle and results
in weight saving.
On the AMST, the operational concept of the air vehicle calls for flights in and out of short bare
field runways in a hostile environment. Under these circumstances, the operational concept is
to increase the sink speed to reduce the stopping distance. A design contact velocity for this
condition will be established by analysis of the landing performance requirements. The C-17 air
vehicle that came out of the AMST program was design to operate at 14.5 ft/sec-sec sink speed
at mission weight for this very reason.
Another example of rational criteria is the use of higher sink speeds for trainer air vehicle. Since
the operator is inexperienced, the probability of high speed contact is significantly increased.
Therefore, the normal criteria is 13 feet/second sink speed or higher as determined by the user.
A.4.4.1.3.1.8 Energy absorption.

Landing gear shock absorption performance shall be verified by (TBS) .
Normally, this requirement is satisfied by demonstration during a jig drop test. The test not only
accesses the ability to absorb the vertical energy, it also serves the purpose of evaluation of
rebound, spring rates, damping in both directions, and other dynamic characteristics.
206
JSSG-2009A
APPENDIX A
There are several air vehicles that have flown on calculated metering pin-orifice combinations
with relative success. Most Navy gears have calculated pins, but they are ultimately evaluated
by dropping the total airplane in a fatigue drop test.
TBS should be accomplished by analysis and laboratory testing, with demonstration during flight
testing.
(TBD)
A.3.4.1.3.1.9 Ride quality.

The landing gear subsystem shall provide a ride such that the vertical accelerations at the pilot’s
station shall not exceed (TBS 1) on a (TBS 2).
Objective of the requirement is to establish quantitative ride quality requirements which can be
verified. Runway roughness has long been recognized as impacting the peak design loads and
the fatigue life of the basic airframe structure. Ride quality relates to pilot comfort and his ability
to function in the cockpit dynamic environment induced by ground loads and air vehicle
response.
TBS 1 should be filled by insertion of the acceptable acceleration limits.
TBS 2 runway surface roughness should be specified in detail and should match up with the
structural ground roughness criteria specified in the air vehicle specification.
As a minimum, the criteria should be based on pilot functional capability. In other words, criteria
should reflect the maximum levels of oscillation at which the pilot can continue to perform
required control functions. Air crew physical comfort should also be considered.
The prime example of problems for which this criteria is intended is the XB-70. The location of
the cockpit relative to the nose gear amplifies the vertical travel of the nose gear shock strut.
The problems that the designer is trying to avoid are primarily physiological. The environment
has been known to be so hostile that the pilot was unable to read the instruments or to provide
vocal communication.
207
JSSG-2009A
APPENDIX A
There are numerous solutions to the problem of ride quality. The most common of recent times
has been to use dual chambered shock struts. This design solves the ride quality problem, but
introduces severe landing gear maintainability problems. In the F-4, C-5A, and F-15, it has
been difficult to seal the high pressure chamber and there is no way to determine the status of
the cylinder without disassembly. Development of adequate servicing and inspection
techniques has been difficult. The FB-111 uses dual pistons, but has a single air chamber. It
has been a relatively good performer in the field.
A.4.4.1.3.1.9 Ride quality.

Ride quality shall be verified by (TBS) .
An analysis permits evaluation within the full operational spectrum. However, in order to obtain
confidence in this review, it is necessary to verify discrete points by actual taxi test on the
airplane over a known runway profile.
TBS: Ride quality should be verified by analysis, substantiated by component laboratory testing
and demonstrated on the air vehicle during flight testing.
(TBD)
A.3.4.1.3.1.10 Landing gear servicing.

The (TBS) . types of landing gear servicing shall be accomplished without removal of
components or jacking of the complete air vehicle.
This requirement is to insure that consideration is given to maintenance requirements in design

of the landing gear installation and fairing. Designs that require air vehicle jacking and strut
removal not only increase maintenance costs but also increase the possibility of maintenance
accidents.
TBS should be filled with at least the following: “gas charging, oil replacement, and inspection
for proper servicing.”
Internal shock strut design, which impedes fluid flow and location of the drain, are the major
considerations in meeting this requirement.
208
JSSG-2009A
APPENDIX A
It should be possible to fully re-service each shock-strut with both fluid and nitrogen in not more
than 30 minutes.
It should be possible to determine the amount of extension for all struts without removing any
cowling or without using a measuring device other than a scale. A scale integral with the strut is
desirable.
If serviced with fluid, the shock absorber struts should utilize the same type of fluid as used in
the air vehicle hydraulic system. On Navy air vehicles without a hydraulic system, MIL-PRF-
83282 is preferred.
This requirement was previously contained in MIL-L-8552 and represents an application of

lessons learned and an attempt to standardize maintenance procedures. This is part of the
overall effort to improve air vehicle maintainability.
The maintenance of shock absorbers is a very important factor in achieving desired

performance and life. Strut servicing with fluid and charging agent should be as simple as
possible under all load conditions to insure that line maintenance personnel accomplish the
required functions.
Most struts require complete removal or pulling of the piston to drain the fluid. The hazards of
oil spillage should be readily apparent. Recent efforts have been made to attempt to influence
designers to provide drainage capability without removal. This requirement is intended to
continue this pursuit.
Strut filling is another important function which is potentially compromised on most designs.
There is no way of telling fluid level without complete deflation and refilling. It is unfortunately
easier to add nitrogen and adjust the extension rather than to assess the fluid level. This
results in inadequate fluid for metering during energy absorption. This then can result in
excessive load, and possible structural damage.
A.4.4.1.3.1.10 Landing gear servicing.

Landing gear servicing shall be verified by (TBS) .
Initially design features such as servicing will be reviewed by routine engineering discussions
and inspection of drawings. After the air vehicle is in flight test status, maintenance function will
be evaluated on a routine basis.
209
JSSG-2009A
APPENDIX A
TBS should be filled in with inspection, demonstration and substantiated during flight testing.
This should take into account all servicing actions.
(TBD)
A.3.4.1.3.1.11 Repeated operation.

The landing gear subsystem shall be capable of performing its required shock absorption
function within (TBS 1) after positioning for landing and shall not prevent accomplishment of
(TBS 2) successive landings with (TBS 3) between landings.
Unless care is exercised in design, the internal shock absorber chamber arrangement can
impede fluid flow. Assemblies with this characteristic have difficulty in performing the basic
energy absorption function upon extension if they have been stowed with the centerline above
horizontal and the fluid is required to flow from chamber. The purpose of this requirement is to
establish a time limit consistent with system needs for fluid flow between chambers to insure
proper metering during energy absorption. The consequences of improper flow are foaming,
improper metering, and cavitation. All of which result in excessive load and potential structural
failure. It is recommended that the blank have two minutes inserted if no specific system
requirements are identified or are unidentifiable.
TBS 1 should reflect the minimum time from when the strut is fully extended to touchdown.
TBS 2 is the number of time landing or touch-and-go’s are performed within a given operation or
training missions.
TBS 3 gives the minimum amount of time that expires between any set of landing or touch-and-
go.
This requirement is intended to define the energy absorption capability for touch and go
landings. The most severe succession of consecutive landings, which can reasonably be
expected in service, should be identified for design. It is recommended that successive design
conditions such as landplane landing at 10 feet/second, level landing attitude, be identified
within a five minute time period.
Internal strut design with proper drainage routes controls this capability. Whether or not the
strut fluid foams upon extension controls whether there is sufficient fluid beneath the orifice to
insure that only fluid is metered during the energy absorption stroke.
210
JSSG-2009A
APPENDIX A
This performance characteristic was previously identified in MIL-T-6053. It represents a

condition that can be developed when the air vehicle is used in training by landing with a series
of touch and go landings. If the internal shock absorber design permits foaming of the fluid
during the metering process, the second landing will encounter a portion of the energy stroke
where gas will be metered through the orifice instead of oil and the peak loads will be very high.
Fluid flow between chambers should be carefully considered in the internal strut design.
It would be beneficial to study design details of existing struts that are stored above the
horizontal and successfully meet the extensive time requirements without any adverse effects.
There are various circumstances which affect the metering characteristics of a gas-oil shock
absorber. Included among these are: The ability to recirculate the oil, rebound characteristics
of the strut, and temperature. Recirculation and rebound are a function of internal design and
the temperature impacts the air curve from which the taxi loads are determined. Higher
temperature will result in noticeable load increases. The source of temperature increase can be
changes in the ambient air or internal strut friction.
A.4.4.1.3.1.11 Repeated operation.

Repeated operation shall be verified (TBS) .
The laboratory drop test is the best method of demonstrating this requirement because the
exact condition of installation and performance can be duplicated and controlled. It is
significantly less expensive than trying to measure the loads and analyze the effects of this
condition on the air vehicle during the flight test program.
VERIFICATION GUIDANCE(4.4.1.3.1.11)
TBS should reflect the number of successive drops to be done in a row with a specified
minimum time between them. For those struts that are stored past horizontal, thus having air-oil
inversion, it may be desirable to conduct an analysis and laboratory demonstration to ensure the
oil drains into the proper chamber in time.
(TBD)
A.3.4.1.3.1.12 Friction control.

Shock absorber friction in the landing gear subsystem shall not cause (TBS) .
211
JSSG-2009A
APPENDIX A
This requirement is intended to minimize operational problems due to high mechanical friction of
the shock absorber. Mechanical friction may cause severe operational problems in strut
servicing and weapons loading. Quantitative requirements are not well defined because this
characteristic has not been considered in detail on past designs It is suggested that detailed
study of a proposed air vehicle may result in suitable quantitative requirements. Areas of study
could include strut extension as a function of strut pressure changes and change in elevation of
external stores stations when weapons are loaded.
TBS should specify as a minimum: “adverse effects in shock absorber servicing, air vehicle
landing and taxi, and mission loading or unloading.”
Static strut function on the A-10 air vehicle created a hazardous condition for weapons loaders
in that at a certain load the strut would suddenly break away causing a significant change in
elevation of the weapons loading point.
During some landings on early F-15 aircraft, one strut would stroke before the other due to
differences in mechanical friction. The resultant asymmetric loading prevented the other strut
from stroking for several seconds. The air vehicle ground rollout was in a skewed attitude
adversely affecting control during this time.
A.4.4.1.3.1.12 Friction control.

Shock absorber friction control shall be verified by (TBS) .
Careful analysis and design best meet this requirement. Except for some bearing material and
seal changes, little can be done with existing hardware that proves unsuitable. Nevertheless,
final proof of suitability is a demonstration on the air vehicle. In some cases specific tests such
as weapons loading, fueling, or servicing may be specified in detail to verify the function
characteristics.
TBS should reflect inspection of drawing and layout to support an analysis of strut friction and
ratcheting effects on air vehicle operations. The analysis may be supported with laboratory
testing of bearing. The final verification should be operational demonstrations on the air vehicle
for those critical stroking situations.
(TBD)
212
JSSG-2009A
APPENDIX A
A.3.4.1.3.1.13 Repairability.
Where joints and wear surfaces are required, they shall accommodate reparability by (TBS) .
Experience has shown that it is essential that a means be provided to permit rework of landing
gear joints and wear surfaces. Failure to establish such a requirement results in high operating
costs because expensive landing gear forgings must be replaced when contact surfaces are
corroded or worn out of tolerance. Landing gear functional and structural requirements do not
insure that parts can be refurbished.
This requirement is primarily intended to prevent scrapping of major landing gear forging due to
normal wear and corrosion.
TBS should be completed by the following statement: “providing a minimum of 0.060 inch
allowance on the diameter of each pinned joint and a minimum of 0.030 inch allowance on each
non-circular wear surface.” Allowance means that up to this much material may be removed for
insertion of bushings or other repair. Deletion of this requirement should be considered for
prototype and other limited life air vehicles.
Small linkage parts that are more economical to replace than repair should be excluded from
the requirement. A suggested statement is: “This requirement should not apply to any
component such as small linkage parts that are more economical to replace than repair.”
This requirement is intended to reflect the detail requirements currently documented in

AFSC DH 2-1, AFSC DH 1-2, MIL-L-8552, and lessons learned on recent systems and
commercial experience of airlines.
There are numerous air vehicles which have experienced wear in the joints. Examples would
include KC-135 bushed axle and beam, B-52 pistons, and C-141 axle bogie beam fretting.
Therefore, to save the expense of repair or replacement, it is vital to allow enough material for
rework.
Joint designs have proved to be extremely critical in maintaining hardware in the fleet. Lessons
learned include use of positive lubrication for all joints, static and dynamic. All joints should be
bushed. Avoid all pressed fit or matched fit joints. These features have contributed to great
cost at the depot level during overhaul. They should be considered in the original design
recognizing the service life commitment of "Roughness and runway repair profile criteria" in this
appendix.
Commercial airline usage has made extensive use of lubrication and replaceable bushings to
achieve extended use of major landing gear components. It is impossible to legislate against
corrosion or wear; you can only design for minimized detrimental effects.
213
JSSG-2009A
APPENDIX A
Extreme difficulty has been encountered in the use of keyways and threaded parts on the B-52.
These have been the source of stress concentration and have resulted in numerous field
failures from fatigue cracking.
A.4.4.1.3.1.13 Repairability.
Repairability shall be verified by (TBS) .
Close engineering monitoring of design details during the development program is the only
effective means of transfer of lessons learned. These lessons learned come from Using
Commands and AFLCMC Engineering monitors.
TBS should be filled in with inspection of engineering drawings and analysis.
Strength and life analysis should be accomplished on the rework capability designed into the
joints to ensure that the gear performance capability is not compromised when the joints are
reworked.
(TBD)
A.3.4.1.3.1.14 Empennage protection.

Empennage protection, if used, shall be provided by (TBS 1) and shall incorporate the
following features: (TBS 2) .
This requirement is aimed at protecting the empennage from damage during ground usage
when the brakes are applied while the air vehicle is rolling backwards or the air vehicle is over
rotated on take-off or landing, or during shipboard towing operations for all allowable sea state
conditions.
TBS 1 should be filled in with the appropriate empennage protection device.
TBS 2 should reflect the expected performance of the empennage protection device for those
mission profiles that the air vehicle will see. It should list the number of times the bumper will be
used and type of operation, such as passive bumper versus an extendable bumper.
Special control features include: retraction, automatic extension based on throttle setting and
gear position, emergency extension capability, and position indication.
214
JSSG-2009A
APPENDIX A
Depending on the characteristics which are identified in the blank, various parameters influence
and control this requirement. System design, component design details and system interfaces
are general areas of control.
Tail bumpers are frequently safety features that represent protection of more expensive and
delicate airframe hardware that is jeopardized by extreme tail down landings, abrupt rotation on
takeoff and ground maneuvering.
This is a new requirement, not previously documented in design requirements. Since these
special features impact the cost, it is necessary to state the requirements in the original
documentation. Most of the special features are Using Command preferences and they should
be consulted extensively on these requirements. Since they are cost drivers, the user should be
apprised and be willing to accept the impact on reliability and maintainability.
Tail bumper design is a direct function of the protection to be provided. A simple ground
handling protection device can be simply a hard point to prevent ground contact of the rest of
the airframe. It would be infrequently encountered and usually be a simple manual device. If
the protection desired come from overrotation on takeoff or high attitude landing, the device
becomes in fact an energy absorber. If the strikes are frequent enough, the designer should
consider a replaceable contact.
Another feature that is optional is the ability to position the bumper from the pilot’s station.
Retractable bumper wheels or skids should extend during regular and alternate or emergency
extension of the landing gear. A position indicator should be provided. If aerodynamic
degradation occurs from having the bumper permanently extended, consideration should be
given to providing a retractable feature.
If the bumper is contacted on takeoff or landing, there is a firm need to isolate the hydraulic
system to prevent spikes of peak pressure being applied to the system.
The unit should be readily inspectable.
SAE ARP1107 is a useful reference for recommended practice for design and installation of tail
bumpers.
A.4.4.1.3.1.14 Empennage protection.

Empennage protection shall be verified by (TBS) .
The need for a bumper should be determined before an air vehicle is produced. Analysis is the
only logical means to evaluate the full range of operational capabilities. The effectiveness of the
bumper to provide the intended protection should be evaluated on the air vehicle. It can be
accomplished as part of the routine observations. Some effort should be made to record
frequency of strike to assist in evaluation of the operational adequacy.
215
JSSG-2009A
APPENDIX A
TBS should be filled in with dynamic analysis of the air vehicle. The empennage protection
operation and controls should be evaluated by air vehicle test.
Dynamic analysis should be conducted of all air vehicle ground and rotational operations to
determine the need and the type of bumper.
(TBD)
A.3.4.1.4 Velocity and directional control
A.4.4.1.4 Velocity and directional control
A.3.4.1.4.1 Braking.
Braking shall be provided with the capability to (TBS) .
This requirement is necessary to establish performance requirements for the braking system.
TBS should be filled in with the level of performance expected. Differential control of braking is
a desirable feature to permit the pilot to use the brakes for directional control. Anti-skid control
should be considered, but may be optional. There may be reason to have both a secondary
and an emergency braking system.
Consideration should be given to a protection circuit or indication to the pilot of an incipient skid
so as to minimize the potential of a tire blowout.
This is a reflection of the criteria previously stated in MIL-B-8584, AFSC DH 2-1, and AFSC DH
1-6. It reflects the lessons learned from WWII aircraft and has been standard criteria for over
ten years. The only recent innovation has been the use of anti-skid control on emergency brake
systems and the double redundancy of dual actuation lines for normal and emergency systems.
216
JSSG-2009A
APPENDIX A
A.4.4.1.4.1 Braking.
Braking shall be verified by (TBS) .
Since the requirement is for a level of performance, the only suitable demonstration is for the
total system.
Brake performance should be verified by analysis and laboratory tests. System performance
should then be substantiated during flight testing.
(TBD)
A.3.4.1.4.2 Directional control.

Directional control provided by the landing gear shall be as: (TBS 1) . Ground directional
control characteristics shall permit the pilot to control the air vehicle under the following
crosswind conditions: (TBS 2) .
Specific performance will be allocated to the landing gear steering, braking, propulsion and flight
control systems. Two major requirements to be defined are: the expected performance during
takeoff and landing, crosswinds and ground maneuvering of the air vehicle for other reasons.
Both should be defined because the allocation to the landing gear steering system will be
different for each case. The requirement to meet both is usually a steering system design
driver.
TBS 1 should reflect the air vehicle ground maneuverability of the air vehicle for all phase of
ground operations. Normally for high speed small steering angles are required, where as for
taxi and ground apron operations large steering angle control is needed. The system design
and air vehicle control should be designed to reflect full operational capability to the users
requirements to complete his mission. The following should be considered in determining the
appropriate directional control:
a. Air vehicle geometry
b. Landing gear geometry
c. Width of runways and taxiways
d. Type of airfield surface (wet or dry)
e. Cargo handling (loading dock compatibility)
217
JSSG-2009A
APPENDIX A
f. Takeoff and landing speeds

g. Thrust reversal
h. Crosswind.
TBS 2 should specify the crosswind condition limits under which the pilot should be able to
control the air vehicle.
Since it is a full system requirement, the capability of the steering system is combined with
various other techniques to identify the directional control capability desired for the total air
vehicle.

a. A method frequently used to specify the ground maneuvering requirements is to establish
the maximum width permitted for the air vehicle to make a 180° turn on a dry pavement
without use of differential braking. This characteristic is usually presented in the flight
handbook for each current air vehicle.
b. In some cases, obstacle clearance by the air vehicle may be more restrictive than pavement
width available for ground turning. The flight handbook also normally provides characteristic
data for current air vehicle.
c. Excessive reliance should not be placed on use of differential braking for ground
maneuvering. Minimum radius turns using this approach are difficult to accomplish with
precision. Also, this condition frequently results in the most critical landing gear loads. If
used extensively, this will result in landing gear reliability problems. Directional control by
differential braking is very unsuitable for air vehicle operation on soft surface airfields
because it causes extreme surface damage. Turnaround requirements should not be so
restrictive that they can be met only by a pivot turn.
d. If it is expected that the air vehicle will have a reverse thrust capability, it may be desirable to
establish a direction reversal requirement more severe than can be accomplished by a
normal 180° continuous turn. Operation of C-130, YC-14 and YC-15 air vehicle has shown
that direction reversal by several movements of the air vehicle, including backing of the air
vehicle, is a practical operation. Pilot experience has shown that the number of movements
should be restricted to three.
e. Air vehicle ground directional control is usually severely degraded if the airfield surface is
icy, wet or soft. This should not be ignored. However, establishment of a requirement for
ground maneuvering on anything other than a dry concrete surface should be avoided.
Experience has shown that verification of compliance on any other surface is impossible due
to difficulty of accurate control of the many test variables.
f. Airfield geometry for standard construction is controlled by the following manuals. These
may be useful in establishment of requirements:
1. AFM 86-3, Planning and Design of Theater of Operations Air Bases
2. AFM 86-8, Airfield and Airspace Criteria.
Some systems have tried to maintain a steering tolerance of .2°, which has proven to be very
difficult to rig and maintain.
218
JSSG-2009A
APPENDIX A
Overall landing gear arrangement and basic ground stability are significant factors in crosswind
operating performance. This requirement should be compatible with the ground stability
requirement.
Flight test experience has revealed that shock strut characteristics can influence crosswind-
landing response. High breakout loads of the strut combined with aerodynamic characteristics
of the air vehicle may result in failure of the air vehicle to attain a wings-level attitude during
rollout. This may appear to the pilot as poor directional control.
This requirement should apply to operation on dry concrete airfield surfaces only. Crosswind
performance is degraded on low coefficient of friction surfaces. However, verification of a stated
requirement on such surfaces is difficult. Flight test evaluation on adverse surfaces should be
accomplished for flight handbook data.
Systems to preposition landing gear for crosswind takeoffs and landings have been used on
some air vehicle to improve crosswind-operating characteristics. Recent examples are the B-52
and C-5A. These systems are recommended only when justified by analysis of air vehicle
handling qualities and pilot workload for crosswind operation.
A.4.4.1.4.2 Directional control.

Directional control performance of the landing gear system shall be verified by (TBS) .
Due to the many variables involved in the air vehicle ground directional control characteristics,
the only suitable verification method is test of the complete air vehicle. This normally is
accomplished in three stages. The first is an evaluation for typical operation. This is a
continuous process throughout the flight test program. The second is a planned evaluation for
minimum radius turns on a dry paved surface. This is accomplished not only to evaluate the
minimum radius turns that can be achieved by various pilot techniques, but also to measure
resultant structural loads. The third phase, which will vary between air vehicle programs, is
evaluation of directional control under adverse conditions. Adverse conditions can include wet
surfaces, soft surfaces or failure of some air vehicle systems.
TBS: Performance of the ground control of the air vehicle should be demonstrated during taxi
and flight testing for all operational missions and ground maneuverability.
Verification of the steering system’s ability to hold the air vehicle to 25 ft within 1000 ft is difficult
to demonstrate on the air vehicle due to crown of the runways, alignment of the air vehicle to the
centerline or line of reference, and centering of the steering system. More consideration is
needed on how to verify whether the air vehicle can hold a straight line track as it travels down
the runway. (Modify to not include numbers.)
219
JSSG-2009A
APPENDIX A
A.3.4.1.4.3 Emergency directional control.
Emergency ground directional control provided by the landing gear, if required, shall be
provided with the following characteristics: (TBS) .
Some type of emergency directional control system should be provided to permit completion of
the design mission or safe recovery of the air vehicle after failure of the normal directional
control system. The design approach to provide an acceptable capability is highly dependent
upon success criteria established by this requirement. It may be possible to meet the
requirement with existing normal systems, or it may be necessary to provide secondary or
redundant steering systems. In many cases, differential braking may qualify as the emergency
directional control system.
TBS should be filled in with consideration given to the following performance requirements for
the emergency directional control system:
a. The emergency directional control system should permit the air vehicle to complete the
operational mission after failure of the normal directional control systems. Completion
includes recovery of the air vehicle to the base of origination without damage due to
failure of the normal directional control system.
b. After failure of the normal directional control system, it should be possible for the air
vehicle to maintain a path along the centerline of the runway (+10 feet) after landing
(Sea level, Standard day).
c. The emergency directional control system should permit the air vehicle to maneuver
from the soft surface runway without assistance from external power or equipment.
Maneuver includes the ability to turn 180° in a maximum width of 100 feet.
d. No single point failure should cause loss of ground directional control.
The following parameters should be considered: air vehicle weight, air vehicle speed, type of
runway surface (hard and soft), and control precision

(TBD)
A.4.4.1.4.3 Emergency directional control.

Emergency ground directional control characteristics provided by the landing gear shall be
verified by: (TBS) .
Verification is to ensure that emergency directional control is achieved.
220
JSSG-2009A
APPENDIX A
TBS should reflect verification by analysis of system operation after the insertion of failures,
either single point or normal control systems. The analysis may be supported by bench testing
of system components with induced failures and air vehicle tests.
With the advent of digital control systems, verification of failures and emergency systems has
been a multi-phase verification. With computer simulations modeling various failures, watch the
computer logic response. Then this is backed up with some “iron-bird” type of simulation to see
if the hardware responds properly with the response of the software code for the inserted failure
modes.
A.3.4.1.4.4 Braking and skid control
A.4.4.1.4.4 Braking and skid control
A.3.4.1.4.4.1 Braking control interface.

Braking control shall be applied by the following means: (TBS) .
Rather than define the classical method of applying brakes through the rudder pedals, this
requirement is adjustable for the situation. If the mission(s) or the state-of-the-art dictate a
change in concept, the blank should reflect the desires.
TBS should reflect the braking control method used. If no new method is used then the phrase,
“foot pressure on the tip of the rudder pedal” should be inserted.
If foot pressure on the tip of the rudder pedal is used, the following should be considered:
a. Maximum breakout force at the tip of the pedal
b. Minimum force for full braking
c. Maximum force.
d. Maximum breakout force
e. Maximum force for full braking
f. Maximum travel
g. Travel for initial braking
h. Deceleration rate/application force gradient (mean)
221
JSSG-2009A
APPENDIX A
i. Deceleration rate/application rate tolerance.

This requirement reflects the criteria previously contained in MIL-B-8584. The intent was to
standardize the brake application methods so that transition by pilots from one air vehicle to
another will not result in confusion in the event of an emergency, which requires fast application
of brakes. The initial source of the requirement is not known.
Refer to JSSG-2010 for further information on brake activation controls. This is a critical control
and the use of a non-standard activation method should not be permitted without consulting with
the crew systems design group.
Brake controls should be provided to both the pilot and co-pilot. In any position of the foot there
should not be a tendency for the pilot to apply brake effort unintentionally during the normal use
of the rudder pedals or during arrested landings. Equal positive action of the brake system
should be provided when the air vehicle is moving forward or aft with the same effort on the
brake pedal or brake-operating control.
Some foreign air vehicles utilize a hand lever for brake application.
Pedal position for pilots of varying heights and leg lengths can be a problem.
The MIL-B-8584 paragraph on “Power operated systems, Types II and III” calls for landplane
landing weight pedal brake force of 65 to 85 pounds. This has been found to be too high for
comfortable pilot control. The forces were reduced to the 35 to 65 pound range for the B-2 and
50 to 75 pound range for the C-17. It is recommended that the pedal force for landplane
operation be between the 35-65 pound force range. It may be desirable to restate the
requirement to read: "Brake pedal forces shall not to exceed 60 lbs for a 10 ft/sec squared at
landplane landing weight deceleration, and 150 lbs for maximum braking.”
A.4.4.1.4.4.1 Braking control interface.

Braking control interface shall be verified by (TBS) .
Since braking control suitability is subjective, the evaluation is qualitative and subject to
personal preferences. A mock-up or actual air vehicle should be used for preliminary
evaluation. Final review is subject to program limitations.
TBS should be filled in with mock-up evaluation, air vehicle taxi and flight testing.
(TBD)
222
JSSG-2009A
APPENDIX A
A.3.4.1.4.4.2 Alternate independent braking.

Separate and independent braking shall be provided with the capability to (TBS 1) with
(TBS 2) failures.
This requirement is necessary to establish performance requirements for the alternate braking
system. An alternate braking system is nearly always required. Experience indicates that an
alternate system is essential to provide adequate safety and reliability.
TBS 1 should be filled in with the level of performance expected. Normally, the stopping
performance should be equal to that provided by the normal system. Differential control of
braking is a desirable feature to permit the pilot to use the brakes for directional control. Anti-
skid control should be considered, but may be optional. There may be reason to have both a
secondary and an emergency braking system which should be specified: “A secondary braking
system, separate and independent of the primary system, should be provided. The backup
system should have braking capabilities equivalent to the primary system. An emergency
braking system should be provided with sufficient capability to perform a maximum energy stop
with pilot metered braking.” Such a design concept may be need to preclude any single failure
causing loss of normal brake functions.
TBS 2 should define the number of non-structural failures.
Consideration should be given to a protection circuit or indication to the pilot of an incipient skid
so as to minimize the potential of a tire blowout.
The design and marking of the alternate brake control should be coordinated with the crew
system design group.
This is a reflection of the criteria previously stated in MIL-B-8584, AFSC DH 2-1, and
AFSC DH 1-6. It reflects the lessons learned from WWII air vehicle and has been standard
criteria for over 10 years. The only recent innovation has been the use of anti-skid control on
emergency brake systems and the double redundancy of dual actuation lines for normal and
emergency systems.
There are various approaches to emergency brake system design. In the 1950 time period, it
was common practice to provide emergency braking from an auxiliary air bottle. These designs
had limited capacity, utility, and effectiveness. They did not operate through the anti-skid
control system and there were often blown tires with the use of this type of emergency brake
system. They had separate lines to a shuttle valve at the brake. Since this was a different
media than the normal system, extensive system bleeding was required after their use.
223
JSSG-2009A
APPENDIX A
Another disadvantage of the air bottle emergency system is the limited capacity. If the pilot
“pumps” the brakes, he will deplete the system and could have insufficient capacity to complete
the stop.
Another recent design approach to emergency brake design is to provide dual lines to the
brakes from different hydraulic systems. Each system has the capability to stop the air vehicle.
The F-111, B-1, and F-16 utilize this approach.
Usually with pilot directed brake pressure, there is little or no sense of deceleration or “feel” for
tire skidding. The problem is further aggravated by the pressure differential between the normal
and emergency braking systems for the same pedal deflections. One successful method was a
“foot thumper” which caused a small pin in the brake pedal to “thump” the pilot’s foot when the
tire started into a skid, thus allowing the pilot to back off the pedals. This also assisted the pilot
in metering the pressure up to the point of skidding, thus providing a means of achieving
maximum deceleration without a blowout in emergency conditions.
Since the normal and emergency brake systems may not provide comparable pressure to the
brakes for the same pedal position, it is desirable for the condition of the wheel to be indicated
in the cockpit. This is necessary because in most air vehicles the pilot does not have a “feel” of
locked wheels or air vehicle deceleration in the cockpit. A foot pulsar has been used in one
case to fulfill this need.
The logic of the anti-skid allowed brake pressure only when both Main Landing Gear (MLG) and
Weight On Wheels (WOW) switches indicated weight on (Touchdown Protection). But the MLG
strut design allowed enough strut deflection during taxi turns to trip the WOW switch off, causing
the anti-skid to go into touchdown protection mode.
A.4.4.1.4.4.2 Alternate independent braking.

Alternate braking shall be verified by flight test.
The requirement is for a level of performance, thus, the only suitable test is of the total system.
The alternate brake performance should be verified by analysis and laboratory tests. System
performance should then be substantiated during flight-testing.
(TBD)
224
JSSG-2009A
APPENDIX A
A.3.4.1.4.4.3 Skid control.

Skid control shall be tuned for optimum performance on a (TBS) surface, considering both
braking and cornering forces throughout the control speed range.
There has been a tendency within Industry to attempt to achieve a minimum stop distance on a
dry runway, and then to assume a factor to be applied to predict wet stop distances (FAA). This
is demonstrated most safely and under more controlled conditions. However, the real need of
the system is to have the skid control system to be tuned on the surface where the greatest
need exists. Therefore, every attempt should be made to tune the production adjustments or
the anti-skid brake control system for a wet runway, where the performance is most critical. The
brake and skid control system should provide differential braking control, locked wheel
protection, touchdown protection, parking brake function, anti-spin on retraction, and
hydroplaning protection. In addition, the brake and skid control system should permit holding
the air vehicle at a full stop and locked wheel pivot turns.
Stopping distance is not the only factor to be considered. Cornering power is equally important
on runways experiencing adverse weather. Crosswinds may dictate that differential controls to
assist steering are equally important to stopping performance. This should be considered
equally in tuning the system.
TBS: the anti-skid system should operate satisfactorily under the following conditions:
a. Prevent tire flat-spotting and never permit a completely locked brake within the control
speed range when the brake will respond to control.
b. From maximum ground operation speed to the lowest speed compatible with ground
handling, not to exceed 10 knots.
c. Should not induce airframe dynamic instability, gear walking, gear chatter.
d. Tuned for optimum performance on a wet runway, a dry runway, and combination of wet
and dry surfaces, considering both braking and cornering forces, throughout the control
speed range.
e. At temperatures from -65°F to +160°F.
f. When conditions are imposed which duplicate the environment of sea coast regions.
g. Environmental conditions of 100 percent (100%) humidity, including conditions in which
condensation occurs in the form of water or frost.
h. When subject to pressure variations associated with altitude ranging from 1300 feet
below sea level to the maximum operational altitude of the air vehicle.
i. Under conditions consisting of blowing sand and dust particles as encountered in desert
areas.
225
JSSG-2009A
APPENDIX A
j. Environmental conditions such as explosive atmosphere, translational accelerations,

acoustical in the region where the hardware is mounted, vibrations, shock, and fungus.
This criterion is generally stated in MIL-B-8075. Difficulty has been encountered on numerous
systems where the anti-skid control system components are adjusted to provide minimum stop
distance on a dry concrete surface. Then the wet runway performance is left to chance and is
frequently less than optimum. The requirement for consideration of wet system adjustment was
not introduced into specification language until 1971. Prior documentation reflected ancient
state of the art design and evaluation. Coordinate the anti-skid activation controls and location
with the crew station group.
In tuning an anti-skid system or adjusting the response rates for production, there is significant
risk in tailoring the system for dry runway performance. The available coefficient is relatively
constant with a dry surface as compared with a wet surface. Therefore, system response or
sensitivity can be improperly placed from dry runway testing. This usually is the direct result of
establishing guaranteed stop distances on dry surfaces, but not requiring specific performance
on wet. It is extremely difficult to define a wet surface and to control it in flight test for
demonstration. It is dependent upon the surface (micro-texture), the runway construction, and
the rate of water input.
Factors to be considered in anti-skid tuning and operation are features such as locked wheel
protection and interaction if the brakes are paired, touchdown protection to prevent lock-up or
flat spotting upon initial contact with the runway, and the degree of sophistication desired. Anti-
skid systems vary in performance from anti-locked wheel devices to approaching automatic
braking systems. Some commercial and T-43 brakes are automatically applied without pilot
effort and function to a pre-selected deceleration rate.
There are several basic design approaches to anti-skid system in terms of hydraulic control.
One is paired wheel control and another is individual wheel control, with various combinations of
each. For single wheel gear air vehicle such as used on fighters, more use has been made of
paired wheel control. This decision is made primarily for dynamic stability and ground control
reasons. If release and reapplication of brakes on one side of the air vehicle at a time can
induce control problems, paired wheel control should be considered. However, individual wheel
control is more efficient from a stopping efficiency point of view, because each braked wheel is
producing all the torque that is possible. With paired wheel control designs, caution should be
used in valve selection to insure retention of differential braking capability in crosswind
situations. Some systems reduce both wheels to a common threshold pressure and offset the
differential pressures that the pilot thinks that he is applying. Other paired wheel control valves
operate like individual wheel control systems.
226
JSSG-2009A
APPENDIX A
A.4.4.1.4.4.3 Skid control.

Skid control shall be verified by (TBS) .
Ultimately, the final production tuning should be done on the air vehicle, but there are various
approaches to preliminary evaluation. These include computer simulation and working
simulators. The verification should be tailored to reflect the economic coordinated method used
for other systems.

TBS should be filled in with “The brake and skid control system performance, including
efficiency and compatibility with interfacing subsystems, shall be initially evaluated by computer
simulation analysis; final verification shall be performed by air vehicle test subsequent to final
production tuning. Tuning performance verification shall include operation on a wet runway and
shall be accomplished with an instrumented air vehicle. The effects of system malfunction shall
be evaluated by analysis and validated by computer simulation. The operating characteristics of
the anti-skid system and design features of the system shall be verified by inspection.”
Verification of the anti-skid should include the following:

a. Freedom from air vehicle dynamic instability due to anti-skid brake control operation will
be demonstrated on the air vehicle throughout the forecasted air vehicle operation
spectrum.
b. Document all test conditions, test equipment, and test procedures for component
preproduction tests.
c. Analysis of brake control system performance under various anti-skids, air vehicle
(including wing lift), runway surface conditions, brake system inputs should be
considered.
d. Analysis of the effects of various system part failures should be considered. Those
failures not adequately covered by analysis should be simulated by appropriate
laboratory tests.
e. Operational checkout procedures should be developed to detect all failures.
(TBD)
227
JSSG-2009A
APPENDIX A
A.3.4.1.4.4.4 Skid control with power interruption.

During interruption of power to or malfunction of the skid control the system shall (TBS) .
It is the intent of this requirement to state how the system responds to circumstances of power
interruption or system malfunction. It indicates the reaction that is most acceptable for system
design.
TBS should be filled by specifying an acceptable means for responding to power interruption or
system malfunction. For example, “return to pressure as metered, with adequate pilot
notification.” Or “metered brake pressure is dumped and the braked wheels are free rolling until
the alternate brake system is activated.” There may be other logical choices of action for
system power interruption or malfunction that should also be considered.
The source of this requirement is MIL-B-8075. A requirement similar to this has been in force
since the anti-skid systems first were introduced into USAF aircraft around 1954-55. The failure
response mode has been questioned on numerous occasions and user preference appears to
be the criteria that should be applied.
On fighter air vehicle or relatively simple multi-tired gear designs, most systems revert to
manual upon system failure with suitable notification to the pilot. On complex systems, such as
the C-5A, the affected wheel and brake assembly is isolated and the remainder of the system
continues to function with anti-skid control.
If the gear was not retracted on a touch-and-go, the anti-skid should be capable of resetting its
touchdown protection circuit to provide touchdown protection for each subsequent landing
regardless of gear cycling.
A.4.4.1.4.4.4 Skid control with power interruption.

The effects of power interruption and system malfunctions shall be verified by: (TBS) .
There are numerous means of evaluation of anti-skid system malfunction. These include failure
mode analysis under the reliability program, simulator studies on the full scale landing gear
mock-up, and flight test evaluation. The flight test portion is normally on a routine monitoring.
TBS should specify that computer simulations and analysis, with the results being substantiated
by on air-craft demonstration and checkout of system switching logic parameters.
228
JSSG-2009A
APPENDIX A
Often test sets will not detect all types of failures and causes. Generally, the using activity
observes the test set or warning light and, if functioning, will assume the unit is acceptable when
in fact those lights only indicate failures of a specific type. Operation instructions, including
failure modes and effects, are desirable.
A.3.4.1.4.4.5 Anti-skid engagement and disengagement.

A means shall be provided, if required, to engage or disengage the anti-skid.
This requirement is to provide a means for the pilot to override anti-skid system operation. It
permits the pilot to select normal braking without anti-skid as an alternative to emergency
braking. This is desirable if the emergency system has limited capacity or is difficult to control.
The anti-skid override is usually accomplished by removing power from the anti-skid control box.
The control for this can vary from a circuit breaker to a switch (stick or panel mounted) to a
complex control and warning system (semi-automatic shut down). The control should be as
simple as possible. Braking force should be that commanded by the pilot. The pilot should be
provided with a warning that the anti-skid has been disabled.”
The criteria for pilot control is a restatement of requirements previously stated in specification
MIL-B-8075 and AFSC DH 1-6.
In the past it has frequently been desirable to shut off anti-skid during taxi to prevent
unexpected brake release. The argument against the control is that it leads to inadvertent
operation without anti-skid. Also, if the pilot is given several alternatives, he may try all of them
and overrun the runway. (direct selection of an emergency system may provide a shorter total
stop distance).
Most older air vehicle utilize an on-off switch for the anti-skid control system. Without anti-skid
protection it is much easier to flat spot or blow out the tire. The heavier the air vehicle the more
likely the pilot will not know he is locking up a wheel until the tire blows. With digital technology
it is easy to design two or more equivalent braking control systems that switch back and for
between them almost instantaneously without the loss of any braking performance. Therefore,
strong consideration should be given to determine whether the pilot can operate without anti-
skid. If not, then the requirement is to design a redundant braking system that switches
automatically and let the pilot know that it has switched.
229
JSSG-2009A
APPENDIX A
A.4.4.1.4.4.5 Anti-skid engagement and disengagement.

The means to engage and disengage the anti skid shall be verified by (TBS) .
To ensure that the switching logic works appropriately for all the condition that the system is
engaged and disengaged.
TBS should reflect verification by computer simulations and the results substantiated by on air
vehicle checkouts and flight testing. The anti-skid control and switching logic should be
modeled on the computer and applied to a laboratory simulator.
(TBD)
A.3.4.1.4.5 Nose wheel steering
A.4.4.1.4.5 Nose wheel steering
A.3.4.1.4.5.1 Steering characteristics.

Nose wheel steering shall have the following characteristics: (TBS) .
Usually some form of nose gear steering will be required to provide adequate directional control.
If this should be the case, it may be desirable to specify some characteristics. This is required
to standardize controls and insure that air crew procedure is similar to previous air vehicles to
minimize air crew transition training.
TBS should be filled in with consideration given to the following:

a. Steering control force
b. Steering rate
c. Ability to track a straight line
d. Steering deadband
e. Method of control (rudder pedals or wheel)
230
JSSG-2009A
APPENDIX A
f. Indicators (strut marking, warning lights)

g. Self-test provisions
h. Shimmy damping. Shimmy damping should be provided at all times, including with or
without steering engaged, and during power system failures. Shimmy damping should
be maintainable without dependency on replacement of normally wearing parts.
i. 360° swivel. Should provide 260° full swivel of the nose landing gear wheel without
disconnection of or damage to any air vehicle component.
j. Power Recovery of the nose landing gear wheel to the commanded position should be
possible from any wheel angle within the powered steering range.
k. System stability should be controlled to the commanded position without hunting,
chatter, or instability under all conditions when installed and operating on the air vehicle.
l. Positive trail should be provided to allow recovery to neutral from any powered steering
angle when the system is disengaged during taxi.
m. Nose wheel centering should be automatically provided when the nose wheel is
airborne.
n. Static nose wheel steering should be provided to give sufficient torque to turn through
the full steering range statically at the maximum weight with brakes applied on dry
pavement, on unprepared site of some specified CBR and with tires initially frozen to the
ground.
Coordinate the activation and location of the steering controls with the crew station group.
This requirement is to provide a method of including specific design characteristics that have
previously been directed by MIL-S-8812, MIL-STD-203, and AFSC DH 2-1. System rate and
response characteristics have not been quantitatively stated in the past, but rather have been
controlled by test pilot consensus. In the future, it may be desirable to establish quantified
requirements to permit more orderly development of the system. The type of control (rudder
pedal or wheel) has been dictated in the past by MIL-STD-203. Steering indication systems and
built-in test have been given little consideration in the past.
Past air vehicles have generally been designed to the following criteria:
a. The steering system should be designed with sufficient output torque to permit turning
the steered wheels through the full range without the aid of motion or the air vehicle or
engine thrust or auxiliary power. The steering capability should be available throughout
the design temperature range of the air vehicle, and with the most critical combination of
weight and center of gravity at engine idle thrust and a design coefficient of friction of
0.80 at the tire ground interface. The tires should be inflated in accordance with
applicable servicing instructions, and all brakes may be assumed to be released unless
normal engine idle thrust is sufficiently high to cause motion.
b. Testing has indicated that the actual maximum tire to ground friction coefficient may be
less than 0.8. Air vehicles that have little or no capability to turn the nose gear with the
231
JSSG-2009A
APPENDIX A
air vehicle static have generally been unacceptable and required redesign to increase
steering torque.
c. Flight and laboratory tests indicate that excessive nose gear steer angle during takeoff
and landing, particularly on slippery surfaces, is likely to result in over control by the
pilot. If excessive steering angle is used, the turning force may be less than the
maximum available. This has caused several air vehicle accidents. Consideration
should be given to restriction of steer angle during takeoff and landing to preclude this
problem.
d. Development of suitable steering rate and control force have been problem areas on
several recent air vehicle developments (C-141, F-15). Frequently, the problem involves
excessive deadband in the control, control hysteresis, or poor pedal geometry. Careful
analysis of initial flight test results is recommended to insure timely detection and
correction of problems. Quantitative control criteria to avoid problems by good design
are desirable but not available.
e. Deflection of cables, pulleys, pulley mounts, and pulley mount back up structure is a
frequent cause of poor response in systems with mechanical control.
f. Military Standard 203 (MIL-STD-203) required use of hand wheel steering in cargo air
vehicles. This is desired because it permits smoother operation during taxi, providing a
better ride for passengers. Recent work with prototype air vehicles indicates that
perhaps the advantages of the steering wheel are not clear cut for tactical cargo air
vehicles. At the present time it is probably best to leave the type of steering control
unspecified.
g. Some air vehicle steering systems have a method to show the pilot the nose gear
steering angle. One evaluation reveals that such indicators are seldom used and may
be of little value. On some air vehicles it may be desirable to indicate that landing gear
are not centered. Indicators on the landing gear showing steering angle are useful for
rigging of the steering system.
h. The caster axis for wheel swivel or rotation should be vertical.
i. Ensure the free-play, friction, and steering load path are design to be stable.
Damping should be provided to preclude shimmy through the speed range for wheel ground
contact.
Damping provisions should be in accordance with MIL-S-8812.
Unless otherwise specified in the detail specification, nosewheel steering should be provided in
accordance with MIL-S-8812.
If at all possible, avoid putting the steering actuator on top of the strut, try to keep the steering
power as close to the torque arms as possible. This minimizes the effect of freeplay, wear, and
friction in the shimmy tendency of the gear.
See the structure section on shimmy to keep the trail distance between 1-5 inches for better
chance to have a stable design.
232
JSSG-2009A
APPENDIX A
Avoid designs where the gear has to be rotated to be stored.
Avoid designs where unequal or unsymmetrical loading goes into the gear.
For design’s that exhibit shimmy it has been found that hanging a mass damper on the strut, in
particular forward of the gear, has been able to move the shimmy onset speed to a level higher
than air vehicle rotational speed.
A.4.4.1.4.5.1 Steering characteristics.

Steering characteristics shall be verified by (TBS) .
Performance Of the steering system is the result of the complex interaction of air vehicle
subsystems and geometry. Flight test of the complete air vehicle is considered the only valid
verification method. Usually, this can be accomplished concurrently with flight performance
testing. However, it may be necessary to augment testing by formal test or demonstration of the
adverse steering conditions. Engineering analysis during development is desirable to insure
successful test. However, it is not required for verification.
TBS: Steering characteristics should be verified by an analysis, flight test and a formal
demonstration of the steering system operation with the static air vehicle should be
accomplished to determine compliance with factors that cannot be verified by flight test.
Configuration design requirements should be verified by inspection of engineering drawings and
hardware.
The verification should cover at least the following: Compliance with system performance and
control requirements including power recovery, torque output, and control stability should be
verified by analysis and ground test. Adequate positive trail and 360° swivel should be verified
by demonstration on the air vehicle. Configuration design requirements, including centering
should be verified by inspection of drawings and hardware, and demonstration on the air vehicle
(on jacks). The effects of system failure should be verified by analysis.
(TBD)
233
JSSG-2009A
APPENDIX A
A.3.4.1.4.5.2 Response to nose wheel steering failure.

No single or multiple failures of the nose wheel steering control, including hydraulic or electrical
power, shall cause the air vehicle to depart the runway.
This requirement is to influence the contractor in selection of the type of steering system to be
used and the degree of redundancy to be provided when there is loss of the steering function. It
should be tailored to recognize the importance of steering to the particular air vehicle.
In the event of nose wheel steering, including a power system failure, the steering system
should provide for automatic or manual switching to a backup system or deselection to a free
caster mode in sufficient time to avoid departing the runway
The following should be considered:

a. Maneuverability of the air vehicle without steering
b. Operating environment
c. Performance of similar air vehicle.
This item reflects criteria previously identified in MIL-S-8812. Requirements on failure mode
and effect were introduced into this document in 1975 and they represent input from industry.
Some air vehicle incorporate dual sources of steering power. This should be considered for air
vehicles that must have operable steering to maintain control for takeoff and landing. It may
also be desirable for air vehicle that cannot be taxied by use of differential brakes and thrust.
Secondary systems should be pilot selectable after the air vehicle is on the ground and should
not degrade braking performance.
A.4.4.1.4.5.2 Response to nose wheel steering failure.

Adequate response to nose wheel steering failure shall be verified by (TBS) .
This requirement usually will be such a low rate of occurrence that demonstration by flight test is
not practical. Verification should be by use of a failure mode analysis combined with historical
failure - rates of similar equipment. In some cases, it may be difficult or impossible to determine
the result of some component failures. The effects of such failures should be investigated by
simulation on a laboratory simulation of the system or on the air vehicle.
234
JSSG-2009A
APPENDIX A
TBS should be filled in with analysis, computer simulations, systems checkout and
demonstration on the air vehicle to ensure proper system response to failures of the nose wheel
steering system and power supply.
(TBD)
A.3.4.1.4.5.3 Emergency steering.

In the event of failure of primary nose wheel steering, emergency nose wheel steering, if
required, shall be provided with the following characteristics: (TBS) .
If a nose wheel steering system is required to provide adequate directional control,

consideration should be given to directional control in the event of failure of the system.
TBS should define unique requirements. Possible characteristics include: pilot or automatic
selection of an alternate power system, indication or primary failure, type and amount of
steering to be accomplished, emergency steering should not degrade normal or emergency
brake system performance.
A requirement for emergency steering capability has been a requirement of MIL-S-8812 since
1969. However, most military air vehicles achieve emergency directional control with differential
brakes or rudder control.
a. Emergency systems that operate by providing a second source of hydraulic pressure
should be designed with care to prevent creation of additional critical failure modes.
Emergency steering should be designed so that it does not degrade normal or
emergency braking.
b. The question of automatic or pilot selected emergency steering should be carefully
considered. Automatic selection reduces pilot workload and provides minimum transfer
time. Pilot selection, on the other hand, reduces the possibility of depletion of the
emergency system before the critical operating period. All hydraulic selector valves
should be designed so that fracture of the valve body will not result in loss of both
steering systems.
c. Steering systems that use two sources of power for normal operation have been used to
fulfill this requirement. Consideration should be given to whether operation with one
system failed will provide sufficient steering torque for emergency operation.
235
JSSG-2009A
APPENDIX A
d. Use of differential braking for directional control is often considered a suitable substitute
for an emergency steering system. This may not be a suitable approach for air vehicle
with complex landing gear arrangements, narrow landing gear tread, or unpaved airfield
operating requirements.
A.4.4.1.4.5.3 Emergency steering.

Emergency steering shall be verified by (TBS) .
Performance of the emergency steering system is the result of a complex interaction of air
vehicle subsystems and configuration. Suitability can be determined only by test of the
complete air vehicle.
TBS should be filled in with analysis and a flight test. Adequacy of the emergency steering
system should be verified by analysis and tested on the air vehicle.
(TBD)
A.3.4.1.5 Actuation control
A.4.4.1.5 Actuation control
A.3.4.1.5.1 Retraction and extension actuation interface.

A means shall be provided to actuate retraction and extension of the landing gear.
The intent of this requirement is to identify the technique required for landing gear actuation.
Normally the gear actuation should be accomplished by actuation of a standard gear handle.
This requirement should be coordinated with crew systems.

(TBD)
236
JSSG-2009A
APPENDIX A
A.4.4.1.5.1 Retraction and extension actuation interface.

Retraction and extension actuation interface shall be verified by (TBS) .
Normally, the suitability of the design, location and operation of the landing gear control can be
evaluated by inspection of engineering drawings, crew station mock-ups, or actual hardware.
Unusual designs may require pilot evaluation during flight test or formal demonstration to verify
suitability.
TBS should be filled with inspection of drawings.
(TBD)
A.3.4.1.5.2 Gear door actuation and locking.

If required, fairing door actuation and locking shall be (TBS) .
The objective of the requirement is to establish the relationship and mechanical interface of the
gear and door actuation and locking system. Usually, this statement will be completed by the
phrase: “automatically sequenced with the landing gear actuation.” The intent here is to
minimize aircrew workload and to standardize aircrew procedures. In some special cases,
however, it may be desirable to provide controls for separate operation of the fairing doors. An
example would be to open doors that are normally closed for ground operation.
TBS should be filled with “automatically sequenced with the landing gear actuation. Retraction
or extension of any single landing gear shall not depend on satisfactory operation of any other
landing gear.“
This item was previously contained in AFSC DH 2-1 and AFSC DH 1-6. The requirement dates
back to ARDCM 80-1 or HIAD in the 1955 time period.
a. Landing gear and door sequencing is frequently a major source of problems in
development of a new air vehicle. The best approach is to minimize or eliminate
237
JSSG-2009A
APPENDIX A
sequencing by elimination of landing gear fairing doors, or by connecting the doors

directly to the landing gear. Serious consideration should be given to statement of this
design approach as a part of this requirement.
b. Current air vehicle use one or more of the three basic types of sequencing: mechanical,
hydraulic, or electrical. Mechanical consists of use of links, bellcranks, and torque tubes
to transfer landing gear motion to door drive motion. Hydraulic includes use of priority
valves, actuator internal porting, or mechanically actuated valves to operate door
actuators at a proper time in the landing gear operation. Electrical consists of detection
of landing gear and door positions by electrical switches to enable control of relays or
solenoid operated hydraulic valves to apply power in the proper sequence.
c. F-5, F-15, and T-38 type aircraft include separate door controls so that doors can be
opened for ground maintenance. This introduces several design problems. The first is
that it may present operational problems if doors are not returned to proper position
before flight. The actuation sequence and in-flight performance should not be degraded
by this maintenance error. As an alternative, the error should be correctable by the pilot
while the air vehicle is in flight. Separate operation of doors also results in a need for
door ground locks to prevent inadvertent ground operation while personnel are in the
wheel wells. Control switches should be located so that the operator is clear of the door
operation, but so that he can readily determine that all personnel are clear of the doors.
d. Proper operation of some sequencing methods is very dependent upon hydraulic
pressure, hydraulic flow, dynamic loads, and aerodynamic loads. It is essential that it be
possible to check the system for proper operation with the air vehicle on jacks. Ground
checkout set up and test procedures should be developed that adequately simulate the
in-flight operation. If this is not possible with the proposed design, the design should be
changed to provide a practical operational air vehicle.
e. Proper timing of landing gear door locks to the door drive system is a frequent problem
area. Usually, some type of time delay is used to insure door unlocking is complete
before doors are powered open. Time delay systems are not fail safe and sometimes
will not perform properly at extreme temperatures. Door unlock detection systems avoid
these problems, but add significantly to control circuit complexity.
f. The effect of landing gear and door actuation dynamics on proper sequencing of door
locks is frequently overlooked. Rebound of the door from the closed position may
prevent proper locking. Oscillations may combine with control circuit characteristics to
cause buzz or chatter of doors and locks. This can be avoided by decelerating the door
near the closed position and by use of a time delay to insure that door closed and locked
force is maintained for seven to ten seconds after initial indication of locking.
g. Nose door has locks on the door as the result of a late design change to an aft retracting
nose gear configuration. Low observability requirements led to more locks than on other
air vehicles. Compounding the rigging problem is the flexibility of the composite door.
h. When loads are high on all doors increases the criticality of the latch sequence timing.
The fall out of this is very tight rig requirement. Unfortunately, the adjustments are made
on the connecting rods which have threads that are too coarse for the required levels of
accuracy. High loadings on the hooks and rollers led to galling problems which was
addressed by changing the coatings on the surfaces.
238
JSSG-2009A
APPENDIX A
A.4.4.1.5.2 Gear door actuation and locking.

Landing gear door actuation and locking shall be verified by (TBS) .
Proper operation of the landing gear and doors is the result of a complex interaction of air
vehicle subsystems, dynamic and aerodynamic loading. It can be evaluated only by flight test of
the air vehicle. Preliminary verification by analysis, laboratory test of a simulated system, and
with the air vehicle on jacks, is highly recommended to minimize flight test time and cost.
TBS should be filled with inspection of drawing and hardware followed with demonstration on
the air vehicle during checkouts and in flight testing.
(TBD)
A.3.4.1.5.3 Single failure criteria.

No single point nonstructural failure, including power interruption or unmated connector, shall
prevent gear extension or cause mis-sequencing.
This requirement is needed to ensure that the landing gear will extend and lock with a single
point nonstructural failure, including power interruption or unmated connector.
The design should be such that there is no single failure in the power and electrical portion of
the actuation system that will prevent the extension of the landing gear.
The past approach was to specify a general level of redundancy and to prohibit or require
certain design features. Requirements were contained in AFSC DH 2-1.
Consideration should be given to the fact that air vehicle with multiple landing gears may be
able to land with one landing gear retracted. This may require modification of this requirement
statement. Landing with one assembly retracted will impose some weight limit and may require
special techniques. Operating limits should be evaluated by analysis to insure that they provide
a useful emergency capability. Flight test to evaluate technique should be accomplished. This
approach was successfully used in development of the C-5A aircraft.
239
JSSG-2009A
APPENDIX A
A.4.4.1.5.3 Single failure criteria.

It shall be verified that no single point nonstructural failure, including power interruption or
unmated connector, shall prevent gear extension or cause mis-sequencing by (TBS) .
The acceptable level of failure is normally so low that verification by test is not practical. The
requirement should be verified by failure mode and effects analysis of the extension system
combined with historical failure rate data for similar components. In some cases, it may be
necessary to accomplish laboratory testing to verify failure modes and effects, and to establish
failure rate data for new design components.
TBS should be filled in with inspection of drawing, design logic and schematics to eliminate
single failure points. Extension with failures induced should be verified by demonstration, either
on the air vehicle or on a simulator if available.
(TBD)
A.3.4.1.5.4 Actuation reversal.

Reversal of the landing gear control during actuation shall result in the landing gear going to the
last position selected.
This requirement is to ensure that consideration is given to system operation if the command is
changed before the system completes an earlier command. In some cases, however, it may be
necessary to use some other scheme to avoid system design problems. Then the requirement
should be changed accordingly.
This requirement is to ensure that the landing gear actuation system will not “hang-up” under
any motion of the control handle and prevent the gear from finally going to the last commanded
position.
This requirement is from the AFSC DH 2-1.
240
JSSG-2009A
APPENDIX A
It may not be possible to meet this requirement with a system fairing door actuation. F-15
experience indicates that this is the case for a design that requires that fairing doors be closed
after extension of the landing gear.
All systems should be analyzed in the design stage to determine if there are any critical time
periods that a control reversal will create a problem. Consideration of dynamic loads and time
delay functions of the system may be required for an accurate analysis.
Control reversal characteristics after single component failures in complex electrical control and
indication systems should also be reviewed. Failure of a single switch may not only give an
indication that the landing gear is not in the position selected, but also disrupt normal
sequencing.
It may be proposed that this requirement be modified to establish a time limit on reversal or that
the landing gear immediately go to the last position selected. The concern is that a landing gear
that must go fully to the first position selected will take excessive time to reach the last position.
Modification of the requirement in this form should be resisted because it may complicate the
design and increase cost excessively.
A.4.4.1.5.4 Actuation reversal.

The ability of the landing gear during actuation to go to the last commanded position shall be
verified by (TBS) .
Control reversal characteristics of the actuation system may be very dependent upon system
dynamic, hydraulic supply characteristics and aerodynamic loads. Verification of the
characteristics should, therefore, be accomplished by flight test of the air vehicle.
TBS should be filled in with landing gear simulator and demonstrated on the first air vehicle prior
to first flight. Usually, this is accomplished as a part of the subsystem functional test after initial
assembly. A retest of control reversal characteristics should also be accomplished with the air
vehicle on jacks whenever test air vehicle are modified by components that affect the retraction
or extension sequence.
(TBD)
241
JSSG-2009A
APPENDIX A
A.3.4.1.5.5 Airspeed operational criteria
A.4.4.1.5.5 Airspeed operational criteria
A.3.4.1.5.5.1 Retraction.
Retractable landing gear shall retract into an aerodynamically faired enclosure and the fairing
doors if used, shall close and lock without damage at all airspeeds up to (TBS 1) for flight at
(TBS 2) within a time no greater than (TBS 3) .
This requirement is to establish the range of airspeed for retraction of the landing gear and to
define the flight conditions at which the limits apply. Usually, minimum airspeed for retraction is
not a problem. Landing gears usually retract with the air vehicle static on jacks. In special
cases, such as use of an air turbine to power gear retraction, it may be desirable to specify a
minimum airspeed for operation. A possible selection is “minimum flying speed.” The maximum
airspeed is frequently a design driver in sizing of retraction or door closing actuators. The value
selected usually will depend upon the type and performance or the air vehicle. It may also be
established indirectly to be compatible with landing gear extended limit speed or landing gear
extension limit speed. A possible approach is to specify that the maximum airspeed must be
compatible with air vehicle performance and mission requirements. In some cases, the Using
Command may specify a minimum value based on operational experience. Conditions for
application of limit speeds should be defined. This should include temperature (usually 59°F),
altitude (usually sea level), air vehicle attitude (side slip, yaw, pitch, roll) and possibly
configuration.
A time limit should be put on retraction so as to reduce drag for take-off and minimize the
transition time between clean and dirty.
TBS 1 should reflect the maximum air speed required for operation.
TBS 2 should define the environmental conditions and the air vehicle maneuvering limits for the
operation of the actuation system.
TBS 3 should be filled in with a time compatible with air vehicle performance, but no greater
than ten seconds.
Aerodynamic loads on the landing gear and doors are frequently difficult to predict. Errors to
100 percent (100%) have been experienced. This may result in severe restrictions of the
landing gear limit speed compared to the planned value. The retraction system should be
instrumented for load and air load surveys accomplished early in the flight test program.
242
JSSG-2009A
APPENDIX A
External stores on some air vehicle may significantly change aerodynamic loads on landing
gear doors. Performance should be evaluated with various external stores configurations.
Retractable landing gear should be designed to ensure proper wheel alignment during retraction
and stowage.
For large air vehicles where feasible, a clear vision panel or a positive mechanical indicator
should be provided that may be used to verify the gear position as indicated on the gear
indicator panel.
Hydraulic linear actuators should be preferred over hydraulic rotary actuators for landing gear
and door actuation.
When electronic proximity switches are used, the larger model proximity switch should be
preferred over the smaller model.
Landing gear door lock actuators should be mounted on the airframe and the lock stirrup should
be mounted on the gear doors, and not vice versa.
A solid state automatic gear sequencing control system should be used only if it has adequately
built-in test equipment to check out the principal components of the control system. Indicator
lights on the control box should also indicate the progress of the gear actuation sequence from
retract to extend, and vice versa. Low temperature frequently, severely degrades operating
time due to increased viscosity of hydraulic fluid and lubricants. Rotary drive systems seem
more susceptible to this problem than linear actuators. Examination of system performance
after cold soaking is very important because maximum air vehicle take-off performance occurs
at low temperature.
Loss of an engine or hydraulic system may severely degrade operating time. This should be
examined by analysis and flight test to confirm that it does not create a hazardous flight
condition.
Very short operating time usually results in severe dynamic loads on the actuation mechanism
and points of attachment to the landing gear and doors. Mechanism acceleration and
deceleration loads may greatly exceed aerodynamic and inertia loads determined by analysis.
Failure to consider this fact has resulted in early failure of mechanisms on flight test air vehicle.
Strain gage instrumentation of the mechanism during initial checkout and flight test is
recommended to confirm that dynamic loading is acceptable.
A.4.4.1.5.5.1 Retraction.
Retraction requirement shall be verified by (TBS) .
Normally, the suitability of the retraction system to function properly can be determined by direct
observation of flight test results. Loads instrumentation may reveal, however, that although the
function is proper, retraction mechanism stresses are too high for reliable operation.
243
JSSG-2009A
APPENDIX A
TBS should be filled in with analysis and by flight test.
Initial design should be supported by air loads analysis, the results should then be substantiated
by flight testing that include the establishing of maneuvering limits at the specified air speed.
It has been found in several cases that the air loads seen on the air vehicle differ significantly
from that calculated. This has often required the air vehicle to do certain series of yaw
movements to get gears down and locked.
It has also been seen that for high accelerating air vehicles that they can exceed the operational
limits speed of gear retractions during a max performance takeoff. Thus in determining the
maximum operational limit of the actuation system will take into account air vehicle acceleration
speeds after lift off and allow a pad if retraction time is compromised (longer than expected).
A.3.4.1.5.5.2 Extension.
Retractable landing gears shall extend and lock and the fairing doors if used, shall be positioned
as required for landing without damage at all airspeeds from (TBS 1) to (TBS 2) for flight
within a time no greater than (TBS 3) .
This requirement is to establish the minimum acceptable range of airspeeds for extension of the
landing gear and to define the flight conditions at which the limits apply.
Previous requirements were based on structural design criteria of MIL-A-8862. This contained
four conditions to be considered to determine actuation speed for the landing gear. Usually, this
was discussed with the contractors prior to contract award and a general agreement reached on
a specific airspeed for design. Frequently, the actual basis for the design criteria was
comparison with similar type of air vehicle or previous experience of the contractor.
A time limit should be put on extension so as to minimize the time necessary for return to base
and between clean and dirty.
TBS 1 should be filled with the minimum air speed which should usually be “0” to avoid
excessive design reliance on air loads to extend the landing gear. This also enables checkout
of the landing gear with the air vehicle on jacks. From a practical operational limit, this block
could also state, “minimum flying speed.”
TBS 2 should be filled with the maximum airspeed for landing gear extension should be the
minimum acceptable to perform the required mission.
244
JSSG-2009A
APPENDIX A
This block should be completed as necessary to define the flight condition at which the limit
speed applies. This should include temperature (usually 59°F), altitude (usually sea level), and
possibly flight attitude (roll, pitch, yaw).
TBS 3 should be filled in with a time compatible with air vehicle performance, but no greater
than 15 seconds.
Retractable landing gear should be designed to ensure proper wheel alignment during and after
extension.
Application of the criteria contained in MIL-A-8862 may not result in adequate or reasonable
landing gear limit speeds.
Although it is desirable to have the landing gear operate in a direction that enables the air load
to assist extension, normal and emergency extension should not depend on this air load for
proper operation. Use of a landing gear that requires some minimum airspeed for operation
should be avoided because it presents maintenance difficulties (hard to functional test and
adjust), and may be sensitive to lubrication, wear and air vehicle maneuvering.
Many factors other than normal landing gear operation may be significant in selection of the
maximum landing gear limit speed. Examples include: use of the landing gear as a high speed
air brake and air traffic control rules for operation near airports. The limit should be set only
after careful analysis of the total mission of the new system.
Low temperature frequently, severely degrades operating time due to increased viscosity of
hydraulic fluid and lubricants. Rotary drive systems seem more susceptible to this problem than
linear actuators. Examination of system performance after cold soaking is very important
because maximum air vehicle take-off performance occurs at low temperature.
Loss of an engine or hydraulic system may severely degrade operating time. This should be
examined by analysis and flight test to confirm that it does not create a hazardous flight
condition.
Very short operating time usually results in severe dynamic loads on the actuation mechanism
and points of attachment to the landing gear and doors. Mechanism acceleration and
deceleration loads may greatly exceed aerodynamic and inertia loads determined by analysis.
Failure to consider this fact has resulted in early failure of mechanisms on flight test air vehicle.
Strain gage instrumentation of the mechanism during initial checkout and flight test is
recommended to confirm that dynamic loading is acceptable.
245
JSSG-2009A
APPENDIX A
A.4.4.1.5.5.2 Extension.
Extension requirement shall be verified by (TBS) .
This requirement can be verified only by flight test because proper operation is the result of
complex interaction of the air vehicle aerodynamics, dynamics, and system design.
TBS: Landing gear extension should be verified by analysis. Flight-testing should test to the
calculated speed limits and the results of these tests should be compared to the analysis and
the analysis should be corrected accordingly.
(TBD)
A.3.4.1.5.6 Operation with loss of door.

Loss of any landing gear fairing door used shall not result in (TBS) .
This requirement is to insure that the design approach minimizes the effect of loss of a fairing
door. The primary intent here is to discourage routing of hydraulic lines and wires on the doors.
Alternate design approaches that have been used, include use of hydraulic fuses on lines that
are routed on doors. Expansion of the requirement statement to include consideration of door
loss detection may be desirable.
TBS should be filled with the statement should be completed by the phrase: “loss of the
actuation power system.”
Routing of hydraulic lines and electrical wires on fairing doors can cause severe problem with
landing gear operation if the doors are lost in flight. Usually the landing gear remains operable
after door loss if drive power to the actuator and control logic is maintained. Problems were
experienced during flight test of C-5A air vehicles, because both electrical and hydraulic lines
are mounted on the landing gear doors.
Mechanical linkages and cables should not be located on fairing doors because they are subject
to binding due to deflections of the door caused by aerodynamic and inertia loading. Rigging of
door locks with complex mechanisms mounted on the doors may be very difficult because the
246
JSSG-2009A
APPENDIX A
in-flight dimensions cannot be duplicated on the ground. Problems with door mounted
mechanisms were encountered on the B-57 air vehicles.
Control logic with the lost door should be reviewed to confirm that it does not prevent landing
gear extension. Normal extension is preferred, however, emergency extension after door loss is
acceptable.
A.4.4.1.5.6 Operation with loss of door.

Operation with loss of door shall be verified by (TBS) .
If a door loss-operating requirement is imposed, it should be verified by analysis. The intent is

to insure consideration of safety aspects rather than positive demonstration of a mission
capability. Flight demonstration is not worth while because of the many possibilities of the mode
of door loss. In some cases it may be desirable to cycle the landing gear with the air vehicle on
jacks and the doors removed or disconnected to confirm proper control logic.
TBS should be filled with analysis of gear operation with loss of door and analysis of effects of in
flight loss of gear doors.
(TBD)
A.3.4.1.5.7 Emergency extension.

A separate emergency extension system shall be provided with the capability to (TBS 1) . It
should extend the landing gear in not more than (TBS 2) seconds at all airspeeds from
(TBS 3) to (TBS 4) .
The intent of this requirement is to indicate that an emergency extension system is required and
to define characteristics of the system.
TBS 1 should state be independent of the normal system except for components stressed by
ground loads.
247
JSSG-2009A
APPENDIX A
TBS 2 should specify the time required to get the gear down and locked with the emergency
system.
TBS 3 should specify the minimum airspeed the emergency system should function
successfully; usually 0 to accommodate on jacks operation.
TBS 4 should reflect the maximum air speed that the emergency extension system will need to
operate. This value needs to allow enough speed to safely control the air vehicle in all phases
of landing.
The time and speeds are not usually the same as those required for normal gear extension.
System and linkage design details, lock designs, method of emergency extension, redundancy
of system with power sources influence this requirement. This item reflects the criteria
previously stated in AFSC DH 1-6 and AFSC DH 2-1. It has been a standard input for over
20 years.
When a strut compressing mechanism is used, means should be provided in the wheel well to
preclude jamming of the gear in case of compressing mechanism failure.
A direct mechanical linkage should be provided to release the uplocks for emergency gear
extension unless otherwise specified in the detail specification. It should not be necessary for
the crewmembers to physically hold the emergency extension control in the actuated position.
Where possible, interior fuselage and compartment doors should be provided to permit direct in-
flight access to gear uplocks by a crewmember.
The limit airspeed for emergency extension should be the same as the normal extension limit
speed to simplify emergency procedures. During a C-5A air vehicle accident, the landing gear
did not fully extend because the emergency extension gear limit speed was exceeded. At the
time, the C-5A emergency extension limit speed was significantly lower than the present limit.
Experience indicates that the most desirable design is one that provides for free fall of the
landing gear after manual release of the uplocks and door locks. Frequently, this approach
cannot be used due to the geometry of the landing gear and doors. Alternate power systems of
various types are in current use but all have some inherent problems as discussed below.
The emergency landing gear control should be located near the normal control unless specific
approval is granted for an integral control. Whenever cockpit space is at a minimum,
consideration should be given to integrating the emergency landing gear control with the normal
control. The design should preclude interaction between normal and emergency operation.
Failure of the normal landing gear control should not preclude subsequent successful actuation
of the emergency landing gear subsystem. The emergency landing gear control should be as
specified in MIL-STD-203.
Manual uplock release - free fall systems. A major problem with these systems is degradation
of performance due to inadequate lubrication and corrosion. It should be possible to functionally
248
JSSG-2009A
APPENDIX A
test such systems on the ground. As in the case of normal system operation, excessive
reliance should not be placed on assisting air loads. Actuation forces should be carefully
considered to be sure that they remain within capability of the air crew. Proper rigging and
resetting of the system after use frequently presents a maintenance problem. Complex
resetting procedure may seem acceptable for use after real emergencies but normally become
intolerable because of the need for periodic checkout of the system. Consideration should be
given to the effect of normal retraction after use of the emergency extension system.
Typical actuation endurance testing with 10 percent (10%) of the extensions being emergency
extensions may drive the design of system components unnecessarily. The life of a typical
bomber could see less than 100 emergency cycles. Some extend by having the tires knock the
doors out of the way, with composite doors 500 impacts versus 100 impacts can cause a
considerable weight difference and strength difference. Consider the appropriate number of
emergency extension cycles for endurance, instead of arbitrarily assigning 10 percent (10%) of
the cycles.
The actual time for emergency extension of the landing gear includes the time required to
confirm that, the landing gear is down and locked. Air vehicle accidents have occurred because
aircrew attention was directed for long periods of time trying to confirm that the emergency
system has operated properly.
Operating time for manual emergency extension systems that include a set of controls for each
landing gear assembly should be based on the assumption that landing gear will be extended in
sequence (one at a time) rather than simultaneously.
Emergency extension system operating time may be significantly degraded by operation at low
temperature. Performance at low temperature, including cold soak of the mechanism, should
be investigated.
Performance of emergency extension systems is sometimes severely degraded by certain

hydraulic system configurations. Measurements should be made using hydraulic return
pressures and hydraulic porting typical of that expected for actual emergencies. Do not assume
that the normal hydraulic actuation system is devoid of fluid. Many landing gear emergency
extensions are accomplished as a precautionary measure rather than due to a confirmed fluid
loss failure in the landing gear hydraulic system.
A.4.4.1.5.7 Emergency extension.

Emergency extension shall be verified by (TBS) .
Verification of emergency extension system characteristics should be accomplished during flight

because air loads and the interface with other air vehicle systems cannot be accurately
simulated.
249
JSSG-2009A
APPENDIX A
TBS: The verification of the emergency extends system should include an air load analysis
which is supported by simulator testing and flight testing. If simulator testing is too expensive
then means to test the emergency extend system adequately on the air vehicle both on the
ground and in the air should be accomplished.
On some air vehicles, additional flight hardware was added to block the normal extend system
so the emergency system was the only operating system. Addition flight hardware may be
added to ensure that the gear would be extended if the emergency system failed the extension
testing, or did not have the hydraulic power to get the gear down especially if the gear has to
extend into the air stream.
Providing correct air loads on simulators have not been very successful. They have often been
in the wrong direction and the max loads have often been at the wrong gear position and door
position.
The flight test used to verify performance of the emergency extension system should accurately
reflect the most critical probable failure conditions. For example, depressurization of the
hydraulic system may not accurately simulate failure of a landing gear sequence valve.
Hydraulic flow with a blocked valve may cause much higher extension loads than experienced
with a depressurized hydraulic system. Critical failure modes should be accurately simulated.
A.3.4.1.5.8 Actuation indication
A.4.4.1.5.8 Actuation indication
A.3.4.1.5.8.1 Gear position status indications.

An indication shall be provided to show gear position.
This requirement is provide an indication of the position and status of the landing gear. This is
required on air vehicle with retractable landing gear to enable the pilot to know that the landing
gear is in the position required for the intended operation. Also, the system may warn the pilot
of unsafe conditions and permit him to select the proper corrective action.
A means to indicate normal gear position, disagreement between the gear control and the gear
position, and gear unsafe conditions should be provided. See Crew Systems Specification
Guide for position indicators and standard lighting configurations.
250
JSSG-2009A
APPENDIX A
This requirement was formerly contained in AFSC DH 1-6 and MIL-STD-203 also contained a
requirement that the indicator(s) be located on the instrument panel or adjacent to the landing
gear control lever visible to the pilot(s) in his (their) normal position(s).
a. The general requirement for an indicator has existed in some form for at least 25 years.
1. Normally, an indicator should be provided for each separate landing gear assembly.
The pilot usually needs to know which landing gear is not in the position selected to
properly plan the corrective action.
2. The gear indicating system should not indicate a “safe-gear-locked-position” prior to
actual locking or positive engagement of uplock or downlock mechanism. Landing
gear indicators are usually lights or electromechanical devices. Usually a green light
is used for each landing gear to indicate that it is down and locked. Red lights are
sometimes used to indicate that landing gear or doors are not up and locked. In
some cases, no indicator is provided for up and locked, however, and unsafe uplock
condition is indicated by the warning system (red light in gear handle plus an aural
warning). Electromechanical indicators have been used in many air vehicles. These
usually show green wheels for gear down, a barber pole design for in-transit and “up”
for landing gear up and locked.
3. Indicator systems that use lights should include two bulbs in each indicator with a
light test function either as an integral part of the indicator or as a part of the air
vehicle lighting system. When two bulbs are used, be sure that it is possible to
detect that one bulb is burned out. F-15 air vehicle experience indicates that bulbs
should be separated under the common lens to insure that failed bulbs can be
detected.
4. Indicator lights and panel lighting should be designed with replaceable bulbs. A
sealed lighting system used on the C-5A air vehicle proved troublesome. Bulb
replacement required removal of the entire landing gear control. Replacement of the
landing gear control required a complete functional check of the landing gear
retraction system. The functional check required that the air vehicle be jacked.
What seemed like a good idea at component level had a major impact on system
maintenance manhours. Landing gear indicator panel lighting should be
accomplished with easily accessible bulbs or light emitting elements that will permit
easy replacement without removal of the panel or removal and disassembly of the
panel. This requirement should stand regardless of the alleged guaranteed life of the
bulbs.
5. Switches used to indicate an uplock or downlock position of the gear should be
activated directly by the locking means
6. Indicators should function from a positive signal rather than lack of a signal.
Negative logic can, for example, result in a broken wire giving a false down and
locked indication.
7. Landing gear control circuits, indicator circuits, and electrical and magnetic proximity
sensors should be separated insofar as possible. This minimizes the possibility of
sensor-to-sensor inductive interference that will not only prevent landing gear
251
JSSG-2009A
APPENDIX A
operation but could also give false indications of the malfunction. When gear
geometry does not allow sensor separation, interference properties should be
investigated to determine if sensor isolators are needed. Also, separation of the
circuits usually prevents compromise of emergency circuits. Use of common
components would result in simultaneous deactivation of the indication systems.
8. Indicator operation after a single failure of the nominal extension system should be
carefully considered. An incident was experienced on the initial F-15 design wherein
a single failure resulted in a down and locked indication when the landing gear was
up and locked. A switch failed causing the landing gear to try to extend while still
uplocked. Deflection caused by the force against the uplock caused an indicator
switch to make contact. The combination of failed switch plus the false actuation of
the second switch resulted in a false indication.
9. If at all possible, some type of backup system of indication should be provided.
Usually viewing windows can be provided on cargo air vehicle so that uplocks and
downlocks can be inspected directly. Some type of simple marking system should
be used for the downlock locked indication. Frequently, a diagram of proper position
is placed near the viewing window so that the air crew can quickly judge the position.
On some air vehicle it is also desirable to mark the downlock so that it can be
observed from a chase air vehicle. Other devices such as mechanical indicators and
mirrors have been used on air vehicle to permit the pilot to check gear position if he
suspects indicator system malfunction. The use of fiber optic scopes to inspect the
position of the landing gear in flight has been unsatisfactory to date.
10. The original nose landing gear position indicator used on C-141A air vehicle was
actuated by a switch in the over center drag brace link. Slight movement of the
landing gear in the retracted position could result in a false indication that the landing
gear was extended and locked. This feature resulted in an air vehicle accident. The
deficiency was eliminated by installation of a switch to detect that the landing gear is
extended.
11. All switches should be designed and installed to be readily accessible and easily
adjusted or rigged and removed and replaced. Switch mounting and installation
should be adequate to ensure proper switch actuation under all landing gear loads
and deflection. Proximity switches have proven to be highly reliable, easy to
troubleshoot and do not require the frequent rigging and adjustments associated with
mechanical switches as long as the initial design locates the switches and targets in
stable areas of the landing gear linkages. Mechanical switches should have a high-
force actuator-return-spring or be provided with a direct double-acting mechanical
linkage. This prevents mechanical switches from sticking in one position due to
contamination or friction.
12. For certain locations on the gear, it may be desirable to install connectors on the
proximity switches. This would reduce maintenance time if chafing or wire bundle
failures are a problem. Note: if connectors are used on the switches, ensure they
are designed to be compatible with the EMC/EMI requirements.
13. The squat switch should be located and should be of such a design that the “weight-
off” condition is not indicated until the wheel is off the ground.
252
JSSG-2009A
APPENDIX A
b. The following detailed requirements have been applied to most current air vehicles. The
results are generally satisfactory. Use of a similar requirement and approach aids air
crew transition to a new air vehicle design.
1. Provide a Type MA-1 audio warning signal (refer to MIL-DTL-9320) that
automatically actuates when the following conditions exist simultaneously:
(a.) The air vehicle is below a preset altitude.
(b.) The IAS of the air vehicle is less than a preset value.
(c.) In turbine engine air vehicle, the throttle is less than a predetermined power
setting. In reciprocating engine air vehicle, the throttle is less than normal cruise
position.
(d.) The landing gear is not down and locked.
2. Provide a radially mounted wheel-shaped landing-gear control knob. Ensure that the
internal red warning light automatically lights when any gear is not exactly consistent
with the position selected for the landing-gear control, or if any of the gear is
retracted. Additionally, ensure that this light illuminates when the audio signal
occurs. Install the red warning light on an automatic dimming circuit. Provide a test
switch that tests the landing-gear audio and warning light circuit.
Recently, difficulty was experienced with the F-105 control handle. The detent had worn to such
a state that adequate warning was not provided. This indicated that periodic inspection is
required.
A.4.4.1.5.8.1 Gear position status indications.

Gear position status indications shall be verified by (TBS) .
Proper operation and suitability of the indicator system can best be determined by normal use
during the flight test program. In some cases it may be desirable to perform a specific
demonstration of operation when specific malfunctions to the landing gear are simulated. If a
landing gear retraction simulator is available, it is highly recommended that the various failure
modes be investigated on the simulator.
TBS: The verification of the landing gear indication should be by inspection of drawing and logic
schematics. The verification of operation should be demonstrated on the air vehicle both on
jacks during checkouts and in flight-testing.
Consideration should be given to conducting an icing test where the landing gear subsystem will
successfully operate after there is an ice build-up and freezing of the hydraulic locks. The gear
253
JSSG-2009A
APPENDIX A
should successfully retract and extend, verify that any ice build-up on door or locks will not
prevent extension.
Conduct simulator testing to verify that the braking inertia loads encountered while stopping the
wheel from spinning during retraction are not exceeding the design limits and concur with the
analysis.
Conduct simulator testing to determine minimum accumulator pressure needed to extend and
lock the gears successfully under all conditions.
It is significantly more difficult to verify operation at -65°F than it is at -40°F.
A.3.4.1.5.9 Landing gear position restraint
A.4.4.1.5.9 Landing gear position restraint
A.3.4.1.5.9.1 Gear position restraint.

A means shall be provided to maintain each landing gear in the selected position.
The intent of this requirement is to ensure that the gear will stay in the final selected position
without any power for all air vehicle operations within its mission profiles.
The objective of the requirement should be to establish performance for gear positioning.
"Locks” should be considered for maintaining each landing gear in the selected position.
Where doors are used in conjunction with landing gear, the method used to restrain the landing
gear in the selected position should not result in extension of the landing gear due to gapping or
loss of a landing gear door.
AFSC DHs 1-6 and 2-1 formerly stated the requirement for automatic operating positive
mechanical locks. These requirements were based on ARDCM 80-1 (HIAD) that were
generated primarily on lessons learned.
a. Use of actuation force or blocking of the actuation pressure to retain the landing gear in
the retracted or extended position is considered an unacceptable approach. Such
designs are subject to failure due to power failure, leakage, or excessive deflection.
Inadvertent gear extension at high speed has caused major air vehicle accident. This
requirement should specify that positive mechanical locks be used to maintain the
landing gear in the extended or retracted position.
254
JSSG-2009A
APPENDIX A
b. Landing gear and door locks should be designed for proper rigging while on the ground.
Rigging of uplocks and downlocks should be by simple adjustment and not require
devices with close tolerance adjustments. Some designs have been used in the pasts
that require compensation for the fact that alignments of parts of the lock are dependent
upon the amount of airload applied. These designs require considerable flight test effort
to develop suitable rigging procedure. Frequently, the problem is not recognized and
severe flight test delays result. In most cases, the problem can be avoided by mounting
major lock components on fixed structure and providing guides to direct moving parts to
the proper position.
c. Landing gear uplocks should not be mounted in a manner that requires that the shock
absorber be properly serviced for the lock to operate correctly. A recent incident with a
fighter air vehicle revealed that not only will the lock not lock but also the lock parts may
jam and prevent landing gear extension.
d. Landing gear downlocks should be designed so that ground loads does not stress them.
Downlocks subjected to ground loads are exposed to a severe fatigue stress
environment that may be highly dependent upon lock rigging. Durability testing on a
single landing gear may not accurately reflect operational design life. If the design
dictates that the downlock must carry ground loads, it is recommended that the lock be
non-adjustable.
e. Hydraulic pressure variations due to surges or thermal expansion have caused locks to
unlock. Locks sometimes work properly for normal operation but malfunction when used
for emergency extension because subjecting both sides of the actuator to return
pressure results in a tendency to unlock. The actuators should be installed so that if
both sides of the piston are pressurized, the resultant force tends to lock the actuator
towards the commanded position. In designs where pressure works on both sides of the
actuator insure that time delays and system logic are such to cause the gears or doors
lock in the commanded position. The use of landing gear simulators is strongly
recommended in proving the logic and capability of such a system.
f. Locks should be designed so that if actuation force is applied with the lock engaged the
lock does not unlock and neither the lock nor the actuating mechanism is damaged.
g. Some ground load conditions may result in deflections that tend to unlock downlocks.
An analysis should be performed to determine if limit load conditions will result in
excessive deflection. The analysis should include unusual loading conditions such as
extreme landing attitudes and reverse braking.
h. Electrically operated locks should be designed so that no single electrical failure will
result in the lock unlocking.
i. Locks should be designed with no water traps. Ice build-up should not prevent
operation. Testing may be required to verify that actuator force or ice breaker design is
adequate.
j. Uplocks should be designed so that flight inertia loads of the landing gear do not load
the actuation mechanism.
k. Landing gear subsystems should be designed so that small errors in servicing will not
cause gear malfunctions.
255
JSSG-2009A
APPENDIX A
l. The use of shims for adjustments between any switch, brackets and gear structure
decreases the reliability and maintainability of the landing gear subsystem.
m. The uplocks should hold the individual gears in the up and locked position independent
of door locks.
n. Failure of door locking linkages or extension devices should not preclude emergency
unlocking and extension of the landing gear.
Slight 5 to 7 percent (5-7%) over inflation of the F-111 gear struts will prevent the main gear
from locking in the retract position.
The F-111 landing gear strut servicing procedure used air pressure in conjunction with strut
extension for proper inflation of the shock struts. The strut extension is measured in one-eight
inch increments and the air pressure is held to plus or minus 25 pounds per square inch. The
gage used for this procedure has a range of 0-4000 pounds and the dial face is marked in
100-pound increments which makes accurate air servicing very difficult and almost impossible
to meet the plus or minus 25-pound requirement.
Do not use air for inflation, for under certain conditions an explosive mixture can be formed,
resulting in a “dieseling” effect. Nitrogen will prevent this potential problem.
This requirement should not prohibit use of systems that depend on the landing gear uplocks to
keep doors closed. These systems have been used on fighter air vehicle, F-4 for example, with
considerable success. An inherent disadvantage of this approach is that door linkage must be
rigged to provide proper preload of the door. The preload should be enough to prevent door
gaping due to air loads but not so high as to cause structural damage. The major advantage of
this approach is that it simplifies the actuation sequence and mechanism.
The number of actuators required to operate door and landing gear locks should be minimized.
Failure of an actuator normally disables the actuation system and may cause severe damage.
Only electrical or hydraulic interlocks can avoid this. Experience has indicated that these
interlocks frequently cause more failures and maintenance problems than the basic system.
Use of a small number of actuators often results in a complex mechanism. Once developed,
however, such systems provide better operational service.
A.4.4.1.5.9.1 Gear position restraint.

The means to maintain gear in the selected position shall be verified by (TBS) .
Suitability of the lock system should be evaluated by flight test. Evaluation of performance
under extreme conditions such as load or low temperature may require that a laboratory test be
performed. In some cases, design analysis may be sufficient to show that the lock performance
is not adversely affected by the specified conditions.
256
JSSG-2009A
APPENDIX A
TBS should be filled with analysis, laboratory tests (simulators), taxi and flight-testing, failure
modes and effect analysis, supported with laboratory testing or on air vehicle testing as
appropriate.
(TBD)
A.3.4.1.5.10 Ground safety restraint.

Ground safety provisions shall be provided to prevent retraction without damage to the air
vehicle or ground safety provisions under any of the following conditions: (TBS) .
There have been numerous incidents of inadvertent or uncoordinated gear retractions during
landing gear maintenance which have resulted in personnel injury. Therefore, operational
needs exist to provide a design which precludes this characteristic.
TBS should be filled with the following: Inadvertent gear handle actuation, transient, taxi, take-
off, landing, hydraulic or electrical signals, EMI, physical impact of gear linkages or other should
be included in the blank.
Unique landing gear ground locks should be stowable on the air vehicle.
Previously, ground lock requirements were contained in AFSC DHs 2-1 and 1-6. These
documents identified the need for inclusion of such a device in the design but they did not
attempt to identify the conditions under which the lock would continue to provide safety. This
will be a new requirement.
a. Landing gear lock should be designed so that they may be installed and removed
regardless of the load on the landing gear. This is required so that locks can be used for
normal operation to maximum weight and with the air vehicle on jacks.
b. Doors that are power activated for ground maintenance access should be provided with
separate ground locks for installation with doors open. It may not be necessary to use
these locks for normal flight operations.
c. Pins used to hold a ground lock in place should be permanently attached to the lock to
minimize the possibility of the pin being improperly installed.
257
JSSG-2009A
APPENDIX A
A.4.4.1.5.10 Ground safety restraint.

The effectiveness and adequacy of the ground safety locks shall be verified during flight test.
Design aspects of the ground lock can be evaluated by inspection of the hardware. Functional
suitability can be evaluated as a part of the overall flight test evaluation of the air vehicle.
During ground operation in flight testing the use of ground safety restraints should be
demonstrated and proved to be adequate.
(TBD)
A.3.4.1.6 Ground operation interface.

The landing gear shall be capable of providing flotation, high frequency ground roughness
accommodation, controllable frictional drag at the ground for stopping, stopping energy
absorption, a side load at the ground as a function of yaw angle, and low friction drag for take-
off and landing.
The objective is to provide a capability compatible with the air vehicle operation and
performance for all taxi, turns, takeoff, and landing operations at the critical gross weights and
velocities that do not exceed air vehicle structural or operational limits. Emergency conditions
should also be considered, such as aborted takeoffs and maximum landings. If aerodynamic
heating exceeds 160°F during flight, this should be considered.
Performance parameters:
a. Air vehicle configuration
b. Flotation
c. Load - This parameter will be dependent upon A.3.4.1.3.
d. Growth allowances
e. Runway considerations
f. Speed - maximum ground speed, rotation speed, brake application speeds.
258
JSSG-2009A
APPENDIX A
g. Taxi distances and turning requirements

h. Environmental heating - Aerodynamic heating level, time at high speed, equipment mass
and air flow may be significant parameters for the design. This may dictate high
temperature compounding.
i. Temperature
j. Air vehicle design weights.
The environment developed by the wheel-brake-tire combination should be accounted for in the
design conditions of the wheels.
See sections A.3.4.1.11 and A.4.4.1.11 for Component information if tires, wheels, and brakes
are used.
This requirement reflects the concept generated in MIL-PRF-5041, AFSC DH 2-1, and
AFSC DH 1-6. This is an Industry accepted practice for military and commercial tire
development.
A.4.4.1.6 Ground operation interface.
Ground operation interface shall be verified by (TBS) .
This is to ensure that the ground operation interface requirement is verified.
TBS should be filled in with analysis, ground and flight test as appropriate.
This should take into account the static and dynamic loads, speeds and time at loads for worst
case operational conditions, as well as normal operating conditions.
If tires are used:
The use of a laboratory dynamometer to evaluate the tire, wheel and brake performance
characteristics permits evaluation to the limits of the tire, wheel and brakes capability with low
risk. The design conditions are carefully controlled and are repeatable. The Industry has
always utilized this method of evaluation prior to installation on an air vehicle to determine
performance limits and to establish safety of flight. It is significantly more economic than any
other verification method. The tire, wheel and brakes will also be observed and evaluated
during the routine flight test program.
259
JSSG-2009A
APPENDIX A
A.3.4.1.7 Restraint capability.
The landing gear shall provide restraining force to hold the air vehicle static on a dry paved
surface during application of (TBS) .
This establishes the need to hold the air vehicle static for functions such as engine run-up.
TBS should reflect the thrust level of engine run-up during which the air vehicle is required to
remain static, such as 100 percent (100%) military power.
Depending upon Using Command practices, this requirement may vary. Most jet air vehicles do
not generally park with brakes locked and run-up all engines to military power. However, the
requirement should be tailored for the Command requirements.
The ability to meet these requirements is a function of the size and design of the rolling
components selected. If there is not enough tire contact area, holding the brakes locked will still
result in skidding the tires. The ability to develop a tire drag force is a function of the applied
load and the tire to ground coefficient of friction. The contact patch may have some effect, but
that should be included in the assumptions used to select the coefficient of friction.
Depending on the type of brake used on the design, the brakes may or may not remain locked
at full actuation pressure. With steel brakes, the static coefficient of friction between the brake
disks is much higher than that generated during braking, and holding wheel locked is relatively
easy. With carbon brake disks and friction material, the static and dynamic coefficients of
friction are very close to one another and more effort would be required to keep the disks from
rotating.
It is not clear whether it is best practice to let the operational practice drive the hardware design
or whether the hardware design should drive the operational practice. This should be a joint
engineering/Using Command decision.
A.4.4.1.7 Restraint capability.

Total air vehicle stopping performance and the ability to hold the air vehicle static during engine
run-up shall be evaluated by air vehicle test as follows: (TBS) .
Even though the static coefficients of the brake are evaluated in the laboratory during
development testing, it is best to evaluate the system performance on the air vehicle.
260
JSSG-2009A
APPENDIX A
TBS should reflect a demonstration on the air vehicle. On some air vehicle the thrust is
sufficient to move the air vehicle even with the wheel locked up. This is not a failure of the
brake system as long as the brakes can keep the tires from rotating. It would be prudent to
release brake once the air vehicle begins to move to prevent flat-spotting the tires.
A number of air vehicles have start to move are the end of the runway when the throttles are
advanced and before they get to 100 percent (100%) power. In these cases the pilot should
release the brakes and begin it takeoff roll. This should not be considered a failure of the
braking system as long as the wheel did not begin to rotate first.
A.3.4.1.8 Auxiliary deceleration devices
A.4.4.1.8 Auxiliary deceleration devices
A.3.4.1.8.1 Arresting hook systems
A.4.4.1.8.1 Arresting hook systems
A.3.4.1.8.1.1 Air vehicle arrestment performance.

The arresting hook system shall be capable of decelerating (TBS 1) air vehicle to a stop by
engaging (TBS 2) arrestment system at (TBS 3) .
This is a performance statement for the arresting hook system. The legacy arresting hook
specification MIL-A-83136 can provide additional guidance.
TBS 1 should define the maximum weight or configuration of the air vehicle to be arrested.
TBS 2 should list the intended arresting system. If this value is not known, use the BAK-13,
which produces the highest hook load.
TBS 3 should list the speed of engagement blank and define the energy to be absorbed. If the
total energy of the system exceeds the barrier capability, the limit speed at the design gross
weight selected should be used.
The arresting system and air vehicle should withstand engagement loads with all tires
contacting the ground, initially with zero deflection of the tires and landing gear shock
absorbers, for an air vehicle at landplane landing design weight and approach speed.
261
JSSG-2009A
APPENDIX A
Barrier system design and limits hook compatibility, air vehicle configuration, and engaging
speeds control this requirement.
The verification aspects are defined in AFSC DH 2-1. The original emergency tail hooks were
retrofitted on MIL-A-18717, was used to establish criteria. Through the efforts and cooperation
of Industry, MIL-A-83136 was published in August 1968. Recently, errors were found in the
load data used for design compatibility with the BAK-12 barrier system, and efforts were being
made to update the criteria.
The spring type hook shanks have exhibited numerous problems both during testing and
operation in the field. If a spring tube shank is used, consideration should be given to its
bending mode after contacting a protrusion on the runway or at barrier engagement, as missed
engagements are common place because of hook bounce when the vertical load at the attach
point is very high.
A.4.4.1.8.1.1 Air vehicle arrestment performance.

Performance limits for arresting hook systems shall be evaluated by air vehicle test with the
specified arrestment system.
Since the performance is basically a function of interface and compatibility with the arrestment
system, the most logical demonstration is on the air vehicle with the intended barrier system.
Much of the performance is dimensional and dynamic response as a system.
The design and structural capability should be verified by analysis and laboratory testing. On air
vehicle testing should verify overall system performance capability.
A number of engagements should be performed on the air vehicle during flight testing to ensure
there is no damage due to cable dynamics and that the loads are within the design envelopes.
A.3.4.1.8.1.2 Fly-in engagement criteria.

Arresting hook system and attachment shall withstand loads of (TBS) fly-in engagement.
If the Using Command intends to arrest the air vehicle during emergency by fly-in engagement,
this statement should reflect the requirement. If the user does not intend to operate in this
262
JSSG-2009A
APPENDIX A
manner, the requirement should be deleted. The blank should show the gross weight condition
for fly-in engagement.
TBS should list the approach speeds expected for this type of engagement and still maintain
control of the air vehicle.
Barrier system energy capacity, hook design loads, hook point design, air vehicle configuration,
and weight all impact and control meeting this operational need.
This is a new requirement. The loads should be the same as taxi engagement for the same
gross weight-velocity engagement. MIL-A-83136 previously excluded fly-in engagements, but
this requirement establishes performance for such a maneuver, since the user needs this option
in case of emergency.
The fly-in engagement loads are significantly higher than those encountered when taxiing into
the barrier. Therefore, the weight of air vehicle which can be recovered within the design load
envelope is reduced. The impact dynamic loads are high, as well as the loads due to higher
energy transmission. It would be anticipated that local damage to the underside of the air
vehicle could be expected due to fly-in engagement.
A.4.4.1.8.1.2 Fly-in engagement criteria.

Performance limits for emergency arresting hook systems shall be evaluated by air vehicle flight
test with the specified arrestment system.
Since the performance is basically a function of interface and compatibility with the arrestment
system, the most logical demonstration is on the air vehicle with the intended barrier system.
The dynamic effects play a major part in the ability to arrest the intended air vehicle.
The fly-in engagement should be verified by air vehicle testing with the required arrestment
systems.
(TBD)
A.3.4.1.8.1.3 Probability of successful engagement.

The probability of successful engagement of the arresting system shall be not less than (TBS)
for all air vehicle landing attitudes. The arresting hook system shall provide sufficient hook hold-
263
JSSG-2009A
APPENDIX A
down force and damping to minimize hook bounce and prevent further loss of contact with the
runway for all-landing configurations and attitudes.
This requirement is to establish an acceptable level of reliability of the arresting hook system. It
is primarily intended to insure consideration of proper positioning of the hook and prevention of
hook bounce.
TBS should be filled with an appropriate value based on operational experience with existing
systems on air vehicles with similar mission requirements. In some cases it may be desirable to
further define the conditions applicable to this success probability. This could include such
factors as type of runway surface, type of arrestment system, and maximum lateral or angular
misalignment of the air vehicle and arrestment cable.
Runway roughness, damping characteristics, discrete bump characteristics, and hold-down

force are parameters influencing the ability to meet this requirement.
Design criteria were previously furnished in legacy documents MIL-A-83136 and AFSC DH 2-1.
Prevention of hook bounce prior to arrestment cable engagement is a major factor in the
probability of success. Previously it was specified that hook bounce should not exceed 21/4
inches before arrestment. This has been found to be one way to improve the probability of
success and should be strongly considered by the designer. Hook bounce is limited by using a
damper.
A hydraulic or mechanical damping device usually provides damping. In most cases the worst
case condition is when the nose tire is flat and the nose gear strut is also flat. However, with the
viper it is when the nose tire just touches the runway, because the main gears are still extended
due to wing lift, essentially 3-point landing with all the gears extended, the hook will sail over the
cable. Need to design to successfully engage under this condition also.
A.4.4.1.8.1.3 Probability of successful engagement.

The probability of successful engagement shall be determined by analysis of flight test results.
The requirement should be verified by analysis because the high probability of success would
require too much testing to establish a significant sample size. Arrestment failures experienced
during flight test should be considered. If the design or procedures that caused the arrestment
failure is not corrected, probability of recurrence of the condition should be considered in the
analysis.
264
JSSG-2009A
APPENDIX A
Arresting hook dynamics and adequacy of the hold-down force should be determined by
computer analysis and should be demonstrated on the air vehicle.
(TBD)
A.3.4.1.8.1.4 Lateral freedom of hook.

Hook installation shall have lateral freedom for (TBS) .
Frequently, the air vehicle will contact the ground off-center on the runway and in a drift landing
attitude, which would make engagement other than straight into the center of the cable span.
Therefore, limits on off-center and alignment engagement should be established for operational
requirements. In the past, 20 percent (20%) off-center and 20 misalignment have been selected
for design purposes.
TBS should be filled with: “ 20% off-center and 20° misalignment at engagement with respect
to the center of the cable span.”
Lateral hook loads, centering forces, barrier characteristics, crosswind, direction and velocity
are characteristics impacted by this requirement.
This requirement was previously stated in MIL-A-83136. A portion was in the Performance
Section and a portion was previously in the Verification or Quality Assurance Section. It is
expected that this requirement originally stemmed from the Navy requirement as expressed in
MIL-A-18717.
Since many of the previous requirements on Air Force arresting hook design stemmed from
Navy experience, most of the lessons learned are from this operational regime.
The biggest problems associated with off-center engagement are eccentric loads, control, and
air vehicle clearance. If there are any protuberances within the envelope of arresting hook
movement, they are in jeopardy of damage due to hook contact. The bottom of the air vehicle
should be clear in the envelope of hook movement. A suitable protected fairing is needed for
most arresting hook installations.
The attachment of the hook should be designed to take off-center loading to the limit of the
design envelope. Cable bounce and dynamics are as important a consideration as the hook
movement itself.
265
JSSG-2009A
APPENDIX A
Therefore, knowledge of anticipated cable dynamics is an important task of proper design and
installation.
Most hook installations have had difficulty in maintaining directional control during barrier
runout. This is particularly true for off-center misaligned engagements. On the F-111 and F-5, it
was found to be best to maintain control with the use of rudder rather than steering. Rollback
after completion of the runout is also a problem. If the brakes are applied too abruptly, air
vehicle with aft center of gravity situations will sit back on the tail and suffer structural damage.
Each air vehicle should develop the proper technique for the design for steering and handling of
rollback. Another problem with rollback is catching the hook point on runway irregularities. This
can accentuate the tendency to tip back.
A method should be provided to keep the shank on the air vehicle centerline prior to
engagement but permit movement after engagement.
A.4.4.1.8.1.4 Lateral freedom of hook.

Performance limits for arresting hook systems shall be evaluated by air vehicle flight test with
the specified arrestment systems. The dynamic and design characteristics shall be evaluated
by analysis and inspection.
The air vehicle with the intended system best demonstrates compatibility with the arrestment
system. Dynamic response of the system can be predicted to a limited degree, but the final
proof is an actual demonstration.
Appropriate dynamic analysis and laboratory testing may be needed to determine the
performance envelope for the arrestment system. The results of the analysis should be
supported by on air vehicle tests and demonstrations.
(TBD)
266
JSSG-2009A
APPENDIX A
A.3.4.1.8.1.5 Hook retracted criteria.

The retracted hook shall preclude (TBS) .
The objective of this requirement is to establish a safety requirement for landings where hook
engagement is not desired.
TBS should be filled with: “ the inadvertent engagement of the arresting system for all air
vehicle landing attitudes, including the effects of compressed tires and struts, and rebound of
the cable due to the tires running over it.”
Rather than define a prescribed ground clearance at maximum tail down attitude, including
compressed tires and struts, this requirement is a statement that the stowed hook should not
inadvertently engage the barrier or arresting system while in the most critical condition.
Physical details of the hook design, aft fuselage detail design, and high angle of attack flying
characteristic impact meeting this design requirement.
This requirement was previously contained in MIL-A-83136.
Generally, tail hooks have provided a minimum ground clearance of 14 inches in the stowed
position at maximum tail down attitude. This rule of thumb has been to insure ground clearance
for the cable that is rebounding from the main tires running over it. It may be conservative, but it
represents lessons learned by the Navy after years of experience in arresting hook design and
installation.
If such clearance cannot be provided, a fairing can provide suitable protection to preclude
inadvertent hook-cable engagement. Considerable damage to the fairing was experienced on
the F-111 during category II testing at Edwards AFB. This occurred on routine engagement
after the hook picked up the cable and rebounded against the bottom of the air vehicle. Fairing
design should be inexpensive or easily replaceable or both.
A.4.4.1.8.1.5 Hook retracted criteria.

The dynamic and design characteristics shall be evaluated by inspection.
No special tests can be conceived to evaluate inadvertent hook engagement on routine

landings. This will become readily apparent by observation.
267
JSSG-2009A
APPENDIX A
Inadvertent engagements should be evaluated by analysis and inspection of drawings and the
installation.
(TBD)
A.3.4.1.8.1.6 Position indication.

Current position of the hook shall be (TBS) .
In order for the pilot to maintain control of the air vehicle in emergency or normal operation, it is
vital to be able to know whether the hook has been deliberately or inadvertently extended and
whether the hook has in fact been extended when such action was initiated. Therefore,
indication is deemed necessary to provide this status information to the pilot.
TBS should reflect the need for having the current extended/retracted position of the hook be
indicated to the crew. Indication should be provided to the crew whenever the hook position is
inconsistent with the control position.
Cockpit designs, arresting hook position display, position sensing circuit, redundancy of circuit,
power sources, and switch design and location impact the ability to meet this operational need.
This is a new requirement not previously contained in prior documentation.
Experience on recent air vehicle indicates that location of the arresting hook release lever is
important. On the F-111A and the F-15A, the arresting hook release handle is located in the
near proximity to the parking brake control handle. In each case, the handle shapes are similar
and there have been incidents with each air vehicle where the wrong handle has been
inadvertently actuated. The direct result has been blown tires and a missed barrier.
Fortunately, no serious damage resulted in either occurrence.
Therefore, judicious placement of the release handle and some method of position indication
are reasonable expectations for new designs.
268
JSSG-2009A
APPENDIX A
A.4.4.1.8.1.6 Position indication.

Position indication shall be verified by (TBS) .
Observations from drawings, mock-up, or actual air vehicle confirm the adequacy of the
arresting hook controls.
TBS should be filled with inspection of drawings and on air vehicle demonstrations. The air
vehicle demonstrations should check both correct position indications and incorrect position
indications.
(TBD)
A.3.4.1.8.1.7 Maintenance and installation criteria.

For maintenance activity, the hook installation shall (TBS) .
Numerous features are available for arresting hook system designs. Each adds complexity and
are cost drivers. If such features are known to be desired by the intended user, this requirement
should reflect such choice.
TBS should reflect the need to have provisions to secure the hook in the extended and in the
retracted positions to prevent inadvertent retraction or extension.
Detail hook design, user’s needs, and maintenance procedures are influenced by this
requirement. This requirement contains some previous requirements of MIL-A-83136 and has
the potential of adding new requirements. The retraction and extension features were
previously defined. AFSC DH 1-6 also contained a discussion of this item.
If the arresting hook extension is designed to be used only under emergency conditions, no
retracting mechanism was required in the past. However, a positive latching device, which
prevents inadvertent extension in flight or on the ground, should be provided. If the system is
electrically actuated, the controls from the cockpit to the uplock release mechanism should be
totally redundant. In the past, extension time has been limited to two seconds or less. With
electrically actuated release mechanisms, the ground safety pin should interrupt the electrical
269
JSSG-2009A
APPENDIX A
power to the release mechanism. This will prevent release mechanism damage if the cockpit
switch is actuated with the ground safety pin installed. In the interest of personnel safety, the
release mechanism should prevent installation or removal of the ground safety pin with the
arresting hook in any position other than fully up and locked.
A.4.4.1.8.1.7 Maintenance and installation criteria.

Maintenance of the hook system shall be verified by (TBS) .
Design features are best reviewed by inspection of drawings and actual air vehicle installations.
TBS should be filled with inspection and on air vehicle demonstrations.
(TBD)
A.3.4.1.8.1.8 Hook actuation criteria.

The hook shall be positioned by the following action (TBS) .
This requirement is to establish the design and performance requirements for the arresting hook
control.
TBS should reflect the hook actuation control method in accordance with the crew station
specification. If required the following statement may be added, “The air vehicle shall be able to
disengage from the arresting cable without external assistance, and then be able to taxi over the
cable without reengagement.”
Factors include location, actuation, and design of the control switch. The following has been
specified in the past by MIL-STD-203:
a. (Normal system operation) Single pilot, tandem pilot, operable by pilot. Actuation -
Direction of motion should correspond to hook movement. Design - when an indicator
light is used, it should be located in the control handle and should be “ON” when the
arresting hook is inconsistent with control position.
b. Emergency arresting hook control (ground use only). Single pilot, tandem pilot, side-by-
side pilot: Location - Accessible to the pilot’s shaped switch - Down or aft for hook
270
JSSG-2009A
APPENDIX A
“down”. Design - A recessed, guarded push button switch or a guarded hook-shaped,

coded toggle switch.
Type of arresting hook (normal of emergency), type of air vehicle, and number of crew influence
this requirement.
This requirement was formerly included in MIL-STD-203.
(TBD)
A.4.4.1.8.1.8 Hook actuation criteria.

Hook actuations shall be verified by (TBS) .
The characteristics established by this requirement can usually be determined by review of the
hardware and engineering drawings. Formal demonstrations or tests may be necessary for
some complex control systems such as automatic deployment. Revise the verification
requirement to be compatible with the design requirements.
TBS should be filled with inspection of drawings and demonstration on the air vehicle.
(TBD)
A.3.4.1.8.2 Drag chutes
A.4.4.1.8.2 Drag chutes
A.3.4.1.8.2.1 Air vehicle drag chute performance.

(TBD)

(TBD)
(TBD)
(TBD)
271
JSSG-2009A
APPENDIX A
A.4.4.1.8.2.1 Air vehicle drag chute performance.

Drag chute performance requirements shall be (TBS) .
Drag chutes should follow standard drag or drogue chute design practices as typically found in
JSSG-2010 which provide the performance capability of drag chutes.
TBS should refer to the latest parachute design guide or specification as needed.
(TBD)
A.3.4.1.9 Shipboard compatibility.
Landing gear for shipboard compatibility shall include features for (TBS) .
(TBD)
TBS should be filled in with catapulting, arrested landings, deck operations, ski jumps, and
parking brakes.
(TBD)
A.4.4.1.9 Shipboard compatibility.
(TBD)

(TBD)

(TBD)
(TBD)
272
JSSG-2009A
APPENDIX A
A.3.4.1.9.1 Landing gear catapult compatibility.

Air vehicles with ship-based landing gear shall be compatible with catapult systems by (TBS) .
Catapult systems provide additional power necessary for an air vehicle to take off from an
aircraft carrier.
Provisions for catapulting should be in accordance with MIL-L-22589.
The air vehicle deck clearance should not be less than six inches. This clearance should also
be maintained with respect to the composite clearance envelope during all catapulting
operations with the air vehicle in all critical off-center positions and rolled to an attitude
commensurate with a 25 knot cross wind and the main gear fully compressed and tire flat on the
wing-low side.
Landing gears of ship-based air vehicles should include provision to prevent damage due to
repeated sudden extension of the landing gear as the wheels pass over the deck edge
subsequent to catapulting, a bolter, or a touch and go.
For ship-based air vehicles, tire selection should be based on the dynamic reaction resulting
from catapulting whereby tires should not be fully deflected to a bottomed condition.
On ship-based air vehicles, if the shock absorber is of the stored-energy type, the energy stored
in the shock absorber during the catapult stroke should be sufficient to provide rotation of the air
vehicle to flight attitude at the end of the deck run in the event that one or both nose gear tires
have failed during the catapult run. The stored energy should not cause pulsating loads that
would jeopardize safe operation of the air vehicle.
When catapulting, means should be provided for automatic retraction of the bumper wheel or
skid, if used.
A “park-on” cockpit warning system or an automatic park brake release system should be
provided to preclude “brakes-on” during catapulting.
The landing gear retraction time should be compatible with the air vehicle flight performance
and should not exceed 10 seconds.
The center of the nose wheel axle of ship-based air vehicle should clear the deck by no less
than 6 ½ inches when the tire(s) is flat.
273
JSSG-2009A
APPENDIX A
(TBD)
A.4.4.1.9.1 Landing gear catapult compatibility.

Landing gear catapult compatibility shall be verified by (TBS) .
Verification will ensure that air vehicles can safely and successfully take off from aircraft
carriers.
(TBD)

(TBD)
A.3.4.1.9.2 Arrested landings compatibility.

Landing gear for ship-board conventional takeoff and landing air vehicles shall be capable of
arrested landing.
Ship-based air vehicles should be capable of landing on ships at high speeds, which requires
the use of arresting gear so that the plane does not roll beyond the carrier deck edge.
When designing tires, consideration should be given to dynamic impact loads, especially when
traversing a 1-5/8 inch diameter arresting cable.
For ship-based air vehicles, the restraint system should withstand the following ultimate load
factors: 20 forward static, 10 lateral static, 7.5 aft static, 20 down static, and 5 up static.
The fuselage aft of landing gear struts of ship-based air vehicles should be designed to prevent
or shield external projections that might engage the arresting wires.
Provisions should be made to retain the nose wheel in the centered position until landed, and
remain centered during roll back from arrested landings.
The landing gear installation of ship-based air vehicles should not contain features such as
sharp projections or edges that would be conducive to failure of the barricade in the event of a
barricade engagement.
274
JSSG-2009A
APPENDIX A
In any position of the foot, there should not be a tendency for the pilot to apply brake effort
unintentionally during the normal use of the rudder pedals or during arrested landings.
Wheel diameter should be selected to prevent the arresting cable from riding over top the wheel
when the tires are flat. The recommended dimension of the wheel radius is greater than
6.5 inches.
The tire pressure for ship operating design pressure should not exceed 1.3 times the static
pressure at the rated load or 350 psi and 32 percent (32%) deflection.
(TBD)
A.4.4.1.9.2 Arrested landings compatibility.

Arrested landing compatibility shall be verified by (TBS) .
Verification will ensure that air vehicles can safely and securely land on aircraft carriers.
TBS should be filled in with analysis and test to ensure arrested landings can be safely
executed.
(TBD)
A.3.4.1.9.3 Deck operations.

Deck spotting of ship-based air vehicles shall be provisioned by (TBS) .
Air vehicles should be able to be operated in a confined area on a carrier. These operations
should include but not be limited to taxiing, towing, and spotting.
TBS: The wheel brake hydraulic system should be capable of providing adequate braking for
deck handling without engine operation of external power packages and performing at least
275
JSSG-2009A
APPENDIX A
10 applications of the normal brake before a hand pump or other means would be utilized to
repressurize the brake system. A pressure indicator should be provided in the pilot’s cockpit.
A minimum tire section width of six inches should be provided for ship-based air vehicles.
(TBD)
A.4.4.1.9.3 Deck operations.

Deck spotting for carrier air vehicles shall be verified by (TBS) .
Maneuverability on air vehicles carrier decks is limited. Therefore, it is necessary to ensure air
vehicles have the capability to be operated and then stowed to maximize space on the carrier.
(TBD)
(TBD)
A.3.4.1.9.4 Ski jumps.

Air vehicles with ski jump capability shall have (TBS) .
The objective of the requirement is to establish performance for the gear for ski jump
operations.
(TBD)
(TBD)
276
JSSG-2009A
APPENDIX A
A.4.4.1.9.4 Ski jumps.

(TBD)
(TBD)
(TBD)
(TBD)
A.3.4.1.9.5 Parking brake.

All shipboard air vehicles shall have a parking brake.
Shipboard air vehicles need a parking brake for ready alert status, rough sea conditions, and
catapult spotting.
VTOL air vehicles with wheeled-type landing gear should be able to set parking brakes prior to
landing.
(TBD)
A.4.4.1.9.5 Parking brake.

(TBD)
(TBD)
(TBD)

(TBD)
277
JSSG-2009A
APPENDIX A
A.3.4.1.10 Specialized subsystems.
The air vehicle shall have specialized subsystems or landing gear characteristics as follows:
(TBS) .
This requirement is to cover those specialized subsystem requirements not normally covered
under landing gear subsystem.
The requirement describes landing gear other than nose wheel, main wheel, or tail wheel.
Examples could be outrigger or skid-type landing gear. Unique air vehicle design or operational
characteristics may drive the need for this gear.
TBS is filled with the name and requirements of any specialized subsystems to meet mission
requirements. Examples of specialized subsystems are: skis, crosswind positioning systems,
kneeling systems, and inflator-deflations systems.
Towing and ground handling of air vehicles with skid-type landing gear should be possible with
the airplane loaded to maximum gross weight.
The C-5 have forward and aft kneeling systems, had onboard inflation and deflation systems,
and an aft steerable gear to account for cross wind landings.
A.4.4.1.10 Specialized subsystems.
The specialized subsystem shall be verified by (TBS) .
Each type of specialized subsystem will have its own particular verification methods and needs.
TBS: Most subsystems should require system analysis, laboratory testing and on air vehicle
demonstration and possibility pass and fail criteria.
(TBD)
278
JSSG-2009A
APPENDIX A
A.3.4.1.10.1 Floatation gear.

When an air vehicle is equipped with floatation gear, the gear shall facilitate safe takeoff,
landing, taxiing, towing, and mooring of the air vehicle on the water's surface.
Flotation gear has been used successfully on rotorcraft and other air vehicles, but specialized
landing gear setups have unique performance requirements.
Flotation gear is either fixed position or deployable. Deployable flotation gear should be
capable of automatic inflation after water contact. Considerations to take into account include,
but are not limited to: water buoyancy, drop characteristics, stability and control characteristics
at various sea states, stability and control with rotors turning and at rest, weight and balance
limitations, effects on aerodynamic performance and aeroelastic qualities, water taxi
capabilities, takeoff and landing characteristics with the subsystem installed, validation of
adequate clearance for rotors or propellers at various centers of gravity and various sea states.
The effects of in-flight deployment should be investigated. Also effects on egress should be
investigated.

(TBD)
A.4.4.1.10.1 Floatation gear.

The operational characteristics of the floatation gear shall be verified by analysis and tests.
Some aspects of the floatation gear's behavior can be verified by analysis (weight and balance
limitations, water buoyancy, adequate propeller or rotor clearance) but other aspects should be
demonstrated by actual testing (stability and control characteristics, takeoff and landing
characteristics)
Typical qualification test objectives and measurements are to validate water buoyancy, drop
characteristics, stability and control characteristics at various sea states, stability and control
with rotors turning and at rest, weight and balance limitations, effects on aerodynamic
performance and aeroelastic qualities, water taxi capabilities, takeoff and landing characteristics
with the subsystem installed, validation of adequate clearance for rotors or propellers at various
centers of gravity and various sea states, maintainability, and electromagnetic compatibility if
279
JSSG-2009A
APPENDIX A
the flotation gear is squib activated. The effects of in-flight deployment should be investigated.
Also effects on egress should be investigated. Typically, strain gages should be used to
evaluate structural adequacy of points of attachment. Typical measurements are weight,
buoyancy, drag characteristics, clearance, required power, voltage, stress at attachment points,
and vibration characteristics.

(TBD)
A.3.4.1.10.2 Snow ski gear.

When an air vehicle is equipped with snow skis, the gear shall facilitate safe takeoff, landing,
taxiing, towing, and mooring of the air vehicle on snow.
Snow ski gear has been used successfully on rotorcraft and other air vehicles, but specialized
landing gear setups have unique performance requirements.
Considerations to take into account include, but are not limited to: buoyancy in snow, stability
and control characteristics at various wind conditions, visibility in snow with rotors turning,
weight and balance limitations, effects of aerodynamic performance, taxi capabilities under
various snow conditions, takeoff and landing characteristics with the subsystem installed,
validation of adequate clearance for rotors or propellers at various center of gravity positions,
and effects on in-flight performance.
(TBD)
A.4.4.1.10.2 Snow ski gear.

The operational characteristics of the snow ski gear shall be verified by analysis and tests.
Some aspects of the snow ski gear's behavior can be verified by analysis (footprint areas,
buoyancy in snow, weight and balance limitations) but other aspects should be demonstrated by
actual testing (stability and control characteristics, takeoff and landing characteristics, visibility in
snow with rotors turning).
280
JSSG-2009A
APPENDIX A
Typical qualification test objectives and measurements are to validate footprint areas, buoyancy
in snow, stability and control characteristics at various wind conditions, visibility in snow with
rotors turning, weight and balance limitations, effects of aerodynamic performance and
aeroelastic qualities, taxi capabilities under various snow conditions, takeoff and landing
characteristics with the subsystem installed, validation of adequate clearance for rotors or
propellers at various center of gravity positions, maintainability, and effects on in-flight
performance. Typically, measurements should include weight, footprint area, structural
adequacy of attachment points, vibration characteristics, ground and snow clearances, step
height, and aerodynamic and aeroelastic characteristics.
(TBD)
A.3.4.1.11 COMPONENTS
A.4.4.1.11 COMPONENTS
A.3.4.1.11.1 Tires
A.4.4.1.11.1 Tires
A.3.4.1.11.1.1 Air vehicle tire performance.
The tires shall be capable of performing on the air vehicle for the following: (TBS) .
The objective is to provide a tire capability compatible with the air vehicle operation and
performance for all taxi, turns, takeoff, and landing operations at the critical gross weights and
velocities that do not exceed air vehicle structural or operational limits. The blank should be
filled with an all inclusive performance requirement such as: conditions of maximum air vehicle
takeoff and landing, including all ground maneuvering before and after takeoff and landing.
Emergency conditions should also be considered, such as aborted takeoffs and maximum
landings. If aerodynamic heating exceeds 160°F during flight, this should be considered.
TBS should as a minimum have the following air vehicle performance parameters defined:
a. Tire sizing parameters
281
JSSG-2009A
APPENDIX A
1. Air vehicle configuration - This will tend to dictate the gear geometry and possibly the
decision for a small number of large diameter tires or a large number of small
diameter tires.
2. Flotation - This requirement will tend to dictate tire pressure, gear configuration and
may drive the design of the air vehicle fuselage. If flotation does drive the design,
tire service life problems will be nil.
3. Tire load - This requirement will be dependent upon 1 and 2, above.
4. Growth allowances - This requirement will tend to dictate tire size, if not established
by flotation.
5. Runway considerations - Maximum tire pressure is limited to 300 psi; minimum
footprint area is to be equal to or greater than 50 square inches.
b. Tire design parameters
1. Velocity - This requirement will dictate the tread thickness, and therefore, wear life.
2. Taxi distances and turning requirements - These requirements will tend to design the
tire carcass, bead step-off area, and the shoulder area due to internal heating from
the flexing of the tire.
3. Environmental heating - Aerodynamic heating level, time at high speed, equipment
mass and air flow may be significant parameters for the design. This may dictate
high temperature compounding.
4. Tire slippage - Wheel and tire interface should be designed to present slippage that
could cause loss of air with damage to the tire, tube, valve or wheel.
5. Low temperature - Unless otherwise specified, the low temperature requirement for
the tire compounds should be -65°F.
6. Burst pressure - Tires normally are designed to withstand a burst pressure equal to
3.5 times the maximum operating (rated) inflation pressure. A factor of 4.0 is
sometimes used for low pressure (Less than 150 psi) tires.
This requirement reflects the concept generated in MIL-PRF-5041, AFSC DH 2-1, and
AFSC DH 1-6. This is an Industry accepted practice for military and commercial tire
development.
Unless otherwise specified in the detail specification, tires should be tubeless. When specified,
inner tubes should be in accordance with SAE AS50141.
The tire land based operating pressure should be equivalent to the rated pressure at a tire static
load with a 32 percent (32%) tire deflection.
A tire contour should be selected that provides an aspect ratio above 72 (that is, tire section
height to tire section width) unless exception is authorized by the detail specification.
Nosewheel tire size selection should account for maximum dynamic braking loads in addition to
the maximum air vehicle static load.
282
JSSG-2009A
APPENDIX A
Historically, except for the B-52, tires operated at velocities at or above 250 mph and 250 psi
have relatively poor service life, less than 25 landings per tire. Tires operated at or less than
225 mph and 200 psi have good service life, over 100 landings per tire. Tires inflated at 250 psi
and greater are more susceptible to cuts due to the high stress in the tread compared to a
200 psi tire. Higher inflation pressure also tends to accelerate groove cracking, resulting in
tread failure such as chunking or stripping a tread.
As the speed rating increases, the tread thickness decreases which results in less wear life and
greater susceptibility to cut removal. The cut depth is much more critical as the velocity
increases.
Therefore, when establishing tire operational parameters, strive to limit the adverse effects of
high rotational velocities and high pressures. Flotation and growth requirements will aid in a
good solution to this problem. This requirement should not dictate design of a high performance
air vehicle, such as fighter or interceptor types.
The use of air to inflate main wheel tires, where thermal fuse plugs are used, is not
recommended. Release of the fuse plug will result in discharge of the air on to the hot brake
increasing the probability of fire. Nitrogen is used to inflate most commercial and some military
air vehicle tires.
It is sometimes desirable to mold a ridge in the tire sidewall to deflect water spray or other
debris thrown up by the tire. This ridge is known as a “chine” and such tires are usually called
“chine tires”. The primary use has been to prevent water spray from entering engine inlets.
Chine tires are presently used on F-111 and C-9 air vehicle nose landing gears. Chine tires
should be tailored for each application. Flight-testing is necessary to confirm suitability of
design.
In the past, the maximum allowable braking dynamic load factor were 1.4 and 1.35 for low-
pressure type III tires and for extra high pressure type VII tires, respectively.
A.4.4.1.11.1.1 Air vehicle tire performance.
Takeoff, landing, and taxi performance shall be verified by: (TBS) .
The use of a laboratory dynamometer to evaluate the tire performance characteristics permits
evaluation to the limits of the tire capability with risk. The design conditions are carefully
controlled and are repeatable. The Industry has always utilized this method of evaluation prior
to installation on an air vehicle to determine performance limits and to establish safety of flight.
It is significantly more economic than any other verification method. The tire will also be
observed and evaluated during the routine flight test program.
283
JSSG-2009A
APPENDIX A
TBS should be filled with the air vehicle performance requirements that need to be meet. This
should take into account the static and dynamic loads, speeds and time at loads for worst case
operational conditions, as well as normal operating conditions.
(TBD)
A.3.4.1.11.1.2 Service life.
Tires shall have a service life, due to tread wear only, of not less than (TBS 1) landings.
This shall apply during operation of the air vehicle as follows: (TBS 2) .
The objective is to provide a satisfactory life. Historically, tires of a conventional design, Types
III, VII, and VIII, should provide 50 to 300 cycles (one takeoff and one landing equals one cycle),
dependent on diameter and velocity requirements.
TBS 1 should be filled with a reference to Tire design load-speed-time figure for the air vehicle
application, showing the number of air vehicle cycles required for a given tire diameter and
speed rating range.
TBS 2 should describe the operation during which the life requirement is to be applied.
The performance parameters controlling service life are:

a. Tire diameter establishes thickness
b. Velocity rating of tread
c. Tire pressure due to load - stress in tread rubber
d. Installation.
The source of this criteria is MIL-PRF-5041, supplemented by the AFSC-Ogden ALC Life Cycle
Cost Program. A similar arrangement is a worthy candidate for future programs.
Tire mold skid depth (tread wear prior to removal) should be compatible with current state of the
art for the particular tire size selected.
Tire life is frequently affected by the air vehicle installation. If there is excessive camber or yaw
abnormal tread wear can be generated. Early F-15 air vehicles are an example of this problem.
Obviously, the tire design cannot be held accountable for this performance.
284
JSSG-2009A
APPENDIX A
If the landing gear is designed or modified to cause excessive camber or yaw angle, excessive
tire wear may result.
The need for venting (drilling of vent holes in the side wall of the tire) high performance tires
exists regardless of type of construction to prevent blistering and build up of nitrogen pressure
between the cord layers within the tire.
The service life shall be evaluated on the air vehicle during flight test.
The primary factor in tire service life is tread wear. Laboratory testing does not evaluate this
aspect of tire performance. Therefore, the flight test program is the first opportunity to evaluate
this aspect of the design. The service life evaluation will be continued into Using Command
evaluation to Squadron level. AFMC will further extend this aspect with its wear index tests of
the Life Cycle Cost Program.
The specific operational service spectrum to flown by the air vehicle needs to be agreed to by
both the customer and the manufacturer. Otherwise a Life-Cycle-Cost program will have to be
established to verify the life of the tire.

(TBD)
A.3.4.1.11.1.3 Retread and carcass performance.
The tire carcass shall be capable of (TBS) retreads without degradation of tire structure
performance.
The objective is to provide a tire construction that can be retreaded. This has proven to be cost
effective in the Air Force and particularly on commercial air vehicle where they have retreaded a
single tire as many as nine times.
TBS should be filled with a number for repeated retreads that would be compatible with the tire
performance and life. If the tire life is relatively long on a large diameter slow speed tire, the
aging life of the carcass may limit it to one retread. If the tire is medium in diameter,
34-40 inches and rated in the 225 mph range, it could be retreaded four or five times. A high
speed fighter tire of 28-34 inch diameter could also be retreaded five times, providing the
carcass could not be subjected to high working stress due to inflation pressure of 250 psi or
greater. In this case, only one retread may be cost effective. Performance parameters
controlling retreadability include:
285
JSSG-2009A
APPENDIX A
a. Tire velocity rating

b. Tire pressure rating
c. Tire construction (special requirements)
1. Environmental heating
2. Excessive deflection
3. Exotic designs
4. Age limitations
5. Balancing.
This is a new requirement not currently defined in any general defense specification. It reflects
the current state of the art and has been used on all recent systems in the interest of Life Cycle
Cost.
Reliable retreading is dependent on a sound carcass and sufficient material on the crown of the
tire to prepare the surface properly for a new tread. Providing a sound carcass is dependent on
testing the initial construction through repeated life test on the dynamometer, stripping the tread
and retreading between cycles, and a good inspection of a used carcass prior to retreading.
286
JSSG-2009A
APPENDIX A
A.4.4.1.11.1.3 Retread and carcass performance.
Retreading capability shall be verified by (TBS) .
The retread capability of the carcass, can be verified by requiring the tire to complete all the
dynamic tests of "Air vehicle tire performance" in this appendix, then buff the tread and repeat
the cycle without the heat soak is above 300°F for one hour.
TBS: The tire should be tested to the operational requirements of the original tire to ensure
compatible performance for all air vehicle operational missions.
(TBD)
A.3.4.1.11.1.4 Growth within tire.
In selecting tire sizes, an allowance shall be made for (TBS) growth in air vehicle maximum
design weight within the same size tire.
The objective is to provide a tire with growth potential within the original clearance envelope.
Historically, even in the 1970s era, aircraft continued to grow in gross weight that would
overload original tire capabilities. Whereas, by adding plies, the tire can easily be changed to
carry the extra load within the same envelope.
TBS should be filled with 25 percent (25%) based on past experience.
Performance parameters controlling growth are:

a. Burst pressure
b. Bulk modulus
c. Taxi distances, velocity, and temperature.
This requirement was contained in AFSC DH 1-6 and AFSC DH 2-1. This requirement was
originally generated in the mid 1950’s based on lessons learned with aircraft growth. Since
change in tire size impacts stowage area and airframe sizing, it is considered to be an important
concern.
287
JSSG-2009A
APPENDIX A
A tire ply rating should be selected that is at least two ply ratings less than the maximum
recommended ply rating for any particular tire size.
Most aircraft developed in the last 25 years have grown in gross weight from 10 to 40 percent
(10 to 40%). In many of these instances the landing gears cannot grow accordingly, and
therefore are operated as less than “0” margin. Tires readily lend themselves to easy growth
potential within the original designed envelope by increasing the number of plies. This has been
a very effective method of providing sufficient tire growth on aircraft developed in the late 1960’s
and early 1970’s.
A.4.4.1.11.1.4 Growth within tire.
An analysis shall be performed to show growth potential in the selected tire sizes.
The requirement for tire growth can be verified by analysis of actual plies to ply rating, to
maximum number of plies and maximum ply rating allowed.
A load analysis should be conducted to show that the tire can handle the specified increase in
air vehicle gross weight without having to change tire size, only ply ratings, and load carrying
capability.
(TBD)
A.3.4.1.11.1.5 Multiple tire operation with failures.
For multiple tire gear designs, capacity shall be provided to accommodate (TBS 1) tire
failure(s) without additional tire failure, when operating at all gross weights under the following
conditions:
(TBS 2) .
The objective is to provide tires with the dynamic load carrying capability to withstand an
overload for a short period of time and not cause a catastrophic failure. Should a tire fail during
taxi at maximum gross weight, the other tire(s) on that strut should have the capability to
support the additional dynamic load while taxiing back to an apron or repair area. On takeoff,
the remaining tire(s) should have the capability to support the dynamic load for either aborting or
completion of takeoff, followed by a landing at landplane landing gross weight.
288
JSSG-2009A
APPENDIX A
TBS 1 should be filled with a statement such as; “one” or “fifty percent (50%) of assembly”.
TBS 2 should describe the minimum operation with the failed tire(s).
Performance parameters controlling include:

a. Load rating
b. Ply rating
c. Air vehicle gross weight
d. Center of gravity locations
e. Tire construction
f. Operating spectrum.
Criteria for overload capability factors in tire capacity were previously documented in
AFSC DH 2-1. The requirement, as expressed, is a new requirement defining the conditions of
overload from which the remaining tires are expected to continue to operate. This will allow the
airframe manufacturer to properly develop and demonstrated this overload capability.
Present specifications do not require testing tires to dynamic loads greater than the rated static
load. Nose tires are rated with dynamic load factors ranging from 135 percent (135%) to
150 percent (150%) of the static load rating. The dynamic loads usually are not verified by test.
Development of a tire to withstand a sustained overload, such as excess load due to a mating
flat tire, requires a tire test program simulating this condition. For example, if a tire is required to
operate safely after a mating tire has failed, at least investigate the following:
a. Failure of a tire during taxi out for takeoff will result in an overload on the mating tire(s).
The mating tire should have capability to endure the excess load for taxiing back to a
repair area.
b. Tire failure during takeoff run. The mating tire should have the capability to endure the
excess load for an aborted stop.
A.4.4.1.11.1.5 Multiple tire operation with failures.
Overload capability shall be verified by (TBS) .
Laboratory dynamometer tests provide the opportunity to conduct a controlled test to the
required limits without risk to air vehicle or personnel. It is the most economic approach from a
cost and schedule viewpoint.
289
JSSG-2009A
APPENDIX A
TBS should be filled with analysis and tests.

(TBD)
A.3.4.1.11.2 Wheels
A.4.4.1.11.2 Wheels
A.3.4.1.11.2.1 Air vehicle wheel performance.
The wheel assemblies shall be capable of performing on the air vehicle for the following:
(TBS) .
The purpose of this requirement is to identify the operating conditions that will establish the
design envelope for the main, nose, and auxiliary wheel equipment.
The conditions should account for maximum gross weight usage (taxi and takeoff), design
mission takeoff, landing, and taxi. A spectrum should be generated to simulate the anticipated
load distribution to give the required life. If high brake temperatures are typically encountered
with main wheels, the design spectrum should include this condition. Eccentric loads induced
by installation on the air vehicle or operational usage should be suitably reflected in the
requirements. These will not be known until the design of the installation is complete, but
provisions for such eventualities should be included in the basic requirements. Examples might
be: high frequency pivot, cambered roll, or yawed roll.
TBS should include all ground operation of the air vehicle, in particular worst-case conditions
covering both static and dynamic requirements.
Velocity, wheel material and processing, vertical versus side load, fatigue characteristics,
sustained stress levels, and tire-wheel-axle interfaces have an impact on the ability of the wheel
to meet the required performance requirements. This requirement summarizes the various load
discussions previously stated in legacy documents MIL-W-5013, AFSC DH 1-6, and AFSC
DH 2-1. This is the very backbone of the wheel design requirements. It establishes the static
strength and fatigue requirements for the wheel assemblies.
In the past, the static load capability was established by arbitrary criteria, and the design
conditions were not necessarily associated with actual operating conditions. An example of
problems associated with arbitrary criteria in lieu of rational criteria is the C-141A main wheel. It
was designed and tested to maximum-load Military Specification criteria with an arbitrary
290
JSSG-2009A
APPENDIX A
cambered roll fatigue requirement. On the airplane, with 80° steering available to the pilot, the
landing gear was experiencing numerous full pivots during routine taxi usage. The result was
over 75 wheel flange failures in service. The wheel was redesigned to accommodate this
specific condition of pivot turn. Since the revised wheel has been put into service
(approximately 1970), there have been no further wheel flange failures.
Use of arbitrary criteria does not always drive the designs to structural inadequacy. A recent
example has been the use of .5 g turn for yawed roll criteria in design. This particular condition
has produced numerous laboratory failures which drove redesign of the wheel hub area. There
has never been evidence of field difficulties in this area with the wheels involved. It is suspected
that the criteria is quite conservative and is resulting in heavy hub wheels. Research is planned
by Flight Dynamics Laboratory to measure stress in various wheels for straight yawed roll
versus turn techniques on a dynamometer flywheel to try to resolve this issue.
Another aspect that is some concern is the aspect of corrosion effects in the field as compared
with development testing. Corrosion has a significant impact on inventory life, but current
criteria do not account for this phenomenon. Recent painting technique improvements will
potentially diminish this disparity.
Corrosion effects that occur in the field are not adequately covered during development testing.
Thus, design considerations should be given to improve corrosion protection procedures for the
wheels. Specifically, ensure the wheel bearing seal will protect the bearings from the
environment. (Note that a metal-to-metal interface on the seal is inadequate for this purpose, as
discovered on the B-1 wheel.)
Corrosion is one of the main reasons for retiring aluminum wheel halves. Fatigue cracks start
from corrosion pits in most of the cases. The tire beads wear off the corrosion protection on the
wheel rims.
A.4.4.1.11.2.1 Air vehicle wheel performance.
Laboratory tests shall be conducted to evaluate takeoff, landing, and taxi performance
requirements.
Laboratory tests are recommended because of the versatility in evaluating performance and the
schedule required for development. The laboratory can explore the load envelope and provide
timely answers to the designers and evaluators.
The wheel should be subject to the operational loading that it will experience on the air vehicle
to ensure all mission requirements can be met.
291
JSSG-2009A
APPENDIX A
(TBD)
The wheel service life shall be (TBS) .
From a logistic consideration, an arbitrary average service life should be established for wheels,
consistent with operational needs.
In the past, an arbitrary laboratory life of 1500, 2000, or 2500 miles at rated load or 110 percent
(110%) of air vehicle design limit load on the wheel was selected for design and the service life
achieved was accepted. However, our needs are actually service life, so average field service
life should be specified. The number selected is a function of the type of air vehicle on which it
will be installed and the overall logistic plan. Some air vehicle places premium on lightweight
and the wheel criteria should knowingly reflect this priority. Weight and life are directly related.
Ten thousand service miles for a cargo air vehicle are consistent with airline criteria. Two
thousand service miles for high performance air vehicle wheels seem to reflect the primary
concept of design.
Current airline wheels are designed for 50,000 miles or greater service life.
TBS should reflect a accelerated life performance of 2000 or 2500 mile at 110 percent (110%)
of maximum rated load. This allows a reasonable test program and produces a limited life
wheel.
Maintenance procedures, air vehicle usage, wheel material; and operating technique are major
factors in achieving service life. Wheel fatigue life requirements were contained in MIL-W-5013.
Generally, the roll life requirements were straight roll at an arbitrarily established rated load.
About 15 years ago, commercial and military development requirements were modified to
include typical service abnormalities. This has resulted in improved service performance. In
most cases where frequent service failures occur, the cause can be traced to service induced
conditions which were not accounted for in the development criteria and evaluation. Therefore,
duplication of operating environment in development evaluation is a paramount consideration.
Actual wheel service life is difficult to determine. Ogden Life Cycle Management Center
(LCMC) is attempting to initiate a system to track wheel forging by serial number. Commercial
wheels are traced and tracked. Each major forging is warranted for a given life.
Maintenance has a major role in extending or shortening wheel service life. Bearing and axle
nut installation, handling during tire changes, and tire-wheel inflation technique and diligence
contribute to wheel life.
292
JSSG-2009A
APPENDIX A
Being able to predict a realistic usage spectrum and qualifying to this criteria represents a major
factor in achieving long service life. However, if a wheel qualified to the above accelerated life
spectrum gives a 10 year life expectance, then only 2-3 shipsets of wheels are needed for the
life of the air vehicle, which can be easier and cheaper to maintain than trying to test the wheel
to a long and drawn-out test program.
Wheel flanges are the most frequent source of service failure. Extra attention should be placed
on this portion of the design.
Air vehicle wheels qualified with one type of tire may not be compatible with other types. This
incompatibility may not be limited to radial versus bias construction, but may occur on bias to
bias or radial to radial from different vendors. When qualifying different types of tires for the
same application (bias versus radial), it is strongly recommended that both a strain survey and a
roll test be performed on both types of tires. When an alternate tire supplier is qualifying for the
same application a strain survey should be performed to determine if further roll testing is
needed.
A-10, F-15, F-16 wheels were qualified with one type of tire, when the other type of tire was later
qualified to the same tire requirements, it was found that there was a significant reduction in the
wheel fatigue life. Analysis should only be used to design and to obtain confidence that the
component will pass the test.
Service life of wheels shall be verified by (TBS) .
Dynamometer roll test is the most economical and reasonable means of demonstrating service
life. The loads and environment are carefully controlled and permit a more formal analysis of
results.
TBS should show verification by analysis and laboratory testing.
When a second source for tires is qualified the requirement for additional strain and roll testing
is not the tire manufacturer responsibility, but belongs to the prime airframer or governments
responsibility; the procurement contracts should reflect this.
The latest wheel roll tests include combined load roll tests with the side load inputted by a
yawed roll. Cambered roll does not produce a side load and a dynamometer.
Service life can best be determined by a properly structured experimental stress analysis using
strain gages. Production tire configurations are an absolute must.
293
JSSG-2009A
APPENDIX A
A.3.4.1.11.2.3 Brake overheat capability.
Protection shall be provided to the wheel from brake heat to prevent (TBS 1) after exposure
to (TBS 2) energy.
The purpose of this requirement is to establish performance requirements for heat dissipation.
The potential detrimental effects to wheels and tires include wheel or tire explosion due to
degradation in strength of either unit, or increase in tire pressure causing overstress. Solutions
to these problems include wheel heat shields, and wheel fuse plugs.
TBS 1 should reflect no destructive degradation should occur to the wheel.
TBS 2 should reflect the emergency energy level associated with maximum landing weight
landing, which is the highest energy from which you could expect a serviceable assembly.
Peak brake heat sink temperature, thermal conductivity properties of material, effectiveness of
heat shields, and fuse plug eutectic are parameters affecting this requirement. Performance
requirements similar to this statement on heat dissipation are contained in legacy documents
MIL-W-5013, AFSC DH 1-6, and AFSC DH 2-1. Direct requirements for fuse plugs are
contained in MIL-W-5013. The requirement reflects design approaches originally developed for
commercial air vehicle but currently accepted as standard design practice for the military brake
industry. The first fuse plugs were introduced around 1957.
Caution should be taken in designing the fuse plug installation to minimize stress risers. If the
plug is screwed into the wheel well, extra precautions should be taken with the threads.
The fuse plugs should be located directly within the heat path from the brake to insure an
environment similar to that being seen at the tire bead seat. Since this is the area that suffers
degradation due to heat, the fuse plug should accurately reflect the environment.
Heat shields can cause structural damage to the wheel forging upon installation by inflicting a
scratch. Care should be taken to insure relatively simple installation. Heat shield retention has
been a difficult problem to solve on many wheel designs.
All sharp edges should be eliminated from heat shields.
A.4.4.1.11.2.3 Brake overheat capability.
Wheel overheat capability shall be verified by (TBS) .
294
JSSG-2009A
APPENDIX A
The laboratory provides the opportunity to explore the total design envelope. Under laboratory
conditions, the energy input and other important factors can be controlled and will generally
provide a better evaluation than on the air vehicle. Of course, flight test observations will also
contribute to the overall assessment of design adequacy for the assembly.
TBS should be filled with analysis and laboratory testing.
(TBD)
A.3.4.1.11.2.4 Nonfrangability criteria (flat tire operation).
Each wheel, with a flat tire, shall be (TBS) .
This requirement is to provide a wheel that can roll on its rim without coming apart and
damaging the air vehicle. This capability is called non-frangibility.
The roll-on-rim requirement of TSO C26c all but eliminated the flange failure mode on
commercial airliners. This area should be carefully investigated in the development stage using
strain gage techniques. Flange fatigue lives should be several times that of the area selected
as the failure point. Failure point is normally selected for its non-explosive pressure release
when a through crack develops.
TBS should be filled with: “capable of performing one maximum weight landing touchdown and
rollout without failure; reuse of the wheel is not required.”
(TBD)
A.4.4.1.11.2.4 Nonfrangability criteria (flat tire operation).
Flat Tire operation shall be verified by (TBS) .
The verification of the non-frangibilty of the wheel is usually demonstrated during laboratory
testing and is usually one of the last tests since the wheel is unusable after the test.
295
JSSG-2009A
APPENDIX A
TBS should be filled in with analysis and laboratory testing to the required load-time curves.
The wheel is not to come apart, and not to fragment in any way.
Consider the TSO C26c roll-on-rim test method. This method does not use a tire, for it is
believed that a tire will scatter the results over an unacceptable range.
A.3.4.1.11.2.5 Bias and radial tire compatibility.
Wheels shall be compatible with (TBS) .
This requirement is to ensure that wheel life and strength is not lesson or less than what is
required for mission operation, when radial or bias tires or when different bearings or brake
manufacturers are used.
TBS should be filled with: “ bias and radial ply tire designs, brakes, bearings, and axles with
respect to life, loads, corrosion, lubrication, sealing, and thermal protection.”
Wheel that have been qualified with either bias or radial tire designs only have consistently
shown shorter service life when the other tire type is used on it. Thus the need to qualify both
tire types if the possibility of both type of tires being used on the air vehicle.
A.4.4.1.11.2.5 Bias and radial tire compatibility.
Bias and radial tire compatibility shall be verified by (TBS) .
The life capability of the wheel will be determined by analysis and wheel stress testing and roll
testing with all qualified parts intended to be used in air vehicle operations.
TBS should be filled with: “ analysis and laboratory wheel and tire qualification testing.” The
testing and analysis should reflect the use of both types of tires if the program intends to allow
both types of tires. If different bearings or brakes are to be used the same sets of analysis and
testing should be accomplished.
296
JSSG-2009A
APPENDIX A
(TBD)
A.3.4.1.11.2.6 Pressure-release criteria.
Braked wheels shall have (TBS) .
This requirement is to provide protection from wheel and tire explosions due to
overpressurization and to over heat protection. The device(s) should release tire pressure
before critical failure conditions occur.
TBS should be filled with: Protection to prevent wheel or tire explosion due to high pressure or
high temperature conditions. Braked wheel should provide a safe method of automatically
releasing tire pressure whenever brake energies exceed maximum landing stop conditions. The
device should not release at any time during or after a maximum design energy stop as
specified for mission operations regardless of brake wear state. The device should not release
during any Rejected Takeoff (RTO) stop, but may release after the air vehicle has come to a
stop, but should release before the wheel and tire strength is compromised.
There has been loss of life from wheel and tire failures where protection was not provided, or
malfunctioned.
A.4.4.1.11.2.6 Pressure-release criteria.
The pressure release capability shall be verified by (TBS) .
The verification effort should show that the pressure release devices would release the pressure
before any dangerous overpressurization occurs, nor when the strength of the wheel is
compromised by over heat due to brake energy inputs.
TBS should be filled in with: “analysis and laboratory testing.” The analysis should take into
account both thermal as well as strength considerations. The analysis should be compatible
with the testing accomplished on the wheel, brake and tire assembly.
Temperature release devices come in only incremental values, thus the location and shielding
of the devices are critical to ensure that they will release before the wheel softens enough to fail.
297
JSSG-2009A
APPENDIX A
Usually several high energy stops must be performed to determine the suitability of the
particular release device and location thereof. Normally several of these devices are need on
the wheel since heat rises thus the upper portion of the wheel will be hotter sooner thus one of
the devices needs to be in the upper region at all times.
A.3.4.1.11.3 Brakes
A.4.4.1.11.3 Brakes
A.3.4.1.11.3.1 Air vehicle stopping and turn-around performance.
Brake assemblies used to provide any portion of the air vehicle stopping performance shall have
the following characteristics: (TBS) .
This requirement is to define acceptable performance of conventional brake assemblies should

the contractor elect to use this approach to provide stopping performance. Requirements
should be in the form of success criteria that are unique to the brake assembly and its
installation when the brake is used to provide any part of the stopping performance.
TBS should be filled in with the expected air vehicle stopping performance need to satisfy the
missions.
The requirement will usually be complex in that several aspects of “success” need to be
considered. Brake performance criteria may be different for the different stopping conditions
specified in air vehicle specification. Requirements to be considered should be selected from
the following performance parameters and modified as necessary to clearly indicate the
applicable stopping performance.
The following success criteria should be considered in completion of this requirement.

a. There should be no structural failure of the brake assembly during any single stop within
the design envelope. This condition does not apply for abuse or usage outside of
recommended operating limits.
b. The required stopping performance should be provided at any time during the specified
operational life of the brake.
c. After initial installation, it should not be necessary to perform manual adjustment of the
brake to permit the stopping performance to be met.
d. Brakes should not squeal, chatter, or cause any vibration during the stop that results in
malfunction or reduces the life of any air vehicle component.
e. Brakes should not cause heating of any air vehicle component that causes component
malfunction prior to attainment of required life.
298
JSSG-2009A
APPENDIX A
f. Brakes should release upon release of the normal brake control during and after the
stop.
g. No damage to the air vehicle, including rolling components, except wear of brake friction
surfaces and ground-contacting elements should result from stopping.
h. Prevention of structural overload due to braking should not be dependent upon pilot
proficiency.
i. Overheating of brake assemblies due to malfunction or abuse should be indicated by
j. The wheel brakes should be adequate for a rapid “turn around” or “park” time of no
greater than the time required for refueling operation or no greater than 15 minutes.
Most of the suggested brake criteria were previously stated or implied in MIL-W-5013.
A very large percentage of these failures were brake disc failures. Most generally, these
failures are not necessarily design failures, but are induced by improper production processing.
Another potential cause of brake disc failure is excessive heat input. If dragging or some other
operational input abuses a brake, the structural integrity can be compromised. However, design
assessment under controlled conditions should give some measure of capability and potentially
a measure of tolerable abuse.
Brake chatter is the frictional or mechanical excitation of the landing gear fore and aft vibrational
mode. It is generally caused by negative damping from the friction pair and usually has a critical
speed range.
Brake chatter should be defined as brake vibration in the 50 to 100 Hz range. Since gear walk
is normally in the 5 to 15 Hz range, brake chatter does not cause gear walk. Gear walk is much
more complicated than implied by this section. Brake squeal is defined as greater than 100 Hz.
Gear walk is a complicated interaction of the airframe structure, brake control system, and
dynamic characteristics of all concerned.
Brake housing designs should avoid using a direst part of the housing as a dynamic grease seal
rub surface unless it is adequately hardened or protected against wear.
Brake squeal is the induced vibration of the stationary parts of the brake assembly and its
mounting. It generally has a natural frequency of several hundred cps as compared to chatter
frequency of 6-25 cps.
Brake chatter has been so severe that gear walk was induced on the F-101 and F-105 air
vehicles. There are numerous design changes within the brake that can control this
compatibility. The most effective change is with the lining rubbing surface materials. The
stiffness of some of the structural members controls the response to squeal. Squeal has been
so intense on brakes that it has resulted in structural failure. Extensive flight-testing was
required on the B-52, KC-135, F-100 and F-101 to evaluate the gear vibration. Recent designs
have been “tailored” to the application by establishing response characteristics of the system
prior to finalized hardware design. Testing has been modified to evaluate the brake-mounting
compatibility prior to installation on the air vehicle.
299
JSSG-2009A
APPENDIX A
Peaks in brake torque are generally experienced as a result of various loading conditions. For
instance, with steel brakes there is a high probability of brake chatter and peak torque at the low
speed end of a normal energy stop. This is particularly true with a brake that is substantially
worn. Peak torques are also experienced with very high-energy stops as the lining material
reaches a point of maximum heat and wear. Most steel brakes produce very high torque, with
maximum pressure applied from 30 to 0 knots. This occurs whether the assembly is cold or hot.
It is experienced during taxi-out and taxi-in.
Temperature distribution within the brake and to the surrounding structure is a major factor in
the success of a given brake design. Improper balance can produce hot spots in the hydraulic
actuation section and contribute to seal deterioration and ultimately to leaks. It can produce
excessive disk warpage. It can produce damage to the tire bead through the wheel assembly.
Ventilation and elimination of conductive and convective heat is a major concern for assembly
design. The problem of distribution is significantly increased with introduction of carbon brake
discs. They may be lighter, but they do operate at a significantly higher temperature. Beryllium
brake discs operate at significantly lower temperatures than steel or carbon brakes.
Overheating of brake assemblies may be encountered in operational use due to malfunction or

abuse. A combination of low energy stops or a dragging brake may result in gradual
temperature buildup that will negate normal safety devices or cause fires. Consideration should
be given to detection of this condition and design to minimize damage caused by inadvertent
overheating of the brake assembly. Several methods of temperature detection have been
conceived and tried without overwhelming success. We have tried “TEMP-STICKS”, which are
heat sensitive devices that melt at a prescribed value. Maintenance personnel place these units
in direct contact with the hot brake to try to ascertain current temperatures. They read fairly
reliably, but it is dangerous to place personnel in such close proximity to an overheated brake.
The use of “Temp Sticks” on carbon has proven to serve as an oxidation catalyst on the F-16
carbon pressure plated when applied. Temp Sticks should not be used on carbon heat sinks.
Brake temperature sensors and indicators have been used on some air vehicles. Sensors may
be mounted either directly in the brake assembly or in the wheel well. Reliability and
maintainability problems may be severe due to the severe operating environment. Current use
of this system in Air Force air vehicles is limited to the B-1 and C-9A. A system was installed on
C-133 air vehicles but removed in operational use due to maintainability problem. Brake
temperature monitoring system have been developed and used in several commercial air
vehicles.
Life of adjacent components can be severely degraded due to high operating temperatures, or
to reduction in material strength due to long term heat exposure. This softening effect has lead
to early removal of components from service. The requirements should establish the
temperature limits of surrounding components that are not to be exceeded during normal
operation of the braking system.
Load deflection characteristics have an impact on design and service performance. If the
assembly is too flexible, the torque radius drops and uneven wear and higher operating
pressure result. Excessive deflection can also introduce eccentric or non-uniform loading into
the brake structural members. The potential results of this can be premature failure in the field.
300
JSSG-2009A
APPENDIX A
Often the source of yield failure is warpage and dimensional instability. Slots open-up or close
depending on the type service experienced or the temperature-time history of the part. This is
why the development cycle should contain as many evaluations of actual service as possible.
Carbon brake discs have a much lower tolerance to abnormal loading. For example, they are
incapable of supporting axial loads inadvertently transmitted through wheel deflections. The
torsional loads should be properly directed to avoid localized structural failure. Axial deflections
of the heat sink should be minimized to prevent degradation since the individual discs have low
rigidity in response to loads in that direction.
Performance of some wheel brake systems with anti-skid control is severely degraded as the
brake wears. This is because of the increase in volume of brake actuation fluid that must be
moved for each skid cycle. Manual adjustment can be used to compensate for brake wear,
however, most present day high performance air vehicles use automatic brake adjusters.
Present tires, wheels and brakes are subject to damage when subjected to greater than
maximum design landing energy. It is an accepted practice to replace these components after
refused takeoffs stop with greater than maximum landing energy. Replacement of other landing
gear components after any refused takeoff stop (up to design RTO energy) is unacceptable due
to the high cost of components.
Normally the landing gear is designed to withstand a limit drag load resulting from an effective
peak brake coefficient of 0.8. In some cases, particularly in growth versions of an air vehicle,
this coefficient is reduced. If less than 0.8 is used, a test should be accomplished to verify that
peak brake torque does not result in excessive drag load. It may be necessary to limit brake
torque to provide a compatible landing gear subsystem. If maximum torque is limited, refused
takeoff stopping performance is degraded.
Be careful to associate the maximum wheel static load and the tire static loaded radius at
maximum wheel static load if the 0.8 wheel drag force is to be used to calculate peak to peak
torque requirement. The 0.8 is not a brake coefficient, but a tire to ground coefficient of friction.
A.4.4.1.11.3.1 Air vehicle stopping and turn-around performance.
Brake durability, operating characteristics and compatibility with interfacing subsystem such as
(TBS 1) shall be evaluated by (TBS 2) .
Brake evaluation will normally consist of laboratory and flight testing. In so far as possible,
verification should be by air vehicle stopping tests. Performance is likely to be highly dependent
upon characteristics of the air vehicle and environment that are difficult to simulate
simultaneously in the laboratory. Some extreme conditions such as maximum and minimum
temperature can be duplicated only in the laboratory. Some extreme operating conditions may
also be too hazardous for air vehicle test. The requirement should clearly indicate
characteristics to be evaluated by air vehicle test because this can be significant cost and
schedule driver.
301
JSSG-2009A
APPENDIX A
TBS 1 should reflect the various subsystems that are to be tested together to verify the stopping
performance of the air vehicle.
TBS 2 should be filled with; “analysis, laboratory, and air vehicle testing.” The laboratory testing
is to evaluate maximum performance envelops. The flight testing is to verify that the analysis
and laboratory test accurately demonstrated the stopping performance of the air vehicle is as
published in the flight handbooks.
Brake failure modes experienced in the laboratory may have little correlation with failure modes
on the air vehicle because of poor simulation of air vehicle operation. Modification of the brake
to eliminate laboratory failure modes may induce additional failure modes on the air vehicle. An
example is that large drive key clearances may result in severe battering damage to brake disc
keyways. Reduction of the clearance to eliminate the problem can lead to severe dragging
brake problems on the air vehicle. This is primarily due to the fact that the actual loading cycle
on the air vehicle is quite different than the accelerated life test usually used in the laboratory.
Verification requirements should be structured to insure that performance on the air vehicle is
the final success criterion. Laboratory test failures should not be ignored; however, laboratory
successes are of no value to the operational Air Force.
Consideration can be given to allow structural failure or gross deformation of the brake
assembly during a RTO if the stopping performance is satisfied.
A.3.4.1.11.3.2 Wear indicator and servicing criteria.
Means shall be provided to determine current status of brake wear without disassembly or the
use of special tools.
This is an expression of an operational need to be able to determine status of brake wear during
a pre-flight inspection or after any given flight. Rather than dictate wear pins for measurement,
the designer is free to develop any means which will provide this inspection capability,
consistent with his overall maintainability plan.
Mechanical design of the brake, friction wear characteristics of the discs or lining material, and
maximum permissible wear have marked influence on the ability to accurately display current
wear status of the brake assembly.
This item was previously expressed in MIL-W-5013, calling specifically for “brake lining wear
indicators”. This requirement has been established from operational lessons learned, and
generally expresses the desires of most Using Commands.
302
JSSG-2009A
APPENDIX A
The details of attachment of wear indicators generally control the adequacy of the design. The
problems encountered include improper use of frictional mechanical devices, which do not “pull
through” to give an accurate assessment of brake disk wear. Other mechanical designs have
encountered eccentric loadings and resulted in broken parts. There have been designs that
utilize the mechanism of the automatic brake loadings. Frequently, design reliability is low due
to exposure to this hostile environment.
Wear indicators should be readily observed and generally simple in design to provide a reliable
indication of wear. Little or no interpretation should be required to assess the state of disk wear.
Some degree of protection should be provided if the indicator extends beyond a reading surface
to prevent damage due to foreign object impact.
A.4.4.1.11.3.2 Wear indicator and servicing criteria.
Brake wear indications and servicing suitability shall be verified by (TBS) .
Brake evaluation will normally consist of laboratory and flight testing. In so far as possible,
verification should be by air vehicle stopping tests. Performance is likely to be highly dependent
upon characteristics of the air vehicle and environment that are difficult to simulate
simultaneously in the laboratory. Some extreme conditions such as maximum and minimum
temperature can be duplicated only in the laboratory. Some extreme operating conditions may
also be too hazardous for air vehicle test. The requirement should clearly indicate
characteristics to be evaluated by air vehicle test because this can be a significant cost and
schedule driver.
TBS should be filled with: “laboratory testing and on air vehicle demonstration.”
Brake failure modes experienced in the laboratory may have little correlation with failure modes
on the air vehicle because of poor simulation of air vehicle operation. Modification of the brake
to eliminate laboratory failure modes may induce additional failure modes on the air vehicle. An
example is that large drive key clearances may result in severe battering damage to brake disc
keyways. Reduction of the clearance to eliminate the problem can lead to severe dragging
brake problems on the air vehicle. This is primarily due to the fact that the actual loading cycle
on the air vehicle is quite different than the accelerated life test usually used in the laboratory.
Verification requirements should be structured to insure that performance on the air vehicle is
the final success criterion. Laboratory test failures should not be ignored; however, laboratory
successes are of no value to the operational Air Force.
303
JSSG-2009A
APPENDIX A
A.3.4.1.11.3.3 Structural failure criteria.
Structural failure of the brake during normal, emergency or parking operation shall not result in
(TBS) .
The intention of the requirement is to define the unacceptable modes of failure for the brake
assembly. If the design can tolerate minor discrepancies, strict adherence to no crack
philosophy may be an unnecessary cost driver. It is our intention to define unacceptable
results.
TBS should reflect unacceptable consequences of failure, such as locking, piston over-
extension, pieces of disc inducing locked wheel or structural failure of the wheel, deformation of
the piston, bushing, or housing due to high operating pressures when the brakes are hot.
Maximum surface and heat sink temperature, heat sink materials, lug loadings, peak torques,
and running clearances provide technical influence in meeting this requirement.
MIL-W-5013 contains a very superficial discussion of brake disc failure in section 4, which is
inadequate to evaluate performance in the field. Therefore, this requirement is basically a new
requirement to reflect all the lessons learned in maintenance and safety.
Brake disintegration can be the cause of serious accidents and potential fires.
A design approach, which has been used successfully to prevent fires as a result of brake disc
failure, is to use actuation piston stops. The stops prevent the pistons from being pushed from
the housing and subsequent flooding of the brake with hydraulic fluid from the open ports.
Carbon disk brakes are more susceptible to disk disintegration than steel discs due to the lack
of strength when loaded axially. Extra precaution should be taken with this type of design to
insure piston retention and fire prevention. Carbon brake discs generally are operated at higher
temperatures than its steel brake counterparts.
The wheel to brake interface (wheel keys and brake clips) is critical, a number of carbon disc
have been broken or cracked because of interference or brake dynamics in this area. Insure
sufficient clearance is maintained at all loadings and the interface design is a proven concept.
A.4.4.1.11.3.3 Structural failure criteria.
Structural capacity of brake components shall be evaluated by test and analysis and the wheel
lock-up range at various speeds on different surfaces shall be evaluated by analysis.
304
JSSG-2009A
APPENDIX A
Theoretical response to numerous modes of failure can be considerably more comprehensive

than that which could be evaluated by test. Limited testing can be used to evaluate and validate
the failure mode analysis.
The analysis should look at all possible brake failure modes and ensure the air vehicle is not
compromised, and will not produce a catastrophic failure. The testing accomplished on the
braking system should verify the safety design features are working as expected, and where
relief devices are used they release as designed. Piston retention features should be
demonstrated.
Numerous brake fires have been experienced due to expansion and deformation of brake
components such as bushings, pistons, and housings from the high temperatures of the brakes.
The result is leaking hydraulic fluid on the hot brake stack. Therefore, the verification should
demonstrate that the brake assemblies are protected from the heat, or the components should
operate normally without failure within the heat environment experienced throughout the air
vehicle operating range.
A.3.4.1.11.3.4 Secondary braking capability (fail-safe).
(TBS) failure of the brake control system shall not result in a total loss of air vehicle braking
capability.
Objective is to define whether single or dual failures will be permitted before loss of control. If
the redundancy of dual failure concepts is significant cost drivers, the program management will
have to determine what level of risk they are willing to take. The user should commit their
feelings on this matter. The blank should indicate “single” or “dual”.
TBS should list the number of failures that can occur and still not lose air vehicle braking and
should indicate whether or not 100 percent (100%) braking capability of alternate braking
systems is available.
Brake system design, redundancy, and reliability are key words in arriving at a decision for this
requirement.
This requirement was previously contained in AFSC DH 2-1 and the intent is to clarify what is or
is not acceptable performance for the brake system. It establishes the degree of redundancy,
which is required. There is an obvious price to pay for double redundancy, but if the Using
Command desires such features, the airframe manufacturer should be notified in advance so
that the requirement is clear to all competitors during Source Selection.
305
JSSG-2009A
APPENDIX A
The AFSC DH 2-1 contains a requirement just for single failure, but this “tailorable” requirement
presents an option to increase the redundancy if the system needs the capability. Under no
circumstances should a single failure in a hydraulic, electrical, or mechanical component of the
normal braking system cause degradation of the emergency system capabilities.
The sources of failure that impact the ability of the system to maintain control are numerous.
Failures may occur in the actuation system (hydraulic, pneumatic, or mechanical), the brake
assembly, the pedal linkage, or the tire.
In one case, an electrical connector became disconnected and caused both the normal and
emergency system to become inoperable. Do not route normal and emergency systems
through the same connectors.
A.4.4.1.11.3.4 Secondary braking capability (fail-safe).
The effect of component malfunctions shall be evaluated by (TBS) .
Options available for this verification include simulator demonstrations, flight test, or analysis.
Depending on the complexity of the system, the availability of the simulator, and experience
level of the proposed contractors, the blank should be completed. It is also a function of
economics, since each approach has associated costs. Technically, the simulator in
conjunction with an analysis is most desirable because the interfaces can be evaluated and the
conditions can be controlled.
TBS should reflect analysis and laboratory simulations and brake control system testing.
(TBD)
A.3.4.1.11.3.5 Fire prevention criteria.
Setting the parking or holding brake immediately after (TBS 1) stop conditions shall not
cause damage to the brake, landing gear, or other air vehicle equipment. Brake fluid
temperatures shall not exceed (TBS) °F at any time after any design-landing stop, or up to
fuse plug release conditions.
Due to the high temperatures that can occur within the brake, the rest of the brake, seals and
fluid needs to be protected from over temperatures that would degrade the seals, or cause fluid
to escape on to the hot brake surfaces resulting in fire.
306
JSSG-2009A
APPENDIX A
TBS 1 should reflect the number of high-energy stop conditions that the brake system can
experience in service. The maximum landing or stopping conditions.
TBS 2 is the maximum operation temperatures for the hydraulic fluid and seals used in the
system. Typically, the values is 275°F. However, a number of fighters have raised the
temperature limits up to 350°F and higher as long as test prove that the brake assembly can
successfully operate at these elevated temperatures without any system equipment
degradations.
F-16 brake system experienced a number of brake fires after the parking brake was set at the
end of operational missions. Found that their was a direct heat flow path to the brake seals,
which cause them to deteriorate allowing fluid to escape on the brake resulting in a self-feeding
fire. Solved the problem by providing insulators between the piston and the brake stack.
A.4.4.1.11.3.5 Fire prevention criteria.
Fire prevention shall be verified by (TBS) .
The brake system design should take into account the heat generated in the heat sink and
determine the heat flow and provide protection from over heat to those components not able to
withstand the high heat.
TBS should be filled in with: “...analysis and laboratory demonstration of the brake system at the
design energies.”
(TBD)
A.3.4.1.11.3.6 Refurbishment criteria.
Provisions for brake friction members to be refurbished or the use of spacers after initial stack
wearout shall be incorporated to provide cost effective wear life extension. The refurbished
brakes shall be capable of all requirements herein.
Some heat sink material is quite expensive, yet structurally sound even though the stack has
used its initial service life. It has been shown that the worn stack can be rebuilt either
mechanically of by reprocessing to have nearly the initial life capability and meet all the
performance requirements of the air vehicle for fraction of the cost of a new brake heat stack.
307
JSSG-2009A
APPENDIX A
Cost effectiveness of using refurbished brakes or use of a spacer disc in the heat stack to
extend brake wear life needs to stated, so the initial design can take this requirement into
account. The cost of refurbishment or of a additional spacer has to be balanced against the
expect air vehicle life and the number of landing and stopping cycles.
There are a number of air vehicles that are using spacers or having their brake heat sinks
refurbished at a great savings over buying new heat stacks.
The use of spacers and refurbished heat sinks should be carefully investigated for their effect on
the new and worn brake RTO capability. Thermal constraints defined using the original
equipment heat sink may not be appropriate for spacers or refurbished configurations.
A.4.4.1.11.3.6 Refurbishment criteria.
The use of refurbishment shall be verified by (TBS) .
The spacer and or refurbished brake stack needs to be tested to the initial design requirements
to ensure that there is not compromise to air vehicle performance.
TBS should reflect all the testing that qualifies the airworthiness of the refurbished equipment to
the original equipment testing.
(TBD)
A.3.4.1.11.3.7 Temperature interface criteria.
Temperature interface between the brake heat sink and surrounding equipment shall be
(TBS) .
Typically the material used in the equipment around carbon heat sinks have temperature-
operating limits much lower than the capability of the heat sinks. Need to ensure that none of
the surrounding equipment is degraded due to high heat and heat soak.
308
JSSG-2009A
APPENDIX A
TBS should be filled in with the temperature limits of each material temperature limits.
The tires, wheels, and brake housing, plus axles and wheel bearings should be able to operate
without degradation for all normal brake operation up to RTO operations.
A.4.4.1.11.3.7 Temperature interface criteria.
The temperature interface limits shall be verified by (TBS) .
The brake qualification testing at all energy levels should record equipment temperatures for all
the test conditions. The temperature levels are not to exceed the capability of each item to
continue to operate as designed, apart from the RTO energy level.
TBS should be filled in with laboratory testing at al the brake design energy levels.
(TBD)
A.3.4.1.11.3.8 Service life and replacement criteria.
Service life of the arresting hook shall be (TBS 1) without replacement of components
except
(TBS 2) .
This requirement is to establish the minimum service life of the arresting hook system. The
requirement should recognize that the hook point or shoe is subject to severe wear and may
need to be replaced at some interval less than the life of the system.
TBS 1: Service life should be determined by analysis of the air vehicle mission and arrestment
concepts. If no study results are available, it is suggested that a service life of 1000 landing
engagements without replacement of components.
TBS 2: Ground-contacting elements may be replaced after each 15 landing engagements be

used.
309
JSSG-2009A
APPENDIX A
Hook point wear characteristics, attachment fatigue characteristics, shank design and load
levels, and hook materials, are parameters influencing the ability to meet this requirement.
This is a new requirement. MIL-A-83136 required a replaceable hook point.
“Weak link” theory should be considered in design of an arresting hook system. Inadvertent
overload is frequently a possibility due to the hostile environment in which the hook is loaded.
Frequently, the most severe loads are dynamically applied, and these are the most difficult to
calculate. Therefore, attachment structure is extremely critical for capacity and life. Attachment
is usually integral with the structure or bulkhead of the fuselage.
Obviously, the hook life will be very low if the hook shank and hook point are integral. If life over
15 landings is desired, the hook point should be separate from the shank to minimize
replacement cost.
The F-111/FB-111 hook shank and point were integral. During category II testing, the average
life for FB-111 hook was 6 or 7 landings. The F-111A average life was 10-12 landings. These
are considered to be economically high. The replacement hook cost was $3,200.00 in 1966.
A.4.4.1.11.3.8 Service life and replacement criteria.
Service life of the hook shall be evaluated by laboratory tests for fatigue life and air vehicle tests
for durability.
The environment, load level, and load orientation can best be controlled in a laboratory.
Therefore, lab tests with airplane certified loads produces the best combination for accurate
verification. The cost of a laboratory test is significantly lower than airplane tests.
Service life of the hook system should be accomplished by analysis and laboratory testing.
(TBD)
310
JSSG-2009A
APPENDIX A
A.3.4.1.11.3.9 Drag chute service life.
Deceleration drag chutes shall (TBS) .
The life of the drag chute should be depended on the number of expected operations, and how
often it should be replaced.
TBS should reflect the life requirements for deceleration operations and environmental
conditions.
(TBD)
A.4.4.1.11.3.9 Drag chute service life.
Drag chute service life shall be verified by (TBS) .
Life capability should be demonstrated and proven to last the require number of deployments.
TBS should specify the analysis, demonstrations and air vehicle testing.
(TBD)
311
JSSG-2009A
APPENDIX A
A.5 PACKAGING
A.5.1 Packaging
service's system commands. Packaging data retrieval is available from the managing Military
Department’s or Defense Agency's automated packaging files, CD-ROM products, or by
A.6 NOTES
not mandatory.)
A.6.1 Intended use.

The landing subsystem descriptions in this appendix are intended for use in air vehicle systems
developed to perform combat and combat-support missions in environments unique to military
weapon systems.
A.6.2 Acquisition requirements.

b. Title, number, and date of the specification.
A.6.3 Acronyms.
The following list contains the acronyms/abbreviations contained within this appendix.
AGE Aerospace Ground Equipment
AMST Advanced Medium Short Take Off and Landing Transport
CAD/CAM Computer Aided Design / Computer Aided Manufacturing
CBR California Bearing Ratio
GVT Ground Vibration Test
HIAD Handbook of Information for Aircraft Designers
LCN Load Classification Number
MLG Main Landing Gear
312
JSSG-2009A
APPENDIX A
RRR Rapid Runway Repair

RTO Rejected Takeoff
VTOL Vertical Takeoff and Landing
WOW Weight On Wheels
A.6.4 Subject term (key word) listing.

Actuation
Arresting hook
Brake
Drag chute
Fire prevention
Flotation gear
Nose wheel
Restraint
Ski jump
Skid
Steering
Tires
Wheel
A.6.5 International standardization agreement implementation.
This specification implements STANAG 3098, Aircraft Jacking; STANAG 3209, Tyre Valve
Couplings; and STANAG 3278, Aircraft Towing Attachments and Devices. When amendment,
revision, or cancellation of this specification is proposed, the preparing activity must coordinate
the action with the U.S. National Point of Contact for the international standardization
agreements, as identified in the ASSIST database at https://assist.dla.mil/online/start.
A.6.6 Responsible engineering office.
The office responsible for the development and technical maintenance of this appendix is
information on this appendix can be obtained from AFLCMC/ENRS, 2145 MONAHAN WAY,
WRIGHT-PATTERSON AFB OH 45433-7017 USA; DSN 674-5476; COMMERCIAL (937) 904-
5476; AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.
313
JSSG-2009A
APPENDIX A
A.6.7 Changes from previous issue.
314
JSSG-2009A
APPENDIX B
APPENDIX B
AIR VEHICLE HYDRAULIC POWER SUBSYSTEM
B.1 SCOPE
B.1.1 Scope.
information for the Hydraulic Power Subsystem provided for in Part 1 of this specification. The
appendix has been developed and coordinated by technical personnel from the Air Force, Navy,
and Army and has been approved as an official guide for use by Government personnel for
B.1.2 Structure.
B.1.3 Appendix.
B.1.4 Deviations.
315
JSSG-2009A
APPENDIX B
B.1.5 Environmental impact.
B.1.6 Responsible engineering office.
B.2 APPLICABLE DOCUMENTS

B.2.1 General.
they are listed.
B.2.2 Government documents
B.2.2.1 Specifications, standards, and handbooks.


MIL-DTL-5498 Accumulators, Hydraulic, Cylindrical, 3000 PSI, Aircraft
MIL-PRF-6083 Hydraulic Fluid, Petroleum Base, for Preservation and Operation
316
JSSG-2009A
APPENDIX B
MIL-F-8815 Filter and Filter Elements, Fluid Pressure, Hydraulic Line, 15 Micron
Absolute and 5 Micron Absolute, Type II Systems; General Specification
MIL-PRF-46170 Hydraulic Fluid, Ruse Inhibited, Fire Resistant, Synthetic Hydrocarbon
Base, NATO Code No. H-544
MIL-PRF-83282 Hydraulic Fluid, Fire Resistant, Synthetic Hydrocarbon Base, Metric,
NATO Code Number H-537
MIL-PRF-87257 Hydraulic Fluid, Fire Resistant; Low Temperature, Synthetic Hydrocarbon
Base, Aircraft and Missile
MIL-STD-5522 Test Procedure for Aircraft Hydraulic and Pneumatic Systems, General
19111-5094 USA.)
B.2.3 Non-Government publications.
SAE INTERNATIONAL
SAE AIR 1243 Anti Blow-By Design Practice for Cap-Strip Seals
SAE AS5440 Hydraulic Systems, Aircraft, Types I and II, Design and Installation
Requirements for
SAE AS8775 Hydraulic System Components, Aircraft and Missiles, General
Specification for
SAE AMS-P-83461 Packing, Preformed, Petroleum Hydraulic Fluid Resistant, Improved
Performance at 275 F (135 C)
users.)
317
JSSG-2009A
APPENDIX B
B.2.4 Order of precedence.
B.2.5 Streamlining.
318
JSSG-2009A
APPENDIX B
B.3 REQUIREMENTS
B.4 VERIFICATIONS
B.3.1 Definition
B.4.1 Definition
B.3.2 Characteristics
B.4.2 Characteristics
B.3.3 Design and construction
B.4.3 Design and construction
B.3.4 Subsystem characteristics
B.4.4 Subsystem characteristics
B.3.4.1 Landing subsystem
B.4.4.1 Landing subsystem
B.3.4.2 Hydraulic power subsystem.
The hydraulic power subsystem shall accept power from an energy source internal or external
to the air vehicle and thus generate, condition, and distribute hydraulic fluid power to the control
and actuation devices of the air vehicle utilizing systems which are dependent upon hydraulic
power for normal, alternate, or emergency operation. The hydraulic power subsystems may
include components in the other systems dependent upon hydraulic power, such as landing
gear or flight controls. The hydraulic power subsystem(s) shall be sized and configured to
supply hydraulic power, as required, to the using systems and utility functions in all modes of
ground and flight operation.
The function of the hydraulic power subsystem is to deliver fluid at sufficient flow rates and
pressure to the actuating devices in all modes of flight or ground operation. The speed of
actuation is a function of fluid flow-rate whereas the actuating force is a function of pressure.
Hydraulic fluid power has been found to be the lightest and most efficient method to transmit
high horsepower in air vehicles.
Important aspects of hydraulic power subsystem operation are fluid quality (absence of dirt,
moisture, and air), control of fluid leakage and extreme temperature performance (especially at
319
JSSG-2009A
APPENDIX B
temperatures lower than -20°F or temperatures higher than +225°F). Sufficient fluid power
should be available for all known conditions. Conditions should include:
a. Ground operations
b. Taxi, takeoff, and landing
c. All flight attitudes within structural limitations
d. Zero gravity or negative gravity
e. All altitudes within the flight envelope
f. Structural deflection
g. Loss of all engine propulsive power
h. Emergency and alternate hydraulic power subsystem operation.
Many of the requirements for hydraulic power subsystem design, installation, and general use
may be found in the applicable documents in Section 2 (these documents may also be used as
a reference source to prepare specific requirements which are appropriate for particular
hydraulic power subsystem(s); other inappropriate requirements may be discarded or modified
to achieve a “tailored” document).
The hydraulic power subsystem(s) is often oversized to meet a short duration function. For
example, the landing gear and brake system on the C-5A, and the gun drive system on the
A-10. The hydraulic power subsystem should be divided into a finite number of separate,
independent hydraulic power subsystems to meet redundancy requirements for mission
performance or emergency use. The separate system(s) may transmit power from one system
to another, but should not transmit fluid from one system to another. Experience has shown
that one contaminated fluid system can contaminate another.
Standard practice is to use engine-driven pumps (direct or remote gearbox drive) for primary
power. The required pump flow (proportional to engine gearbox speed) is often greatest when
air vehicle airspeed is lowest, as in the landing phase. Multiple engine air vehicle hydraulic
power subsystems using engine-driven pumps should have pumps driven by at least two
engines.
Potential growth in flow requirements for hydraulic services should be considered in establishing
the pump sizes. Eight-thousand-psi pressure systems are being considered to save space and
weight.
Whenever hydraulic power is required for primary flight controls, it is desired that one system is
primarily used to power the flight controls. This hydraulic power subsystem should not be used
to supply any other system or component in the air vehicle. This hydraulic power subsystem
should be as simple as practicable and should contain a minimum number of components.
(TBD)
320
JSSG-2009A
APPENDIX B
B.4.4.2 Hydraulic power subsystem.
The verifications (inspections, analyses, demonstrations, and tests) specified shall verify the
ability of the hydraulic power subsystems to meet the requirements of section 3 herein.
Verification shall encompass planning, procedure preparation, and reporting and shall be
accomplished by inspection, analysis, demonstration, or test, or a combination of these
methods.
The design and operating characteristics to fulfill the needs of the weapon system should be
known before full-scale development.
The hydraulic power subsystem should be verified incrementally by one or more of the
following:
a. Analysis.
1. A hydraulic power subsystem description and analysis report.
2. Computer program analysis of steady state and dynamic performance. This is a
data item, when required.
b. Laboratory tests.
1. Qualification tests to verify specific component and system design and performance
requirements including durability and environmental requirements.
2. Full-scale functional hydraulic power subsystem mockup and simulators.
c. Ground and flight tests.
1. Contractor tests
2. Procuring activity tests
d. Inspection.
1. Conformance to drawing(s)
2. Identification verification
e. Demonstration.
Guidance for qualification tests is contained in component documents listed in primary
documents such as SAE AS5440 and SAE AS8775, and legacy documents MIL-H-5440 and
MIL-H-8775. Guidance for ground and flight tests is also included in MIL-STD-5522.
Hydraulic power subsystem design verification is normally the contractor’s responsibility. The
government on occasion desires to witness or conduct verifications. So for contractual reasons,
321
JSSG-2009A
APPENDIX B
a statement such as the following is added: "All verifications shall be the responsibility of the
contractor but the government reserves the right to witness or conduct any verification."
B.3.4.2.1 Hydraulic power subsystem general requirements
B.4.4.2.1 Hydraulic power subsystem general requirements
B.3.4.2.1.1 Fluid selection.

The hydraulic power subsystem(s) fluid shall be (TBS) .
Fluid selection is critical to the performance of the hydraulic power subsystem. It affects the
operation of every component in the system and should be the same as the fluid used in ground
support equipment.
TBS should be filled in with a hydraulic fluid based on the hydraulic power subsystem’s
requirements for various hydraulic fluid properties, such as, thermal and chemical stability,
viscosity, oxidation-corrosion inhibition, lubricity, fire resistance, seal and system material
compatibility, cost, and logistics. The procuring activity should specify the fluid, unless there are
unique performance requirements, which would require a trade study.
The Navy successfully converted all its air vehicles to MIL-PRF-83282 for increased fire
resistance. The initial conversion caused problems with initial increased filter replacement due
to the better detergent action of MIL-PRF-83282. After a period of time, filter replacement
returned to normal. Similar behavior was observed by the Air Force during its conversion of air
vehicles to MIL-PRF-83282. Self-contained units, such as dampers and landing gear shock
absorbers, were also converted to MIL-PRF-83282. Due to the high viscosity at low
temperatures, hydraulic power subsystem temperature is restricted to -40oF. For lower
temperature, the air vehicles should be converted to MIL-PRF-5606. The Army similarly
requires change of their air vehicle hydraulic fluid from MIL-PRF-83282 to MIL-PRF-5606 at
temperatures below -40oF. In the Air Force, those air vehicles, which had extreme low
temperature operational requirements, were not converted to MIL-PRF-83282 but are now in the
process of converting to MIL-PRF-87257.
Performance Specification MIL-PRF-5606 (formerly MIL-H-5606) petroleum base fluid has been
widely used in military air vehicles for about 35 years. It operates in a temperature range of -
65oF to +275oF and is generally satisfactory. It is non-Newtonian which means its viscosity will
change with high rates of fluid shear, as when pumping, and, most importantly, it is also
flammable. Because of its flammability, alternate fluids have been developed and are in
322
JSSG-2009A
APPENDIX B
common usage. These fluids are less flammable. As a result of the increased fire resistance of
the alternate fluids, MIL-PRF-5606 is no longer used as a design fluid in new air vehicles.
Performance Specification MIL-PRF-83282 is a polyalphaolefin-based synthetic hydrocarbon

fluid with an operating temperature range of -40oF to +400oF. It is more fire resistant (200o
higher flash and fire points) than MIL-PRF-5606 and has a lower flame propagation rate and
greater gunfire ignition resistance. However, it is capable of ignition under certain conditions,
such as hot manifold ignition. MIL-PRF-5606 and MIL-PRF-83282 are chemically compatible
and physically miscible but do not have the same low temperature fluid characteristics. The
viscosity of MIL-PRF-83282 at -40oF is equivalent to that of MIL-PRF-5606 fluid at -65oF.
Therefore, fluid system warm-up procedures with MIL-PRF-83282 fluid may be required at cold
temperatures. MIL-PRF-83282, unlike MIL-PRF-5606, is shear stable. Thus, MIL-PRF-83282
can be pumped at 8000 PSI without loss of fluid viscosity.
Phosphate ester hydraulic fluids are used in commercial air vehicles as well as military
derivatives, such as the C-9 (DC-9), TA3 (737), E-4 (747), KC-10 (DC-10) and the presidential
air vehicle. Phosphate ester fluids are also fire resistant, but are not chemically compatible with
many military air vehicle materials, such as hydrocarbon base fluids, MIL-PRF-5606 and
MIL-PRF-83282 fluids, elastomeric seals, wire insulation, and paint. The physical properties,
such as bulk modulus, also are incompatible with military hydraulic power subsystems.
However, the commercial airlines and suppliers have developed materials compatible with
phosphate ester fluids, which meet the demanding needs of commercial air vehicle operations.
Military air vehicles using phosphate ester hydraulic power subsystems have contract
maintenance programs. The fluid is more fire resistant than petroleum base fluids but should be
restricted to less than 250oF for long term operation because of thermal decomposition.
Phosphate ester fluid systems should be checked periodically for viscosity change and acid
number: an Air Force air vehicle had to have a change of hydraulic tubing because of fluid
decomposition and subsequent system corrosion.
Department of Defense Specification MIL-PRF-46170 is the rust-inhibitor version of

MIL-PRF-83282 and was used as a preservative fluid. Defense Specification MIL-PRF-6083 is
the rust-inhibitor version of MIL-PRF-5606 and likewise used as a preservative fluid. Neither
MIL-PRF-6083 nor MIL-PRF-46170 should be used as a working fluid in air vehicle systems
because the sulfonate inhibitor is marginally stable above 250 F, and has been found to
precipitate out of solution and form a film on internal surfaces. This precipitate film can cause
close-fitting components to jam and lead to component failure.
The newest hydrocarbon hydraulic fluid is MIL-PRF-87257, which is similar to MIL-PRF-83282.

This newer fluid has full performance characteristics from -65 F to 350 F. It was developed in
direct response to the low temperature limits of MIL-PRF-83282 and is completely
interchangeable with both MIL-PRF-5606 and MIL-PRF-83282. This fluid has good viscosity to
the limit of -65 F and no replacement is needed for cold weather operation. The fire resistance
of MIL-PRF-87257 is between MIL-PRF-5606 and MlL-PRF-83282 but is more like
MIL-PRF-83282 than MIL-PRF-5606. It should be used where fire resistance is important and
where extreme cold or high temperature operation is critical.
323
JSSG-2009A
APPENDIX B
B.4.4.2.1.1 Fluid selection.

Suitability of the hydraulic fluid selected shall first be verified by analysis and then by hydraulic
simulator test, as required. The analysis may include a trade study between different fluids.
The fluid selected affects every component in the hydraulic system and it should be suitable
over the entire air vehicle environment. Analysis and test should show this compatibility.
Initial fluid selection should be based on analysis, considering all operational and environmental
factors. Final fluid verification should be accomplished with system-level test using flight worthy
components. Care should be taken to include all normal as well as abnormal environments.
Internal and external corrosion of components by the fluid may cause some fluids to be
unsuitable. Fluids with good environmental properties may be toxic to humans and therefore
should be unsuitable except in the most extreme conditions. Fluid lubricity is another
operational property that is extremely important. It affects the wear and overall life of
components. An early test program may be required to establish fluid properties for a unique
application. Air vehicle operational environmental may also affect the fluid selection process.
Some fluids may be suitable for air vehicle operation but not satisfactory for shipboard use, as in
Navy operations, or for desert maintenance operations.
Careful testing should precede any fluid change, even if a minor change, for the fluid affects
each component in the system. Three development bomber air vehicles used M2V hydraulic
fluid, which is similar to the silicate-ester fluid used in the B-58 and B-70 air vehicles. The
rotating equipment, hydraulic pumps, and motors in the bomber were designed and qualified to
use M2V. However, to reduce costs, the fourth development bomber was designed for use with
MIL-H-5606 fluid. Because of the extensive and successful linear actuator testing with
MIL-H-5606 fluid, it was decided to conduct a 100-hour test on existing pump and motor designs
instead of the 750-hour qualification test.
The pumps showed very high wear rates and had to have some material and geometry
(increased clearance) changes to pass a 100-hour test. Hydraulic pumps and motors should be
fully requalified when a significant fluid change is to be made. High-speed rotating equipment is
especially sensitive to hydraulic fluid characteristics.
Property differences in qualified fluid sources can also affect the fluid performance. A
performance-type specification can result in fluid property variations among qualified sources.
Hydraulic packing and fluid manufacturers met in the 1950s to establish reference materials to
insure control and compatibility of fluids and packings when brought together. For example,
elastomer volume change varied about 4 percent (4%) when tested in different qualified fluids.
This difficulty was repeated when the Navy changed from MIL-H-5606 to MIL-H-83282 (now
MIL-PRF-5606 and MIL-PRF-83282). Different fluid sources for the MIL-H-83282 used different
percentages of an ester component. This ester component affected the swell of elastomeric
324
JSSG-2009A
APPENDIX B
O-rings. As a result of seal performance variations with the different qualified sources, the ester
component was more tightly restricted to ensure the same seal performance.
B.3.4.2.1.2 System fluid capacity.

The total fluid volume, including reserves, shall be optimized to accommodate all operating
modes of the air vehicle including emergency and normal operation.
The total system volume needs sufficient volume to operate all normal and emergency
functions. Total fluid volume should provide for system fluid exchanges, compressibility,
thermal effects, and leakage. Hydraulic fluid should be available in the reservoir in sufficient
quantity to supply the hydraulic pumps under all operational conditions and air vehicle attitudes.
Hydraulic power subsystem operation requires a variable system volume, and the reservoir
accommodates these changes in volume to provide more or less fluid as needed. Fluid thermal
expansion and contraction, variations in component volumes during operation, and emergency
operations cause system volume changes. Guidance for the reservoir volume is given in
MIL-DTL-5498 for closed reservoirs. Reservoir volume includes volume exchange for actuators
due to unbalanced areas, accumulator charging and discharging, thermal expansion,
emergency reserve, and leakage reserve. If not sized properly, changes in the volume can
cause fluid to be spilled overboard or the pump to cavitate due to insufficient fluid.
The reservoir should be located so that the following conditions will be obtained:
a. A static head of fluid should be supplied to the hand pump and the power-driven pump
or pumps in all normal flight attitudes of the air vehicle.
b. The length of suction line to the pump is a minimum.
c. Protection from combat damage
d. If practicable, suction lines should be so routed as to prevent breaking of the fluid
column caused by gravity after engine shutdown and during the parking period. Where
such routing is not possible, or where the reservoir cannot be located above the pump,
suitable provisions should be installed to maintain the fluid column to the pump after
engine shutdown. A swing type check valve in the suction port of the reservoir should
normally maintain the fluid column to the pump.
e. If routing of the pump bypass cannot be accomplished so that breaking of the fluid
column by gravity after engine shutdown is prevented, check valves should be
incorporated in the lines.
If a vent is provided in the reservoir, it should be arranged so that loss of fluid will not occur
through the vent during flight maneuvers or ground operations of the air vehicle. A filter should
be incorporated into the vent line if the temperature requirement is suitable. If a filler cap is
used, the act of removing the filler cap should automatically vent the reservoir in such manner
325
JSSG-2009A
APPENDIX B
that the energy contained in the pressurizing air is not dissipated by imparting kinetic energy to
either the filler cap or the fluid contained in the reservoir or elsewhere in the system.
Reservoir volume includes volume exchange for actuators due to unbalanced areas,
accumulator charging and discharging, thermal expansion, emergency reserve, and leakage
reserve. If not sized properly, changes in the volume can cause fluid to be spilled overboard or
the pump to cavitate due to insufficient fluid.
B.4.4.2.1.2 System fluid capacity.

System fluid capacity shall be verified by (TBS) .
System fluid capacity factors are based on analytical data, expected operating sequence, as
well as experience.
TBS: Analysis, inspections, ground and flight tests, and demonstration programs should verify
the hydraulic fluid capacity requirements. A hydraulic simulator capable of performing all normal
and emergency functions will demonstrate an adequate system fluid capacity. Loss of fluid from
the system overboard relief valves should also be checked with the simulator.
Actual operational conditions of the air vehicle should be used for the test verifications. Start
up, take off, flight, weapons delivery, return to base, and landing conditions should be included.
The UH-1 helicopter incorporated an overboard relief valve in the reservoir to prevent rupture
due to overfill. During routine shut down, pressure surges caused fluid to be squirted overboard
onto the ground. Routine reservoir servicing was required. The problem was not discovered
during tests because all modes of operation were not evaluated. The problem could have been
easily corrected during design and manufacture with higher relief valve settings or check valves
to prevent pressure surges from reaching the valves.
B.3.4.2.1.3 System fluid monitoring.

A means shall be provided to monitor hydraulic system fluid quantity.
Fluid quantity indication provides a means to detect impending system failure due to fluid loss,
and is needed to properly fill and service the system.
326
JSSG-2009A
APPENDIX B
A means to indicate hydraulic fluid level should be located on or near the hydraulic reservoir.
Reservoir sight gauge - Transparent reservoir level sight gauges can easily be damaged unless
they are encased in a protective metal jacket.
B.4.4.2.1.3 System fluid monitoring.

The means for monitoring system fluid quantity shall be verified by ___(TBS)___.
System fluid quantities should be verified for flight operation and servicing.
TBS: The hydraulic fluid quantity monitoring system should be verified by inspection and air
vehicle ground and flight tests.
(TBD)
B.3.4.2.1.4 System pressure.

The system pressure shall be (TBS) psi.
The operating pressure of the hydraulic power subsystem(s) establishes test and design
requirements for hydraulic power subsystem components. This requirement is needed for proof
and burst pressure tests and for designing components such as hydraulic pumps and motors,
relief valves, pressure switches, accumulators, crew station, and flight test instrumentation
parameters.
TBS: Pressure selection should be based on air vehicle hydraulic power subsystem weight,
reliability, design loads, cost, safety and state-of-the-art. Selection of pressure levels with
available components that reduce development, procurement, test, and system support costs
should be considered. The availability and development cycle for ground support equipment is
also factors.
327
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.1.4 System pressure.

System pressure shall be verified by (TBS) .
Analyses should support the pressure selection. Tests should supplement the selected
operating pressure level(s).
TBS: System pressure should be verified by analysis of the contractor design report and
drawings, laboratory tests of components, and system tests.
(TBD)
B.3.4.2.1.4.1 Pump inlet pressure.

Pressure at the hydraulic pump(s) inlet shall be (TBS) .
Sufficient pressure should be available at the hydraulic pump inlet port to prevent pump
cavitation and degradation in performance at maximum steady-state or transient flow demands.
Extreme cold temperatures and high altitude pump startup should be considered.
TBS should be filled in with the pump inlet pressure derived for the system.
The airframe contractor and hydraulic pump manufacturers should define values for pump inlet
pressures.
Inlet pressure should be provided during system startup, if necessary, to compensate for lack of
bleed air pressurization during engine start or lack of bootstrap pressurization during hydraulic
power subsystem starts. Also consider the effect of firewall shutoff valve closure on a
windmilling engine-driven hydraulic pump without inlet fluid flow.
328
JSSG-2009A
APPENDIX B
The use of a portable cart to gas pressurize the reservoir during auxiliary pump startup has
been generally unacceptable. Either the ground equipment is not available or it is a
maintenance nuisance. The result has been pump cavitation damage. One cargo air vehicle
pump suction line is about 100 feet long. When there was sudden flow demand, sufficient fluid
flow could not be accelerated to the pump inlet to prevent pump cavitation. A corrective action
was to reduce the response time of the pump. Pumps are also unloaded during engine start to
reduce drag torque on the engine gearbox.
B.4.4.2.1.4.1 Pump inlet pressure.

Inlet pressure(s) to the pump(s) shall be verified by (TBS) .
Pump durability and pump flow characteristics are dependent on pump inlet pressure and flow.
TBS: The hydraulic pump inlet pressure should be measured and evaluated during the air
vehicle ground and flight test program and during the pump qualification tests. Inlet pressure
should be provided during system startup, if necessary, to compensate for lack of bleed air
pressurization during engine start or lack of bootstrap pressurization during hydraulic system
starts. Also consider the effect of firewall shutoff valve closure on a windmilling engine-driven
hydraulic pump without inlet fluid flow.
High-speed pumps - In general, high-speed piston-type hydraulic pumps require higher inlet
pressures as compared to lower speed piston-type hydraulic pumps.
B.3.4.2.1.4.2 System start pressurization.

Sufficient system pressurization, if required, shall be maintained for normal pump operation in
the event the normal system start up pressurization source (reservoir bootstrap pressure or
other pressurization source) is not available.
Sufficient pressure should be available at the pump inlet port during startup to prime the pump
when the normal system start pressurization source is not available.
One method to pressurize the pump inlet, during the transition to normal pressurization, is to
use an accumulator.
329
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.1.4.2 System start pressurization.

System start pressurization shall be verified by (TBS) .
System start pressurization should be verified. Sufficient pressure should be available at the
pump inlet port during startup.
TBS: Analysis, inspection, and system tests are used to verify this requirement.
(TBD)
B.3.4.2.1.4.3 System pressure indication.

Means shall be provided to sense and transmit hydraulic pressure indications in each hydraulic
power subsystem.
Flight crew personnel should know the operating status of the air vehicle hydraulic power
subsystems.
The system pressure indicating device should be installed in the air vehicle in a location easily
observable to the pilot or other flight personnel.
Pressure indicators - Flight station space allotted to hydraulic power subsystem pressure
indicators often allows only the use of small size indicators. This makes the indicator hard to
read accurately.
B.4.4.2.1.4.3 System pressure indication.

Availability and measurement of system pressure shall be verified by ___(TBS)___.
330
JSSG-2009A
APPENDIX B
The usefulness of pressure determination(s) should be established.
TBS: The pressure indicating system should be verified by inspection and test.
The visibility and accuracy of the gage readout should be verified during the air vehicle ground
and flight test program.
(TBD)
B.3.4.2.1.4.4 System low-pressure warning.

Means shall be provided to indicate low system pressure(s) as follows: (TBS) .
In order to maintain flight safety when a hydraulic power subsystem is lost, air vehicle designs
incorporate redundant hydraulic power subsystems. Therefore, essential hydraulic powered
flight control is still available when one of the redundant systems has failed. The flight crew
should be alerted by a low pressure warning device (which denotes a failed hydraulic power
subsystem if it comes “on”) that the air vehicle may no longer have hydraulic power subsystem
redundancy, and that appropriate action should be taken.
TBS: The low-pressure warning device should be installed in the air vehicle in addition to the
pressure indicating system. It should be installed in a location easily observable to the pilot or
other flight personnel.
An indicator light that only senses a low needle position on the oil pressure gage can result in
erroneous warnings if the gage system fails.
B.4.4.2.1.4.4 System low-pressure warning.

The low-pressure warning shall be verified by ___(TBS)___.
The utility of low-pressure indication should be established.
331
JSSG-2009A
APPENDIX B
TBS: The low-pressure warning device should be verified by conducting tests in accordance
with appropriate specification(s) and it should be evaluated during the air vehicle ground and
flight test program.
False warnings - Low-pressure warning devices have come “on” due to anomalies in the air
vehicle electrical system. Design provisions should be included in the warning device to
minimize false warning occurrences due to electrical system anomalies.
B.3.4.2.1.5 Pressure control.

Overpressure protection shall be provided.
Limiting system pressures are needed to prevent malfunctioning of hydraulic components or

prevent component structural failures.
Variable-displacement hydraulic pumps incorporate a pressure-sensing device, which controls

the pump flow rate into the system as a function of the system pressure. Fixed-displacement
hydraulic pumps often use a pressure regulator (unloading valve). System pressure relief
valves and thermal relief valves are also used in hydraulic power subsystems to prevent
excessive pressures, which could cause component structural failures. For pumps not designed
to withstand reverse rotation, the system should be designed so that no single failure will permit
reverse rotation.
(TBD)
B.4.4.2.1.5 Pressure control.

Control of hydraulic pressures shall be verified by ___(TBS)___.
Pressure control is necessary as a proof of system safety.
332
JSSG-2009A
APPENDIX B
TBS: The performance of the hydraulic power subsystem pressure control devices should be
verified by analyses, inspections, laboratory tests, and ground tests.
(TBD)
B.3.4.2.1.5.1 Peak pressure.

Peak pressure resulting from any phase of system operation shall not exceed (TBS) .
Peak pressure limits are needed to prevent damage to hydraulic components.
TBS: The maximum peak surge pressure during any phase of system operation should not
exceed 135 percent (135%) of the system operating pressure unless the system is designed to
accommodate higher peak pressures. Peak pressures less than 135 percent (135%) may be
required for some hydraulic power subsystems.
The use of constant-displacement pumps with unloading valves generates excessive peak
pressures in some air vehicles. Free air trapped in a hydraulic fluid system also contributes to
excessive peak pressures.
B.4.4.2.1.5.1 Peak pressure.

Peak pressure characteristics shall be verified by __(TBS)__.
Transient peak pressures are a major factor in causing fatigue failures in hydraulic components.
TBS: Peak pressures can be predicted by computer analysis. Component, mockup, and air
vehicle tests should be used to verify the transient pressure characteristics.
(TBD)
333
JSSG-2009A
APPENDIX B
B.3.4.2.1.5.2 Pressure ripple.

Pressure ripple shall not exceed (TBS) .
Pressure ripple amplitude and frequency generated by high-speed rotating fluid equipment
should be identified and attenuated to prevent hydraulic power subsystem instabilities.
TBS: Pressure ripple amplitude limits should be expressed as a percentage of nominal system
pressure. The military pump specification permits ripple amplitude of 10 percent ( 10%) of
system output pressure. The blank should be filled in to limit pressure amplitude to a lesser
value and, further, to prevent destructive resonance in the hydraulic distribution system at the
range of operating pump speeds.
The pressure ripple in the flow output of a piston-type hydraulic pump is transmitted throughout
the supply side of the hydraulic power subsystem. The dynamic resistance (impedance) of the
hydraulic fluid column creates pressure pulsations throughout the hydraulic supply system.
When the frequency (speed) of the acoustic source (pump) is equal to the natural frequency of
the hydraulic fluid column, a resonance condition occurs. Pressure ripple at resonance may be
very high; +1000 psi in a 3000 psi system. These resonant conditions are potentially very
destructive to the system hardware. In extreme cases, the pressure vessel (lines or
components) may reach fatigue failure limits in a few minutes. Hydraulic flow and pressure
ripples excite high frequency mechanical motion in lines and components. Excessive motion
causes stresses that may result in failure of lines, components, or mounting hardware.
Pump discharge lines are generally the most vulnerable since they are in the area of maximum
acoustic energy close to the pump. Dead-end lines to service ports and pressure transmitters
are also vulnerable to pulsation induced damage.
Pressure ripples also occur in the pump inlet and return system. Normally, the inlet system is
not a problem because of the low pressure at which it operates. However, thin wall tubing, high
installation stresses, and an adverse resonance condition could produce inlet system failures.
The coupling of hydraulic to mechanical resonances is a complex phenomenon, and is a

function of line size, configuration (routing), and installation constraints. Total stresses in lines
are a combination of hoop stress from internal pressure and bending stress due to installation
and induced vibration. Large pump discharge and inlet lines (one inch and above) are
particularly vulnerable to high installation stress. Total combined line stress should be low
enough to provide infinite fatigue life.
An acceptable level of pressure ripple in one system may not be acceptable in another system
due to differences in mechanical response. High frequency line motion induced by pressure
ripple cannot be controlled by normal line support techniques (clamps). Clamps should be
334
JSSG-2009A
APPENDIX B
designed to withstand the line vibration without wearing out the cushion and chafing through the
line. Table B-I relates central system pulsation level with potential problems.
TABLE B-I. Pump pressure ripple, peak to peak.
MAXIMUM PULSATIONS POTENTIAL PROBLEMS
>600 PSI
Rapid failure of pump discharge line due to
pressure and vibration stresses. Possible
failures of mounting structure and internal
functions of central components.
300 – 600 psi Line clamp cushion wearout, line failure due
to clamp chaffing, poor clamp life, frequent
inspections required, discharge line check
valve wearout.
<150 psi Trouble free, long-life service.
The first category (>600 psi) is a potential safety of flight situation. The second category is one
of nuisance level problems that probably surface only after a considerable amount of
operational flight experience. The best approach is to verify acceptable line stresses on the iron
bird and the first flight air vehicle to preclude failures of the first category. Pump to filter line
lengths or other simple plumbing changes may be identified to relocate resonances away from
continuous operating speeds. If stress levels are not acceptable, wideband attenuators or
hoses for mechanical decoupling should be considered. Beyond the central system (that is,
away from the high acoustic energy of the pumps, gearboxes, and engines), the vibration
environments are relatively benign. Good line support and adequate clearances between lines
and lines and structure precludes significant vibration related problems.
B.4.4.2.1.5.2 Pressure ripple.

The required pressure ripple limits shall be verified by (TBS) .
Pump ripple characteristics should be determined by appropriate high response electronic

instrumentation.
TBS should be filled in by “analysis and test.” A computer program can predict the system
dynamics once the hydraulic power subsystem configuration has been modeled. The Defense
Specifications for pumps include a test procedure to determine ripple characteristics in a
specific test circuit. However, this test circuit may not have the same configuration or
335
JSSG-2009A
APPENDIX B
impedance as the system being developed. Changing the hydraulic power subsystem
impedance could appreciably increase the amplitude of the hydraulic pump pressure ripple.
Consequently, if any major changes are made to hydraulic power subsystems such as rerouting
hydraulic lines or adding components, tests should be rerun to determine the effects on the
pump outlet pressure characteristics.
Pump ripple pressures and peak pressure transients (water hammer) are attenuated at the
system pressure filter. Therefore, emphasis should be placed on evaluating system dynamics
between the pump outlet and system pressure filter. Pressure-attenuating devices such as
Helmholtz resonators, accumulators, and system architecture can reduce pressure amplitudes.
Some air vehicles use pumps that incorporate Helmholtz resonators to attenuate output
pressures.
There have been several air vehicles that have experienced tube and tube clamp failures
because of resonance. Most failures occur in the engine nacelle area and could have been
prevented or corrected if system evaluation tests had been conducted.
Pump pressure ripples in a distribution circuit are damped at the pressure line filter. Therefore,
transducer pickups should be placed close to the pump pressure outlet.
B.3.4.2.1.5.3 Back pressure.

Proper functioning of any unit shall not be affected by back pressure in the system.
The hydraulic power subsystem back pressure limits should be controlled to preclude
degradation and malfunctions from occurring.
Legacy Military Specifications MIL-H-5440 and MIL-H-8891, and SAE AS5440 could be used as
guides. Factors to consider include reservoir pressurization and hydraulic line loss as a function
of fluid viscosity.
The system or systems should also be so designed that malfunctioning of any unit in the system
will not render any other subsystem, emergency system, or alternate system inoperative
because of back pressure.
Back pressure resulting from the operation of any unit while the air vehicle is on the ground
should create no greater back pressure at the brake valve return port than 90 percent (90%) of
that pressure which will cause contact of braking surfaces. In addition, supply pressure to the
brake system should not drop below the maximum brake-operating pressure during the
operation of any other subsystem in the air vehicle during taxiing, landing, or takeoff.
336
JSSG-2009A
APPENDIX B
Brake system return fluid should go directly to the reservoir instead of another return line.
Clogged filter(s) can cause serious back pressure problems. A clogged brakeline filter
contributed to a bomber mishap after landing.
B.4.4.2.1.5.3 Back pressure.

Operating effects from back pressure shall be verified by ___(TBS)___.
System back pressure characteristics should be identified during development to avoid redesign
after full-scale development.
TBS: The verification of the hydraulic power subsystem back pressure should be by analysis,
laboratory tests, and air vehicle ground and flight tests.
(TBD)
B.3.4.2.1.6 System level contamination prevention.

There shall be means to remove solid particulate contaminants from hydraulic power subsystem
fluid during flight, ground, and filling operations.
It is important that particulate contaminants be removed from hydraulic fluid to reduce

component wear and prevent contaminant-induced component malfunctions, such as servo
valve stiction.
If filters are used, the following should be considered. The filter rating(s) issue for hydraulic
power subsystems can be controversial. Most of the controversy is focused on 5- versus
15-micron absolute filtration. A desirable goal is to establish a contamination level that is
practical to maintain and still ensure reliable hydraulic power subsystems. The trend has been
to go to 5-micron absolute filters in new designs.
Levels of needed filtration have been a controversial subject for years. In the 1950s, the filter
element was a 10-micron nominal rating which did not define the maximum particle size
removed by the filter.
337
JSSG-2009A
APPENDIX B
In the 1960s absolute ratings were specified. The MIL-F-8815 filter has a 15-micron absolute
rating that essentially means that the largest spherical particle removed is 15 microns, whereas
the largest particle removed was undefined in older filter specifications.
On the basis of early experience with 5-micron absolute filters in improving the pump life on an
air vehicle, U.S. Navy personnel recommended the immediate adoption of 5-micron filtration in
all systems.
About 1961, the use of 3-micron absolute filters on ground service equipment (GSE)
successfully “cleaned” contaminated hydraulic power subsystems on a bomber air vehicle.
Thus, the 3- to 5-micron absolute filter became a “standard” for GSE. The contamination in the
systems was actually from pumps and reservoirs that were not clean.
Naval Air Development Center laboratory tests for pump wear data indicates decreased pump
internal surface damage with the use of finer filters. Five-micron absolute filters were reported
to produce 71 percent (71%) less wear than 15-micron absolute filters. The reason is that the
finer filter removed more of the smaller abrasive wear particles from the lubricating film
thickness separating component operating surfaces.
The use of hydraulic-powered flight controls and servo valves do, generally, require finer
filtration.
The changeover from 25-micron absolute filters to 5-micron absolute filters improved the
performance of silt-prone servo valves in a cargo air vehicle.
The use of a 5-micron absolute filter in place of a 10-micron absolute filter improved the
performance of the Maverick missile hydraulic power subsystem that uses single stage servo
valves.
A large degree of success depends on the system designer and the degree of effort that the
user is willing and able to put into the maintenance and filtration control program. A clear fluid is
not necessarily a clean fluid. The unaided eye cannot see particles smaller than 40 microns.
Education and re-education is critical at all working levels to keep clean hydraulic power
subsystems clean.
At one time, reusable (cleanable) wire mesh filter elements were used. However, the cleaning
procedure, including ultrasonic bath, did not sufficiently restore the full effectiveness of the metal
elements. Experience has shown that the disposable (noncleanable) elements are more
efficient and are more cost effective than “cleanable” wire mesh elements.
Experience has shown that filter media migration can occur from sintered bronze filters; that is,
bronze particles separate from the filter itself.
Separate pump case drain filters are recommended instead of piping case drain flow upstream
of system return line filters. Return lines filter pressure drop and return line system pressure
surges can adversely affect case drain line pump seal integrity. Also, a pump failure causes
debris in the case drain line.
338
JSSG-2009A
APPENDIX B
B.4.4.2.1.6 System level contamination prevention.

The means to remove solid particulate contamination shall be verified by ___(TBS)___.
Filter characteristics are usually proven by qualification tests on the filter element and filter
assembly.
TBS: This requirement should be verified by inspection of drawings, and laboratory test data.
There is a difference between laboratory tested dirt capacity and actual system filter life. Dirt
capacity of a filter element as measured in the laboratory is designed to produce repeatable,
relative data demonstrating a filter’s ability to remove artificial test contaminant under specific
test conditions. System contamination is not the same as the contaminant used in the
laboratory. Actual filter life would have to be established by test in the air vehicle system. An
experimental test method used to rate a filter is known as Beta X, where X is a particle size, for
example X = 10 microns. The filtration ratio for X micron size is determined by obtaining
particulate measurement data while recirculating flow with predetermined weight of contaminant
added continuously to the test system (also called multipass testing). The dimensionless ratio
for Beta X micron particles is equal to the number of particles upstream of the filter greater than
X microns, divided by the number of particles downstream greater than X microns. This test is
not called out in military filter specifications.
The ability of a finer filter to remove more fine particles than a coarser filter does not necessarily
mean that the finer filter will have a shorter life in the system because of dirt holding limitations.
The finer filter should remove more of the abrasive smaller particles which contribute to higher
wear rates. This should result in less component surface wear which should reduce the overall
amount of system generated contamination. The question becomes “How fine a filter is
necessary for a given system.”
Pump performance tests at the Franklin Institute resulted in the following:

a. 10-micron size and larger particles were detrimental.
b. Hardness of the particle(s) is a dominant factor in wear.
B.3.4.2.1.6.1 Contamination control maintainability.

Contamination control assemblies shall be readily accessible and shall be replaceable with no
fluid loss other than the fluid in the assembly.
This is a maintenance-driven requirement. Contamination controls assemblies need to be

located where they are easily accessible and prevent fluid loss during maintenance actions.
339
JSSG-2009A
APPENDIX B
The contamination control assemblies should be located so that maintenance personnel can
easily see the contamination control assembly indicator, readily replace contamination control
assemblies as needed; and have sufficient working envelope space to allow wrenching and
space to remove and replace a contamination control assembly element. During contamination
control assembly replacement, fluid should be retained in the hydraulic power subsystem and
not be permitted to spill. The function of an automatic shut-off is to prevent fluid from draining
out of the system upstream and downstream of the system contamination control assembly
during element removal.
The following addresses filter assemblies that have historically been used for contamination
control.
The location of the filter assemblies also involves environment considerations. A filter on a
fighter was located in the aft fuselage near the engine area and was exposed to heat soak.
There were leakage problems with the static seal at the filter bowl interface. An air-to-air
missile, which used special low viscosity fluid experienced static seal leakage problems, caused
by extreme low temperatures during qualification tests; the Buna N O-ring was replaced with a
fluorosilicone O-ring.
A special filter for use in a manifold was procured by an air vehicle prime. This resulted in a non-
competitive situation that was costly and added to the logistics burden.
When changing a dirty filter element, clean fluid should be placed in the filter bowl with a clean
filter element to minimize particle and air contamination ingestion into the hydraulic system
during this maintenance action.
B.4.4.2.1.6.1 Contamination control maintainability.

Accessibility of installed contamination control assemblies for ease of element replacement shall
be verified by __(TBS)__.
There should be sufficient envelope to remove and replace contamination control assembly
elements.
TBS: A review of contamination control assembly drawings can show the envelope dimensions
needed to remove and replace the element. A demonstration on the mock-up and air vehicle is
the best way to verify ease of contamination control assembly removal and replacement.
340
JSSG-2009A
APPENDIX B
The following addresses filter assemblies that have historically been used for contamination
control.
Some filter differential pressure indicators have given false indications of clogged filter elements
on some air vehicles.
These false indications occurred so often that some maintenance personnel chose to ignore the
button indicator. Consequently, filter element replacement time was based on air vehicle
operating hours in lieu of the indicator for some air vehicles.
B.3.4.2.1.6.2 Cleanliness level of delivered systems.

Hydraulic particulate contamination shall not exceed (TBS) when the air vehicle is delivered
to the procuring activity. Fluid sampling capability shall be available.
A desired goal is to establish a contamination level that is practical to maintain and still ensure
hydraulic power subsystem reliability.
TBS: A generally accepted contamination level for delivered air vehicles is NAS 1638, Class 6
or Class 7, depending on the complexity of the hydraulic power subsystem.
(TBD)
B.4.4.2.1.6.2 Cleanliness level of delivered systems.

Hydraulic particulate contamination of delivered air vehicles shall be verified by ___(TBS)___.
The initial cleanliness level should be measured.
TBS: Contamination level is determined by analysis of representative fluid samples taken from
the air vehicle hydraulic power subsystems. It is recommended that a sampling valve be
located upstream of the return line contamination control assembly. Other sampling points, if
desired, should be selected by mutual agreement.
341
JSSG-2009A
APPENDIX B
Samples should be taken from a moving fluid stream. A sample of fluid from a static location is
of little value. Contamination level of new and cleaned air vehicles may be acceptable, but can
build to an unacceptable level within 100 flying hours. Peak contamination levels appear to
coincide with component replacement, pump defects, and servicing activities.
Contamination can arise from internal or external sources.
Ground service equipment fluid, which is not clean, contributes to air vehicle system
contamination. Ground service equipment should be monitored for fluid cleanliness levels.
Hydraulic pumps generate considerable contamination, especially during wear-in periods, and
during a primary failure. Much of the wear-in debris is less than 5 microns. Hydraulic pumps
should be procured that have already completed a run-in test.
Consider contamination control assemblies in proportion to the number of components in the

system rather than for only maximum pump flow.
Unless conflicting engineering data is available for particular hydraulic power subsystems, it is
recommended the following contamination levels in table B-II be considered as a maximum
limit:
TABLE B-II. Contamination levels.
NEW FLUID SEE THE APPLICABLE FLUID

SPECIFICATION.
Ground Service Equipment Class 6, NAS 1638
Delivered Air Vehicles Class 6 or 7, NAS 1638
In-Service Air Vehicles Class 8, NAS 1638
B.3.4.2.1.7 System air removal.

The system shall be designed and configured such that entrained air shall not cause sustained
loss of system pressure or degradation of system operational performance during all conditions
of intended air vehicle operation. There shall be provisions for bleeding air from the hydraulic
fluid at critical points for maintenance purposes.
Air in hydraulic power subsystems can cause problems with sluggish response due to lower
effective fluid bulk modulus, pump cavitation, or in some cases, the complete loss of hydraulic
power due to air lock of the hydraulic pump(s) (free air in the pump inlet line).
342
JSSG-2009A
APPENDIX B
There have been cases where fighter air vehicles have lost hydraulic power in one or two
hydraulic power subsystems for periods of a few seconds to several minutes or more. Several
cases of pump air lock occurred during a flight maneuver and negative “g” mode.
The use of unvented hydraulic power subsystems (that is, the reservoir does not vent to
atmosphere) makes it more difficult to remove air from hydraulic fluid. Bleed fittings should be
provided in the brake lines. Bleed fittings should be considered at strategic high points in the
hydraulic power subsystem.

a. Air vehicle system design. Some examples of designs, which could reduce the air in
hydraulic power subsystems, are:
1. Some system accumulators can be eliminated by providing high-response pumps,
backed up by high-response relief valves. This reduces the frequent maintenance
associated with accumulator piston seal leakage of gas into the hydraulic fluid.
2. Using quick-disconnect couplings having low air inclusion on components that require
periodic maintenance, and using quick-disconnect fittings at service ports. This results
in negligible fluid loss and air entrainment.
b. Ground service equipment. The use of closed hydraulic power subsystems with “bootstrap”
type reservoirs has made air bleeding more difficult. Reservoirs of the open or vented
design make air bleeding simpler.
Effective removal of air from air vehicle hydraulic power subsystems is important and can be
accomplished with a conventional hydraulic ground cart if it has open loop capability. The
cart reservoir should be kept open to the atmosphere to separate air from the air vehicle oil.
The actual bleed time depends on the initial air content of the oil, volume of the circuit being
cycled, the cart flow rate and the air settling capability of the cart reservoir. Further, if there
are multi-hydraulic power subsystems in the air vehicle, the ground cart should have
simultaneous multi-hydraulic power subsystem capability with a separate open loop
reservoir for each system.
Never service the air vehicle using a pneumatically pressurized cart reservoir. The oil in the
cart reservoir dissolves large amounts of the pressurizing gas that finds its way into the air
vehicle system during servicing. Keeping the cart reservoir vented to atmosphere allows the
air to come out of solution and separate from the air vehicle oil during open loop bleeding.
c. Reservoir bleed valve. Bleeding of the air vehicle reservoir via the reservoir overboard
bleed valve removes a free bubble from the top of an air vehicle reservoir. Momentary
reservoir bleeding is a good practice after each long down period and also as a preflight
activity. However, it is not practical to remove air in this manner from the entire system.
Closed loop air removal via a reservoir bleed cannot wash out the air. Detection of free air
in a bootstrap type reservoir system can be roughly indicated by reservoir piston sink (the
change in reservoir piston position indicator before and after hydraulic power subsystem
pressurization).
343
JSSG-2009A
APPENDIX B
d. Laboratory tests. Air separation and collection in the reservoir is most effective when oil-
flow rate through the reservoir and the reservoir pressure are both low. However, high oil-
flow rates are necessary to flush air from remote system locations. Air was adsorbed by oil
at normal return pressure (50 psi) and system flows. Bootstrap pressure, combined with
high flows necessary to sweep air through the system, actually helps the hydraulic fluid to
adsorb the system air. Shutdown of the system causes the air to come out of solution
without collecting at the reservoir. Another phenomenon noted was that the pump seemed
to homogenize the air within the oil, aiding in air adsorption at high flow conditions.
e. Laboratory and iron bird system tests. Laboratory and iron bird system tests demonstrated
system modifications to clear pump air lock independent of temporary system pressure loss.
The main objective was the capability to restore pressure to an air locked system in less
than four seconds for ingested air volumes of up to 66 cubic inches of free air. The
modification consisted of adding a bypass valve, and a check and one way restrictor relief
valve. The bypass valve, which closes when system pressure increases to 600 psi, allows
sufficient flow through the reservoir and pump suction line to sweep out the air. It was found
necessary to increase the bypass valve orifice flow capacity from the 3-5 gallons per minute
(gpm) design goal at a differential pressure of 3000 psi to obtain a satisfactory recovery
time. The larger orifice was needed to move the oil in the pump pressure hose at the low
differential pressure (about 50 psi) available during the air locked condition, while the pump
is acting as an air compressor. The in-line relief valve aids in “trapping” bootstrap reservoir
pressure and allows free flow into the reservoir.
A potential drawback to a bypass valve in this application is the heat that could be
generated if the valve were to fail in continuous bypass. However, a thermal switch could
be incorporated if operational analysis showed that thermal protection was mandatory.
f. Deaeration devices. A fighter nose gear system incorporates a deaeration device that
eliminates nose wheel steering shimmy caused by air in the hydraulic power subsystem.
The device can handle the amount of air in this application because nose steering is not a
continuous function. An operational test of a deaerator in the main system of a fighter air
vehicle showed that saturation occurred because of the system oil flow rates.
g. Air tolerance. Dissolved air measured in a fighter air vehicle was in a range of 14 to
26 percent (26%) by volume. Dissolved air is air in solution in a fluid. Free air is air
entrapped in a system but not totally in contact with a fluid. Entrained air is air suspended in
a fluid and normally exists in the form of bubbles. MIL-PRF-5606 hydraulic fluid contains
about 10 percent (10%) dissolved air by volume at 15 psi. Saturated air volume in solution
is proportional to pressure and is inversely proportional to temperature. There is no
universal acceptable minimum value for air in a system, but good bleeding and maintenance
procedures should reduce the air content. Open loop bleeding can reduce the air vehicle
system air content to 14 percent (14%) or less.
h. Deaerated hydraulic fluid. Some missiles are charged with deaerated hydraulic fluid using a
vacuum technique.
344
JSSG-2009A
APPENDIX B
B.4.4.2.1.7 System air removal.

Entrained air effects and provisions for air removal shall be verified by (TBS) .
It may be necessary to introduce known quantities of free air into a laboratory system
(subsystem) to evaluate performance.
TBS: Entrained air phenomena can be evaluated in functional test rigs (iron bird). The
provisions for air removal should be verified by inspection, demonstration, and tests.
(TBD)
B.3.4.2.1.8 Moisture exclusion.

The hydraulic power subsystem shall be designed to restrict the ingestion and collection of
moisture.
Moisture in a hydraulic power subsystem can cause malfunctions from corrosion, shorts in
electrical devices, and freezing.
Specific water concentration will vary with the fluid system. The limit in new MIL-PRF-5606 fluid
is 100 ppm (parts per million) and is 500 ppm in new MIL-PRF-6083 fluid, the preservative
version of MIL-PRF-5606 fluid. Consider moisture ingression from moist bleed air reservoir
pressurization (if used), from air vehicle washing, and from operating in the rain or snow.
Solenoid valves in a low spot can accumulate water and freeze.
Water in conjunction with chlorinated solvents in a hydrocarbon fluid system can cause sticking
of slide valves and promote a form of corrosion on low-chromium steels. Experience has shown
that chlorine concentration of 200 ppm and 100 ppm of moisture can promote corrosion
phenomena. This has occurred on several different air vehicles.
Water running down the landing gear strut wiring entered a “black box” and caused a short.
Locate electrical devices related to the hydraulic power subsystem to preclude water ingestion
or hermetically seal from moisture.
345
JSSG-2009A
APPENDIX B
There is no universal specified maximum limit for moisture content in a hydraulic fluid system.
Although it would be desirable to be below 150 ppm, a 300-ppm moisture limit has been
considered for one specific hydraulic power subsystem with MIL-PRF-83282 hydraulic fluid.
There have been many cases of adding drilled vent holes in valves after water problems
occurred. Also, valves with drilled vent holes should be oriented to drain moisture instead of
collecting moisture.
B.4.4.2.1.8 Moisture exclusion.

Means to restrict ingestion and collection of moisture shall be verified by __(TBS)__.
Operations analysis and systems layout are factors to identify potential moisture problems.
TBS: Verification can be by system design analysis, inspection, first article (air vehicle)
inspection, and ground and flight test experience.
Analyzing air vehicle system fluid samples for water content is not normally done, unless a
water-related problem occurs or is suspected. Occasionally, water in GSE hydraulic fluid is
transmitted to an air vehicle.
B.3.4.2.1.9 Leakage control.

Acceptable leakage limits shall be defined for components and systems.
External leakage should be minimized to reduce maintenance problems and potential fire
hazards. Leakage, even within allowable limits, is a general nuisance.
Static seals should not leak at all. Dynamic seals usually have finite amounts of leakage.
Allowable leakage values are normally specified for individual components in contractor-
prepared specifications or in Defense Specifications. Leakage values should be evaluated for
“reasonableness,” and overall performance expectations. O-ring seals are most commonly
used, although other specialty seals are often used successfully.
A common cause of leakage is inadequate design squeeze. Use of the largest standard cross
section O-ring possible is highly recommended. It is difficult to seal with a “string.”
346
JSSG-2009A
APPENDIX B
The O-ring seal is affected by changes in physical shape combined with loss of mechanical and
physical properties. These are time-dependent functions after the seal is installed. In type I
hydraulic power subsystems, the seal is expected to last the life of the air vehicle. However,
there is a loss of seal life at fluid temperatures greater than 225°F for Buna N seals in either
MIL-PRF-5606 or MIL-PRF-83282 fluid. This was learned in a fighter air vehicle and could be
predicted by O-ring specification fluid aging tests for type I (7 days at 160°F) versus 70 hours at
275°F for type II O-ring material. It is recommended that heat exchangers be used to keep
hydraulic power subsystem fluid below 225°F if practical and below 250°F if possible, to achieve
reasonable seal life. This is reflected in SAE AS5440. Aerospace Material Specification
SAE AMS-P-83461 Buna N O-rings should be used in MIL-PRF-5606 and MIL-PRF-83282
hydraulic fluid systems.
O-ring spiral failures occur when there is differential twisting of the O-ring, which results in a
spiral cutting failure. The failures have been attributed to several factors, but marginal seal
lubrication with rapid stroking duplicated the failure in the laboratory. Side loading a shock strut
and completely drying the strut before stroking induced the laboratory failures. Spiral failures
have been corrected by using a seal shape that resists rolling in the seal groove.
An in-service leakage problem results when a low squeeze design is used to reduce seal
friction, even though the design passed qualification tests. If such a design is contemplated, the
absolute worst design conditions should be tested. Experience has shown that a low squeeze
design results in unacceptable leakage in service.
Using the O-ring elastomer as a spring to maintain contact between the tetrafluoroethylene
(TFE, Teflon®) and the metal rod has used cap strips of TFE to reduce friction or cylinder bore.
In certain piston applications a blow-by phenomena has occurred where a pressure reversal
separates the TFE cap and cylinder bore interface, allowing a massive pressure drop across the
piston. Corrective action was to make notches on the sides of the TFE cap. Blow-by caused
the crash of an experimental air vehicle. The failure mode was duplicated in the laboratory. A
failure to extend a fighter landing gear was attributed to blow-by of a rod type cap seal, although
this could not be duplicated in the laboratory. Additional information on blow-by is found in
SAE AIR 1243.
The use of dual rod seals can reduce external leakage. The dual rod seals are usually vented
to return. Unvented rod seals have been used in the United Kingdom with great success and
also in several United States air vehicles. The dual unvented seals are usually “specialty” seals
that permit some seepage, and furthermore, are not operating in high temperature environments
where thermal expansion of trapped fluid can generate extreme high local pressure. Dual
unvented seals should not be used when a pressure trap force or friction force between seals is
greater than the actuating force, such as spring-loaded devices or free fall actuators.
The fitting boss seal installation has been a problem because separate manufacturers usually
make the mating flat metal surfaces. In addition, the axis of the threads should be
perpendicular to the fitting hex surface. The absence of a fitting “hex” flat to the mating surface
can permit extrusion of the boss fitting O-ring, especially in larger port sizes. Several air
vehicles are using the Rosán® boss fitting to prevent the potential service difficulties with the
older boss type fitting installation.
347
JSSG-2009A
APPENDIX B
B.4.4.2.1.9 Leakage control.

Acceptable leakage rates shall be verified by ___(TBS)___.
Allowable leakage should consider the effects of in-service use as well as leakage from “new”
seals.
TBS: Use individual component qualification and acceptance requirements, laboratory

evaluation(s), air vehicle extreme-temperature tests, and air vehicle flight and service
experience
Duplicate the operating conditions as much as practical and consider adverse seal design
tolerances.
(TBD)
B.3.4.2.1.10 Emergency operation.

Normal and emergency systems and their controls shall be designed so that the desired
function is attained when either is initiated first or when both systems are operated at the same
time.
The desired function should be accomplished after selection of either a normal mode or an
emergency mode of operation.
Operational capability should be considered to avoid any adverse interaction between normal
and emergency modes of operation.
Two or more subsystems pressurized by a common pressure source, one of which is essential
to flight operation and the other not essential, should be so isolated that the system essential to
flight operation will not be affected by any damage to the nonessential system.
Hydraulic pumps required to provide emergency power for direct application to flight controls or
other essential hydraulic flight requirements should not be used for any other function.
348
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.1.10 Emergency operation.

Intended functional performance with normal and emergency operation shall be verified by
(TBS).
The function should not be lost because of an adverse interaction between normal and
emergency modes of operation.
TBS: Verification should be done by design review(s), subsystem tests, ground demonstration,
and flight tests.
(TBD)
B.3.4.2.1.11 Proof pressure.

No component shall fail, take any permanent set, or be damaged in any manner, when
subjected to applicable proof pressure of (TBS 1) . Systems and components shall satisfy
this requirement when subjected to a proof pressure of (TBS 2) .
The intent of this requirement is to assure that all systems and components are adequately
designed and tested for functional and structural integrity.
TBS 1: The system and its components should be designed to withstand the proof pressure
requirements without permanent deformation and should be fully functional following the test.
TBS 2: When proof tests are conducted at temperatures other than design temperatures,
account for the degradation of material properties at design temperatures in determining the
proof pressure. The proof load should be of sufficient magnitude to ensure that the service life
requirements are met.
349
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.1.11 Proof pressure.

Proof pressure compliance shall be verified by ___(TBS)___.
A material factor of safety should be established.
TBS: This requirement can only be demonstrated by actual tests on the system and
components.
a. System. Proof pressure is applied to the system to prove the integrity of connections at
each component.
b. Component. Proof pressure is applied to the component to prove the integrity of the
component.
(TBD)
B.3.4.2.1.12 Burst pressure.

No component shall rupture when subjected to an applicable burst pressure of (TBS) .
The intent of this paragraph is to ensure all components are adequately designed and tested for
structural integrity.
TBS: The components should be designed to withstand burst pressure requirements without
rupture. Deformation resulting from the test is acceptable and the component need not be
functional after the test. When burst tests are conducted at temperatures other than design
temperatures, account for the degradation of material properties at design temperature in
determining the burst pressure.
350
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.1.12 Burst pressure.

Burst pressure compliance shall be verified by __(TBS)__.
The intent is to ensure that all components are adequately designed and tested for structural
integrity.
TBS: Burst pressure compliance should be verified by tests. Burst pressure is applied to the
component to prove the integrity of the component. SAE AS8775 and the legacy document
MIL-H-8775 may be used as guides for the test procedure and pressure level.
(TBD)
B.3.4.2.1.13 Low-temperature operation.

The hydraulic power subsystem shall operate at low temperature conditions as follows: (TBS).
The low temperature operating conditions should be defined.
TBS: The low temperature operating temperature is normally defined in the weapon system
procurement document.
At one time, O-ring seals were aged for 72 hours at -65°F to test for O-ring material
crystallization phenomena. Current low temperature tests are performed after stabilizing the
component at the desired low temperature plus a 4- to 8-hour low temperature soak, depending
on the mass and size of the component.
The O-ring seal properties that enhance low temperature sealing can be in opposition to good
seal performance at higher temperatures. For example, high tolerance O-ring cross section, low
351
JSSG-2009A
APPENDIX B
tolerance O-ring glands, higher volume change material, and use of “high volume swell” fluid
can improve low temperature sealing.
A valuable laboratory test known as temperature retraction (TR) was developed in the 1950s.
TR 50-10 denotes the temperature to return an elastomer specimen 10 percent (10%) after the
specimen had been stretched 50 percent (50%) and “frozen” in a cold bath. It was determined
that an O-ring should pass a -65°F performance test if an oil aged test specimen had a
TR 50-10 of -49°F or colder.
Laboratory component tests at -65°F should be conducted with a tolerance of -5°F, +0°F.
B.4.4.2.1.13 Low-temperature operation.

Low-temperature performance shall be verified by ___(TBS)___.
The suitability of low-temperature performance should be verified and information, as required,

included in the pilot’s handbook and maintenance cold weather operating procedures.
TBS should be filled in with analyses and tests. Low temperature tests are performed at the
component level and are performed at a system level in the Climatic Hangar at Eglin AFB FL.
Low temperature ground and flight tests are performed during operation and test evaluations.
A component should be capable of functioning when assembled with adverse tolerance parts
without binding at low temperatures. The effect of different materials should be considered in
the design stage. The manufacturer can verify this by analysis. In critical applications, a test
might be preferred.
B.3.4.2.1.14 High-temperature operation.

The maximum hydraulic bulk fluid temperature shall be (TBS) .
The high temperature operating conditions should be defined to ascertain possible fluid cooling
needs and general operation.
352
JSSG-2009A
APPENDIX B
TBS: The high temperature-operating limit is usually a function of seal life rather than a function
of fluid life. Consideration should also be given to heat soak-back after engine shutdown.
A fighter has a thermal switch that diverts hydraulic fluid to the heat exchanger when the fluid
temperature exceeds 225°F.
A helicopter had heat degradation of fluid and seals after cumulative ground test operation using
the onboard auxiliary power unit (APU). Corrective action was to include an air-fluid heat
exchanger.
B.4.4.2.1.14 High-temperature operation.

High temperature operation shall be verified by ___(TBS)___.
The suitability of high temperature performance should be verified.
TBS should be filled in with analyses and tests. High temperature tests are performed at the
component level. System high temperature performance tests are performed during operation
and test evaluations.
High temperature component aging should be carefully controlled in an oven (or fluid bath)
having uniform temperature throughout. The system maximum fluid temperature is usually in
the pump case drain.
B.3.4.2.1.14.1 Thermal relief.

Pressure relief for hydraulic fluid thermal expansion shall be provided for all components in hot
locations and closed plumbing segments.
Temperature and pressure conditions, if not controlled, could cause over pressurization
component failures.
353
JSSG-2009A
APPENDIX B
Particular emphasis should be placed on the following:

a. Pressure and temperature control
b. Avoiding component location in proximity to hot compartments heats sources and hot
surface.
(TBD)
B.4.4.2.1.14.1 Thermal relief.

Pressure relief for hydraulic fluid thermal expansion shall be verified by (TBS) .
The pressure relief function should be verified.
Analysis and inspection of drawings should show protection features. Tests may be required in
some instances.
(TBD)
B.3.4.2.1.15 Fire and explosion hazard proofing.

Integration of the hydraulic power subsystem in the vehicle shall be in accordance with (TBS) .
Temperature and pressure conditions, if not controlled, could present a potential fire hazard.
TBS: Particular emphasis should be placed on the following:

a. Pressure and temperature control
b. Keeping combustibles to a minimum
c. Avoiding proximity to ignition sources, hot surfaces, and electrical wiring.
354
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.1.15 Fire and explosion hazard proofing.

Fire and explosion resistance shall be verified by (TBS) .
Fire and explosion resistance should be verified because it is a critical safety-of-flight issue.
Analysis and inspection of drawings should show protection features. Tests may be required in
some instances.
TBS: MIL-F-87168 should be used for guidance.
(TBD)
B.3.4.2.1.16 Survivability-Vulnerability (S-V).

The hydraulic power subsystems shall be configured to accept (TBS) by the threat(s)
specified in the system or air vehicle specification without loss of flight and mission-essential
functions.
Air vehicle performance limitations after hydraulic power subsystem(s) damage should be
defined.
TBS: Capability should be defined for loss of systems as well as impact by specific threat(s).
Refer to the mission completion in a combat environment specification for guidance.
A single failure in the hydraulic power subsystem component or any other subsystem supplying
power to the hydraulic power subsystem should not prevent the completion of the air vehicle’s
primary mission.
355
JSSG-2009A
APPENDIX B
The hydraulic system(s) should be configured such that any two fluid system failures due to
combat or other damage, which cause loss of fluid or pressure, will not result in complete loss of
flight control. For rotary-wing air vehicles, the surviving system(s) should provide sufficient
control for return to the intended landing area. Where duplicate hydraulic power subsystems
are provided, these systems should be separated as far as possible to obtain the maximum
advantage of the dual system with regard to vulnerability from gunfire or engine fires. Where
practicable, dual systems should be on opposite sides of the fuselage, the wing spar, or
similarly separated.
(TBD)
B.4.4.2.1.16 Survivability-Vulnerability (S-V).

S-V of the hydraulic power subsystems shall be verified by (TBS) .
Performance limitations after hydraulic power subsystem(s) damage should be defined.
TBS: Survivability-vulnerability characteristics should be verified by analysis.
(TBD)
B.3.4.2.1.16.1 Resistance to gunfire.

Hydraulic power subsystem pressure vessels shall not fragment from a single impact by
(TBS) .
Gunfire damage to a pressure vessel should not result in fragmentation that can injure
personnel or cause serious damage to the airframe.
TBS: High-pressure vessels have been required to take a single Armor Piercing Incendiary
(API) .50-caliber projectile without fragmenting.
Low-pressure vessels may require resistance to a single .30-caliber API projectile.
356
JSSG-2009A
APPENDIX B
Experience has shown that American Iron and Steel Institute (AISI) Code 4130 steel and
comparable steels should not be heat treated above 160,000 psi to preclude fragmentation.
B.4.4.2.1.16.1 Resistance to gunfire.

Pressure vessel resistance to fragmentation shall be verified by ___(TBS)___.
Gunfire damage to a pressure vessel should not result in fragmentation that can injure
personnel or cause damage to the air vehicle.
TBS: Resistance to fragmentation should be evaluated by test. Past practice (reference

MIL-DTL-5498) has been: For accumulators three inches or less in diameter, the ammunition
should be .30-caliber M-2 armor piercing. For all other sizes, the ammunition should be
.50-caliber M-2 armor piercing. Muzzle velocity should be 2800 feet per second (fps). The
accumulator should be positioned with its longitudinal axis 45° from normal away from the gun
position. The projectile should be tumbled so that the .30-caliber shell produces an “in” hole at
least 1/4 inch wide by 5/8 inch long and the .50-caliber shell should produce an “in” hole at least
1
/2 inch wide by 11/2 inches long. The projectile velocity after tumbling should be monitored
during the last 10 feet prior to impact. Minimum velocity should be 2300 fps. The accumulator
should remain in one piece, and the material of the cylinder should not tear excessively in any
one direction.
(TBD)
B.3.4.2.1.17 Clearance.
Clearance shall be maintained between moving system components and structure or other
components to ensure that no possible combinations of temperature effects, airloads, wear, or
structural deflections can cause binding, rubbing, or jamming. There shall also be adequate
clearance for component installation, removal, and maintenance.
The intent of this requirement is to prevent binding, chafing, or jamming of components in static
or operating modes. In addition, there are minimum clearances necessary to accommodate
removal and installation of components.
357
JSSG-2009A
APPENDIX B
Component installation should have separation clearances that are maintained under all air
vehicle-operating modes. There should be clearance for hand tools required removing and
installing components. There should be sufficient space to remove and install components.
This may require additional access panels and doors.
(TBD)
B.4.4.2.1.17 Clearance.
Compliance with clearance requirements shall be verified by ___(TBS)___.
The best way to determine clearance is by close examination of installation mock-up(s) and by
examination of the air vehicle before and after flight tests. Tests may be required to
demonstrate maintenance of adequate clearances during dynamic operation; such as landing
gear, etc., and structural deflections caused by air loads, landing loads, etc.
TBS: Separation clearance under all static or operating modes should be verified by analysis,
inspection, and test.
(TBD)
B.3.4.2.2 Interface requirements.
Hydraulic power subsystem and component interfaces shall be identified and controlled to
ensure form, fit, and functional compatibility.
Interface baseline design data should be established in the air vehicle development phase to
minimize the need for extensive design changes that emerge during air vehicle assembly and
test.
Hydraulic power subsystem interfaces should be identified in hydraulic power subsystem design
reports and appropriate contractual documents.
358
JSSG-2009A
APPENDIX B
(TBD)
B.4.4.2.2 Interface requirements.
Hydraulic power subsystem interface(s) with other air vehicle systems shall be verified by
___(TBS)___.
Interface control data is necessary to ensure physical and functional compatibility.
Verification may be accomplished by analysis, demonstration, inspection and tests.
(TBD)
B.3.4.2.2.1 Electrical power system interface.

All electrical components shall operate with electrical power defined by (TBS) .
The quality and quantity of available power should be matched to the required needs of the
system and component operation(s).
TBS: The electrical power available should be defined at the system and component level. The
number of different electrical connectors should be identified and limited to reduce life-cycle
costs.
There have been cases where D.C. solenoids would not overcome component forces at
minimum voltage.
B.4.4.2.2.1 Electrical power system interface.

Electrical power system interfaces shall be verified by ___(TBS)___.
359
JSSG-2009A
APPENDIX B
Physical and functional compatibility with electrical system(s) is paramount for hydraulic power
subsystem(s) performance.
TBS: Operation of hydraulic power subsystem components at specified power should be

verified by system and component tests. Required performance should be demonstrated for all
variations permitted by the specification.
(TBD)
B.3.4.2.2.2 Support equipment (SE) interface.

Means shall be provided to mate with the following ground test and service equipment: (TBS)
.
All SE which is in operation and is expected to be compatible with new air vehicle systems
should be identified to ensure interface compatibility.
TBS: Identify SE such as hydraulic power carts and fluid filling equipment. Ground service
connections for hydraulic power subsystem checkout should be accessible at ground level for
maintenance personnel and be so specified. Further identify peculiar fittings to mate with the
SE.
System ground test provisions should be so designed that pressurization of any hydraulic power
subsystem in the air vehicle is not necessary in order to test another hydraulic power
subsystem.
(TBD)
B.4.4.2.2.2 Support equipment (SE) interface.

The interface of the hydraulic power subsystem with specified SE shall be verified by
___(TBS)___.
360
JSSG-2009A
APPENDIX B
Physical and functional interface of support equipment is essential for timely checkout and
maintenance.
Compatibility of SE should be verified by ground demonstration, analysis, and inspection.
(TBD)
B.3.4.2.2.3 Instrumentation interface(s).

Instrumentation interface(s) shall be identified.
The type and quantity of instrumentation needed for a subsystem is dependent upon the desires
of the operator and the complexity and flexibility of the subsystem.
As a minimum, the following instrumentation should be provided:

a. Hydraulic power system pressure (each system)
b. Low pressure indicator (each system).
A simple system requires limited instrumentation.
(TBD)
B.4.4.2.2.3 Instrumentation interface(s).

The presence of required instrumentation shall be verified by _(TBS 1) . The accuracy and
range of the instrumentation shall be verified by _(TBS 2) .
The physical and functional interface of instrumentation system(s) is essential to measure the
health of the hydraulic power subsystem(s).
361
JSSG-2009A
APPENDIX B
TBS 1: The presence of the required instrumentation should be verified by inspection and tests.
TBS 2: The accuracy and range of the instrumentation should be verified by component testing
and system calibration.
(TBD)
362
JSSG-2009A
APPENDIX B
B.5 PACKAGING
B.5.1 Packaging.
B.6 NOTES
not mandatory.)
B.6.1 Intended use.

The hydraulic subsystem descriptions in this appendix are intended for use in air vehicle
systems developed to perform combat and combat-support missions in environments unique to
military weapon systems.
B.6.2 Acquisition requirements.

a. Title, number, and date of the specification.
B.6.3 Definitions.
Inspection: Inspection is defined as visual verification that the system, including system
documentation, conforms to the specification requirements. Visual verification can be in the
form of inspection of the physical installation, or inspection of drawings showing physical
relationships, or review of documents reflecting qualification status with respect to specification
requirements.
Analysis: Analysis is defined as verification that specification requirements have been achieved
by evaluation of equations, charts, and reduced data, and by comparisons of analytical
predictions with available test data, etc. Verification analysis, however, does not include the
normal analysis of data generated during ground or flight-testing.
Demonstration: Demonstration is defined as an uninstrumented test where success is

determined by observation only, such as fit and function checks and tests that require simple
quantitative measurements.
363
JSSG-2009A
APPENDIX B
Test: Test is defined as verification of the specification requirements through the application of
established test procedures within specified environmental conditions and subsequent
compliance confirmation through analysis of the data generated.
Verification by similarity: When verification by similarity is proposed, it should be accomplished

by using verification data from previously developed and qualified items. The verification data
from the earlier verification should be submitted with design data to substantiate that:
a. The equipment is to perform a similar function in the new application as it did in its
earlier verification.
b. The environment and operating limits should be no more demanding or degrading than
in the earlier operation.
c. The new item does not incorporate differences that would invalidate the criteria of
“Inspection” or “Analysis,” above.
d. The equipment meets requirements of its earlier application(s) as indicated by its Mean
Time Between Failures (MTBF) and other field failure data.
Considerable effort is expended when similarity claims are made late in a program and rejected
by the procuring activity or additional testing is required. Similarity claims should be established
early in a program.
B.6.4 Acronyms.
The following list contains the acronyms/abbreviations contained within this document.
API Armor Piercing Incendiary
GSE Ground Service Equipment
SE Support Equipment
S-V Survivability-Vulnerability
TFE Tetrafluoroethylene
TR Temperature Retraction
364
JSSG-2009A
APPENDIX B
B.6.5 Subject term (key word) listing.

Burst pressure
Contamination
Fluid
Leakage
Moisture
Peak pressure
Pressure
Proof pressure
Pump
B.6.6 Responsible engineering office.
AFLCMC/EZFA, WRIGHT-PATTERSON AFB, OH 45433-7017; DSN 785-8625, COMMERCIAL
(937) 255-8625; AFLCMC.EZF.MAILBOX@US.AF.MIL. Requests for additional information on
this appendix can be obtained from AFLCMC/ENRS, 2145 MONAHAN WAY, WRIGHT-
PATTERSON AFB OH 45433-7017 USA; DSN 674-5476; COMMERCIAL (937) 904-5476;
AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.
B.6.7 Changes from previous issue.
365
JSSG-2009A
APPENDIX C
APPENDIX C
AIR VEHICLE AUXILIARY POWER SUBSYSTEM
C.1 SCOPE
C.1.1 Scope.
information for the Auxiliary Power Subsystem provided for in Part 1 of this specification. The
specifications. This appendix is a mandatory part of the specification. The information
contained herein is intended for compliance.
C.1.2 Structure.
C.1.3 Appendix.
C.1.4 Deviations.
366
JSSG-2009A
APPENDIX C
C.1.5 Environmental impact.
C.1.6 Responsible engineering office.
C.2 APPLICABLE DOCUMENTS

C. 2.1 General.
they are listed.
C.2.2 Government documents
C.2.2.1 Specifications, standards, and handbooks.

367
JSSG-2009A
APPENDIX C

STANAG 3372 Low Pressure Air and Associated Electrical Connections for Aircraft
Engine Starting
(Copies of this document are available at http://nsa.nato.int and www.ihs.com to qualified
users.)

JSSG-2007 Engines Joint Service Specification Guide
MIL-PRF-7808 Lubricating Oil, Aircraft Turbine Engine, Synthetic Base
MIL-PRF-23699 Lubricating Oil, Aircraft Turbine Engine, Synthetic Base, NATO Code
Number O-156
19111-5094 USA.)
C.2.3 Non-Government publications.
SAE INTERNATIONAL
SAE AIR713 Guide for Determining, Presenting, and Substantiating Turbine Engine
Starting and Motoring Characteristics
SAE AIR781 Guide for Determining Engine Starter Drive Torque Requirements
SAE AS943 Starter, Pneumatic, Aircraft Engine
SAE ARP949 Turbine Engine Starting System Design Requirements
SAE AIR1087 Aircraft Accessory Drag Torque during Engine Starts
SAE AIR1160 Aircraft Engine and Accessory Drives and Flange Standards
SAE AIR1174 Index of Starting System Specifications and Standards
SAE AIR1467 Gas Energy Limited Starting Systems
SAE AIR1639 Safety Criteria for Pneumatic Starting Systems
users.)
368
JSSG-2009A
APPENDIX C

ASME Paper 79-GT-95 Journal of Turbomachinery
(Copies of this document are available from https://www.asme.org/shop/journals on the ASME
Website at https://www.asme.org; ASME, Three Park Avenue, New York NY 10016-5990
USA.)
C.2.4 Order of precedence.
C.2.5 Streamlining.
section 2 (first tier). All other documents referenced through tiering may be used for guidance
369
JSSG-2009A
APPENDIX C
C.3 REQUIREMENTS
C.4 VERIFICATIONS
C.3.1 Definition
C.4.1 Definition
C.3.2 Characteristics
C.4.2 Characteristics
C.3.3 Design and construction
C.4.3 Design and construction
C.3.4 Subsystem characteristics
C.4.4 Subsystem characteristics
C.3.4.1 Landing subsystem
C.4.4.1 Landing subsystem
C.3.4.2 Hydraulic subsystem
C.4.4.2 Hydraulic subsystem
370
JSSG-2009A
APPENDIX C
C.3.4.3 Auxiliary power subsystem.
The auxiliary power subsystem (APS), in its performance of the functional requirements
specified in (TBS) , shall provide on-board auxiliary power generation, conversion and
transmission required by the air vehicle in the types, quantities, and duration of power required
by the interfacing subsystems for all applicable phases of vehicle operation and specific
performance requirements specified herein.
Auxiliary power subsystems are used to generate, convert, and transmit power for various
subsystems of the air vehicle.
TBS should reference the applicable section of the Air Vehicle Specification (section 3.5 of
JSSG-2001) that establishes the subsystems and their required functions.
In the context of this document, the term “auxiliary power subsystem” refers to those
subsystems that generate, convert and or transmit power on the air vehicle other than the main
propulsion system(s) and which are provided to interfacing subsystems, such as electrical and
hydraulic, for further conversion and distribution. The APS may include subsystems and
components such as Auxiliary Power Units, Emergency Power Units, Airframe Mounted
Accessory Drives, Power Take-Off Shafts, Ram Air Turbines, and Engine starting systems (Air
Turbine Starters, Jet Fuel Starters, and such). Given the current trend in the integration of
subsystem functions, the term APS does not have to be used to reflect the proposed peculiar
system solution containing these functions nor must these functions be grouped within this
category. However, all relevant requirements of this section should be addressed in the
applicable sections (however re-categorized) of the proposed solution.
Most manned air vehicle systems may require an on-board auxiliary power subsystem and
should use this and subsequent paragraphs as the requirements. For those systems that may
not require a separate on-board system, such as a missile, this requirement and possibly all
subsequent sub-requirements should be deleted.
Power requirements for all air vehicle subsystems during specified missions, ground
maintenance, and emergency conditions should be obtained and consolidated for proper
system selection and sizing. Some parameters that should be considered in determining
performance requirements are as follow:
a. Mission profiles
b. Power requirements or profiles of pneumatic hydraulic and electrical including number of
units; minimum and maximum rotational speeds; torque and speed; bleed pressure,
temperature, and flow-rate characteristics and efficiencies
c. Engine starting characteristics, including accessory drag during starting
d. Changes in drag characteristics due to ambient temperature variations
371
JSSG-2009A
APPENDIX C
e. Emergency power response time and duration

f. Ground maintenance and hanger-deck maintenance requirements
(TBD)
C.4.4.3 Auxiliary power subsystem.

Analysis and tests shall be conducted on the APS to validate the system’s capability to provide
the types and quantities of power which are required for operation of the air vehicle for all the
flight and ground conditions specified. Verification shall be accomplished incrementally and
shall consist of (TBS) .
Verification is necessary to assure that performance, interface, and functional requirements are
met.
TBS: The capability of the auxiliary power subsystem to provide the types and quantities of
power for the specified mission profiles should be evaluated during full scale engineering
development. The capabilities of the onboard equipment to deliver the required shaft power and
bleed air, at the temperature and altitude extremes typical of system requirements, should be
verified during qualification laboratory tests and during air vehicle ground and flight tests.

(TBD)
C.3.4.3.1 Secondary air vehicle power
C.4.4.3.1 Secondary air vehicle power
C.3.4.3.1.1 Mechanical power transmission.

When applicable, the APS shall transmit mechanical power from the engine(s) to the (TBS)
power conversion accessories at the appropriate torque and speed for the environments, loads,
attitudes, and misalignments resulting from the possible air vehicle ground and flight operations.
372
JSSG-2009A
APPENDIX C
This requirement establishes the needed capability of the accessory drive system, to include
airframe-mounted gearboxes and power takeoff shafts.
When airframe mounted accessory drive gearboxes are used in the proposed system, this
requirement should apply as written with the exception of the wording, “When applicable”.
Power transmission by means other than mechanical such as electrical, hydraulic, or
pneumatic, should be governed by the respective specification sections (see this specification
guide’s appendix B for hydraulic, appendix H for electrical, and appendix M for pneumatic).
TBS: Specify the power conversion accessories being driven. These may typically include
primary flight and utility system hydraulic pumps and electrical generators. Specialty devices
such as fuel and lubrication pumps, blowers or other equipment should also be included.
The environments, loads, attitudes, and misalignments are derived based on the equipment
location, mounting structure and flexibility, manufacturing tolerances, accessory demands, flight
capabilities and other factors. The specific derived values should be specified in the next lower
tier component specification.
(TBD)
C.4.4.3.1.1 Mechanical power transmission.

The power transmission capability of the APS shall be verified by analysis, bench tests, air
vehicle ground and flight tests, and demonstrations.
Verification is required to provide an acceptable degree of confidence in gearbox capability prior

to use on the air vehicle.
Verification should be accomplished by:

a. Analysis of power requirements, duty cycles, and installed system interface limitations
b. Analysis of predicted component and installed system performance and endurance
c. Component and system bench tests validating functionality, endurance capabilities, and
mechanical limits at maximum permissible misalignments
373
JSSG-2009A
APPENDIX C
d. Simulated environmental tests, analysis, or combinations of tests and analysis that

extend the test results to all specified environmental conditions
e. Air vehicle ground and flight tests and demonstrations that validate performance and
demonstrate integrated system functionality and capability
Proven gearbox endurance should precede usage time-cycles during the flight test program.
(TBD)
C.3.4.3.1.2 Power generation.

When applicable, the APS shall provide (TBS 1) power generation in accordance with the
requirements of (TBS 2) for all phases of vehicle operation.
This requirement establishes a key functional capability for the APS system and identifies
supporting requirements.
This requirement is applicable when the APS is required to provide direct primary electrical,
pneumatic, hydraulic power generation, or combinations thereof for the air vehicle.
TBS 1 should specify the type of non-propulsive power to be provided such as primary air
vehicle electrical, pneumatic, hydraulic. A distinction as to the nature of the power usage, such
as primary, back-up, emergency, utility, should be included in the description.
TBS 2 should specify the air vehicle subsystem section that specifies the requirements for that
type of power (appendix B for hydraulic, appendix H for electrical, and appendix M for
pneumatic).
(TBD)
374
JSSG-2009A
APPENDIX C
C.4.4.3.1.2 Power generation.

The power generation capability of the APS shall be verified by analysis, bench tests, air vehicle
ground and flight tests, and demonstrations.
Verification will insure that the APS will properly provide the required primary flight system
power.

a. Analysis of power requirements, duty cycles, and installed system interface limitations
b. Analysis of predicted component and installed system performance
c. Component and system bench tests validating functionality, performance and endurance
capabilities
d. Simulated environmental tests or analyses (or both) that extend the test results to all
specified environmental conditions
e. Air vehicle ground and flight tests and demonstrations that validate performance and
demonstrate integrated system functionality and capability.
(TBD)
C.3.4.3.2 APS starting.

The on-board auxiliary power generation equipment shall start, without exceeding any APS
operating limits, in the time required to support (TBS 1) requirements as specified in (TBS 2) .
The system shall start and operate on the ground throughout the air vehicle temperature and
pressure altitude ranges as specified in (TBS 3) . In-flight, the APS shall start and operate
throughout the air vehicle temperature and pressure altitude range defined in (TBS 4) .
Preconditioning of the subsystem components shall not be required, except as follows: (TBS 5).
The ability of the APS to start in a timely manner is critical to achieving higher air vehicle level
readiness, launch or emergency functional support requirements. The remaining portion of this
requirement is needed to define the temperature and altitude starting capability of the onboard
auxiliary power subsystem and preconditioning necessary to make a successful start at the
specified ambient environments.
375
JSSG-2009A
APPENDIX C
Air System, Air Vehicle and other interfacing subsystem level requirements should be evaluated
as to the need for a start time requirement.
TBS 1 should be filled in with the type of requirement to be supported. These would include air
vehicle readiness, rapid reaction launch, emergency power response, or a combination of these.
Maintainer requirements and needs should also be considered.
TBS 2 should be filled in with the appropriate document or specification number and paragraph
associated with the requirement(s) to be supported. In some situations where the requirement
is a derived value, such as may be the case with emergency response power, no higher level
document or paragraph will be available to be referenced in TBS 2. Hence the “as specified in
TBS 2” portion of the requirement should be deleted and consideration be given to specifying
the actual time requirement in its place. Actual time allocation of the total “system” requirement
to the various APS equipment generally should be specified at the next lower tier specification.
In the absence of any higher level or derived requirements, starting performance experienced
with similar commercial and military systems should be utilized (typically no greater than
30 seconds).
TBS 3 should reference the air vehicle ground operational envelope from the Air Vehicle
Specification.
The capability to start and operate the system in-flight may be required to supplement air
vehicle power demands under certain flight modes, mission scenarios or in-flight emergencies
by providing extra power capacity or by unloading the main engine(s) of bleed and or
mechanical power extraction loads. Generally, this is a capability that is inherent in most
systems and can enhance air vehicle survivability with little system penalty, depending upon the
desired operational envelope. A multi-position door may be required for improved performance.
TBS 4 should define a flight envelope if in-flight starting is required.
A tradeoff should define the optimum compromise between start system sizing, insulation,
location, and preconditioning impact on logistics and operation. Limiting preconditioning
reduces special actions required prior to air vehicle launch, reduces burdens on maintenance
personnel, and may limit special ground support equipment. Generally, with the exception of
batteries (which are sometimes used for auxiliary power unit (APU) starting and emergency
power), no special external thermal conditioning should be required for APS equipment.
TBS 5 should define any preconditioning requirements.
Industry documents (SAE AIR1467, SAE AIR1639, and ASME Paper 79-GT-95) contain
additional information.
(TBD)
376
JSSG-2009A
APPENDIX C
C.4.4.3.2 APS starting.

APS starting shall be verified by (TBS) .
Verification is needed to assure adequacy of APS starting and the APS starting system.
TBS: A review of trade studies should be accomplished verifying that an optimum solution of
start system sizing, insulation, location, and preconditioning impact on logistics and operation
has been achieved.
Verification should be by a combination of analysis, bench tests of components and subsystem

including temperature and altitude extremes, APS test stand tests, air vehicle ground and flight
tests and analysis that extends the test results to all specified conditions.
To verify the low and high temperature starting capability, the equipment, including the starting
system, should be soaked to the condition that it would encounter when installed in an air
vehicle exposed to the specified extreme temperatures.
(TBD)
C.3.4.3.2.1 APS start system capacity.

The APS starting subsystem shall provide the capacity for (TBS 1) ground start(s) at
temperatures (TBS 2) . In flight, when required to meet emergency requirements of
“Emergency power” and the airstart requirements of “APS starting” in this appendix, the starting
subsystem shall provide sufficient capability to achieve successful start throughout the APS
temperature and pressure-altitude envelope in the first start attempt.
APS start systems generally use stored energy from an on-board, limited capacity source.
Once depleted without a successful start, re-servicing with ground support equipment may be
required to recharge the system that may impact the mission. This requirement establishes the
necessary start system capability in support of mission and air vehicle survivability
requirements.
TBS 1 should be filled in with the number of ground starts desired. The anticipated starting
reliability and design of the APS equipment should dictate the number of ground starts to be
required. First starts of the day or first starts after maintenance could be problematic due to air
in the fuel lines, moisture or other factors effecting ignition thereby necessitating a two-start
capability. However, providing such capability under very low temperature conditions, could
377
JSSG-2009A
APPENDIX C
result in an excessively large system that may not be in the best interest of the total weapon
system. Hence, only a single attempt is usually specified for low temperatures. Typically a
temperature value in the range from -20 to 0 F is selected, below which, only single start
attempt capability is required.
TBS 2 should specify the applicable temperature conditions.
(TBD)
C.4.4.3.2.1 APS start system capacity.

The capacity of the start system shall be verified by (TBS) .
Verification is needed to assure adequate capacity of the APS starting system.
TBS: Verification should be by a combination of analysis, bench tests of components and

subsystem including temperature and altitude extremes, APS test stand tests, air vehicle ground
and flight tests and analysis that extends the test results to all specified conditions.
(TBD)
C.3.4.3.2.2 APS start system charging.

The APS starting subsystem shall be replenished or recharged automatically by onboard
equipment during operation of the APS or main engine(s) and have ground accessible
provisions and capability for replenishment by ground support equipment.
This requirement establishes methods for replenishing the APS start system that impacts
mission readiness and maintainability. Automatic recharge eliminates the need for equipment
and manpower intensive ground service after each use.
378
JSSG-2009A
APPENDIX C
Depending upon mission readiness and maintainability requirements, the requirement should be
applied directly. For systems that may have a single use duty cycle, such as may be required
for a cruise missile, only ground servicing provisions should be specified.
(TBD)
C.4.4.3.2.2 APS start system charging.

The capability of the APS to be recharged by on-board equipment shall be verified by (TBS) .
The capability of the system to be charged from ground support equipment shall be verified by
air vehicle ground tests.
Verification is needed to assure the APS starting system has the capability of being recharged
by the appropriate equipment.
TBS: Verification should be by a combination of bench testing of components, APS test stand
tests, air vehicle ground and flight tests and analysis that extends the test results to all specified
conditions.
(TBD)
C.3.4.3.2.3 APS start system recycle.

The time required to replenish or recharge the APS start system to a fully functionally capable
status shall be consistent with air vehicle readiness and emergency power requirements.
This requirement is needed to define mission-critical performance. Air vehicle on "ALERT"

status must be mission ready continuously.
379
JSSG-2009A
APPENDIX C
Depending upon the air vehicle readiness, safety and other APS functional requirements, a
recharge time should be allocated to the APS start system and specified in the next lower tier
equipment specification. The capability to return immediately to mission-ready status following
training alerts, false alerts, or aborted alerts should not be degraded by start system recycling
requirements. If the start system is an integral part of the emergency power function, it should
be ready before the air vehicle can take flight.
(TBD)
C.4.4.3.2.3 APS start system recycle.

The proper allocation of time to recharge shall be verified by analysis of simulated usage and
mission scenarios. APS return to readiness status shall be verified.
Verification is necessary to insure that the starting system does not require more than the
appropriately allocated amount of time to return to ready status following shutdown.
Verification should be by a combination of bench testing of components, APS test stand tests,
air vehicle ground tests and analysis that extends the test results to all specified conditions.
(TBD)
C.3.4.3.3 Main engine starting.

The APS shall provide power to start the main engine(s) throughout the air vehicle ground
temperature and pressure altitude ranges within the time allocated to support the air vehicle
readiness, rapid launch and propulsion system requirements, while simultaneously providing
power for air vehicle subsystem loads required during engine starting without exceeding any
engine and APS starting or operating limitations.
This requirement is needed to establish the constraints on a key functional requirement of main
engine starting which can have significant impact on APS system design and sizing.
380
JSSG-2009A
APPENDIX C
The APS should provide adequate power for starting the main engine(s) in the time required to
meet air vehicle rapid launch requirements, general readiness and any propulsion system
requirements. Engine start times as derived from alert response requirements should dictate
APS torque or power levels required. If no air vehicle requirements are specified, then typical
start times as experienced throughout the aerospace industry (approximately 45 seconds
standard day at sea level conditions, per engine and 60 seconds on a hot or cold day sea level
conditions) should be used. Engine characteristics can be obtained from the applicable engine
specification or the Engine Airframe Interface Control Document (ICD). APS and engine
operating limitations that should be observed include but are not limited to:
a. Acceleration rates
b. Torque limits
c. Maximum exhaust gas temperatures (EGT)
d. Time in start window.
Power source redundancy may be necessary to provide flexibility and meet mission
requirements. Starting by ground support equipment and air vehicle self-sufficiency (such as
onboard starting equipment) may be required. For additional guidance, refer to C.3.4.3.3.1, as
well as Industry standards (SAE AIR944 (NONCURRENT), SAE AIR1174, and SAE ARP949)
for additional information.
Design consideration for sizing the starter should include the torsional spring constant of the
entire drivetrain, the drivetrain total backlash, the speed ratio between the starter pad and driven
rotor system and the effective mass moment of inertia and drag of all rotating parts. The
drivetrain should be designed to accept impact loads and other dynamic loads that can occur
during startup.
(TBD)
C.4.4.3.3 Main engine starting.

The capability of starting main engines within required times and without exceeding any engine
or APS operating limitations with simultaneous air vehicle subsystem loads shall be verified by
(TBS) .
This verification is to assure required main engine start capability with simultaneous air vehicle
demands on the APS. For air systems with alert or mission readiness requirements (or both), it
is essential to accurately verify engine start times to determine if air vehicle response time can
be met.
381
JSSG-2009A
APPENDIX C
TBS: Verification should consist of bench tests, air vehicle ground tests and analysis of engine
design data and test data. For new complex APS, verification on an integrated test stand may
also be required.
The capability of the starting methods to provide the specified power should be verified by
laboratory testing. Ground and in-flight air vehicle tests should be conducted to verify that the
engine can be satisfactorily started by the methods specified.
Bench verification testing adequately demonstrates equipment power producing capability.

Accurate analysis of the impact of installation losses on starting performance (such as pressure
loss, flow loss, duct leakage, current loss, or mechanical losses) can be verified only by air
vehicle testing.
Ground and flight start tests should be conducted. Starting performance curves should be
generated. (SAE AIR713 contains additional information.)
Utilizing the defined power sources, figures showing the main engine starting characteristics
versus starter output torque-speed characteristics at the normal and worst case environmental
conditions should be presented. Ground and in-flight capability should be shown (refer to
SAE AIR781 and AIR1087 for additional information).
With the air vehicle established in a simulated alert status, the APS should be started and main
engine starting should follow immediately. Environmental conditions for the test should be
defined. The total elapsed time from initiation of the start cycle to final engine idle speed should
be within the allocated time. Verification of start times for the most critical conditions should be
provided.
The air vehicle should be exposed to the required extreme environmental conditions and the
main engines started using the required power sources. The started main engine should attain
idle revolutions per minute (RPM) when employing the required power sources.
Experience has shown that engine start characteristics vary greatly from design predictions.
Testing has provided one of the best methods to assess system performance and indicate
where modifications may be required.
382
JSSG-2009A
APPENDIX C
C.3.4.3.3.1 Alternative power sources.

A means of utilizing alternative sources of starting power such as cross bleed power or ground
power sources shall be provided to meet air vehicle mission requirements.
When the calculated reliability of the primary starting mechanism or power source will not meet
mission specified requirements, the capability of utilizing alternative sources of power for the
main engine starter should be provided.
The need for utilization of alternative power sources should depend on the expected main
starting system reliability, the mission criticality of the air vehicle and survivability
considerations. Alternate power sources should include other main engines and ground cart for
pneumatic or electrical power. Use of pneumatic ground carts should require that connections
be compatible with requirements of NATO STANAG 3372. Start time is not critical when using
an alternative power source.
Generally, on-board pneumatic power start systems should have the capability to use a ground
cart or, as the available facilities may dictate, pneumatic supply from another air vehicle.
One Air Force bomber system had two APUs, each coupled to two remote gearboxes, all of
which had to operate properly to start the engines. Failure of any one of these devices could
have resulted in non-flyable status. To provide starting power to any engine not capable of
receiving power by the normal means, a pneumatic probe starter was developed to connect
directly into the engine-mounted gearbox. Pneumatic power could be directed from another
operating engine through an externally connected hose.
Two modern day USAF fighter air vehicles do not have the capability to use alternative power
sources and cannot be launched until failed equipment is repaired. However, another modern
day USAF fighter has its emergency power function integral to the engine starting function,
hence if the APS cannot start the engines, having the capability to start from an alternative
power source provided no advantage since the “safety critical” emergency power function would
not be available for the mission.
383
JSSG-2009A
APPENDIX C
C.4.4.3.3.1 Alternative power sources.

Verify by analysis and air vehicle test that the APS provides a means of utilizing alternative
power sources for main engine starts.
Capability must be proven by air vehicle test since other verification methods cannot assure
adequacy of design.
Testing should be conducted during air vehicle ground testing. Capability at environmental
extremes should be verified.
(TBD)
C.3.4.3.3.2 Starting conditions.

The starting system shall be capable of performing main engine start(s) under all airframe
operational and maintenance configurations that may require engine operation and under the
environmental conditions stated in JSSG-2001, “Environment”. Ground start capability shall be
provided for ambient conditions (TBS) .
This requirement defines and limits restrictions to starting the main engines.
Airframe effects, such as movable wings, cargo doors, or unique configurations in addition to
the starting power generator (such as auxiliary power unit and jet fuel starter) and its physical
interfaces; inlet and exhaust door locations, should be evaluated.
TBS should be filled in with the allowable extremes of temperature, pressure, wind direction and
velocity, and other relevant ambient conditions, from the applicable air vehicle specification
paragraph that specifies ground operating conditions.
(TBD)
384
JSSG-2009A
APPENDIX C
C.4.4.3.3.2 Starting conditions.

Verification that the APS is capable of performing main engine start(s) under the required
airframe configurations and environments specified shall be by (TBS) .
Verification is needed to insure the capability of the engines to start within the limits specified.
TBS: Verification should be accomplished by a combination of APS test stand tests, air vehicle
ground and flight tests and analysis of interfacing airframe designs and test data.
Testing should be conducted over the entire air vehicle operating envelope. Simulations of
defined conditions may be required.
(TBD)
C.3.4.3.3.3 In-flight starting assist.

The APS shall assist in-flight main engine starting by motoring the engine core rotor within the
envelope defined in the air vehicle - engine ICD (TBS) , while simultaneously providing any
required secondary power as specified in “Secondary air vehicle power” and emergency power
as specified in “Emergency power” in this appendix, as applicable.
This requirement defines the required in-flight starting assist capability based on air vehicle
survivability requirements and anticipated operable engine flameout potential. Since the
windmill start regime of turbofan engines generally requires airspeeds in excess of that which
can be achieved at reasonable dive angles with all engines out, an airstart assist capability may
be required.
As a minimum, a single-engine air vehicle should be provided in-flight starting capability.

Regardless of the number of engines, if normal start equipment is on-board, air vehicle
survivability would be enhanced if this equipment were to be made air operable and capable of
providing power assist to the engine. The parameters that should be considered in providing
this capability are as follow:
a. Air vehicle flight envelope
b. Accessory drag characteristics
c. Engine starting characteristics
385
JSSG-2009A
APPENDIX C
d. Engine susceptibility to flameout

e. Aerodynamic-installation characteristics
f. Air vehicle speed
g. Air vehicle descent profile
h. Minimum engine speed
i. Probability of a re-light.
TBS should specify the applicable engine - air vehicle ICD that should contain “assisted airstart”
envelope of the engine.
(TBD)
C.4.4.3.3.3 In-flight starting assist.

In-flight starting assist capability shall be verified by (TBS) and air vehicle flight tests at the
specified envelope extremes.
Verification is needed to verify the specified engine in-flight starting assist envelope. Flight tests
are required since experience shows variations between actual and predicted performance are
probable.
TBS: Verification should generally be accomplished by a combination of bench and cell tests of
the subsystem including simulated altitude and temperature extreme tests, air vehicle flight
testing, and analysis of data from these tests and from the engine manufacturer’s test stand,
cell, and ground tests to extend results to all specified conditions.
Assisted air starts should be conducted at the extremes of the altitude versus speed envelope.
The APS should deliver the power required to assure that the engine core rotor can be
maintained at sufficient speed for a properly operating engine to reach idle RPM.
(TBD)
386
JSSG-2009A
APPENDIX C
C.3.4.3.3.4 Start cycle control.

Control of the start cycle shall be automatic from initiation to starter cutout, including start
system re-engagements during main engine spooldown restarts.
This requirement defines the means for starting the engines based on operational requirements.
Generally, start initiation is by means of a single switch in the cockpit that provides automatic
starter operation from initiation to starter cutout. The starter should be provided a speed
responsive cutout device that will terminate the power supplied to the output shaft at the speed
at which the engine no longer requires starter assist. A device should be designed to be fail-
safe in the event of loss of activation signal. An automatic engagement-disengagement
mechanism should be used to limit the burden on the crew and assure that distraction of the
crew during the starting sequence will not result in catastrophic failure. The overriding
parameters of concern within this area should be safety and human factors.
It is desirable for engines requiring air start assist that the starter mechanism be designed to
engage at all engine speeds. Turbine starters with clutch limitations should at least be capable
of re-engaging an engine that is at the maximum steady state windmilling speed or 30 percent
(30%), whichever is higher. Most current air turbine starters are capable of engagements at
speeds of 30 percent (30%). This capability enhances engine in-flight starting capability and air
vehicle survivability by allowing faster engagement for quicker engine starts with less altitude
loss. This margin should also be adequate for ground restarts in the event the start switch is
activated prior to rotor stoppage. (Refer to SAE AS943 for additional information.)
(TBD)
C.4.4.3.3.4 Start cycle control.

Verification of the start cycle control capability shall be by (TBS) .
Verification is needed to insure the capability of the engine starting control system including
associated logic functions.
TBS: Verification should consist of component bench tests of controller logic and starter
engagement-disengagement mechanisms, system-vehicle integration facility tests and air
vehicle ground and flight tests. System-vehicle integration laboratories and facilities are
387
JSSG-2009A
APPENDIX C
generally desired to evaluate the control logic interactions between the various subsystems on
the air vehicle prior to actual installation and test on the air vehicle. An air vehicle main engine
start test should be conducted utilizing the initiation and control methods specified.
Engine starting is generally verified by air vehicle ground testing to assure proper and safe
operation of the integrated system.
Air vehicle spooldown engagement testing should be minimized to limit potentially more
expensive damage to the equipment. Running engagements should be accomplished at the
maximum permissible speeds. Inertia loads comparable to expected engine inertia should be
applied to the starter output shaft. (Refer to SAE AS943 for additional information.)
(TBD)
C.3.4.3.3.5 Start cycle termination.

It shall be possible to terminate the starting cycle at any time without damage to APS
equipment.
A significant potential for start cycle interruption exists. Equipment damage from such a
probable occurrence is economically and operationally unacceptable.
Generally, no special features are necessary to meet this requirement. (Refer to SAE AS943
for additional information.)
(TBD)
C.4.4.3.3.5 Start cycle termination.

Termination of the starting cycle any time during the start cycle without damage to APS
equipment shall be verified by bench and air vehicle ground testing.
Verification is needed to insure the capability to terminate a start cycle without damage to the
APS.
388
JSSG-2009A
APPENDIX C
Testing of APS components, such as auxiliary power unit, jet fuel starter, and air turbine
starters, should include start cycle interruptions. Start cycle interruptions to APS should be
made during air vehicle ground testing.
Bench and test stand tests should be used until equipment integrity is verified to prevent air
vehicle damage or development schedule delays.
(TBD)
C.3.4.3.3.6 Start duty cycle.

The APS shall be capable of performing (TBS 1) consecutive main engine starts on the
ground, with a maximum time interval of (TBS 2) seconds from the completion of one cycle
to the initiation of the next, followed by the ability to meet the motoring requirements of “Engine
motoring” in this appendix. In flight, the starting function shall be capable of providing
continuous main engine assist for a period consistent with a worst case all engines out scenario.
This requirement is needed to define system capabilities as a result of mission, reliability and
safety performance requirements. Air vehicles on "ALERT" status must be mission ready
continuously. The capability to accomplish a main engine start following an aborted attempt or
the ability to motor the engine following a hot or hung start must not be degraded by start
system limitations.
TBS 1 should be filled in with the number of consecutive starts to be required.
TBS 2 should be filled in with the maximum number of seconds permitted between starts.
Generally, with the capability of conducting at least two consecutive main engine starts on the
ground within 30 seconds of each other should be required. The actual criteria for this
requirement should be based on expected usage scenarios resulting from mission completion
and engine reliability and failure mode criteria.
(TBD)
389
JSSG-2009A
APPENDIX C
C.4.4.3.3.6 Start duty cycle.

APS start duty cycle capability shall be verified by (TBS) .
Verification is necessary to insure the APS has the capability to perform and endure the engine
starting and motoring function for the duty cycle specified.
TBS: Verification should be by analysis of in-flight engine out scenarios, bench testing, and air
vehicle testing.

(TBD)
C.3.4.3.4 Emergency power.

Emergency power shall be provided as follows: (TBS) .
Many air vehicle systems require emergency power such as the flight control system, fuel
system, electrical system, and engine start system, in the event of normal power failure. There
are conditions where the capabilities of the emergency power source may be restricted by
extreme attitudes (inverted flight or uncontrolled flight). The period of time that emergency
power can be provided (for example, the power level and duration) affects pilot and air vehicle
survivability.
TBS: The emergency power may be required to provide emergency hydraulic and electrical
power for primary flight control in the event of primary power failure anywhere in the permissible
envelope. Individual accessories such as a generator or hydraulic pump may fail. Loss of the
total secondary power system due to engine failure, power takeoff shaft failure, gearbox
damage, or such, is also possible. Emergency power should at minimum provide the quantity
and duration of power required to recover an air vehicle to a safe ejection envelope. It is
generally desirable to provide adequate power to permit stable air vehicle control for attempted
assisted engine restart, air vehicle decent and recovery. The emergency power source can be
a means of providing for assisted main engine air starts (single attempt or multiple attempt
capability). Air vehicle design and mission requirements should be considered when defining
emergency power requirements.
390
JSSG-2009A
APPENDIX C
(TBD)
C.4.4.3.4 Emergency power.

Emergency power capability shall be verified by (TBS) .
Adequate quality and quantity of power for flight control and other functions necessary for safe
operation of the air vehicle during designated emergency conditions must be assured. Bench
and ground testing provide operability and performance levels. Flight testing verifies functional
capabilities for defined emergency situations.
TBS: Verification of emergency power capability should include analyses of various simulated
air vehicle emergency scenarios, bench tests, system-vehicle integration facility tests, and air
vehicle ground and flight tests.
Simulated emergency power demands should be placed on the APS. Extreme flight conditions
should be simulated in test cells.
(TBD)
C.3.4.3.4.1 Emergency power operation.

Emergency power operational characteristics shall be as follow:
a. Emergency power shall be provided automatically upon detection of a critical power loss.
The capability for manual activation by the flight crew shall be provided.
b. Transition to emergency power shall not interrupt flight critical control systems operation
or result in unstable air vehicle operation.
c. (TBS) .
This requirement establishes critical operational characteristics of providing emergency power

should it be required. Many current day air vehicle systems cannot tolerate even momentary
power interruptions such that detection of a critical power loss and activation of the emergency
power source must be accomplished automatically. Since all emergency situations cannot be
foreseen, a manual activation capability should also be provided. The activation and transition to
emergency power should be transparent to operation of critical flight control systems.
391
JSSG-2009A
APPENDIX C
The requirements “a” and “b” should usually apply depending upon the design of the air vehicle
“power” architecture.
TBS should define other critical operational characteristics as appropriate for the application.
(TBD)
C.4.4.3.4.1 Emergency power operation.

Emergency power operational characteristics shall be verified by (TBS) .
Verification is needed to insure that specified initiation and control functions perform as required
to provide the types and quantities of emergency power.
TBS: Verification should include component and subsystem bench tests, system-vehicle
integration facility tests, air vehicle ground tests, and air vehicle flight tests. Anticipated
operational conditions such as extreme attitudes, load transients, and intermittent operation
should be simulated.
Laboratory and ground testing should be used to verify control function and overall operability
with minimum risk. Flight testing should be used as the means of demonstrating installed
emergency power performance.
(TBD)
392
JSSG-2009A
APPENDIX C
C.3.4.3.5 APS operation for air vehicle ground support.

The APS shall have the capability to provide self-sufficient (no ground support equipment) air
vehicle ground operations and maintenance support to the extent specified. The capability to
use ground support equipment for maintenance shall be included in the design.
This requirement establishes a key functional capability to support ground maintenance

activities without the use of ground support equipment.
The need for self-sufficiency should be dependent upon the maintainability philosophy
established in the Operational Requirements Document and JSSG-2001, as well as logistic and
deployment requirements. Self-sufficient capability should typically require the system to start,
operate, and provide electrical, hydraulic and pneumatic power, as applicable and without
assistance from ground support equipment, in support of performing ground maintenance
activities such as interfacing subsystem diagnostic and functional checkouts, air vehicle
servicing and weapons loading. Considerations associated with such a requirement should
include:
a. Duty cycle and heat load definition.
b. An operational noise level which would permit maintenance personnel to communicate
with each other.
c. Exhaust and inlet location and design that allows access to applicable areas of the air
vehicle.
(TBD)
C.4.4.3.5 APS operation for air vehicle ground support.

The capability of the APS to support self-sufficient ground operations and maintenance support
shall be verified by (TBS) . The capability to use support equipment shall be verified by
inspection of design drawings and air vehicle demonstration.
Verification is needed to insure the capability of the APS to support air vehicle self-sufficiency
during ground maintenance.
393
JSSG-2009A
APPENDIX C
TBS: Verification should include analysis, subsystem bench tests, and air vehicle ground
demonstrations and tests.
Anticipated loads, duty cycle and heat rejection requirements should be analyzed and defined.
Subsystem bench testing should validate capability of performing under the required conditions
and duration. Air vehicle demonstrations and tests of the integrated system should be
accomplished to validate that the system functions properly in the installed environment and
does not create an unsuitable environment for the maintainer.
(TBD)
C.3.4.3.5.1 Engine motoring.

The APS shall provide the capability for motoring the main engine at speeds and duration
required to meet any engine operational, maintenance or emergency scenarios using power
from either of the following power sources: (TBS) .
Motoring capability may be required before normal engine starts, for engine cooling after a hung
start, and to accomplish maintenance checkouts, and engine washing.
Engine motoring requirements generally should be based upon the operational and
maintainability needs of the selected main propulsion engine. Engine requirements,
maintenance procedures and emergency (for example, hung start) scenarios should be
analyzed to define the proper speed and duration requirements. Generally, five minutes of
motoring should be used to accomplish engine maintenance checkout and cleaning. The
specific engine specification or the engine - airframe ICD may address any specific
requirements. The Engines Joint Service Specification Guide, JSSG-2007, may be consulted
for general guidance.
TBS should be filled in by specifying the power sources (such as APS pneumatic, hydraulic or
electrical; ground cart pneumatic, hydraulic or electrical; operating engine pneumatic, hydraulic
or electrical; or facility pneumatic, hydraulic or electrical) that will be utilized in performing this
capability.
(TBD)
394
JSSG-2009A
APPENDIX C
C.4.4.3.5.1 Engine motoring.

The capability of main engine motoring system by the specified power sources shall be verified
by (TBS) .
Verification is to insure that the engine motoring system has the motoring capability required to
perform the necessary tasks.
TBS: Verification should be accomplished by analysis, bench tests, and air vehicle ground tests
as follow:
a. Analysis of any engine requirements, maintenance procedures and emergency
scenarios that establish the required motoring speeds and duration.
b. Analysis of predicted system performance from the various power sources using
estimated system losses and efficiencies.
c. Component bench tests validating component efficiencies and endurance capabilities.
d. Analysis that extends the test results to all specified environmental conditions.
e. Air vehicle ground testing that validates estimated system losses and demonstrates
integrated system functionality and capability.
(TBD)
C.3.4.3.5.2 Systems ground operational power.

The APS shall provide the necessary power combinations of hydraulic, electrical and pneumatic
power required to perform uninterrupted (TBS) .
Specifying the type of maintenance activities to be performed on an uninterrupted basis is

required such the APS can be sized to meet to maintainability and mission readiness
requirements.
TBS should be filled in with consideration given to the following scenarios:

a. any single avionics, vehicle management system, flight control, hydraulic, or electrical
system checkout
395
JSSG-2009A
APPENDIX C
b. servicing and corrective maintenance

c. weapons loading.
(TBD)
C.4.4.3.5.2 Systems ground operational power.

The capability of the APS to provide the necessary power combinations of hydraulic, electrical
and pneumatic power required to perform the specified tasks on an uninterrupted basis shall be
verified by (TBS) .
Verification is needed to ensure the APS can supply adequate power for performing the tasks
specified.
TBS: Verification should be accomplished by analysis, bench and air vehicle ground tests as
follows:
a. Analysis of power requirements, duration and installed system interface necessary to
accomplish the maintenance activities specified.
b. Analysis of predicted component and installed system performance
c. Component bench tests validating component efficiencies and endurance capabilities.
d. Analysis that extends the test results to all specified environmental conditions
e. Air vehicle ground tests that validate estimated system losses and demonstrate
integrated system functionality and capability.
(TBD)
C.3.4.3.5.3 Maintenance limitations.

APS operating time shall not limit maintenance tasks performed using onboard power with the
exception that engine motoring shall be no less than that specified in “Engine motoring” in this
appendix.
Establishing duration requirements is necessary such that the APS can be designed for proper
endurance. Maintenance tasks must be able to be performed on an uninterrupted basis.
396
JSSG-2009A
APPENDIX C
Requirement applies to systems with self-sufficiency requirements.
(TBD)
C.4.4.3.5.3 Maintenance limitations.

The capability of the APS to not constrain the performance of maintenance tasks as a result of
operating time limitations shall be verified by (TBS) .
Verification is needed to assure that there are no APS operating time limitations that will impact
the performance of maintenance tasks.
TBS: Verification should be accomplished by analysis, bench and air vehicle maintenance
ground demonstrations as follows:
a. Analysis of power requirements, duration and installed system interface necessary to
accomplish the maintenance activities specified.
b. Analysis of predicted component and installed system performance.
c. Component and subsystem bench tests validating endurance capabilities.
d. Analysis that extends the test results to all specified environmental conditions.
e. Air vehicle maintenance ground tests and demonstrations that validate integrated
system endurance capability.
(TBD)
C.3.4.3.5.4 Noise.
The APS noise level shall be consistent with the human factor requirement specified in air
vehicle specification (TBS 1) . Mission-related noise level requirements shall be as follow:
(TBS 2) .
This is required to prevent injury to personnel and to establish noise level requirements for
specific mission needs.
397
JSSG-2009A
APPENDIX C
From the personnel safety perspective, noise level requirements should be specified at the air
vehicle level (“Acoustic noise” of JSSG-2001).
TBS 1 should specify the applicable air vehicle document and paragraph for this air vehicle
system. Typically, this should require that personnel exposure to acoustic noise not exceed the
levels stated in AFR 161-35.
TBS 2 should specify any more restrictive noise level requirements that would be associated
with a particular mission. The need to conduct a conversation in the immediate area of the air
vehicle with the APS operating, as may be the case for a high level diplomatic mission, would
be an example where more restrictive requirements would be applicable.
(TBD)
C.4.4.3.5.4 Noise.
Compliance with the noise requirements specified shall be by air vehicle ground tests and
analysis.
Verification is required to insure personnel safety and capability of meeting mission

requirements.
Control of noise levels are highly dependent upon the installation design, hence ground tests
and analysis of the data thereof should be performed on the air vehicle.
(TBD)
398
JSSG-2009A
APPENDIX C
C.3.4.3.5.5 Decoupling.
Means shall be provided to prevent unintentional disengagement and reengagement of the APS
power transmission system from the main engine(s) when decoupling capability is provided as
an alternative method of driving the air vehicle accessories (hydraulic pumps and generators)
for ground maintenance.
Requirement is necessary for air vehicle and personnel safety. Unintentional disengagement of
a decoupling system during flight could result in loss of primary and hydraulic power and place
the air vehicle at risk. Likewise, unintentional reengagement of the decoupling system on the
ground while maintenance personnel may be working in the area represents a serious
personnel hazard.
An APU, jet fuel starter (JFS), or a ground power cart may be used to drive the remote
gearboxes via pneumatic (such as an air turbine starter), or mechanical link. Decoupling may
facilitate use of the secondary power source and remote gearboxes for ground checkout and
munitions loading. If such design solutions are incorporated, the stated requirement should be
applied.
Decoupling mechanisms have been shown to add increased complexity to a gearbox and to
adversely impact the transmission system’s reliability.
C.4.4.3.5.5 Decoupling.
The capability of a means to prevent unintentional disengagement and reengagement of the
APS transmission components from the main engine shall be verified by (TBS) .
Verification is needed to insure that decoupling is possible, that inadvertent engagement and
disengagement will not occur and that the specified functions can be successfully
accomplished.
TBS: Verification should consist of component bench tests, air vehicle ground tests and
maintenance operation demonstrations. Testing should be conducted to verify that
unintentional engagement and disengagement is not possible.
399
JSSG-2009A
APPENDIX C
(TBD)
C.3.4.3.6 Fuels.
The APS shall meet the performance specified herein when supplied with fuels as follows:
(TBS) .
This requirement is needed to specify fuel characteristics by which auxiliary power subsystem
performance will be based and the performance limitations resulting from use of other fuels
which may have to be used in the event that the primary fuel is not available.
TBS: Generally, most auxiliary power generating equipment should use the same fuel as the
main engine. Reference should be made to appendix E, “Fuel designation” and “Fuel
contamination”. APS performance differences when operating with other than the primary fuel,
such as alternate or emergency fuels, should be specified. The APS should start and operate
using the alternate fuels specified. There should be no effect on the established overhaul time
for the APS. Limits on operating time and storage time with alternate fuels should be specified.
If fuels other than the air vehicle primary type are selected to power the APS, they should be
specified as appropriate. When using fuels other than that used for the primary air vehicle,
factors such as logistics, maintenance, handling, storage, and availability should be considered.
(TBD)
C.4.4.3.6 Fuels.
The capability of the APS equipment to meet performance on the specified primary fuel(s) shall
be verified by test. The capability of the APS to meet performance using fuels other than the
primary fuel(s) shall be verified by (TBS) .
Verification is needed to certify the capability of APS equipment to meet performance on the
specified primary fuels and other fuels as specified. Quantitative data, obtainable only through
testing, is required to assess performance on the primary fuel types.
400
JSSG-2009A
APPENDIX C
Testing to verify APS performance requirements should be conducted using the specified
primary fuel(s).
TBS should be filled in with respect to the effects on APS performance characteristics, changes
in starting time and effects on the air vehicle mission(s) when using an alternate fuel should be
assessed. This, however, may not always necessitate testing.
(TBD)
C.3.4.3.7 Lubricating oil.

The APS shall meet the performance specified herein with lubricating oil(s) conforming
to (TBS 1) except for the following variations in the specified characteristics: (TBS 2) .
This requirement is needed to specify oil characteristics by which auxiliary power subsystem
performance will be based.
TBS 1 should be completed with consideration that lubricating oils which conform to
MIL-PRF-7808 and MIL-PRF-23699 should be used as standard lubricants.
TBS 2 should be completed considering that special lubricants may be required for unusual or
nonstandard situations.
Generally, the APS equipment oil should be the same as the main engines to minimize logistics
impacts. Limits on special conditioning may be required to restrict reduction in mission
readiness and limit unnecessary burden on the user.
(TBD)
401
JSSG-2009A
APPENDIX C
C.4.4.3.7 Lubricating oil.

The capability of the APS to meet performance utilizing the specified lubricating oil(s) shall be
verified by test.
Verification is necessary to insure the capability of APS equipment to start and operate at
temperature extremes utilizing the specified oil.
Performance testing to verify APS requirements should be conducted using the specified
lubricant.
(TBD)
C.3.4.3.8 APS controls and indicators
C.4.4.3.8 APS controls and indicators
C.3.4.3.8.1 APS controls.

Controls for the APS shall be as follows:
a. Cockpit crew: The pilot(s) shall have the means to initiate the following actions:
(TBS 1) .
b. Other Flight crew: The (TBS 2) shall have the means to initiate the following actions:
(TBS 3) .
c. Maintenance crew: The maintenance crew shall have the means to initiate the
following: (TBS 4) .
This requirement establishes the control requirements of the user based on mission,
maintenance, and safety requirements.
TBS 1, TBS 3, and TBS 4 should be filled in with consideration given to the following. Describe
the control functions that the various crew members require. Typical functions to consider
should be:
a. Main Engine(s) start-stop
402
JSSG-2009A
APPENDIX C
b. APS start-stop
c. APS Arm for emergency power activation
d. APS “safetying” from inadvertent activation
e. Engine decouple – recouple
f. Motor engine
g. Motor Gearbox.
TBS 2 should be filled in with the specific crew member(s), such as the loadmaster or flight
engineer, that requires specific functions.
Generally, APS start sequencing and control is automatic upon actuation of a single switch.
Stable operation under all anticipated operational conditions, including starting and load
transients, is essential. Requiring APS control functions for crew other than the pilots will result
in external APU activation and shutdown controls, such as load master control in cargo bay, or
switch at crew entrance ladder.
(TBD)
C.4.4.3.8.1 APS controls.

Controls for the APS shall be verified by (TBS) .
Verification is needed to insure that controls for the APS are properly located as determined by
mission, maintenance and safety requirements.
TBS: Verification should be by review of analysis to determine that mission, maintenance and
safety requirements are met and by test, inspection and demonstration during ground tests to
determine that the controls function as required.
(TBD)
403
JSSG-2009A
APPENDIX C
C.3.4.3.8.2 APS status and health indications.

The APS shall provide operating status and health information as follows: (TBS) . If
required, some or all of the elements of status and health information shall be configured for
incorporation with other subsystems into any planned integrated diagnostic system.
This requirement is needed to identify parameters essential for monitoring APS operation, such
as EGT and RPM.
TBS should be filled in with the parameters to be provided with consideration given to the
following:
a. Information to the cockpit required to assess the integrity of the APS during normal air
vehicle operational control.
b. Information to other air vehicle systems to advise of APS status.
The parameters to be sensed, their expected operating range, and required display range
should be defined and documented in applicable Interface Control Documents or interface
requirements paragraph.
(TBD)
C.4.4.3.8.2 APS status and health indications.

The capability of the APS to provide the required status and health information shall be verified
by (TBS) .
Verification is required to insure that proper information is being sent to the flight and
maintenance crews.
TBS should be filled in with inspection and demonstration during air vehicle ground and flight
tests, as applicable.
(TBD)
404
JSSG-2009A
APPENDIX C
C.3.4.3.9 Power interruptions.

The APS equipment shall remain safe and operating, during any condition of operation, in the
event of a momentary interruption of electrical power resulting from electrical power source
transfers. The APS equipment shall remain safe in the event of any momentary or total loss of
electrical power. Any APS limitation resulting from momentary interruption of electrical power to
APS shall be defined.

The APS may be providing critical power to the air vehicle. Its operation should not be
compromised or terminated as result of an electrical power transfer from an external to internal,
internal to external or internal to internal power source.
The interruption of electrical power may result from internal functions of the air vehicle electrical
system, or from the transfer to or from externally supplied power (ground power source). A
momentary interruption of power may be defined as that which can be reasonably expected on
the air vehicle in question, or in terms of a specific time span.
If the APS is providing a flight critical function, consideration should be given to having
uninterruptible power for the system.
(TBD)
C.4.4.3.9 Power interruptions.

Safe operation in the event of momentary interruption of electrical power shall be verified by
(TBS) .
Verification is necessary to insure safe operation of the APS in the event of interruption or loss
of electrical power.
TBS: APS performance with loss of external electrical power should normally include bench
and air vehicle ground testing and, if applicable, flight testing. Subsystem bench and test stand
testing should verify:
a. The capability of the APU, JFS, or such, to remain safe, as applicable.
b. Limitations of functions following loss of external electrical power.
405
JSSG-2009A
APPENDIX C
(TBD)
C.3.4.3.10 APS unique integrity
C.4.4.3.10 APS unique integrity
C.3.4.3.10.1 Rotating equipment and containment.

The failure of APS high speed rotating equipment shall not result in a hazard to personnel or
damage to adjacent equipment. Containment shall be provided for any portion of the rotating
equipment that does not demonstrate adequate damage tolerance and control.
This requirement is needed to preclude injury to personnel and damage to equipment resulting
from the failure of high speed rotating parts such as cooling and ventilation fans, multiple disk
clutch and brake assemblies, or high speed gearing.
A damage tolerance design approach can be utilized in some cases as a means of ensuring
high speed component integrity. If such an approach cannot demonstrate adequate design
margin, containment should be provided.
Experience has shown that APS turbine equipment normally needs additional containment
protection for the compressor and turbine since there is a probability that failures will occur and
the normal high operating speed generates high energy fragments if failure does occur. With the
unit being used for ground power there is a high probability that personnel would be near the air
vehicle and therefore, exposed to these fragments.
Expectations of compressor-turbine failures can be attributed first to the inability to confidently

predict all conditions of usage, and second, the non-accountability of total rotor cycles. Failure
to accurately track cycles can allow rotating groups to remain in the inventory until fatigue failure
occurs. In addition, even with state-of-the-art inspection techniques, material flaws are possible.
When failures do occur, the time required to incorporate the proper repairs results in exposure
of personnel to a hazardous working environment and expensive damage to equipment.
406
JSSG-2009A
APPENDIX C
C.4.4.3.10.1 Rotating equipment and containment.

Personnel safety and adjacent equipment protection from failure of APS high speed equipment
shall be verified by (TBS) . Containment requirements shall be verified by analysis and test.
Verification is necessary to insure that neither hazardous conditions to personnel nor damage to
adjacent equipment are encountered due to rotating equipment. Verification is also necessary
to insure proper containment is provided by the APS for rotating equipment that does not
demonstrate adequate damage tolerance and control.
TBS: Damage tolerance designs should be verified by analysis, material characterization tests,
temperature and stress surveys, inspection demonstrations, and component tests. Containment
capability should be verified by analysis and test.
(TBD)
C.3.4.3.10.2 Critical speeds.

All rotating APS equipment in the installed configuration shall be free of damaging resonance
conditions at all speeds in the operating range. Any damaging critical speeds existing above
the operating range shall be at least (TBS 1) above the maximum operating speed. Any
damaging critical speeds existing below the operating range shall at least (TBS 2) below the
minimum operating range. Adequate damping and appropriate balancing shall be provided so
that any critical speed existing from zero speed to (TBS 1) above maximum speed shall be
traversed safely with smooth operation.
Resonant conditions existing within the operating range of rotating equipment typically create
large dynamic loads, which adversely impact the life of equipment and surrounding structure.
Subsequent failure may result in personnel injury, major air vehicle secondary damage, or
possible air vehicle loss.
TBS 1 should be filled in with a percentage value. Note that TBS 1 is used in two different
places.
TBS 2 should be filled in with a percentage value.
407
JSSG-2009A
APPENDIX C
Generally a critical speed margin of at least 20 percent (20%) above and below the operating
range should be required. Larger margins may be required if the system has numerous
uncontrolled variables that impact critical speed response.
(TBD)
C.4.4.3.10.2 Critical speeds.

Verification of critical rotating speed requirements shall be by analysis, component and
subsystem bench tests, and air vehicle ground and flight test.
Verification is necessary to insure that rotating equipment is free of damaging resonance

conditions at all speeds in the operating range. Verification is also necessary to insure if any
damaging critical speeds do exist, they are at the dictated values above and below the
operating range.

a. Analysis predicting and updating system critical speed margins and its sensitivity to
piece part and assembly variabilities.
b. Component tests validating part and assembly stiffness characteristics
c. Bench tests that include a special structural resonance test conducted on an operating
power take off system.
d. Air vehicle ground and flight tests validating installed system response characteristics.
(TBD)
408
JSSG-2009A
APPENDIX C
C.3.4.3.11 Exhaust systems.

Exhaust systems shall be designed, constructed, and located to prevent the leakage, ingestion
and damaging impingement of hot, corrosive, toxic, or combustible exhaust gases into or upon
the air vehicle, engine(s), APS inlet(s), ground or ramp.
The purpose of this requirement is to prevent exhaust gases from becoming a hazard to the
aircrew or having a detrimental impact to air vehicle structure, adjacent and interfacing
subsystems and facilities. Ingestion of exhaust gases through APU or engine inlet(s) provides a
means via the bleed ports for toxic fumes to enter the Environmental Control System.
Impingement of hot or corrosive gases upon unprotected air vehicle structure could lead to
failure of that structure.
Generally, APS exhaust duct runs are short. The high velocity exhaust gas can be used as the
motive force for operation of an eductor. Compartment ventilation and cooling air flow are
established by the eductor. Skillful eductor design should preclude or minimize the effects of
exhaust gas leakage. Location of APS inlet and exhaust openings should be suitably chosen to
avoid exhaust gas ingestion and impingement under the anticipated field conditions. Design
attention should also be paid to potential compartment leak paths such as those established at
the duct and fuselage interface.
(TBD)
C.4.4.3.11 Exhaust systems.

Capability to preclude APS exhaust gas leakage, ingestion or damaging impingement into the
air vehicle and ground or ramp shall be verified by: (TBS) .
Verification assures APU exhaust gases do not enter the air vehicle or cause damaging
impingement upon the air vehicle and ground.
TBS: Verification should be by analysis of exhaust plume and by using inspection, flow
visualization, temperature and gas measurement techniques during ground and, if applicable,
flight testing of the air vehicle.
409
JSSG-2009A
APPENDIX C
(TBD)
C.3.4.3.12 APS safety
C.4.4.3.12 APS safety
C.3.4.3.12.1 Protective features.

The APS shall incorporate protective features to preclude hazards to personnel and equipment
without the need for constant crew (flight and ground) monitoring. Shutdowns caused by
protective features shall have no detrimental effects to the equipment.
Preventing injury to personnel and damage to equipment requires the capability to automatically
shut down; this capability also permits autonomous operation of the APS. Damage precipitated
by sequencing necessary to automatically shut down equipment is contradictory to the intent of
protective features (preclude damage to equipment).
See table C-I for a list of some APS protective features.
Other related features that should be considered include:

a. Providing a convenient shutdown method external to the air vehicle for ground crew use.
b. Manual override provisions for emergency use to allow APS operation subsequent to an
automatic shutdown for a duration sufficient to meet critical mission requirements. If
such a provision is provided, it should be designed to be used only for those automatic
shutdown functions where continued operation of the APU will not result in injury or
death.
c. In flight when the system is providing a flight-safety critical function, automatic shutdown
should only be provided for those faults in which continued operation of the APS will
result in probable loss of the air vehicle.
Mission requirements may take precedence over protecting equipment (overriding automatic
shutdown features) when continued operation of the APU will not result in injury or death.
(TBD)
410
JSSG-2009A
APPENDIX C
C.4.4.3.12.1 Protective features.

Protective features shall be verified by laboratory or system ground tests.
Prudent engineering dictates that safety features be proven highly reliable through thorough
testing. The capability to preclude hazards to personnel and equipment must be demonstrated
before utilization.
Testing should simulate the possible condition, such as overspeed, overtemperature, or fire,
which may occur. Protective features should shut down equipment at the limiting speed,
temperature, and such.
Safety provisions should be functionally verified in a controlled environment.
(TBD)
411
JSSG-2009A
APPENDIX C
TABLE C-I. APS protective features.

LOW OIL FIRE
AIR VEHICLE EGT PRESSURE SPEED FIRE DETECTION EXTINGUISHER
C-5 Light in Shutdown switch, Auto Shutdown 1 Fire Pull light Manual
Cockpit No Indication 100% - No Loadmaster Panel Loadmaster Panel
(GTCP 165-1) Indication Cockpit
Auto 2 Light - Cockpit
Shutdown
3 Audible
C-130H Auto (During Starting) 110% Auto No Provision No Provision

Shutdown Acceleration Shutdown
(GTCP-85-180) Inhibited
C-130
(GTCP-85-71)
C-141 Auto Auto Shutdown 110% Overspeed Fire Pull Light Crew Manual Crew Entry
Shutdown Switch. Entry Door Door
(GTCP-85-106) Light at No Indication
No Indication Light - Flt Engr Flt Engr
Flt Engr
Station Audible - Ground Only
AWACS Auto Auto Shutdown - 110% Auto

Shutdown No Indication Shutdown
(GTC 165-6)
*B-1 Auto Auto Shutdown 110% Auto Auto Shutdown Button, Switch
Shutdown Shutdown
(GTCP 165-7) Audible Warning
Run Light
F-15
(JFS-190)
F-16 Auto 110% Auto

Shutdown Shutdown
(T-62T-40)
Run Light
F-18 Auto Auto Shutdown Auto Shutdown Yes w/cockpit Manual (airborne)
Shutdown (110% 5ms) indication
(GTCP 36-200) Auto (W.O.W.)
V-22 Auto Auto shutdown with Auto shutdown with Yes w/Auto Shutdown “FIRE
shutdown “APU FAIL” cockpit “APU FAIL” cockpit of APU SUPPRESSOR
(T-62T-46-2) with “APU indication indication DISCHARGED”
FAIL” cockpit Cockpit Indication
indication
*external controls also provided
412
JSSG-2009A
APPENDIX C
C.3.4.3.12.2 Fuel accumulation.

Accumulation of fuel in combustion chambers due to false starts and other probable
occurrences shall not cause a hazard nor result in damage to the equipment or air vehicle. Seal
leakage shall be handled in accordance with the Fire and Explosion Protection requirements of
(TBS) .
This is required to prevent injury to personnel and damage to equipment.
The design should prevent accumulations of fuel in the combustion chamber from creating a
hazard to equipment or the air vehicle. Accumulations from occurrences such as leaking fuel
nozzles or incomplete combustion should be automatically and immediately drained from the
unit.
TBS should be filled in with reference to the applicable fire and explosion section of the air
vehicle specification.
(TBD)
C.4.4.3.12.2 Fuel accumulation.

Hazard prevention due to accumulations of fuel in combustion chambers and seal leakage shall
be verified by (TBS) .
Verification is necessary to insure that fuel is sufficiently drained from the combustion chamber
so that a hazardous condition does not exist.
TBS should be filled in with an appropriate combination of analysis, tests, and inspections. This
requirement may be verified by acceptable operation through the development program.

(TBD)
413
JSSG-2009A
APPENDIX C
C.3.4.3.13 APS non-operating conditions.

There shall be no APS non-operating conditions within the permissible ground and flight
envelopes and environmental conditions that would damage or render the subsystem incapable
of performing its required functions when commanded.
This requirement establishes criteria for non-operating performance. In many air vehicles, the
APS equipment is non-operating during the majority of the flight and may be subject to such
phenomena as windmilling or freezing of moisture and condensate in sensitive pneumatic
control mechanisms. Proper lubrication to APU bearings and seals generally cannot be
provided during windmilling. Reverse windmilling may impact starting performance or damage
turbomachinery. The APS must be capable of operating properly when commanded and should
not experience damage under such conditions.
Generally, inlet and exhaust doors are provided to prevent airflow through the APU. APU
windmilling should be minimized or prevented.
(TBD)
C.4.4.3.13 APS non-operating conditions.

The capability of the APS to withstand the non-operating conditions and environments shall be
verified by analysis, test and demonstration.
Verification is necessary to insure that damage from such conditions as windmilling does not
occur.

a. Analysis of predicted installed subsystem non-operating characteristics and
environments throughout the flight envelope.
b. Component and subsystem bench tests validating endurance and environmental
capabilities.
c. Analysis of design and component and subsystem bench test data.
414
JSSG-2009A
APPENDIX C
d. Air vehicle flight tests and demonstrations that validates predicted installed system non-
operating characteristics and environments throughout the flight envelope, as applicable.
Windmilling characteristics can be assessed only by flight testing.
(TBD)
C.3.4.3.14 Interfaces.
The interfaces between the air vehicle and the APS shall be established and controlled to allow
the APS equipment and all interfacing air vehicle systems and subsystems to perform their
intended functions to the extent specified within this specification and applicable supporting
specifications. All APS and air vehicle interfaces shall be detailed in (TBS) .
This requirement is necessary to achieve proper installed integrated subsystem performance. It

insures that interface requirements which can impact subsystem design performance and
functionality are established up front and are not changed without the knowledge and
concurrence of the interfacing subsystems. This helps preclude any change by one subsystem
to that specified from impacting a second subsystem to the extent that a physical (or functional)
interface becomes unsatisfactory.
TBS: The interfaces can be shown in an ICD, or for programs that do not have an ICD, the
interfaces can be put into the specification paragraph. Interface definitions that should be
considered are as follow:
a. Other air vehicle subsystems interfaces:
1. Fuel
(a.) Physical
(1.) Connection Type and size
(2.) Connection loads
(3.) Connection location
(b.) Fuel Conditions
(1.) Types
(2.) Temperature (max, min)
(3.) Viscosity (max)
(4.) Pressure (max, min)
415
JSSG-2009A
APPENDIX C
(5.) Flow rate (max)

(6.) Vapor Liquid Ratio (V/L) (max)
(7.) Fuel contamination (Type, Size, Quantity)
2. Electrical
(a.) Input Power
(1.) Voltage (min, max)
(2.) Current (Max)
(3.) Quality
(b.) Output Power (if applicable)
(1.) Voltage (min, max)
(2.) Current (Max)
(3.) Quality
(c.) Physical
(1.) Connector(s) type
(2.) PIN assignments
3. Hydraulic
(a) Physical
(1.) Connection type and size
(2.) Connection loads
(b) Fluid conditions
(1.) Types
(2.) Temperature (maximum, minimum)
(3.) Viscosity (maximum)
(4.) Pressure (maximum, minimum)
(5.) Flow rate (minimum, maximum)
(6.) Fuel contamination (type, size, quantity)
4. Pneumatic
(a.) Environmental Control System interface requirements:
(1.) Connection Type and size
(2.) Connection loads (shear, moments, blow off)
(4.) Pressure
416
JSSG-2009A
APPENDIX C
(5.) Temperature
(6.) Flow
(7.) Contamination (See additional guidance, below.)
(b.) Other pneumatic interface requirements
5. Mechanical
(a.) Mounts
(1.) Loads
(2.) Locations
(b.) Accessory Pads (Generator(s), Hydraulic pump(s), Power Takeoff Shaft)
(1.) Direction of rotation and Speed (continuous, peak, limit)
(2.) Torque (continuous, peak, limit)
(3.) Shear loads
(4.) Weight
(5.) Over hung moments
(6.) Mass moment of inertia
(7.) Acceleration rate
(8.) Spring rates (Torsional, bending, axial, as applicable)
(9.) Envelope
(10.) Alignments
(11.) Mounting flange details
(12.) Spline details (Style, size, loading, concentricity, lubrication)
(13.) Lubrication interface requirements (Physical, flow, temperature)
(14.) Materials
(15.) Anti-rotation pin tolerances
(16.) Duty cycle
6. Vehicle Management System Interface
(a.) Communication port definition
(b.) Signal or Word definitions
7. Thermal
(a.) Heat rejection from lube system
(b.) Heat rejection to bay
(c.) Bay temperature (max, min)
8. Lubrication system interface
417
JSSG-2009A
APPENDIX C
(a.) Physical (Location, size, loads)

(b.) Pressures (Pressure drops, peaks/pulsation, scavenging pressurization)
(c.) Contamination and filtration levels
9. Envelope
b. Propulsion system interfaces
c. Non airframe peculiar auxiliary power system physical and functional interfaces:
1. Ground support equipment
2. Other
d. The conducted and radiated magnetic and electronic interface limits
Interface control documents and drawings should be prepared. Deviations from the required
interfaces should be approved by all parties. Standard mount pads, fittings, and such, should
be used. Refer to APS Defense Specifications for additional information. For air vehicle,
engine, and accessory drive and flange standards, refer to the industry standard SAE AIR1160
and the legacy Air Force-Navy Aeronautical Design Standard AND10230 for additional
information.
Ground power sources available at the specified operational bases should be considered (refer
to legacy Industry Standard SAE AS44).
For interface with the ECS, APS-generated substances contained in the bleed air that may be
used for cabin air conditioning should be within the threshold limit values specified in table C-II.
The bleed air should not contain a total of more than 5.0 mg (0.3 lbm x 10-6) of engine
generated particles per m3 (ft3) of bleed air.
(TBD)
418
JSSG-2009A
APPENDIX C
C.4.4.3.14 Interfaces.
Interface requirements shall be verified by: (TBS) .
Verification is needed to insure the compatibility of controlled interface such as, airframe and
non-airframe supplied equipment, with the auxiliary power subsystem.
TABLE C-II. Threshold limit values.
SUBSTANCE PARTS PER MILLION
Carbon dioxide 5000.0
Carbon monoxide 50.0
Ethanol 1000.0
Fluorine (as HF) 0.1
Hydrogen peroxide 1.0
Aviation fuels 250.0
Methyl alcohol 200.0
Methyl bromide 20.0
Nitrogen oxides 5.0
Acrolein 0.1
Oil breakdown products (for example, 1.0

aldehydes)
Ozone 0.05
“TBS” should be filled in by disclosing the progressive method(s) that should be used for
verification. Past verification methods have included inspection, analysis, demonstrations and
tests. Test, demonstration, or both should typically be necessary since an analysis may not
reveal all possible problems. Verification that all interfaces are established and controlled
should be by inspection of applicable documents. Analyses may be used for conditions that
419
JSSG-2009A
APPENDIX C
may not be adequately demonstrated or tested. The compatibility of interfaces should be

verified by test and demonstration throughout the air vehicle and engine development program.
For sophisticated subsystems, a separate integration test is recommended to avoid costly

changes and schedule delays that could be encountered by waiting to perform an air vehicle
verification.
For the B-1, complete nacelle simulator (2 engines, 2 remote gearboxes, APU and associated
drive equipment) testing was accomplished prior to first flight and precluded potential delay to
the program. The F-15 and F-16 APS integrated laboratory testing was also conducted prior to
first flight. The requirement to conduct integration testing depends upon the development
schedule and the complexity of the APS.
420
JSSG-2009A
APPENDIX C
C.5 PACKAGING
C.5.1 Packaging.
C.6 NOTES
not mandatory.)
C.6.1 Intended use.
The auxiliary power subsystem descriptions in this appendix are intended for use in air vehicle
C.6.2 Acquisition requirements.

C.6.3 Acronyms.
The following list contains the acronyms/abbreviations contained within this document.
APS Auxiliary Power Subsystem
EGT Exhaust Gas Temperature
ICD Interface Control Document
JFS Jet Fuel Starter
RPM Revolutions Per Minute
WOW Weight On Wheels
421
JSSG-2009A
APPENDIX C
C.6.4 Subject term (key word) listing.

Engine
Exhaust
Fuel
Power
C.6.5 International standardization agreement implementation.
This specification implements STANAG 3372, Low Pressure Air and Associated Electrical
Connections for Aircraft Engine Starting. When amendment, revision, or cancellation of this
specification is proposed, the preparing activity must coordinate the action with the U.S.
National Point of Contact for the international standardization agreement, as identified in the
ASSIST database at https://assist.dla.mil/online/start.
C.6.6 Responsible engineering office.
C.6.7 Changes from previous issue.
422
JSSG-2009A
APPENDIX D
APPENDIX D
AIR VEHICLE ENVIRONMENTAL CONTROL SUBSYSTEM
D.1 SCOPE
D.1.1 Scope.
information for the Environmental Control Subsystem provided for in Part 1 of this specification.
The appendix has been developed and coordinated by technical personnel from the Air Force,
Navy, and Army and has been approved as an official guide for use by Government personnel
for assistance in tailoring the air vehicle subsystems specification for acquisition and model
specifications. This appendix is a mandatory part of the specification. The information
contained herein is intended for compliance.
D.1.2 Structure.
D.1.3 Appendix.
D.1.4 Deviations.
423
JSSG-2009A
APPENDIX D
D.1.5 Environmental impact.
D.1.6 Responsible engineering office.
D.2 APPLICABLE DOCUMENTS

D.2.1 General.
they are listed.
D.2.2 Government documents
D.2.2.1 Specifications, standards, and handbooks.


STANAG 3208 Air Conditioning Connections
424
JSSG-2009A
APPENDIX D
STANAG 3212 Diameters for Gravity Filling Orifices

STANAG 3315 Aircraft Cabin Pressurizing Test Connections
STANAG 3372 Low Pressure Air and Associated Electrical Connections for
Aircraft Engine Starting
(Copies of these documents are available at http://quicksearch.dla.mil, http://nsa.nato.int, and

www.ihs.com to qualified users.)

MIL-STD-464 Electromagnetic Environmental Effects Requirements for
Systems
MIL-STD-810 Environmental Engineering Considerations and Laboratory
Tests
MIL-STD-1472 Human Engineering
MIL-STD-2218 Thermal Design, Analysis, and Test Procedures for Airborne
Electronic Equipment
MS33561 Connection, Aircraft Ground Air Conditioning, 5 Inch, Minimum
Requirements
MS33562 Connection, Aircraft Ground Air Conditioning, 8 Inch
MS33740 Nipple, Pneumatic Starting, 3-inch ID, Outline Dimensions of

MIL-HDBK-221 Fire Protection Design Handbook for U.S. Navy Aircraft
Powered by Turbine Engines
MIL-HDBK-310 Global Climatic Data for Developing Military Products
MIL-HDBK-454 Electronic Equipment, General Guidelines for
MIL-HDBK-5400 Electronic Equipment, Airborne, General Guidelines for
19111-5094 USA.)
425
JSSG-2009A
APPENDIX D
D.2.2.2 Other Government documents, drawings, and publications.

USAF MANUAL
AFMAN 48-155 Occupational and Environmental Health Exposure
Controls
(Copies of this document are available at www.e-publishing.af.mil to qualified users.)
USAF TECHNICAL ORDER

TO 42D4-1-4 Rain Repellent for Application to Windshields—All Aircraft
(Copies of this document are available at http://www.tinker.af.mil/technicalorders/index.asp to
qualified users.)
FEDERAL AVIATION ADMINISTRATION

FAA Report DOT/FAA/CT-88 Aircraft Icing Handbook, Volumes 1-3
(Copies of this document are available at www.dtic.mil to qualified users; the Defense Technical
Information Center (DTIC), 8725 John J. Kingman Rd., Suite 0944, Ft. Belvoir VA 22060-6218
USA); and from www.ntis.gov; the National Technical Information Service (NTIS), 5285 Port
Royal Road, Springfield VA 22161-2103 USA.)
D.2.3 Non-Government publications.
SAE INTERNATIONAL
SAE AIR1102 Transparent Area Washing Systems for Aircraft
SAE AIR1204 Control of Water Carryover from the Environmental Control
System and Condensation on the Structure
SAE AIR1277 Cooling of Military Airborne Electronic Equipment
SAE AIR1539 Environmental Control System Contamination
SAE AIR1609 Aircraft Humidification
SAE AIR1667 Rotor Blade Electro Thermal Ice Protection Design
Considerations
SAE AIR1811 Liquid Cooling Systems
426
JSSG-2009A
APPENDIX D
SAE-AMS-I-7171 Insulation Blanket, Thermal-Acoustical

SAE ARP85 Air Conditioning Systems for Subsonic Airplanes
SAE ARP699 High Temperature Pneumatic Duct Systems for Aircraft
SAE ARP731 General Requirements for Application of Vapor Cycle
Refrigeration Systems for Aircraft
SAE ARP986 Guide for Qualification Testing of Aircraft Air Valves
SAE ARP1270 Aircraft Cabin Pressurization Control Criteria
SAE ARP1796 Engine Bleed Air Systems for Aircraft
SAE AS4073 Air Cycle Air Conditioning Systems for Military Air Vehicles
SAE AS5498 Minimum Operational Performance Specification for In-flight
Icing Detection Systems
SAE AS6882 Water Repellent, Window and Windshield, Glass and Plastic
(Copies of these documents are available from www.ihs.com to qualified users, and from
www.sae.org; SAE International, 400 Commonwealth Drive, Warrendale PA 15096-0001 USA.)
D.2.4 Order of precedence.
D.2.5 Streamlining.
427
JSSG-2009A
APPENDIX D
D.3 REQUIREMENTS
D.4 VERIFICATIONS
D.3.1 Definition
D.4.1 Definition
D.3.2 Characteristics
D.4.2 Characteristics
D.3.3 Design and construction
D.4.3 Design and construction
D.3.4 Subsystem characteristics
D.4.4 Subsystem characteristics
D.3.4.1 Landing subsystem
D.4.4.1 Landing subsystem
D.3.4.2 Hydraulic subsystem
D.4.4.2 Hydraulic subsystem
D.3.4.3 Auxiliary power subsystem
D.4.4.3 Auxiliary power subsystem
428
JSSG-2009A
APPENDIX D
D.3.4.4 Environmental control subsystem.

The environmental control subsystem (ECS) provides temperature, humidity, ventilation, and
pressure control to occupied spaces, equipment, and airframe. The system must be able to
provide this control under any flight or ground condition of the air vehicle in any environment in
which the air vehicle is intended to operate. Critical viewing areas of air vehicle transparencies
are maintained clear of dirt, rain, ice and fog as required to meet air vehicle safety and mission
requirements. Power is extracted to operate the system. Air is conditioned to meet occupied
compartment needs and possibly to perform other functions. This air may be from internal
(engine or auxiliary power unit (APU)) or external (ground cart) sources or an ECS dedicated
compressor(s). Other fluids may be conditioned as required by air vehicle needs. Heat is
rejected overboard normally through the use of a heat sink. The temperature of the heat sink
needs to be controlled to meet air vehicle mission, airworthiness, and safety requirements.
Functions may include, but are not limited to: pressurization heating, cooling, ventilating,
moisture control, bleed air systems, ram air supply, pressure and anti-g suit control, defogging,
defrosting, anti-icing, rain removal, windshield washing, electronic and electrical thermal
management, heat sink thermal management, and boundary layer control.

The environmental control subsystem provides a safe and comfortable environment for the crew
and provides the required environment necessary for proper air vehicle operation and surface
integrity. This permits the successful completion of the mission without loss of personnel or air
vehicle.

The air vehicle mission(s) should be analyzed to design the ECS to its expected percentage
usage in identified environments. Sufficient ECS capacity should be available for all known
conditions, including:
a. Ground operations
b. Taxi, takeoff, and landing
c. All flight attitudes within structural limitations
d. Zero gravity or negative gravity
e. All altitudes within the flight envelope
f. Structural deflection
g. Loss of engine propulsive power
h. Emergency operation.
When used, air cycle systems, including cabin pressurization control valves, should be in
accordance with SAE AS4073. The equipment design requirements of section 5 of SAE ARP85
should also be applied. Vapor cycle system should comply with paragraph 3.5, Failure
Protection and Safety, of SAE ARP731. The SAE ARP731 was prepared by a technical
specialist in vapor cycle systems with many years of experience with military and commercial
429
JSSG-2009A
APPENDIX D
systems and is strongly recommended for the establishment of requirements for vapor cycle
refrigeration system. These systems were not widely used until recently on military air vehicles;
therefore, there are not many military guidelines on them.
The following recommendations should be considered for specifying vapor cycle systems:
a. Suction pressure should not be greater than 14.7 psia (10.1 kPa) for charging.
b. Compressors, especially centrifugal ones, should be hermetically sealed. This can be
accomplished by integrating motor with compressor or using a magnetic drive.
A systems engineering approach is helpful in achieving proper integration of the environmental
control, environmental protection, and engine bleed air provisions.
(TBD)
D.4.4.4 Environmental control subsystem.

Verification shall encompass planning, procedure preparation, and reporting, and shall be
accomplished incrementally by inspection, analysis, similarity, demonstration, or test, or a
combination of these methods.

Verification is required to assure that performance interface and functional requirements are
met.

Operating performance should be shown by appropriate laboratory and subsystem tests, and
applicable ground, taxi and flight tests. Pass criteria are based on successfully meeting all test
objectives.
For Army rotary-wing air vehicles, system design and performance analysis should use
Aeronautical Design Standard ADS-9C, available from the US Army Materiel Command at
www.redstone.army.mil, as a guide.
Testing should also be accomplished and should consider the following guidelines.
a. If the cockpit is not simulated (not geometrically similar and does not have the
distribution ducting of the air vehicle) during laboratory testing then the air vehicle
cockpit should be instrumented with thermocouples capable of recording the dry bulb
temperature located at the crewmember’s head, torso, and foot levels. These
thermocouples should be the basis for demonstrating that the required cockpit
430
JSSG-2009A
APPENDIX D
temperatures are achieved. Furthermore, the Globe Temperature should also be

measured in the presence of maximum solar radiation, and the recorded value should be
extrapolated to the design condition as required.
b. The cockpit should also be instrumented to record the wet bulb temperature in the
vicinity of the crew member(s). These temperatures should be used as required to
demonstrate that the cockpit environment is maintained as required.
c. Laboratory testing should include all aspects of the ECS. This includes, but is not
necessarily limited to:
1. the bleed air ducting, valves, and heat exchangers
2. the refrigeration package which includes the heat exchangers, valves, air cycle
machine or vapor compressor, sensors, interconnecting ducting, simulated ram air
scoops, and controller
3. the nuclear, biological, and chemical contamination (NBC) control subsystem
components
4. components comprising the Microclimate cooling of crewmembers wearing NBC
protective gear
5. the distribution ducting down to the equipment interface. The cockpit distribution
ducting need not be included, but the cockpit volume and the cockpit distribution
ducting pressure drop should be simulated.
The laboratory system test rig described above is necessary for a variety of reasons. It is the
chief means to show that the ECS has the required heating and cooling capacity; it is used to
demonstrate that the software control algorithms properly function and the ECS can be
controlled safely; it is used to uncover and investigate control and design problems; and it is
used to demonstrate NBC requirement compliance.
(TBD)
D.3.4.4.1 Pressurization.
The environmental control subsystem shall provide pressurization to all compartments, bays,
and equipment requiring a pressure controlled environment.

The total barometric pressure and the oxygen partial pressure in the environment are prime
considerations for the design of pressurization systems. Eight thousand feet is the maximum
altitude for prolonged flights without undue fatigue from mild hypoxia. Ten thousand feet is the
threshold for increasingly severe hypoxia, and is the maximum without supplemental oxygen.
Twenty thousand feet is the threshold for occasional symptoms of decompression sickness
including abdominal gas pains.
431
JSSG-2009A
APPENDIX D

Pressurization systems should be used for manned air vehicles flying above 20,000 ft to avoid
these physiological problems and those that occur at higher altitudes. In addition, the use of
supplemental oxygen should be considered for any air vehicle where the cabin pressure
exceeds 8,000 ft.
In this paragraph, the compartments that will require pressurization should be specified. This
paragraph should be deleted for unmanned vehicles or vehicles with a service ceiling below
20,000 ft. and which do not require positive pressure for NBC protection.
(TBD)
D.4.4.4.1 Pressurization.
The capability of the environmental control subsystem to provide pressurization to all
compartments, bays, and equipment as required shall be verified by (TBS) .

Verification is necessary to ensure the ECS is capable of providing pressurization to the
compartments, bays, and equipment as required.

TBS should be filled in with engineering analyses, demonstrations, and flight tests.
All measurements of rate of pressure change should be done to a standard. The worst
(highest) slope should be taken over a 1-sec interval ( P /s e c).
Laboratory tests may be useful to ensure there is no undesirable interaction between the
regulators before proceeding to the flight test.
For pressure measurements, all pressure taps should be located so as to minimize the effect of
turbulence caused by valves, elbows, or orifices in the system, and to determine all pressures
required for a complete evaluation of system operation.
If the air vehicle fuselage or any equipment bay is pressurized, the ability to pressurize the
volume to the required level should be demonstrated by testing, and the testing should show
that the required pressure level is achieved with the design air flow-rate. Furthermore, if the air
used to pressurize the fuselage or equipment is collected internally to the air vehicle structure
and routed to a single or various destinations for added cooling of equipment, the contractor
should demonstrate, by test, that the required amount of air (1.6 times the amount required for
cooling the destination avionics or equipment) is provided. The factor 1.6 is used to
compensate for development of in-service leakage.
432
JSSG-2009A
APPENDIX D
(TBD)
D.3.4.4.1.1 Occupied compartment pressure schedule.

The environmental control subsystem shall automatically maintain the following nominal
pressure schedule: (TBS 1) . The environmental control subsystem shall maintain this
nominal pressure schedule within (TBS 2) .

Pressure schedules are specified to minimize the discomfort (due to pressure changes) to the
crew and passengers, and to prevent hypoxia. The pressurization system must be capable of
reacting quickly to changes in flight conditions, air conditioning flow rates, and such, to maintain
the pressure schedule and avoid annoying or painful pressure bumps. This function can be
accomplished only by a fast acting, automatic system.

Pressurization system requirements should be established based upon minimum physiological
limitations. Environmental thresholds and physiological limitations used in establishing the
pressurization system requirements should be considered by the project engineer when
completing those portions where the requirements are dependent upon the mission of the air
system under consideration. (SAE ARP1270 is an excellent reference and provides guidelines
to the pertinent technology relative to the physiological considerations, technical system
requirements, and design objectives for air vehicle pressurization control systems.)
TBS 1: The engineer should select the type of schedule to be specified, based upon the
mission and operational requirements of the air vehicle. For combat and combat trainer air
vehicles, the desired pressure schedule is unpressurized for sea level to 8,000 ft, and then
8,000 ft isobaric to the operational ceiling. For high performance, high altitude fighter or
interceptor-type air vehicles, a substantial weight increase can be incurred by maintaining an
8,000-ft pressure schedule to the operational ceiling of the air vehicle. This weight increase is
due to the additional structure incurred by the high differential pressures. In these cases, a
5-psi differential pressure schedule above 23,000 ft is typically used. (See figure D-1.)
Selection of pressure schedule should be closely coordinated with oxygen system engineers to
ensure crew always has an acceptable breathing environment. The 5-psi differential is usually
chosen since it will maintain the cabin pressure below 30,000 ft—the threshold for high
incidence of decompression sickness. Other differential pressure schedules may be chosen
depending upon the cabin pressure requirements of the system under consideration. This type
of schedule generally imposes the minimum penalty on the air vehicle and meets the minimum
physiological requirements. If an NBC collective protection system is to be used, the pressure
schedule will need to be modified to maintain a differential pressure at sea level. The absolute
pressure should be greater than the maximum external pressure on the air vehicle skin. This
pressure should be relieved prior to crew exit to prevent damage and injury.
433
JSSG-2009A
APPENDIX D
CABIN ALTITUDE – 1,000 FT
FIGURE D-1. Cabin pressure for combat air vehicles.
For non-combat air vehicles, a pressurization system that allows the crew to select any cabin
altitude between -1,000 and +10,000 ft is desirable. The maximum altitude chosen is 10,000 ft,
as oxygen systems are generally not desired or provided (except for emergency use). This
434
JSSG-2009A
APPENDIX D
system is particularly applicable for air vehicles that frequently carry personnel who are not
regular crewmembers, as discomfort can be minimized by selecting the schedule that minimizes
changes in cabin altitude. Air vehicles operating at or near sea level cabin pressures with this
system can be used to transport patients suffering from medical conditions where a decrease in
environmental pressure could be serious or even fatal. Pressurization systems for air vehicles
with this type of schedule are usually designed for cabin pressure differentials of 8 to 9 psi. The
maximum differential is established as that differential required to maintain
an 8,000-ft cabin altitude at the maximum cruise altitude of the air vehicle. If an NBC collective
protection system is to be used, the pressure schedule will need to be modified to maintain a
differential pressure at sea level. The differential pressure should be greater than the maximum
external pressure on the air vehicle skin. Means need to be incorporated to relieve this
pressure prior to crew exit without causing discomfort in the ears.
As an example, assuming a maximum cruise altitude of 45,000 ft, the maximum differential is
found to be 8.75 psi when the intersection of the 8,000-ft cabin altitude line with the 45,000-ft
airplane altitude line is referenced on figure D-1. The system would then be designed to
maintain a sea-level cabin altitude up to an airplane altitude of about 23,000 ft and then would
follow the 8.75 psi differential to the operational ceiling. Any cabin altitude between -1,000 and
+10,000 ft could be chosen by the crew and would be maintained up to the 8.75 psi differential.
To summarize, this type of pressurization system is normally used for air vehicles with the
following mission requirements:
a. The continuous use of oxygen is impractical or undesirable.
b. The air vehicle will be used for medical evacuation.
c. The air vehicle will frequently carry non-crewmember personnel.
Air vehicles such as rotorcraft that require pressurization only to meet NBC protection
requirements should have their pressurization schedule set high enough that he external air
pressure on the skin of the air vehicle is always less than the occupied compartment air
pressure. If an NBC collective protection system is to be used, the pressure schedule will need
to be modified to maintain a differential pressure at sea level. The absolute pressure should be
greater than the maximum external pressure on the skin of the air vehicle. This pressure should
be relieved prior to crew exit to prevent discomfort in the ears, personal injury, or structural
damage.
Special mission requirements may require maintenance of different compartment pressures

within the air vehicle. In these cases, a separate pressure regulator should be installed in each
portion of the air vehicle where pressure can be maintained independently, and where safety
measures (over pressure protection, decompression, and such) are provided.
TBS 2 should be filled in with a tolerance value at which the pressure schedule is maintained.
The pressurization system should be designed to follow the pressure schedule within
reasonable limits. Closer tolerances are possible in the pressurized range than in the
unpressurized range. The normally accepted tolerances are 0.2 psi in the pressurized range
and from 0.0 to 0.5 psi in the unpressurized range. The tolerances in the pressurized range are
mainly a function of the design of the overall system—both the automatic control and the
provisions incorporated upstream in the environmental control subsystem to minimize or prevent
excessive changes in flow rate. Therefore, a tolerance of 0.2 psi in the pressurized range is
435
JSSG-2009A
APPENDIX D
easily attainable in a properly designed system, and is selected so any pressure variations due
to the dynamic design of the pressurization system (overshoot, steady-state error, under-
damped response, and such) are small enough that they are unnoticeable and therefore not
distracting or annoying to the crew. In the unpressurized range, the tolerance is generally a
function of flow path for the outflow valve (or cabin) to overboard. The more complex the path
(such as using cabin exhaust for equipment cooling and then dumping it overboard), the higher
the unpressurized cabin steady-state pressure (and therefore higher tolerance). The maximum
tolerance in the unpressurized range is usually 0.5 psi. Negative pressure differentials are
easily avoidable, and the lower tolerance limit is usually 0.0 psi.
Relaxation of pressure schedule requirements has been deemed appropriate for certain air
vehicles that did not have mission requirements necessitating prolonged flight at high altitudes.
For example, significant cabin structural and canopy weight was saved on the A-10 air vehicle
by allowing the air vehicle to be unpressurized up to 10,000 ft, isobaric 10,000 ft cabin to 18,000
ft flight altitude, and then maintain a 2.75 psi differential up to the service ceiling of 40,000 ft,
which corresponds to a 25,000 ft cabin altitude.
Pressure schedules have been referenced to ambient pressure but have not accounted for
fluctuations encountered in measuring the ambient pressure. The measuring equipment and
bays have been susceptible to pressure variations which should have been taken into account.
For example, the F-15 pressure regulator sensed its reference pressure in a bay which was
typically 0.3 psi above ambient. Therefore, in an effort to use off-the-shelf pressure regulators,
the differential control pressure was 5.3 psi in lieu of 5.0 psi.
D.4.4.4.1.1 Occupied compartment pressure schedule.

Engineering analyses and flight tests shall be conducted to verify the pressure schedule and
tolerance requirements for occupied compartments. The analyses shall consider the operating
condition with the least air inflow to the cockpit or that condition for which the required
pressurization is the most difficult to achieve. Flight tests shall be made at high and low
altitudes and speeds throughout the flight envelope. Transient conditions shall include ground
static, taxi, takeoff, slow and rapid climbs and dives, accelerations, rapid throttle bursts,
maneuvers, and landings. Steady-state conditions shall include both high and low altitudes and
speeds.

While some requirements can be verified by engineering analysis, certain pressurization
requirements and system performance can be verified only by flight testing. The dynamic
response and interaction of the engine bleed system, pressurization system, and flight
conditions cannot be simulated in the laboratory. Flight tests for both steady-state and transient
conditions are required, with particular emphasis on the transient conditions where
pressurization problems are most frequently encountered.
436
JSSG-2009A
APPENDIX D

Established crew station interfaces should be listed here for verification. If a warning of system
abnormality is provided, flight testing should demonstrate that the warning activates at the
correct time.
Flight testing for pressure transients should include any possible changes in system operating
modes and the actuation of all applicable valves and system controls to uncover any
interactions between components that could generate excessive transients.
Although flight testing is the generally preferred method of verification, analysis is sufficient for
requirements difficult to safely verify in flight, such as the effects of pressure source failure.
During rapid throttle bursts, use maneuvers which cannot be misunderstood when finally
documented in an updated to flight test analysis. In F-5F pressurization flight tests, the pilots
used a MIL-IDLE-MIL throttle burst that resulted in a large tolerance in the schedule and was
considered realistic. However, for formal documentation purposes (updated to flight test
analysis), the contractor used a MIL-MINIMUM POWER SETTING TO MAINTAIN LEVEL
FLIGHT-MIL burst that resulted in a smaller (tighter) tolerance in the schedule and looked better
contractually.
D.3.4.4.1.2 Unoccupied compartment, bay, and equipment pressure schedules.

The environmental control subsystem shall provide pressurization or pressurized air for
(TBS 1) and automatically maintain the following nominal pressure schedule: (TBS 2) .
The environmental control subsystem shall maintain this nominal pressure schedule within
(TBS 3) .

Depending upon the operational needs of the air vehicle, equipment compartment, or other
pressurization requirements may be specified.

TBS 1 should be filled in by identifying the compartments, equipment, and subsystems that will
require pressurization or pressurized air from the ECS. The following should be considered.
a. Equipment compartments. Equipment compartments that are separate from pressurized,
occupied compartments may need to be pressurized for proper equipment operation.
Coordination with other engineering areas is necessary to determine if pressurization is
required or desirable. Trade studies may be necessary to evaluate the impact of
pressurized compartments on life cycle cost to aid in the design approach if
pressurization is required or is considered a possible design approach of the potential
contractors. The following requirements should be considered and included, as
appropriate:
1. Compartment pressure should be regulated automatically.
437
JSSG-2009A
APPENDIX D
2. If the pressure schedule is not specified, it should be compatible with the most critical
unit contained within the compartment.
3. Safety valves or other provisions should be provided for positive and negative
pressure relief, as required by structural considerations.
4. Protection against air vehicle damage due to decompression should be provided.
5. Provisions to protect against detrimental residual pressure differentials should be
provided, as necessary.
6. The pressurization system should be designed to allow for in-service leakage rates
of 1.6 times the production leakage rates.
7. The pressurization medium should be supplied at temperature, moisture, and
contamination levels compatible with the equipment specifications. Multiple sources
may be required based upon the equipment requirements and emergency
capabilities desired.
8. Instruments to indicate loss of equipment pressurization to the crew may be required.
9. Design failure modes may need to be specified.
10. Provisions to test the pressurization system and compartment leakage should be
provided. These requirements are similar to those for occupied compartments and
are based on the same rationale. Other requirements, depending upon unique
requirements of the air vehicle under consideration, may also be needed.
b. Equipment pressurization. Some pieces of equipment require internal pressurization
from an external source. Those requirements should be included here. The engineer
should work closely with the avionics engineers to establish the pressurization
requirements to complete this requirement. The following is provided as a guide to
establishing the appropriate requirements:
1. The air should be supplied at pressure, moisture, and contamination levels
compatible with the equipment specification.
2. Pressure relief provisions to prevent overpressurization of the equipment should be
provided.
3. When two or more units are pressurized by the same source, loss of pressurization
by one should not cause loss of pressurization to the other units.
4. Provisions that allow ground checkout of pressure regulators, relief provisions, and
system leakage should be incorporated.
5. Test fittings should be in accordance with an equivalent to the legacy Military
Standard MS33565. A detailed description of the test fittings (dimensions, general
characteristics) is contained in that standard.
6. Consideration should be given to providing a means for indicating loss of equipment
pressurization to the crewmembers.
c. Subsystems. Other pressurization requirements, such as on-board oxygen generating
system (OBOGS), on-board inert gas generating system (OBIGGS), hydraulic reservoir
canopy seal or fuel pressurization, can be included here, as appropriate, with
438
JSSG-2009A
APPENDIX D
consideration given to the various requirements discussed above under equipment

compartments and equipment pressurization.
TBS 2 should be filled in with the appropriate pressure schedule for the identified
compartments, equipment, and subsystems.
TBS 3 should be filled in with the appropriated tolerance for maintaining the identified pressure
schedule.
(TBD)
D.4.4.4.1.2 Unoccupied compartment, bay, and equipment pressure schedules.

The capability of the ECS to provide pressurization for the identified compartments, equipment,
and subsystem at the required schedule and level of tolerance shall be verified by (TBS) .

Verification is necessary to ensure that the ECS has the capability to provided pressurization to
the proper locations at the required schedule and level of tolerance.

TBS: Flight tests should be conducted to verify the pressure schedule and tolerance
requirements for unoccupied compartments. Flight tests should be made at high and low
altitudes and speeds throughout the flight envelope. Transient conditions should include ground
static, taxi, takeoff, slow and rapid climbs and dives, accelerations, rapid throttle bursts,
maneuvers, and landings. Steady-state conditions should include both high and low altitudes
and speeds.
The requirements should be verified by cost effective method. In general, pressurization system
performance can be properly verified only by flight test. However, some aspects can be verified
by analysis, laboratory and air vehicle ground test, and inspection. Flight test costs can also be
reduced by performing the tests concurrent with other tests.
(TBD)
439
JSSG-2009A
APPENDIX D
D.3.4.4.1.3 Rate of occupied compartment pressure change.

The rates of change of pressure in all occupied compartments shall be controlled within the
following limits:
a. The maximum rate of pressure change under all normal operating conditions, including
transients, shall be (TBS 1) .
b. The capability shall be provided to select and control automatically a pressure change
rate anywhere in the range of (TBS 2) .
c. For emergency pressure release, the maximum rate of pressure decrease shall be
(TBS 3) .
d. For emergency repressurization, the maximum rate of pressure increase shall be
(TBS 4) .
Pressure regulation, particularly the rate of pressure change, is based on the ability of the ear to
compensate for pressure changes. The objective of this requirement is to ensure pressure
bumps (short duration cabin pressure changes) and pressure changes (due to flight altitude
changes or schedule changes) are regulated to prevent or minimize crew and passenger
discomfort.

TBS 1 should be filled in with the value for the rate of change of pressure.
TBS 2 should be filled in with the value of an acceptable range in which the pressure change
rate can be selected and automatically controlled.
These values should be based on physiological data that suggest the average person can
compensate for increasing pressure rate changes as high as 0.2 psi/sec without conscious
effort. For rates greater than 0.2 psi/sec, some conscious effort is required to maintain
equilibrium, and for rates 0.5 psi/sec and higher, discomfort is experienced even by experienced
crewmembers while attempting to maintain equilibrium across the eardrum. Therefore,
0.2 psi/sec is typically the maximum acceptable rate of pressure change for normal operation.
This includes all transient conditions.
The body is more tolerant to decreasing pressures and the 1.0 psi/sec is specified to minimize
problems due to decompression. These requirements are realistic and attainable. Commercial
systems are routinely designed for rates of 500 ft/min (0.004 psi/sec) for decreasing pressure,
and 300 ft/min (0.003 psi/sec) for increasing pressure (sea-level conditions). The commercial
standards should be considered for air vehicles designed for medical transport, since the
patients, due to ear blockages, may be more susceptible to the pressure changes. Automatic
controllers that allow for selection and control of the rate of pressure change anywhere in the
range of 100 to 2,000 ft/min are frequently required for non-combat air vehicles. This type of
control, along with a non-combat pressure schedule in “Occupied compartment pressure
schedule” in this appendix, allows the crew to select the most comfortable pressurization control
for the particular mission being flown. The values given above are applicable to all systems.
440
JSSG-2009A
APPENDIX D
TBS 3 should be filled in with an appropriate value for the maximum rate of pressure decrease
during emergency release. This value should not exceed 1.0 psi/sec.
TBS 4 should be filled in with an appropriate value for the maximum rate of pressure increase
during emergency repressurization. This value should not exceed 0.5 psi/sec.
In consideration of pressurization transients, significant problems have been experienced due to

dynamic incompatibilities between the major components of the pressurization system. These
examples include the following cases:
a. Lack of a pressure regulator upstream of the cabin has resulted in severe cabin pressure
surges since cabin outflow regulators often have not responded adequately to engine
bleed air transients during throttle maneuver.
b. Exhausting cabin outflow into the avionics compartment has caused enough back
pressure to the cabin airflow to prevent proper cabin pressure regulation during
transients.
c. Experience has shown the pressure regulator valves upstream of the cabin should be
dynamically matched to engine transient characteristics and the effective downstream
volume throughout the full range of airflow and pressures to prevent unsatisfactory cabin
transients.
d. Experience has shown the modification of an air vehicle’s ECS to increase cabin flow
rate necessitates careful analysis of the pressurization system dynamics to preclude
severe cabin pressure surges. In some cases, a mock-up may have been necessary to
evaluate adequately the major system modifications.
D.4.4.4.1.3 Rate of occupied compartment pressure change.

Rate of pressure change requirements shall be verified during flight test.

Verification is necessary to ensure the rate of pressure change in the occupied compartment(s)
is within the limits specified.

Verification of rate of pressure change requirements should be made during the test conditions
of “Occupied compartment pressure schedule”, “Unoccupied compartment, bay, and equipment
pressure schedules” in this appendix, and during periods of emergency pressure release and
repressurization at steady-state cruise conditions. All measurements of rate of pressure change
should be done to a standard. The worst (highest) slope should be taken over a 1-sec interval
( P/sec).
(TBD)
441
JSSG-2009A
APPENDIX D
D.3.4.4.1.4 Compartment positive and negative pressure relief.

Personnel injury and structural damage due to excessive positive or negative pressure within
compartments shall be prevented.

Protection from excessive pressure differentials and partial decompression is necessary for
crew safety and to prevent air vehicle structural damage.

Some means should be provided to protect against over-pressurization should the primary
control valve malfunction. Protection of occupied compartments from excessive positive and
negative pressures should be provided. Blowout panels or sufficient flow areas between
compartments should be provided to prevent personnel injury and structural failure in the event
of sudden decompression. The amount of protection required will vary depending upon the
mission of the vehicle and other factors. For example, on a wide-body air vehicle with many
compartments (such as the E-4B), requiring no structural damage due to rapid decompression
would impose a massive penalty on the air vehicle (structural weight). Instead, the requirement
should be, “Prevent structural damage which would preclude the safe return of the air vehicle”.
For example, floor collapse that severs control cables or hydraulic lines would be unacceptable,
but small, localized failures should be acceptable. A primary concern should be the prevention
of personal injury due to collapsing partitions, flying debris, or such. There are several factors
that should be considered in establishing these requirements. The cause of the rapid
decompression is an important factor (for example, loss of a cargo door, loss of a window, or
hull damage due to an engine disk failure). The larger the pressurized hull hole size specified,
the more difficult this requirement is to meet. For combat air vehicles, the type of oxygen
system being used and whether or not pressure suits are being used are also important factors.
The maximum altitude of the air vehicle is also a factor.
On special purpose air vehicles, further requirements or more detailed requirements may be
necessary to ensure vehicle safety and adequate performance.
The need for this pressure relief is proportional to the level of pressurization, and it is necessary
for crew safety. In cases where the actual pressurization is small (for example, 0.5 psid or
lower), it may be very difficult to generate higher pressure differentials even if there is a
component or system failure. In this instance it would not be logical to include additional
components to meet this requirement. But, if significant pressure forces can be generated, the
need for the requirement is also significant. Each system should be examined for this
possibility.
Multi-compartment air vehicles should be protected from excessive positive and negative
pressures, during both normal operation and in the event of sudden decompression.
Sudden decompressions have resulted in the loss of one DC-10 air vehicle and damage to
several others. The most serious DC-10 decompression resulted from the loss of a cargo
442
JSSG-2009A
APPENDIX D
compartment door. The sudden loss of pressure created an excessive pressure differential
across the floor and the floor collapsed. The collapsing floor severed control cables, which
resulted in loss of air vehicle control and subsequent crash of the air vehicle. The DC-10
incidents have dramatically emphasized the need to provide sufficient flow paths to prevent
damage or injury. This is an important safety-of-flight requirement.
D.4.4.4.1.4 Compartment positive and negative pressure relief.

Analyses shall be conducted to verify that personnel injury and structural damage will not occur
as the result of sudden decompression of one compartment for multi-compartment pressurized
volumes. The analysis shall assume a (TBS) square feet hole is opened in the fuselage of
cargo and transport air vehicles to cause the rapid decompression. Analysis shall be conducted
to verify adequacy of positive and negative pressure relief settings. Laboratory and ground
tests shall verify positive pressure relief function. Laboratory and flight tests (rapid descent)
shall verify the negative pressure relief function.

Analyses are the only feasible means of verifying many of these requirements because of the
inherent danger of personnel injury or air vehicle damage while simulating a rapid
decompression. This is especially the case since the requirement may permit some damage to
occur during extreme rapid decompression emergencies. Ground and flight tests can easily
verify most normal pressure relief functions.

TBS should be filled in with a value indicating the size (square feet) of the hole to be used for
analysis purposes associated with rapid decompression.
The decompression hole size considered for sudden decompression should be a function of the
cross-sectional area of the fuselage. FAR 25.365, Amendment 25-87 states, “Any opening in
the compartment up to size H0 in square feet; however, small compartments may be combined
with an adjacent pressurized compartment and both considered as a single compartment for
openings that cannot reasonably be expected to be confined to the small compartment.” The
size H0 should be computed by the following formula:
H0 = PAs
where
H0 = maximum opening in square feet, not to exceed 20 square feet.
As
P .024
6240
As = maximum cross-sectional area of the pressurized shell normal to the longitudinal axis,
in square feet.
443
JSSG-2009A
APPENDIX D
For pressurized rotary-wing air vehicles, the contractor should demonstrate by analysis that no
damage to flight controls, flight surfaces, or other air vehicle parts which could adversely affect
safety of flight and landing can occur as a result of sudden decompression, over-pressurization,
pressure differential, or negative pressure. For decompression analysis the contractor should
assume a hole size which results in the most severe condition. Hole sizes should be derived
from:
a. a door or canopy opening as a result of a faulty latch
b. a window
c. a failed engine turbine disk
d. enemy fire with subsequent loss of pressurization. For this analysis the contractor
should determine the maximum hole size sustainable (with respect to pressurization
problems) for vulnerability purposes and verify that the vulnerability requirement is not
compromised as a result of enemy fire and the loss of pressurization.
Analysis should be conducted to verify adequacy of positive and negative pressure relief
settings. Laboratory and ground tests should verify positive pressure relief function. Laboratory
and flight tests (rapid descent) should verify negative pressure relief function.
(TBD)
D.3.4.4.1.5 Occupied compartment pressure release.

The pressurization system shall have the capability for both normal and emergency pressure
release. The normal pressure release shall be capable of dumping pressure without shutting off
the pressurizing air source. The emergency pressure release shall be capable of dumping
pressure from maximum differential to (TBS 1) within (TBS 2) seconds with the
pressurizing air source shut off automatically at the initiation of the emergency dump. Pressure
differential following landing or following normal pressure release in flight shall not exceed
values that can result in personnel injury or air vehicle damage when hatches or doors are
opened when the pressurizing air source is operating.

Provisions for pressure release are required to quickly purge the occupied compartments of
smoke, fumes, toxic gases, and such contaminants; to allow in-flight air drop of cargo; to allow
the use of ram air for emergency ventilation; and to permit emergency escape. The normal
pressure release provisions are intended to clear the occupied compartments of smoke, fumes,
and such contaminants, when the ECS or other pressurization source is not the source of the
problem. This permits the most rapid clearing of the compartments. The emergency provisions
are intended for use when the pressurization air or ECS is the smoke or fume source, when
total ECS failure occurs and ram air ventilation is required, or an emergency condition exists
that requires emergency escape.
444
JSSG-2009A
APPENDIX D

TBS 1 should be filled in with the desired pressure to be reached in an emergency pressure
release.
TBS 2 should be filled in with the desired time to reach that pressure from the maximum
differential pressure.
The maximum possible rate of depressurization (not to exceed 1.0 psi/sec) is desired.
However, for air vehicles with large, pressurized volumes (1,000 cu ft or more), special
provisions, such as blowout panels, may be required to achieve a 0.5 to 1.0 psi/sec rate. In
these cases, the rate can be lower, but 60 seconds is generally considered a maximum
acceptable release time.
For this requirement, the engineer should determine if a maximum acceptable time for pressure
relief is to be specified, and if so, what it should be. This value will be influenced by mission
requirements, emergency procedures to be used on the vehicle. When other guidance is not
available, the following requirements should be considered:
a. For small, pressurized volume air vehicles: “The release time to dump from maximum
pressure differential to within 1 psi of ambient pressure should be within the range of 0.5
to 1.0 psi/sec.”
b. For large, pressurized volume air vehicles: “The release time to dump from maximum
cabin pressure differential to within 1 psi of ambient pressure should be not greater than
60 sec.”
One psi is used as the lower limit to establish the requirement because the rate of pressure
release will taper off rapidly at pressure differentials of less than 1.0 psi.
Air vehicle upgrades may result in increased flow rates of the pressurizing air source. When
this occurs, the pressurization system needs to be evaluated to determine if the outflow
capability can handle the increased flow without degrading the ground pressure differential
beyond acceptable limits.
Small residual differential pressures, across large surface areas, can result in forces that can
injure personnel and damage the air vehicle when hatches or doors are released under those
conditions. The contractor should evaluate his design and the air vehicle mission to determine if
and where provisions are necessary to relieve possible residual pressures before opening any
hatches, canopies, or doors.
This requirement should be met with the ECS operating, because under normal operating
procedures it is not desirable to turn off the ECS before operating canopies, hatches, or doors.
Some pressure release systems have failed to provide for canopy seal pressure release when
electrical power is off. This is a concern when procedures require electrical power to be shut off
immediately after emergency landing and canopy seal pressure must be released in order to
manually open the canopy.
445
JSSG-2009A
APPENDIX D
D.4.4.4.1.5 Occupied compartment pressure release.

Flight tests at steady-state cruise conditions and following landing shall verify pressure release
provisions. Further, if doors or canopies are not fully latched, these tests shall demonstrate that
appropriate action, as determined by a safety hazard analysis, can be taken to preclude an
unsafe condition from developing.

Verification is necessary to ensure that the ECS is capable of providing the appropriate
pressure release for normal and emergency operations. Flight-testing is the most accurate,
practical method of verifying most pressurization related requirements.

Pressure release provisions that must function for emergency escape or smoke evacuation
should be verified by analysis to be capable of functioning independently of the cause of the
emergency (such as an ECS fire), or in conjunction with the loss of the capability to shut off the
pressurization source in the event that the pressurization source is the cause of the emergency.
Experience on wide-body air vehicles has shown that laboratory tests of emergency pressure
relief provisions have been necessary to verify their proper and consistent function.
D.3.4.4.1.6 Occupied compartment leakage rate.

The maximum allowable leakage rate of pressurized compartments, including leakage through
the Environmental Control System, shall not exceed (TBS) .

Leakage rates are specified in order to ensure minimum safe pressure levels can always be
maintained.

TBS should specify the maximum allowable leakage rate. A study of inventory air vehicles has
shown leakage rates typically increase up to 1.6 times the rate existing during production
acceptance. Therefore, the in-service maximum allowable leakage rate included in field
maintenance manuals should use the maximum allowable leakage rate for production air
vehicles, as determined below, and multiplied by the 1.6 factor. The 1.6 may be adjusted if
there is more appropriate data on the increase of leakage rate in service for the particular type
of air vehicle being developed.
Seals themselves are part of the airframe. The ECS provides air for pressurizing the seals.
Therefore, an interface exists between the ECS and airframe. This interface should be closely
coordinated between the ECS engineers and airframe engineers.
446
JSSG-2009A
APPENDIX D
Several approaches can be taken to establish maximum leakage rates. Generally, it is specified
as the lesser rate that will result from the following considerations:
a. The maximum allowable leakage rate should not exceed one-half (1/2) the rate that will
ensure the compartment pressure altitude will not exceed a specified number of feet
during a maximum rate of descent without engine power, or at idle from maximum
operating ceiling with the compartment initially pressurized at a specified value, with the
pressurization air source shut off. The leakage rate for engine idle or without engine
power will ensure cabin pressurization is maintained until the air vehicle can reach a
safer altitude, thereby preventing physical injury to the occupants.
b. The maximum allowable leakage rate should not exceed one-half (1/2) the rate that will
ensure the required pressure schedule can be maintained with engines at idle speed.
c. If more than one air conditioning unit is supplying air to the pressurized compartment,
the maximum allowable production leakage rate should not exceed one-half (1/2) the
rate that will ensure the required pressure schedule can be maintained with one air
conditioning unit inoperative.
d. The maximum allowable leakage rate should not exceed 0.07V0.667 + 0.5 lb/min, where
V is the volume of the pressurized enclosure in cubic feet. The 0.5 lb. allows for the
leakage from outflow valves and air conditioning units.
For non-combat air vehicles, it is undesirable for the cabin altitude to exceed 30,000 ft, as that is
the threshold for a high incidence of decompression sickness, and the time of useful
consciousness without breathing oxygen is about 55 sec. Maximum cabin altitudes of
20,000—25,000 ft are much safer and should be design goals. With the 100 percent (100%)
factor of safety that is required (“one-half (1/2) the rate"), the desired goals will generally be met,
and the minimum requirements will always be met even with the in-service leakage rates. An
initial cabin pressure of 10 psia is usually specified, as this is equivalent to a cabin altitude of
10,000 ft—the usual set point for cabin pressurization warning systems, (see “ECS crew station
interface” in this appendix) and is the expected cabin pressure at the time the crew is alerted to
the problem.
For combat air vehicles, it is not desirable for the cabin altitude to exceed 42,000 ft, as that is
the maximum for continuous use of pressure breathing, and altitudes above 50,000 ft require
use of pressure suits. An initial cabin pressure of 35,000 ft is usually specified, as this is
equivalent to the usual 3 psi warning
light set point (reference “ECS crew station interface” in this appendix) and is the expected
pressure at the time the pilot is alerted to the problem. In summary, when using these criteria,
the engineer should complete the requirement based upon the type of air vehicle and the
pressurization warning instruments being specified. Typical requirements are:
a. Combat air vehicles. Will not exceed 42,000 ft when initially pressurized at 35,000 ft
cabin altitude—based on 3 psi warning set point (see “ECS crew station interface” in this
appendix).
b. Non-combat air vehicles. Will not exceed 30,000 ft when initially pressurized at 10 psi—
based on 10,000 ft cabin altitude warning set point.
447
JSSG-2009A
APPENDIX D
If the warning set points are different than above, the requirements should be adjusted
accordingly.
Experience has shown that an adequately designed system will be capable of maintaining the
required pressure schedule with the engines at idle speed, and in the case where there is more
than one air conditioning unit, with one of the units inoperative. The 100 percent (100%) factor
of safety (“one-half (1/2) the rate") ensures these requirements will be met under in-service
leakage rates.
The formula suggested in the guidance was empirically derived by the US Navy several years
ago. Use of these criteria over the years by both the Navy and Air Force has proved more than
adequate. It is usually used for large pressurized volume air vehicle.
Some fighter air vehicles in-flight leakage rates have been much higher than ground leakage
rates. Two causes have been identified:
a. Air loads may have caused sufficient displacement of the canopy to allow leakage
around the canopy seal.
b. If engines were operated at idle at high altitude, the engine bleed pressure may not have
been high enough to fully pressurize the seal. In some cases, this problem might have
been alleviated by a check valve, which retains the seal pressurization.
D.4.4.4.1.6 Occupied compartment leakage rate.

Leakage rates shall be established by analysis and measured during ground and flight tests on
each air vehicle to demonstrate acceptable leakage.

Verification is necessary to ensure that the ECS does not permit occupied compartment leakage
at a rate exceeding the maximum allowable limit.

A manufacturing assessment of the expected maximum cockpit leakage area compared to the
engineering established maximum limit should be a part of the analysis. Air vehicle factory
functional and flight tests should be conducted to verify pressurization system performance and
capability. A factory functional test should be conducted to determine the leakage rate and
effective leakage area by pressurizing the air vehicle to the maximum required pressure
differential. Usually, one of two methods is used for measuring leakage. Either the constant
pressure flow method or the time pressure drop method is employed. The constant pressure
flow method is normally used in all applications except those cases involving a large,
pressurized volume. The constant pressure flow method provides a consistent and accurate
leakage value.
Flight tests should be instrumented to recorded cockpit pressure and rate of pressure change.
448
JSSG-2009A
APPENDIX D
Experience has shown that restoring fighter air vehicles to delivery configuration after being
used in flight testing has resulted in leakage rates that were higher than initial delivery, and may
have exceeded the in-service leakage rate earlier than expected. This has been especially true
when the pressure bulkheads have been penetrated several times in different places during the
flight test program.
D.3.4.4.1.7 Occupied compartment pressure source.

The pressurization source shall provide a minimum flow rate to the pressurized compartment(s)
for all flight conditions of at least (TBS 1) times greater than the maximum allowable
production leakage rate. If required to meet the contamination requirements of “Occupied
compartment contamination” in this appendix, the pressure source shall be filtered. If stored
gas is used for pressurization, the partial pressure of oxygen shall be (TBS 2) . No single
failure of a supply or control component shall result in (TBS 3) . Means shall be
incorporated to seal all pressurization supply inlet openings into the occupied compartments to
prevent rapid loss of compartment pressure in the event of pressure source failure. For multiple
pressure sources, the pressure schedule shall be maintained with one inoperative source.

The purpose of this requirement is:
a. To ensure the pressurization system will perform satisfactorily throughout the operational
life of the air vehicle and to ensure the extra capacity is built in that is required to
overcome the additional leakage that occurs as air vehicles age or undergo
modifications.
b. To ensure the air supply meets minimum requirements for health and safety reasons.
c. Stored gas systems are rarely encountered in manned air vehicles. However, they may
occur in special applications and provisions must be made to ensure adequate oxygen
levels are maintained.
d. To ensure the safety of the crew and passengers under failure conditions.
e. More than one pressurization source is desirable on multi-engine air vehicles so single
engine failure will not result in loss of pressurization.
TBS 1: In-service leakage rates are as high as 1.6 times production leakage rates on current air
vehicles. The minimum flow should therefore be established based on the maximum allowable
in-service rate so pressurization can always be maintained. The greater the allowable leakage
rate, the greater the minimum requirements will be.
TBS 2: The rationale and supporting physiological data given for escape capsules can be used
to establish minimum oxygen levels.
449
JSSG-2009A
APPENDIX D
TBS 3: Failure requirements can be approached many ways. The following should certainly be
considered when systems designs are established and reviewed:
a. No single failure of any control component should result in an occupied compartment
pressure altitude in excess of 12,000 ft on air vehicles without a diluter demand pressure
breathing oxygen system.
b. On air vehicles with diluter demand pressure breathing oxygen systems, no single failure
of any control component should result in an occupied compartment pressure altitude in
excess of 35,000 ft.
c. Ideally, no single failure should result in failure of any other component.
d. Simultaneous failure of the pressure regulator and the safety valve should not occur as a
result of a single component failure, a sensor or control line failure, or a sensor or control
line leak.
e. Provisions should be made to ensure safe pressure levels are maintained in the event of
probable failures such as interruption of electrical power or loss of pneumatic control
pressure.
f. Provisions should be provided for emergency pressurization if any single failure causing
loss of pressurization air source occurring at maximum altitude could result in
crewmembers being incapacitated before the air vehicle can descend to 42,000 ft with
pressure breathing.
The approach to this requirement that most simply and directly addresses the true requirement
is specifying the probability of the failure and the resulting impact. It is undesirable for low
probability failures (such as a duct rupture) to impact the design adversely. Conversely, with
more likely failures (such as a pressure regulator failure) it is desirable that proper safety
provisions be made. The desired result is to prevent the cabin altitude from exceeding safe
levels for sufficient time for the crew to take appropriate corrective action.
Under failure conditions, a maximum altitude of 35,000 ft is usually specified for air vehicles with
diluter demand oxygen systems, as that is the maximum altitude for continuous use of demand
oxygen systems. For air vehicles without a diluter demand oxygen system, a maximum altitude
of 12,000 ft is usually specified. Twelve thousand feet corresponds with the normal FAA
requirements for passenger-carrying air vehicles, and is within the range of 10,000 ft (maximum
without continuous use of oxygen) and 18,000 ft (maximum for emergency use without oxygen).
For air vehicles with high altitude missions, particularly single-engine air vehicles where the
engine is the only source of pressurization air, loss of the pressurization source will require rapid
descent to below 42,000 ft (unless pressure suits are used). Under some circumstances it may
not be feasible to attain a low enough leakage rate, or some other requirement might exist that
would make an emergency pressurization source a mandatory requirement or a more desirable
approach. The objective is to ensure adequate cabin pressures are maintained for emergency
descents.
With two engines, the system should be designed so either engine can independently maintain
pressurization. With two or more engines, the system should be designed to maintain
pressurization with any one engine failed. Controls should be provided to permit isolating failed
engines and to give the crew flexibility in selecting the pressurization source or sources.
450
JSSG-2009A
APPENDIX D
Use of check valves in place of shut-off valves at the engines should be discouraged. A shut-off
valve gives more confidence that the valve will function properly (fail closed) in maintaining
pressurization.
Filtration adds weight and maintenance requirements. The ECS engineer should coordinate
with the engine project engineer or the cognizant engineer for other possible pressure sources
to ensure that appropriate contamination levels are specified for the air supply from those
sources. Sometimes, however, the engines or other pressure sources may be government-
furnished equipment (GFE) or already designed prior to the air vehicle award. In this case
filtration may be the only alternative. (SAE AIR1539 is a good reference on possible sources of
contamination that could enter the occupied compartment through the ECS.)
(TBD)
D.4.4.4.1.7 Occupied compartment pressure source.

The capability of the ECS
a. to provide the required minimum flow rate to the required locations for all flight conditions
shall be verified by (TBS 1) .
b. to meet the required contamination requirements shall be verified by (TBS 2) .
c. to provide the required partial pressure of oxygen (if applicable) shall be verified by
(TBS 3) .
d. to limit damage to the maximum allowable resulting from a single failure shall be verified
by (TBS 4) .
e. to seal all pressurization supply inlet openings in the event of pressure source failure
f. to maintain the pressure schedule with one inoperative pressure source (for multiple
pressure sources subsystems) shall be verified by (TBS 6) .
Verification is necessary to ensure that the pressure sources of the ECS functions are required.

TBS 1: Analysis and flight tests should be used to verify the minimum flow rate to pressurized
compartments.
TBS 2: Air source contamination levels should be verified during qualification testing of the
pressure source. Any filtration required to meet the requirement should be verified.
451
JSSG-2009A
APPENDIX D
TBS 3: The partial pressure of stored gas sources should be verified during qualification testing
of the pressure source.
TBS 4: Failure mode and effects analyses should be used to verify that no single failure results
in damage greater than the maximum allowable.
TBS 5: Inspection of drawings and the air vehicle should be used to verify incorporation of
means in air supply inlet openings to prevent rapid loss of compartment pressure in the event of
pressure source failure.
TBS 6: For multiple pressure source applications, analysis should be used to verify the ability to
maintain the pressure schedule with one source inoperative.
(TBD)
D.3.4.4.2 Temperature control
D.4.4.4.2 Temperature control
D.3.4.4.2.1 Cooling
D.4.4.4.2.1 Cooling
D.3.4.4.2.1.1 Occupied compartment in-flight cooling.

The air conditioning subsystem shall be capable of in-flight cooling as follows: (TBS) .

A proper thermal environment is necessary for the passengers and crew to prevent or minimize
the performance degradation due to heat stress. Any equipment contained in the occupied
compartments must be maintained within a suitable environment to operate satisfactorily as well
as to have an acceptable reliability and interface with passenger and crew occupants.

TBS: The following should be considered, and specified as appropriate:
a. Type of cooling requirement approach
1. Pilot envelope
2. Average compartment
3. Combination
b. In-flight cooling requirement
1. Factor (dry bulb, WBGT, or such)
452
JSSG-2009A
APPENDIX D
2. Temperature limits (including touch temperature limits)

c. Active or ram air cooling
Cooling requirements will usually be established based upon the type of air vehicle and its
unique operational requirements. The cooling requirements are also a reflection of the thermal
balance for the air vehicle to insure thermal stability for airworthy operations. The thermal
conditioning of the crew is cognitive to sustaining the maximum or nominal skills required for
optimum performance and execution of mission functions in a thermally stressed environment.
The ECS is a required thermal conditioner for performance of weapon systems operation.
Manned air vehicles can generally be divided into three categories. The first is fixed wing air
vehicles with small volume compartments where the crew members are essentially restricted to
their seats; fighter, attack, trainer and observation air vehicles typify this category of air vehicle.
The second category is the fixed wing air vehicles with larger volume compartments where the
crew or passengers can move from their seats; cargo, transport, navigation training, command
and control, patrol, electronic counter measure, and similar air vehicles typify this category. The
third category is typically rotorcraft including helicopters and tilt rotor fixed wing air vehicles.
a. Small volume (combat) air vehicles. Generally, the “average compartment temperature”
has been used to define and establish cooling requirements. This approach has been
unsatisfactory because it is very difficult to distribute the cooling air adequately to obtain
reasonable minimal temperature gradients while at the same time obtaining the desired
temperatures. The real requirement is to cool the pilot and other crewmembers.
Experiences on the F-15, A-10, and F-5, along with many discussions with pilots, have
resulted in the conclusion that pilots prefer a cooling system where the cooling air is
blown across their envelope and where they have control over the direction of the
airstreams. This has led to the development of the “Pilot Envelope Temperature”
approach to specifying cooling requirements. The Pilot Envelope Temperature is
defined as the arithmetical average of temperature measurements taken about the
envelope occupied by the crewmember and should include measurements taken at the
ankle, knees, hips, chest, shoulders, and head. For early design and analysis purposes,
and until test data is available, formulas of the following form have been found to be an
acceptable predictor of the Pilot Envelope Temperature:
Tpe = .85 (Tout - Tin) + Tin
where
Tpe = Pilot Envelope Temperature
Tin = Air Supply Inlet Temperature
Tout = Compartment Discharge Temperature.
This empirical equation does not take into account any heat added as a result of using
the air for avionics cooling before discharging from the compartment (such as on the F-
15, where after cooling the pilot the air is used to cool avionic equipment on the deck
behind the pilot before being discharged), and should be adjusted accordingly.
453
JSSG-2009A
APPENDIX D
By specifying the pilot envelope temperature, the true requirement is then addressed
(cooling the pilot). The dry bulb temperature has been the factor most often used to
specify cooling and heating performance requirements because it is readily understood
and easy to measure. However, there are many factors that influence how a person
feels thermally—ambient temperature, air velocity, humidity, solar radiation, and such.
As a result, many factors have been proposed and used as predictors of human stress,
including Effective Temperature, and Wet Bulb Globe Temperature (WBGT). The
WBGT has been shown to be a better indicator of these various factors, and is defined
as:
WBGT = .7Twb + .2Tbg + .1Tdb
where
Twb = Wet Bulb Temperature
Tbg = Black Globe Temperature from a 5 cm sphere
Tdb = Dry Bulb Temperature.
The WBGT should be specified to be met and measured in the vicinity of the crew
member’s head and shoulders. Historically, the Air Force has used 90°F as the
maximum limit for the WBGT value. Although the WBGT is a better measure of crew
comfort, it is difficult to predict and the measurements are more difficult and costly.
Other factors can enter into establishing the cooling requirements, such as clothing worn
by the crew members. The development and use of ventilation garments could reduce
the requirements for cockpit cooling.
b. Large volume air vehicles (non-combat). On large volume air vehicles, the crew
members and passengers may be able to leave their positions and move about the air
vehicle. In these cases, temperature limits should be established for all areas of the air
vehicle which personnel may enter. The “average compartment temperature” is
generally used in this case, thereby assuring that reasonable temperatures are
maintained throughout each compartment. The average compartment temperature is
the arithmetical average of dry bulb temperatures taken throughout the compartment,
excluding areas such as within 6 in. of the floor, where severe temperature gradients
occur due to typical 60°F floor temperature requirements. Specifying the average
compartment temperature, along with appropriate distribution requirements, will result in
the desired environment. Again, other factors, such as the WBGT, may be appropriate
in some circumstances rather than dry bulb temperature. Many other requirements,
such as clothing, may influence the cooling requirements.
A combination of Pilot Envelope Temperature and Average Compartment Temperature
may be the best approach for many air vehicles. A Pilot Envelope Temperature could be
specified for crewstations, with an Average Compartment Temperature specified for the
remainder of occupied areas.
454
JSSG-2009A
APPENDIX D
c. Rotorcraft. The approach taken on rotorcraft will depend on its usage. Generally,
rotorcraft were not actively cooled. More recently attack type helicopters and anti-
submarine helicopters have had active cooling for the crew to reduce heat stress and
improve crew performance. Transport helicopters, particularly in the cabin are not
usually actively cooled; however, recent requirements for both the crew and passengers
to wear NBC protective clothing may add to the heat stress and may require active
cooling. Typically the cockpit of these air vehicles are cooled to the same requirements
as the cockpits of combat air vehicles. The cabins of rotorcraft with active crew such as
anti-submarine helicopters are cooled to the same extent as non-combat air vehicles.
Troop transport rotorcraft generally have no active cooling‘ using only ventilation for heat
removal. On air vehicles where use of ram air is restricted because of NBC or other
requirements, some active cooling may be needed.
Once the approach to be taken in specifying cooling requirements (Pilot Envelope versus
Average Compartment Temperature) is established, the problem becomes one of determining
the maximum temperature limits allowable. This is roughly the equivalent to a 70 to 75°F
environment under high humidity conditions and can be as high as 85°F under low humidity
conditions. A value of 70°F is the generally accepted ideal temperature. Under supersonic, low
altitude, and possibly other flight conditions, maintaining a 70°F environment may impose
significant penalties on the vehicle. Therefore, higher limits are frequently used for these flight
conditions which are generally of limited duration (less than 30 minutes). Human performance
degradation occurs at temperatures above 80 to 85°F. Therefore, under flight conditions of 30
min or less, 80°F is a typical requirement. Under short duration conditions (about 10 min or
less), temperatures as high as 90°F may be acceptable without performance degradation. For
steady state conditions the compartment discharge temperature should not exceed 95°F.
For air vehicles or portions of air vehicles without an active cooling system, compartment
temperatures are typically specified to be within 10°F of outside ambient temperature.
The real objective is to prevent the mental and physical degradation of the crew. Exact
determination of temperatures and times where deterioration begins to occur is dependent upon
the individual and the circumstances. So, based upon the above discussion, table D-I can be
used as a guide to establish cooling requirements for actively cooled air vehicles.
TABLE D-I. Cooling guidelines.
DRY BULB
TEMPERATURE FLIGHT CONDITIONS DURATION TIME
70°F All flight conditions over 30 min. duration
80°F All flight conditions 10-30 min. duration
90°F All flight conditions less than 10 min. duration
On most air vehicles, the ground operation, low level, or supersonic flight conditions will usually
be the design points for the ECS and are typically less than 30 minutes in duration, so the 70°F
455
JSSG-2009A
APPENDIX D
requirement is usually attainable. However, on air vehicles with long supersonic capabilities or
other severe flight conditions, 80°F would be acceptable for longer times if it eases the design of
the system.
To best determine the dry bulb temperatures to be used, trade studies should be performed.
The resultant dry bulb temperatures should meet the above requirements based on the
environment specified in the air vehicle specification.
Based on in-depth studies of crew performance, the Crew Technology Division, United States
Air Force School of Aerospace Medicine (USAFSAM), WRIGHT-PATTERSON AFB OH 45433;
http://www.wpafb.af.mil/afrl/711hpw/usafsam.asp, has recommended that the WBGT in the
vicinity of a crew member’s head and shoulders not be greater than 90°F during flight
operations.
D.4.4.4.2.1.1 Occupied compartment in-flight cooling.

The capability of the air conditioning subsystem to provide the required in-flight cooling shall be
verified by (TBS) .

Verification is necessary to ensure the capability of the air conditioning subsystem to provide the
required in-flight cooling.

TBS: Verification should be accomplished by analyses, qualification and flight testing, or a
combination thereof. Flight testing should provide the final verification that the subsystem
meets the performance requirements. Flight testing is the only means to verify performance
under many conditions, such as transients.
Laboratory tests should simulate as best as possible all critical flight conditions including
transients. Laboratory testing is an ideal place to test reaction to failures. Flight testing should
be performed to verify computer analyses and laboratory testing. (It may be necessary to rerun
computer analyses and laboratory tests to correspond to the flight test conditions.) Conditions
not easily simulated in the laboratory should also be flight tested.
There are several factors involved with selecting a maximum temperature difference from the
specified ambient for performing testing. The larger the difference the easier it is to find a test
location, but the extrapolation to specified conditions will be less accurate. There is less loss of
accuracy if the computer model is very detailed, laboratory tests are extensive and the
laboratory and flight test instrumentation enables component performance to be evaluated. If
the computer model and laboratory testing is limited, the flight test should be performed within
10o F of the specified ambient. With a more accurate computer model and extensive laboratory
testing and laboratory and flight instrumentation, a difference of 20o F may be tolerated. If the
ground case is determined to be one of the sizing conditions, the use of the Environmental
Chamber at Eglin AFB should be considered. This allows use of the actual specified conditions
456
JSSG-2009A
APPENDIX D
while removing the risk of not being able to reach specified test conditions when the ECS testing
is scheduled.
System performance tests should be conducted with a minimum of 75 percent (75%) of the
passenger and crew accommodations occupied during cooling tests.
Government experience has shown that comprehensive analyses are essential early in the
development of a system. As a result, the Government has developed several general
computer programs for use in the analysis of Environmental Control Systems. These programs
are routinely used to evaluate the design and performance of proposed systems and to
establish performance requirements for future systems.
During the evaluation of alternative cooling upgrades for a Special Operations Forces program,
the user requested a multitude of information and data on system performance for every
conceivable environment and location. A fairly simple, “basic" computer model was created
based on a simple compartment air vehicle platform. The resultant compartment temperatures
were computed using simple heat balance equations. This tool proved invaluable.
Experience has shown that the adequacy of the air conditioning system should be established
early in the design of the system to avoid problems and expensive design changes.
Several Navy aircraft have had problems with inlets for heat exchangers or ground air too close
to exhausts from engines or APU. The result was that the cooling performance did not meet
predictions. Analyses should consider the conditions at inlets and not automatically assume
they are at ambient conditions.
D.3.4.4.2.1.2 Occupied compartment ground cooling.

For steady-state, sea level ground operation, the air conditioning subsystem shall be capable of
providing cooling at (TBS 1) under the following conditions: (TBS 2) .

Ground cooling system performance must be specified for maintenance of crew and cabin
equipment environments. The air vehicle mission requirements for crew ground time and cabin
equipment ground operating time will dictate the severity of the requirement.

TBS 1 should be completed with the temperature limits required for the air vehicle.
TBS 2 should be completed with the operating conditions at which the ground cooling is to be
provided.
Ground cooling that uses the onboard air vehicle system can be a very severe design condition
because engine bleed air pressures are generally low at engine idle power settings and APUs
generally supply bleed air at relatively low pressure and flows. The system should be capable
457
JSSG-2009A
APPENDIX D
of providing cooling during ground operation, using the air vehicle propulsion engines operating
at idle power, the APU (if one is required for the air vehicle mission), or bleed air supplied from
ground support equipment (if bleed air ground connections are required). The actual cooling
requirements will depend upon the mission of the air vehicle under consideration. The actual
requirements should also contain ground alert requirements if the air vehicle’s mission states
the air vehicle will be on alert. Occupied compartment temperature requirements for fighter and
attack air vehicle have typically been 85 to 95°F, while requirements for transport air vehicles
have been 70 to 85°F. Rotorcraft follow the above guidelines where active cooling has been
used. The requirements for any equipment contained in the occupied compartment should also
be established.
It is essential that high-g cockpits be cooled before takeoff. Trade studies should be performed
to match ECS design to ground cooling requirements, based on the maximum ground ambient
temperature specified in the air vehicle specification. Trade studies should also be performed to
study the use and operation of ground carts to minimize Environmental Control System use.
The F-15 did not have an established requirement for cooling the cockpit with a ground cooling
cart and thus there were no provisions for doing so. It was later found that it was necessary to
run both engines during engine trim. One is the engine being trimmed and the other is to
provide cockpit cooling.
D.4.4.4.2.1.2 Occupied compartment ground cooling.

The capability of the air conditioning subsystem to provide appropriate cooling for steady-state,
sea level ground operation shall be verified by (TBS) .

Verification is necessary to ensure that the air conditioning subsystem is capable of providing
the required level of cooling for steady-state, sea level ground operations.

TBS should be filled in with analyses and air vehicle ground tests.
Ground testing should be performed with the air vehicle painted as it will be when operational.
Extrapolating test data could be performed, but many multi-colored paint schemes such as
camouflage are difficult to analyze.
(TBD)
458
JSSG-2009A
APPENDIX D
D.3.4.4.2.2 Heating
D.4.4.4.2.2 Heating
D.3.4.4.2.2.1 Occupied compartment in-flight heating.

The air conditioning system shall be capable of heating as follows: (TBS) .

Heating must be provided for occupied compartments in order to provide a proper thermal
environment for the passengers and crew to prevent or minimize the performance degradation
due to cold stress. The thermal conditioning of the crew is cognitive to sustaining the maximum
or nominal skills required for optimum performance and execution of mission functions in a
thermally stressed environment.

TBS: Either the Pilot Envelope or Average Compartment Temperature approach can be taken
to specify heating requirements. Once the approach is established, the problem becomes one
of determining the minimum temperature limits allowable. This would be in the range of 75 to
85°F under low humidity conditions (which are most likely under cold day conditions). A
temperature range of 70 to 80°F is generally accepted as ideal for heating. Human
performance degradation occurs at low temperatures. Skilled motor performance shows a
progressive loss with continual cold exposure. A value of 60°F is the lowest temperature
recommended for consideration. This lower value is typically used for cabin areas of transport
rotorcraft. Clothing and crewmembers’ duties and responsibilities are factors that should be
considered while establishing these requirements.
The most widely used cold stress indicator is the dry bulb temperature.
(TBD)
D.4.4.4.2.2.1 Occupied compartment in-flight heating.

The capability of the air conditioning subsystem to provide the required in-flight heating shall be
verified by (TBS) .

Verification is necessary to ensure that the air conditioning subsystem is able to meet the in-
flight heating requirements of the air vehicle.
459
JSSG-2009A
APPENDIX D

TBS: Analyses, laboratory qualification testing, and air vehicle ground and flight tests should
verify the capability of the heating system to meet the specified requirements.
It is difficult to find consistent ambient temperatures which reflect the cold temperatures
specified in MIL-HDBK-310, particularly for ground operations. Therefore, ground chamber
testing is highly recommended for air vehicle testing. The use of the Environmental Chamber at
Eglin AFB should be considered, particularly where heating is known to be an issue based on
previous experience. Rotorcraft and external stores typically have difficulties meeting heating
requirements. The chamber allows use of the actual specified conditions while removing the
risk of not being able to reach meaningful test conditions when and where the ECS testing is
scheduled. If testing in the chamber is not possible, constraints should be placed on the
maximum temperature envelope allowed for heating tests. At the very minimum, tests should
be constrained to the winter months in a climate that has a true winter season. If chamber tests
are not to be performed, a more accurate ECS model should be developed and extensive
laboratory tests performed to supplement the ground and flight testing.
(TBD)
D.3.4.4.2.2.2 Occupied compartment ground heating.

For steady-state, sea level ground operation, the heating subsystem shall be capable of
(TBS) .

Heating must be provided for occupied compartments in order to provide a proper thermal
environment for the passengers and crew to prevent or minimize the performance degradation
due to cold stress.

TBS: Ground heating using the on-board air vehicle system can be a severe condition because
engine bleed air pressures and temperatures are lowest at engine idle power settings; APUs
supply relatively low pressure and temperature bleed air; and electrical power is limited. The
subsystem should be capable of providing heat during ground operation using the air vehicle
propulsion engines operating at idle power; from a compressor being driven off the engine; the
APU (if one is required for the air vehicle mission); or bleed air supply from ground support
equipment (if bleed air connections are required).
For rotorcraft, heating requirements may be met by using an auxiliary combustion, exhaust or
electrical heater. If an auxiliary heater is to be used, the ECS engineer should consult with the
air vehicle project engineer to determine if it should be provided in a kit for cold weather
460
JSSG-2009A
APPENDIX D
operations. The actual heating requirement will depend upon the mission of the air vehicle
under consideration. Requirements typically fall in the range from 60 to 80°F.
All ground heating requirements should be based upon trade studies to determine the ECS
capability relative to the specified environmental conditions. Throttle advancement should be a
last resort option that can be used to attempt to fulfill this requirement. If this approach is
chosen, a study should be performed to assess the consequences in taking this approach.
(TBD)
D.4.4.4.2.2.2 Occupied compartment ground heating.

The capability of the heating subsystem to provide the required heating for steady-state, sea
level ground operations shall be verified by (TBS) .

Verification is necessary to ensure the heating subsystem is able to meet the heating
performance requirements.

TBS should be filled in with analyses, laboratory qualification testing, air vehicle ground and
flight testing, or an appropriate combination of these methods.
(TBD)
D.3.4.4.2.3 Avionic and equipment compartment temperature control.

The temperature of all avionics (includes all electronic equipment installed on the air vehicle)
and equipment compartments shall be maintained as follows:
a. The required avionic ambient temperatures shall be maintained for all continuous,
intermittent and short-time ground and in-flight operating conditions as specified (TBS 1)
.
b. The inlet cooling or heating fluid temperature and flow rate to forced air and liquid cooled
equipment shall be maintained for all continuous, intermittent and short-time ground and
in-flight operating conditions as specified (TBS 2) .
c. Temperature control for avionic equipment and equipment compartments shall be
automatic.
461
JSSG-2009A
APPENDIX D

Temperature control must be provided for avionic equipment so internal components will always
operate within the temperature range used to predict reliability and integrity of the avionics. To
achieve desired reliability and integrity, it is necessary to require that proper temperature control
be maintained for all statistically significant ground and flight operating conditions and ambient
extremes of temperature and humidity. Controls must be incorporated which automatically
maintain the desired avionic environment. To prevent adverse effects due to low temperature, it
is necessary to limit both minimum inlet cooling air temperature and maximum flow rate to
avionic equipment. The inlet cooling or heating fluid temperature and flow rate to forced air and
liquid cooled avionics and the compartment temperatures for ambient cooled avionics must
always stay within the range to which each equipment is designed for any possible ambient
ground and flight operating condition and ambient extremes of temperature and humidity to
ensure equipment operates as specified and does not fail.

TBS 1: The ambient temperature surrounding the avionics is to be maintained to insure
avionics operating temperatures are maintained as a means of insuring performance
requirements and integrity requirements of the equipment and overall air system are met.
Based on this condition, it is highly recommended that a team approach of analyzing and testing
the temperature control needs of the avionics be performed jointly with platform system
engineers, ECS and environmental engineers, thermal management subsystem engineers, and
avionics engineers as a minimum to provide meaningful results.
A comprehensive trade study of avionics reliability and integrity versus ECS cooling capability
should be required to meet reliability and integrity requirements. Where there is insufficient
information on avionics reliability and integrity versus temperature, a temperature below the
maximum allowable temperature should be selected or the avionics contractor consulted. A
temperature of 27ºF below the maximum operating temperature was used in the former Navy
specification. Several fighter programs have designed the exhaust temperature of forced
cooled equipment to be maintained below the maximum ambient temperature, which usually
corresponded to the maximum inlet temperature. The following actions should be taken to
perform a comprehensive trade study:
a. To provide the needed information from the avionics contractor, the ECS engineer
should coordinate with cognizant avionics and environmental engineers for the
equipment to be used and recommend that for all newly designed or significantly
modified equipment, each avionics contractor conduct a detailed, analytical thermal
analysis on each “black box" module early in the design phase. The analysis should
predict internal component temperatures for various worse case operational
environmental conditions; the conditions being defined by a component life cycle
environmental profile (LCEP) per task 402 of MIL-STD-810 (conducted either by the
combat/materiel developer staff or contractor). The thermal analysis is necessary to
verify that the amount of coolant flow required will maintain internal component
temperatures at or below the level necessary to satisfy component environmental
qualification requirements which addresses all airworthiness (reliability, integrity and
safety) issues. Transient thermal analyzer programs are available to conduct the
462
JSSG-2009A
APPENDIX D
thermal analysis. This should be followed by a thermal verification test on each piece of
avionics. The test should be conducted on prototype or preproduction equipment
representative of the design to be released for production. The avionic equipment
should be operated at conditions of maximum heat dissipation in the worst-case
specified environment with cooling equivalent to that provided on the air vehicle and at
the temperature at which reliability and integrity predictions are made. The equipment
should be instrumented so that temperatures are monitored (1) for all critical parts, (2)
for any part whose individual dissipation is 1 percent (1%) or more of the total equipment
dissipation, and (3) such that the sum of the dissipation of the monitored parts is 90
percent (90%) or more of the total unit heat dissipation. The purpose of this test is to
verify that the cooling provided and the internal arrangement of components within the
“black box" module will result in component temperatures that are at or below the levels
necessary to achieve the required reliability and integrity. Where existing GFE or
Commercial Off-The-Shelf (COTS) equipment will be used, it may not be possible to
obtain an analysis or test data from the avionics contractor. Working with avionics
engineers and reliability and integrity engineers, it may be necessary to estimate the
required information based on the data available. For further guidance on avionic
equipment thermal design, analysis, cooling requirements and test procedures, refer to
MIL-STD-2218.
b. The airframe contractor should use the above information to conduct a comprehensive
trade study of avionics reliability and integrity versus ECS cooling capability. The trade
study should consider all factors affecting life cycle cost and air vehicle penalties. The
study should consist of determining the overall avionics reliability and integrity for various
levels of avionics cooling. The levels to be considered should be a wide range of
coolant inlet temperatures such as 0 to 90°F. For each of the inlet temperatures studied,
a range of exit temperatures such as 100 to 160°F should also be considered. For each
of the inlet-exit temperature combinations studied, the effect on ECS weight, volume,
and development cost, and effect on air vehicle penalties should be determined. The
overall effect on life cycle cost should then be determined for each of the combinations
and the ECS/Avionics Cooling approach that results in minimum life cycle cost without
degrading avionics reliability and integrity requirements should be selected.c. An
alternate approach to comprehensive analysis focus and reliability is a system
engineering approach focused on the integrated system performance of systems
insuring thermal balance conditioning of the air vehicle. Optimization of the avionics
system for thermal conditioning can be achieves by making an exergy assessment of the
system to insure the thermal conditioning minimizes the adverse entropy effects of the
integrated system for thermal conditioning. The purpose of thermal conditioning is not
only a reliability issue but a performance function required to insure mission success.
TBS 2: Prevention of overcooling should be considered since particular pieces of avionics
equipment may have a limited operating temperature range or may be subject to condensation.
Heating may be required for very sensitive equipment.
Change in temperature is just as an important factor in avionics reliability and integrity as the
absolute temperature. Consideration should then be given to establishing requirements on the
fluctuation of temperature. A firm requirement for fluctuation limits has not been established.
Work at the Naval Air Development Center on an earlier avionics technology indicated that the
463
JSSG-2009A
APPENDIX D
most critical part temperature of the avionics should not vary more than ±11°F at no more than
±11°F per hour. The applicability of this to today’s avionics is not clear.
It is important that proper consideration be given to temperature control requirements at the

beginning of the program, especially if new avionics are to be designed. A cooperative effort of
both avionics and ECS engineers should be established to ensure compatibility between the
ECS and avionics equipment. Such consideration should eliminate the need for many future
modifications which are caused by failure to consider all aspects of avionics and equipment
compartment cooling, such as:
a. Effects on temperature control of changes in air vehicle engine bleed air to ECS, and
intermittent operation.
b. ECS performance during operational use and air vehicle maneuvers and possible ECS
performance degradation.
c. Magnitude and length of time of air vehicle induced aerodynamic heating on
compartment temperatures.
d. Avionics heat load growth factors. (see “Growth” in this appendix)
e. Proper cooling air flow and pressure balancing distribution since all forced air cooled
avionics do not have the same pressure drop versus air flow rate characteristics.
f. Equipment duty cycles.
g. Solar radiation.
h. Thermal integrity.
In the future, the coordination of avionics and ECS requirements is expected to become much
more difficult. With the emphasis on the use of COTS equipment, there will be large variations
in avionics requirements. The ECS engineer should ensure the requirements established for
the ECS will meet the requirements of all the avionic equipment. Considerable coordination and
compromise may be required. Commercial Off-The-Shelf equipment and GFE should probably
not be specified to inlet temperature and flow compatible with the optimum ECS for lowest air
vehicle penalty. It may be necessary to negotiate changes to the specifications where possible.
For example, the avionics may be designed for a high inlet temperature (many commercial
systems use ambient or cabin air) which would require a high flow, but it may be possible for the
avionics to be satisfied with a lower flow if a lower temperature can be ensured as with air
directly from a refrigeration system (a typical combat air vehicle design). The ECS engineer,
however, cannot arbitrarily make this assumption without detail knowledge of the thermal design
of the equipment and coordinated discussions and agreement with the avionics engineer and
the equipment installer.
(SAE AIR1277 provides excellent background information and guidance in how to establish
interfaces between the ECS and avionic equipment.)
Department of Defense (DOD) experience has shown significant improvement in avionics

reliability and reduced life cycle cost can be achieved by providing air conditioning for avionics
464
JSSG-2009A
APPENDIX D
to minimize the environmental extremes experienced by the avionics. The design of hot air
vehicle structures requires the input of three, separate, technical disciplines to be successful.
Environmental Control System, structures, and aerodynamics engineers all need to be involved.
Frequently, only one or two of these disciplines have been involved on past programs. This has
led to serious design deficiencies in several, different air vehicle programs. Solution of this
problem in the future requires the recognition of the potential problem by the engineers involved
and the involvement of all affected disciplines early in the air vehicle design effort.
Past experience has shown the main concern has been to maintain avionics component
temperatures within their acceptable minimum and maximum limits. This approach results in
designing the avionics cooling system with only sufficient cooling capability to maintain avionics
components just at or below maximum allowable temperatures under hot day conditions. Also,
many past systems allow the coolant temperature to fluctuate throughout a wide range.
Temperatures allowed to fluctuate and reach maximum limits have adversely affected avionics
reliability on past systems.
Overcooling of avionics has been a problem on a number of air vehicles and resulted in the
need for system changes. Problems resulted due to cold soaking of the equipment at high
altitude with extremely cold air. Avionics failed when moisture condensed and froze on the cold
avionics when the air vehicle returned to low altitude.
The F-15 incorporated an adjustable avionics flow control to provide the increase in cooling
capability to take care of the growth avionics. To maximize the benefits of increasing avionics
reliability, the total capability was used to overcool the avionics before the complete complement
of growth avionics was added. It was discovered the original system tests were all conducted
with predicted distribution system back pressures based on avionic equipment added to the
system for the particular flow rates under evaluation. The higher back pressure that resulted
from forcing higher flows into a distribution system designed for lower flows caused an instability
in the control system. The solution was to degain the cabin flow controller. The solution was
easier than the effort involved in identifying the problem.
The F-14 air vehicle was designed to have its forced cooled equipment to exhaust at a
maximum of 160°F, the maximum ambient temperature of MIL-HDBK-5400 Class 2 equipment.
The reliability was acceptable for that generation of air vehicle. For the F-18 air vehicle, an in-
depth study was performed and an exhaust temperature of 140°F was selected as the normal
exhaust temperature. Improved reliability was achieved with this approach. As it turned out the
140°F was easy to achieve by installing a valve to the electronic counter measure transmitter,
which is closed whenever the transmitter is off or removed, which is the majority of the time.
With the transmitter on, the system can maintain all the avionics at 160°F, but when it is off or
removed, the flow that would have gone to it is shared with the other avionics, maintaining them
at 140°F.
The original Phoenix Missile required heating from the F-14 air vehicle on cold days to achieve
its required operating temperature. The design of the heating system assumed that once the
required temperature was reached, there would be sufficient internal heating to maintain the
temperature. This was not the case. Due to exposure to external temperatures at altitude, the
missile cooled below its required temperature, but the heating system did not activate until very
465
JSSG-2009A
APPENDIX D
cold temperatures were achieved. The problem was corrected by a controller change, which
was costly at the late stage at which it was discovered.
D.4.4.4.2.3 Avionic and equipment compartment temperature control.

Avionic and equipment compartment temperature control shall be verified by (TBS) .

To ensure adequacy of temperature control provisions for avionics, both analyses and test are
required. Analyses are required early in the program to ensure proper thermal design of the
avionics and proper capacity of the cooling system. These analyses then need to be verified by
laboratory and flight test after the hardware is available.

TBS should be filled in with analyses, component tests, ECS test rig and air vehicle ground and
flight tests; as well as allowable deviations from maximum operating conditions.
Analyses should be conducted early in the development program to ensure adequacy of

avionics cooling system capacity for all ground and flight conditions. The analysis should
itemize the equipment and indicate the required environment for normal, transient, and
emergency operating conditions to be maintained for each piece based on the reliability
allocations established by the contractor. Furthermore, equipment that is performance sensitive
to temperature should be itemized. The analysis should show that transient temperature
environments during cold soak start ups and hot soak cool downs for these selected pieces of
equipment are consistent with their functional specification requirement (the equipment is
allowed to function within the prescribed time and performance tolerance as set forth in the
detailed equipment specification). The analysis should be conducted assuming a full
complement of equipment (maximum heat load) and soak conditions at the extreme hot and
cold day cases for the start up requirements. The validated ECS performance model should be
used to predict the equipment flow rate and temperature supply conditions. Then these supply
conditions should be used to predict avionics and electrical equipment reliability, and lastly the
predicted reliability numbers should be compared to the allocated requirements. A cooperative
effort among reliability, air vehicle system, avionic and ECS engineers is required to determine
what flight and ground operations, under which environmental conditions, will occur for a
sufficient enough amount of time to be considered statistically significant in the reliability
calculations. The contractor may consider the equipment duty cycle in the reliability predictions.
Laboratory tests and air vehicle ground and flight tests should verify the ability of the ECS to
provide the required coolant (flow rate and temperature) to each piece of forced cooled avionic
equipment for all ground and flight conditions. Inspection of drawings and flight demonstration
should verify automatic temperature control for avionic equipment and equipment
compartments. Laboratory tests and flight tests should verify minimum inlet coolant and
maximum flow rate do not result in overcooling avionic equipment.
Ground and flight testing should be performed on the approved design represented by the air
vehicle configuration control including the production paint scheme. Testing of any proposed
changes to the configuration should only be done after testing of the approved configuration is
466
JSSG-2009A
APPENDIX D
complete. Suitable instrumentation should be installed to measure the system performance and
to allow a computer model of the ECS performance to be validated. Measurements include, but
are not necessarily limited to, coolant flow rate, temperature, pressure, humidity, contaminants
or contaminant simulants, pressure differential across each major component of the system,
airflow (pounds per minute), the temperature differential, and the pressure drop across each
major component of the system, including the electronic equipment and equipment bays. The
flight test conditions selected should reflect the worst-case ground and flight conditions for the
type of air vehicle being developed.
It is usually very difficult, and as a result costly, to find the ambient temperatures specified in the
air vehicle specification, but due to the non-linear nature of ECS, it is also difficult to accurately
extrapolate test date over large ambient temperature differences. Therefore, some maximum
temperature difference from the specified value should be required. Extrapolation cannot be
accurately performed unless steady state conditions are reached in the test. There are several
factors involved with selecting a maximum temperature difference from the specified ambient for
performing testing. The larger the difference the easier it is to find a test location, but the
extrapolation to specified conditions will be less accurate. There is less loss of accuracy if the
computer model is very detailed, laboratory tests are extensive and the laboratory and flight test
instrumentation enables component performance to be evaluated. If the computer model and
laboratory testing is limited, the flight test should be performed within 10o F of the specified
ambient. With a more accurate computer model and extensive laboratory testing and laboratory
and flight instrumentation, a difference of 20o F may be to tolerated. If the ground case is
determined to be one of the sizing conditions, the use of the Environmental Chamber at Eglin
AFB should be considered. This allows use of the actual specified conditions while removing
the risk of not being able to reach specified test conditions when the ECS testing is scheduled.
Often not all avionics are available at the time of the avionic cooling flight test, because of
development problems or security requirements. Missing avionics can invalidate the test. An
approach to this should be established and provided in the specification. Any missing avionics
should be simulated in flow or heat load as applicable. It is difficult to generalize as to how
many boxes could be missing before the tests become meaningless. The heat load of the
missing boxes is of course important consideration. One approach is to require that all avionics
be included in the test. This would require negotiations if boxes are missing as test time
approaches, but the specific boxes and their possible impact on the test would be known.
During the testing of the F-14 avionic cooling system several deficiencies were noted and
changes were made to the flight test air vehicle to correct the deficiencies, such as added
insulation. The original configuration was never fully tested. Following the flight test, many of
the changes incorporated on the flight test air vehicle were never incorporated in the production
air vehicle; therefore, the test data did not reflect the performance of the production air vehicle,
which had some reduced but unknown capacity.
Although all testing can be accomplished in ground and flight testing, experience has shown
that significant cost can be saved by doing as much as possible in laboratory test. This is
particularly true of the distribution system. It is difficult to do a very accurate analysis of a
complex duct system with restrictions, changes in geometry, and such. Testing in the laboratory
467
JSSG-2009A
APPENDIX D
can verify or correct much of the flow distribution problems. The interface with the ECS can
also be performed. Flight testing is then required to verify there are no flight interactions that
were not anticipated in the laboratory, and to test transients not possible in the laboratory.
For the F-18A/B aircraft, the radar cooling flow was assumed to discharge to near ambient
pressure, but it turned out that the compartment to which it discharged was partially pressurized
due to ram effects. This resulted in low flow and sometimes reverse flow in this cooling leg.
Discharge conditions should be considered when analyzing cooling system performance.
D.3.4.4.2.4 Avionic ground operation.

On the ground with engines operating, the ECS shall provide cooling at the level established in
“Avionic and equipment compartment temperature control” in this appendix, except for
equipment that does not require ground cooling. Ground check out or maintenance of the
avionics without engines operating shall be performed using the following: (TBS 1) . Ground
operation of (TBS 2) shall be automatically prevented unless coolant is provided to the
avionics. Operation of all avionics required during start-up and air vehicle ground servicing shall
be possible without requiring refrigerated coolant from ground carts or the onboard cooling
system.

Avionic failure or degraded reliability can result from operating the avionics on the ground during
maintenance without providing proper cooling. Since ground operation can account for
50 percent (50%) or more of the avionics' total operating time and for many air vehicles it is the
most severe operating condition, a significant reduction in reliability can result from operating
the avionics on the ground without cooling or with inadequate cooling. Therefore, requirements
need to be established to provide adequate cooling for avionics that is required to run on the
ground and to prevent ground operation of avionics automatically unless proper cooling is
provided. Maintenance crews need to perform certain maintenance tasks without using ground
carts or running the onboard ECS. Certain avionics may have to be powered during ground
servicing. Certain avionics may require operation prior to starting the cooling system.

Historically ground cooling of avionics has been the most overlooked area when ECS
requirements are specified. As noted in rationale a significant amount of avionics operation is
performed on the ground where ambient conditions are most severe. In addition the commonly
used bleed air powered air cycle systems produce marginal or inadequate flow rate and
temperature with the engines at ground idle power. Many air vehicles have had no internal
ground cooling capability without the engine or APU running. Where there are no ground carts
or where they are difficult to use or time consuming to retrieve and start, avionics have been
operated with no cooling. As a result of this many-sided ground cooling deficiency, avionics
reliability has suffered.
The ground cooling issue is a multidisciplinary problem and an air vehicle system engineering
challenge for thermal balance and stability to insure mission and airworthy performance. It is
essential that when requirements are being defined that the ECS engineer coordinate with this
multidisciplinary group in order to define the ground cooling strategy. The group consulted
468
JSSG-2009A
APPENDIX D
should include the air vehicle systems engineer to define how the air vehicle will be used, the
avionic engineers to determine the ground cooling requirements of the avionics, the
maintenance engineer for maintenance requirements, ground support engineers to determine
what types and capacity of ground cooling and pneumatic carts, the APU engineer to determine
the capacity of the APU for ground cooling and the reliability engineer to determine impact of
ground cooling temperatures on avionics reliability. The approach developed will vary greatly
with the type of air vehicle and its base of operation. For most air vehicles, during operation on
the ground with engines operating, the ECS should provide sufficient cooling to air and liquid
cooled avionic equipment including COTS and cockpit equipment, and equipment
compartments to meet equipment and reliability requirements.
TBS 1: The major issue to be determined is what source of cooling will be used when air
vehicle engines are off. The ECS engineer with guidance from the inter-disciplinary team will
have to determine if cooling will come strictly from internal or external sources or from both.
The use of an onboard APU is usually desirable for air vehicles to be operated at remote bases
or if the APU is already planned to be installed for engine starting. The APU should have
enough capacity to provide both the electrical as well as cooling capacity simultaneously for the
avionics that will be needed to operate on the ground. Selective running of the avionics on the
ground can reduce APU requirements but should be coordinated with the avionic engineers.
Adequate air vehicle internal cooling sources that utilize ambient air or internal fuel could
eliminate or minimize the need for external cooling sources, such as ground cooling carts.
Fans, although a weight penalty, have provided excellent flexibility for carrier based air vehicles
providing adequate cooling under all but the most severe operating conditions. The trend
toward liquid cooled avionics will make the use of fans less attractive. Connections for standard
ground carts should normally be planned. The extra weight for the connections is small in
comparison to the benefit and flexibility of being able to use the ground cart. The use of ground
carts as the only source of cooling with the engines off reduces the weight impact on the air
vehicle, but can be an added burden to maintenance. Note that for carrier-based air vehicles,
use of APUs and pneumatic ground carts are very limited on the hangar deck where the
majority of avionics checks and maintenance are performed.
TBS 2: Provisions for automatic shut-off of avionic equipment is needed to prevent ground
operation when proper cooling is not being provided, except for equipment which have been
excluded, such as the inertial navigation system (INS) or equipment required to do ground
servicing. Many newer air vehicles use a Vehicle Management System (VMS) to control air
vehicle systems such as the ECS. If the VMS does control the ECS or the ground cooling fans
necessary to run the avionics, the VMS must be excluded from the automatic ground shut-off.
The automatic shut-off provisions should be designed to be inoperable during flight and taxiing
on the ground when equipment operation is required. Coordination is required with the avionic
engineers to ensure that the equipment that needs to operate for some period without cooling is
properly specified.
Experience has shown avionics are often operated on the ground during maintenance without
any cooling provided to the equipment. This leads to reduced avionics reliability. The F-15 air
vehicle was modified to incorporate an interlock to prevent electrical power to the avionic
469
JSSG-2009A
APPENDIX D
equipment unless adequate cooling was provided. This change was required because avionics
failures were attributed to ground operation without cooling.
At the Critical Design Review (CDR) for the C-17 air vehicle, the using command identified the
need to be able to jack the airplane, change tires, fuel or defuel the air vehicle, and such,
without wheeling out ground carts or running the onboard ECS off the APU. Operation of
certain avionics is required for these maintenance tasks. As a result, the cooling system had to
be redesigned so ambient air could be brought into the cooling loop to cool these avionics. If
this capability had been identified early in the program, a redesign would have not been
required.
On some programs lack of communication between the avionic engineers and ECS engineers
has led to inadequate ground cooling of avionics. When terms such as “operating on the
ground,” are used, people sometime assume this means normal mission operation only. On one
program avionic engineers indicated during the requirements definition phase that the
equipment, which had a large heat load, was not required to operate on the ground, forgetting
the equipment sometimes requires check-out on the ground. During the development phase,
however, the requirement was mentioned. Accommodations were made, but the cooling
provisions were not totally adequate, since the APU, which powered the ECS, had already been
selected and was under capacity to meet this additional load. This is a common oversight with
transmitting devices such as radars, which would be hazards if operated normally on the
ground, but these devices will normally need some periodic check or calibration using a dummy
load. These uses are infrequent, but cooling is needed when these large powers are dissipated
and must therefore be accommodated in the cooling design.
Avionics thermal conditioning in the 21st century has moved ground operation mode to air
vehicle operation configuration that has to be defined as a critical parameter for determining
operational definition for maintenance operations. Recent air vehicles like the F-35 and F-22
aircraft have made this configuration a serious perspective for the design understanding of the
air vehicle because it defines derived requirements for thermal conditioning and air vehicle
operations on the ground. The self-sufficiency configuration will be a driver in the development
of the air vehicle concept of operations (CONOPS) and maintenance management of the air
vehicle to insure mission and turn around times can be sustained to provide proper timelines for
maximum effectiveness under extreme environmental conditions.
D.4.4.4.2.4 Avionic ground operation.

The ability of the air vehicle ECS to meet ground avionic operation requirements shall be
verified by (TBS) .

An early analysis of the ground cooling provisions is required. Incorporation of provisions late in
the program could be costly and delay the program. Ground demonstration tests are required to
verify the analysis and to ensure air vehicle cooling provisions have the capacity to cool all air
cooled and liquid cooled avionic equipment needed for normal ground operation, servicing and
470
JSSG-2009A
APPENDIX D
maintenance, including COTS, cockpit equipment, and equipment compartments during hot,
humid days with air vehicle engines operating and not operating.
It is necessary to verify that the onboard avionics cannot be operated on the ground during
periods of inadequate cooling. This can be verified easily through a ground demonstration.
Testing should also demonstrate that the automatic shutoff provisions do not shutoff equipment
while the craft is in flight. It is necessary to verify that all avionics required during air vehicle
ground servicing can be operated without augmented cooling.

TBS should be filled in with analyses, demonstration, inspection, and test.
Demonstration tests should show automatic shut-off provisions are inoperable during flight and
taxi when equipment operation is required. An analysis of the proposed approach to ground
cooling should be performed and presented at the Preliminary Design Review and updated at
CDR to ensure it is reviewed by the full multidisciplinary team involved with this area. The
analysis should include all potential ground maintenance and operational scenarios for the air
vehicle. It should specify what avionics will be on and what the heat load will be. It should then
specify what modes of ground cooling will be used and what their capacities are. Mechanization
profile of each thermal conditioning scenario should be incorporated as an intregal part of this
verification process to insure sequencing does not create issues from a transient viewpoint as
well as steady state.
Demonstration tests are needed to ensure the adequacy of ground cooling capability of air
vehicle internal and external ground cooling sources.
The demonstration tests for adequate air vehicle cooling provisions for avionic equipment during
normal ground operation, maintenance and servicing procedures should pertain to all avionics
used during these operations. Ground demonstration of equipment automatic shut-off
provisions when cooling is insufficient, should apply to all of the onboard avionic equipment
unless some have been excluded, such as the INS. The demonstration tests should also
include verification that equipment automatic shut-off provisions are not operable during flight
and during taxiing when equipment operation is required. Compatibility of the ECS design with
air vehicle internal ground cooling sources, external cooling sources and carrier deck facilities
when required, should be shown. The ECS engineer should coordinate with the avionic
engineers to ensure the equipment that is to operate without cooling for certain periods is
demonstrated to those requirements.
(TBD)
471
JSSG-2009A
APPENDIX D
D.3.4.4.2.5 Occupied compartment air distribution.

a. The conditioned air shall be distributed so that (TBS 1) .
b. Directional and quantity adjustable air outlets shall be provided for (TBS 2) .
c. The air from any outlet into occupied compartments shall not exceed (TBS 3) °F for any
single failure.

Proper air distribution is essential for adequate heating and cooling. Distribution requirements
should be specified to prevent excessive temperature differences, limit the velocity of air
movement past crew members and passengers, and prevent the airflow from being fixed
directly onto crew members' bodies in a distracting or irritating manner.

TBS 1: Distribution requirements should be specified to prevent excessive temperature
differences, limit the velocity of air movement past crewmembers and passengers, and prevent
the airflow from being fixed directly onto crewmembers’ bodies in a distracting or irritating
manner.
TBS 2: The following should be considered and specified, as appropriate.

a. Minimum distribution requirements. For air vehicles or positions where the Pilot
Envelope Temperature is specified, a minimum of two outlets per crewmember should
be provided. Each outlet should be flow- and direction-controllable by the crewmember.
Consideration should be given to providing four outlets – two forward facing gaspers and
two along side of each crewmember.
b. Maximum temperature variations.
c. Requirements for foot outlets. These can be specified for certain positions, or can be
specified as contractor-provided, as appropriate.
d. Requirements for gaspers. This includes the miscellaneous requirement of
subparagraph “Miscellaneous” (d), below.
The approach that should be taken on the distribution system depends on the way the heating
and cooling requirements are specified (Pilot Envelope Temperature versus Average
Compartment Temperature).
a. Pilot Envelope Temperature Approach. For proper cooling (which can be interpreted as
adequate pilot comfort), proper flow distribution is essential. Military experience has
shown pilots are generally most satisfied when the cooling air is blown across their
envelope by controllable outlets they can adjust for both direction and flow rate
according to their personal preference.
b. Average Compartment Temperature Approach. In large, occupied compartments, as in
passenger or cargo air vehicles, the distribution system should be designed to provide
adequate mixing of the air to prevent excessive temperature differences. This is
472
JSSG-2009A
APPENDIX D
generally accomplished by an overhead distribution duct located along the center or both
sides of the compartment. The air is exhausted through the sidewalls near the floor.
In addition to the overall approach to the distribution system, other factors should be
considered:
a. Temperature variation. The air should be uniformly distributed to prevent excessive
temperature differences. Temperature variation between any two points in the pilot’s
envelope should not deviate more than an 5 to 10°F from the “Pilot Envelope
Temperature.” These values are typical, reasonable requirements that minimize the
temperature variations across the crewmembers. When using the Average
Compartment Temperature, the temperature variation between any two points in the
envelope occupied by seated personnel should not deviate more than 10°F from the
average compartment temperature. Under certain circumstances, further details may be
appropriate, such as excluding the area within 6 inches of the floor because of low floor
temperatures and the resulting influence on temperatures near the floor. However, if the
floor is excluded, a minimum floor temperature should be specified because the feet are
very sensitive to cold. A minimum floor temperature of 55°F is recommended unless it
causes a severe weight or power penalty. It may be also be appropriate to specify
maximum temperature differences for areas outside the envelope of seated personnel,
where movement is possible. Values of +10 to +15°F are typical for the envelope
immediately occupied by personnel.
b. Foot outlets. Foot outlets or foot warmers should be considered for proper heating (and
cooling) of the crewmembers’ feet in many crew positions. This is particularly true of
pilot and copilot positions in most air vehicles, aerial refueling operator’s stations, and
such. The feet are very sensitive to the cold; proper attention to foot outlets is essential.
c. Gaspers. Cold air outlets or “gaspers” are typically provided at crewstations and
passenger positions. These are flow-and-direction-controllable outlets that provide cool
air (usually 35°F) and can be adjusted to accommodate the individual who occupies the
position. Gaspers can be required for crew positions, passenger positions, galleys,
lavatories, or other places where individual temperature and flow control is desired.
d. Miscellaneous. The conditioned air, defog air, or anti-fog air should be distributed to
prevent the crew’s exhalation from fogging or frosting transparencies. This requirement
does not apply to non-mission-essential windows. The air flow should not be “fixed”
directly into the crewman’s eyes or onto the crewman’s arms or shoulders. Defog or
anti-fog air should not impinge on the crew. The impact of hot avionics around the crew
should also be considered in the design of the distribution system.
TBS 3 should be filled in with the maximum allowable air temperature. The temperature of the
air entering occupied compartments is normally limited to 200°F for a single failure condition.
Figure D-2 shows the F-5F cockpit air distribution system, which has proved very acceptable.
The diffusers forward of the crewmembers are on the right side and the diffusers along side the
crewmembers are along the left canopy rail. Both diffusers are controllable for direction and
flow rate.
473
JSSG-2009A
APPENDIX D
Figures D-3 and D-4 show the F-15 distribution system. This system, although acceptable, had
one disadvantage—the continually flowing 88°F +3°F canopy anti-fog air impinged on the pilot’s
helmet and face, making him feel warm on low altitude, hot day flights. The problem was
corrected by providing pilot control of the anti-fog flow temperature and providing a defog
temperature setting.
The A-10 air vehicle is another example. Figure D-5 shows the original cockpit distribution
system. The cockpit of the air vehicle is essentially a titanium shield “bathtub,” and penetrations
of the armor shielding were held to the absolute minimum. As a result, the outflow valves and
safety valves were located on the deck behind the pilot. The conditioned air supply duct splits
into two similar lines which come up and over the titanium armor shielding and deliver the
conditioned air from each side of the pilot at about mid-chest level. The holes in these “back
warmers” were fixed to provide proper air velocity along the cockpit sidewalls to permit the
entire cockpit to be cooled to 80°F. In retrospect, it has been concluded that this distribution
system tends to “short circuit” the cabin and pilot with some of the airflow going directly from the
back warmers to the outflow valve. During flight testing, surveys and comments indicated pilots
were not satisfied with the distribution in the cockpit. As a result, changes were made to the
distribution system to improve the overall effectiveness of the ECS and to satisfy the pilots'
requirements. The revised distribution system is shown on figure D-6. The back warmer ducts
were extended and routed inside the cockpit along both sides forward of the pilot and
terminated at aft-facing, multi-directional, adjustable outlets. The adjustable outlets permit the
pilot to direct the air on or away from his body. The pilot is able to shutoff the air with the
adjustable outlet. Figure D-7 shows the improved flow distribution that received rapid
acceptance.
Figures D-8 and D-9 show the E-3 Airborne Warning and Command Systems (AWACS) air
conditioning distribution system and the corresponding cabin air distribution systems.
Figure D-10 shows the AWACS flight deck distribution system. It should be noted the
distribution system provides for both crew position cooling (using gaspers and shoulder
warmers), and general flight deck cooling (using the overhead diffuser).
D.4.4.4.2.5 Occupied compartment air distribution.

a. The conditioned air distribution shall be verified by (TBS 1) .
b. Directional and quantity adjustable air outlets shall be verified by (TBS 2) .
c. Prevention of high temperature air into the occupied compartments shall be verified by
(TBS 3) .

Verification is necessary to ensure that the air distribution requirements are met.

TBS 1 should be filled in with laboratory development testing and air vehicle ground and flight
tests.
474
JSSG-2009A
APPENDIX D
TBS 2: Inspection of drawings should show that each crew member has foot warming outlets
and individual air gaspers for cooling at the torso and head levels.
Analysis and flight or laboratory testing should demonstrate the adequacy of the design. The
analysis should show that the distribution system is optimized to cool and heat the
crewmember’s envelope (torso and head) to the system requirement by controlling the air flow
and direction. The analysis should also show that the temperature variation in the
crewmember’s envelope does not vary by more than 10°F. The laboratory or flight test should
include sufficient dry bulb thermocouples to determine the conditions in the pilot envelope area.
The tests should also show that the air can be directed to optimum locations and that flow-rates
can be adjusted.
Adequacy of adjustable outlets can be evaluated by crew comments. A cockpit mock-up is

recommended for ECS testing to find possible problems in the duct layout and flow distribution.
This mock-up can be integrated with the instrument mock-up by installing the ECS ducting and
actually doing flow and distribution tests.
475
JSSG-2009A
APPENDIX D
FIGURE D-2. F-5F cockpit air distribution system.
476
JSSG-2009A
APPENDIX D
FIGURE D-3. F-15 cockpit air distribution.
477
JSSG-2009A
APPENDIX D
FIGURE D-4. F-15 cockpit air distribution.
478
JSSG-2009A
APPENDIX D
FIGURE D-5. Original A-10 cockpit air distribution.
479
JSSG-2009A
APPENDIX D
FIGURE D-6. New A-10 distribution duct routing.
480
JSSG-2009A
APPENDIX D
FIGURE D-7. Revised A-10 cockpit flow pattern.
481
JSSG-2009A
APPENDIX D
FIGURE D-8. Cabin air distribution system installation.
482
JSSG-2009A
APPENDIX D
FIGURE D-9. Cabin air distribution.
483
JSSG-2009A
APPENDIX D
FIGURE D-10. Flight deck conditioned air distribution system.
TBS 3: An analysis should be used to demonstrate that a means exists to prevent harmful or
damaging high temperature air from causing equipment damage or personnel injury during
normal operation or for a single failure condition. This analysis should be made a part of the
System Safety Hazard Analysis and documented.
For fighter air vehicles, it has been recommended that a minimum of nine thermocouples be
used to determine Pilot Envelope Temperature. Location recommendations are: two at the feet,
two at the knees, two at the hips, two at the shoulders, and one at the head above the helmet
and shielded from solar influence. An optional tenth thermocouple can be added on the
instrument panel (glare shield) center line.
484
JSSG-2009A
APPENDIX D
D.3.4.4.2.6 Avionic coolant distribution.

Removal of avionic equipment from their mounting racks during flight and on the ground shall
not adversely affect the distribution of air and liquid coolant flow supplied to the remaining
avionic equipment.
There shall be no cooling capacity loss due to the removal of equipment from the coolant
distribution lines or ducts.

Maintaining proper coolant flow to all remaining avionics is necessary when one or more units
are removed from their mounting racks, in order to preserve the reliability and operability of
those remaining avionics.

Proper coolant flow distribution to all avionic units should be maintained. Avionic equipment can
be adversely affected by reduced coolant or loss of coolant when the coolant flow distribution is
disturbed by the removal of one or more units from the mounting rack and the coolant lines to
and from the equipment are left open. Degraded performance, reduced reliability, and avionic
failures can occur.
Shut-off devices in the coolant flow lines or ducts and mounting racks, of all avionic units, that
automatically close the coolant flow to and from the unit(s) being removed should be
considered. For air cooled equipment, not in a closed system, a shutoff device that
automatically closes the flow line with an orifice plates having the same flow-pressure drop
characteristics as the units being removed should be strongly considered. Coolant flow lines of
liquid cooled units should contain provisions for quick-disconnect and self-sealing automatic
shut-off devices to and from the units to eliminate coolant loss. Blind connections should be
avoided.
There should be no leakage in coolant distribution ducts and flow lines. The design and
compatibility of avionic equipment inlet and exit control of air and liquid coolant flow distribution
and shut-off provisions should be coordinated with the air vehicle inlet and exit ducts and flow
lines. To achieve this, an early cooperative effort between ECS and avionic equipment
engineers, both contractor-furnished equipment and GFE, is required.
Critical to the use of liquids in coolant systems is establishing a means to prevent leaks and
determine the quantity of loss that will no longer allow effective performance and maintenance.
Based on the maintenance focus on systems being managed using a two level maintenance for
line replaceable units, it is recommended that liquid systems consider closed loop operations to
minimize the impact of leaks and maximize the opportunity for containment and easy
maintenance. This guidance is recommended as a means for highlighting the impact of the
distribution system and methodology on the air vehicle’s operations for turning the air vehicle for
effective battlefield missions and operations.
485
JSSG-2009A
APPENDIX D
The S-3 air vehicle had orifice plates to replace units that were removed from the air vehicle.
However, they were kept on the ground and were often lost or hard to find when needed.
The F-18 air vehicle had plates that automatically closed when the box was removed and was
pushed out of the way when the box was reinstalled. The F-18 units greatly reduced the overall
maintenance time for removing and replacing a box as well as ensuring the proper flow balance
was maintained.
D.4.4.4.2.6 Avionic coolant distribution.

Proper avionic coolant distribution shall be verified by (TBS) . Ground demonstration on the
air vehicle shall verify that one or more pieces of avionic equipment can be removed from their
mounting racks without adversely affecting coolant distribution to the other avionics and that
liquid cooled boxes can be removed without any leakage of the coolant.

It is necessary to verify the ability to remove avionics on the ground without adversely affecting
flow distribution to the remaining avionics and to remove a liquid cooled box without any
leakage of the coolant.

TBS: Inspections and tests under actual coolant flow conditions should verify no coolant
leakage or loss in the distribution ducts and flow lines.
Coolant shut-off and coolant distribution control devices to and from avionic units that allow the
units to be removed from their mounting racks without coolant loss and without adversely
affecting coolant distribution to other avionic equipment should be verified. Proper coolant
distribution to remaining avionics when one or more avionic units are removed from their
mounting racks should be verified. These items should be verified for cockpit and cabin and for
each of the different avionics racks or bays in the air vehicle.
Air Force experience has noted a loss of valuable turn around time for operations when the
origination point of coolant leaks cannot be determined and quickly repaired. The trace of line
runs from a physical perspective is often difficult due to packaging constraints and conditions,
especially for tactical system air vehicles; therefore, special emphasis is expressed for a more
disciplined design pursuit in using liquid-based cooling systems. Thermal packaging of the
design is the critical element required for success of this type system. The F-22 radar system is
a classic system using Polyalphaolefin (PAO) coolant in a key liquid cooling system that is a
lead determinant in the viability of the F-22 air vehicle as an effective weapon system and
battlefield operator. Therefore, it is imperative that the design of the liquid distribution system is
486
JSSG-2009A
APPENDIX D
understood and the rapid turn around of this system under failure conditions is also understood
to insure valuable timelines can be retained for a vehicle’s return to operations.
D.3.4.4.2.7 Occupied compartment air velocity.

The velocity of air moving past personnel shall be controlled to less than (TBS 1) .
Air velocity in the vicinity of litter patients shall not exceed (TBS 2) .

Air velocity must be limited to ensure a satisfactory environment, prevent blowing of maps,
papers, and other loose items at crew stations.

TBS 1: The conditioned air should be properly diffused to limit the velocity in the vicinity of the
crew and passengers. Typically, the velocity of air moving past crewmembers is limited to
300 to 500 ft/min, depending upon the crew station and crewmembers’ responsibilities. The air
velocity in the vicinity of passengers is typically limited to 300 ft/min.
TBS 2: The air velocity in the vicinity of litter patients should not exceed 50 ft/min.
When these requirements are considered, it should be kept in mind that high velocities for
extended periods are annoying and fatiguing. High velocity air can also be an acoustical noise
problem. Variable and directional flow control is highly desirable at crew stations to allow for
individual preference and mission variables (use of maps, as an example).
One of the pilot complaints on the original A-10 distribution system was the high air velocity,
which interfered with their maps and knee pads.
D.4.4.4.2.7 Occupied compartment air velocity.

Air velocity requirements shall be verified by analysis and (TBS) testing.

Verification is necessary to ensure that the air velocity requirements are met.

TBS: A cost-effective approach for adequately verifying this requirement should be determined
and specified. Typically airflow rates are highest at sea level and can be tested in a mock up or
in the air vehicle on the ground. If the system design is such that higher flow rates or variation
in the direction of flow rates may result in flight, flight-testing should be required.
487
JSSG-2009A
APPENDIX D
(TBD)
D.3.4.4.2.8 Occupied compartment flow shutoff.

A method to shut off all air flow to occupied compartments shall be incorporated. At least two
means shall be provided to shut off hot air sources to occupied compartments. Accessible
means for direct manual operation in flight shall be provided for (TBS) .

Total flow shutoff capability is required to prevent the introduction of smoke, fumes, toxic gases,
or other such contaminants, into the occupied compartments when the source of the
contaminants is the ECS and to shut off the system due to a failure (for example, full hot). Dual
means to shut off hot air sources are necessary to prevent a single failure from resulting in the
inability to shut off hot air to occupied compartments. On cargo, bomber, and other large air
vehicles, means for manual operation of certain valves can significantly reduce mission aborts
since faulty valves can be manually overridden.

TBS: The manual operation of trim valves, hot air bypass valves, and other such valves, is
highly desirable if the valves can be located where they are accessible to the crew. This
capability is highly dependent upon the location of the air conditioning package within the air
vehicle. In general, this is a “desirable” capability. In some cases, operational needs may
dictate a firm requirement; otherwise, the requirement could be specified as, “...should be
provided for hot air bypass valves, trim valves, and other such valves, as possible.”
The hot air bypass valve on the C-130 has frequently stuck in the open position. This valve is
accessible, and the crew has corrected the problem by manually closing the valve. This
capability has prevented many mission aborts or degraded missions due to ECS failure.
D.4.4.4.2.8 Occupied compartment flow shutoff.

The ability to shut off all air flow to occupied compartments shall be verified by (TBS 1) . The
incorporation of at least two means of shutting off hot air sources to occupied compartments
shall be verified by (TBS 2) . Accessible means for direct manual operation of identified
valves shall be verified by (TBS 3) .

Verification is necessary to ensure that the requirements for occupied compartment flow shutoff
are met.
488
JSSG-2009A
APPENDIX D

TBS 1 should be filled in with inspections of drawings and air vehicle demonstrations.
TBS 2 should be filled in with inspections of drawings.
TBS 3 should be filled in with inspections of drawings and air vehicle demonstrations.
(TBD)
D.3.4.4.2.9 Transient temperature control
D.4.4.4.2.9 Transient temperature control
D.3.4.4.2.9.1 Transient ground cool-down.

The air conditioning system shall be capable of cooling (TBS 1) to an average temperature
of (TBS 2) within a time period of (TBS 3) following a ground heat soak at (TBS 4)
conditions.

Cool-down transient performance requirements are necessary to ensure compartment crew and
equipment environmental compatibility with mission requirements.

Transient cool-down requirements are mission oriented. Ground maintenance and alert
requirements should be addressed when cool-down requirements are developed. Defense
customers need to be an integral part of this process to insure customer needs are achieved by
this design process and the proper CONOPS are created for proper, integrated operation
between man and machine to achieve mission success.
TBS 1 should be filled in with the compartments and equipment requiring transient ground cool
down. This may have to generalized, since equipment requirements may not be known when
the specification is prepared.
TBS 2 should normally be consistent with the upper level of the temperatures established in,
“Occupied compartment ground cooling” in this appendix.
TBS 3 should typically be 15 to 30 min; however, shorter or longer cool-down times may be
required as mission requirements dictate.
TBS 4 should use the daily cycle of high temperature and humidity combined with solar
radiation called out in the air vehicle specification. The air vehicle specification will normally call
out the table in MIL-HDBK-310. This table should be used if it is not referenced in the air
vehicle specification and modified to be consistent with the air vehicle specified conditions.
489
JSSG-2009A
APPENDIX D
Ambient conditions should be adjusted to account for induced effects such as the increased
heating effects from a heat soaked tarmac.
(TBD)
D.4.4.4.2.9.1 Transient ground cool-down.

The capability of the ECS to provide the required transient ground cooling shall be verified by
(TBS) .

Verification is necessary to ensure that the ECS requirements for transient ground cooling are
met.

TBS should be filled in with the appropriate combination of analysis and testing.
Testing should start no later than three hours prior to sunset to avoid falling temperatures. Note
that the time to start the test will vary with the season. The test should proceed until all internal
temperatures are varying by less 2°F/hr. The test data should be extrapolated to the conditions
specified for the air vehicle.
Testing should be performed with the air vehicle painted as it will be when operational.
Extrapolating test data could be performed, but many multi-colored paint schemes such as
camouflage are difficult to analyze.
Often when running cool-down tests, some tests have been run to the specified target
temperature rather than to steady state condition. This is useless unless they are running at the
specified ambient conditions, which never happens unless the test is conducted in an
environmental chamber. In order to extrapolate to specified ambient conditions the steady state
temperature must be reached in order to calculate the time constant. Another mistake is
starting the test too late and as ambient temperatures fall, the internal temperatures continue to
fall never reaching steady state.
Experience has shown that ground cool-down analyses depend a great deal on the skin
temperatures utilized in the analysis. The skin temperatures assumed for the air vehicle during
these analyses have been frequently too low. This has been particularly true of analyses
involving air vehicles with darker paint schemes.
490
JSSG-2009A
APPENDIX D
D.3.4.4.2.9.2 Transient ground warm-up.

The heating subsystem shall be capable of heating (TBS 1) to an average temperature of
(TBS 2) within a time period of (TBS 3) following a ground cold soak at (TBS 4)
conditions.

Transient ground heat up performance must be specified to define air vehicle cold weather
readiness.

TBS 1 should be filled in with the compartment(s) to be heated for this requirement.
TBS 2 should be filled in with the temperature value required. Typically 60°F is used as the
temperature for the occupied compartments to reach corresponding to the steady state heating
guidelines above. Once this is reached, the steady state guidelines then apply. The minimum
allowable operating temperature is usually used for equipment and equipment compartments as
the temperature goal.
TBS 3 should be filled in with a specified time period to reach the required temperature.
Transient ground heat-up times after cold soaking are typically 15 to 30 min. However, shorter
or longer warm-up times may be required as mission requirements dictate. Air vehicle
scramble, alert time, and ground maintenance requirements should be examined for
compatibility with warm-up performance. Trade studies should be performed to determine the
specific warm-up times.
TBS 4: Cold soak conditions should use the daily cycle of low temperature called out in the air
vehicle specification. The air vehicle specification will normally call out the table in MIL-HDBK-
310. This table should be used, if it is not referenced in the air vehicle specification, and
modified to be consistent with the air vehicle specified conditions. Nighttime conditions should
be used with radiation to a cloudless sky.
(TBD)
D.4.4.4.2.9.2 Transient ground warm-up.

The capability of the heating subsystem to provide the required transient ground heating shall

Verification is necessary to ensure that the heating subsystem requirements for transient ground
warm-up are met.
491
JSSG-2009A
APPENDIX D

Testing should be completed before dawn. The test should proceed until all internal
temperatures are varying by less 2°F/hr. The test data should be extrapolated to the conditions.
VERIFICATION LESSONS LEARNED (4.4.4.2.9.2.)
Often when running warm-up tests, some tests have been run to the specified target
temperature rather than to steady state condition. This has proven to be useless unless the
tests were conducted at the specified ambient conditions. Experience has shown that this never
happens unless the test was conducted in an environmental chamber. In order to successfully
extrapolate to specified ambient conditions, the steady state temperature must be reached in
order to calculate the time constant.
D.3.4.4.2.10 Thermal control of other compartments, structure, skin, equipment, and

subsystems.
The thermal control of other compartments, structure, skin, equipment, and subsystems shall be
as follows: (TBS) .

Depending upon the operational needs of the air vehicle, thermal control may be required for
weapons bays, wheel wells, structure, skin panels, special purpose compartments or
equipment, and other subsystems.

TBS: The other compartments, structure, skin panels, equipment, or subsystems which require
thermal control should be defined along with any specific requirements.
Experience has shown that the design of hot air vehicle structures has required the input of
three, separate, technical disciplines to be successful. Environmental Control System,
structures, and aerodynamics engineers have all needed to be involved. Frequently, only one
or two of these disciplines have been involved on past programs. This has led to serious design
deficiencies in several, different air vehicle programs. Solution of this problem in the future
requires the recognition of the potential problem by the engineers involved and the involvement
of all affected disciplines early in the air vehicle design effort.
492
JSSG-2009A
APPENDIX D
D.4.4.4.2.10 Thermal control of other compartments, structure, skin, equipment, and

subsystems.
Analyses and ground and flight tests shall verify thermal control is provided as follows:
(TBS) .

This completed paragraph will provide for verification of the requirements of 3.4.4.2.10.

TBS: The other compartments, structure, skin panels, equipment or subsystems which require
thermal control should be defined along with any specific requirements. Analytical performance
analyses should be conducted early to predict and verify adequacy of thermal control system
performance. The performance analyses should then be verified by ground and flight tests.
(TBD)
493
JSSG-2009A
APPENDIX D
D.3.4.4.3 ECS crew station interface.

The following controls shall be provided: (TBS 1) . Controls shall be readily accessible to the
appropriate crew member(s). The controls used throughout the ECS shall not cause instability
when subjected to any normal operational condition including: (TBS 2) . The contractor
shall establish minimum dynamic performance requirements, such as settling time, maximum
overshoot, and such, consistent with operational requirements and good air vehicle design
practice. The following warnings, cautions, and advisories shall be provided: (TBS 3) .
Controls, sensors and instruments shall be consistent with air vehicle fault isolation
requirements.

Appropriate controls, sensors, and instruments are specified (and occasionally, their location) in
accordance with the operational needs of the air vehicle to permit the safe operation of the
system. Caution indicators, warning lights, and such, are required to alert the crew to problems
so corrective action can be taken before personnel injury or physiological deterioration occurs.
Appropriate controls, sensors and instruments are required to assist maintenance personnel in
fault isolating the ECS.

The appropriate requirements should be specified based upon the requirements of the system
under consideration. Coordination with the crew system engineer should occur when these
requirements are established.
TBS 1: The ECS should have a control panel(s) or equivalent (such as a page on a multi-
function display) which is (are) accessible by the pilot and co-pilot, or other crew member. The
panel(s) should allow all ECS functions to be controlled and all warnings, cautions, and
advisories to be displayed. The controls include but are not limited to:
a. bleed air control (on or off) for each source of bleed air, including engine, shaft driven
compressor or APU or secondary power unit
b. bleed air temperature out of the engine compartment is too high
c. ECS off and on
d. ram air selection (or other appropriate backup cooling scheme)
e. cockpit temperature control (automatic and manual)
f. cockpit pressure dump as required
g. air flow rate as required
h. individual zone temperature control as required (automatic and manual)
i. NBC system on or off as required
j. defog selection as required
k. windshield anti-ice as required
494
JSSG-2009A
APPENDIX D
l. safety critical functions as required

m. mission critical functions as required.
Automatic controls are the most efficient and effective means of controlling modern, complex
Environmental Control Systems. Automatic controls can also better maintain the selected cabin
temperature and minimize the attention and manipulation required by the pilot (or other crew
members). Manual override provisions or degraded mode operation of the control system
should be included to permit the crew to position the valves controlling air temperature if the
automatic temperature control fails, or for use under special circumstances. Automatic controls
may be unnecessary in prototype or special purpose air vehicles.
The controls should be readily accessible to the crew. In large air vehicles where there may be
several temperature “zones” or many compartments, individual controls can be provided in each
compartment to permit control of the temperature by the occupants. An example would be a
separate temperature control in the Aerial Refueling Operator’s Station on tanker air vehicles.
On cargo air vehicles, there may be a requirement for a cargo compartment control at the
Loadmaster’s Station. In all cases, the pilot or flight engineer should have ultimate control
authority over the system, with the capability to disable or override the other individual controls,
as necessary.
Response characteristics, such as tolerance, settling time, and maximum overshoot, can be
specified, as appropriate. Temperature controls should typically hold the Pilot Envelope or
Compartment Ambient Temperature to within ±1.5°F of the setting selected by the occupants.
The typical range of temperatures used is 65 to 80°F. If suits are to be used on the air vehicle
which require ventilation or pressurization flow from the air vehicle, the temperature control
requirements for those suits need to be stated with coordination with the crew system engineer.
Suit temperature should normally be maintained within 3°F of the setting selected by the
occupants during steady state conditions and 5°F during transient conditions.
TBS 2 should be filled in as appropriate with consideration of the following. Any special
conditions for the air vehicle should also be used:
a. All normal flight and ground conditions.
b. All normal vehicle configurations.
c. Any transient induced by changes in air vehicle flight conditions or vehicle configuration.
d. Any manual or automatic changes in ECS control settings.
e. Transients induced by the bleed air source.
f. Changing the bleed air source.
g. Any single failure in any ECS component.
h. If an integrated ECS controller is used, it should not drive the system unstable in the
presence of a single internal failure or due to a single sensor failure.
TBS 3: In general, fighter and attack air vehicles have only warning indicators, while large air
vehicles with multiple engine bleed, multiple temperature zones, large avionics loads, and such,
495
JSSG-2009A
APPENDIX D
may require many indicators so the pilot and flight engineer can properly monitor and control the
system.
An indication should be provided to the flight crew in the event that coolant supply conditions
(temperature and flow rate) do not meet minimum requirements.
An indication of occupied compartment pressurization should be provided in one of the following

two ways. If set points are specified for the warning and caution lights, they should be
coordinated with 3.4.4.1.6 to ensure adequate time for corrective action or emergency descent.
For combat air vehicles, the following should be considered:

a. Cabin air pressure altitude indicators should be provided.
b. If the air vehicle can fly above 42,000 ft, a warning indication should be provided to warn
the crew that compartment pressure has dropped below some predetermined minimum
value, usually 3 psia.
For non-combat air vehicles, the following should be considered:
a. Cabin air pressure altitude indicators should be provided.
b. Instruments to show cabin rate of climb and descent in feet per minute and the cabin
differential in psi should be provided in the crew compartment.
c. A caution indicator to show loss of compartment pressure below some predetermined
minimum value, usually 10 psia, should be provided.
d. A warning indication that compartment pressure has dropped below 8 psia should be
provided in all passenger-carrying air vehicles which fly above 25,000 ft.
The following indications should be considered when establishing requirements:
a. Bleed air temperature
b. Bleed air pressure
c. Bleed valve position
d. Refrigeration pack discharge temperature
e. Control valve position
f. Cabin (zone) supply temperature
g. Zone temperatures
h. Turbomachinery overspeed
i. Trim air temperature
j. Turbine inlet temperature
k. Cargo, electronic, other compartment temperatures
l. Unique requirements due to the special mission of the vehicle.
496
JSSG-2009A
APPENDIX D
Also, a warning should not be provided if some type of corrective action cannot be taken. To
reduce false warnings and system limitations, the same sensor should not be used for both
airflow control and warning.
The USAF has experienced dual failures in cases where single failures (such as a pressure
regulator failure) have gone unnoticed until a second failure occurs. These dual failures have
resulted in the introduction of high temperature bleed air into the cockpit, with serious
consequences. An A-10 experienced an automatic temperature control failure and the backup
manual control reacted too slowly to prevent injury to the pilot. A manual control should
probably be able to return the inlet temperature to within acceptable limits in less than 5 sec for
the worst-case condition.
On the E-4B, the flight engineer could reposition control valves for avionics racks.
Dynamic performance and instability problems have occurred during most recent ECS
development programs. The F-4 has always had flow surge problems, and they were
aggravated when a water separator and its associated anti-ice control were added. The F-5F
had severe pressure surge problems in the cockpit, which were corrected with the addition of a
bleed pressure regulator with rate control, and other changes. The AWACS air vehicle
experienced bleed system instabilities that could be corrected only through a redesign of the
system. The F-15, A-10, and F-111 also had stability problems, which were identified during
ground or flight testing.
In the past, dynamic problems generally have been found only after the hardware is built—
during ground or flight tests. Problems discovered during flight tests, particularly pressure and
surge problems, can be difficult if not impossible to trace and correct because of the many
interacting controls in the typical ECS. An excellent example is a pressure surge problem that
occurred on the F-111 air vehicle. The pressure surges were causing “overpressure indicators"
on pressure regulating valves to indicate a malfunction, but troubleshooting on the ground would
never identify any problems or malfunctions. It was necessary to conduct a special laboratory
test that identified the cause to be the interaction between two redundant (series) pressure
regulators. Once identified, the problem was easily corrected by changing the sensing port
locations.
D.4.4.4.3 ECS crew station interface.

Inspection of drawings and the air vehicle shall verify incorporation of the required control,
warnings, cautions, and advisories. Analyses, laboratory tests, and air vehicle ground and flight
tests shall be conducted to demonstrate satisfactory operation of all control components during:
(TBS) .
497
JSSG-2009A
APPENDIX D

The adequacy of the air conditioning system must be established early in the design of the
system to avoid problems and expensive design changes. This is done through review of
drawings and qualification tests. Flight testing provides the final verification that the system
meets the performance requirements. Flight testing is the only means to verify performance
under many conditions, such as transients. Laboratory and flight testing can often be performed
in conjunction with other system testing, requiring minimal additional resources. Laboratory
testing can identify problems early before costly redesigns are needed and can be used to
simulate failure conditions that would be difficult or dangerous to do in flight.

TBS should include the following as applicable and any other special requirements for the
specific air vehicle:
a. All normal flight and ground conditions.
b. All normal vehicle configurations.
c. Any transient induced by changes in air vehicle flight conditions or vehicle configuration.
d. Any manual or automatic changes in ECS control settings.
e. Transients induced by the bleed air source.
f. Changing the bleed air source.
g. Any single failure in any ECS component.
h. If an integrated ECS controller is used, the system should demonstrate stable operation
during an internal integrated controller failure or a control sensor failure.
Review of drawings and crew station mockups should be used to verify such items as
accessibility of controls and as an initial review of provisions for manual or degraded mode
operation in the event of automatic mode failure. Laboratory qualification tests provide an
inexpensive as well as safe way to test simulated failure modes as well as a preliminary review
of control accuracy. Flight testing provides the final verification that the system meets the
performance requirements. Flight testing is the only means to verify performance under many
conditions, such as transients. Operating the system under “manual full hot” should be a test
point to verify the controls properly limit the maximum temperatures entering the occupied
areas.
A laboratory system test using the production configuration control software should demonstrate
that the ECS control system functions without distracting the crew, displays stable
characteristics, and controls all ECS functions safely and as required. Verification should
ensure controls and software functionality as well as hardware functionality. This is needed due
to the increasing reliance on software in the control of complex systems. The laboratory ECS
rig should test all revisions to the ECS software affecting the control functions. The test rig
should incorporate interface data buses to simulate control data transfer between systems (or
within the ECS) or provide this data to the controller with the specified protocol. For example, a
digitized temperature signal from the fuel system may be used by the ECS controller. This
feedback information should be provided to the controller at the contractor specified frequency
498
JSSG-2009A
APPENDIX D
to simulate actual system performance. Air vehicle flight tests should demonstrate that the
installed ECS functions as required and that crew compartment control settings vary linearly
with the controlled parameter.
With the development and general availability of advanced computer programs such as the
Engineering Analysis System (EASY), extensive early evaluation of proposed system dynamic
performance is now possible and should be used routinely as a design tool.
(TBD)
D.3.4.4.4 Surface touch temperatures.

Floor areas normally contacted by personnel shall be maintained at or above (TBS 1) for all
steady-state flight conditions. All other floor areas shall be maintained at or above (TBS 2) .
The temperature of all surfaces, except small local areas such as diffusers and circuit breakers,
which enter into radiant heat exchange with personnel shall be maintained within the range of
(TBS 3) for steady-state conditions. All surfaces that can be touched by personnel shall be
maintained within upper and lower temperature limits defined by (TBS 4) .

Minimum floor temperatures are specified to prevent discomfort or injury. Maximum and
minimum surface temperatures are specified to prevent injury to personnel and to control or
minimize radiant heat exchange with occupants.

TBS 1 should be filled in with a minimum temperature value. Generally, the minimum average
floor surface temperature should be 60°F or higher at crew stations or passenger seats. For air
vehicles such as rotorcraft where 60°F was selected as the minimum average occupied
compartment temperature, a lower temperature such as 55°F may have to be selected, since it
is impossible to maintain a 60°F floor temperature with a 60°F compartment temperature. A
temperature of 40°F is a reasonable lower limit for any other floor areas contacted by personnel.
TBS 2 should be filled in with a minimum temperature value. Temperatures should be above
32°F to prevent the formation of frost or ice, which can cause slippery surfaces. For unoccupied
areas, such as some cargo compartments, the surfaces should be maintained above 32°F to
prevent the freezing of cargo, formation of frost and ice, and such.
TBS 3 should be filled in with a temperature range. Upper and lower temperature limits for
momentary and prolonged contact of different types of materials are defined in MIL-STD-1472.
The temperature of all surfaces, except small local areas such as diffusers and circuit breakers,
which enter into radiant heat exchange with personnel should be maintained within a specified
range for steady-state conditions. Generally, the temperatures of these surfaces should not
exceed 105°F under steady-state conditions, since temperatures above 105°F begin to have a
499
JSSG-2009A
APPENDIX D
noticeable effect on radiant heat transfer with the occupants. For transient periods, typically
30 minutes or less, the requirement can be relaxed to a maximum of 160°F. A value of 160°F
will cover ground operation where the air vehicle is heat soaked and high surface temperatures
will exist in direct solar radiation. 160°F is also consistent with the high temperature limits
usually used for non-operating equipment. A reasonable lower limit is 50°F, as lower
temperatures will result in noticeable radiant heat exchange. All surfaces that can be touched
by personnel should be maintained within defined upper and lower temperature limits.
TBS 4: The following should be considered when the surface touch temperatures requirement is
addressed:
a. Floor temperatures should be kept high enough to prevent cold feet, hazardous
conditions, and cargo damage.
b. Unguarded surface temperatures should be kept low enough to prevent personnel injury.
See MIL-STD-1472 for guidance on specific temperature values.
c. Heat transfer should be minimized.
In the past, surface temperature requirements have generally not been enforced or verified,
except for floor areas in cargo air vehicle or when pilot comments or complaints indicated an
improvement was necessary. However, high surface temperatures are beginning to receive
greater attention because of the impact on the crew environment and on instruments and
avionics reliability. Very high temperatures have been recorded around and behind the
instrument panels and improved instrument panel cooling techniques are in development. It is
expected that more stringent instrument panel requirements and verification requirements will
be levied in the future. Also, a low temperature requirement should be specified for surfaces
that enter into radiant heat exchange with personnel.
Shrouds constructed of phenolic resin with an internal air gap around the pressure carrier have
been successfully used on bleed air ducts that pass through occupied areas to provide an
insulated surface with safe touch-temperatures.
D.4.4.4.4 Surface touch temperatures.

Proper touch temperature implementation shall be verified by (TBS) .

Verification is necessary to ensure that proper touch temperatures are maintained.

TBS: Analyses and flight-testing should verify that surface temperatures are adequate for
human comfort, floor surfaces are maintained at or above the specified temperature, and
surfaces which can be touched meet the specified requirements. Hazard analyses should be
500
JSSG-2009A
APPENDIX D
performed to ensure no hazards are created by the operation of the ECS and verified in flight
test. Instrumentation should generally be required only to verify floor heating systems. Other
surface temperatures can be evaluated subjectively by the crew, with measurements required
only for questionable areas. Potential temperature hazards should be analyzed. Measurements
should be made where the analysis indicates the temperatures are close to their limits to
validate the analysis.
Experience has shown that surface temperatures and most other heating and cooling
requirements should be tested under all environmental conditions. For example, floor heating
systems have been generally tested under cold day conditions, as are the adequacy of floor
temperatures and foot warming provisions. As experience on the A-10 showed, the system may
appear very adequate during arctic testing when the aircrew is dressed for cold weather.
However, under normal operating conditions where the crew is more lightly dressed, they may
complain of “cold feet" or other problems. Therefore, test programs should be designed to verify
the system with allowance for variation in crew dress.
D.3.4.4.5 Ventilation
D.4.4.4.5 Ventilation
D.3.4.4.5.1 Occupied compartment normal ventilation.

Fresh air ventilation for contaminant and odor removal shall be provided to occupied
compartments during all flight and ground conditions. Contamination levels of “Occupied
compartment contamination” in this appendix shall be maintained. A minimum of (TBS 1)
cubic feet per minute (cfm) shall be provided to each crew member. A minimum of (TBS 2)
cfm shall be provided to each passenger. Galley and toilet areas shall be vented and provided
with direct overboard exhaust outlets sufficient to eliminate odors.

Fresh air ventilation is required to provide the necessary oxygen content, prevent high CO2
concentrations, and remove moisture and objectionable odors.

Figure D-11 shows ventilation flow requirements as a function of cabin volume.
TBS 1 should be filled in with a minimum flow rate value. Curve D of figure D-11 is
recommended for most situations.
TBS 2 should be filled in with a minimum flow rate value. Curve C of figure D-11 is
recommended for most situations.
501
JSSG-2009A
APPENDIX D
The cooling, heating, or pressurization airflow requirements of an open loop air cycle system
generally exceed the minimum ventilation requirements, so this requirement will rarely influence
the system design. The possible exception is engine idle descent and ground operation of
large-volume, passenger-carrying air vehicles or transport type rotorcraft. Under these
conditions, the bleed pressures and flows are low and the requirements frequently relaxed.
The use of vapor cycle and closed loop or partially closed loop air cycles may reduce the
amount of fresh air normally used to meet cooling and heating requirements. The ultimate
requirement is to maintain the specified contamination levels. Commercial air vehicles currently
provide 100 percent (100%) fresh air to the cockpit in air vehicles where re-circulation is used.
This requirement should be considered if there is a concern that the specified requirements are
not adequate, or that the system design may deteriorate with use and not provide an adequate
environment for pilots over the life of the air vehicle.
FIGURE D-11. Ventilation flow rate as a function of cabin volume.
502
JSSG-2009A
APPENDIX D
For the C-5A air vehicle, the allowable minimum ventilation rate was reduced to 12 cfm per
person for the aft troop deck and cargo compartment. This reduced minimum rate has proved
acceptable
Experience has shown that several types of failures can cause contamination or overheating of
the occupied compartment resulting in the necessity to turn off the ECS. In this event, it is
necessary to have an alternate ram air source, especially if the failure has caused smoke or
odors in the occupied compartment. Failure of cabin temperature controls can result in overheat
and odor and the necessity to shutoff the system and use ram air. Bleed air contamination due
to an oil leak can contaminate the bleed system and cause the crew to shut off the ECS and use
ram air. Bearing failures of the air cycle machine (ACM) can contaminate air. Combat damage
can cause loss of ECS and result in the need for fresh air ventilation. A combat mission may
require use of the ram air system when the ECS fails.
During evaluation of generic smoke removal procedures for various air vehicle programs, it
became clear that no single procedure was effective for clearing smoke from occupied
compartments of all air vehicles. Smoke removal is highly dependent on air vehicle flow
patterns and internal compartment design.
D.4.4.4.5.1 Occupied compartment normal ventilation.

The capability of the ECS to provide fresh air ventilation and contamination control shall be
verified by (TBS) . Galley and toilet areas ventilation shall be verified by (TBS) .

Verification is necessary to ensure that the ECS can provide fresh air ventilation and
contamination control as required.

Analysis or testing should show that the required level of fresh air is provided to the cockpit on a
continual basis during normal operation.
(TBD)
503
JSSG-2009A
APPENDIX D
D.3.4.4.5.2 Occupied compartment emergency ventilation and smoke removal.

Emergency fresh air ventilation shall be provided to occupied compartments during periods
when the normal air conditioning and ventilation system has failed or is shut off due to
contamination of the normal ventilation air supply or temperature control failure. Means shall be
incorporated to remove smoke or gases originating in the occupied compartments as a result of
fire or smoke.

Emergency ventilation provisions are usually required for all air vehicles to provide ventilation
when the normal method from the Environmental Control System has failed or is contaminated,
or other emergency conditions exist. Also, rapid means for smoke removal from the cockpit and
passenger-occupied cargo compartments are required to allow the crew visibility and prevent
nausea or asphyxiation.

Ram air is generally used for emergency ventilation. The emergency ventilation air should be
supplied to each occupied compartment. It may be desirable to control the volume of ram air
entering some compartments. The system should provide the required ventilation under all
flight conditions. Icing of ram air scoops is an important consideration. The emergency ram air
selector should shutoff the air conditioning system air supply to the occupied compartment when
ram air is selected. However, the defrosting air and the electronic equipment cooling should not
be automatically shutoff when ram air is selected for occupied compartments. A procedure for
smoke removal should be verified early in the flight test program. The procedure should be
included in the flight manual.
Consider the effects of the normal air conditioning system, emergency ram air ventilation and
pressurization system, and availability of operable doors, hatches, and windows, in establishing
the smoke removal procedure. Ensure smoke or gases from the cargo compartment will not
enter the cockpit.
(TBD)
D.4.4.4.5.2 Occupied compartment emergency ventilation and smoke removal.

Emergency occupied compartment ventilation shall be verified by (TBS 1) . Emergency
smoke removal shall be verified by demonstration as specified in (TBS 2) .

The provisions for emergency ventilation and smoke removal can be verified by inspecting
drawings, but the performance must be verified by test.
504
JSSG-2009A
APPENDIX D

TBS 1 should be filled in with inspection of drawings and flight demonstration to verify
emergency fresh air ventilation for occupied compartments.
TBS 2 should be filled in with inspection of drawings and flight tests.
A small smoke generator can be used to release smoke in the cabin and the time required to
clear the smoke can be measured. This method has been used on many cargo air vehicles.
Whether or not an actual flight test is required should be determined based upon the probability
of smoke entering the area, possible causes, and the hazard associated with the actual test.
For fighter air vehicles, the time could be estimated by analysis. The procedure for removal of
smoke should be developed and tested early in the flight test program.
Roscoe® Smoke Generators have proven reliable and inexpensive for use in smoke removal
tests.
D.3.4.4.5.3 Avionic equipment and equipment compartment emergency cooling.

In the event of failure of the normal mode of avionic cooling, an alternate cooling mode shall be
provided for (TBS) .

An auxiliary means for cooling mission essential or “safe return" to base avionics should be
provided for use when the normal air conditioning system is inoperative. This will prevent
mission aborts or flight safety hazards due to ECS failure.

TBS: The avionics required to be cooled by the alternate cooling mode should be defined in
coordination with the avionics system engineer. This would normally be either mission essential
or “safe return” to base avionics.
For Army rotary-wing air vehicles, the backup cooling mode should allow for the mission to be
completed. Ram air is usually used as the alternate cooling mode for equipment cooled by ECS
air. An acceptable practice is to design emergency ram air cooling to provide sufficient cooling
as long as ram air temperature is below 120ºF. For liquid cooled avionics an acceptable
practice is to have redundant and independent coolant lines. Another approach is to design the
avionics to operate for a specific amount of time without cooling. This approach would need to
be coordinated with the avionics system engineer.
(TBD)
505
JSSG-2009A
APPENDIX D
D.4.4.4.5.3 Avionic equipment and equipment compartment emergency cooling.

The emergency avionic and equipment cooling provisions shall be verified by (TBS) .

Verification of the existence and adequacy of the emergency cooling provisions is required.

TBS should be filled in with inspection of drawings and flight tests.
The avionics required to be cooled by the alternate cooling mode should be defined. The
performance of the emergency cooling provisions should be evaluated at several points
throughout the flight envelope. Tests should show that enough cooling exists to the avionics
and electrical equipment for mission completion or “safe return to base”, as specified in the
requirement. If there are two modes of emergency cooling, such as a redundant blower and
ram air, the performance of each method should be evaluated during flight test.
On a new cargo air vehicle program, two methods of emergency avionic cooling were provided.
However, the contractor contended it was necessary to conduct verification tests for only one of
the methods.
D.3.4.4.5.4 Suit ventilation and pressurization.

If required, an air supply shall be provided to (TBS) .

Anti-g suits, pressure suits, ventilation suits, NBC suit, anti-exposure suits, and such, may be
required to meet the mission requirements of the vehicle. The ECS must supply air at the
pressure, flow, temperature, moisture, and contamination levels compatible with the respective
suits. The ECS must meet ventilation requirements of capsules or cargo areas if these areas
are on the air vehicle.

TBS should identify any suits that require ventilation and pressurization.
Suits such as pressurization, ventilation, anti-g, NBC and anti-exposure suits have specific
pressure drop, temperature control flow rate, moisture and contamination requirements which
should be maintained. The ECS engineer should coordinate with the crew system engineer to
specify the correct requirements for the particular suit or suits to be used on the air vehicle.
506
JSSG-2009A
APPENDIX D
These requirements should include such items as shut-off provisions where there needs to be a
determination as to whether they will be mounted on the suit or on the air vehicle.
(TBD)
D.4.4.4.5.4 Suit ventilation and pressurization.

If required, suit ventilation requirements shall be verified by (TBS) .

Analysis and laboratory testing should be performed to provide early verification of suit or other
ventilation requirements to avoid costly redesigned later. Proper performance can only be
completely verified by flight testing.

TBS: The performance of ventilation or pressurization provisions for suits such as
pressurization, ventilation, anti-g, NBC and anti-exposure suits should be verified first during
analysis and then during flight tests. Analysis should be performed to provide early verification
that requirements are being met. Pressure, flow and temperature requirements of the suit to be
used can be simulated in the ECS laboratory test for additional verification. In flight testing with
the actual suit provides the final verification.
(TBD)
D.3.4.4.5.5 Capsule pressurization and ventilation.

If an emergency escape capsule is included in the design, the Environmental Control System
shall (TBS) .

Depending upon the operational needs of the air vehicle, emergency escape capsule
pressurization and ventilation requirements may need to be specified.

TBS: If any emergency escape capsule system is anticipated or required for the air vehicle
under consideration, the following should be considered. The air vehicle pressurization system
provides pressurization during normal air vehicle operation. The purpose of the capsule
507
JSSG-2009A
APPENDIX D
pressurization system is to provide a survivable pressure level during an emergency escape

and descent. Since the cabin may be unpressurized (due to damage, system failure, or such) at
the start of the escape sequence, the capsule pressurization system should be designed to
operate and meet its performance requirements starting with the capsule pressurized or
unpressurized. The exact requirements for the capsule pressurization system will depend upon
the air vehicle mission, the escape design philosophy, user requirements, among other things.
As a minimum, the cabin altitude should never exceed 42,000 ft, as that is the maximum for
continuous use of pressure breathing. Altitudes above 42,000 ft require the use of pressure
suits. Therefore, minimum requirements would typically be to repressurize the cabin to the
equivalent of 42,000 ft and maintain that until the capsule has descended to that altitude.
More stringent requirements may be imposed to improve the crew safety and to reduce the
possibility of the crew being disabled during the descent due to decompression sickness,
hypoxia, or such. In that case, the requirement should be to repressurize the cabin to a 5 psia
differential and prevent the cabin altitude from exceeding 30,000 ft during descent.
The air or gas mixture used to pressurize the capsule should be capable of sustaining life. This
is usually accomplished by specifying the minimum partial pressure of oxygen in the air-gas
mixture.
The minimum partial pressure of oxygen should be established based upon inspired oxygen
pressure requirements. The inspired oxygen pressure PIO2 in torr (mm hg) is:
PIO2 = FO2 (PB - 47)
FO2 = Fraction of oxygen in ambient air or gas mixture.
PB = Prevailing barometer pressure in torr.
47 = Vapor pressure of water at body temperature.
The partial pressure of oxygen (PO2) in the cabin air or gas mixture in torr is:
PO2 = FO2(PB)
The ideal environment for unimpaired performance is as close to sea-level conditions as

possible, where the inspired pressure does not fall appreciably below 149 torr. For cases where
oxygen is not or may not be available, the inspired oxygen pressure should be no less than the
10,000 ft equivalent of 100 torr. As an example, for an air vehicle at 50,000 ft with a 5 psi
differential pressure schedule, the cabin pressure is 7.4 psia or 382.8 torr (1 psi = 51.7 torr).
Combining the above equations:
PIO 2 x PB
PO 2
PB 47
508
JSSG-2009A
APPENDIX D
For an inspired pressure of 100 torr, the required partial pressure of oxygen is:
100 x 382.8
PO 2 = 114 torr
382.8 47
For the sea level equivalent of 149 torr:
149 x 382.8
PO 2 = 170 torr
382.8 47
For air vehicles where oxygen will always be available and used, this requirement could be
based, as a minimum, on the oxygen equivalent required at the altitude where the crew would
start breathing cabin air.
Thorough coordination should be used to complete this paragraph, as the requirements are very
mission- and user-requirement dependent. For example, the availability and proposed use of a
demand oxygen system will influence the specified pressure schedule and oxygen pressure
schedule. The engineer should carefully consider the minimum physiological requirements
while establishing the capsule pressurization minimum requirements. Because of the unique
requirements possible with each capsule application, these requirements may require extensive
tailoring.
The capsule system can also be used to provide emergency protection against depressurization
due to failure of the normal air vehicle system. This capability can be used for safe descents
from high altitudes to permit completion of critical portions of the mission. In this case, the
controls for the two systems should be separate and independent so their use is clear to the
crew and no single failure (such as a switch) can disable both systems.
This requirement should be carefully considered before being applied, as it can significantly
impact the system and air vehicle design. Requiring emergency pressurization for safe descent
from high altitude should have little impact on the system design, other than additional controls
that could otherwise be part of the automatic ejection sequence. However, requiring the
capability to provide emergency pressurization throughout the mission could have a severe
impact on the system weight and volume. Therefore, this requirement should be considered
only when operational requirements dictate it, and then only the performance conditions should
be carefully specified, weighing the operational gains against the impact on the system and air
vehicle.
Ventilation provisions should be suitable for landing either on land or water. The system should
provide adequate ventilation (adequate oxygen content and minimum CO2 concentration)
without permitting the entrance of water in high sea conditions. Consideration should be given
to provisions for automatic actuation of the ventilation device at 15,000 ft. A manual override
control should also be provided.
(TBD)
509
JSSG-2009A
APPENDIX D
D.4.4.4.5.5 Capsule pressurization and ventilation.

If an emergency escape capsule is included in the design, the ventilation provisions shall be
verified by (TBS) .

Verification is necessary to ensure that pressurization and ventilation performance requirements
for the emergency escape capsule are met.

TBS: This paragraph should be completed as appropriate to assure that the requirements are
fully verified by the most cost effective method. In general, pressurization and ventilation
system performance can only be verified by flight test. However, some aspects can be verified
by analysis and inspection.
(TBD)
D.3.4.4.5.6 Cargo and other compartment ventilation.

In cargo compartments there shall be (TBS) .

Special overboard venting provisions may be necessary for cargo compartments or other
compartments so that volatile and hazardous vapors and fumes from cargo or other sources
may be vented directly overboard.
Provisions must be incorporated to ensure adequate cargo compartment ventilation during

normal loading and offloading of motorized vehicles to ensure crew safety and prevent an
explosion hazard.

TBS should be filled in with the ventilation requirements for the cargo compartments. The
following should be considered.
Overboard vents can be incorporated for venting volatile cargo. However, even with the vent
provisions, cargo compartment ventilation may still be required to ensure dissipation of vapors
and fumes to prevent explosive mixtures and hazardous concentrations. The ventilation
requirements are usually established for the troop or passenger configuration. If no passenger-
carrying requirement exists for the air vehicle, then the ventilation requirement should be
established based upon the cargo requirements. An air flow of 15 to 20 cu ft/min per 300 cu ft
of cargo volume would be a typical requirement. The air flow rate also depends on the rate of
expansion of the material carried in containers. Vents should be the same size as those on
510
JSSG-2009A
APPENDIX D
previous air vehicles. The ECS vents are part of air vehicle structure. To prevent a possible
explosion or fire, it is desirable to have more than one vent onboard a cargo air vehicle. These
vents will ensure that oxygen and other possible reactive materials can be vented separately.
The system should provide adequate ventilation for cargo compartments during ground
operations to ensure air vehicle exhaust and vehicle exhaust product concentrations will not
exceed human tolerance levels during normal loading and offloading operations. This can be
accomplished through operation of the normal airborne ventilation system or by separate
ground exhaust fans.
Operational requirements may dictate the use of fans so it is not necessary to run the ECS
during loading and offloading.
If guns or other weapons or other devices that produce volatile and hazardous vapors and
fumes, their compartments should be vented. If used, the air intake should be located away
from the gun muzzle to prevent gases from entering the ventilating air. Gun icing by ventilating
air should be prevented. This can be accomplished with a ventilating system operating only
while the gun is firing. The ventilation airflow rate should be high enough to result in an average
concentration of combustibles of 4.5 percent (4.5%) with good mixing, and 2.25 percent (2.25%)
with less thorough mixing.
Only one vent existed on the C-130. This vent was used for both liquid oxygen and petroleum
products with no instructions to clean the vent between use. If separate vents are not provided,
the air vehicle Technical Order (T.O.) should have instructions for cleaning the vent prior to use.
If the vent is not cleaned and oxygen is vented overboard, there would be a good possibility of
an explosion because of an oxygen and petroleum reaction. The C-141 also contains only one
overboard vent.
D.4.4.4.5.6 Cargo and other compartment ventilation.

Cargo and other compartment ventilation shall be verified by (TBS) .

Verification is necessary to ensure that performance requirements are met.

TBS should be filled in with analyses, inspection, and tests.
Ventilation for loading and offloading can be verified during loading and offloading tests.
(TBD)
511
JSSG-2009A
APPENDIX D
D.3.4.4.6 Contamination
D.4.4.4.6 Contamination
D.3.4.4.6.1 Occupied compartment contamination.

During ground and in-flight operation, air within the occupied compartments shall not exceed the
permissible exposure limits established in: (TBS) . Gaseous concentrations that could create
an explosion hazard during pressurized, unpressurized, and depressurized periods shall be
prevented.

Contamination levels must be limited to ensure the efficiency and safety of the crew, and
gaseous concentration must be prevented because of the explosion hazard.

TBS: Contamination of the air in occupied compartments may affect the efficiency and safety of
the crew. High concentrations can cause dizziness, headache, nausea, irritation of the eyes
and upper respiratory tract, and such. The Surgeon General, USAF, is responsible for the
establishment of permissible exposure values within the USAF (basic guidelines are contained
in AFMAN 48-155, which gives the threshold limit values of airborne contaminants). Contact the
711th Human Performance Wing/Human Effectiveness Directorate, Air Force Research
Laboratory, 711HPW/RH, WRIGHT-PATTERSON AFB OH 45433;
http://www.wpafb.af.mil/afrl/711HPW/; for further information and detailed bibliographic data on
toxic contamination. Wherever possible, vapors resulting from auxiliary engine exhaust
systems, air vehicle fuel systems, air vehicle Environmental Control Systems, gunfire exhausts,
combustion heater exhaust, cartridge actuated devices, hydraulic fluid, oil, overheated electrical
insulation, coolant fluids, fire extinguisher agents, motor vehicles, fuel tanks, dry ice, electrical
equipment cooling air exhaust, and such, should be prevented from entering the occupied
compartments. When the entry of the vapors cannot be prevented, sufficient ventilation should
be provided to prevent excessive concentrations.
Vapor concentrations that create an explosion hazard during pressurized, unpressurized, and
depressurized periods should be prevented. For air vehicles that carry cargo cooled by dry ice,
special ventilation rates should be considered because of the sublimation of dry ice into CO2. If
it is assumed the dry ice is stored in an insulated container, the required ventilation rate to
preclude a hazardous concentration of CO2 (0.50 percent) (0.50%) may be estimated as follows:
Air changes/hr = Wt of ice in lbs X 32.2 / compartment vol in ft3 X 0.47
or
Air changes/hr = Wt of ice in kg X 14.6 / compartment vol in m3 X 0.0133 .
512
JSSG-2009A
APPENDIX D
Experience has shown that cadmium dust or vapors are highly toxic. A near accident on a
C-130 was attributed to cadmium poisoning of the crew. This resulted from failure of the air
conditioning cooling turbine, which had a cadmium-plated turbine nozzle. The turbine failure
resulted in the introduction of cadmium dust and vapor into the cockpit. Both pilot and co-pilot
became nauseous as a result. The pilot lost consciousness on final approach and was
hospitalized for two years.
Catalytic filters have been required on some air vehicles to remove contaminants from the
engine bleed air. Use of internal diameter bleed air extraction from the engine has been shown
to greatly reduce the potential for contaminants in the bleed air. Noxious odors have resulted
when automatic temperature controls fail and the cabin air supply temperature exceeds the
normal upper temperature limit. Therefore, the potential for generation of noxious odors at
temperatures occurring during failure conditions should be considered in selection of ducting
system materials.
D.4.4.4.6.1 Occupied compartment contamination.

Analyses and tests shall be conducted to verify contaminant levels in occupied compartments
are within the maximum allowable levels as follow: (TBS) .

Verification is necessary to ensure that the contamination levels in the occupied compartment(s)
do not exceed the allowable limit.

TBS: Demonstration of adequate contamination levels is usually a straight-forward, analytical
effort. If an existing engine or a derivative of an existing engine is to be used, data should be
obtained on the contaminates in the bleed air after the air vehicle has been through its service
life. However, special circumstances can arise which require careful consideration and possible
testing. These circumstances include possible entry of engine exhaust fumes through open
cargo doors or through normal intakes from rotorcraft downwash, off of jet blast deflectors or
from lead air vehicles on carrier decks; chemical laser reactants and products, possible noxious
odors during high temperature failure conditions, and such. If a re-circulation system is used,
testing should be performed to ensure that there is not a build-up of CO2 or other contaminates.
Furthermore, if the ECS contains filter material for NBC purposes or general filtration such as
odor removal, a laboratory system test should be conducted to demonstrate that the filter
material is not contaminating the ECS air more than the established permissible limit. Since the
filtration medium is unknown, limits cannot be established in this document. However, filtration
mediums can be hazardous to the crew, and they should also be evaluated for possible
maintenance implications if they are released into the ECS. This test should include an air
sample taken as close as possible to the bleed air source (for example, upstream of the ECS
filter) and a sample downstream of the ECS filter (for example, cockpit supply or avionics supply
air). Furthermore, a comparison should be made between the samples taken at the beginning
of the system test to samples taken at the conclusion of the system tests or just prior to the rig
dissemble. This will help in determining if the filter material is susceptible to breakdown over
513
JSSG-2009A
APPENDIX D
long periods of time. (This is assuming that the system rig is used for endurance testing. If not,
samples from the air vehicle should be taken at the beginning of the flight test program and at
the conclusion of the flight test program.) The results of this comparison should be addressed
in the System test report.
An investigation of the cleanliness of air supplied to the cabin should be made by collecting air
sample in an evacuated container and by analyzing the contents in a laboratory. Samples
should be screened for contamination of smoke, oils, water content, biological or chemical agent
simulants, and particulates which may be introduced from the outside air via the bleed air
source (if used) and by air vehicle specific components such as filters. Samples should be
taken in such a manner that the origin of the contamination (outside air infiltration versus
contamination from ECS supply air) can be determined. Sufficient samples should be obtained
to cover all flight conditions under which contamination may exist. The moisture content of the
air in both crew and passenger compartments also should be determined safe and satisfactory.
Performance of the system and component equipment should be considered under the following
conditions:
a. Climb
b. Descent
c. Level flight
d. Maneuvering flight
e. Hover (in ground and out of ground effects), if applicable.
Testing of Navy air vehicles should be performed in a salt air environment.
Past ECS systems have used toxic materials. The intention is to eliminate their use, but this is
not always possible. When they are used, a means must be devised to test for the safety of the
crew and to ensure that maintainability problems will not be created as a result of their use.
Consequently, it may be necessary for the contractor to investigate the physiological effects
endemic to the material and also possible maintainability impacts. An example of this is the use
of 13x molecular sieve (Sodium Aluminosilicate - Na2O: Al2O3: 2.8SiO2: xH2O - also known as
zeolite). This material has been observed to enter the ECS and cause severe erosion to
aluminum. It is not expected that this material will cause permanent or serious injury to the crew
under normal usage, but its erosive property could release other toxic substances if present. In
addition, the long-term effects of this substance on the equipment are unknown. Other
unknown filtering agents may be used in the future. These should be evaluated as they are
introduced, and conducting tests on the completed system is the only way of determining that
permissible limits as established by investigation and study are not exceeded.
514
JSSG-2009A
APPENDIX D
D.3.4.4.6.2 Avionic equipment and equipment compartment dust control.

Dust contamination of the avionic equipment by cooling air shall be prevented. Air delivered to
the interior portions of internally forced convection air cooled electronic equipment or to avionics
cold plates shall not contain more than (TBS) when air vehicle is operated in dust
environment specified in the air vehicle specification.

To prevent avionic failures due to dust accumulation within the equipment, it is necessary to
specify a requirement to prevent dust contamination.

TBS should be filled in with a maximum concentration level of dust allowable and size
distribution. A suggested requirement is, “Air delivered to the interior portions of internally
forced convection air cooled electronic equipment shall not contain more that 0.001 grams of
solid contaminants per pound of air, and 95 percent (95%) of the particles shall be less than
20 micron in size, and no particle shall be greater than 50 micron."
The dusting environment should be specified in the air vehicle specification. If it is not, see
MIL-HDBK-310 for guidance in selecting a dusting requirement. Avionic equipment design
configuration and dust control methods and devices should be used to achieve the required dust
removal function.
Each piece of avionics may have its own peculiar dust control requirement or different
susceptibility to dust contamination depending on the design configuration (for example,
compartment ambient air cooled equipment with or without cold plates, and equipment cooled
directly by forced air supplied by the ECS). As a result, it is difficult to cite one filtration
requirement that will be suitable for all avionics.
Cold plates and finned heat exchangers can be used effectively to prevent contamination of
internal avionic compartments, but cold plates and finned heat exchangers can be blocked by
dust when avionics are cooled by unfiltered compartment air. In this case the cold plates also
need to be protected from dust.
The dust control requirement can be met through use of a single filter in the avionic cooling air
supply, individual filters at the inlet to each piece of avionics, or through use of a clean air
source. The number of filters should be minimized to reduce the maintenance requirements
associated with inspecting, cleaning, and replacing of filters. The filters, if used should be easily
accessible without having to remove other components. Generally, avionics cooled by air
directly from an air cycle system using engine bleed air will not need a filter except for vertical
and short takeoff and landing, helicopter applications, or cases where the engines are located
near the ground or at the tail of the air vehicle.
(Refer to MIL-HDBK-454, GUIDELINE 52, for further guidance on filtration for avionic
equipment.)
515
JSSG-2009A
APPENDIX D
In the future, the more extensive use of COTS equipment may make this requirement more
difficult, since COTS equipment typically blows cooling air directly over the electronic
components.
Several cases of avionics problems due to dust contamination have occurred. Most dust
problems have occurred in cargo air vehicles where the avionics are cooled by compartment
exhaust air. Considerable dust and dirt can be present in the compartment exhaust air from
cargo air vehicles, which necessitates filtering the air before it passes to avionic equipment.
Avionics equipment cold plate blockage occurred on the S-3 air vehicle due to dust
contamination resulting in inadequate cooling of equipment and other equipment problems.
Cabin air is used to cool the avionics. Although the cabin is supplied from air cycle system, dust
enters the cabin when the doors are opened, and lint enters or the crew’s clothing. The problem
was corrected by adding filters at the inlets to the cold plates that were readily accessible to
maintenance personnel for cleaning.
D.4.4.4.6.2 Avionic equipment and equipment compartment dust control.

Analyses and tests shall be conducted to verify dust levels in avionic equipment and equipment
compartment cooling air are within the maximum allowable levels as follow: (TBS) .
Inspection of drawings and air vehicle ground and flight tests shall verify avionics are free from
dust contamination by cooling air.

Inspection of drawings is required to verify provisions are incorporated to prevent the entrance
of dust into the avionics. Air vehicle ground and flight tests will then be used to show freedom
from dust problems under operational conditions.

TBS: An analysis should be conducted to determine the quantity and type of dust that can enter
the ECS during periods when backup or emergency cooling is selected. This analysis should
show that the contamination levels due to dust has no effect on the avionics, that it does not
degrade the cooling capability of heat exchangers, and that it does not adversely affect any
other component in the ECS. If this cannot be demonstrated, then the analysis should describe
the maintenance actions required to restore avionics operation, the cooling capacity, or restore
the other ECS components to their normal operating condition; the frequency with which said
action is to be done; and that this condition is allocated in the flowdown requirements for air
vehicle maintainability. Early in the program, system drawings should be inspected to ascertain
incorporation of filters or determine they are unnecessary due to air source.
(TBD)
516
JSSG-2009A
APPENDIX D
D.3.4.4.6.3 Nuclear, biological, and chemical contamination.

The ECS shall have the following provisions to counter nuclear, biological, and chemical (NBC)
threats (TBS) .

Depending upon the mission of the air vehicle and the expected threats, nuclear, biological, and
chemical protection provisions may be required to remove deadly or incapacitating agents from
the ECS air to provide for the safety of the crew and to improve the survivability of the air
vehicle.

TBS: NBC protection should be provided as required. Much of the NBC material and data are
classified. Therefore, these requirements should be established in cooperation with the
program office, survivability and command personnel. The NBC protection should not be a
cause for reduced reliability of the other ECS components either in the normal operating mode
or in the backup mode. Since outside, contaminated air can traverse the engine or APU, ECS
bleed air components, air cycle machine, and distribution ducting rapidly, the NBC protection
equipment should be operational full time in an NBC threat area, or should be able to activate
rapidly enough in order to provide the necessary protection. If the NBC device is used for
additional purposes other than NBC protection (for example, water vapor removal), all functions
and required performance should be achieved simultaneously.
Generally, one of two possible approaches should be selected for providing NBC protection for
the crew and passengers requiring different requirements from the ECS:
a. Individual protection. Under this option only the crew and passengers are protected
from NBC agents. The occupied compartment may become contaminated and will need
to be cleaned after an encounter. Individual protection interfaces with the ECS may
include such items as suit hook-ups and control of the pressure, temperature and
humidity of the suit supply air. If the suits selected do not have ventilation, additional
cooling of the compartment may be necessary to compensate for the added heat stress
on the individuals. OBOGS air supply may need to be filtered, if the masks being used
do not have filtration. If the masks do have filtration, the added pressure drop will need
to be compensated for in the OBOGS supply requirement. Crew system engineers
should be consulted to obtain appropriate interface requirements.
b. Collective protection. Under this option selected occupied and other compartments are
protected from NBC agents to avoid costly, difficult and potentially damaging clean up
following encounters. Usually individual protection should also be provided as a backup
to the collective system and in case ingress or egress has to be accomplished in a
contaminated area. For collective protection, the air vehicle needs to be pressurized to
at least the level of the dynamic head of the air vehicle at maximum speed to preclude
contaminant entry from an airborne cloud. Generally an NBC filter should be used to
filter the air entering the protected compartments. The temperature and humidity of the
air delivered to the NBC filter should be in accordance with the filter specification. Single
failures in the ECS that allow contaminated air to enter the clean air source should be
517
JSSG-2009A
APPENDIX D
avoided. If avionics compartments are selected for collective protection, only particulate
and liquid filtration of avionics supply air may need to be provided, unless temperatures
within the avionics are expected to cause condensation of liquid (aerosol) agents.
(TBD)
D.4.4.4.6.3 Nuclear, biological, and chemical contamination.

The ability of the ECS to provide protection against nuclear, biological, chemical contamination
shall be verified by (TBS) .

Verification is necessary to ensure that the ECS is able to meet the requirements of providing
protection against NBC contamination.

TBS: Much of the material and data involving chemical, biological, and radiological
contamination are classified. Coordination with survivability personnel to establish the proper
method for verification is recommended. Live agent testing is the only way to prove that NBC
equipment can work as required, but it is difficult to conduct because of the sheer size of an
ECS (laboratory availability) and the need to take extraordinary safety precautions. Therefore,
exhaustive laboratory testing with simulants should be followed by smaller scale live agent
testing that combines the proof of the concept (live agent testing) with the practicalities and
limitations of real system operation. Both type tests should be considered to conclude that the
NBC system will perform as required.
The performance of this system should be demonstrated by testing in the laboratory and during
flight tests. If the system provides dual functions such as water or water vapor filtration in
addition to NBC materials, each function should be tested individually and combined. For
example, the NBC system should be tested for its water removal capability without NBC
contaminants present. The system should also be tested with water and NBC contaminants
present at the required challenge levels. Furthermore, ambient temperatures (for example, bay
temperatures where the equipment is located) should be simulated during the testing if it is
known that the filter medium performance or system performance is dependent upon
temperature. For chemical challenges the system test rig should be used to demonstrate
compliance to the performance requirement. While other ECS performance testing is being
conducted (for example, heating, cooling, pressurization, or ventilation), the test rig should be
used to test NBC characteristics with a suitable chemical simulant(s) that does not require
extraordinary safety precautions to be taken. If simulant testing cannot be done in conjunction
with the other ECS performance testing, chemical simulant testing should be scheduled towards
the end of the system testing to ensure ample time for discovery of malfunctioning equipment,
component infant mortality, or such, which may adversely affect the chemical protection
performance outcome. The simulant should be introduced at the simulated bleed air source (for
518
JSSG-2009A
APPENDIX D
example, APU or engine bleed port). The rig should be instrumented to take samples or record
the simulant concentration at the source, before and after heat exchangers, before and after the
air cycle machine, the cockpit inlet concentration, and sources of air that may be possible to
bypass the filtration equipment, such as cooling air for air cycle machine bearings. Reductions
in the concentration of the simulant as it traverses the ECS should be recorded as a function of
time (for example, concentration as a function of location and time). If a heat exchanger or
other component failure can cause contamination of the cockpit, the rig should be instrumented
to detect contamination due to a failure of these components. Filter medium integrity should
also be demonstrated with laboratory testing. Air samples downstream of the filter should be
taken at the onset of the system testing and be examined for filter medium material such as
Sodium Aluminosilicate. Samples should be taken throughout the test program to determine if
the rate of output of filter medium is changing. These samples should show that filter medium
contamination does not increase with usage. Live agent testing should also be considered.
Preferably, where the ECS equipment is an integral part of the NBC system, such as with a
pressure-swing absorption system, this should be done in the system rig. If this is not feasible,
a pseudo-ECS test rig should be constructed which encompasses as much of the ECS as
practicable. For passive filtration systems such as charcoal filters, testing the filter alone with
live agent testing may be sufficient. The pseudo-ECS rig should be able to provide the interface
parameters and boundary conditions of the absent ECS components (for example, flow rate,
pressure, temperature, liquid water content, humidity, and other persistent contaminants such
as engine oil vapors) which represents the most severe operating condition for the filtration
equipment. Engine or APU oil vapors at concentrations allowed by the respective specifications
should be imposed simultaneously with water and chemicals for the duration of live agent
testing. Challenge levels and time duration of the chemical agents should be as established by
the system specification. If the specification does not distinguish between ambient challenge
level(s) and the challenge level(s) that would exist at the interface of the NBC equipment, then
the specification requirement (both chemical concentration and time) should be introduced at
the bleed air source. The flight test should be conducted with a suitable detectable simulant.
The purpose of this test is not to show that the ECS-NBC system components work and perform
as required, but rather it is to show that chemical infiltration to the occupied compartments does
not occur under field operating conditions. However, if laboratory testing has not been
conducted to demonstrate performance of the NBC equipment, then the flight test should be
used as the platform to demonstrate it as well as stopping infiltration. As such, instrumentation
described for the laboratory testing should be included for the flight test air vehicle, and this
instrumentation should be able to show that the ECS supply air is free from contamination and
that infiltration does not occur.
Work to date on a pressure swing system has illustrated problems with water and dusting.
Therefore, testing methods and objectives should be used which can demonstrate satisfactory
operation with respect to these type problems.
519
JSSG-2009A
APPENDIX D
D.3.4.4.7 Moisture and humidity control
D.4.4.4.7 Moisture and humidity control
D.3.4.4.7.1 Occupied compartment moisture control.

All air delivered to all compartments shall be free of entrained liquid water.

Entrained moisture needs to be eliminated from air delivered to occupied compartments to
prevent:
a. Fogging
b. Water spray from outlets, diffusers, gaspers, and such obscuring crew visibility.
c. Shorting of electrical equipment.
Entrained moisture is defined as the moisture carried in the air as free water. It should not be
confused with water vapor in the air, or “humidity”. This requirement can be met by proper
design practices. Water separators, heat exchanger drains, and such, can eliminate most of the
entrained moisture from the air. Any entrained moisture not removed in the air conditioning
packages or evaporated in the downstream distribution ducting can be trapped and drained
overboard before it reaches the outlets. (See SAE AIR1204 for more guidance.)
Experience shows state-of-the-art, low-pressure water separators located downstream from the
turbine remove approximately 85 percent (85%) of the entrained moisture. More effective
moisture removal can be accomplished through use of high-pressure water removal; that is,
remove the entrained water before air passes through the expansion turbine. Also, it has been
learned that system penalty can be reduced through use of the removed water as a system heat
sink. The F-15 experienced an early problem with water from the water separators being
sprayed over the secondary heat exchanger and collecting on the back side of the cabin ram air
valve. Over time, the water entered the cabin distribution system as a fine spray and as a
drenching spray when ram air was selected. Drain holes were added to correct the problem.
Several earlier designs of fighter air vehicles, such as F-4 and F-105 air vehicles, did not have
water separators in the air cycle air conditioning system. This proved a serious deficiency when
operated in a hot, humid environment, such as Southeast Asia.
520
JSSG-2009A
APPENDIX D
D.4.4.4.7.1 Occupied compartment moisture control.

All ground and flight tests shall verify the air delivered to occupied compartments is free of
entrained moisture. During ground and flight test the ambient conditions shall be (TBS) .

Actual testing is the only way to verify that entrained moisture is being prevented, due to the
many phenomena involved. For example, how much reheating takes place in the distribution
ducting; actual effectiveness of water separator, traps, and such, during air vehicle maneuvers.
Testing is only valid if conditions exist which normally cause moisture problems.

TBS: Ambient conditions for the ground and flight testing of moisture control need to be
carefully selected. If the requirement is too rigid, it will be costly and time consuming to perform
the test. If the requirements are not rigid enough, the test will not adequately reflect how the
system will work when the specification conditions do exist. Test should be run at the highest
absolute humidity as possible and the highest relative humidity conditions at moderate dry bulb
temperatures. A near 100 percent (100%) relative humidity case at 70 to 80°F dry bulb is
desirable for the high relative humidity case.
The V-22 air vehicle used 95°F dry bulb and 80°F as the high absolute case.
D.3.4.4.7.2 Occupied compartment humidity control.

The humidity in occupied compartments shall (TBS) .

At altitudes above 30,000 ft, the absolute humidity of the ambient air becomes very low, which
results in crew compartment relative humidities of only a few percent on air vehicles with
conventional, open-loop air cycle systems. Prolonged human exposure to low humidity results
in nasal problems, dry skin, dehydration, and fatigue. Breathing 100 percent (100%) oxygen
further aggravates the problem.
Humidification may also be required for the cabin of aeromedical evacuation air vehicles to
provide a safe, controllable, and stable environment for aeromedical patients.

TBS: General humidification of the entire occupied compartment is usually not considered
practical because of the weight penalty of the water required for the humidification and because
of the problem of condensation on the walls, floors, and other areas due to low outside ambient
temperatures. Humidification provisions are available for and used by some airlines on Boeing
747 and Lockheed L-1011 air vehicles. On Boeing 747 air vehicles, water from the potable
521
JSSG-2009A
APPENDIX D
water supply is sprayed into recirculated cabin air. On Lockheed L-1011 air vehicles, potable
water is evaporated into hot engine bleed air. With the increased acceptance and use of
various “closed loop" air conditioning concepts, humidification may become more easily
accomplished, and with much lower air vehicle penalties. (See SAE AIR1609 for additional
guidelines.)
For air vehicles that have mission times in excess of 12 hr at high altitudes (above 30,000 ft),
consideration should be given to maintaining a minimum ambient relative humidity of 30 percent
(30%) for the crew and passengers.
For aeromedical evacuation air vehicles, the possibility of providing general humidification of
30-to-50-percent (30-50%) relative humidity should be considered and incorporated as state-of-
the-art permits. Provision for humidity control to an isolated portion of an aeromedical
evacuation air vehicles is also a possibility.
High humidity levels in air vehicle occupied compartments should be prevented because high
humidity has a detrimental effect on the sweat evaporation from crew members and
passengers. Since sweat evaporation is the primary mechanism for body thermoregulation in
hot environments, the pilot's body will tend to overheat and become fatigued. Normally, properly
designed temperature control provisions will prevent excessively high humidity levels in air
vehicle compartments.
United States Air Force experience gained from extended duration missions has shown a
definite need to provide humidification of the crew compartment at high altitudes. The Strategic
Air Command Flight Surgeon has recorded pilot weight losses of 10-15 lb as a result of flights of
approximately 24 hr.
D.4.4.4.7.2 Occupied compartment humidity control.

Verification of humidity control shall (TBS) .

Verification is necessary to ensure that performance requirements are met.

TBS should be filled in with a combination of laboratory and flight tests to verify the humidity
control provisions. Laboratory tests should demonstrate the capability of the system to add
water to the ECS air without creating problems with entrained moisture. Flight testing should
verify the adequacy of the humidity levels.
(TBD)
522
JSSG-2009A
APPENDIX D
D.3.4.4.7.3 Avionic equipment and equipment compartment moisture control.

Moisture contamination of avionic compartments, avionic equipment cooling air, and fluid
coolants during ground and flight operation shall be prevented.

To prevent avionic failures due to free water, it is necessary to specify a requirement that
prohibits the introduction of moisture into the avionic equipment by the cooling air or liquid
coolant.

When using an open looped air cycle system, the use of high-pressure condensing type and
centrifugal type water separators in the ECS should be considered for the removal of entrained
moisture in avionic cooling air. Efficiencies in most low-pressure air cycle systems are not
adequate to remove enough water from the avionic cooling air to disregard water as a problem
for the avionics. Entrained water may still be present during some modes of operation and in
some environments.
The requirement for controlling avionic equipment moisture contamination can be met through
the use of cold plates or heat exchangers. The use of cold plates or heat exchangers is an
effective means of reducing moisture problems since the cooling air does not enter or come into
direct contact with the internal portions of the equipment containing electronic parts and
circuitry. If this approach is used the distribution system should be designed to be tolerant of
moisture. Also, long-term corrosion of the cold plates should be considered, especially in Navy
applications. Note that condensation could still occur on the inside of the cold plate if the
coolant temperate was low enough. This approach requires that the avionics engineer specify
that the equipment be designed with cold plates. If the equipment is already designed and
retrofit of cold plates may not be feasible. (Refer to MIL-HDBK-454, GUIDELINE 52; and
MIL-STD-2218.)
The use of closed-looped air cycle simplifies this problem. Surface temperatures should still be
maintained above the dew point to prevent condensation within the equipment.
The requirement for controlling moisture contamination of coolant fluids can be met by suitable
efficient filtration of the inlet pressurization air flow used for pressurizing coolant fluid reservoirs.
Since moisture can come into contact with coolant fluids when fluid reservoirs are being
serviced, refilled, or when fluid is being replaced or added, methods of eliminating moisture
contamination in these situations should be considered. The design of the equipment to which
the fluid will come in contact should assume, however, that some moisture will be present in the
fluid.
In the future, the more extensive use of COTS equipment may make this requirement more
difficult, since COTS equipment typically blows cooling air directly over the electronic
components.
523
JSSG-2009A
APPENDIX D
Past experience has shown a number of cases of avionics failures due to free water being
delivered to internal portions of the equipment. One such case was failure of the AGM-69A
(SRAM) INU due to free water collected inside the INS outer case from the ECS air during
captive flight on FB-111 air vehicles.
A problem has been identified with equipment that incorporate chemical dryers for humidity
control when the pressurization system is operated on the ground with one or more of the units
that require pressurization removed for maintenance.
The system that normally does not flow significant quantities of air can flow large quantities of
humid air through the system and quickly saturate the drier. This is also the case when a unit is
replaced and the pressurization system is not reconnected.
Although not due to moisture in the cooling air itself, the F-15 air vehicle experienced a problem
associated with using cold air out of a ground cooling cart which caused moisture to condense
and collect on the external surface of the distribution ducts and run to a low point where it would
drip. This problem also existed as a result of rainwater entering the air vehicle. In at least one
case, the water dripped onto an avionics box with louvers on top. This problem can be
eliminated if considered in the early design phase of the system. The F-15 air vehicle required
the addition of deflectors over certain avionics boxes and drain holes in some of the avionics
shelves.
The A-5 air vehicle experienced Verdan computer failures, less than an hour in flight, during
operations in hot humid climates due to internal accumulation of moisture that was entrained in
the cooling air. These failures resulted in frequent mission abortions.
Silicate ester fluid was used to cool the radar and missile on the F-14 air vehicle and the radar
on F-18 air vehicles. It was assumed the fluid when purchased to proper specifications would
stay free of moisture, and there were no filtration devices used on these air vehicles. Due to the
hygroscopic nature of the fluid the fluid easily entrained water when stored in open containers or
reservoirs. Water was also added to the fluid in leaky heat exchangers in the ground support
equipment. The water attacked the bonding material in the missile cold plates, whose design
also falsely assumed there would be no water present, which resulting in their failure and major
damage to the missile. Also, the fluid and water when subjected to high voltage in the radars
chemically reacted to form alcohol and an ionized gel. The alcohol resulted in a few cases in
fires. The gel attached itself to the interior of the radars resulting in significant maintenance
activity to clean it out.
524
JSSG-2009A
APPENDIX D
D.4.4.4.7.3 Avionic equipment and equipment compartment moisture control.

All ground and flight tests shall verify that air delivered to avionic equipment and equipment
compartments is free of entrained moisture. During ground and flight test the ambient
conditions shall be (TBS) .

Analyses of cooling system performance and avionic configuration are required to ascertain that
free water will not be delivered to or formed in the internal portions of avionics. Flight testing is
required to verify the analyses.

TBS: Ambient conditions need to be carefully selected. If the requirement is too rigid, it will be
costly and time consuming to perform the test. If the requirements are not rigid enough, the test
will not adequately reflect how the system will work when the specification conditions do exist.
Tests should be run at the highest absolute humidity as possible and the highest relative
humidity conditions at moderate dry bulb temperatures. A near 100 percent (100%) relative
humidity case at 70 to 80°F dry bulb is desirable for the high relative humidity case.
Analyses of cooling performance during high humidity conditions and avionic configuration
should be done early in the development program to ensure that free water will not be delivered
to or formed in the internal portions of avionics . Flight testing should be conducted in a hot,
humid environment to demonstrate that free water will not be delivered to internal portions of
avionics.
The V-22 air vehicle used 95°F dry bulb and 80°F wet bulb as the high absolute case.
525
JSSG-2009A
APPENDIX D
D.3.4.4.7.4 Moisture control of other compartments, structure, skin, equipment, and

subsystems.
Means shall be incorporated to prevent moisture contamination of other compartments,
structure, skin, equipment, and subsystems as defined (TBS) .

Depending upon the operational needs of the air vehicle, moisture control may be required for
weapons bays, wheel wells, air vehicle structure, skin panels, special purpose compartments or
equipment, and other subsystems.

TBS: The other compartments, structure, skin panels, equipment, or subsystems which require
moisture control should be defined along with any specific requirements.
(TBD)
D.4.4.4.7.4 Moisture control of other compartments, structure, skin, equipment, and

subsystems.
Moisture control of other compartments, structure, skin, equipment, and subsystems shall be
verified by (TBS) .

Verification is necessary to ensure the moisture control requirements are met.

TBS should be filled in with analyses, inspection, and tests.
(TBD)
526
JSSG-2009A
APPENDIX D
D.3.4.4.8 Transparent area fog and frost protection.

Critical viewing area interior surfaces of these transparencies shall be maintained free of fog
and frost for all steady-state ground and flight operating conditions. The critical viewing areas
are (TBS 1) . Critical viewing areas shall also be maintained free of fog and frost during
maximum rate descent from the operational ceiling of the air vehicle in the ambient environment
of (TBS 2) . Preheating of the critical viewing areas by increasing occupied compartment air
temperature above normal limits prior to descent shall not be required to maintain fog-free
surfaces.

Fog and frost protection is required to ensure adequate crew visibility. Fog and frost protection
may also be required for other transparent areas such as sensor windows. Preheating the
compartments to accomplish the fog and frost protection function is prohibited for two reasons:
a. It unnecessarily heats the cabin above the specified limits.
b. It adversely affects the transient capability. If a sudden dive is required due to loss of
cabin pressurization or combat maneuvers, the crew will not have the time to preheat the
cabin.
In-flight failure of an ACM or other component may necessitate turning off the air conditioning
system. However, fog and frost protection is still required to permit the safe completion of the
mission or return of the air vehicle.

Protection from fog and frost is achieved by raising the temperature of the transparency interior
surface above the compartment dew point temperature.
TBS 1 is to define the transparency areas which are critical viewing areas and for which the
transient fog protection requirements must be met. The critical viewing areas of the windshield
and canopy are determined by crew station performance considerations. Critical viewing areas
of camera and sensor windows are determined by the operational requirements for these pieces
of equipment. The critical viewing areas of the canopy and windshield should be obtained from
the crew station engineer. Camera windows, sensor windows, and other special fog and frost
protection requirements should also be specified. Close coordination with the engineers
responsible for the special equipment is necessary to ensure these requirements are accurately
and completely specified.
TBS 2 should be filled in with consideration of the following. The ambient conditions for the
maximum rate of descent requirement are to be specified. The historical requirement in MIL-T-
5842 was unrealistically severe, requiring the system to function from near MIL-STD-210A cold
day conditions at altitudes of 25,000 feet and above to tropical day conditions at sea level. The
USAF Environmental Technical Applications Center was requested to investigate the
occurrence of cold temperatures aloft with high humidities below. The results of their analysis
are shown on figure D-12. The air should be assumed saturated all along the profile
(temperatures are dew point temperatures). The sea-level dew point temperature of 88°F
527
JSSG-2009A
APPENDIX D
corresponds to the MIL-HDBK-310 high humidity 1 percent (1%) extreme. This curve is
recommended for specifying the environmental interface under which the performance
requirements must be met. This curve may need to be tailored to be consistent with the
environmental requirements specified in the air vehicle specification.
Consideration should also be given to emergency fog and frost protection. In the event of
failure of the fog protection system, some other means should be available to meet the steady-
state fog protection performance requirements for the critical viewing areas. For example,
analysis may show that the transparency anti-icing system is capable of supplying enough heat
to the transparency interior surface to meet the steady-state fog protection requirements.
Another alternative for lower speed air vehicles is a clear vision panel that can be opened in
flight.
The normal fog and frost protection provisions should not be disabled by closure of an air
conditioning package shutoff valve.
Experience has shown that the use of an anti-fogging approach is very effective for fog
protection. Also, the use of effective water removal in the air conditioning system aids in
minimizing fogging problems.
The F-15 approach of blowing 88º F air over the transparency interior surfaces has proved an
effective means of fog protection. The only drawback has been the complaint by some pilots of
a warm head on hot, sunny days.
Use of a high-pressure water separator in air cycle systems greatly minimizes the possibility of
fogging as shown by the Advanced Environmental Control System (AECS) advanced
development program.
Lack of water removal in air cycle systems greatly aggravates cockpit fogging problems, as
experienced by F-4’s in Southeast Asia operations.
528
JSSG-2009A
APPENDIX D
ALTITUDE IN FEET X 1000
FIGURE D-12. Upper air temperature profiles for design of windshield defogging system.
529
JSSG-2009A
APPENDIX D
D.4.4.4.8 Transparent area fog and frost protection.

The capability of the ECS to provide fog and frost protection
to the defined critical view areas shall be verified by (TBS) .

Verification is necessary to ensure the ECS meets the fog and frost protection requirements.

TBS should be filled in with analyses, laboratory testing, and ground and flight tests. Analyses
and flight tests should demonstrate that preheating of critical viewing areas by increasing
occupied compartment air temperature above normal limits is not required to maintain the
critical viewing areas clear of fog during rapid descent. Inspection of drawings and flight
demonstration should show that normal fog protection provisions are not disabled by closure of
air conditioning package shutoff valves.
The steady-state analysis should show that the fog and frost protection system can supply
enough heat to the transparency to raise the interior surface above the dew point. For this
analysis, the outside ambient air temperature and the heat transfer properties of the
transparency will determine how much heat flow is required. The cabin dew point should be
determined from the outside ambient humidity plus the moisture given up by the crew. An
allowance of 0.25 to 0.50 lb/hr for each crewmember should be made. It should be noted that
no allowance is made for water removed from the cabin air by the water separator. This
practice prevents a water separator malfunction from being a critical single point failure.
Another important parameter in this analysis is the temperature of cabin air in close proximity to
the transparency.
The analysis for transient system performance is more complicated than for the steady-state
condition. The transient performance requirements are generally more severe than the steady-
state requirement. However, for the transient performance case, water removed by the water
separator should be considered since the probability of performing a maximum rate of descent
dive with a failed water separator is low. Also, for this analysis, the transparency is assumed to
be at its normal steady-state temperature when the dive is initiated. If a system is used that
requires activation by the crew, the analysis should not take advantage of system activation
prior to initiation of the descent. The cabin dew point will change instantaneously during the
descent as the outside ambient dew point changes.
Analyses, laboratory testing, and ground and flight tests should verify that thermal protection for
all critical viewing areas prevents overheating for normal and backup cooling modes.
Final verification should be by a flight test where the sea level dry bulb temperatures and dew
point temperatures are within a specified differential from the required temperatures. A
5 to 10oF differential is recommended. The following flight test procedure is recommended for
all but rotorcraft, but it is especially applicable to combat air vehicles.
530
JSSG-2009A
APPENDIX D
The flights should be made during early morning or late evening when the dry bulb and dew
point temperatures are the closest. Climb the air vehicle to the lowest altitude at which a true
atmospheric temperature of -65°F exists. The air vehicle should loiter at this altitude, at the
minimum engine power setting required to maintain level flight, for a period of 30 minutes. A
maximum rate of descent dive with the lowest practicable engine power setting should be
performed too the safe minimum altitude. The air vehicle should descend through as much
cloud as possible particularly at low altitude. The test should be repeated with the dive being
made at the maximum allowable speed. The following test data should be recorded as a
minimum:
a. Sea-level dew point and dry bulb temperatures during test flights.
b. Cockpit temperatures at head and foot level taken at regular intervals during the flight.
These temperatures should be recorded immediately before and after the descent.
c. Defogging air temperature and temperature at various locations on the inner surface of
the transparencies.
d. The condition of all transparencies during the flight. The condition should be described
in detail and illustrated by sketches.
e. The cloud conditions encountered during flight.
f. Speed, altitude, and duration of any extra flying required to clear the transparencies at
the end of the dive.
(TBD)
531
JSSG-2009A
APPENDIX D
D.3.4.4.9 Rain removal.

The rain removal subsystem shall maintain the visibility required through critical viewing areas
for mission completion under the precipitation rate of “Design environment at installed locations”
of the Air Vehicle System Specification. The critical viewing areas for rain removal are
(TBS 1) . The system shall maintain the required visibility during operation in rain for the
following conditions: (TBS 2) . The rain removal system shall not be damaged by flight at the
maximum air vehicle speed. A single failure shall not result in depriving the crew of the
minimum critical viewing area.

Viewing area rain removal is required to ensure adequate visibility for crew, camera, and
sensors.

TBS 1: The critical viewing areas are determined by crew station performance considerations.
The critical viewing areas of the windshield should be obtained from the crew station engineer.
Critical viewing area for camera windows, sensor windows, and such, should be obtained from
the engineers responsible for those pieces of equipment.
TBS 2 is used to list the specific flight and ground conditions that will require rain removal. The
factors discussed above should be used in determining this requirement. Sensor requirements
may differ significantly from crew station transparencies requirements, and the operational
needs of the air vehicle should be considered when establishing this requirement.
Different air vehicles have different rain removal requirements. All air vehicles require adequate
rain removal during landing approach and ground operations. In addition, rotorcraft require rain
removal throughout their flight envelope. Fighters also require sound rain removal throughout
the low altitude portion of their flight envelope, especially if they have a terrain-following
capability, such as the F-111. Most transports only require rain removal during landing
approach, landing, and ground operations. Bombers, such as the B-52 and the B-1, which have
a terrain-following capability, need rain clearance at this flight condition. In addition to any
mission requirements, Navy carrier based air vehicles must be able to see the carrier deck and
signaling equipment when landing in the rain and must be able to see personnel and equipment
on the crowded flight deck when taxiing into position for launch in the rain.
The design of the air vehicle has an even greater effect on the type of rain removal required
than does the mission. The size and shape of the windshield is very important. It is usually
much easier to clear the rain off the relatively small, flat windshields of most transports than it is
the large, bubble canopies on combat air vehicles, rotorcraft or observation air vehicle. The
availability of bleed air from the air vehicle engines, the slope of the windshield, and the material
from which the windshield is made all affect the design of the rain removal system.
532
JSSG-2009A
APPENDIX D
Types of rain removal systems:

a. Windshield wipers. Windshield wipers are the oldest method in existence to remove rain
from windshields. Built with arms and blades in the shape of inverted airfoils, they work
satisfactorily at air vehicle speeds up to approximately 150 knots, true airspeed (TAS).
The aerodynamic shape of the arms and blades cause the blades to press harder
against the windshield surface rather than blowing from the surface as airspeed
increases. Tests of this concept by Lockheed in 1965 demonstrated that a windshield
wiper could satisfactorily clear a rainfall of 2.8 in/hr from a windshield at an airspeed of
115 knots, TAS. The same test showed a 2.0 in/hr rainfall could be cleared at 150
knots, TAS with only a slight decrease in visibility.
The wiper was operating at 340 strokes/min. This is state-of-the-art for windshield
wipers and may remain as an upper limit of their performance. At higher airspeed and
rainfalls, the speed of the wiper should be increased to provide the same amount of
clearance. In addition to the mechanical and power consumption problems involved in
faster wiper speeds, the wiper itself begins to become a serious obstruction to good
vision. Many pilots find the flickering effect of the windshield wiper moving back and
forth through their line of sight to be very distracting when the wiper speed exceeds 350
strokes/min.
There are other problems with windshield wipers that have not been solved. Wipers
work very well on flat surfaces. The more pronounced the curve of a windshield the less
effective wipers become. Wipers are all but useless on modern fighter air vehicles with
single-piece, bubble canopies. There is also a serious problem when windshield wipers
are used on materials other than glass. Polycarbonate and stretched acrylic both
scratch easily. The continuous rubbing of windshield wipers combined with the dust in
the air will rapidly wear a pattern of fine scratches into the surface of the windshield. In
bright sunlight the scratches cause a severe glare. As nothing can be done about dust
in the air, the only apparent solution to this problem seems to lie in making non-glass
transparencies more scratch resistant. This problem is particularly bothersome on
rotorcraft, as these air vehicles most often combine windshield wipers and non-glass
windshields. This results in a very high replacement rate of windshields.
Overall, windshield wipers are an acceptable means of rain removal for helicopter,
transport, and utility-class air vehicles, which usually do not fly at high speed at low
altitude and tend to have reasonably flat windshields. Windshield wipers are low cost,
reliable, and lightweight. They are also readily available.
b. Jet blast rain removal systems. This method was developed from the chance
observation that the high-pressure, high-temperature air used to de-ice the windshield of
the F-86 air vehicle also did a good job of preventing rain from striking the windshield.
These systems have evolved as follows. High-pressure, high-temperature engine bleed
air is ducted to the base of the windshield. The bleed air is controlled by a shutoff and
pressure regulator valve. When the valve is opened, the bleed air is directed over the
windshield by a series of nozzles or by one slot-type nozzle at the upstream edge of the
windshield. If a series of nozzles are used, they should be spaced closely together or
water streaks will result on the windshield. Experience has shown the slot nozzle to be
the better choice in this application. The nozzles should be a convergent type and
should direct air parallel to or slightly away from the windshield. Tests have shown that
533
JSSG-2009A
APPENDIX D
a slight angle away from the windshield of the jet blast nozzles, which provides a small
component of jet blast air velocity normal and away from the transparency, gives the
best performance. The nozzle exit air should be at sonic velocity. Since the sonic
velocity is proportional to the square root of the temperature, the jet blast air should be
as hot as other systems requirements will permit. The jet blast air typically requires a
pressure of at least 60 psig. These systems also require between 4.5 and 7 lbm/min of
bleed air for each inch of width of cleared windshield. Experiments have repeatedly
shown the above requirements to be the minimum for acceptable jet blast system
performance. Unfortunately, this system has two very serious disadvantages. The
greater of these is the amount of bleed air required. As stated above, the system needs
4.5 to 7 lbm/min of bleed air for each inch width of clear windshield. This means that a 1
ft-wide, clear section of windshield would cost from 54 to 84 lbm/min of bleed air. Also,
the engines should be able to supply these quantities of bleed air at idle power at
sufficient pressure to produce sonic flow at the jet blast nozzle exit. These conditions
should be the design point because idle descent to land is the time most critical to good
visibility.
A second, serious problem with this system is its potential for damaging or failing the
windshield by overheating its surface. Experiences on the F-4, F-15, and other air
vehicles have shown the importance of using means to protect against overheating the
transparencies. Overheating can result in cracking, internal delamination, or
discoloration.
Windshield over-temperature protection may be provided by limiting the jet blast

temperature or by allowing the jet blast to mix with some of the slipstream air before it
reaches the windshield so an insulating layer is formed between the windshield and the
jet blast air or by a combination of both.
There are several ways to provide the desired mix of slipstream and jet blast air. The jet
blast nozzles can be raised somewhat above the plane of the windshield outer surface.
The jet blast nozzles may be rotated slightly away from the plane of the windshield. The
nozzles may also be located a few inches forward of the leading edge of the windshield.
In addition, there should always be a cockpit signal to warn the pilot of an eminent
overheat of the windshield.
The F-18 air vehicle reduces the temperature of the air used for rain removal and other
warm air uses by separating the bleed air coming through the primary heat exchanger
into two air streams, diverting the cooler air closest to the ram air inlet to the warm air
manifold that supplies the rain removal system.
One other problem with jet blast systems is that they cannot be designed totally
analytically. Wind tunnel testing of cockpit mock-ups complete with simulated rain to
size and position the jet blast nozzles properly relative to the windshield is required to
refine the system design.
c. Rain repellents. All rain repellents, whether “in-flight” or “ground applied”, work in the
same manner. A thin film, usually one molecule thick, of rain-repellent material is
deposited on the windshield. Water does not adhere to or wet the repellent. As a result,
the water will remain in the form of spherical droplets rather than spreading into the non-
534
JSSG-2009A
APPENDIX D
uniform film it normally forms. These droplets will then rapidly roll off the windshield due
to gravity and the slipstream. Both types of rain repellent have two common problems:
1. Glare. At night, in rain under overhead lighting, there is a very distracting glare from
light being diffracted into the pilot's eyes by the droplets on the windshield. This
effect will occur with any rain repellent. This glare is not noticed in daylight and does
not occur at night with any lights other than overhead lights. This glare could be a
problem near hangers and other facilities with overhead lights.
2. Static and taxi. During slow taxi and static operations, rain repellents are sometimes
unsatisfactory because there is insufficient wind to blow the droplets off the
windshield. The droplets should become quite large before they roll off due to
gravity. This will result in a high percentage of the windshield covered with water
droplets and the associated impaired visibility. This problem becomes even worse
when the slant angle of the windshield is low. Thus, even with a good ground-
applied rain repellent, windshield wipers or jet blast may still be needed for low-
speed taxi and static operation.
Ground-applied rain repellents should be reapplied every 30 to 50 flight hr, or after each
encounter with rain. In the Air Force, requirements for applying rain repellents are
provided in TO 42D4-1-4. All ground-applied rain repellents suffer in some degree from
additional problems. These problems are discussed below.
1. Limited life. The ideal, ground-applied rain repellent would be applied during
manufacture of the windshield and would last the life of the windshield. To date, this
goal has not been approached and there is no reason to believe it can ever be
reached. Failure to solve this problem leads to the next—maintainability.
2. Maintainability. The fact that current, ground-applied rain repellents are periodically
reapplied leads to several problems. First, the pilot has no way of knowing if the
proper reapplication of rain repellent has indeed been accomplished. Reapplication
requires manpower. The effectiveness of all current, ground-applied rain repellents
is heavily dependent on the skill and dedication of the people applying them and the
weather conditions in which they are applied. Finally, once the repellency is gone in
flight, it cannot be replaced in flight.
Rain repellents applied in flight are sprayed onto the transparency from nozzles located
upstream of the windshield. The air and rain impinging on the windshield then distribute
the repellent material evenly over the windshield’s surface. This results in a rain
repellent film being formed on the windshield, which will last for several minutes. When
the film loses its repellency another may be applied.
In principle, the designs of in-flight, repellent-dispensing systems are quite simple.

There are two basic types. The first type, or Type 1, system has an unpressurized
reservoir. The reservoir is pressurized during flight by compressed air either from a
small compressor or from the air vehicle service air system. When the pilot activates the
system, the compressed air forces the repellent through the system plumbing to the
distribution nozzles and out onto the windshield. The system has a timed solenoid valve
in the plumbing so that a fixed amount of repellent is applied to the windshield on each
command from the pilot.
535
JSSG-2009A
APPENDIX D
The second type, or Type 2, rain-repellent dispensing system has a pre-pressurized

bottle of repellent. This type of system eliminates the need for an active rain repellent
pressurization system in the air vehicle. If this type is used, the materials used as the
charge for the bottles must meet current hazmat requirements established in the air
vehicle specification.
In-flight-applied systems also have some inherent problems, as follow:

1. In-flight systems do not work adequately on the ground because the repellent is not
distributed properly, so windshield wipers or jet blast are still required for ground
operations.
2. In-flight systems also require maintenance to fill or replace the reservoir. If the
reservoir (bottle) has to be replaced after it is empty, the storage and replenishment
for replacement bottles may be a problem, particularly for carrier-based air vehicles.
3. Because it is a fluid system, In-flight-applied systems are subject to corrosion and
clogging problems, adding additional maintenance hours. This does vary with the
system design and the type of fluid being used.
4. The in-flight system does add weight to the air vehicle compared to ground-applied
rain repellent. This needs to be considered particularly for high performance
(combat) air vehicles and rotorcraft.
There are also many advantages to the in-flight-applied repellent. Although not true of
all current, in-flight-applied rain repellent systems, this system can be very simple and
reliable. Its cost can also be competitive with windshield wipers and jet blast systems.
The system is very effective in flight, assuming proper design. Unlike ground-applied
repellents, this system gives the pilot complete control over the repellency of his
windshield. To date, this system has been largely restricted to transport-type air
vehicles. However, with the exception of rotorcraft, this system could be applied to all air
vehicles. Rotorcraft, when hovering or flying at very low airspeeds, lack the necessary
airflow to distribute the repellent.
Consult SAE AS6882 for further guidelines if ground-applied repellent is to be used.
Various types of air vehicles lend themselves to different types of rain removal systems:
a. Rotorcraft (helicopters) are probably the most difficult type of air vehicle for which to
provide a rain removal system. In-flight-applied repellent systems do not work at the
very slow speeds at which rotorcraft sometimes operate. Windshield wipers tend to
scratch the polycarbonate used almost exclusively for helicopter transparencies.
Ground-applied repellent should be considered as a prime candidate for a helicopter rain
removal system. The only alternatives would be a windshield wiper—thus a high
replacement rate of polycarbonate windshields or the large weight penalty of glass
windshields.
b. Utility air vehicles are compatible with wiper use. Glass transparencies do not cause a
very serious weight penalty to this type of air vehicle and the performance of these air
vehicles is well within the capability of wipers. Utility air vehicles also tend to have flat
windshields. These utility vehicles are referring to historically cargo-oriented or large
536
JSSG-2009A
APPENDIX D
payload-carrying vehicles that have multi-functional and utility-oriented performance

capabilities.
c. Combat air vehicles would be prime candidates for in-flight-applied systems when jet
blast is not practical and where static and taxi visibility is not critical. Wipers are not
usable at the speeds at which these air vehicles operate. The performance
requirements of such air vehicles would justify the development of an in-flight-applied
rain repellent system. Current ground-applied rain repellents are only of limited value in
the environments where these air vehicles must operate. Where static and taxi visibility
is critical, such as on an air vehicle carrier, a combination of a jet blast system
supplemented by a ground applied system would be the prime candidate. The jet blast
provides the needed clearance during taxi, static and low speed. The ground applied
rain repellent provides additional capability to meet heavy rain conditions without
requiring excessive bleed air flows, but limited capability is there if the repellent has worn
off. The jet blast may also be used for anti-icing.
d. No particular type of rain removal system is more beneficial for transport-class air
vehicles. All types of rain removal systems could work on this type air vehicle. In fact,
current transports use all types of rain removal systems in many different combinations.
e. Bombers have characteristics of both combat and transport air vehicles when all aspects
of their missions are examined. The systems most likely to satisfy the requirements of
bombers would be in-flight-applied rain repellent and jet blast.
The items above are guidelines only. It is often necessary in practice to combine two and even
three different rain removal systems to achieve desired performance under all conditions. A
trade study that considers all possible rain removal methods should be conducted for each new
air vehicle early in the program to select the best rain removal system.
(TBD)
D.4.4.4.9 Rain removal.

The capability of the rain removal subsystem to provide the required rain removal functions and
performance shall be verified by (TBS) .

Verification is necessary to ensure proper rain removal performance is met. Verification needs
to ensure the clearance area of the rain removal provides for safe operations of the air vehicle
where the system operates.
537
JSSG-2009A
APPENDIX D

TBS should be filled in with the appropriate combination of laboratory tests, failure mode and
effects analyses, and air vehicle ground and flight tests to verify adequate rain removal through
critical viewing areas.
Flight tests should demonstrate the rain removal system is not damaged by flight at maximum
speed.
A failure mode and effects analyses (FMEA) should verify that no single failure results in failure
of rain removal for two windshields.
Laboratory tests in “rain tunnels" are very effective in the design and evaluation of rain removal
systems. Rain tunnels permit test of the system under carefully controlled conditions that are
difficult or impossible to encounter during flight testing. Flight tests, in natural rain or behind a
spray tanker, permit evaluation of the rain removal system installed on the air vehicle in the
flight environment.
The A-10 program made very effective use of a rain tunnel in the development of the rain
removal system. The tests demonstrated that a ground-applied rain repellent would work very
well. However, as a result of these tests it was learned that a small jet blast system was also
required to help clean the windshield under “mist” rain conditions at low speeds of 40 knots and
under.
D.3.4.4.10 Transparency cleaning.

A cleaning system shall be provided for the following transparencies: (TBS 1) . The cleaning
system shall be designed to remove (TBS 2) and shall have sufficient capacity to provide
necessary cleaning of critical viewing areas throughout any single mission. The critical viewing
areas for cleaning are (TBS 3) . There shall be no loss of fluid during flight maneuvers of the
air vehicle.

Air vehicles with low altitude missions, vertical takeoff and landing capability, and similar
missions or those required to operate on an air vehicle carrier may require a transparency
cleaning capability to ensure adequate crew visibility. Camera windows, sensor windows, and
such, may require cleaning system to ensure proper performance of the device. Cleaning
systems must be able to remove salt, dust, insects, gun gas residue, and such, depending upon
the environment in which the air vehicle is to operate.

TBS 1 should designate the transparency surfaces that require a cleaning system. This may
include a windshield, a canopy, sensor window, or such.
538
JSSG-2009A
APPENDIX D
TBS 2 should define the substances that the cleaning system must be able to remove.
TBS 3 should define the critical viewing areas for which the cleaning system must meet
performance requirements. The critical viewing areas are determined by performance
consideration and the requirements of special sensors. The critical viewing area of the areas to
be cleaned should be obtained from the appropriate cognizant engineer.
The system should be required to remove dried salt fog from the transparencies when the air
vehicle is expected to operate over or near saltwater. Insect and dust removal is required for
operation over land. Another application for a transparency cleaning system is on air vehicles
subjected to large quantities of smoke from air vehicle armament. In these applications, the
system should be able to remove smoke or residue from transparencies.
The capacity required for salt removal is a function of the expected mission altitude and
duration. The system capacity should be adequate for a complete mission.
For dust and insect removal systems, the design and capacity should be determined by the
insect removal case, as that is more difficult to achieve than dust removal. The insect removal
system capacity is determined by mission duration and washing frequency.
A common design criteria for insect removal is that one honeybee-sized insect (120 mg) can be
expected to impact each square foot of windshield frontal area for each 20,000 ft of horizontal
extent. A common design criteria for vertical takeoff and landing air vehicles is for the washing
system to maintain the pilot and co-pilot’s windshield free of dust based on a dust density of
0.1 gram per cubic foot of commercial 140 mesh silica flour.
Since smoke and armament residue may be unique to each air vehicle, wind tunnel and
perhaps flight test experience should be conducted to determine smoke and residue cleaning
requirements.
Typical wash system operation is usually initiated by spraying a washing fluid on the
transparency exterior surface. Then a jet blast or windshield wipers are used to provide
scrubbing action, if necessary, to loosen the foreign substance from the transparency surface.
The system controls can either automatically sequence the wash duration and jet blast initiation
or the control can be completely manual.
Normally, the wash fluid will be contained in a reservoir pressurized by bleed air. Since
maintenance may be required on the system after each flight for reservoir filling, it is important
for the reservoir to be located in an accessible location and fill and drain ports should be easy to
use. If the washing fluid has a freezing point that may be reached while the air vehicle is
operative or inoperative, heating provisions should be required for the reservoirs. Reservoir
heating can be accomplished either electrically or by the use of bleed air.
The wash fluid is to be non-corrosive and non-toxic, meet current hazmat requirements
established in the air vehicle specification and should be in no way detrimental to the
transparency surface. Also, the system design can usually be simplified if a fluid is used that
will not freeze at temperatures encountered in the air vehicle, thus alleviating the fluid heating
requirement. The use of detergents should be avoided since corrosion problems can result for
539
JSSG-2009A
APPENDIX D
the air vehicle, and system maintenance and reliability will be adversely affected due to line
clogging problems and the necessity to purge fluid lines with bleed air after washing.
(See SAE AIR1102 for additional guidance.)
Solutions of 60 percent (60%) water and 40 percent (40%) ethylene glycol and some
commercially-prepared fluids have proved to be satisfactory washing fluids.
D.4.4.4.10 Transparency cleaning.

Inspection of drawings and the air vehicle shall verify incorporation of cleaning provisions for
(TBS 1) and that fluid cannot be lost during flight maneuvers. Laboratory and flight tests shall
verify the capability of the system to remove from (TBS 2) critical viewing areas throughout
any single mission.

Laboratory tests are essential in the design, development, and test of cleaning systems. Design
conditions are difficult to encounter and measure during flight testing, so laboratory testing is
required. Flight tests are required to evaluate the system installed on the air vehicle and in the
flight environments.

TBS 1 is used to define the transparencies with cleaning provisions.
TBS 2 is completed by defining the substances that must be removed by the cleaning system.
Laboratory wind tunnel tests are usually necessary to finalize system detain design (nozzle
sizing, wash duration, or system geometry). These tests can also serve to verify the
performance of the system.
Cleaning systems are difficult to design and it should be verified that the contractor makes
sufficient provisions for system testing.
D.3.4.4.11 Ice protection.

The air vehicle and its subsystems shall maintain full flight critical operation in the icing
environment defined in the air vehicle specification. Except for an air vehicle required to
perform its typical mission while under icing conditions, the air vehicle and its subsystems shall
recover a “full mission capability” within the (TBS 1) time period after exiting icing conditions.
When an air vehicle is required to perform its typical mission while under icing conditions,
540
JSSG-2009A
APPENDIX D
mission capability shall be maintained as defined in the air vehicle specification. An Ice
Protection System (IPS) shall be provided as required to meet these requirements.
a. Unprotected components. Ice accretion on components that cannot or will not be
protected shall present (TBS 2) degradation to mission capability and maneuvering
performance parameters and shall not present unacceptable safety risk to flight crew or
ship-or-ground personnel in all operational phases.
b. Protected components. The IPS designs shall adhere to the (TBS 3) documents for
the IPS technology implemented for a particular subsystem or component.
c. IPS detection and controls. If an IPS is required, a manual or automatic (or both)
detection system for sensing incipient ice accretion shall be provided and shall enunciate
(TBS 4) information to the pilot. A (TBS 5) method for reporting surface ice control
performance shall be provided for flight critical and safety-of-flight components.
A properly designed IPS provides operational safety, strategic, and tactical advantages for a
given air system. The natural environment cannot be controlled, nor can it be reliably predicted
on small to intermediate spatial and temporal scales in which most weapon systems operate,
such that safety-of-flight risk due to inadvertent entry is a common event. Tactical advantages
include mission planning efficiency, mission readiness, mission timeliness, and success rate,
which all increase with an IPS, since operations can be executed during known or predicted
icing environments of certain severities. Strategic advantages include utilizing adverse weather
conditions such as icing as a cover to capitalize on the element of surprise during offensive
operations and to protect air vehicles in transit or on special missions.
Commonly, the decisions regarding the components protected by an IPS on a given air system
are made during contract negotiations, such that the detail specification should be descriptive to
the component level to ensure an adequately balanced system is developed during acquisition.
The cost of designing, testing, manufacturing, operating, and maintaining an IPS has been
historically very high and may consequently result in under-designed systems being introduced
to the fleet. However, there are many exposed air vehicle components on which ice accretion
has a neutral effect beyond drag increase, and should not be protected. The determination of
protection requirements for a given component should not be done via contract negotiation or
cost tradeoffs, but by engineering evaluation of system or mission impact. There are a wide
range of IPS technologies available with different levels of maturity, levels of electrical power
requirements, weight impacts, reliability and maintainability characteristics, as well as
functionality (ice control performance).
As the complexity of air vehicle weapon systems has increased, so have the IPS technologies
to protect them, causing an increased need for autonomous control, monitoring, and
performance reporting of the IPS, to reduce crew workload. An automatic system can provide
IPS activation upon entering into an icing environment without flight crew action. A manual IPS
can allow the flight crew to prioritize air vehicle resources during normal and emergency
operations. The performance adequacy of an IPS to control ice accretion or removal is
generally provided by monitoring air data and propulsion instruments, visible external cues, and
airframe vibrations and air vehicle handling qualities. The design of an IPS is most always a
compromise of cost, weight and power for a specified icing severity protection level, such that
541
JSSG-2009A
APPENDIX D
there will be environments that exceed this level, and the flight crew should not discover these
limits by exceedance before exiting the environment. Failure reporting in the cockpit will provide
the flight crew with information that will allow flight, safety, and mission critical decisions to be
made during system malfunction.

The air vehicle specification should specify which components are to be protected or
unprotected, what portion of the each surface will be protected, and the type of protection
required (deice active shedding, deice passive shedding, anti-ice running wet, anti-ice
evaporative).
TBS 1: If not defined in the air vehicle specification, the “time period” should be based on
mission requirements as well as expected performance of available technology and is typically
5-30 minutes. The term “full mission capability” should be well defined based on intended
system reliability and robustness during normal and instrument meteorological conditions (IMC)
operations. The IPS should provide protection for all components exposed to in-flight, ship, and
ground icing conditions as given in “Operational environment” of this document’s handbook that
present unacceptable operational safety risks to personnel or materiel, prevent or delay mission
completion, or degrade mission readiness or success. The best commercial design practices
should be used in the IPS design process (guidance information is provided in the "Aircraft Icing
Handbook," FAA Report DOT/FAA/CT-88/8, which is the most up-to-date, central source of icing
design data to date (beyond the Aeronautical Design Standard ADS-4 available from the US
Army Materiel Command at www.redstone.army.mil). The handbook is updated on a regular
basis by the FAA and the SAE AC-9C Aircraft Icing Technology Subcommittee. The
determination of icing effects, appropriate protection techniques, and which components can be
unprotected should be resolved by technology trade studies, accepted and validated ice
accretion computer simulation, and documented experience. Component and material testing
using artificial, simulated, or natural testing should also be used. Protection technologies
including Type I & II Freezing Point Depressant (FPD) deicing fluid categories require
appropriate levels of airframe watertightness to prevent intrusion and degradation of subsystem
components and have an environmental impact that should be addressed.
TBS 2: The limits of degradation should be specified. For example, maximum engine inlet
distortion (engine qualification limits should be used), a maximum shed ice size for engine
foreign object damage (FOD) potential (determined from distortion energy criteria or ice
ingestion testing), a maximum airframe parasitic drag delta (5 percent (5%) is recommended), a
maximum air vehicle lift to drag ratio delta (5% is recommended), a minimum transparency
critical visible area (70% of total viewing area is recommended), or a maximum radome signal
attenuation to dispersion (10% is recommended). Consideration should be given to preventing
excessive ice accretions on the fuselage and exposed subsystems and components during all
conditions of flight and ground-or-ship operations. The determination of whether a particular
component does not require protection should consider the potential aerodynamic degradation,
the ice elimination process (sublimation, shedding, melting, manual removal) and its operational
phase impact, and the component functionality and criticality contribution to mission success.
TBS 3: No components should deice or self-shed accreting ice into air induction inlets or
exhausts (engine inlets), transparencies, or rotating components (main or tail rotors) and fixed
542
JSSG-2009A
APPENDIX D
surfaces should be protected from excessive ice impact forces. No IPS component should
cause compromising emanations (electrical or acoustic), behave abnormally in electromagnetic
or acoustic environments, or excessively degrade system reliability or maintainability. All IPS
components exposed to the ambient environment should be resistant to solar radiation; salt
spray; and hydrometeor, sand, dust erosion. New technology IPS systems are permitted with
DOD concurrence concerning operational characteristics, reliability, maintainability, cost
effectiveness, design risk, test evaluation, and technical maturity. IPS component, electrical,
pneumatic controller failure modes should be addressed to maximize survivability and mission
capability. When GFE components are used, the airframe contractor should provide all
necessary electrical, control, pneumatic, and hydraulic utility service connections located at the
component mounting interface in an accessible manner. When a component IPS requirement
must be assessed during flight testing, there should be utility service, structural, and spatial
provisions provided for that IPS subsystem if it must be installed.
Protection should be provided for all flight critical surfaces (such as the wing or empennage)
and optionally for other aerodynamic surfaces degraded by ice accretion. The operation of any
surface contraction or folding design and locking indicators should not be degraded by ice
accretion. Design considerations should include degradation of lift, performance, range,
endurance, handling qualities, stall angle-of-attack (AOA), control effectiveness, and sink rate
and increase of drag, stall speed, takeoff speed, and control forces. Components should be
resistant to impact and accretion from residual ground or ship ice accretion during flight platform
operations.
Engine and Engine Air Induction Inlet IPS considerations are also given in JSSG-2007, Engines
Joint Services Specification Guide, and should be considered such that a balanced Airframe
and Engine Integrated IPS is developed. The engine inlet, inlet duct, components, inlet auxiliary
inlets, and the engine front frame should be protected to < +40°F by an anti-ice or deice IPS
system. High flow rate (> 80 lbm/min) propulsion systems with long ducting, prone to
condensation or vortex icing, should be protected to < +60°F. If a particle separator is required
the design separating efficiency should include removal of natural-shed, passive-shed, and
active-shed ice from engine-face-forward components such that particle sizes entering the
engine do not affect the fatigue limits of the fan or compressor design and the separated particle
sizes do not damage or obstruct auxiliary blowers or ducts. If the IPS is an active-shed or
passive-shed deice design then engine FOD-threatening shed ice shards should not be
generated in any phase of operation. If the engine IPS subsystem is a "running wet" design the
runback of liquid water should not refreeze and shed into the engine in any icing environment or
phase of operation. Consideration should be given to condensation icing; vortex icing; ice
crystal and snow accumulation; water plug or slush formation; airflow spillover characteristics;
and ramp, guide vane, and boundary layer suction and bleed design. If shielding screens are
installed over or in front of any inlet consideration should be given for protecting the screen,
determining exposure duration limits before functional and total obstruction, and assessing
shedding characteristics and FOD potential. Ram air inlets are to be protected, or sized
appropriately for partial obstruction if not protected.
Drains and vents should not be placed inside nor forward of engine inlets and should not shed
damaging accumulated ice into air induction inlets or exhaust, rotating components, or
transparencies. These ports should not incorporate a design that will cause ice to accrete and
should resist subsequent obstruction.
543
JSSG-2009A
APPENDIX D
Electromagnetic components susceptible to degradation due to ice accretion should be

protected. Consideration should be given to the dielectric, reflective, and refractive properties
and the electro-static space charge accumulation and retention of the ice accretions and the
associated component functional degradation.
Neither the operation nor failure of transparency IPS should cause structural damage or
degradation of clarity in any icing environments or any other environment or phase of operation.
A transparency overheat control device should be required. Alcohol or other corrosive materials
should not be used on acrylic panels.
Consideration should be given to the fuel tankage design within flight surfaces (wing, sponson,
and fuselage) for external surface sub-freezing cooling (due to internal vaporization of fuel)
causing clear ice to form. Fuel additive behavior for preventing system obstruction due to
freezing of dissolved water or other fuel components should be considered.
Provision for an anti-icing and deicing IPS for rotor blades or propellers should be provided.
The direct use of exhaust gases for anti-icing or deicing of rotor blades or propellers should not
be permitted, unless all materials in contact with the exhaust gases have adequate corrosion,
oxidation, and elevated temperature resistance properties and component leakage poses a
minimal threat to affected subsystems and personnel. Fluid-type systems should not eject FPD
fluids into air induction inlets or exhausts; vents or drains; antennas or radomes; or windshields,
canopies, or transparencies. When the rotor head is exposed to icing conditions the various
components (droop stop, articulation joints) should be insensitive to icing or be protected from
accreted ice restriction or malfunction. Spinners should be designed with considerations for
attachment point and bracket cold spots. The blade-fold system should be insensitive to icing or
shielded from direct exposure to icing conditions.
All exposed sensors should be assessed for ice accretion degradation.
Air data systems such as pitot-static and AOA sensors should be protected by an anti-ice
"evaporative" IPS.
The IPS subsystem components should withstand lightning strikes in accordance with
MIL-STD-464. The IPS electrical components should not be directly used to transmit lightning
currents and should be designed to prevent inadvertent transmission damage.
Electrostatic discharge systems should be designed to function during and after exposure to
icing conditions.
Landing gear systems and wheel well sub-systems should be designed to be resistant to
accumulation of freezing precipitation and ground accretion residual and should not be
functionally degraded or damaged.
Lighting systems should be positioned such that ice accretions will not cause total functional
degradation and should be resistant to ground de-icing fluids.
Function of externally-mounted armament should not be degraded by ice accretion. The

appropriate exposed subsystem components should be protected when a weapon must be
544
JSSG-2009A
APPENDIX D
guided by laser or video. Consideration should be given to ice accretion on armament or drone
surfaces where aerodynamic performance and impact accuracy are important.
Federal Aviation Administration Report DOT/FAA/CT-88/8 provides excellent guidance on the

design of IPS. SAE AIR1667 provides guidance on rotor blade electothermal IPS.
TBS 4: Enunciation or activation should be initiated by a detector subsystem that senses either
accreting ice or outside air temperature and liquid water content. All IPS subsystems should
have a manual deselect or reselect capability with sustained re-inunciation and respective
failure modes should be indicated in the cockpit.
TBS 5: The decision to provide manual or automatic icing environment detection (or both)
should be made upon evaluation of cost limits of the particular program, the expected
operational icing environments, and the workload and experience of the flight crew. IPS surface
ice control performance should be monitored and reported when failure or capability
exceedance can result in a flight critical or safety-of-flight risk. It is recommended that mission
critical component IPS provide a monitoring function as well. Built-in-test capabilities are critical
for acquiring high levels of reliability and maintainability for an IPS, as well as mission readiness
and system robustness. There are three basic types of ice detectors: probe (extends out into
the local flowfield and droplet dispersion field), surface (mounted on an exposed component
between impingement limits), and remote (detects ice on an exposed surface from another air
vehicle location). A desirable feature of an ice detector is that it can sense incipient ice
accretion in the four air vehicle local environments (fuselage, flight surface, air induction inlet,
and rotational component) and that it can sense ice on an area of a surface and not just a point
indication. The ice detectors should be provided in accordance with SAE AS5498. Controls for
operating the IPS should be readily accessible to the pilot and co-pilot. An ice-detected
indicator should exist as a separate enunciation readily viewable by the pilot and copilot. The
IPS subsystems that have potential for causing engine FOD, or rotating or fixed system impact
damage should be activated automatically and all other IPS subsystems may be activated
automatically or manually.
On the V-22, the IPS design was considered in the ‘conceptual’ stage prior to production,
allowing for minimum cost-to-benefit on a very complex system. The initial rotor IPS on the SH-
60B was a kit based on the UH-60A kit. The SH-60B evaluation tests behind a spray tanker
revealed that the UH-60A droop stop heaters, not included on the initial SH-60B configuration,
had to be added prior to further testing. The Navy limited the air vehicle icing envelope to an
icing envelope that was qualified by Army tests. Several years late, the SH-60B rotor IPS
became a production line installation. Kit methods for IPS design were found not to be a viable
option for the complex tilt-rotor V-22 air vehicle. Both the propulsion system, air induction
system, and airframe system should have complementary and matched IPS capabilities. This
was not the case on the F-18 air vehicle such that a considerable portion of F-18 engine FOD
events have occurred, and the large portion of unknown FOD sources are suspected to consist
of a comparable ratio of icing-related sources.
On various programs, certain components that were initially left unprotected or partially
protected required add-on protection or extension of coverage to be installed on the air vehicle.
545
JSSG-2009A
APPENDIX D
For example, on the P-3 air vehicle the UHF antenna was not protected (actually, not
connected) and was believed to result in excessive p-static noise on communications equipment
when used in light rime icing conditions. The V-22 air vehicle has many unprotected exposed
components that have the potential to shed ice during the landing or hover flight phase that can
be recirculated in the external flowfield and be ingested by the engines or threaten ground or
ship personnel.
Few mishaps or safety of flight threatening events have occurred related to the operation of an
IPS installed on an air vehicle while in icing conditions. Protection systems have failed in and
out of icing conditions causing some structural damage, but the majority of adverse experience
has been inadvertent entry into icing conditions causing degradation to unprotected flight or
mission critical components. This experience is understandable, since IMC flight is typically
avoided when possible, and even more so for potential icing conditions, as well as the fact that
the majority of military operations occur in warmer climates and seasons.
Flight critical surfaces, such as the V-22 wing, did not initially have adequate upper and lower
surface chordwise coverage, allowing residual ice to form aft of the protected leading edge.
This was realized using computer simulation for the lower surface early in the program, but it
was later realized that the upper surface coverage could not protect for Supercooled Large
Droplet (SLD) that runback and ice past the protected area on the upper surface (SLD icing was
outside FAA and DOD icing envelopes when the V-22 air vehicle was developed). Empennage
protection was designed for the P-3 vertical stabilizer, but later on it was disabled. On the V-22
air vehicle, empennage protection was planned, but then canceled with provisions. The lack of
empennage protection on fixed wing air vehicles is dangerous because its sensitivity to icing
depends upon the design margins (rudder or elevator effectiveness), the allowable c.g. limits of
the air vehicle, and the severity of the icing encounter. Tailplane icing is a threat to fixed wing
air vehicles since the more slender leading edges accrete ice at a much faster rate than the
blunter wing and fuselage leading edges.
A large majority of icing incidents have involved the propulsion system, mainly from FOD-
producing, ingested ice originating from internal engine inlet components, inlet lips, or external
components forward of the inlet. The F-14 inlet design has sectioned ramps, one of which
under certain flight conditions would adjust to create a forward facing step that would allow ice
to accrete, subsequently shed, and be captured inside the ramp area. Upon carrier landing this
ice would be dislodged and ejected forward, and upon going full throttle (standard procedure),
the ice would then be subsequently ingested by the engine. The ramp scheduling was adjusted
to prevent the undesired ramp position. The F-18 air vehicle had an inlet drain installed in the
port ducting that would seep water, which under flight conditions would freeze upon exiting the
drain, accreting large ice chunks that would eventually shed and cause engine FOD. This
behavior was extensively experienced by the Canadian Air Force, who operated the F-18 air
vehicle in predominately colder weather. The drain was rerouted so that it would exit external
and aft of the engine inlet.
An icing event during takeoff of an A-6 resulted in a canopy ice-over causing total visual
obstruction as well as air data instruments becoming obstructed (loss of airspeed indication).
This was an inadvertent encounter, where other air vehicles previously passing through that
airspace 15-20 minutes before had not noticed any icing conditions. Avoidance was stressed
in this case and no redesign was attempted. An F-14 icing event caused a canopy to be
546
JSSG-2009A
APPENDIX D
impacted by ice, and in combination with the rain, reduced forward visibility to a one inch strip
and also resulted in catastrophic dual engine FOD upon arrestment. This was also an
inadvertent encounter during a marshal flight pattern placed inside a thunderstorm cell pattern.
This air vehicle did not have the updated ramp schedule for the engine inlet.
The SH-60B air vehicle has an exposed rotor head, and it was realized that the droop stops
were being frozen in the retracted position by accreted ice allowing the rotor blades to droop to
a dangerous position on deck. A redesign was instituted that placed the existing UH-60A
resistive heater in the droop stop fastener. The SH-60B and V-22 rotor systems wiring harness
or clamps, that bring control and power signals from the rotor head to the blades, were failing
due to the extreme rotational force and vibration environment. Stronger connectors, clamp
materials or positioning, and specialized wiring were used to prevent these problems.
A UH-1 rotor IPS was developed during which it was found that runback icing on the blades was
occurring due to overheating of the electrothermal blankets. This behavior caused ice to form
aft of the protected leading edge, which resulted in considerable torque rise and also
asymmetrical shedding or vibration. Better tailoring of power densities along the blade
prevented this problem.
On the V-22 pitot-static airflow distortion can occur when ice builds up on unprotected antennae
placed in front of those components. Ice accretion on the base of the pitot-static probes was
found to grow outward and forward of the base thereby affecting the air flow around the probes.
Air data instruments should be placed on the airframe in a manner that will ensure unobstructed
airflow from freestream early in the program.
On the P-3 air vehicle, which has a manually activated IPS, there have been a few instances of
inlet snow or ice FOD or obstruction. The obstruction occurred when an engine was shut down
to conserve fuel, during which time the air vehicle was in air induction icing or snow or ice
crystal IMC flight, causing the engine inlet to become packed with snow and ice, preventing an
engine restart when needed. Other cases of engine FOD occurred when icing conditions were
perceived some time after entrance, resulting in a delayed manual activation of the inlet and
engine IPS. This resulted in FOD-capable ice accreting in the inlet that subsequently was shed
when the IPS was activated. Even though a probe-type ice detector is installed on the P-3
fuselage and Naval Air Training Operating Procedures Standardization guidance is provided,
the flight crew cannot perceive all possible accreting environments.
D.4.4.4.11 Ice protection.

The Ice Protection System (IPS) shall be verified by (TBS) .

The phenomena of ice accretion is very complex and current modeling capabilities still
necessitate extensive ground and flight testing periods to validate IPS design capabilities at the
component and subsystem level. Artificial icing testing on the ground and in-flight are also of
significant value, primarily due to the ability of these facilities to produce a controlled, repeatable
547
JSSG-2009A
APPENDIX D
icing cloud over a greater range of conditions than may be found during a natural ice flight test
program. Natural icing surveys provide the final validation of the design on the air vehicle
system level.

TBS: The verification of the IPS should be determined by artificial, simulated, or natural testing,
by accepted ice accretion computer codes or by a combination of the above. Qualification by
similarity should only be exercised on non-flight critical components and should consider
surface ice control performance. The capabilities of the air vehicle should be demonstrated on
the component level, subsystem level, and on the air vehicle level. Mission completion potential
should be demonstrated. The following methods should be considered:
a. empirical correlation of experimental data or historical design data
b. computer simulations using flow field, trajectory, heat transfer, accretion and
performance codes
c. ground-based icing facility testing on the component and subsystem levels
d. ground-based component and subsystem functional, reliability, and fit evaluations
e. ground-based, full-system mockup functional testing
f. ground-based climatic lab testing
g. simulated ice testing (icing tunnel)
h. in-flight artificial spray tanker testing
i. natural icing survey flight testing
j. cold weather ground and flight operations evaluations
The engine should be evaluated ultimately in an installed airframe in a natural or artificial (or
both) in-flight or ground environment.
Federal Aviation Administration Report DOT/FAA/CT-88/8 provides excellent guidance to

establish a test and certification program for an IPS and unprotected surfaces.
Component level demonstration has included computational analysis with approved software
and icing test facilities (ground-based or flight-based) as a combined effort on the V-22 air
vehicle. Air vehicle level demonstration involved flight-based testing (either artificial spray
tanker or natural icing conditions) efforts. Mission completion demonstration was accomplished
by using the resulting above data and computer simulation with validated software.
On one aircraft program that went through extensive analysis and ground-based testing, ice
buildup on a small surface not considered in the analysis and testing resulted in shedding
causing significant damage to the aircraft. There is no substitution for full aircraft testing in
icing. Natural icing testing should be performed on larger aircraft where the tanker cannot
totally cover the aircraft.
548
JSSG-2009A
APPENDIX D
D.3.4.4.12 Bleed air
D.4.4.4.12 Bleed air
D.3.4.4.12.1 Overbleed protection.

Protection against overbleeding of the bleed sources shall be incorporated.

One intent of this requirement is to ensure that any failure of the ECS will not result in
overbleeding of the bleed source(s). Overbleeding can be detrimental to the bleed air source
and result in a hazardous condition.

A flow limiting device is required to protect the bleed source from overbleeding in the event of a
duct failure or control component failure in the bleed air system. Frequently, the bleed air
source may contain its own flow limiting device, in which case such a device (such as a flow
orifice) can be deleted in the bleed air system. The flow limiting device should satisfy maximum
system demand, which should not exceed the maximum allowable flow from the source(s). On
multiple engine air vehicles, the engines may require flow sharing limitations.
On multiple engine air vehicles, certain engines require that a balanced flow be maintained
between the engines. If excess flow is taken from one engine it may have a detrimental effect
on its reliability. The air vehicle engineer in coordination with the propulsion engineer should
provide the maximum imbalance in the flow allowed for the engines.
The UH-60 winterized heater subsystem uses engine bleed air. Since the engine anti-ice also
uses engine bleed air, the heater includes an interlock that reduces engine bleed air to the
heater when the engine anti-ice switch is on. This prevents overbleeding of the engines when
both the heater and engine anti-ice are in use.
D.4.4.4.12.1 Overbleed protection.

Analyses, inspection of drawings, and laboratory, ground, and flight tests shall verify the
protection against overbleeding the bleed sources.

Analyses provide preliminary verification of maximum flow control requirements. Laboratory
testing of the flow control component(s) is required to verify their safety. Final verification can
only be done when combined with actual engines in ground and flight test.
549
JSSG-2009A
APPENDIX D

Usually, flow control performance is strictly a function of a flow control component, unless
certain system or engine interfaces have been overlooked. Laboratory testing should verify that
the design meets its requirements and is safe. Final verification in ground and flight test should
require minimal instrumentation and can be accomplished in conjunction with other tests.
(TBD)
D.3.4.4.12.2 Bleed air source shut off.

An independent means shall be provided for shutting off the bleed air flow from each bleed air
source. These shutoff provisions shall be controllable from the air vehicle crew station. The
shut-off provision shall be located (TBS) . A second means of shutting off the bleed air flow
from each bleed source shall be provided for rotary-wing air vehicles.

Provisions for shutting off bleed air are required to enable the flight crew to stop flow from the
bleed source(s) in case of bleed air contamination. Also, bleed air duct rupture or excessive
leakage downstream of the source can be isolated through bleed shutoff provisions used in
conjunction with isolation valves. The shutoff provisions are often required for maintenance or
other operational requirements. Dual means for shutting off hot air sources are necessary to
prevent a single failure from resulting in the inability to shut off hot air to occupied
compartments.

The intent of this requirement is to provide shutoff provisions for the onboard high pressure
bleed air sources, such as the engines, APU and auxiliary compressors. The ability to control
these valves from the crew station is important since they can be used to isolate a contaminated
bleed source or a leaking duct section from the rest of the bleed air system. Bleed shutoff
valves are also used to eliminate engine bleed during engine maintenance trim runs. Most
modern air vehicles have a leak detection system that automatically shuts off the source from
the leaking system.
TBS: The shutoff valves should be located as near as practicable to the bleed air source in
order to isolate as much of the bleed ducting as possible in the event of a leak or rupture. The
ECS engineer should coordinate with the cognizant engineers for each of the pressurized air
sources to determine the closest practical location for the shutoff valves. Careful selection of
mounting methods is desired in high vibration areas such as the engine compartment. Shutoff
valves for ground pneumatic power sources are not required on the air vehicle. Bleed air
shutoff provisions should comply with fire safety requirements.
550
JSSG-2009A
APPENDIX D
Shutting down the normal mode of ECS cooling should be allowed to count as a second means
of shutting off bleed air into the cockpit. (See SAE ARP1796 for more guidance.)
Serious damage from high temperature bleed air leakage or duct rupture has occurred in a
number of cases due to the lack of bleed air shutoff provisions at the source. Experience shows
it is best to locate these provisions as close to the bleed port of the engine as possible
D.4.4.4.12.2 Bleed air source shut off.

Inspection of drawings and air vehicle demonstrations shall be used to verify that independent
means are incorporated for shutting off the bleed air flow from each bleed air source that these
provisions are controllable from the air vehicle crew station. Inspection of drawings shall verify
that shutoff provisions are within the required distance from the bleed source.

Bleed air source shutoff provisions require verification through air vehicle demonstration to
ensure proper installation and functional interface. Drawings and schematics must be examined
to verify that shutoff control features are independent and within the required distance of the
source.

Verification of proper utilization of shutoff features requires a systems operational analysis. A
functional demonstration of these features is easily performed on the air vehicle and is usually
included in air vehicle acceptance procedures and during flight-testing. A drawing review is all
that is required to verify that the shutoff provisions are within the required distance of the
source.
(TBD)
D.3.4.4.12.3 Bleed air distribution control.

An independent means shall be provided for shutting off the bleed air flow to each subsystem
using bleed air source. These shutoff provisions shall be controllable from the air vehicle crew
station. The shutoff provisions shall be located (TBS) .

Subsystem shutoff provisions are required to enable the flight crew to eliminate airflow to a
failed subsystem without deactivating other subsystems. Distribution shutoff valves can also be
used for leakage isolation.
551
JSSG-2009A
APPENDIX D

Distribution shutoff valves, in addition to controlling the function of a subsystem, also provide a
means of isolating a failed subsystem or air leakage source without deactivating other
subsystems. Most new air vehicles have a leak detection system that automatically shuts off
the source from the leaking system.
TBS: Location of the shutoff provisions at the inlet to the using subsystems improves reliability,
safety and reduces cost and weight.
Experience has shown it is best to locate the shutoff valve at the subsystem inlet rather than the
outlet, as has been done in the past on some hot air rain removal and nacelle vent systems.
The inlet location allows the ducting to be unpressurized when the subsystem is not being used,
and if a leak develops during system operation, the leak can be stopped by closing the shutoff
valve.
D.4.4.4.12.3 Bleed air distribution control.

Inspection of drawings and air vehicle demonstrations shall be used to verify that independent
means are incorporated for shutting off the bleed air flow to each subsystem which uses bleed
air and that these provisions are controllable from the air vehicle crew station. Inspection of
drawings shall verify shutoff provisions are at required locations.

Distribution shutoff provisions require verification through air vehicle demonstration to ensure
proper installation and functional interface. Drawings and schematics must be examined to
determine that shutoff provisions are independent and at proper location.

Verification of distribution shutoff features can usually be accomplished through a single air
vehicle demonstration. This demonstration is usually included as part of the air vehicle
acceptance test procedures.
Individual switches are provided in the AH-1 cockpit for shutting off bleed air to the rain removal
system and the environmental control unit.
D.3.4.4.12.4 Isolation and crossover control.

On air vehicles with multiple bleed sources, or where multiple subsystems are supplied,
isolation and crossover shutoff valves shall be provided.
552
JSSG-2009A
APPENDIX D

Incorporating isolation and crossover shutoff valves permits alternate bleed source utilization for
multiple subsystem, multiple engine air vehicles, often eliminating the need for mission abort in
the event of a bleed supply duct failure.

Figure D-13 illustrates the typical use of isolation and crossover valves in a multi-engine, multi-
subsystem air vehicle. Isolation and crossover systems are normally limited to multi-engine air
vehicles with large bleed air systems. During normal operation, the crossover valve will be
closed with left-hand engines supplying air to the left-hand system and right-hand engines
supplying air to the right-hand system. If a duct failure occurs in the left-hand system, the leak
detection system or a bleed air hot light should alert the crew to close the left engine bleed
source shutoff valves, close the left-side isolation valve, and open the crossover valve so the
right-hand engines will be able to supply air to the left-hand system in addition to the right-hand
system. Also, if an engine is shut down for emergency or economy reasons, the same
procedure allows bleed air to be supplied to the opposite side. In either of the above situations,
the cross bleeding allows continuation of the mission and eliminates a potential hazard. The
crossover valve can also be opened to allow cross starting of engines.
Experience has shown it is advantageous to locate isolation and crossover valves so they are
readily accessible in flight and have provisions for manual and automatic operation.
D.4.4.4.12.4 Isolation and crossover control.

The bleed air system design shall be analyzed and functionally demonstrated to verify proper
use of isolation and crossover shutoff provisions.

Analyses of the bleed air system design and air vehicle functional demonstration are required to
verify proper use of isolation and crossover shutoff provisions.

Inclusion of bleed source isolation should be verified by inspection of drawings and an analysis
of the bleed air system design. Functionality of the bleed source isolation should be
demonstrated with air vehicle testing, and it should include all applicable combinations of
normally operating valve positions and with valve failures.
(TBD)
553
JSSG-2009A
APPENDIX D
FIGURE D-13. Typical isolation and crossover valve installation.
554
JSSG-2009A
APPENDIX D
D.3.4.4.12.5 Reverse flow prevention.

There shall be provisions to automatically prevent reverse flow of bleed air from any source into
any other source. This protection shall include conditions where one failure is present.

Provisions are required to prevent reverse flow into a bleed source to eliminate the potential for
engine performance degradation or damage and to ensure proper air flow control in the event of
a failure of a single bleed source.

Reverse flow into failed bleed sources is to be prevented. Failure to stop flow could prevent
cross engine bleed start and may prevent operation of critical systems such as OBOGS.
Pressurizing the outlet port of some bleed sources prior to their achieving full operational speed
may be detrimental to operation and cause failure. In some cases, typically check valves are
used to prevent reverse flow. Check valve failures can go undetected for several flights if they
do not cause problems with other components, but could result in a hazardous condition if a
failure occurs that they are designed to protect against. As a result, means should be
incorporated to allow for periodic inspection of bleed air system check valves. Borescope
provisions have been used for this purpose. Dual check valves have been used to provide the
insurance that a single check valve failure will not cause engine malfunction in applications
where both low and high stage bleed are used. High quality check valves that minimize loss of
flappers also have been used. (See SAE ARP1796 for additional guidance.)
Many problems have resulted on air vehicles due to failure of check valves in the engine bleed
air system. Careful attention to their design is required, especially the flapper design. There
have been instances where the flappers have become disengaged and then lodged in
downstream components causing them to malfunction. Serious incidents have occurred from
shutoff valves being held in the open position by failed check valve parts. Such an incident
resulted in an engine starter going into an uncontained turbine wheel failure with a part of the
wheel striking and killing a B-58 crewmember during takeoff.
Reverse flow protection in the AH-64A pressurized air system is provided by a check valve and
an engine compressor bleed air selector valve to prevent shaft driven compressor air from
feeding into the No. 1 engine bleed air output.
D.4.4.4.12.5 Reverse flow prevention.

Inspection of drawings, engineering analysis, laboratory tests and air vehicle demonstrations
shall be used to verify that there is no reverse flow of bleed air into a source under any
operating conditions. These shall include conditions where one failure is present.
555
JSSG-2009A
APPENDIX D

Verification that reverse flow provisions are utilized can be obtained by inspection of the system
configuration.

Reverse flow control features usually result in check valves being employed on the system at
appropriate locations. Inspection of the locations in which these provisions are incorporated
usually provides sufficient assurance of reverse flow protection for the system. Rigorous
qualification testing of bleed air check valves under realistic conditions, such as air flowing at
pressure and temperatures to be experienced in operation, should be performed. A safety
analysis of the bleed air system should be conducted assuming a bleed air check valve fails.
This analysis should indicate whether or not additional design effort is needed for the bleed air
system. This feature may be safety critical, and the assessment is necessary because of the
difficulty of knowing when a bleed air check valve failure has occurred.
(TBD)
D.3.4.4.12.6 Bleed air pressure regulation.

The pressure of engine bleed air shall be regulated to that pressure level determined to be the
minimum necessary for all recipient subsystems to meet operational performance requirements.
Proper pressure regulation shall be maintained with one failure present.

The requirement for pressure regulation to the lowest acceptable level ensures that any damage
experienced by the air vehicle as a result of a bleed system failure will be minimized. This
requirement also allows for lower system cost and higher reliability by providing a less severe
component design and operating environment. In addition, pressure regulation aids in
eliminating problems due to pressure surge.

The intent of this requirement is to ensure bleed air used within the air vehicle is controlled to
the lowest possible pressure.
An immediate advantage to pressure regulation is that it lessens the hazard potential and the
potential for secondary damage in the event of a bleed system failure. Lower air pressure also
allows for the utilization of lower cost components, less rigorous testing, and simplified system
design. Pressure regulation is often accomplished in stages. The first stage of pressure
regulation is the regulation of the bleed air system pressure. Further reduction in pressure can
sometimes be accomplished for other subsystems. This is especially useful if the using
subsystems are remotely located from the bleed air system. This provides a design where two
556
JSSG-2009A
APPENDIX D
failures are required in order for full bleed pressure from the pressure source to travel
downstream to the using subsystems. Since single failures are normally assumed for designing
bleed system ducting and components, this results in further savings in cost and weight of the
downstream components as well as providing a safer system.
The regulator schedule for the bleed air system should be set to accommodate the highest
pressure and flow rate demands for the air vehicle plus distribution duct losses. To illustrate,
the highest pressures required for subsystem operation may be for an ejector designed to utilize
65 psig. The ducting to the ejector may create a 5-psi pressure drop at the design flow rate.
Therefore, the first stage regulator should be scheduled for 70 psig. Pressure regulation should
occur as near the bleed source as possible.
A severe cockpit pressure surge problem existed on early F-5F air vehicles due to the lack of
bleed air pressure regulation.
The AH-64A shaft driven compressor provides its own pressure regulation, and if the pressure
output falls below 10 psi, a valve on the No. 1 engine bleed air output opens to allow continued
operation of the pressurized air system on engine bleed air.
D.4.4.4.12.6 Bleed air pressure regulation.

The proper pressure regulation of bleed air shall be verified by engineering analysis, laboratory
tests and air vehicle demonstrations. These shall include conditions where one failure is
present.

The critical nature of the bleed air pressure requirement necessitates interim verification by
analysis during the initial system design phase and final verification by laboratory and air vehicle
tests.

Proper system pressure control requires verification of system components in laboratory tests
as well as system tests performed on the air vehicle. The air vehicle testing is required to
ensure compatibility between control components and the rest of the system.
For pressure measurement, all pressure taps should be located to minimize the effect of
turbulence caused by valves, elbows, or orifices in the system, and to determine all pressure
required for a complete evaluation of system operation.
Probable single failures should be simulated in laboratory tests.
557
JSSG-2009A
APPENDIX D
(TBD)
D.3.4.4.12.7 Bleed air temperature control.

The ability of the ECS to maintain the temperature of bleed air ducted out of an engine, APU, or
auxiliary compressor at or below the maximum allowable shall be (TBS) . A crew station
indicator shall be activated in the event that bleed air temperature leaving an engine
compartment exceeds the normal maximum value.

The requirement for maximum temperature control ensures that any damage experienced by
the air vehicle as a result of a bleed system failure will be minimized. This requirement also
allows for lower system cost and higher reliability by providing a less severe component design
environment. The crew should be alerted to failure of the bleed air temperature control
provisions since a safety hazard could exist.

TBS should be filled in with a maximum temperature value. There are several important
advantages to limiting the maximum temperature of the bleed air ducted out of the engine, APU,
or auxiliary compartment. Lower air temperatures will result in less air vehicle damage from
bleed air system failures. Safe bleed air system surface temperatures can be more easily
obtained with lower internal air temperatures. Also, less costly materials can often be utilized in
the system. The maximum temperature of bleed air ducted from the engine, APU, or auxiliary
compartment should be limited to the autogenous ignition temperature of combustible fluids
that, through a fluid system failure, could contact the bleed air system. By this criterion, fuels,
oils, and hydraulic fluids usually limit bleed air temperatures to 450°F outside the engine, APU,
or auxiliary compartment. Space and weight limitations on fighter and attack air vehicles may
make this a difficult requirement to meet. Also, improved leak detection systems have reduced
the consequences of failure. A trade-off should be performed to review cost, weight, and safety
issues. Modern air vehicles typically have the over-temperature indication automatically shut off
the bleed air supply, with a crew reset available. This reduces crew workload and reduces the
potential damage from the overheat condition.
Requirements of this paragraph should be coordinated with those in “Hot surface temperature.”
Also see MIL-HDBK-221 for further guidance.
(TBD)
558
JSSG-2009A
APPENDIX D
D.4.4.4.12.7 Bleed air temperature control.

The ability of the ECS to maintain the temperature of bleed air ducted out of an engine, APU, or
auxiliary compressor at or below the maximum allowable shall be verified by (TBS) .

Bleed air temperature control is a critical design feature and final verification that the system
meets this requirement must be through air vehicle test. Over temperature indication must be
demonstrated in a laboratory to preclude possible air vehicle damage.

TBS: Analyses and air vehicle ground and flight tests should be conducted to verify that the
maximum temperature of bleed air ducted out of the engine, APU or auxiliary compartment does
not exceed the maximum allowable value under normal conditions.
The ability of the ECS to indicate to the crew that an over temperature condition exists should
be verified by inspection of drawings, engineering analyses, laboratory tests and air vehicle
demonstrations.
Bleed air temperature should be monitored during air vehicle flight and ground testing.
Normally, extrapolation of this data will be required to predict worst-case extremes.
(TBD)
D.3.4.4.12.8 Bleed air leak detection.

When bleed air ducting is routed in areas where leakage could cause damage to the structure
or nearby components, or could cause surface limits to exceed the autogenous ignition
temperature of any substance contained in that compartment, a means for leak detection shall
be incorporated. Automatic shutdown with a crew station advisory or a crew station warning
shall be provided when a potentially damaging or fire-producing leak occurs. The sensors for
the leak detection system shall recover their required leak detection temperature range following
exposure to a leak.

The requirement for a leak detection system is necessary to protect against air vehicle damage
or fire due to high temperature bleed air.

The sections of the bleed air system that can contain air at temperatures that could damage
surrounding components in the event of excessive leakage, or could cause surface limits to
exceed the autogenous ignition temperature of any substance contained in that compartment
559
JSSG-2009A
APPENDIX D
should be defined. The air vehicle engineer should be consulted to obtain information on what
structure, wiring or combustible substances are present in compartments where high
temperature air will be ducted. Emphasis should be placed on assuring adequate detection in
the engine nacelle, pylon, wing, wheel well, and ECS equipment compartment when high
temperature ducting is present in these areas. The insulation on electrical wire is often the least
temperature-tolerant material commonly used in air vehicle equipment bays. Usually, 350°F is
accepted as an upper temperature limit in these areas and ducts which carry air at or above this
temperature should have a leak detection system. A system safety hazard analysis should be
conducted to determine the appropriate course of action upon detection of a bleed air leak.
Compartments containing fuel, hydraulics or liquid coolant should also be reviewed. In many
cases positioning of the leak detecting elements are critical. Unless the ducting will be required
to divert leaks away from critical surfaces, the leak detector should be placed such that it
detects a leak aimed in the direction of the critical surfaces. Careful selection of the type of leak
detection system is important: some measure an average compartment temperature; others
measure discreet temperature; and some do both. The accuracy and reliability vary with the
type of technology. The discreet provides the best measure of the hazard if the element is
between the bleed duct and the critical surface. If it is not in the right location, it may not detect
at all; therefore, the selection of the detection technology should be considered carefully and in
conjunction with the bleed air duct design.
Continuous length-sensing elements placed along the entire length of the high temperature
ducting have proved to be a satisfactory approach for detecting hazardous leaks. Satisfactory
bleed air leak detectors should meet the following requirements:
a. The detectors indicate a bleed air leak within 5 seconds when a 1-inch length of the
detector element is subjected to a hot air blast 100°F above the nominal detector setting
(with the entire element stabilized 100°F below its nominal setting).
b. The detectors have the nominal detector setting 100°F above the maximum local
ambient.
c. The detectors maintain a warning signal for the duration of the overheat condition and
automatically clear the signal following the removal of the overheat condition.
To save precious time, most modern air vehicles require that the bleed system be automatically
shutdown when a potentially damaging or fire producing leak is detected.
For an effective design, the leak detection system should consider the entire bleed air system,
not just the sensors used for detection. Bleed air duct, including insulation covers are an
integral part of leak detection. The ducting and covers can be used to divert most leaks away
from critical areas and toward the leak detector sensors.
The lack of a bleed air leak detection system has been a contributing factor to the loss of a
significant number of air vehicles and has resulted in serious damage to numerous air vehicles.
Both the F-4 and F-105 fighter air vehicles have long runs of high temperature ducting from the
last stage engine compressor section in the aft portion of the air vehicle to the ECS equipment
bay in the forward part of the air vehicle. Numerous leaks, of which the crew was unaware,
occurred in this ducting on F-4 and F-105 air vehicles and were of sufficient magnitude to cause
560
JSSG-2009A
APPENDIX D
either serious damage or loss of air vehicles. The F-105 air vehicles were eventually retrofitted
with a bleed air leak detection system.
D.4.4.4.12.8 Bleed air leak detection.

Bleed air leak detection shall be by (TBS) .

The potential for air vehicle damage precludes the use of air vehicle testing to verify leak
detection system operation. Therefore, system operation must be verified under laboratory
conditions.

TBS: Analyses should be conducted to verify the areas of the air vehicle that require or do not
require leak detection. Laboratory tests should be conducted to verify the ability of the leak
sensors in conjunction with the bleed air system to detect potentially damaging bleed air leaks.
Detectors should be tested to verify that they recover their required detection range following a
detection. Inspections of drawings and air vehicles should verify installation of leak detection
system and indicator for leaks in the crew station.
Since limited testing can be conducted of leak detection system effectiveness, inspection of
system installation drawings requires careful attention to verify that typical leakage paths would
be detected by the system. The leak detector sensors should be laboratory tested to verify they
operate within the proper operating range and that they recover that range after exposure to a
leak. Following these tests the leak detection system should be laboratory tested in conjunction
with the bleed air system to verify minimum required leaks from the bleed system are detected.
This joint testing is required since the bleed air system design can greatly influence the leak
path and thus its potential for detection.
(TBD)
561
JSSG-2009A
APPENDIX D
D.3.4.4.12.9 Bleed air pressure relief.

Air vehicle compartments containing bleed air ducting shall be protected against detrimental
compartment over pressurization in the event of duct failure. Ducting and other components
shall be protected from detrimental positive and negative pressure following single failures.

Pressure relief provisions are required to protect the air vehicle and subsystem components
from damage in the event of a bleed air system failure.

If a bleed duct located in a sealed compartment ruptures, the compartment could become
pressurized to the same pressure as the duct air pressure. The pressures used in the bleed air
system are often greater than the air vehicle compartment structure can withstand. Therefore,
to prevent air vehicle damage in the event of a duct failure, provisions for compartment
overpressure relief should be incorporated. Overpressure relief provisions may be required for
ventilated compartments when it can be shown the compartments' ventilation flow areas (inlet
and exhaust areas) could provide adequate pressure relief. Overpressure relief provisions
typically utilize a “pop-out"-type panel in the compartment, which may be spring loaded and
hinged. Implementation of overpressure relief features and specification of pressure relief
settings may require familiarity with air vehicle structural requirements.
Secondary failure of bleed air system ducting or components due to excessive positive or
negative pressure should not be caused by a single failure. This should also apply to the using
systems being supplied by the bleed air system. Component overpressure (internal or external)
protection is a function of the components' design and structural integrity. This requirement
should be reviewed for the complete flight envelope of the air vehicle. High altitude may result
in lower than expected ambient (ram) pressure. Pressure recovery at high Mach numbers may
result in higher than expected ambient (ram) pressures. This requirement may be met by
installing protection devices or by designing and qualifying the components to possible single
failure condition.
The F-111 air vehicles were plagued with numerous cases of extensive damage within the
engine compartment due to rupture of the nacelle vent duct. Failures of this duct were generally
undetected but occasionally indicated by a fire warning light. Continuous length-sensing
elements placed along the entire length of the high temperature ducting have proved to be a
satisfactory approach for detecting hazardous leaks.
A duct rupture on the C-141 caused pylon damage due to the lack of pressure relief provisions.
562
JSSG-2009A
APPENDIX D
D.4.4.4.12.9 Bleed air pressure relief.

Bleed air pressure relief shall be verified by (TBS) .

Verification of compartment and component pressure protection is left to analysis and laboratory
testing, since air vehicle demonstrations are not feasible.

TBS: Failure modes and effects analyses should verify which compartments need or do not
need protection from over pressure and which bleed air ducting and components require
protection from excessive positive and negative pressure. Analyses should be conducted to
verify the size of pressure relief areas and pressure relief settings. Installation of pressure relief
devices should be verified by drawing and air vehicle inspection. The performance of pressure
relief devices should be verified in laboratory tests.
Structural design factors should be considered during verification of these requirements.

Analysis should consider entire flight envelop to ensure there are no higher or lower pressures.
(TBD)
D.3.4.4.12.10 Uncontrolled bleed air.

Uncontrolled bleed air shall be prevented from entering the cabin after any failure of the system.

The position of bleed air system valves after failure or loss of the actuation signal is critical to
system safety. The valve normal (no actuation signal) position and the failure position must be
determined from an analysis of the most acceptable and least hazardous failure modes. If
control ranges of bleed air valves in series over lap, the resulting control instability will result in
performance degradation, poor valve life and possibly harmful or annoying pressure transients
in occupied compartments.

Uncontrolled hot air should be prevented from entering the cabin after any failure. For most air
vehicles, maintaining cabin pressurization airflow and engine starting airflow capability following
any bleed air valve failure is highly desirable. In the case where the bleed air is supplying an
OBOGS, maintaining pressurized flow may be mission essential. Redundant bleed air shut-off
valves are often used to be able to maintain bleed flow with a failure and without an over
temperature hazard. If bleed air valves are used in series, their control operating range should
not overlap. This will cause control instability affecting performance, valve life and possibly
harmful or annoying pressure transients in occupied compartments.
563
JSSG-2009A
APPENDIX D
Normal and failure mode positions of valves refer to the position (open or closed) to which a
valve returns when no actuation signal is supplied to it (normal position), and the position to
which a valve returns when experiencing loss of power (failure position). This terminology
applies to valves operated electrically and pneumatically. For pneumatically-actuated valves,
the actuation signal is the sense pressure or control pressure and the valve power is the
upstream air pressure. The modes for electrically-actuated valves and electrical-pneumatic
combination valves refer to valve positions with upstream pressure applied to the valve. These
modes are critical because they determine air distribution in the event valve control is lost.
(TBD)
D.4.4.4.12.10 Uncontrolled bleed air.

Uncontrolled bleed air shall be verified by (TBS) .

Valve normal and failed positions and series valve stability can be adequately determined from
laboratory testing.

TBS: Laboratory tests readily reveal valve normal positions and typical failure mode positions.
In this area, emphasis should be placed on verification of proper valve modes for respective
valve applications.
(TBD)
564
JSSG-2009A
APPENDIX D
D.3.4.4.13 Thermal system protection.

Ducting and components shall be insulated or shrouded as required to prevent overheating of
surrounding structure, wiring, plumbing or other equipment; eliminate personnel hazard; or
eliminate potential fire hazard. Entry and retention of fluids including water under or within
insulation or shroud shall be prevented. All insulation and shrouds shall be flame resistant.
Insulation shall not be damaged by normal handling by and contact with maintenance
personnel. The contractor shall perform a trade-off study to determine what additional ducting,
component and compartment thermal insulation is required to meet thermal requirements of this
specification. The trade-off study shall include (TBS) comparison of the overall Thermal
Management System with and without the additional insulation. Acoustical insulation shall be
provided as required to meet the air vehicle acoustical requirements.

Hot surfaces must be insulated or otherwise protected to prevent damage, fire hazard,
personnel hazard, and such. Flammable fluid soaked insulation is a serious fire hazard.
Insulation soaked with any fluid degrades insulation performance, causes corrosion and other
maintenance problems. The weight penalty of adding insulation to meet thermal performance
requirements must be compared to a true penalty of meeting those requirements without the
insulation.

Care should be taken in the selection and application of insulation materials to ensure they are
impermeable to fluids. The outer surface should be durable enough to resist damage due to
handling and normal maintenance actions. Air blast is also a major consideration when the duct
or component is located in a weapons bay, wheel well, or such. Insulation exposed in cargo
compartments and other exposed areas should be designed to withstand the environment and
handling it will experience.
Insulation made of neoprene should not be used in areas where the temperature will exceed
250°F because of the likelihood of corrosion problems.
Sandwich-type insulation blankets, where used, should be vented, and drained at their lowest
point. The vent and drain holes should be shielded if required to prevent entrance of fluid. The
insulation material should be “nonpacking” under service conditions. Insulation should be
attached to ducts and components so that a single failure cannot cause ignition.
SAE AMS-I-7171 is recommended for use as a detail specification for a thermal-acoustical

insulation blanket.
TBS: Adding insulation to meet thermal performance requirements is often rejected based on
its fixed weight penalty. The fact that the refrigeration system will have to become larger and
extracted more power is overlooked. The system with and without insulation should be
compared based on the overall impact on the air vehicle. Take-off-gross-weight is often the
best comparison for new air vehicles required to meet a fixed mission.
565
JSSG-2009A
APPENDIX D
Impact on range or performance may be more appropriate for existing air vehicles or air
vehicles with other limitations. Life-cycle cost might be another important factor. The air vehicle
engineer should be consulted to determine the best measure.
Damage due to air blast when the weapons bay doors were opened resulted in engineering
changes to strengthen the insulation in the weapons bay and ECS bay in the F-111 and F-105
air vehicles. Fuel-soaked insulation was a problem on F-111 air vehicle. This occurred when
the surface was punctured during maintenance actions. On B-52A through B-52E air vehicles,
the pneumatic ducts were covered with a neoprene insulation. It was discovered that neoprene
heated above 250°F deteriorates and in the presence of moisture forms an acid that is highly
corrosive. This necessitated an extensive duct rehabilitation program for B-52 air vehicle.
KC-130 bleed air ducts failed due to corrosion. The ducts are made of stainless steel. Water
held against the duct by cotton insulation, which had become wet and stayed saturated, caused
the corrosion. The duct failure resulted in hot bleed air impinging on the wing spar, wiring that
controls the bleed air valves, and fuel tanks whose sealant degrades at a temperature that are
very close to that of the bleed lines. In at least one case, an Air Force air vehicle was lost due
to bleed duct failure. This failure, and others that caused substantial damage, has occurred on
the ground. Failures in-flight have been identified by pilots and procedures taken (bleed air shut
off) to avert substantial damage. Twice, wing leading edge panels were blown off at take-off
due to bleed duct failure.
The bleed air system is comprised of 40 duct sections. The inspection process is very costly,
approximately 850 man-hours for entire system. The insulation is fiberglass over cotton, which
tends to trap water. The Navy depot must have the duct insulation re-installed by a vendor after
it has been unwrapped for inspection, adding to the cost and time it takes to inspect ducts. After
going to the expense and time to conduct the inspection, it makes most sense to replace
corroded ducts with new Inconel duct sections at that time.
D.4.4.4.13 Thermal system protection.

Analyses, inspections, and tests shall be used to verify ducting and components are insulated or
shrouded to eliminate potential fire or personnel hazard and prevent overheating of the wiring,
structure, or other components. Water absorption characteristics shall be verified by laboratory
test. Maintenance handling provisions shall be verified by demonstration. A tradeoff study shall
verify that the correct amount of additional insulation has been added to meet thermal
performance requirements. Analysis and air vehicle test shall verify the correct amount of
acoustical insulation has been added.

Verification of this requirement can be accomplished by analysis, inspection, and tests, as
appropriate.
566
JSSG-2009A
APPENDIX D

The required air vehicle testing should normally be accomplished in the course of doing other
ECS test.
(TBD)
D.3.4.4.14 Structural integrity
D.4.4.4.14 Structural integrity
D.3.4.4.14.1 Proof pressure.

All system components exposed to positive or negative pressure shall withstand, without
permanent deformation at associated component temperature and pressure, each of the
following proof pressures:
a. (TBS 1) times the gauge pressure at associated temperature that occurs during
normal operation, without malfunction, that would have the most adverse effect upon the
component's structural integrity.
b. (TBS 2) times the gauge pressure at associated temperature that occurs in the event
of failure of an upstream pressure or temperature control device that would have the
most adverse effect upon the component's structural integrity.
Additionally, the ducts that are susceptible to excessive handling and maintenance loads shall
be identified and either (1) designed to withstand these loads, or (2) be clearly and appropriately
marked to warn maintenance workers not to use excessive force on these items. No permanent
deformation is permitted when designing to identified installation or maintenance loads.

The intent of this requirement is to ensure all pressurized components are adequately designed
for structural integrity under both normal operating conditions and upstream pressure or
temperature control device failures.

Proof pressure is that pressure which a duct or component must sustain without permanent
deformation.
TBS 1 should be filled in with a number to serve as a multiplier for the gauge pressure. A value
typically used is “1.5.”
typically used is “1.1.”
567
JSSG-2009A
APPENDIX D
These values are accepted industry standards and are based on previous USAF experience
that has shown that components designed and tested to these criteria have proved to be
durable and reliable. The Navy historically used “2” for bleed air systems. Although somewhat
on the conservative side, it had the advantage of providing a growth capability when higher
pressures resulted from increasing ECS capacity or engine upgrades. For new air vehicles
using a “2” value should be considered. Requalifying and retrofitting bleed ducting can be
expensive. Other less stringent requirements should be specified only after very careful
consideration of the application.
Consideration in design and installation should also be given to maintenance related issues.
Furthermore, if column action, torsional, or bending loads exist in the ducting, the duct’s
strength should be adequate to adsorb these and the internal pressure loads simultaneously.
The most critical operating condition is that combination of operating pressure and temperature
which results in the lowest yield strength of the duct material.
(TBD)
D.4.4.4.14.1 Proof pressure.

All proof pressure requirements on ECS systems and components shall be verified by
component tests and ECS laboratory tests.

This requirement can be demonstrated only by actual tests on each component and tests
conducted on air vehicle installed systems.

Ducting may be proof pressure tested while assembled as a system or as individual
components. All components should be supported for the test as they will be in the actual air
vehicle installation.
Proof pressure tests should be conducted on the air vehicle-installed engine bleed air system
and warm air ducting systems prior to first flight. The objective of proof pressure testing-
installed systems is to verify the system is properly assembled. For this test as well as
acceptance testing of components, the test may be performed at room temperature with the
pressure elevated to correct for the temperature. For the laboratory qualification test, however,
the actual operating temperature should be used.
Excessive ducting misalignment resulted in a dramatic failure on the first air vehicles of a new
bomber program when the air vehicle-installed warm air ducting system was subjected to proof
568
JSSG-2009A
APPENDIX D
pressure. No problem was evident when the ducting was subjected to normal, maximum
operating pressure prior to the proof pressure test. As a result, the improperly aligned ducting
would have gone unnoticed if the proof pressure test had not been conducted, creating the
possibility for a later, serious, in-flight failure.
D.3.4.4.14.2 Burst pressure.

All system components exposed to positive or negative pressure shall withstand, without rupture
at associated component temperature and pressure, each of the following burst pressures:
a. (TBS 1) times the gauge pressure at associated temperature that occurs during
normal operation, without malfunction, that would have the most adverse effect upon the
component's structural integrity.
b. (TBS 2) times the gauge pressure at associated temperature that occurs in the event
of failure of an upstream pressure or temperature control device that would have the
most adverse effect upon the component's structural integrity.
The intent of this requirement is to ensure all pressurized components are adequately designed
and tested for structural integrity under both normal operating conditions and upstream pressure
or temperature control device failures.

Burst pressure is the pressure the component must withstand without rupture. Deformation
resulting from the test is acceptable and the part need not be functional after the test.
typically used is 2.5, which is based on previous USAF experience that has shown components
designed and tested to these criteria have proved to be durable and reliable (SAE ARP1796
recommends “3”). This should be considered to maintain consistency with commercial
standards. The Navy historically used “4” for bleed air systems. Although somewhat on the
conservative side, it had the advantage of providing a growth capability when higher pressures
resulted from increasing ECS capacity or engine upgrades. For new air vehicles using a “4”
value should be considered. Requalifying and retrofitting bleed ducting cant be expensive.
typically used is “1.5,” which is accepted industry standard and based on previous USAF
experience that has shown components designed and tested to these criteria and have proved
to be durable and reliable.
Other less stringent requirements should be specified only after very careful consideration of the
application.
(TBD)
569
JSSG-2009A
APPENDIX D
D.4.4.4.14.2 Burst pressure.

All burst pressure requirements on ECS systems and components shall be verified by
component tests and ECS laboratory tests.

This requirement can be verified only by test.

Since the burst test is a destructive test (even if no deformation occurred at the burst level, the
component is still considered not to have any useful life), continuing to test to failure after
reaching the specified burst limit is highly recommended. If future growth or engine upgrade
results in higher operating pressures, an additional, expensive destructive test may not be
required if the components already exceeded the required burst level in this test to failure.
(TBD)
D.3.4.4.14.3 Rotating equipment structural integrity.

The housing and scrolls of all rotating machinery of the Environmental Control System shall
completely contain all fragments from:
a. Fused drive rotor failures (including tri-hub burst) at the maximum fuse speed and at the
pressure and temperature associated with this speed.
b. Non-fused drive rotor failures (including tri-hub burst) at the maximum speed that can
result from any failure-inducing condition or (TBS 1) percent of the maximum normal
speed, whichever is greater, at the pressure and temperature associated with the speed.
c. Driven rotor failures (including tri-hub burst) at the maximum speed that can result from
“a.” or “b.”, above, at the pressure and temperature associated with this speed. Driven
rotors shall not burst at speeds lower than the drive rotors burst.
d. Driven rotor failures when powered by electric or hydraulic motors at the maximum
speed that can result from any failure including condition or 135 percent (135%) of the
maximum normal speed, whichever is greater.
“Contain” means fragments may penetrate the housing, scroll or shroud but should not pass
through the housing. Particles or parts resulting from a rotor burst and passing through the inlet
or outlet port of the rotating component must be contained by the adjoining ducting.
All rotating equipment shall be designed so that operation at the speed resulting from the worst
case single failure or up to (TBS 2) percent of normal maximum operating speed for a period
570
JSSG-2009A
APPENDIX D
of (TBS 3) minutes is possible without rubbing or other adverse effect upon the equipment.
There shall be provisions to prevent or limit the “windmilling” or “freewheeling” of all rotating
ECS equipment. Fans, such as ground cooling fans, shall not “windmill” in a ram air flow. If a
fan is protected from “windmilling” in a ram air flow by a check valve, a failure of that check
valve shall not constitute a flight safety hazard.

To prevent further damage to the air vehicle or injury to crewmembers, the housing and scrolls
of all rotating machinery should completely contain all fragments from blade failures or wheel
bursts.
Rotating equipment should be designed to operate satisfactorily under certain failure conditions
without adverse effect, such as pressure regulator malfunctions, short-term ram air circuit
blockage, or starvation. Freewheeling of rotating equipment should be limited or prevented
because of the hazards associated with failure of the equipment under these conditions.

Analysis shows the three-section hub burst is the highest energy-level failure and, therefore, is
usually the primary containment design criteria. To limit the speed at which containment must
be demonstrated, the drive rotor can be “fused” so it will fail at the desired maximum overspeed
condition. For these cases, containment is demonstrated at the maximum speed.
TBS 1: If the drive rotor is not fused, then containment is to be demonstrated at the maximum
overspeed condition that could occur as a result of any failure-inducing conditions (pressure
regulator malfunction, ram air circuit blockage, or such). The “single failure” criteria may not
result in a speed much higher than the normal, maximum operating speed. In that case, a
minimum percent of overspeed is usually specified to ensure adequate structural integrity and a
safety factor. This value has been 35 percent (35%) in the past; however, 35 percent (35%)
may be excessive in some cases, especially in the case of bootstrap ACMs. Air bearing ACMs
sometimes have difficulty in achieving 35 percent (35%). Therefore, care should be exercised
in completing the requirement. A value of 35 percent (35%) is appropriate for fans, simple cycle
ACMs, and such. Lesser values are appropriate for the bootstrap or air bearing machines.
Driven rotors should be tested at the maximum speed that occurs as determined from “a.” and
“b.” above. The object is to have the drive rotor fail first so there will be no sudden increase in
rotating speed because of load loss. Speeds used for containment tests should also be
selected with consideration to the speeds that result from freewheeling.
TBS 2 should be filled in with a percentage value. Air cycle machine rotors are usually spin
tested to 120-percent (120%) overspeed during manufacture to ensure their structural integrity.
This has proved an excellent design criterion, as there have been few cases of wheel failures on
operational equipment.
TBS 3 should be filled in with a time value. The overspeed spin and containment requirements
should be consistent. Overspeeds of 120 percent (120%) for 5 minutes have been the typical
requirement.
571
JSSG-2009A
APPENDIX D
When this paragraph is completed, the overspeed requirement should be consistent with (lower
than) the containment requirement.
Control of freewheeling is very important. On the F-111 air vehicle, hydraulically-driven fans are
used for ground cooling. In flight, check valves prevent the flow of ram air through the fans.
However, the check valves failed and the reverse flow caused freewheeling of the fans, which
ultimately failed. The failures caused extensive damage when blade fragments were thrown
through the wheel well. Fan failure also occurred on the first F-15 flight due to check valve
failure and freewheeling. These experiences emphasize the need for freewheeling protection.
Lack of containment capability is unacceptable, as evidenced by several instances of

uncontained wheel failures that resulted in the loss of life and air vehicle. An air turbine starter
failed on a B-58 and killed a crewmember. A B-52 sustained extensive damage when an air
turbine failed.
D.4.4.4.14.3 Rotating equipment structural integrity.

The capability of the housing and scrolls of the rotating machinery of the ECS to completely
contain all fragments from the failures and the conditions described in “Rotating equipment
structural integrity” in this appendix shall be verified by (TBS) .

Verification is necessary to ensure that the containment requirements imposed on the housings
and scrolls are met.

TBS: When using fused rotors, several tests should be conducted to determine the consistency
of the fuse failure speed and to determine the maximum fuse failure speed for containment
purposes. If the adjoining ducting or other hardware is part of the containment feature, it should
be included in the containment test and installed using the air vehicle configuration. Testing and
analyses should be performed to determine the speed of the fan during freewheeling. If the
testing and analyses show the freewheeling speed exceeds the maximum overspeed during
normal operation, the fan should be designed for the overspeed condition.
(TBD)
572
JSSG-2009A
APPENDIX D
D.3.4.4.15 Ground interfaces
D.4.4.4.15 Ground interfaces
D.3.4.4.15.1 Ground test provisions.

Provisions shall be incorporated for:
a. Ground pressure leakage testing of the (TBS 1) . Means to prevent controls left in
the closed position shall be incorporated.
b. Functional checkout of the (TBS 2) on the ground using a ground pneumatic cart as
the air source.
c. Cooling, heating, and ventilation of (TBS 3) by an external ground air conditioning
cart.
d. Ground proof pressure testing of the (TBS 4) . These provisions shall facilitate
performance of the proof pressure test without having to remove or cap duct sections.
Ground test provisions are required to perform maintenance on the ECS, avionics, and other
equipment dependent on the ECS.

TBS 1: Provisions for ground pressure leakage testing of duct systems, pressurized
compartments, and such, should be provided for troubleshooting and integrity checks following
maintenance. Typically, compartments utilize two control devices that ensure proper
pressurization. The compartment pressure level is maintained by a device that either controls to
a constant absolute pressure or a constant differential to the ambient pressure. Additionally, a
safety device should be utilized to ensure that the crew and air vehicle structure will be
protected, in the event of a system failure. It is necessary that these pressurization control
devices have provisions for frequent testing. All required test functions, such as cabin leakage
testing or safety valve testing, should be able to be accomplished as required by the operational
needs of the air vehicle. Additionally, all compartments which are pressurized to a prescribed
schedule should have a means to manually close the automatic pressure regulating device in
order that the structure may be pressurized and leak checked and for air vehicle
disinsectization.
TBS 2: Provisions for functional checkout of the ECS on the ground are also necessary for
proper maintenance of the system. Bleed air can be provided by the air vehicle engine, APU, or
ground support equipment for functional checkout. Ground pneumatic connections and the use
of ground support equipment is preferred, as this minimizes the use of onboard air vehicle
equipment.
TBS 3: Provisions should be incorporated for cooling, heating, and ventilating occupied areas
and avionics equipment, for ground operation, maintenance, checkout, and such. This
requirement should be consistent with those in “Occupied compartment ground cooling”,
“Occupied compartment ground heating”, and “Avionic ground operation” in this appendix.
573
JSSG-2009A
APPENDIX D
TBS 4: Provisions that enable personnel to conduct ground proof-pressure testing of high-
pressure and high-temperature ducting systems quickly and safely should be incorporated to
verify proper installation of the systems. The requirement to pressure test the bleed air system
is obvious because of the hazards and potential structural damage associated with high-
temperature and high-pressure bleed air leaks. Provisions for pressure testing the conditioned
air distribution ducting are also necessary because leakage in that system, although not
hazardous, can significantly impact system performance.
When this paragraph is completed, the project engineer should establish the ground provisions
required for the system under consideration. For a prototype or one-of-a-kind system, minimal
provisions may be required. However, for full-scale development and production systems,
provisions should be required for complete test of the entire system. Serious consideration
should always be given to ground pneumatic connections, as ground support equipment is the
most efficient source of bleed air for ground servicing and reduces the use of onboard
equipment.
The need for ground checkout capability is demonstrated by the F-111 forward bay cooling
system. Many “forward" equipment “hot" warnings were being experienced on operational air
vehicles which could not be resolved by normal maintenance procedures. When pressure
leakage tests were accomplished on several air vehicles during an investigation into the
problem, it was discovered that leakage in the distribution system was a major contributor to the
malfunction.
Therefore, complete ground test provisions should be provided, along with comprehensive TO
procedures on troubleshooting and testing of the system.
The requirement to provide means to prevent the regulator left inoperative is based on USAF
experience.
D.4.4.4.15.1 Ground test provisions.

Ground test provisions shall be verified by (TBS) .

Incorporation of provisions can be verified by inspection. However, the adequacy can be
verified only by demonstration or test.

TBS: Verification should be accomplished by inspection and test.
Ensure adequate pressure data are provided in conjunction with cooling capacity (flow and
temperature) when potential ground cooling carts are evaluated. In addition, air vehicle
distribution system back pressure should be evaluated and tested to confirm compatibility with
the advertised maximum cooling capacity of the cart.
574
JSSG-2009A
APPENDIX D
The adequacy of ground checkout provisions and ground cooling and heating provisions is very
important. High pressure drops in distribution ducting frequently restrict the ground heating and
cooling capability. Accessible and adequate test provisions are not always provided and should
be carefully evaluated.
The pressure drops in the distribution ducting should be carefully determined to ensure the
specified performance will be achieved using the proposed ground support equipment. During
evaluation of potential alternative ground carts for Special Operations Forces air vehicles,
inadequate back pressure data were available for the air vehicle distribution system. Although
overall capacity of the MA-3 cooling cart should have been sufficient to cool the required
avionics, the overall distribution system back pressure reduced flow in some parts of the system
to insufficient levels.
Ducting failure occurred during proof pressure testing of a new bomber air vehicle due to
incorrect test procedures. The procedures failed to account properly for the impact of
disconnecting ducting to provide isolation between sections.
D.3.4.4.15.2 Ground connections.

Air inlet connections for the external ground air conditioning source shall conform to (TBS 1) .
Ground pneumatic cart connections shall be in accordance with (TBS 2) . Ground leakage
connections shall be in accordance with (TBS 3) . Ground connections shall be located so
they are accessible for use during all ground maintenance activities.

United States Defense Standardization and International Standardization Agreements require
specific interfaces with ground support equipment.

TBS 1: There are Defense Standards that address most ground connections: MS33561 and
MS33562 address 5-in. and 8-in., respectively, ground air conditioning connections for air
vehicles.
TBS 2: The 3-in. pneumatic starting nipple is addressed by MS33740.
TBS 3: Air vehicle pressurized cabin ground leakage test connections and canopy seal inflation
and test pressure gauge connections are addressed by STANAG 3315.
575
JSSG-2009A
APPENDIX D
Defense Standards MS33740, MS33561, and MS33562 are consistent with North Atlantic
Treaty Organization Standardization Agreements (NATO STANAGs), as shown below.
MS STANAG
33561 3208
33562 3208
3315
33740 3372
When the engineer completes this paragraph, he should consider the operational requirements
of the vehicle. For prototype air vehicles or special purpose air vehicles, it may not be
necessary to use the standard connections. However, for operational air vehicles, the standard
connections are to be used. In general, it is necessary only to specify the connection be
“compatible with" the appropriate standard connector.
Use of non-standard connections results in operational problems which require the use of
special adapters to make them compatible with standard USAF ground equipment. Provisions
should be made to apply cooling air to the air vehicle during all types of ground maintenance
activity, including gear swings.
D.4.4.4.15.2 Ground connections.

Inspection of drawings and air vehicle ground demonstrations shall be used to verify the
requirements in “Ground connections” in this appendix.

This requirement can usually be verified by inspection.

Where questions arise over the conformity of a connection, it should be verified by
demonstration(by making actual connection to the appropriate ground equipment).
(TBD)
576
JSSG-2009A
APPENDIX D
D.3.4.4.15.3 Ground servicing.

The minimum diameter of air vehicle gravity filling orifices shall be as follow: (TBS) .

International standardization agreements require a minimum diameter for air vehicle gravity
filling orifices.

TBS should be filled in with the appropriate diameter(s) with consideration of the following:
a. Deicing fluids 1.75 in.
b. Coolant fluids 1.50 in.
c. Methanol water 1.50 in.
d. Demineralized water 1.50 in.
The STANAG 3212 specifies the minimum diameters listed above.
It may be possible to delete this requirement for prototype and some special-purpose air
vehicles; however, this requirement should be met for operational air vehicles.
(TBD)
D.4.4.4.15.3 Ground servicing.

Inspection of drawings shall verify gravity filling orifices conform to the requirements of “Ground
servicing” in this appendix.

Verification of ground servicing provisions are required to ensure that the air vehicle will be
compatible with ground support equipment.

Demonstration and Inspection are the most common methods for compliance of this
requirement.
The combination of inspection and demonstration has been an extremely effective approach for
Air Force programs.
577
JSSG-2009A
APPENDIX D
D.3.4.4.16 Hot surface temperature.

The operation of the ECS, including the bleed air system and any auxiliary heaters shall not
cause any exposed surface to be raised above (TBS 1) of any fluid that might be present in
that compartment due to normal operation or leakage. Ducts with a maximum surface
temperature above (TBS 1) shall be either insulated so that the maximum surface
temperature is less than (TBS 1) or the following measures shall be taken to avoid a fire
hazard:
a. Provide an air flow velocity of at least (TBS 2) in the areas immediately surrounding
the external duct surface.
b. Prevent direct impingement of combustible fluids on the duct.
All air distribution ducting shall be flame resistant.

When bleed air system components or auxiliary heaters are located near combustible fluids,
maximum surface temperatures must be controlled as a fire protection measure. Non-metallic
materials are frequently used for cold air distribution ducting. Since this ducting runs through
the occupied cabins and avionics bays, it can serve as a path for fire.

High temperature surfaces can provide an ignition source when in contact with combustible
fluids. For this reason, the use of high temperature equipment in compartments with
combustible fluids should be avoided. Where for justifiable reasons, high temperature
equipment must be in such compartments, the maximum component surface temperatures are
to be limited when the possibility of contact with a combustible fluid exists under any condition
including normal, emergency, or failure conditions.
TBS 1 should be filled in with a temperature value. A temperature of 50°F below the minimum
hot gas ignition temperature is recommended to provide a margin of safety. The temperature
should be assessed at all altitudes and all operating conditions. Autogenous ignition
temperature is less at latitude. Bleed air temperatures may be higher on cold days.
TBS 2 should be filled in with an air flow velocity. A recommended value is “2 feet/second.”
High temperature surfaces radiate heat to surrounding components. To improve the thermal
environment of nearby equipment, it is desirable to minimize hot component surface
temperatures. (See “Thermal system protection” in this appendix.)
For safety reasons, all duct materials should be flame resistant.
Non-metallic, flexible hoses were used on the RC-135C air vehicle to duct cooling air to the
avionics equipment. A fire occurred in one of the avionics boxes and was carried to other
avionics equipment by the flammable air hoses.
578
JSSG-2009A
APPENDIX D
Usage of flame resistant materials such as Kevlar® for ducting, as is used in the AH-64A,
ensures the flame resistance requirement will be met, while also providing a strength-to-weight
advantage over other materials.
D.4.4.4.16 Hot surface temperature.

Hot surface temperature requirements shall be verified by (TBS) .

To ensure safe component surface temperatures, air vehicle test data must be obtained.
Normal analytical methods are not accurate enough to adequately predict component surface
temperatures. Only actual test data can verify flame resistance of given materials.

TBS should be filled in with inspection of drawings and the air vehicle, and analysis of ground
and flight test data.
Component surface temperature below levels that could cause auto-ignition of flammable fluids
or below other critical levels should be demonstrated by heat transfer analyses. At locations
where surface temperatures are allowed to be above critical levels, it should be demonstrated
via inspection of drawings and a safety hazard analysis that such conditions pose insignificant
probability of a safety hazard. During testing, component surfaces should be provided with
temperature instrumentation so temperatures can be monitored for ground and flight test
conditions. Extrapolation of this data will probably be required to predict worst-cases results.
Instrumentation should be installed to determine the quantity and temperature of air from each
source and the temperature and quantity of airflow in all main distribution ducts. Appropriate
surfaces should be instrumented to provide a chordwise profile of exterior and interior skin
temperatures as well as temperature drop and airflow through the double skin passages. The
surface to be instrumented should be subject to approval of the procuring activity. Critical
structures should be instrumented with sufficient thermocouples to insure that overheating does
not occur. Shielded thermocouples should be used to measure air temperatures at locations
where there is a substantial difference between air temperature and the surrounding metal. If
there are discontinuities in the heated areas, sufficient temperature measurements should be
made to determine the effect of the heat flow from the heated to the unheated areas.
If ventilation is necessary to meet the requirements, the flow should be measured.
Laboratory tests should be conducted to verify all non-metallic air distribution ducting is flame
resistant. Previous tests that demonstrate this requirement for the material used or contractor
assessments that demonstrate fires cannot originate at the equipment source may negate the
need for this test
579
JSSG-2009A
APPENDIX D
(TBD)
D.3.4.4.17 Growth.
The ECS shall have sufficient capacity to allow for an increase of (TBS) .

The purpose of growth capacity is to provide for those avionic equipment changes and additions
that normally occur during the service life of an air vehicle. Growth assessment is also a critical
design parameter to insure field balance and flexibility for integrity of performance and life.

TBS: The ECS should have sufficient capacity to allow for growth. Most DoD air vehicles
designed in recent years have been designed with a 25-percent (25%) excess or “growth”
capacity for the ECS based upon the initial production avionics cooling load. However,
experience shows a 25-percent (25%) growth capacity is not necessarily enough to cover all
future changes in avionics, especially on fighter, bomber, and electronic air vehicles. It is
difficult to suggest a single value for excess growth capability that will be adequate for all types
of air vehicles. For each particular new program, the project engineer should base the value of
growth capacity on the best available estimate of likely increase in avionics load of the particular
weapon system, although experience has shown that most of the increases in avionic heat load
are unanticipated during the initial design. Since the original excess capacity is often exceeded,
experience has shown the need for the ECS to be a flexible design with the capability to
increase system capacity easily. This flexibility should consider space allocation for growth
beyond the original built-in growth, especially for key, space dependent components such as
heat exchangers. Strong consideration should also be given to over sizing hard to retrofit items
such as ducting and coolant lines. Consideration should also be given to using flexibility as one
of items considered in the trade-off to be performed. Provisions for an additional 25-percent
(25%) growth beyond an initial 25-percent (25%) growth was required by the former Navy ECS
specification.
Another consideration in determining the growth requirement is possible envelope expansion in

the future. Frequently new engines can be foreseen during the initial air vehicle development.
These new engines could allow the expansion of the envelope, increasing aerodynamic heat
loads significantly, especially to the cockpit in manned air vehicles. Some temperature limits
might be established because of material or aerodynamic limitations. However, even if a
maximum temperature can be determined, heat loads could be much higher due to greatly
increased duration at specific Mach number.
Experience has shown it is definitely necessary to have excess cooling capacity in the ECS to
cool the avionics added throughout the life of air vehicle. Contemplated changes on both the
580
JSSG-2009A
APPENDIX D
F-15 and F-16 will use up the 25-percent (25%) growth capacity originally designed into the
ECS.
Because of the necessity to increase the cooling capacity of the F-15 air vehicle beyond the
initial 25-percent (25%) requirement, a study was conducted to determine what changes could
be easily made to the system. A small increase in primary heat exchanger core capacity, along
with lowering avionics inlet air delivery temperatures, could result in a 37-percent (37%)
increase in avionics cooling capacity. An early trade study identifying what changes could
easily be made to the system to increase capacity could have resulted in these changes being
considered in the initial design of the system. Using the growth capacity for cooling avionic
equipment to lower operating temperatures will increase its reliability if accomplished correctly.
The F-14 air vehicle was wisely designed with approximately 25-percent (25%) growth capacity
even though it was not required by specification. This capacity was utilized by avionics that
were later added to the air vehicle. Further increase in capacity was not required only because
the AIM-54 Missile was redesigned deleting the requirement for active cooling from the air
vehicle allowing the capacity originally used on the missile to be reallocated to new avionics.
Prior to this reallocation ECS studies were performed to meet the advanced projected long term
of F-14 usage. It was determined that up to twice the cooling airflow would be required for
avionic cooling compared to the baseline air vehicle. Proposed changes to increase cooling
capacity included a larger primary heat exchanger with a resulting 30 percent (30%) increase in
ECS cooling capacity with the addition of an aft located bootstrap air cycle system which could
provide the additional cooling required. For additional internal source cooling, F-14 growth
studies have shown that the addition of new larger duct and an auxiliary cooling fan using
ambient air, and an increase in the ECS pressure regulator setting with increased air duct size
can also provide additional cooling to the avionics.
The original F/A-18 air vehicle was designed with no growth. At the time of its design no avionic
upgrades were anticipated; however, avionic additions soon required an expensive ECS
upgrade prior to introduction of the air vehicle in the fleet. When the upgrade was made, again
no appreciable growth was provided. As a result a second even more expensive upgrade to the
ECS was required. The F/A-18E/F has been designed with cooling growth.
The historic trend in processing avionics has been the reduction in size and power to
accomplish the same function as the past generation avionics. The size has been reduced by a
greater percentage than the power, resulting in higher power density and as a result higher heat
density. When avionics is upgraded, seldom does the upgrade maintain the same function as
the baseline especially since the upgrade creates extra space. (There would be little reason to
upgrade if the same function was retained.) As a result the avionic heat load increases rather
then decreases when upgrades are made to new technology. The increase in heat density may
pose additional problems if it exceeds the limits of the cooling medium being used. One
example of this was the F-14 Weapon Control System Processor. The processor was upgraded
from analog to digital technology, but the increased heat load required the addition of a fan for
ground low flight speed operation.
A more recent trend is the use of COTS equipment, especially on large subsonic electronic
aircraft. Although its heat load may be the same or less than specified to military or commercial
581
JSSG-2009A
APPENDIX D
aircraft standards, it will require more cooling from the ECS due to its lower temperature
requirements.
D.4.4.4.17 Growth.
The ECS growth capacity shall be verified by engineering analysis, ECS laboratory testing, and
flight tests. Dummy heat loads may be used for flight test verification of ECS growth capacity.

Both analyses and test are required to ensure system growth capability. Analytical performance
analyses show theoretical capability of the system. These analyses then need to be verified by
laboratory and air vehicle ground and flight testing after the hardware is available.

The airframe contractor should conduct analyses early in the development program to ensure
adequacy of growth capability for all ground and flight conditions. The subsystem test rig should
simulate the nominal avionics and electrical loads of the baseline air vehicle, and it should be
modifiable to increase the avionics and electrical loads by the specified amount. Any feature of
the growth equipment that causes a performance perturbation of the baseline subsystem or
necessary modification should be simulated and tested in the rig (such as additional distribution
pressure drop or added components). Testing should show that the backup cooling provisions
can provide the required cooling for the growth load under all applicable missions. Review of
drawing data is required to verify if sufficient space has been allocated for planned future
growth.
(TBD)
582
JSSG-2009A
APPENDIX D
D.5 PACKAGING
D.5.1 Packaging.
D.6 NOTES
not mandatory.
D.6.1 Intended use.

The Environmental Control System descriptions in this appendix are intended for use in air
vehicle systems developed to perform combat and combat-support missions in environments
unique to military weapon systems.
D.6.2 Acquisition requirements.

c. Title, number, and date of the specification.
D.6.3 Component information
D.6.3.1 Bearings.
Bearings adequate for the loads, speeds, environmental conditions, and life requirements
should be selected for use in the air cycle machine. Use of proper bearings is key to achieving
long life in high-speed, rotating equipment. Ball bearings or self-energizing air bearings are
used in current air cycle machines. Experience has shown air bearings possess the following
advantages:
a. No lubrication system
b. No periodic maintenance checks required
c. Higher mean time between failures (MTBF)
d. On-condition overhaul
583
JSSG-2009A
APPENDIX D
e. Bearing wear-out is non-catastrophic (no damage to wheels and scrolls)

f. Reduced repair and overhaul costs
g. Fewer spares required.
Air bearing air cycle machines are susceptible to adverse effects from contamination of the
bearing cavity. It has been learned that oil, sand, dust, and moisture contamination within the
air bearing can cause problems. The contamination can cause sticking of the foils, damage to
the foil coating when the shaft rotates in the presence of sand, dust, and shaft corrosion.
Experience from the F-16 program has shown air bearing units should be exposed to the
expected contaminants (oil, sand, dust, and moisture) in combination, and a significant portion
of the required start-stop cycles should follow the contamination test.
Care should be taken in protecting the bearings during balancing (grinding) to prevent
contamination (chips) from falling into the bearing cartridge and causing early failure of the
ACM. This occurred in the F-5E ACM production phase.
Compressor bearing failures on the F-16 ACM resulted in a test unit being instrumented to
measure thrust loads. The compressor bearing thrust loads were found to be well in excess of
predicted values. This was considered a contributing factor to the bearing failures. As a result,
a design change was incorporated.
Analyses should be conducted during the design phase to show that the bearings are adequate
for the loads, speeds, and temperatures involved. Sufficient testing should be conducted during
the ACM laboratory qualification test program to verify acceptable life of the bearings. For air
bearing units, this testing should include the number of start-stop cycles expected throughout
the operational life of the unit. Ensure air bearing units are qualified within oil-contaminated
environments equivalent to engine bleed levels for deteriorated engines as well as the typical
sand, dust, and humidity environments.
D.6.3.2 Air cycle machines.
Each turbine, fan, and compressor housing or scroll should be replaceable. Scrolls or housings
are a high-cost part of the ACM. Experience has shown that overhaul costs can be minimized
when the housing is not an integral part of the ACM and can be individually replaced.
Means should be incorporated to avoid air cycle machine turbine nozzle erosion. The turbine
nozzles should be replaceable and should not be a portion of the torus or other major,
disposable part. Turbine nozzle erosion is a common ACM problem, and the nozzles should be
frequently replaced during overhaul. Dust separators and special nozzle ring materials and
coatings can help prolong the life of turbine nozzles. The C-130 ACM nozzles were cadmium-
plated to reduce nozzle erosion. However, this approach proved unsatisfactory since cadmium
poisoning of crew is possible with this approach. Nozzle erosion can be evaluated during
system and component testing, by inspecting nozzles after teardown and measuring flow rates
before and after tests.
The verification of air cycle machine requirements should be in accordance with SAE AS4073.
584
JSSG-2009A
APPENDIX D
Shaft-driven compressors require thorough verification of the safety of the design. Shaft-driven
compressor failures have been a major cause of in-flight aborts in the AH-64A due to the
potential for fire resulting in smoke in the cockpit.
D.6.3.3 Bleed ducts.
Individual duct sections should permit no leakage. Leakage at duct unions is permitted, subject
to a system safety hazard analysis, and should be itemized and quantified by the Contractor,
but the design of the bleed air system should not permit the total leakage or any specified joint
leakage as determined by the Contractor to be exceeded for the service life of the air vehicle.
This criteria includes any portion of the ECS (such as bleed air system, refrigeration package, or
distribution system) where leakage presents either a safety hazard or a performance impact on
the ECS.
A shaft driven compressor air duct design that required a rotary joint and an expansion bellows
did not account for the axial loads on the duct mounting brackets imparted by the expansion and
contraction of the bellows. This required a redesign of the duct mounting configuration.
Drawing inspection was sufficient to reveal that a shaft driven compressor air duct expansion
bellows did not account for the axial loads on the duct mounting brackets imparted by the
expansion and contraction of the bellows. The duct mounting configuration was then
redesigned.
The duct design and installation practices of SAE ARP699 can be used as a guidance
reference.
The contractor should conduct and document engineering analyses to define the thermal
stresses in the bleed air ducting. The contractor should employ a design approach that seeks to
mitigate the thermal stresses in bleed air ducts. Results of these analyses should be presented
at the CDR and the design should be consistent with the analysis results. For example, if
analysis indicated that expansion joints are required, then the design should have expansion
joints. The SAE ARP699 should be used as duct design and installation guide to address the
issue of thermal stresses.
D.6.3.4 Pneumatic actuated components.
Pneumatic actuated components should not fail due to the presence of condensed liquid water,
ice or dust in the main flow path, in the sense lines or in actuators. Either the components
should tolerate the presence of these contaminants or there should be specific design features
to prevent their accumulation. Components should meet requirements when operating under
normal or backup cooling mode.
On both the F-111 and F-105, engineering changes were required to correct moisture-related
problems in pneumatic components. In the F-105, moisture in the pneumatic system caused
corrosion and freezing problems in the components. To correct this problem, holes were drilled
to purge water continuously and contact between dissimilar metals was prevented. These
moisture problems were similar to those on the F-111.
585
JSSG-2009A
APPENDIX D
Laboratory tests should determine the quality of the filtered air delivered to the pneumatic
components. The tests should record particulate concentration, size distribution, and moisture
content. Tests should be conducted with the pneumatic components installed in the production
configuration so problems of moisture condensation in pneumatic lines, and such, can be
identified. The following are recommended tests for verifying adequacy of pneumatic
components:
a. Accelerated internal corrosion and humidity. All pneumatically-operated control
components of the subsystem should be subjected to the following tests:
1. Components should be oriented in the same attitude as they will be installed in the
air vehicle during all phases of testing.
2. All internal surfaces exposed to pneumatic air should be thoroughly wetted by
supplying a solution of 5 percent (5%) (by weight) of sodium chloride in water to the
component. Valves should be cycled 5 times from closed to open during the wetting
operation.
3. The components should then be purged by use of factory air and all valves should be
cycled as in item “2.", above.
4. The components should then be placed in 130°F ±5°F, 100 percent (100%) relative
humidity environment and baked for 1 hour. At the conclusion of each bake period,
the internal surfaces should be flushed with clear water and valves should be
simultaneously cycled as in item “2.", above. A functional check should then be
conducted to determine if a malfunction or degradation has occurred.
5. Items “2." through “4.", above, constitute one cycle. All components should be
cycled as follow:
(a.) 10 cycles with a 1-hour bake period,
(b.) 10 cycles with a 2-hour bake period, and
(c.) 10 cycles with a 5-hour bake period.
6. Each component should be disassembled and inspected at completion of each
10 cycles. Any evidence of corrosion, damage, or malfunction should be considered
failure of the test.
b. Freezing condensate. All pneumatically-operated components of the subsystem should
be subjected to the following test procedure:
1. Components should be oriented in the same attitude as they will be installed in the
air vehicle.
2. The pneumatic components should be connected to an air source with a specific
humidity of 154 grains of water/lb of dry air, and all valves should be cycled 5 times
from closed to open to closed.
3. Immediately after conclusion of step “2.", above, the components should be
depressurized, de-energized, and placed in a cold chamber for 1 hr at 0°F or lower
until the entire unit is stabilized at the low temperature.
586
JSSG-2009A
APPENDIX D
4. At conclusion of step “3.", above, and with components still in the cold chamber at
0°F, the components should be subjected to functional tests to determine that all
components perform satisfactorily.
The tests cited above for pneumatic components were first used on the F-105 program to verify
adequacy of redesigned components. The tests proved adequate since the components that
passed these tests did not exhibit the problems with moisture that were noted on the original
configuration.
D.6.3.5 Heat exchangers.
Laboratory tests should be conducted for the following:

a. proof and burst pressure
b. vibration and mechanical shock
c. pressure drop (all side)
d. thermal efficiency
e. thermal bypass functionality, as required
f. leakage
g. pressure and temperature cycling
h. salt fog.
A heat exchanger leakage test should demonstrate mechanical integrity at proof pressure levels
after completion of vibration, shock, and endurance tests. The heat exchanger should be
submerged in water, oriented in a manner that would reveal the formation of bubbles, and
pressurized to its proof level. The test technician should watch for bubble formation in the heat
exchanger for a 5 minute period. No discernible bubbles should be permitted for those heat
exchangers, which if failed, could contaminate the crew or equipment with NBC or other toxic
agents. If the heat exchanger cannot be oriented to reveal bubbles, then the header or a
portion of the header should be removed to render bubble observance possible. The contractor
should establish leakage requirements and conduct the test described above for non-
contamination critical heat exchangers. For those heat exchangers that are susceptible to icing
because of entrained water in the bleed air, the contractor should conduct sufficient laboratory
tests to show that the control system either averts or controls ice development on the heat
exchanger core. For either case, testing should show that the control system operates in a
manner that requires no human intervention during ice formation or prevention and that
resultant cooling or heating (or both) supply temperatures do not change by more than 1 F or
flow rates change by more than .5 lbm/min. Icing tests are most easily and accurately
accomplished by flight tests behind a spray tanker or in an icing tunnel. Flight tests in natural
icing are possible, but desired conditions are difficult to find and the conditions encountered are
hard to measure. If heat exchangers are susceptible to clogging due to foreign object ingestion,
the contractor should conduct a test to determine the severity of the problem. This includes
heat exchangers using water spray for added cooling. With water spray occurring the
Contractor should inject dirt at a rate that simulates “brown out” field conditions. Changes in
system performance should be observed and extrapolated as required to determine the
587
JSSG-2009A
APPENDIX D
allowable number of hours of operation in such a condition before the system must be cleaned.
A teardown inspection should be conducted to determine the post test condition of the item.
Heat exchangers for Navy applications, particularly those where the operating temperature will
exceed 650°F, should be tested to a salt fog test including sulfur using ASTM G85-85,
Annex A4.
D.6.3.5.1 Ram air heat exchangers.
Ram air heat exchangers and their associated inlets should be located to avoid functional
problems due to operation in icing conditions. The location of ram air heat exchangers and their
associated inlets should avoid damage from foreign object ingestion. A means of cleaning and
inspecting the ram air heat exchangers should be provided without the necessity of removing
them from the air vehicle. Ram air heat exchangers and their associated ducting should not
accumulate rain water. Ram air heat exchangers and their associated ducting and inlets should
not pose a FOD hazard to the air vehicle engines. Ram air heat exchangers and their
associated ducting and inlets should not pose an induction icing hazard to the air vehicle
engines.
Icing of heat exchangers, ram air inlets, and ducting., can usually be avoided by careful design.
In some cases, inlet ice protection may be required. Foreign object ingestion of grass, dirt,
paper, and such, is a very important consideration for air vehicles with assault field operational
requirements or unprepared field operational requirements. Inlets should be located to minimize
the ingestion due to “prop" wash, engine exhaust, debris dislodged by the landing gear, and
such. It may be impossible to prevent ingestion completely on tactical airlift air vehicles. In
those cases, means for inspecting and cleaning the heat exchangers should be provided. The
operational environment and operational requirements of the air vehicle should be considered in
heat exchanger and inlet design.
Extensive problems were encountered on the C-130H due to heat exchanger icing and foreign
object ingestion. It became a requirement to inspect and clean the heat exchangers every 300
hours or 6 months. Access to the heat exchanger is difficult, making this an expensive
maintenance requirement. An engineering change proposal (ECP) was required to correct the
icing problem.
The following should be considered for verification.

a. Drawing inspection and tests should be used to verify that ram air heat exchangers are
free of functional problems due to operation during icing conditions.
b. Drawing inspection and tests should be used to verify that ram air heat exchanger inlets
are located to avoid foreign object ingestion.
c. Inspection of drawings and air vehicle demonstrations should be used to verify a means
of access for inspection and cleaning of ram air heat exchangers while installed in the air
vehicle.
d. Analyses, air vehicle demonstrations and inspection of drawings should be used to verify
the ram air ducting and heat exchangers do not accumulate rain water.
588
JSSG-2009A
APPENDIX D
e. Analyses, air vehicle demonstrations and inspection of drawings should be used to verify
that the ram air heat exchangers and their associated ducting do not pose a FOD hazard
to air vehicle engines.
f. Drawing inspection and tests should be used to verify that ram air heat exchangers do
not pose an induction icing hazard to the air vehicle engines.
D.6.3.5.2 Air to liquid heat exchangers.
Lea4.kage of fuel and some coolants into the air can create serious safety-of-flight problems,
such as possibility of explosion or fire and the possibility of toxic fumes or odors entering the
occupied compartments. Therefore, these incidents should be prevented by proper design
practices. Heat exchangers that transfer heat between air and any liquid other than water
should not introduce liquid or toxic vapors into an occupied compartment as a result of a single
structural failure in the heat exchanger. Heat exchangers that transfer heat between air and any
combustible liquid should not create a fire or explosion hazard as a result of a single structural
failure in the heat exchanger.
One design solution uses a double wall construction between the air and the coolant in the heat
exchanger to prevent intermixing of the coolant and air in the event of a heat exchanger failure.
Another design solution is to have an intermediate loop to transfer the heat from the air to the
ultimate heat sink (fuel). The intermediate loop would use a non-toxic coolant such as silicate
ester coolant. Using this intermediate loop should prevent any possibility of a fire or explosion
being created if fuel leaked into hot bleed air.
a. Drawing inspection and laboratory tests should be used to verify that a single structural
failure does not result in leakage of fuel or toxic coolant fluid into the air of an occupied
compartment.
b. Drawing inspection and laboratory tests should be used to verify that a single structural
failure does not create a fire or explosion hazard as a result of a single structural failure in
the heat exchanger.
D.6.3.5.3 Liquid to liquid heat exchangers.
Leakage of fuel into a coolant loop can possibly create serious safety-of-flight problems since
the addition of air could result in auto-ignition. Therefore, this type of leak should be prevented
by proper design practice. Leakage of coolant into fuel is not considered hazardous, but does
normally result in degraded cooling system performance.
Heat exchangers that transfer heat from a liquid coolant into fuel should be designed so that a
single structural failure in the heat exchanger will not result in fuel entering the liquid coolant
loop, or in liquid coolant entering the fuel in amounts that pose any hazard for safe operation of
the fuel system or engines.
During the F-15 AECS flight testing, the liquid-to-liquid fuel-coolant heat exchanger failed three
times resulting in leaks between the fuel and coolant circuits. The leaks allowed the coolant
system to pump the coolant (silicate ester) into the fuel. As the coolant level decreased, fuel
was pumped into the liquid coolant lines. No methods existed for determining this condition
589
JSSG-2009A
APPENDIX D
other than the delayed symptoms of a hot cockpit or taking coolant samples for flash tests. Poor
brazing was the major factor in the cause of leaks. Leakage of silicate ester into fuel was not
considered a hazard.
a. Drawing inspection, laboratory tests, and ground and flight tests should verify that a
single failure will not result in leakage of fuel into coolant fluid.
b. Drawing inspection, laboratory tests, analyses and ground and flight tests should verify
that a single failure will not result in leakage of coolant fluid into the fuel to pose any
hazard to the fuel system or engines.
D.6.3.6 Water boilers.
Water is an excellent heat sink because of its high, latent heat. However, the potential for
serious problems exists with water use. As a result, a number of design features are necessary
to reduce the possibility for serious problems. The likelihood of corrosion necessitates means
for easy inspection and replacement of the water boiler and storage tank. Frequent servicing
requires water fill and drain provisions. The high freezing point of water requires the boiler and
storage tank not be adversely affected by repeated freeze and thaw cycles.
A means of inspecting the water boiler heat exchanger should be provided without the necessity
of removing it from the air vehicle. The water boiler heat exchanger and tanks should not be an
integral part of air vehicle structure. The water storage tank should have a readily accessible
water fill port and overboard drain. The water boiler heat exchanger and associated tanks and
plumbing should not be damaged by repeated freeze-thaw cycles.
The water tank within the F-111 air vehicle is an integral part of the fuselage structure. The
cooling medium within the tank is a deionized water and 10-percent (10%) propylene glycol
mixture. Initially, tank internal surfaces were coated with a polyurethane material, per
MIL-C-27725. After 4 to 6 years of service, internal tank walls developed some pitting corrosion
and cracks. Air vehicles are being brought into the depot for tank refurbishment.
Refurbishment consists of stripping the internal tank coatings, performing a complete non-
destructive inspection of tank surfaces, replacing cracked or heavily corroded structures, and
treating less severely corroded areas. Then internal tank surfaces are cleaned, chemically
conversion- coated, and repainted with an epoxy coating material This epoxy material exhibits
better water resistance and bonding properties than the polyurethane material used in its place.
Tank refurbishment entails approximately 400 man-hours and $5,500.00 materials cost per air
vehicle. The water tank within the F-111 air vehicle is a small (25 gal capacity), complex
configuration (webs, stringers, and beams), and has limited access. Herein lies one of the
problems. For a tank coating to protect against corrosion, in particular under the extremely
adverse conditions (violent boiling action) exhibited in the F-111, not only must the proper
coating material be used but its application must be flawless. Due to the physical constraints of
the tank, flawless reapplication of the coating is extremely difficult. Consequently, poor
adherence and bubbling has been a persistent coating problem with reworked tanks. A second
rework will have to be performed on most air vehicles, resulting in numerous additional rework
and downtime hours.
V-band clamp-type joints are submerged in the water boiler of the F-111. These clamps are
difficult to work on due to the limited accessibility and leaks at joints have occurred. When the
590
JSSG-2009A
APPENDIX D
system is shut off, the water can leak into the air ducting. When the system is turned on, the
water is “slugged" through the ducting of the ECS. In this case, the leak occurred in the service
air heat exchanger and the water was blown into avionics equipment along with the
pressurization air.
Severe water carryover problems have been encountered on the F-111 and EF-111 air vehicles
which required the installation of "baffles" to reduce the carryover. Water boiler design requires
extensive testing to verify adequacy of the design.
Freezing problems were encountered on the B-58. Water froze in the tanks while the air vehicle
sat on the ramp in cold weather. In several cases, the heat exchanger ruptured because of ice
expansion and also from the overpressure due to trapped steam when the ice melted around
the heat exchanger.
The F-111 also contained sacrificial zinc anodes in the water tank to help prevent corrosion. It
was discovered that the zinc and the tank will reverse polarity under some conditions.
One very serious problem with the water tank in the F-111 is that once installed in the air
vehicle, it becomes part of the air vehicle structure. Removing the tank after installation literally
requires disassembly of the entire air vehicle.

a. Inspection of drawings and the air vehicle should be used to verify a means of access for
inspection of water boiler heat exchangers and storage tanks while installed in the air
vehicle.
b. Inspection of drawings should be used to verify water storage tanks are not an integral
part of the air vehicle structure. A demonstration should be conducted to show the
replacement time for the water storage tanks, and the presence of an overboard drain
and a readily accessible fill port.
c. Laboratory tests should be conducted to verify the ability of water boilers and storage
tanks to withstand repeated freeze and thaw cycles.
Laboratory tests should be conducted for the following:
a. proof and burst pressure
b. vibration and mechanical shock
c. pressure drop (all sides)
d. thermal efficiency
e. thermal bypass functionality, as required
f. leakage.
A heat exchanger leakage test should demonstrate mechanical integrity at proof pressure levels
after completion of vibration, shock, and endurance tests. The heat exchanger should be
submerged in water, oriented in a manner that would reveal the formation of bubbles, and
pressurized to its proof level. The test technician should watch for bubble formation in the heat
591
JSSG-2009A
APPENDIX D
exchanger for a 5 minute period. No discernible bubbles should be permitted for those heat
exchangers, which if failed, could contaminate the crew or equipment with toxic agents. If the
heat exchanger cannot be oriented to reveal bubbles, then the header or a portion of the header
should be removed to render bubble observance possible. A teardown inspection should be
conducted to determine the post test condition of the item.
On the B-58, the freeze-thaw test was accomplished by freezing the tank and allowing it to thaw
by conduction to the outside ambient. In operational use, the tank may be frozen and then
force-thawed by bleed air passed through the heat exchanger. In the case of the B-58, the
water boilers failed in this condition because the water around the heat exchanger melted and
started boiling while there was still a large block of ice in the tank. This resulted in very high
pressures and failed the heat exchanger. Therefore, freeze-thaw tests should be conducted for
all possible freeze-thaw conditions.
D.6.3.7 Duct couplings.
Without a safety feature, failure of the primary latching mechanism can result in separation of
the joint and a high rate of bleed air leakage, which is a serious safety-of-flight hazard. Proper
selection of couplings is critical to air safety. Maintenance aspects of coupling selection
including acceptable leakage also require careful attention. Quick-disconnect couplings, if used
in the bleed air ducts, should have a secondary latch feature so that the coupling integrity is
maintained in the event of the failure of the primary latch mechanism. Couplings chosen should
be consistent with the loads experienced at the respective junctions. Couplings that are
frequently removed should be readily accessible and should have the capability to be reused
without leakage. If joints require seals, the design should require them to be replaced after
having been subjected to thermal and or mechanical loading, otherwise it should be
demonstrated that they be reusable without causing increased leakage.
Bleed air-related failures are a major concern of the Aeronautical Systems Center at Wright-
Patterson AFB OH and the Directorate of Aerospace Safety at Norton AFB CA. A study was
conducted of specific USAF accidents and incidents for the period of January 1970 to
September 1975 that related to the air vehicle ECS. This study identified 39 clamp failures as
shown in table D-II.
592
JSSG-2009A
APPENDIX D
TABLE D-II. Clamp failures.
REASON
FOR FAILURE NUMBER OF TIMES
Improper installation 14
Leaking or loose 10
Bolt 9
Clamp 4
Clamp off 1
Use of wrong clamp 1
TOTAL 39
These incidents resulted in high-dollar value losses, including the total destruction of an F-4 air
vehicle due to fire.
Couplings are critical for safety and optimum ECS performance. Significant leaks in the bleed
air system can cause fires, explosions, burnt insulation and subsequent loss of serviced
subsystems, and structural damage if the leak pressurizes the compartment. Leaks in the
distribution system are more benign with respect to safety, but avionics and cockpit cooling will
still suffer. Excessive leakage can render cooling performance inadequate to support flight, and
significant flight schedule delays may result because of poor access to ducts and couplings and
lengthy repair times. Resolving these problems during manufacturing is more efficient than
discovering and resolving them during the flight test program. Inspection should show that
safety features are included in the design, but tests are mandatory to verify the failsafe features
of the clamp. Inspection and tests are also necessary to assure proper hardware selection and
that maintenance aspects are properly addressed.
A laboratory test should determine the suitability of couplings. This includes high temperature,
high pressure bleed air and refrigeration pack applications, and it applies to metal couplings with
a latching mechanism as well as to composite material type couplings that use “radiator hose
type” clamps for fastening. Additionally, the contractor should submit coupling designs for
review at CDR and indicate their previous usage. The test should simulate the coupling’s
application by connecting two duct sections. The contractor should pressurize the system to
proof levels at the required operating temperature and at the same time impose the required
vibration environment. The test should compare the allowable leakage as determined by the
contractor to observed leakage. To demonstrate service life integrity the contractor should
593
JSSG-2009A
APPENDIX D
devise an accelerated test, conduct it, and repeat the leakage test described above. The
accelerated test may include elevating the temperature environment, vibration environment,
pressure environment, stressing the ducting and couplings by deformation, or other suitable
method determined by the Contractor. A leak test on air vehicle ducting should demonstrate
coupling integrity after installation, but before flight. This test should include the bleed air
system, the refrigeration pack, and the distribution system. The contractor should pressurize
the ducting to proof levels and examine the joints for leakage by applying a soapy solution or by
conducting an internally developed Standard Operating Procedure. This test should
demonstrate that the total leakage allowed as determined by the contractor is not exceeded.
SAE ARP699 contains additional guidance on duct coupling tests. A post-test teardown
inspection should also be conducted to determine the condition of the hardware. Ease of
coupling accessibility and replaceability should also be examined during design reviews,
drawing inspections, and tests.
D.6.3.8 Pressurization control valves.
Dirt and foreign objects can cause malfunction of the pressurization controls. This is a
significant safety-of-flight consideration because the malfunction of a safety valve can result in
personnel injury or air vehicle damage. All pressurization control valves (outflow, safety, and
negative pressure relief) should be located to minimize the entrance of dirt or foreign objects
into the valves. Valves should not be located on the floor, under the floor, or other locations
where dirt normally tracked into the air vehicle can easily fall, be swept, or kicked into the
valves.
The outflow valves on the C-141 are located below the cargo floor in a location such that dirt
and debris from the cargo compartment floor can be blown or swept into the valves. This has
caused malfunction of the outflow valves and difficulty in maintenance.
Guidance for pressurization control valves requirements and testing are provided in
SAE ARP1270. Endurance testing should be performed on the cabin pressure regulator valves
and the cabin safety valves. Sampling tests are recommended for the cabin pressure regulator
valves and the cabin safety valves.
In addition to the test required in SAE AS4073, the Fluid Resistance and the Contaminated
Fluids tests of SAE ARP986 should also be performed on air valves.
D.6.3.9 Liquid cooling loops.
Liquid cooling loops:

a. should be designed so that no hazardous mists, vapors or liquids are introduced into the
occupied compartments in the event of a single failure.
b. should indicate correct liquid level to maintenance personnel over the entire operating
and non-operating temperature and pressure range.
c. should have dry quick disconnects for all equipment that have integral coolant flow
paths.
594
JSSG-2009A
APPENDIX D
d. should accommodate the removal and replacement of equipment without the need for
replenishment of coolant or removal of entrained air in the coolant passages.
Coolant loop liquid level indication over the entire operating and non-operating temperature and
pressure range should be provided. These systems should be designed for quick and easy
maintenance, which includes accessible fill and drain provisions, and readily accessible and
easily read level indications. When the liquid loop is accessible within the air vehicle, it may be
desirable to place the level indicator in a location where it can be checked during flight. All line
replaceable units of liquid cooling loops should have self-sealing disconnects. Liquid coolant
connections to the cooled equipment should be a self-sealing, quick-disconnect type. It should
not be necessary to refill and bleed liquid loops as a result of routine maintenance actions. Self-
sealing, quick-disconnect connections are imperative for line replaceable units (such as liquid-
cooled avionic equipment) to permit quick and easy maintenance. Quick-disconnects are
preferred over valves because disconnects provide an instantaneous sealing of hoses or liquid-
cooled components without loss of any coolant. Past experience has shown that disconnects
are preferred over valves because of their quick-sealing capability. Experience with coolants
has shown that without disconnects the coolants would be allowed to leak and cause physical
damage to personnel and equipment. Coolant fluids selected for use in airborne liquid cooling
loops should be non-toxic and non-hygroscopic and compatible with materials that they contact
within the cooling loop. The coolant fluid should be compatible with the required operating and
non-operating environment. Further guidelines for fluid selection are contained in SAE AIR1811.
Silicate ester coolants have been widely used in airborne liquid cooling systems since the early
1970’s. Operational problems and fire safety hazards have been noted with silicate esters.
These fluids react with moisture to form a silica gel and an alcohol. The gel clogs flow
passages and creates the possibility for arcing within avionics. The alcohol substantially lowers
the flash point of the coolant. Polyalphaolefin is considered a coolant superior to silicate ester
and its use should be considered for all applications that require a dielectric coolant. Increased
operational readiness and meaningful improvement to reliability, maintainability, supportability,
safety, and life cycle cost should be achieved with the use of PAO.

a. Drawing inspection and laboratory tests should be used to verify that a single structural
failure does not result in leakage of fuel or toxic coolant fluid into an occupied
compartment.
b. Laboratory tests, analyses and air vehicle demonstrations should verify that the liquid
coolant level is correctly displayed to maintenance personnel over the entire operating
c. Laboratory tests, analyses and inspection of drawings should verify that all liquid cooling
loop equipment have dry quick disconnects if the equipment has integral coolant flow
paths.
d. Air vehicle demonstrations should verify that equipment may be removed and replaced
without the need to replenish coolant or remove entrained air in the coolant passages.
Laboratory tests should demonstrate that quick disconnects do not leak more than the
contractor specified amount during connection, during disconnection, during use, or during the
disconnection period. These tests should demonstrate acceptable leakage in the pressurized
595
JSSG-2009A
APPENDIX D
and unpressurized states and under the applications operating environment for pressure,
temperature, and vibration simultaneously.
D.6.3.10 Vapor cycle loops.
Vapor cycle loops:

a. should be designed so that no hazardous mists, vapors or liquids are introduced into the
occupied compartments in the event of a single failure.
b. should indicate the true refrigerant level to maintenance personnel over the entire
operating and non-operating temperature and pressure range.
c. should not be adversely affected by negative “g” operation of the host air vehicle if the
host air vehicle is capable of negative “g” operation.
d. should be tolerant of the phenomenon known as “slugging” during start up and other
transient conditions. “Slugging” should not occur during normal, steady state operation
of the vapor cycle system.
e. should not require discharge of the refrigerant during replacement of failed vapor cycle
components that are not part of the refrigerant flow path.
f. should be capable of withstanding, without adverse affects, an internal vacuum at
standard atmospheric pressure during the refrigerant charging process.
g. should be able to automatically detect and indicate to maintenance personnel, the
presence of low lubricant levels, air, water, metal chips, or other contamination in the
refrigerant charge.
The following should be considered for verification:
a. Laboratory tests, engineering analyses, ECS laboratory tests, ground tests and flight test
should verify that no hazardous mists, vapors or liquids are introduced into occupied
compartments in the event of a single failure.
b. Component tests, engineering analyses and air vehicle demonstrations should verify that
the true refrigerant level is indicated to maintenance personnel over the entire operating
c. Component tests, engineering analyses and flight tests should verify that the vapor cycle
refrigeration system is able to operate at all air vehicle attitudes and “g” levels.
d. Component tests, ECS laboratory tests and flight test should verify the tolerance of the
compressor to the phenomenon known as “slugging” during start up and other transient
conditions. These tests should also verify that “slugging” does not occur during normal,
steady state operation of the vapor cycle system.
e. Inspection of drawings and air vehicle demonstrations should verify that replacement of
failed vapor cycle components, that are not part of the refrigerant flow path, should not
require discharge of the refrigerant.
596
JSSG-2009A
APPENDIX D
f. Air vehicle demonstration should verify that the vapor cycle system can withstand,
without adverse affects, an internal vacuum at standard atmospheric pressure during the
refrigerant charging process.
g. Component tests, ECS laboratory tests, air vehicle demonstration and ground tests
should verify that vapor cycle system can automatically detect and indicate to
maintenance personnel, the presence of low lubricant levels, air, water, metal chips or
other contamination in the refrigerant charge.
h. SAE AS4073 should be tailored to establish vapor cycle system verification.
Upon the completion of the component tests, a subsequent teardown inspection should be
performed on the components to determine post-test conditions.
D.6.3.11 Fans.
All fans that may come into contact with air crew or ground maintenance personnel should not
present any hazard of injury due to rotating blades. The rotating blades should be protected
from foreign object damage. The total contribution of fans to the noise level in all occupied
areas should be determined and limited, and consistent with overall air vehicle noise level
requirements.
a. Inspection of drawings and hardware should be used to verify incorporation of means to
prevent personnel injury by fan blades and to protect the fan against foreign object
damage.
b. The noise level due to fans in all occupied areas of the air vehicle should be verified by
ground test, flight test and crew evaluation.
Care should be taken to ensure all fan installations are inspected, especially those located on
the tops and sides of equipment, where personnel might not see them but could touch them
during maintenance, movement around the air vehicle. Laboratory containment tests should
induce blade failures at the blade hub with 130 percent (130%) overspeed conditions, and the
containment ring should prevent the penetration of blade fragments.
D.6.3.12 Component performance data.
The following data should be generated to support the system analysis. They should be
considered for a data deliverable.
a. Heat exchanger thermal efficiency, pressure drop, weight, shape, materials, fin
configuration, and core geometry and dimensions. Thermal efficiency and pressure drop
data for the core should be presented as the product of the Stanton and Prandtl number
and friction factor as a function of Reynolds number.
b. Performance data for air cycle machines, vapor compressors, fans, and liquid pumps
c. Pressure drop data for all distribution ducting, interconnecting ducting for the
refrigeration pack, bleed air ducting, and other components contributing to the pressure
drop of the system. Ducting layout and system installation drawings should be included.
597
JSSG-2009A
APPENDIX D
d. Heat load summary of the equipment and avionics. The summary should itemize the
heat loads, distinguish between the forced and ambient cooled equipment, identify the
equipment’s location in the air vehicle, and list the equipment’s cooling requirement to
satisfy its allocated reliability.
e. System description and schematic. The schematic should show all ECS components,
indicate those locations where performance predictions for flow-rate, pressure,
temperature, and humidity or enthalpy are made, indicate control set points, and
correlate the analysis pressure drops to the respective locations on the schematic
f. Efficiency of components removing water and their dry and wet pressure drops.
g. Control algorithms, including protection control
D.6.3.13 Component qualification by similarity.

The SAE ARP986 provides an excellent guide to determine if qualification by similarity is a
viable approach for qualification tests of any component, not just valves.
D.6.4 Acronyms.
ACM Air Cycle Machine
AECS Advanced Environmental Control System
AOA Angle Of Attack
AWACS Airborne Warning And Command System

CDR Critical Design Review
cfm Cubic Feet Per Minute
CONOPS Concept of Operations
COTS Commercial Off-The-Shelf
EASY Engineering Analysis System
ECP Engineering Change Proposal
ECS Environmental Control Subsystem
FMEA Failure Mode Effects Analysis
FPD Freezing Point Depressant
GFE Government Furnished Equipment
IMC Instrument Meteorological Conditions
INS Inertial Navigation System
598
JSSG-2009A
APPENDIX D
IPS Ice Protection System

NBC Nuclear, Biological, and Chemical (contamination)
OBIGGS On Board Inert Gas Generating System
OBOGS On Board Oxygen Generating System
PAO Polyalphaolefin
psi pounds per square inch
psia pounds per square inch (absolute pressure)
psid pounds per square inch (differential pressure)
psig pounds per square inch (gauge pressure)
SLD Supercooled Large Droplet
SRAM Short-Range Attack Missile
TAS True Air Speed
UHF Ultra High Frequency
VMS Vehicle Management System
WBGT Wet Bulb Globe Temperature
D.6.5 Subject term (key word) listing.
Air
Avionics
Bleed air
Cargo
Contamination
Cooling
Crew station
Heating
Ice
Overbleed
Pressure
Rain
Temperature
Transparency
599
JSSG-2009A
APPENDIX D
D.6.6 International standardization agreement implementation.
This specification implements STANAG 3208, Air Conditioning Connections; STANAG 3212,
Diameters for Gravity Filling Orifices; STANAG 3315, Aircraft Cabin Pressurizing Test
Connections; and STANAG 3372, Low Pressure Air and Associated Electrical Connections for
Aircraft Engine Starting. When amendment, revision, or cancellation of this specification is
proposed, the preparing activity must coordinate the action with the U.S. National Point of
Contact for these international standardization agreements, as identified in the ASSIST
database at https://assist.dla.mil/online/start.
D.6.7 Responsible engineering office.
D.6.8 Changes from previous issue.
assumes no liability whatsoever for any inaccuracies in these notations. Bidders and contractors
are cautioned to evaluate the requirements of this document based on the entire content
irrespective of the marginal notations and relationship to the last previous issue.
600
JSSG-2009A
APPENDIX E
APPENDIX E
AIR VEHICLE FUEL SUBSYSTEM
E.1 SCOPE
E.1.1 Scope.
information for the Fuel Subsystem provided for in Part 1 of this specification. The appendix has
been developed and coordinated by technical personnel from the Air Force, Navy, and Army
and has been approved as an official guide for use by Government personnel for assistance in
tailoring the air vehicle subsystems specification for acquisition and model specifications. This
appendix is a mandatory part of the specification. The information contained herein is intended
for compliance.
E.1.2 Structure.
E.1.3 Appendix.
E.1.4 Deviations.
601
JSSG-2009A
APPENDIX E
E.1.5 Environmental impact.

E.1.6 Responsible engineering office.

E.2 APPLICABLE DOCUMENTS
E.2.1 General.
they are listed.
E.2.2 Government documents
E.2.2.1 Specifications, standards, and handbooks.
602
JSSG-2009A
APPENDIX E
AIR AND SPACE INTEROPERABILITY COUNCIL/

ASCC AIR STD 25/11 Diameters for Aircraft Gravity Filling Orifices
ASCC AIR STD 25/17 Pressure Fuelling Replenishment Connection
STANAG 1135 Interchangeability of Fuels, Lubricants and Associated Products
Used by The Armed Forces of The North Atlantic Treaty Nations
STANAG 3105 Pressure Refuelling Connections and Defuelling for Aircraft
STANAG 3212 Diameters for Gravity Filling Orifices
STANAG 3294 Aircraft Fuel Caps and Fuel Cap Access Covers
STANAG 3632 Aircraft and Ground Support Equipment Electrical Connections
for Static Groundings
STANAG 3747 Guide Specification (Minimum Quality Standards) for Aviation
Turbine Fuels (F-34, F-35, F-40 and F-44)
STANAG 7036 Fuels to be Introduced into and Delivered by The NATO Pipeline
System (NPS)
(Copies of these documents are available at http://quicksearch.dla.mil, http://nsa.nato.int,

www.airstandards.org, and www.ihs.com to qualified users.)
COMMERCIAL ITEM DESCRIPTIONS

A-A-59281 Cleaning Compound, Solvent Mixtures

JSSG-2000 Air System Joint Service Specification Guide
JSSG-2006 Structures Joint Service Specification Guide
MIL-T-18847 Tank, Fuel, Aircraft, Auxiliary External, Design and Installation

MIL-A-25896 Adapter, Pressure Fuel Servicing, Nominal 2.5 Inch Diameter
MIL-DTL-27422 Tank, Fuel, Crash-Resistant, Ballistic-Tolerant, Aircraft
MIL-DTL-38999 Connectors, Electrical, Circular, Miniature, High Density,
Quick Disconnect (Bayonet, Threaded, and Breech Coupling),
Environment Resistant, Removable Crimp and Hermetic Solder
Contacts, General Specification for
603
JSSG-2009A
APPENDIX E
MIL-DTL-83413/6 Connectors and Assemblies, Electrical, Aircraft Grounding:

Receptacles, Two Piece, with Inserts and Housings
MIL-PRF-87260 Foam Material, Explosion Suppression, Inherently
Electrostatically Conductive, for Aircraft Fuel Tanks

Systems
MIL-STD-810 Environmental Engineering Considerations and Laboratory
Tests
MIL-STD-883 Microcircuits
MIL-STD-1290 Light Fixed and Rotary-Wing Aircraft Crash Resistance
MS24484 Adapter, Pressure Fuel Servicing, Nominal 2.5 Inch Diameter

19111-5094 USA.)
E.2.2.2 Other Government documents, drawings, and publications.

EXECUTIVE ORDER
EO 13423 Strengthening Federal Environmental, Energy, and

Transportation Management
(Copies of this document are available from www.archives.gov/federal-register/executive-

orders.)
U.S. AIR FORCE TECHNICAL ORDERS
T.O. 00-25-172 Ground Servicing of Aircraft and Static Grounding/Bonding

T.O. 42B-1-1 Quality Control of Fuels and Lubricants
T.O. 42B1-1-14 Fuels for USAF Aircraft
(Copies of these documents are available at http://www.tinker.af.mil/technicalorders/index.asp to

qualified users.)
604
JSSG-2009A
APPENDIX E
U.S. AIR FORCE AIRWORTHINESS ADVISORIES
AA-01-05 Use of Aluminum Oxide (Al2O3) as a Grit Blasting Media during the
Removal of Organic Coatings on USAF Aircraft Fuel Tanks
AA-04-03 Free Water and Microbial Growth in USAF Aircraft Fuels
(Copies of these documents are available to qualified users. Contact the USAF Airworthiness
Certification Community of Practice Knowledge Owners at
https://cs.eis.afmc.af.mil/sites/AeroEngDisciplines/Systems/Airworthiness/default.aspx .)
U.S. ARMY AND U.S. AIR FORCE TECHNICAL REPORTS

AFAPL-TR-75-70 Summary of Ignition Properties of Jet Fuels & Other
Aircraft Combustible Fluids
AFAPL-TR-78-56 Static Electricity Hazards in Aircraft Fuel Systems
AFAPL-TR-78-89 Factors Affecting Electrostatic Hazards
AFFDL-TR-79-3047 Aircraft Integral Fuel Tank Design Handbook
AFWAL-TR-80-3100 Integral Fuel Tank Test Criteria and Methods
AFWAL-TR-85-2057 Aircraft Mishap Fire Pattern Investigations
USAAVSCOM TR 89-D-22A Aircraft Crash Survival Design Guide
Accession Number AD-A218 434
(Copies of these documents are available at http://www.dtic.mil/, and DTIC Online Access
Controlled to qualified users; Defense Technical Information Center, 8725 John J. Kingman Rd.,
Suite 0944, Ft. Belvoir VA 22060-6218 USA.)
NAVAL AIR SYSTEMS COMMAND REPORT
NAVAIR 06-5-504 Fuels, and Fuel Systems
(Copies of this document are available from www.sae.org; SAE International,

users.)
NAVAL OPERATING INSTRUCTIONS

OPNAVINST 3710.7 General Flight and Operating Instructions
(Copies of this document are available online at http://doni.daps.dla.mil.)
OPNAVINST 4790.2 The Naval Aviation Maintenance Program (NAMP)
(Copies of this document are available online at

http://www.navair.navy.mil/logistics/4790/library/basic2j.pdf.)
605
JSSG-2009A
APPENDIX E
FAA Advisory Circular 20-53 Protection of Aircraft Fuel Systems Against Fuel Vapor
Ignition Caused by Lightning
FAA Report DOT/FAA/CT-83/3 Users Manual for AC-20-53A Protection of Aircraft Fuel
Systems Against Fuel Vapor Ignition Due to Lightning
(Copies of these documents are available at http://rgl.faa.gov and

http://lessonslearned.faa.gov/PanAm214/DOT_AC20-53A.pdf, respectively; from the
U.S. Department of Transportation, Federal Aviation Administration, 800 Independence Avenue
SW, Washington DC 20591-0004 USA).
E.2.3 Non-Government publications.

SAE INTERNATIONAL
SAE AIR1184 Capacitive Fuel Gauging System Accuracies
SAE AS1284 Standard Test Procedure and Limit Value for Shutoff Surge
Pressure of Pressure Fuel Dispensing Systems
SAE AIR1662 Minimization of Electrostatic Hazards in Aircraft Fuel Systems
SAE ARP1665 Definition of Pressure Surge Test and Measurement Methods
for Receiver Aircraft
SAE AIR4023 Aircraft Turbine Fuel Contamination History and Endurance
Testing
SAE AIR4069 Sealing Integral Fuel Tanks
SAE AIR4246 Contaminants for Aircraft Turbine Engine Fuel System
Component
SAE AS5877 Aircraft Pressure Refueling Nozzle
SAE ARP8615 Fuel System Components
SAE AS18802 Fuel and Oil Lines, Aircraft, Installation of
SAE AS33611 Tube Bend Radii
400 Commonwealth Drive, Warrendale PA 15096-0001 USA; and from www.ihs.com to
qualified users.)
606
JSSG-2009A
APPENDIX E
AMERICAN SOCIETY FOR TESTING AND MATERIALS

ASTM D471 Rubber Property—Effect of Liquids
ASTM D2276 Particulate Contaminant in Aviation Fuel by Line Sampling
(Copies of these documents are available from www.astm.org; American Society for Testing
and Materials, 1916 Race Street, Philadelphia PA 19103-1187 USA; and from www.ihs.com to
qualified users).
AEROSPACE INDUSTRIES ASSOCIATION OF AMERICA, INC.

AIA/NAS NASM1515 Fastener Systems for Aerospace Applications
(Copies of this document are available from www.aia-aerospace.org; AIA, 1000 Wilson
Boulevard, Suite 1700, Arlington VA 22209-3928 USA; and from www.ihs.com to qualified
users).
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION

ISO 12103-1 Road vehicles — Test dust for filter evaluation — Part 1:
Arizona test dust
(Copies of this document are available from International Organization for Standardization; ISO
Central Secretariat; 1, ch. de la Voie-Creuse; CP 56 CH-1211; Geneva 20; Switzerland;
www.iso.org; and from www.ihs.com to qualified users).
E.2.4 Order of precedence.

E.2.5 Streamlining.
607
JSSG-2009A
APPENDIX E
E.3 REQUIREMENTS
E.4 VERIFICATIONS
E.3.1 Definition
E.4.1 Definition
E.3.2 Characteristics
E.4.2 Characteristics
E.3.3 Design and construction
E.4.3 Design and construction
E.3.4 Subsystem characteristics
E.4.4 Subsystem characteristics
E.3.4.1 Landing subsystem
E.4.4.1 Landing subsystem
E.3.4.2 Hydraulic subsystem
E.4.4.2 Hydraulic subsystem
E.3.4.3 Auxiliary power subsystem
E.4.4.3 Auxiliary power subsystem
E.3.4.4 Environmental control subsystem
E.4.4.4 Environmental control subsystem
608
JSSG-2009A
APPENDIX E
E.3.4.5 Fuel subsystem.
The fuel subsystem shall supply fuel to the engine(s) on an uninterrupted basis and shall
function satisfactorily under all operating conditions for the air vehicle. The fuel subsystem shall
not limit air vehicle performance within installed engine and air vehicle operating limits. The fuel
subsystem shall provide the following functions: fuel tankage, fuel control, fuel quantity gauging,
engine fuel feed, fuel transfer, refueling, defueling, thermal management, fuel management,
vent and pressurization capability, and all subsystem interfaces. The fuel subsystem shall
provide for safe and reliable onboard control of fuel distribution, and engine feed under all
normal and degraded operations. The subsystem shall comprise the necessary strength to
satisfactorily react to the stresses encountered in all phases of the air vehicle operation. The
fuel subsystem and its components shall provide the above for the complete service life of the
air vehicle.
E.4.4.5 Fuel subsystem

The fuel system components shall be qualified for use in the air vehicle in accordance with the
most current revision of SAE ARP8615, as specified by the procuring service.
E.3.4.5.1 General requirements
E.4.4.5.1 General requirements
E.3.4.5.1.1 Fuel designation.

Fuel(s) for the air vehicle shall be:
a. Primary fuel(s) (TBS 1).
b. Alternate/Restricted fuel(s) (TBS 2).
c. Emergency fuel(s) (TBS 3).

The fuel(s) which are expected to be used in the air vehicle should be identified.

TBS 1 should be filled in with any fuel which can be routinely encountered and used as the
primary fuel(s). Primary fuel should be defined as fuel used to demonstrate contract compliance
for complete steady state and transient operating ranges. JP-8 and JP-5 and their North Atlantic
Treaty Organization (NATO) equivalents F-34 and F-44 (conforming to their applicable
Defense Specifications (e.g., MIL-DTL-5624, MIL-DTL-83133, and ASTM-D1655) should be
specified as “Primary Fuel”.
TBS 2 should be filled in with alternate or restricted fuel(s). Alternate fuel should be defined as
fuel authorized for continuous use where thrust is not adversely affected. The flight manual
609
JSSG-2009A
APPENDIX E
should define limitations and prolonged use may result in a change of maintenance cost. Some
trim adjustments may be necessary with use. “Alternate” versus “Restricted” is simply a
terminology difference between USAF and USN technical publications.
TBS 3 should be filled in with emergency fuel(s). Emergency fuel should be defined as fuel
which may cause significant damage, limited to one flight, only for emergency evacuation or
aerial refueling or countering emergency action.

A Department of Defense (DoD) Directive Number 4140.43 dated 5 December 1975 stated that
all new turbine powered air vehicles should be designed to operate on middle distillate turbine
fuel, JP-8, as well as JP-5 and JP-4. Shipboard based air vehicles will continue to require JP-5
fuel because of safety considerations in storing and handling fuel aboard ships. These fuels can
be routinely encountered in worldwide deployment and should be considered in the design of
the air vehicle systems. All other fuels should be designated alternate, restricted, or emergency
fuels. The conversion of Air Force Bases from JP-4 to JP-8 has been completed. The need for
and availability of JP-4 for new air vehicles remains unclear at this time. Reference
Technical Order (T.O.) 42B-1-14 for a more detailed definition of primary, alternate, and
emergency fuel. Consult NATO Standardization Agency STANAG 1135, STANAG 3747, and
STANAG 7036 for Allied country fuel designations.
JP-8 +100 fuel additive: The thermal stability additive for JP-8 was developed by the Air Force
Research Laboratory’s Propulsion Directorate (AFRL/RZSP) to increase the thermal stability of
jet fuel by 100°F and increase the fuel’s heat sink capacity by 50 percent (50%). The
+100 additive is a fuel injector cleaner additive package consisting of detergent, dispersant,
metal deactivators and antioxidant. The additive was developed to facilitate fielding of future
advanced fighter air vehicles requiring enhanced thermal margins for fuel. During field
evaluation of the additive in F-16 air vehicles, benefits of reduced engine coking were reported.
The Air Force has been evaluating the benefits of this additive in fighter and trainer air vehicles.
However, the additive disarms the current generation of filter coalescer elements making them
ineffective for removing water, and dirt. The Air Force developed an implementation method to
inject the +100 additive downstream after the fuel has been filtered through current filters, for
application on truck refueled air vehicles. A new generation of filter coalescer element is
required to remove dirt and water from fuel with +100 additive so that fuel can be dispensed in a
hydrant system. The Navy has expressed concerns on unique problem with filters for their ships
and requires that a drop-in filter and coalescer element be developed before they use the
+100 additive. The Army has voiced similar concerns on the additive implementation prior to
filter development.
The three Services are currently working on a new-generation filter coalescer development.
Initial prototypes have been tested, but would require significant modification to be used in
existing Air Force, Army, and Navy filter coalescer vessels.
During the B-2 development phase, the primary fuel for the air vehicle was changed from JP-4
to JP-8. This was desired due to the requirement to refuel the air vehicle within a hangar and
due to limited air flow for ventilating air vehicle compartments adjacent to the fuel tanks. The low
volatility of JP-8 greatly reduced the probability of a fuel explosion. JP-4 was re-designated as
610
JSSG-2009A
APPENDIX E
an emergency fuel. With the routine exposure to JP-4 removed, other fuel subsystem changes
could be made. The fuel tank pressurization system, which was mandatory for the fuel
subsystem for hot JP-4, was deleted providing a reduction in system complexity and air vehicle
weight along with an improvement in system maintainability. Also, fuel tank lightning protection
was reduced due to the reduction in risk of fuel tank explosion.
The Air Launched Cruise Missile (ALCM) changed to a high density fuel to improve the range
capability of the missile. The missile was volume limited and therefore, the increased pounds of
fuel could be loaded in the existing tank volume. The fuel designated for ALCM has been
defined by MIL-P-87107B. JP-9 is a mixture of three specific hydrocarbon compounds blended
to obtain a freezing point below -65°F, high volatility to enable ignition of a cold soaked missile,
a maximum viscosity of 80 centistokes at -65°F, very high stability and cleanliness, and no
aromatic components to minimize material compatibility problems. A report on the long term
evaluation of the effects of JP-9 on various fuel subsystem elastomers was issued by the Air
Force Material Laboratory (AFML) reference AFML-MX-79-14, dated 8 March 1979. It was
concluded that most of the fuel subsystem elastomers were compatible with JP-9. Two
exceptions were identified. Chromate cured polysulfide exhibited shrinkage during long term
storage and Nitrile o-rings exhibited excessive swell. A report on the compatibility of JP-9 fuel
with metals was issued as AFML-MX-79-22. The report indicated that 2219-T87 aluminum alloy
in contact with A286, 304 CRES, or cadmium plated steel fasteners is not compatible with water
contaminated JP-9. JP-9 will be serviced in a clean, dry condition and the ALCM fuel tank will
be sealed to prevent absorption of water into the fuel. A data accumulation plan was formulated
by the prime contractor under the Effectiveness Verification Improvement Program to provide a
data base to show that the fuel subsystem will operate correctly without oxidation, gum
formation, or microbacteriological growth for a period of five years or longer.
E.4.4.5.1.1 Fuel designation.

Fuel subsystem required performance shall be demonstrated with the designated primary fuel
which is most critical for each performance parameter.

The ability of the fuel subsystem to perform each of its functions successfully must be verified to
ensure the subsystem will meet the air vehicle needs. The proper and safe operation of the fuel
subsystem, regardless of the fuel type, must be verified.

Fuel subsystem performance should be demonstrated with the designated primary fuel which is
most critical for that parameter.
Performance limitations which are critical due to vapor and air evolution should be defined with
JP-4, if JP-4 is designated as an alternate, restricted, or primary fuel.
Parameters which are critical to density and viscosity should be demonstrated with JP-5 or
JP-8.
611
JSSG-2009A
APPENDIX E
Gauging accuracy should be demonstrated with the fuel which provides the greatest error in the
system.

(TBD)
E.3.4.5.1.2 Material fuel resistance.

All materials used in the fuel subsystem shall be compatible with the air vehicle designated
fuels. Use of copper, magnesium, and cadmium in contact with fuel are prohibited. (TBS)
materials are not allowed.

The material compatibility with the designated fuels should be applied at the air vehicle level,
but has been repeated here for emphasis and to add lower level, unique fuel subsystem
requirements.

TBS should be filled in with consideration of the following:
All materials used in the fuel subsystem should be compatible with any air vehicle designated
fuels, other fuel categories, and any purging or preservative fluids that may be used.
Magnesium should be prohibited from locations where fluid or moisture entrapment is possible.
This restriction should also include the interior of fuel tanks where water can collect.
Fuel temperature range and aromatic content should be considered to ensure elastomer
compatibility.
Particular attention should be given to potting compound compatibility.

Primary concern with current day conventional fuel in relation to material compatibility is the
aromatic content, additives and the small quantity of non-hydrocarbons. Aromatics have high
solvency tendencies and either dissolve or cause severe swelling of rubber. The prevalent non-
hydrocarbons which are generally considered most detrimental to air vehicle systems are sulfur
and sulfur compounds, water soluble components, gums and gum forming compounds, and
naphthenic acid. These can result in corrosion of air vehicle parts made of copper, brass,
nickel, or cadmium plated; cause deterioration of rubber packings and fuel cells; and clog fine
mesh filters. Additives have been added to fuels to reduce these effects.
General experience indicates that Nitrile seals provide adequate performance with good
durability down to approximately -40°F. At fuel temperatures above 160°F, Nitrile is subject to
cracking especially if the seals are allowed to dry out. If these seals are used in a system with a
fuel temperature above 160°F the seals will not leak when the seals are first installed; however,
if fuel is removed from the system for periods as short as 30 to 60 days, the seals will leak when
612
JSSG-2009A
APPENDIX E
fuel is returned to the system. Fluorosilicone seals provide improved sealing below -40°F and
above 160°F but at a higher cost and reduced durability, especially for moving seals.
Fluorosilicone seals tend to swell when exposed to fuel and may be difficult to reinstall if
removed during maintenance actions. If allowed to dry, the seals will return to the original
shape. If the seals have been over stressed such as can occur in a variable cavity coupling
when the coupling has been retorqued to stop a leak, the o-ring will appear like a packing,
square shape, and will not return to original shape.
The Society of Automotive Engineers (SAE) committee, G-4, published AMS 7284, a new seal
material specification for air vehicle fuel subsystems. The material was applicable for a
temperature range of -65°F to +302°F.
In legacy specifications, metal tubing for fuel lines was required to be fabricated from stainless
steel in accordance with MIL-T-8606 or aluminum alloy in accordance with WW-T-700.
Minimum wall thickness was designated as 0.028 inch for aluminum and 0.020 inch for stainless
steel. Although thinner wall thickness’ could retain the required pressure, the minimum wall
thickness is required to minimize handling and maintenance damage.
The prohibition of cadmium plating with fuel is presented in MIL-STD-1568; however, the
prohibition of magnesium and copper with fuel is not included (cadmium and copper are
covered by EO 12856, 3 Aug 93 to eliminate toxic chemicals and extremely hazardous waste).
Both of these materials can react with surfactants of the fuel. Under hot fuel conditions copper
can cause coking of the fuel. Magnesium should be restricted from locations where fluid or
moisture entrapment is possible. This restriction should also include the interior of fuel tanks
where water can collect.
E.4.4.5.1.2 Material fuel resistance.

Long term material fuel resistance shall be verified by (TBS) .

Operation of a system with field supplied fuel for a short period of time does not establish
material compatibility; long-term effects need to be verified.

TBS should be filled in with component level tests, inspection, and operation of the system.
Material fuel resistance should be verified by tests at the component level under all normal and
extreme environmental conditions with all fuel types including primary and alternate. All other
fuel types and fluids should be evaluated by analysis and test as required. The final proof
should be the inspection and operation of the system. For the seal material, the verification
should be in the proof pressure test of the component and the system, and the demonstration of
a leak free system during operation of the air vehicle.

All fuels have considerable variability allowed in the specification and any given batch could
exhibit properties anywhere within the specified range. In order to cover the complete range of
aromatic content TT-S-735 Type I and Type III test fluids have been used. The Type I fluid
613
JSSG-2009A
APPENDIX E
contains zero percent aromatics and the Type III fluid contains 30 percent (30%) aromatics. The
8-day fuel resistance test contained in the legacy mil-spec MIL-F-8615—which used TT-S-735
test fluid, wet and dry periods, and high and low temperatures—had been the basis to establish
fuel resistance for components. MIL-F-8615 has been superseded by SAE ARP8615.
The test procedure was originally developed for Nitrile material and later adapted for
fluorosilicone material. There has been strong evidence that the TT-S-735 Type I test fluid (iso-
octane gasoline) does not produce the desired test effect of “minimum swell” for fluorosilicone.
During conversion from JP-4 to JP-8, fuel leaks often result when an air vehicle, which has been
operating on JP-4, is was filled with JP-8 or JP-5. During the investigation of these fuel leakage
phenomena, it was found the Type I test fluid can produce considerable swell in some materials.
The Type I fluid following the Type III high aromatic test fluid was intended to produce a
minimum swell (shrinkage from the previous condition) and verify that a good sealing contact of
the seal material would remain. The component could pass the test with Type III and Type I test
fluid, but would leak if the component was then subjected to a low aromatic fluid such as JP-7.
At this time, investigation is under way to define a better test fluid. It is recommended JP-7 be
used in place of the Type I test fluid for fuel resistance testing.
E.3.4.5.1.3 Fuel contamination.

Fuel subsystem contamination, as delivered to the engine, shall be no larger than (TBS 1). All
fuel subsystem functions shall continue to operate with fuel contaminated as follows: (TBS 2).

Although fuel is normally serviced to the air vehicle in an extremely clean condition, fuel can
become contaminated. Components must be able to tolerate gross contamination without
malfunction. From the fuel subsystem component viewpoint, the primary concern is blockage of
fuel flow or malfunction of the component such as preventing a check valve from closing. Since
gross contamination is an unusual condition, wearout due to abrasive action of the
contaminates is of little concern. Therefore, gross levels of contaminants which components
must tolerate should be specified.

TBS 1 should be completed with the maximum allowable particle size in fuel being delivered to
the engine. This should be no larger than 2000 microns. A four to eight mesh screen on the
boost pump inlets has been used in legacy fuel systems to ensure this contaminant particle size
requirement is met.
TBS 2 should be completed with fuel system contamination. The following table outlines the
contaminant, size, and quantity which has been used by legacy programs to qualify fuel
systems and components for the air frame to define performance limitations. This table has
evolved over many years and is based on inspection of contamination found in actual air vehicle
fuel tanks. The table should be adjusted to account for contaminants expected during
fabrication. Composite fiber should be considered for air vehicles with composite fuel tanks.
(Refer to table E-I).
614
JSSG-2009A
APPENDIX E
TABLE E-I. Fuel contaminants.
Contaminant Mixture
Particle Size Quantity
Contaminant (Microns)* (gms per 1000 liters)
Iron Oxide 0–5 19

5 – 10 1.0
Sharp Silica Sand 150 – 300 0.7

300 – 420 0.7
ISO 12103-1, A4 Coarse Test Mixture as provided by ISO 5.3

Dust document
Cotton linters Staple below 7 0.07

U.S. Dept of Agriculture
Grading Standards
Iron Chips 150 – 500 10
Aluminum Chips 150 – 500 10
Graphite Epoxy Composite 0 – 45 (23%) 5.2

45 – 150 (26%)
150 – 300 (8%)
300 – 425 (32%)
425 – 710 (11%)
Explosion Suppressant Foam 1 – 100** 0.75**

(ESF) Particles** Distribution is random utilizing
ESF contaminant is method outlined and cut
defined as foam in utilizing the methods in section
compliance with 4.2.4 of MIL-PRF-87260B,
MIL-PRF-87260B. excluding a hot wire cutter.
NOTES:
* The contamination used for testing is graded by the sieve method. Particles considerably larger than
500 microns size can pass through the sieve. Particles in the 700 – 800 micron range have been found in
certified test contamination samples.
** For air vehicles with fuel tank explosion suppression foam installed in the tanks, OR which may aerial refuel
from tankers with ESF
615
JSSG-2009A
APPENDIX E
The fuel subsystem should be able to operate with a free water content of 0.75 cubic
centimeters per gallon. Water contamination has always been a problem with jet fuel. Water
may be introduced at any transfer point between the refinery and the air vehicle tank and water
will be introduced into tanks through an open vent by condensation of water vapor in the air.
Although military fuel normally contains fuel subsystem icing inhibitor, the component and the
system design should accommodate this maximum water contamination since commercial fuels
may be used in military air vehicles.

In many programs the development of the heat exchangers has been the responsibility of the
subsystem designer requiring the cooling. As a result the “allowed pressure drop” of the fuel
pass of the heat exchangers did not receive a critical review by the fuel subsystem team until
the system level testing was accomplished. At test time, it was discovered the pressure drop did
not account for contamination which could be encountered. This oversight can have a big
impact on the suction feed capability of the engine. The fuel subsystem engineer must insure
the pressure drop specified for the heat exchanger(s) meets the engine feed requirements and
accounts for any abnormal feed conditions, especially contaminated fuel. In many cases, the
flow path through the heat exchanger is through very narrow fin spacing. The fuel subsystem
designer should consider the filtering effect of these fins. It may be desirable to provide a
bypass valve. The F-16 has successfully operated without a bypass with a fin spacing of 0.060.
The use of heat exchangers in the suction feed line should be avoided if possible. The system
design should consider the need to flush the tanks after air vehicle assembly. Dirty fuel should
not be routed through the heat exchangers since contaminates will be collected in the heat
exchanger.
The airframe fuel subsystem should not be relied upon to provide filtration for the engine, other
than basic fuel system protection levels. The fuel is normally delivered to the air vehicle in an
extremely clean condition and can be delivered in the same condition to the engine except for
foreign matter introduced during maintenance or from the atmosphere through the tank vents.
Some dust can be expected to enter the fuel tanks through an open vent system. During
manufacture of new air vehicles and during maintenance and repair activities, the fuel tanks
must be cleaned of any foreign material prior to being released for engine run up and flight. If
the tank and air vehicle configuration make it difficult to clean the tanks thoroughly, a temporary
screen, installed in the engine feed line, could be used during engine run up and the first flight to
trap any large particles that were missed in clean up. In the event it is deemed necessary to
have a cleanable or replaceable filter element in the engine feed line, it should be located
downstream of the engine shut-off valve and should be readily accessible for draining and
maintenance. The screen should not be any finer than 40 mesh (approximately 400 microns).
The filter assembly should incorporate a by-pass capability which does not flush the trapped
material during by-pass. The filter assembly should incorporate an impending by-pass indicator
which cannot be reset until the element is replaced.
The requirement to filter the fuel has been imposed upon the engine rather than the airframe.
This results in the total weight and size of the filtration system being much less than it would
have been if the airframe had supplied a line-mounted filter. Because the engine has a much
larger fuel pressure range to work with, the resulting filter size will be smaller. The airframe fuel
616
JSSG-2009A
APPENDIX E
feed line has a very small allowed pressure drop due to the boost pump out suction feed
requirement. A large filter size would be required to meet the pressure drop requirement.
Reference AIR 4023 and AIR 4246 for test procedures and contaminants for engine component
testing.
Currently only KC-130 tankers have ESF in their fuel tanks.
E.4.4.5.1.3 Fuel contamination.

The ability of the fuel subsystem to limit particle sizes in the fuel delivered to the engine(s) shall
be verified by (TBS 1) . The ability of the fuel subsystem to operate with contaminated fuel

The ability of the fuel subsystem components to operate with contaminated fuel should be
verified.

TBS 1: The ability to limit particle size in the fuel should be verified by inspection of the air
vehicle.
TBS 2: The ability of the fuel subsystem components to operate with contaminated fuel as
defined in table E-I, should be verified by component test. Operation of the system with the
specified water contamination should be verified by system test on a fuel subsystem
development rig and by component tests. During the tests the accumulation of ice should not
obstruct moving parts, plug orifices or bleed holes, or block screens or filters.

Air vehicles have operated for the last 20 years with components which have passed
MIL-F-8615 and have not reported any serious operating problems due to contaminated fuel.
This contamination table is believed to represent a conservative high level for normally expected
contamination; however, levels higher than this can occur under rare instances. One common
instance is when manufacturing oversight leaves debris such as cleaning rags in the tank.
During the early operation of the B-2 it was found that there was an unusually high level of
cotton linters in the fuel tanks which collected on the fins of the heat exchangers during engine
operation. These fibers were thought to come from the cotton coverall and cleaning cloth of the
workers during installation of the fuel components and sealing of the tanks. The roughness of
the graphite composite tank material could account for the increase of cotton fiber as compared
to that found in metal tanks. Improved flushing procedures were incorporated to insure removal
of the contamination prior to engine operation and flight. Another source of contamination that
should be considered is wire brushes used to clean areas for good electrical bonding. Wires
from these brushes can pass through wire strainers. For systems which can be controlled in
relation to cleanliness, the contamination level can be reduced to the controlled level. The Air
617
JSSG-2009A
APPENDIX E
Launched Cruise Missile had the missile tanks and the fuel thoroughly cleaned prior to servicing
to prevent contamination problems.
The test fluid used should contain the types and concentrations of the specified contaminant
mixture. The fluid circuit should insure the contaminants remain in suspension in the fluid and
enter the component under test. The contaminant should not be re-circulated so the
contaminant can be continuously and uniformly introduced into the inlet of the component. If the
fuel is filtered and re-circulated, then the fine particles which can penetrate the system filter will
be re-circulated, causing a larger quantity of fine particles to enter the components. This is not
detrimental to the test since the test checks for malfunction of the component and not wear of
the surfaces. A small batch of test fluid with proportionate quantity of contaminant added one
time should not be used. Pockets and voids in the system can trap and hold the total
“proportioned” quantity of contaminant during the first pass through the test circuit and the
remaining fuel flow will be contaminant free.
The component should be subjected to rated flow and pressure for 21/2 hours or 500 component
operating cycles and then subjected to 10 to 25 percent (10 to 25%) of rated flow for 21/2 hours
or 500 cycles. The operation of the component during this time should be in accordance with the
component detailed specification. The above test should be repeated once. If the fuel flows in
both directions when installed in a system, then the test should be conducted with flow in both
directions. Following the above tests, the component may be flushed with fuel to loosen
contaminants, but it may not be disassembled for cleaning. The component should satisfy a
functional test, pressure drop test, and leakage test in accordance with the component detailed
specification. See MAP 749 for related test procedures.
Reference SAE AIR 4023 and SAE AIR 4246 for test procedures and contaminants for engine
component testing.
E.3.4.5.1.3.1 Fuel system icing continuous operation.

The fuel subsystem shall be so designed that icing will not adversely affect system operation.

The fuel subsystem must demonstrate acceptable performance under icing conditions. Aviation
fuel contains an amount of dissolved water which can be released as free water as fuel
temperature drops. If the temperature drops low enough ice crystals can form and collect on
inlet screens, valves, and filters which can stop or slow fuel transfer and cause fuel distribution
problems.

The ability of the fuel subsystem to operate in conditions which could lead to fuel icing should be
demonstrated.

The saturation level of aviation fuel can generally be correlated to ambient temperature; that is,
aviation fuel at 80 F would have a total water content of 80 parts per million (ppm). As the fuel
618
JSSG-2009A
APPENDIX E
temperature drops, the amount of total water which can be entrained drops and the release of
free water droplets occurscan come from the fuel. For example, cooling the fuel to 50 F would
result in a new saturation limit of 50 ppm and 30 ppm free water would be generated. An air
vehicle which receives fuel under warm ambient conditions and is then exposed to cold
temperatures encountered during high altitude flight would see an increase in free water. If
temperatures are low enough, ice crystals can form in the fuel and begin to block filters,
screens, and other small passages. At +15°F, water solubility is only ~20 ppm; dissolved water
can precipitate under typical flight temperatures. Potentially more important is total water
expected on-board aircraft. Expected total water content depends on maintenance efficiency,
flight and ground-time history, etc.
E.4.4.5.1.3.1 Fuel system icing continuous operation.

Fuel subsystem performance with water saturated fuel and under icing conditions shall be
demonstrated by (TBS) .

The verification of fuel system operation should be demonstrated to ensure safety-of-flight
conditions are met.

TBS should be filled in with system level tests at 0 F and the worst-case temperature
encountered in flight is as follows:
Fuel should be saturated to 80 ppm to 90 ppm total water (Coordinating Research Council, Inc.
Document Number 530 Aviation Fuel Properties, Section 2.11 and Figure 47) and tested at 0 F,
and at the worse-case temperature encountered in flight). Test duration should be equivalent to
one design mission including one in-flight aerial refueling (if required by air vehicle design) or a
minimum of 3 hours, which ever is greater.
Tests of the fuel subsystem should be conducted to demonstrate satisfactory operation for the
mission duration plus one in-flight aerial refueling (if the air vehicle is equipped with this is
capability).
Systems and components should operate under normal system feed and transfer conditions
(cycles and flow rates) for the temperatures specified below. Depending on component to be
evaluated, operation for 3 hours at 80 ppm total water with typical operating flow rate may not
provide sufficient total mass of water to fail component/filter, etc. Thought should be given to
test component and implications of operating variables.
a. Fuel system tests. Tests on fuel systems should be conducted at 0o F and -40o F (or
lowest design operational fuel temperature). All surfaces of fuel system components in
contact with the fuel should be at or below the normal surface temperatures which will be
encountered in operational use.
b. Test fuel. Testing should be conducted using the primary fuel of the procuring activity,
JP-5 or JP-8. The fuel used should not contain any anti-icing additive. Care must be
taken when results from this type of operation to that with a FSII are compared.
619
JSSG-2009A
APPENDIX E
c. Procedure. The tests should be conducted with conditioned fuel as follows: Conditioning
procedure for saturated fuel. (Figure of test set up can be provided as an example of an
icing test rig):
1. Fuel should be at 80o F to 90o F. If the ambient temperature of the fuel does not meet
the above requirement, circulate the fuel from the storage tank through a heat
exchanger and back to the storage tank until the fuel has been heated to between
80oF and 90oF.
2. Establish a fuel flow from the storage tank through a transfer pump returning to the
storage tank by way of a by-pass around the filter separator.
3. With flow established through the storage tank, atomize one (1) gallon of water per
1,000 gallons of fuel at a rate of approximately 50 cc per minute.
4. After all water has been atomized into the fuel in the storage tank continue circulation
for approximately five (5) minutes. However, longer time may be required to saturate
fuel fully and obtain a homogeneous mixture.
5. Close the bypass valve and direct the fuel flow through the filter separator to remove
the excess water. Connect the outlet of the filter separator to the inlet of the test tank
and fuel the test tank to the desired test volume. This may require several passes
through the separator—especially if FSII was previously used.
6. Establish a circulation of the fuel in the test tank. Fuel circulation should be from the
test tank through a cooling heat exchanger and back into the test tank. Actual cooling
of the fuel should not be initiated at this time.
Note: Circulation may be accomplished either by using the air vehicle fuel boost
pump(s) or a separate circulating pump. If the air vehicle fuel boost pump(s) is (are)
used to circulate the fuel, provisions should be included to isolate the cooling heat
exchanger and associated plumbing from the air vehicle system during test.
7. Obtain fuel samples from three points in the test tank and analyze them using the Karl-
Fischer method. The average quantity of total water from the three samples should
contain between 60 ppm and 80 ppm (Coordinating Research Council, Inc. Document
Number 530 Aviation Fuel Properties, Section 2.11 and Figure 47).
8. Utilizing the circulation through the cooling heat exchanger, cool the fuel in the test
tank to the test temperature at a rate determined by the actual fuel cooling rate for the
air vehicle. The fuel will be recirculated and agitated throughout the cool-down process
and the final test will be conducted at steady-state. SAE ARP 1401A provides further
details on testing.
9. While cooling the fuel in the test tank to the test temperature, obtain a single sample
every 30 minutes from an in-line sampling point located in the cooling circuit plumbing
and analyze it using the Karl-Fischer method. The total water content of the sample
should be between 60 ppm and 80 ppm. Laboratory testing has indicated that as soon
as the cooling begins, this measurement is for indication only since dissolved water will
precipitate and there is no assurance a homogeneous mixture will be sampled at any
given point in time.
10. Terminate the circulation through the cooling heat exchanger. This may require a
portion of the flow to be bypassed back to the conditioning tank to maintain suspension
620
JSSG-2009A
APPENDIX E
of water/homogeneity within the fuel. A cooling capacity may need to be retained to

prevent fuel warming during test period. Control/maintenance of temperature of test
component may also be important.
11. Run the test.
12. While running the test, obtain a single sample every 30 minutes and at the completion
of the test from an in-line sampling point located in the test circuit plumbing and
analyze it using the Karl-Fischer method. The total water content of the sample should
be between 60 ppm and 80 ppm (for indication only, refer to Step 9.)

AFRL/RZTG, US Air Force Fuels Research Lab, Wright Patterson AFB, OH, has conducted
extensive testing of fuel system icing tests and is a good source for detailed lessons learned.
E.3.4.5.1.4 Fuel temperatures.

The fuel subsystem shall operate with fuel temperatures of (TBS 1) minimum and
(TBS 2) maximum. The fuel subsystem shall not be damaged by ambient temperatures of
(TBS 3) minimum to (TBS 4) maximum.

Even though thermal analysis can predict slightly different component temperatures for different
locations within the air vehicle, a standardized temperature range is recommended for
component design and test. Exceptions to the standard range should be handled on an
individual component basis. For components which are impacted because the standard range
is too severe, the temperature range can be moderated. For components which must operate
outside of the standard range, the extreme temperatures must be used.

TBS 1 through TBS 4 should be filled in with consideration given to table E-II. The fuel
subsystem should be designed to operate in steady state conditions throughout the temperature
range shown in table E-II.
621
JSSG-2009A
APPENDIX E
TABLE E-II. Temperature environment.
Fuel Temperature Ambient Air Temperature

TBS 1 TBS 2 TBS 3 TBS 4
Minimum Temp Maxium Temp Minimum Temp Maxium Temp
Class I -65 deg F (1) +135 deg F -65 deg F +160 deg F
operating
Fuel system which is not -80 deg F non-
affected by fuel heating operating
(1)
Class II -65 deg F (1) +175 deg F * -65 deg F

operating
Fuel system with * Max fuel temp as -80 deg F non- Max ambient temp
aerodynamic heating or determined by operating as determined by
when fuel is used as a engineering design engineering design
heat sink analysis analysis
(1) Due to location in hot compartments, the temperature requirement for some
components in a class I fuel system may exceed the temperatures specified.
These components shall be identified and the maximum temperature specified.

A standard environmental temperature range should be derived from the fuel subsystem design.
Air vehicles typically have been designed to operate with fuel temperatures of -65 to +135°F
and to withstand operating temperatures of -80 to -65°F and 135 to 170°F. Fuel operating
temperatures higher than 135°F can be encountered with supersonic air vehicles, or air vehicles
which use the fuel as a heat sink.
For elastomeric materials, time, as well as temperature, is pertinent. Intermittent exposure to
high temperatures can be tolerated. A mission temperature and time profile should be used for
design with elastomeric materials.
E.4.4.5.1.4 Fuel temperatures.

The effects of fuel and ambient temperature extremes shall be verified by (TBS) .

Natural and induced environmental temperatures can affect the performance and durability of
the fuel subsystem components.

TBS: The effects of fuel and ambient temperature extremes should be verified by analysis,
component tests, and simulator tests, and aircraft tests.
622
JSSG-2009A
APPENDIX E
The air vehicle fuel subsystem should be evaluated to ensure that icing does not adversely
affect the operation of the air vehicle fuel system or the fuel system components’ operation to
include pumps, valves, filters, and screens. All fuel subsystem components’ surface that are in
contact with fuel should be at, or below, the normal surface temperatures that will be
encountered in operational use.

Some unmanned air vehicles have missions that include long durations at high altitudes.
Additionally, next generation aircraft are using fuel to cool a greater number of components and
subsystems, such as avionics, ECS, generators, engine components, etc. These increased
thermal loads on and engine hot fuel recirculation configurations development air vehicles are
creating induced environments that significantly increase the high temperature requirements of
fuel subsystem components.
E.3.4.5.1.5 Proof pressures.

The fuel subsystem shall withstand repeated proof pressure applications without degradation in
performance, failure, permanent deformation, or external leakage. No single failure in the
system shall result in exceedance of proof pressure. The subsystem proof pressures shall be:
a. Engine feed proof pressure shall be (TBS 1) .
b. Fuel transfer proof pressure shall be (TBS 2) .
c. Refueling proof pressure shall be (TBS 3) .
d. Internal tanks proof pressure shall be (TBS 4) .
e. External tanks proof pressure shall be (TBS 5) .
f. Vents proof pressure shall be (TBS 6) .
A factor of safety for the maximum operating pressure of tubing and components must be
specified. This is customarily done by specifying a proof pressure and a burst pressure in
relation to the maximum operating pressure.

TBS 1 through 6 should be filled in with their proper values with consideration given to the
following:
a. Engine feed. The following should be a minimum requirement for engine feed
systems using tank mounted boost pumps feeding to the engine fuel pumps. The
engine feed system should be capable of withstanding a proof pressure of 2 times
the maximum operating pressure without failure or distortion, a burst pressure of
1.5 times the proof pressure without rupture and a negative pressure of one
atmosphere (14.7 psi) without air leakage into the system or collapse or damage of
the components.
623
JSSG-2009A
APPENDIX E
b. & c. Fuel transfer. & Pressure refueling. The pressure refueling subsystem should be
capable of withstanding a proof pressure of 2 times the maximum operating
pressure.
d. & e. Tank pressure safety factors. The fuel tanks should have a proof pressure capability
as specified in JSSG-2006, Structures Joint Services Specification Guide.
f. Vent lines. Collapse pressure on vent lines running through tanks exposed to
hydrostatic fuel heads due to air vehicle loads.

The following criteria were established by the pressurization paragraph in AFGS-87221 for any
structural pressure vessel on an air vehicle.
The pressure differential between pressurized portions of the structure (including fuel tanks) and
the atmosphere should be:
a. 1.33 times the maximum attainable pressure combined with one “g” flight loads, but not
applicable to those pressure vessels which incorporate design features that require dual
failures to exceed normal operating pressure.
b. 1.0 times the most negative and the most positive pressure attainable combined with
maximum flight loads.
c. 1.33 times the maximum attainable pressure combined with the loads due to ground
pressurization.
d. In order to define the total tank structural design criteria, the pressure criteria must be
combined with applicable flight loads including loads from fuel slosh. Fuel tank
pressurization is generally not necessary at lower air vehicle altitudes. If the fuel tank
pressurization activation is delayed until the air vehicle is at higher altitudes, the impact
of combining pressure loads with gust loads is minimized.
E.4.4.5.1.5 Proof pressures.

The ability of the fuel subsystem to withstand repeated sustained and repeated proof pressure
applications without degradation in performance, failure, permanent deformation or external
leakage shall be verified by (TBS) .

The ability of the system to withstand repeated sustained and repeated proof pressure
application should be determineddemonstrated.

TBS: The proof pressure capability of the entire fuel subsystem should be verified by analysis,
component test, fuel system test rig, and installed system pressure tests prior to first flight, and
as part of each air vehicle's acceptance test procedure.
The fuel tank proof pressure should be verified by analysis and ground tests on each fuel tank
of each air vehicle.
624
JSSG-2009A
APPENDIX E
The proof pressure capability of the refueling system should be verified by analysis and system
pressure tests on an engineering test model of the system, and a pressure test on each air
vehicle prior to acceptance.

Proof pressure capability is an important strength consideration. Pressure transients can occur
during normal or failure conditionmode operations. The B-2 and C-17 air vehicles experienced
high pressure transients during aerial refueling that was not predicted. Trying to design refuel
systems that maintain refuel surge pressures at or below normal operating pressures is
unreliable, costly and results in a heavier total design solution. Having a proof pressure
capability permits fuel subsystems to withstand pressure transients without permanent damage.
E.3.4.5.1.6 Burst pressure.

The fuel subsystem shall withstand burst pressure application without external leakage. The
fuel subsystem burst pressures shall be:
a. Engine feed burst pressure shall be (TBS 1) .
b. Fuel transfer burst pressure shall be (TBS 2) .
c. Refueling burst pressure shall be (TBS 3) .
d. Internal tanks burst pressure shall be (TBS 4) .
e. External tanks burst pressure shall be (TBS 5) .
f. Vents shall be (TBS 6) .
The burst pressure requirement of the fuel subsystem should be defined at a level that will
assure a sufficiently high margin of safety.

TBS 1 through 6 should be filled in with their appropriate values, with consideration given to the
following:
a. The fuel subsystem should be capable of withstanding a burst pressure of 1.5 times the
proof pressure of the subsystem.
b. The fuel tanks should have a burst pressure capability of 1.5 times the proof pressure as
defined in JSSG-2006, Structures Joint Service Specification Guide.
The pressure vessel may leak or lose function at burst pressure, but should not rupture or
create shrapnel.

Fast closing valves can create high pressure transients and create high pressure spikes. These
transients are valid pressure conditions to consider.
625
JSSG-2009A
APPENDIX E
E.4.4.5.1.6 Burst pressure.

The ability of the fuel subsystem to withstand burst pressure application without external
leakage shall be verified by (TBS) .

Verification of burst pressures should be considered safety critical.

a. Burst pressure capability should be verified by component tests of every component in
the fuel subsystem.
b. The burst pressure capability of the fuel subsystem should be verified by analysis and
component tests.
c. The burst pressure capability should be verified by testing on at least one tank that is
considered to be the most critical on a structural test article. The remaining tanks burst
pressure capability should be verified by analysis.

The B-2 and C-17 air vehicles experienced high pressure transients in operational vehicles that
were not identified during development. Burst capability provided a margin of safety for these
unknown pressure conditions.
E.3.4.5.1.7 Surge pressure.

Surge pressure shall not exceed the associated proof pressure of the fuel subsystem.

Surge pressure must be limited to ensure pressures do not exceed the system pressure
capability. Surge pressures could occur when refueling valves on the air vehicle are closed and
during rapid power reduction. Stopping a column of moving fuel can result in a pressure wave
being generated within the system which would be considerably higher than the steady state
pressure during flow conditions. The maximum allowable values for surge pressure should be
specified to maintain the required margin of safety of the system.

Surge pressures should not exceed proof pressure of the fuel subsystem specified in
E.3.4.5.1.5, which states the proof pressure is "2 times the maximum operating pressure."
However, if observed surge pressures are greater than 2 times the operating pressure limit, the
system and component must be qualified to the observed surge pressure. Qualification
includes standard proof pressure criteria of no leakage or permanent deformation.
One atmosphere negative pressure should not collapse the line.
The frequency of pressure pulses should be evaluated for fatigue of tubing and components.
626
JSSG-2009A
APPENDIX E
The rate of closure of control (including refuel, transfer and engine feed) refuel valves should
not cause surge pressures in excess of the proof pressure of the system.
Surge pressures can occur during ground and aerial refueling, and any other time the fuel
subsystem is operating.

Maximum surge pressure for refueling systems. The prediction of the magnitude of pressure
surges in air vehicle fuel subsystems due to high rate fueling and fuel transfer is important in
designing systems which will not exceed the specified maximum proof pressure and also to
determine limit pressures so that lightweight systems can be designed. The analysis of surge
pressures for a particular fuel subsystem should include the air vehicle system and the
characteristics of the piping system external to the air vehicle. This should include ground
trucks, ground hydrant systems, and aerial refueling systems. The number of predicted
pressure cycles should be used to determine the fatigue capability of the tubing.
Pressure surge is a transient flow and has a flow rate that varies rapidly with time. Any
operation which causes a sudden change in flow may initiate a pressure surge wave through
the fuel subsystem. Typical operations in fuel subsystems which should be analyzed for surge
pressure development include:
a. Closing of fuel shut-off valves causing fluid deceleration.
b. Opening and closing of multiple fuel valves simultaneously that occur during system
operation.
c. Closing of check valves. Check valves generally do not have a controlled closure rate,
making them prime sources to generate surge pressures.
d. Parallel operation of fuel pumps.
e. Starting and stopping of fuel pumps.
If fluid was flowing in a pipe and a pipe valve that closed instantaneously, the fluid immediately
next to the valve would have its velocity reduced to zero. If the fluid was incompressible and the
pipe wall was inelastic, then the fluid in the entire pipe would be brought to rest immediately and
the pressure would be infinite. However, fluids are compressible and tube walls elastic;
therefore, the pressure rise is not infinite and the pressure manifests itself as a wave which
starts at the valve and travels up and down the pipe reflecting off the ends.
A method for predicting surge pressure in air vehicles and a method for controlling surge
pressure by the control of valve closure rates is presented in NAVAIR 06-5-504 (Coordinating
Research Council Aviation Handbook – Fuels & Fuel Systems). The analysis has never been
completely correlated with a laboratory test program or an air vehicle fuel subsystem and is
therefore presented only as an approximate solution. Reference SAE ARP1665 and
SAE AS1284 for additional information.
Surge pressures in engine feed and transfer systems. Surge pressures as high as 400 psig
have been observed in engine feed lines as a result of stopping fuel flow during rapid power
reduction. These surge pressures have always required some air vehicle modifications to
reduce the surge or to strengthen the line. In transfer systems, surges are caused by level
control valves closure. In the F-4 air vehicle, the transfer level control valve had a very narrow
627
JSSG-2009A
APPENDIX E
deadband of operation; meaning it opened to allow a small fuel transfer and then closed. At
cruise power, the valve opened and closed about ten times per minute resulting in fatigue failure
of the transfer pumps. Although the peak pressure pulse was only about 30 psig, each pulse
resulted in 5 to 10 bending cycles for the impeller vanes causing early fatigue failure. The cyclic
pressure was prevented by changing the valve so that the valve would not reopen until the fuel
level was reduced considerably.
Ground operation during which a running engine is shutdown by closing the airframe mounted
feed line shut-off valve will result in high negative pressures being imposed upon the feed line
downstream of the closed valve. This line should be designed to withstand a full, one
atmosphere, negative pressure without failure.
A USAF bomber incorporates pilot operated level control valves (LCV) to control fuel into a tank.
There are eight tanks on each air vehicle and two LCVs per tank. Operation of a LCV is
performed by commanding a solenoid to open a flow path from the LCV controller into the tank.
This flow path allows for a pressure difference across a non metallic diaphragm, which provides
an axial force to move a poppet allowing flow into a tank. The pressure on the diaphragm is
provided by supply pressure from the refuel manifold and is controlled by a metering orifice.
The manifold is drained to capture any residual fuel thus increasing usable fuel. Draining of the
manifold is a source of air in the system. The design is such, that whenever air is present in the
diaphragm, back pressure through the metering orifice is reduced since the orifice was originally
sized for JP-8 properties. As the air in the manifold is cleared and fuel flow is established
against the poppet assembly, the force to close the LCV is increased because of the change in
density between air and fuel. However, the air in the controller and diaphragm area has not
cleared and can not provide adequate force to maintain an open position of the poppet. This
change in flow characteristics causes rapid closure of the poppet generating high transient
pressure spikes. The spikes were estimated to be between 650 and 700 psig. The bomber fuel
system was designed for nominal, proof and burst requirements of 120, 240 and 360 psig
respectively. Results of high surge pressure on the fuel subsystem:
a. Ruptured diaphragm--failure of LCV to operate.
b. Refuel subsystem design limits exceeded. The high surge pressure (Over 650 psig)
propagated through part of the refuel subsystem, before attenuating, causing potential
static and durability problems with tubing and component.
c. Vent Subsystem was not designed for a ruptured manifold during ground or aerial
refueling. A Failure Modes and Effects Criticality Analysis (FMECA) was created for a
ruptured refuel manifold component and determined the failure would result in
unrestricted flow into a tank that may exceed the pressure/flow capability of the vent
system. Such a condition would result in fuel tank pressures that would exceed limit
load and ultimate load of the fuel tanks.
d. Corrective action:
1. Ruptured diaphragm: The contour of the poppet assembly was redesigned to allow
a slower transition from full flow to no flow eliminating the rapid valve closure
condition. Additionally, a pressure relief valve was incorporated into the housing
limiting any pressure transients to 95 psig.
628
JSSG-2009A
APPENDIX E
2. Refuel subsystem: Analysis was conducted to determine which components

experienced pressures transients above the design limit. These parts were removed
and replaced with new parts.
3. Vent system undersize: Orifices were installed in the ground and aerial legs of the
refuel manifold to limit the pressure and flow into a tank under failure conditions
equal to the fuel tank structural capability.
Ensure two-phase flow is considered as part of system pressure transient analysis.
Ensure fuel system components are designed to a duty cycle that accounts for all pressure
transient conditions. Adequate residual strength should remain at the end of the expected life to
withstand one worst case pressure transient.
Ensure vent and refuel subsystems are designed to prevent fuel tank damage and rupture
under worst case fuel flow into a tank.
E.4.4.5.1.7 Surge pressure.

Surge pressure levels in the fuel subsystem shall be verified by (TBS) .

Surge pressures are common occurrences in fuel subsystems.

TBS: Surge pressure levels should be verified by analyses, component tests, fuel system test
rig, and instrumented aircraft ground and flight tests. The surge pressures should be monitored
during flight test for further verification.

The ability to conduct surge demonstrations on an air vehicle is very limited due to inability to
obtain sufficient instrumentation in the right location. Therefore, surge pressure testing can best
be conducted on an engineering development fuel subsystem where more instrumentation can
be installed and test conditions can be better controlled. Also, danger of damaging an
expensive test air vehicle is eliminated. After completion of testing on the modeltest rig, a
limited demonstration using nominal conditions, and key instrumentation locations can be
conducted on an air vehicle.
Surge pressure in the engine feed subsystem can best be verified under actual flight test
conditions since it is very difficult to simulate engine response on a simulator. Responsive
instrumentation must be used to measure the surge. Pressure transducers of the strain gauge
type with a response on the order of ten milliseconds have been used with a galvanometer
lightbeam oscillograph of like response. Slow response instrumentation will not measure surge
pressure adequately. Reference SAE ARP1665 for recommendations on surge pressure
testing.
629
JSSG-2009A
APPENDIX E
E.3.4.5.1.8 Thermal expansion relief.

Positive and negative pressure relief for fuel thermal expansion and contraction shall be
provided for all closed plumbing segments of the fuel system.

Thermal expansion of fluid in a fixed volume can cause extreme pressures capable of bursting
the system and rupturing fuel system components and plumbing. Additionally, fuel spills can
create a hazardous condition for maintenance personnel as well as creating an environmental
cleanup problem.

Thermal expansion pressure relief should be required for all closed plumbing segments where
positive and negative pressures greater in excess of than the operating pressure limits could
result. Negative pressure relief should also be considered.

All segments of a system, such as a fuel volume enclosed between two valves, or a tank
compartment closed by a shut-off valve or a check valve, should be reviewed to insure
pressures due to expanding and contracting fuel can be relieved.
E.4.4.5.1.8 Thermal expansion relief.

The incorporation of required thermal relief provisions shall be verified (TBS) .

Generally thermal expansion is verified by fuel subsystem analysis, and component qualification
testing. However, hot weather deployments or tests in climatic chambers should be considered
if there are small margin levels for tank expansion.

TBS: The incorporation of required thermal relief provisions should be verified by analysis,
inspection, and component and system level testing.

Thermal management requirements are creating higher temperature delta conditions for the fuel
subsystems. Thermal expansion relief capability is necessary to prevent rupture of pressure
vessels.
Be sure to evaluate both normal and extreme potential pressure levels (including fuel head
heights). When setting thermal relief values for valves, unacceptable fuel migration can result if
thermal relief values are set too low. Thermal relief capability should prevent damage to the fuel
630
JSSG-2009A
APPENDIX E
system without creating unacceptable system characteristics, such as uncommanded fuel

migration from tank to tank.
E.3.4.5.1.9 External fuel leakage.

There shall be no external fuel leakage from the fuel subsystem during normal operating
conditions including ground (a shore and aboard ship) and in-flight refueling on land and aboard
ship.

External leakage of fuel is always a matter of concern. Although external leakage may not
always be a safety hazard, the presence of fuel odor will cause concern, and may result in
unnecessary maintenance activity to troubleshoot the source. Additionally, fuel can damage
other materials such as asphalt parking flightline aprons, and result in very costly environmental
cleanup activities. Fuel leakage limits for flight operations are specified in NAVAIR 01-1A-35,
Work Package 11.

External leakage should be explicitly prohibited.
The decrease in aromatic content resulted in fuel leakage due to changes in seal swell during
conversion from JP-4 to JP-8. During early fuel seal design activity and material selection,
consideration should be given to new alternate fuels being developed that have a potential of
becoming an operational fuel requirement for the fuel system being developed.
E.4.4.5.1.9 External fuel leakage.

External leakage shall be verified by (TBS) .

Ensure durability requirements based on required, expected operational useful life of the fuel
system (which should be related to the specified useful life of the air vehicle) are included in fuel
sealing requirements.

TBS: External leakage prevention should be verified by analysis, component testing,
manufacture testing, (i.e., production tests, acceptance tests, etc.) and inspection during the
ground and flight tests program.

Fuel leaks can be a major source of creating non-mission-capable conditions for operational air
vehicles. Adequate verification during development can avoid problems for deployed systems.
631
JSSG-2009A
APPENDIX E
E.3.4.5.1.10 Compartment drains and fuel leakage path control.

Compartment fuel drainage, including aerial refueling receptacle installation drainage and probe
bay drainage, and complete fuel leakage paths shall be provided to remove water and fuel
or(due to external leaksage), and any other fluids to a safe location outside of the air vehicle
under ground and flight conditions.

Consideration must be given to the removal of water and fuel leakage from compartments
adjacent to fuel tanks and compartments which contain fuel lines or components in order to
prevent the accumulation of fluids within the air vehicle. Accumulating fluids can cause damage
to fuel cells and surrounding components and equipment due to corrosion or material
incompatibility. This could create hazardous conditions due to fuel vapor concentrations.

Compartment fuel drains and leaakage paths should be installed to remove water and fuel
(present for any reason, but primarily resulting from spillage or leaks) to a safe location outside
the air vehicle. No drained or leaked fuel should be allowed to collect on the air vehicle, other
than in the intended onboard containers. Leakage paths should be coordinated with ventilation
air so that the flow is in the same direction, to increase the overboard movement of leaking fuel
and vapor.
All areas surrounding fuel tanks should be drained to:
a. Remove the fire hazard resulting from any fuel spillage or leakage.
b. Prevent prolonged contact of fuel with external tank surfaces, which could result in
outside exterior activation of nonmetallic fuel cells. Consideration should be given to
ensure the drainage openings will remain open at all times throughout the useful life of
the air vehicle.
All compartments containing fuel components, including tank cavities, should be drained.
Drains should be arranged so that no trapped fluid can accumulate at any place in a
compartment.
In the past, minimum drain hole or tube sizes were 3/8-inch diameter, except for self-sealing tank
cavity drains which were ½ inch.
General considerations for drain systems should include:
a. Drain lines should be as short as possible. There should be no traps in the drain line
where water can collect and freeze.
b. Fuel leakage drain path outlet drains will not be interconnected to fluid seal drains that
are intended to drain a fluid during normal operation of the air vehicle. In general, drains
should not be inter-connected, and their locations should be well marked so that the
drains can be easily found by personnel.
c. Operation of drain valves should be automatic and simple.
d. Fuel should not drain on or near any system that could result in a hazard (i.e., landing
gear where ignition could result from hot brakes, auxiliary power system exhausts,
electronics, etc).
632
JSSG-2009A
APPENDIX E
e. Drains should not be located forward of air scoops or openings where fuel can enter the
air vehicle in flight.
f. Drain size configuration may need to consider Low Observable (LO) design
requirements.

(TBD)
E.4.4.5.1.10 Compartment drains.

The presence and suitability of compartment drains shall be verified by (TBS) .

Drainage provisions should be verified on the air vehicle to ensure proper compliance with the
design requirements.

TBS: The presence and suitability of compartment drains should be verified by analysis,
inspection, and ground and flight test demonstration, as necessary to verify adequate leakage
path control, including flow capacity.

A fluid dye test can be conducted from all drain line discharge points where there may be a
possibility of fuel discharge in flight to determine compliance with the drainage design
requirements. The test should be repeated with flaps extended, bomb bay open, and at the
maximum angle of attack experienced during flight, landing, take off (or catapult and arrestment)
for each source which may be influenced by changes in the air flow and pressure distribution
due to such air vehicle configuration. All drains must be verified to provide positive drainage
throughout all flight regimes. Previous Programs have had issues with no drainage due to high
pressures at the drain outlet.
A low-cost flight test was conducted on the F-16 aerial refuel cavity drain. A balloon, filled with
poster paint, was installed on the receptacle in a manner so that it ruptured when the slipway
opened in flight. The poster paint flowed through the drain and marked the exterior of the air
vehicle. The markings showed that the drainage did not enter an engine compartment
ventilation air scoop.
633
JSSG-2009A
APPENDIX E
E.3.4.5.1.11 Electrical fault and explosive atmosphere.

All fuel subsystem components located in an explosive atmosphere flammable zone shall be
capable of operating without initiating an explosion, including under electrical fault conditions.

Freedom from explosive hazard is a safety requirement required for all components exposed to
an explosive atmosphere located in a flammable zone.

In a flammable zone, explosive atmosphere is ever present or should be assumed to be present
under all operating modes unless special equipment or techniques are applied to ensure
freedom from explosive atmosphere.
Electrically-operated components are a prime source of sparks due to normal operation such as
occurs with switch or relay contacts or due to internal faults. Component housings should be
capable of containing any internal electrical fault without failure of the housing. No internal
explosion should propagate to the outside of the housing or generate an unsafe condition.
Where possible, electrical equipment should be isolated from the fuel to minimize the possibility
of fuel leakage and fuel vapor coming into contact with electrical equipment. A second aspect is
the need for adequate electrical bonding between components and structure such that fault
currents flowing across bonding interfaces do not cause arcing, sparking, or hot spots. Part of
this concern is the possibility of safety wire or other debris being in parallel with the intended
bond path and sharing the fault current. Past testing has shown that limiting voltages across
bonds for available fault currents to 0.1 volts should prevent explosions. The required bonding
resistance should be calculated by dividing the available fault current into 0.1 volts. MIL-STD-
464A can be used as a reference to determine bonding requirements.
There are two design approaches follow to design equipment to operate safely within an
explosive atmosphere:
1) Intrinsically Safe – Where possible (e.g., fuel quantity gauging system components), the
best approach for design of equipment which may operate within an explosive
atmosphere is to have an intrinsically safe design. An intrinsically safe design is one in
which the energy present is not adequate to ignite an explosive hydrocarbon/air mixture.
The typical design value for verification of a design as intrinsically safe is maximum
energy of less than or equal to 0.02 millijoules. This is approximate an order of
magnitude below the minimum ignition energy required to ignite flammable hydrocarbon
vapor in air.
2) Explosive Atmosphere Compatibility – This approach verifies the equipment is capable
of operating in an explosive atmosphere without igniting the vapor. There are three
subsets to this general approach as follow:
a. Verify the system is capable of operating within an explosive atmosphere
without igniting the explosive mixture. (Reference MIL-STD-810, Method 511,
Procedure I [Explosive Atmosphere].)
b. Verify the electrical elements of the equipment are isolated within a housing
which will prevent any ignition of explosive vapor within that housing from
634
JSSG-2009A
APPENDIX E
propagating outside of the housing. (Reference MIL-STD-810, Method 511,

Procedure II [Explosion Containment].)
c. Verify the electrical elements of the equipment are isolated within a
hermetically sealed compartment, such that explosive vapor cannot reach the
electrical elements.
Refer to appendix G, Fire and Explosion Hazard Protection, for further guidance on
requirements for components located in flammable zones.

For components which must contain an internal fault, adequate clearance must be provided
within the housing to insure an arc will not burn a hole or create a hot spot on the housing if fault
occurs. Dry bays adjacent to fuel tanks are considered flammable leakage zones. Even though
these areas are not intended to contain fuel, leaks can occur; therefore, components installed in
these areas should be capable of operating in an explosive atmosphere. Qualification criteria
for equipment located in a flammable leakage zone is different than equipment located in
flammable zones. Equipment in a flammable leakage zone should produce an ignition source
under normal operating conditions. Equipment in a flammable zone should not produce an
ignition source under normal and failure conditions.
One area of concern is the clearance between the stator and the housing for pump electrical
motors. The F-111 used a separate “slow blow” circuit breaker for each of the three phases that
powered the fuel boost pumps. During ground maintenance, the circuit breakers were pulled to
prevent the pump from running. Occasionally, a single breaker would accidentally be pushed in
for a short time. This caused one phase in the pump winding to overheat. The pump would
operate after the damage occurred but later there would be an arc from the winding to the
housing. The slow blow circuit breakers permitted the arc to be sustained long enough to burn
a hole in the housing. Test showed that the arc would not occur if the clearance between the
housing and the stator wires was increased from .030 to .060. The maintenance procedures
were also changed to require collars on the circuit breakers when they are pulled.
E.4.4.5.1.11 Electrical fault and explosive atmosphere.

The ability of the fuel subsystem components to operate, including fail-safe condition, in
explosive atmosphere without initiating an explosion shall be verified by (TBS) .

The capability of components to operate in an explosive atmosphere should be verified prior air
vehicle installation since this is a safety requirement.

TBS: The capability of components to operate in an explosive atmosphere should be verified by
analysis of the electrical circuit if the approach selected is intrinsically safe electrical circuit
design and by component tests if the approach selected is explosive atmosphere compatibility.
Electrical bonding resistance should be verified by test using an electrical bonding meter.
635
JSSG-2009A
APPENDIX E
TBS: The capability of components to operate in an explosive atmosphere should be verified by

component tests. Electrical bonding resistance should be verified by test using an electrical
bonding meter.
Explosive atmosphere testing should be conducted in accordance with MIL-STD-810,

Method 511.2, Procedure I or II, as applicable. Procedure I is for components (sealed or
unsealed) operating in a fuel vapor laden potential fire zone environment without igniting the
environment. Procedure II is intended for determining the ability of equipment cases to contain
an explosion or flame. If explosive atmosphere compatibility is planned to be verified via
hermetic sealing of electrical elements of equipment, that hermetic seal should be verified by
test in accordance with MIL-STD-883, Method 1014.

A fire protection zone analysis is critical to determine the level of protection required for
component qualification. See appendix G, Fire and Explosion Hazard Protection, for further
guidance.
E.3.4.5.1.12 Failure criteria.

A single failure of a component of the fuel subsystem or any other subsystem supplying power
to the fuel subsystem shall not prevent the completion of the air vehicle’s primary mission. Two
failures in the fuel subsystem shall not cause critical structural failure or prevent recovery of the
air vehicle. (TBS) are excluded from the single failure criteria.

The ability for the fuel subsystem to operate with single and double failure should be designed
into the system.

TBS: There are several situations in a system where it may not be practical to provide
redundant components, redundant functions, or redundant flow paths. These items should be
recognized and exempted from a strict interpretation of single failure: fuel tubing, engine feed
shut-off valves, and the aerial refueling deployment mechanism are typically not redundant.
Refer to MIL-STD-1798 for additional guidance on defining various system criticality levels.

Current fuel subsystem designs have assumed that fuel tubing does not fail and therefore
should not be subjected to the single failure criteria. It is not practical to install redundant tubing
in an air vehicle. In addition to the extra tubing, additional valvinges would be required to isolate
each redundant branch from the other and additional sensors would be required to determine
when a branch had failed. The criteria for design, installation, and test of a fuel tube must be
very conservative toconsider the expected usage and environments to ensure tubing and
component integrity minimize the possibility of a fuel tube failure. See MS33611 for suggested
tube bend criteria and scratch tolerance.
636
JSSG-2009A
APPENDIX E
It is not practical to provide a redundant flow path to the engine to overcome a failure of an
engine shut-off valve. The engine shut-off valves are opened prior to engine start and should
remain open until engine shut down. A special safety circuit should be defined to prevent the
valve from moving from the selected position in the event of an electrical short on the valve.
This safety circuit insures the flow path to the engine will remain open during flight.
The only solution to failure of the deployment mechanism of the aerial refueling receptacles is to
provide an additional aerial refueling installation on each air vehicle. Again, this is not practical.
The deployment mechanism should be designed and tested to verify a sufficient high reliability
for mission completion. However, adequate integrity should be considered as part of the
receptacle. Refer to MIL-STD-1798 for additional guidance on ensuring integrity of mechanical
systems.
E.4.4.5.1.12 Failure criteria.

The effects of failure on the fuel subsystem shall be verified by (TBS) .

The fuel system on a weapons system provides critical safety and mission functions.

TBS: The effects of failures on the fuel subsystem should be verified by analyses, fuel system
test rig, ground test, and flight test.

A failure effect demonstration test program should be conducted based upon the result of an
analysis.
Testing on the fuel system test rig should demonstrate critical failure mode operation, health
monitoring, and component fault isolation capability of the system. When the failure effect has
been demonstrated during subsystem tests, the tests need not be repeated on the air vehicle.
The failure demonstrations should be described in the failure analysis report.
E.3.4.5.1.13 Fuel plumbing.

The fuel system manufacturer shall prepare a plumbing document covering the installation of
the fuel system plumbing that defines the following:
1) Tubing alignment criteria,

2) Illustration of plumbing relative to tanks, structure, or subsystem plumbing, and wiring;
3) Description and illustration of clamp types;
4) Fuel plumbing inspection criteria;
5) Special Inspection procedures, where applicable;
6) Design criteria for determining tube wall thickness;
637
JSSG-2009A
APPENDIX E
7) Test Requirements for fuel system plumbing (design verification and build verification);
and
8) (TBS) .

Installation of fuel system planning should be identified and documented to enhance system
robustness and repeatability in the manufacturing process.

Ideally, a program plumbing installation document will be a deliverable item under the program’s
contract, but should at least be available for review by the program office. This document should
be updated after SDD and reviewed for each LRIP/FRP lot and following significant fuel system
design changes.
(TBS): Include any items unique to the air vehicle which have not be addressed by the
previously-listed items.

The B-1 program did not have sufficient test requirements for the fuel system plumbing during
manufacture, leading to an excessive rate of fuel leaks and aircraft refusals at the completion of
assembly.
E.4.4.5.1.13 Fuel plumbing.

The documentation of fuel system plumbing installation shall be verified by (TBS) .

The documentation of fuel system installation must be verified.

(TBS): Provide the method by which the documentation will be verified. Verification should
consist of inspection of the provided document.

(TBD)
638
JSSG-2009A
APPENDIX E
E.3.4.5.1.13.1 Fuel line support and routing.

Fuel line design and routing shall conform to SAE AS18802. Fuel lines should be adequately
supported to prevent deflection beyond (TBS 1), due to internal pressures or flight maneuvers.
Minimum clearance of (TBS 2) inches should be provided to prevent chafing of lines with the
airframe, other lines, wiring, or components.

Fuel line support requirements must be provided to ensure that pipe bending due to induced
loading and deflections/expansion due to internal pressure due not cause the pipes to contact
other aircraft structure, leading to chaffing and eventual failure, causing a catastrophic fuel
leak/fire hazard.

All fuel lines should be routed in the most efficient manner to obtain maximum protection against
battle damage. Where possible, fuel lines should be routed through the fuel tanks to minimize
fuel losses and fire resulting from combat damage or fitment failure. Fuel lines which may be
damaged due to maintenance, cargo handling, personnel traffic, or normal aircraft use should
be protected. Access for maintenance and inspection of line joints of the fuel system must be
provided.
TBS 1 should be acceptable deflection. Table E-III should be used to define maximum support
distances; otherwise, SAE AS18802 criteria should be used. Unlined metal support clamps will
not be used on metal fuel lines.
TBS 2 should minimum clearance between lines and other lines/airframe/components.
TABLE E-III. Fuel line support distance.
Tube Size Maximum Distance between Supports

(Inches) (Inches)
1 and smaller 24
1¼ to 1¾ 27
2 31
2½ 33
3 34½
4 37½
5 and over 40
639
JSSG-2009A
APPENDIX E

(TBD)
E.4.4.5.1.13.1 Fuel line support and routing.
The adequacy of fuel line support and deflection tolerances shall be verified by (TBS) .

This is a safety of flight requirement that necessitates rigorous verification. Fuel lines deflecting
and chaffing on aircraft structure have led to numerous fuel leaks and fire incidents.

(TBS): the means by which this requirement will be verified must be provided. Static load
testing on an “iron bird,” as well as computer modeling of structural deflections due to flight
maneuvers and tubing pressurization, should be considered.

(TBD)
E.3.4.5.1.14 Subsystem isolation.

Each refueling subsystem (including any associated manifold) shall be capable of being isolated
from the fuel pressure resulting from the normal operation of the air vehicle's fuel subsystem or
any other refueling subsystem. For those designs where manual activation is required to provide
the isolation, the manual activation shall be capable of being initiated by (TBS) .

This is an integration, operational, and safety requirement. Damage or breakage to any
refueling subsystem (including any associated manifold) must not interfere with the proper
operation of the air vehicle's fuel subsystem and any other refueling subsystem (including
aerial) installed on the air vehicle. Fuel pressure resulting from normal operation of the air
vehicle's fuel system must be isolated from the refueling subsystem(s). In addition, if the air
vehicle incorporates multiple refueling subsystems, they must be isolated from each other so
that damage within one subsystem will not prevent the ability to use the other subsystem(s)
safely and complete the aerial refueling process successfully.

TBS: Specify which crew or aircraft service support member(s) should be provided this
capability.
640
JSSG-2009A
APPENDIX E

Isolation has typically been accomplished by either a check valve or by a manually or motor
operated control valve. If a motor operated control valve is used, consideration must be given
for a manual override and access to the valve so that a single failure of the valve will not prevent
the capability to refuel the air vehicle.
E.4.4.5.1.14 Subsystem isolation.

The ability to isolate each refueling subsystem from the air vehicle's fuel subsystem and any
refueling subsystem shall be verified by (TBS) .

It should be verified that each refueling subsystem can be isolated from the air vehicle's fuel
subsystem and any other refueling subsystem to ensure that no single failure hazards are
introduced to the air vehicle, that single failures do not compromise the proper operation of the
air vehicle's fuel subsystem, and that single failures do not prevent the air vehicle from safely
and successfully refueling from any other refueling subsystem.

TBS: Specify ground demonstration and test of each refueling subsystem.

The ground demonstration should simulate failures of the various refueling subsystems to verify
that one subsystem can be isolated from the other and the air vehicle’s fuel subsystem. If
manual activation is provided for any isolation feature, that capability should be verified along
with the adequacy and accessibility of the activation method.
641
JSSG-2009A
APPENDIX E
E.3.4.5.2 Engine feed
E.4.4.5.2 Engine feed
E.3.4.5.2.1 Engine fuel feed interface.

The interface parameters (TBS) which affect engine operation shall be required between the
air vehicle fuel subsystem and the engine.

The primary function of the fuel system is to provide fuel flow to the engine. To do this, the
critical physical connection(s), and fuel pressure, temperature, and flow conditions should be
defined.
The required interface parameters should be specified in the engine and airframe Interface
Control Document (ICD).
TBS should be filled in with the following suggested interface parameters.

a. Physical:
1. Connection type and size
2. Connection loads
3. Connection location(s)
b. ICD conditions:
1. Primary and alternate fuel(s)
2. Temperature (Maximum, Minimum)
3. Pressure (Maximum, Minimum)
4. Flow rate (Maximum, Minimum)
5. Flow rate maximum. rate of change
6. Vapor liquid ratio (V/L) (Maximum)
7. Fuel contamination (Type, Size, Quantity)
8. Engine heat rejection loads
The determination of the engine fuel flow and pressure requirements involves:
The fuel subsystem should supply the required amount of fuel at the required pressures for
operation of the engine throughout its complete operating range including starting and
augmentation, with the following conditions on the engine:
a. Minimum fuel temperature corresponding to a fuel viscosity of 12 centistokes, to a
specified maximum.
642
JSSG-2009A
APPENDIX E
b. Fuel pressure from true vapor pressure of the fuel plus 5 psig to 50 psig (relative to the
atmosphere), with a vapor liquid ratio of zero. This should be tailored and control by
engine ICD.

During the initial years of WW II, it had been recognized that Net Positive Suction Head (NPSH),
commonly used in the commercial pumping industry for single boiling point fluids, was not
adequate to define the possible two-phase condition that could be generated in air vehicle fuel
systems using wide boiling range hydrocarbon fuels. Hence, the Coordinating Research Council
(CRC) was asked to advise on the DoD on this matter and subsequently provided a section to
the CRC Handbook on Vapor Lock (January 1946 edition) which presented the means for
predicting Vapor-Liquid ratios in dynamic fuel systems using hydrocarbon fuels.
Requirements for turbojet powered air vehicle that limited air vehicle fuel delivery systems to
3 and then subsequently 4 inches of mercury line drop (tank to engine inlet) at a specified flight
altitude, usually 6000 feet, and at the specified engine power setting identified in the engine
model specification. The objective of this requirement was to create a worst case situation, “No
assistance from tank boost pumps”, at a nominal to high power setting. This led to conclude that
the vapor-liquid ratio (V/L) parameter should be used as the design criterion for the condition of
fuel at the air vehicle and engine interface.
The emergency “no assistance from the air vehicle boost pumps” interface fuel condition in
MIL-E-5007 was established at 0.45 V/L. This value was established on the basis of the
calculated V/L for a single engine fighter using high vapor pressure Aviation Gasoline at
6000 feet fuel tank altitude, 110°F fuel temperature and 4 inches of Hg line loss (tank to engine
inlet), at a specified engine power level (fuel flow rate) plus a safety margin. Turbo propeller
powered air vehicle specifications, usually cargo type, specified a V/L requirement of 0.30
because of the difference in performance needs. In later years the use of lower vapor pressure
fuels (primarily JP-4) did ease the need for high V/L capabilities at the airframe and engine fuel
system interface; however, retention of the 0.45 and 0.30 V/L values is considered justifiable for
safety and return flight margins after battle damage with air vehicle power and support sub-
systems inoperative.
In modern fighter air vehicle, the fuel is used as the heat sink for many of the air vehicle
subsystems. In these systems, it is impractical to design for “no assistance from the air vehicle
boost pumps” because the fuel temperatures in many cases are above 200°F. In these designs,
adequate redundancy of pumps and power sources must be provided to prevent loss of pump
operation.
E.4.4.5.2.1 Engine fuel feed interface.

The fuel subsystem engine interface shall be verified by (TBS).

Due to the safety nature of the requirement it should be verified.
643
JSSG-2009A
APPENDIX E

TBS: The fuel subsystem engine interface should be verified by fuel system simulator test and
air vehicle ground and flight tests.
The performance of the engine feed subsystem for normal operation should be verified by test.
The following critical parameters should be defined for the test:
a. Engine power setting. - Determines the fuel flow rate.
b. Altitude range for test.
c. Maximum fuel temperature.
d. Reid vapor pressure of test fuel.
e. Fuel filter condition (if applicable) impending by-pass.

(TBD)
E.3.4.5.2.2 Fuel availability.

Fuel shall be available to the engine(s) on an uninterrupted basis under all air vehicle ground
and flight conditions including (TBS) .

The primary function of the fuel subsystem is to deliver fuel to the engine(s). The key words in
the requirement are “uninterrupted” and “under all air vehicle ground and flight conditions.” The
air vehicle fuel subsystem must be extremely reliable and assure that fuel is always available to
power the engines, throughout any flight maneuver.

Fuel availability to the engines should be required for all conditions in the air vehicle’s
operational envelope and known extreme conditions.
TBS should be filled in with consideration given to the following conditions ([percent] refers to
total feed tank fuel at the end of maneuver):
a. Normal ground attitude (1 percent)
b. Take off attitude including shipboard operations (2 percent)
c. Level flight attitude (landing pattern condition, low gross weight, low airspeed, low altitude)
(1 percent)
d. Landing attitude (touchdown) (2 percent)
e. Maximum pitch attitude expected during climb out and landing (20 percent)
644
JSSG-2009A
APPENDIX E
f. Maximum rate of climb with corresponding attitude (20 percent)
g. Maximum rate of dive with corresponding attitude (10 percent)
h. Maximum roll with corresponding attitude (20 percent)
i. Negative “g” conditions required by defined missions (10 seconds, maximum power,
20 percent)
j. Low or zero “g” flight required by defined missions
k. 90 zoom (20 percent)
l. 90 dive (10 percent)
Fuel flow requirements should be determined by the most critical air vehicle flight conditions
which affect the sizing of lines, rating of pumps, power consumption, valves, and the general
system configuration. The high speed conditions at different points in the altitude spectrum, and
the maximum rate of climb at any point in the altitude envelope, should determine the critical
flow requirement.
a. Negative and zero “g”. Most air vehicles experience periods of flight at negative “g”. Fighter
air vehicles are typically required to endure negative “g” flight for 10 seconds at maximum
afterburner (AB) fuel flow and up to 30 seconds at maximum military fuel flow. This
capability has been justified for inverted flight during aerial combat and aerobatics in which
air vehicles can be required to endure this condition for up to 30 seconds or more.
Additionally, research and other specialized air vehicles may be required to endure periods
of flight in nearly zero “g”. There has been no standard approach developed for bomber
and transport air vehicles.The ten-second negative “g” requirement at the maximum engine
fuel flow should be recommended for fighter type air vehicles unless or until mission
analysis justifies a change. For bomber and transport air vehicles, negative “g” should only
occur under emergency type conditions which are extremely difficult to predict and define.
b. Multi-engine feed independence. In multiengine air vehicles, it should be possible to cut off
fuel flow to any engine without affecting the flow to the remaining engines. When the fuel
flow to any engine or combination of engines is cut off, it should be possible to use fuel
from any fuel feed tank and transfer tank for the remaining engine(s). A separate feed tank
and separate feed lines for each engine is desirable. It may be cost effective on two engine
non-combat air vehicles to use one main feed tank for both engines, but the feed systems
should be independent.
Engine feed and transfer system reliability is improved by using the least number of operating
components in the line between the tank and the engine, and by minimizing the effects that a
component malfunction can have. It is also important to minimize influences external to the fuel
subsystem by:
a. Locating the feed line where it can be protected from maintenance induced damage,
gunfire, material thrown by the landing gear, and other equipment failures.
645
JSSG-2009A
APPENDIX E
b. Locating as many of the other fuel lines as possible inside of fuel tanks, and by using plug-
in components to minimize fuel tank entry, to minimize the effect of leakage and fuel
subsystem disassembly. Special attention must be paid to equipment outside the fuel tank
that covers a plug-in component. That equipment should be designed to minimize the
effort required to unplug the item. In particular, the functional checkout after reassembly
should be minimized.
c. Providing alternate sources of electrical or hydraulic power.
d. Using components that are resistant to fouling by contaminants (including ice).
e. Locating suction feed outlets close to the engine feed shut-off valve to minimize points of
possible air ingestion during suction feed.
Under some transient conditions, the fuel pressure at the engine connection may fall below
normal for a few seconds, but the system should be capable of full and rapid recovery without
degrading engine performance. Within the allowable air vehicle and engine operating envelope,
the fuel subsystem should not limit air vehicle performance or cause engine malfunctions,
especially when transitioning from boost “on” to boost “off” feed mode.
Systems have been produced where a normal air vehicle maneuver or a normal control function
momentarily interrupts flow to the engine. One example is on the Airborne Laser Laboratory air
vehicle. When switching to engine feed from the body fuel tank, air inclusion in the body tank
tubing caused momentary engine power roll back. Another example occurred on the F-105.
When feeding the engine from the aft fuel tank in a prolonged nose down attitude of the air
vehicle, the uncovered boost pump resulted in fuel starvation of the engine even though there
was considerable fuel aboard the air vehicle. The primary difficulty in the design of the engine
feed subsystem is to define reasonable extreme limits of operation such as attitude,
temperature, and rate of change of altitude and flow demand.
Main tank feed pumps should be located in a baffled bay (hopper) which allows fuel to flow into
the bay through check valves that prevent fuel from flowing out of the bay during a low fuel level
attitude change. The B-52 G and H models had numerous cases of engine flameout due to the
main tank pumps not being located in baffled bays. This resulted in uncovered pumps during
low fuel conditions.
a. Negative and zero “g”. The B-2 fuel subsystem design started with an arbitrary requirement
of ten seconds at negative “g”. The fuel subsystem contractor proposed gravity activated,
double ended inlets to meet this requirement. A mission analysis was conducted to define
the requirement and it was determined that it was not possible for the B-2 to be subjected
to a single duration of ten seconds at negative “g”. The requirement was conservatively
estimated to be three seconds. The boost pump inlet design was modified to meet the
three second requirement.
b. Multi-engine feed independence. The early F-4’s had a common pumping system into a “Y”
connection which fed both engines. The arrangement allowed several twin engine
flameouts to occur.
646
JSSG-2009A
APPENDIX E
E.4.4.5.2.2 Fuel availability.

Fuel availability to the engines on an uninterrupted basis under all air vehicle ground and flight
conditions shall be verified by __(TBS)___.

Verification of fuel availability should be considered a safety critical condition.

TBS should be filled in with analysis, simulator tests, ground, and flight tests. Fuel flow
performance of each engine feed subsystem should be verified. A performance analysis of the
fuel and transfer subsystem should be conducted including all single and multiple failures
affecting fuel subsystem operation. The test program should be a demonstration of the analysis
by test in a test rig and in the air vehicle. The test rig should include at least one actual engine
fuel pump and it should include provisions to simulate fuel return from the engine to the pump
inlet, if applicable. Also, on air vehicles where hot fuel is returned from the engine to the tank,
that system should also be included.
Fuel flow during negative or zero “g” should be verified by component bench tests and flight
tests. An “inverted flight box” test can be used to simulate encountering negative “g” conditions
and trapped air release to evaluate negative “g” recovery. Testing should continue beyond the
required period of negative “g” to demonstrate that the system can recover to the positive “g”
flight mode.
Fuel subsystem simulators have proven to be an effective way to integrate and test a fuel
subsystem. The simulator can be a total fuel subsystem simulation for smaller fighter type air
vehicle and rotary-wing air vehicles or a half system for simulation of larger symmetrical bomber
and transport type air vehicles.
The use of a simulator allows early identification of design errors in functional components and
in system routing prior to the availability of an actual airframe. Corrections can be made to the
hardware and the hardware available for installation into the number one air vehicle without a
delay in the program. The fuel subsystem simulator will provide a high degree of confidence for
correct operation of the fuel subsystem on first flight.
Simulators have been produced which have a simulated altitude capability, simulated
temperature capability, both hot and cold, and attitude capability, pitch and roll.
A fuel subsystem simulator requires engineering judgment to define the extent of simulation that
is practical. The exact duplication of the air vehicle is not always practical or possible. The fuel
tanks are generally of a steel construction or of heavy aluminum plate for improved strength to
allow pressure to the extreme limits without fear of failure. As a result the exact mold lines of
the air vehicle skins may not be achieved and some very precise measurements for fuel
gauging accuracy may not be possible. It is recommended that the fuel subsystem be treated
as an engineering development tool. It is not cost effective to use air vehicle production quality
control procedures to inspect and control the simulator. The simulator should not be viewed as
647
JSSG-2009A
APPENDIX E
the primary method to qualify the fuel subsystem; however, the data and test results should be
reviewed using engineering judgment for its applicability to the qualification process.
Verification of fuel availability should be by a combination of tests on a fuel subsystem simulator

and air vehicle tests. Critical attitudes and extreme temperatures can be best established and
held on a simulator. Dynamic conditions such as rate of climb, rate of roll, or uncoordinated
maneuvers can best be tested during air vehicle flight test. Careful attention should be given to
defining critical combinations of test conditions including failure conditions.
E.3.4.5.2.3 Flow performance.

Fuel flow performance of each engine feed system shall provide (TBS 1) of the maximum
fuel consumption of the engine plus one additional engine at (TBS 2) power condition, if
multi-engine, plus any fuel flow required for cooling purposes or motive flow for jet pumps.
Fuel flow requirements vary with airspeed, altitude, gross weight, air vehicle configuration, and
other variables.

TBS1 and TBS 2 should be filled in with consideration given to the following:
For single engine air vehicles the feed system should provide flow for 100 percent of the
maximum fuel consumption of the engine in addition to any fuel flow for Auxiliary Power Unit
(APU) operation cooling purposes and motive flow for fuel driven pumps. This condition should
be analyzed for all operating conditions including steady state and transient conditions.
For multiple engine air vehicles, a feed system should provide flow for crossfeed of at least one
additional engine at full power; therefore, the engine feed system should provide a minimum of
200 percent of the maximum fuel consumption of the engine plus any fuel flow required for
cooling and motive flow.
Engine crossfeed. The engine feed system for each engine should be capable of supplying fuel
to any other engine on the air vehicle. The capability of supplying fuel from any tank to any or
all engines is a desirable feature on a multiengine air vehicle and for a single engine air vehicle
from any tank to the engine.
Tank to tank transfer should be a separate subsystem from the engine feed system.
Potential growth fuel flow should be included in determining flow performance. Fuel flow growth
for transport type air vehicle is a real possibility. Ten to fifteen percent growth should be
considered.
648
JSSG-2009A
APPENDIX E
Engine crossfeed and cross transfer. In systems where fuel must be transferred from a transfer
tank or auxiliary tank to a main tank before delivery to the engine, failure in the main tank or
damage to the main tank results in loss of even greater quantities of fuel. Fuel trapped in
transfer tanks can also cause center-of-gravity (c.g.) problems as fuel in the other tanks of the
system is used. Transfer and crossfeed capability provide greater system flexibility. The
transfer capability should be available after a single failure. It may not be practical to maintain
an engine crossfeed in the afterburner mode; therefore, an expected level of engine
performance should be specified in the requirement.
Transfer systems in which fuel from more than one tank is transferred at the same time should
be designed to be insensitive to the effect of unequal performance of the transfer pumps. In a
common transfer system, the pumps of the same part number design can operate at slightly
different output pressure. The pump with the higher operating pressure can dominate and
supply all of the flow, especially at low flow rates, and may cause an undesirable transfer tank
depletion sequence.
E.4.4.5.2.3 Flow performance.

Fuel flow performance of each engine feed subsystem shall be verified by (TBS) .

Engine feed flow performance should be considered safety and mission critical.

The flow performance of each engine feed system should be verified by analyses and tests on a
simulator and during flight tests.
For multi engine air vehicles, crossfeed of the engine(s) on one side of the air vehicle from the
fuel tank(s) on the opposite side of the air vehicle should be verified by a flight demonstration or
a fuel subsystem simulator for extreme attitudes and on the air vehicle during flight tests for
normal operations. The critical conditions for the demonstrations should be identified by an
analysis of the subsystem and the mission profiles.
Both, fuel temperature and altitude, as well as rate of change of altitude, have a great effect on
the ability of the feed system to deliver fuel. These critical parameters should be clearly stated in
the test procedures. Flow performance tests should be conducted in association with fuel
availability tests and be practical in respect to air vehicle altitude.
649
JSSG-2009A
APPENDIX E
E.3.4.5.2.4 Emergency feed.

The engine feed subsystem without normal boost pump(s) operation shall provide fuel to the
engines operating at (TBS 1) power settings for altitudes up to (TBS 2) feet with fuel
temperatures of (TBS 3) .
Most military air vehicles use power boosted fuel feed systems for normal operation except for
some Army rotary wing vehicles which use suction systems during normal operation. Since any
power system can fail, it is necessary to be able to start and operate the engines following any
failure affecting boost pump operation. The fuel quality in relation to V/L ratio must be within the
interface requirements of the engine.

TBS 1 should be filled in with the proper power rating.
TBS 2 should be filled in with a minimum of 10,000 ft.

TBS 3 should be filled in with a minimum of at least 120°F.
For any single failure in the feed subsystem, the subsystem should provide sufficient fuel flow to
maintain take-off power to a minimum altitude of 10,000 feet with a fuel temperature of at least
120°F. If a higher temperature is predicted as a result of ground operation or solar heating, the
higher temperature should be used.

The principal factors affecting the suction feed capability are the Net Positive Suction Head
(NPSH) requirement of the engine pump at the engine connection, type of fuel, and fuel
temperatures. The expected performance under specified failures should be established in
terms of power setting of the engine altitude that must be obtained, fuel temperature and the
number of failures which should be considered. Dual failures must be considered and specified
in a design which contains dual boost pumps, a boost pump with tank pressurization, or a
crossover system. Fuel temperature, fuel vapor pressure, fuel head and the condition of any
fuel filters in the system have an influence on the suction feed capability of a system.
The flow path from the fuel tank to the engine is critical. Bubble collection high points should be
eliminated. If the engine is taken to a high power setting on suction feed, air bubbles will form in
the fuel. When the fuel flow is reduced, the air bubbles will collect in any high pockets in the
line. When the fuel flow is again increased, the collected bubble (one large bubble) will
eventually be washed downstream into the engine.
The F-15 uses engine fuel flow to cool hydraulic and airframe mounted accessory drive oil
systems. It was observed that the low pressure levels during suction feed operation were
incompatible with the high fuel temperatures resulting from oil cooling. As a result, an
emergency boost pump was added to provide the necessary fuel pressure when the main boost
pumps are inoperative.
650
JSSG-2009A
APPENDIX E
Pressure drops through emergency feed lines are a critical parameter to consider when defining
requirements. Changes in altitude during emergency feed conditions should also be
considered.
E.4.4.5.2.4 Emergency feed.

Emergency feed subsystem performance shall be verified by (TBS) .

Simulated flight conditions for emergency feed conditions should be used to define test
conditions.

TBS: The feed subsystem performance should be verified by analysis, demonstration, and
component test. The test parameters of critical fuel temperature, vapor pressure of the test fuel,
and, if there is a filter or strainer in the engine feed path, the condition of the filter or strainer
(clean or dirty) should be specified.
The critical test parameters can best be established and repeated on a system simulator. A
number of test runs are generally required to prove repeatability. Flight demonstrations can be
conducted at conditions which are not necessarily the most critical for data comparison with the
simulator tests. An emergency back-up system should be tested to verify performance. A test
of an emergency system which does not include all of the elements of that system is of limited
value.
E.3.4.5.2.4.1 Priming.
The fuel subsystem, where suction feed is the normal operation, shall provide the capability for
priming, as required by the engine(s) and APU with fuel from (TBS) . The fuel subsystem
shall be designed to prevent loss of engine feed system prime in the event of an engine(s)
shutdown.

Priming of a system that uses suction feed as a means of engine or APU feed should be
considered a safety critical function.

TBS should be filled in with aviation turbine fuels from –65°F up to 135°F and possible extreme
transient conditions with fuel up to 160°F. However final temperatures should be based on a
thermal analysis of the expected usage.
651
JSSG-2009A
APPENDIX E

Some unmanned air vehicles have had engine performance problems because of suction feed
of high vapor pressure aviation gas.
E.4.4.5.2.4.1 Priming.
The capability of the fuel system to prime the engine(s) and APU shall be verified by (TBS) .

Priming of a fuel system that relies on suction feed for normal operation should be verified to
ensure high levels of integrity.

TBS should be filled in with analysis, fuel subsystem testing and flight testing with air vehicle
turbine fuels at design fuel temperatures and ambient pressure extremes.

The B-2 uses suction feed as a back up to engine feed. Contaminated fuel caused blockages in
the heat exchanger on the flow path to the engine. Because of this contamination, the system
went into suction feed. Fuel system simulator testing simulated the loss of pressurized flow and
confirmed suction feed performance prior to incorporating the design on the aircraft.
E.3.4.5.2.5 Feed tank available fuel.

The fuel feed tanks shall provide at least (TBS) percent available fuel at the normal landing
attitude and power setting.
The feed tanks are the last tanks in the air vehicle to empty and the maximum available fuel
should be provided in the landing attitude.

TBS: The main fuel feed tanks should have at least 99 percent available fuel at the normal
landing attitude and power setting. For fuel transfer tanks, including external tanks, at least
99 percent fuel availability at cruise attitude should be used as a design goal.
The flight profiles in the landing sequence involve both nose down and nose up conditions,
steep turns, as well as positive and negative accelerations and uncoordinated maneuvers (such
as side slip). The system design must consider all these forces acting on the fuel in order to
insure a steady flow of fuel to the engines and maximize the available fuel. The available fuel
652
JSSG-2009A
APPENDIX E
for each main feed tank is all fuel down to the first evidence of flow interruption under
reasonably expected feed conditions during the landing sequence. A good main tank design
can achieve an available fuel quantity of 99 percent (less than 1 percent is unavailable). The
goal of the designer should be to minimize unavailable fuel; however, specifying a requirement
for available fuel greater than 99 percent could impose a cost or weight penalty on the tank
which cannot be justified. The unavailable fuel trapped in transfer manifolds need not be
considered for the main tank. Fuel should be drained from transfer and refueling manifolds and
made available to the engines to minimize the weight penalty to the air vehicle.
E.4.4.5.2.5 Feed tank available fuel.

The availability of fuel from the main tank(s) down to the point of flow interruption shall be
verified for flight attitudes including approach and landing by (TBS) .

Engine feed should be considered a safety critical function.

TBS should be filled in with analysis, fuel system simulator rig tests, and air vehicle ground test.
This testing can be combined with other necessary testing such as fuel tank and fuel gauge
calibration or c.g. travel testing. Ground tests of the air vehicle should be positioned in the
desired approach and landing attitude and fuel pumped down until the fuel pressure falls below
the required engine interface requirement. The fuel remaining at this time is unavailable.
E.3.4.5.2.6 Engine fuel line shut off capability.

Each engine fuel line shall have an emergency fuel shut off and in-flight reopen capability.

The pilot must have the capability of stopping fuel flow into the engine compartment.
Emergency shut off (commonly called fire shut-off valve) which can change position when an
electrical fault occurs cannot be tolerated in the fuel subsystem, especially in the engine feed
system.

An emergency shut off (commonly called fire shut-off valve) should be provided close to, but not
in, the engine compartment to minimize fuel entering into the engine compartment fire zone
after activation of the valve. The valve should be capable of being reopened from the cockpit.
Engine shutoff and reopen time requirements are derived from engine fire protection and engine
feed requirements, respectively.
653
JSSG-2009A
APPENDIX E
Preference for type of actuation such as electrical, cable, or pushrod operation may be
indicated. Electrically operated valves have typically been used in the current generation of air
vehicles. Electrical valves should be of a fail safe design to prevent uncommanded closure in
the event of a short circuit or mechanical forces.
Some installations may require both a tank shut off and a valve and a fire shut-off valve to
minimize the quantity of fuel which can drain into the engine compartment after the valve is
closed and to minimize the length of unprotected line which can drain the tank if the line is
broken.
The crew systems and human factors engineers should be interfaced with when establishing the
location, actuation, and knob selection of the emergency fuel shut-off control in the crew station.
The marking of the emergency fuel shut-off control should be coordinated with crew system
design engineers. A fail safe circuit should be incorporated for each valve. Ground operation of
the valve should also be considered in establishing its location. In many cases, the valve is
used for shutting off fuel to the engine during maintenance operations. Also, it is desirable for
firemen to be able to shut off flow for a crashed air vehicle. For multi-engine air vehicle, the
manual operation should be clear to the ground personal. All valves should require similar
operation; for example up for open; down for closed.
The shut-off valve should be located out of engine rotor burst zone. It should be able to cease
fuel flow upstream of the rotor burst zone.
External markings should be placed on the air vehicle to identify to the ground fire crew where
to access the emergency shut off valve(s).

A fail safe circuit diagram is illustrated in MIL-V-8608A, Amendment 2. There have been
numerous engine flameouts on Air Force air vehicles as a result of valves closing due to
electrical shorts. As a result of these incidents a failsafe wiring circuit was developed. This
wiring diagram was published in MIL-V-8608. This failsafe circuit has proven to be very
effective in eliminating uncommanded valve closures.
Fuel shut-off valves flow control. The valve should have the capability to shut off or open fuel
flow.
There are several design features which should be considered for inclusion into the design of a
shut-off valve, as follow:
a. Position indication
b. Manual override capability
c. Replaceable actuator as subassembly
It is very beneficial to be able to determine visually the open or closed position of a valve without
disassembly of the valve or relying on observation of flow. An external position indicator should
be provided.
Manual override, the ability to open or close the valve without the use of electrical power, is a
very desirable design feature for maintenance actions. Some existing designs have used the
override lever to also provide a valve position indication. The manual override feature should
provide the ability to completely close or open the valve.
654
JSSG-2009A
APPENDIX E
The actuator can be integral to a component or can be attached as a subassembly. Since

actuators are a predominant mode of failure of a fuel valve, actuators provided as a
subassembly which can be replaced without removing the valve body from the fuel flow path
can improve the maintainability of the system. The B-52H air vehicle has eight fuel shut-off
valves located between the engine and the fuel tank. Two different valve types made by
different manufacturers are being installed in the air vehicle interchangeably. With a failed
actuator the repair job may be a small or a major job depending on the valve which is installed.
When the defective valve is the preferred one, then usually all that is required is replacement of
the motor assembly. When the installed valve is the non-preferred item, then a relatively long
and tedious process of defueling the fuel tank and removing and replacing the entire valve
assembly is required.
As a result of F-16 air vehicle uncommanded loss of thrust events, a series of modifications
were made to the air vehicle fuel shut off-valves. It became apparent the need to test the fail
safe mechanism of the valves with and without applied mechanical forces. In specific, we
should test for the effect of natural and induced environments such as vibration or other
extraneous forces normally encountered in service in combination with electrical failure.
E.4.4.5.2.6 Engine fuel line shut off capability.

Emergency fuel shut off capability shall be verified by (TBS) .

Testing and operation of the shut-off valve and fail safe mechanism is required during
component test, simulator rig test and during ground test to assure safety of flight. Closing of
the fire shut-off valve during high fuel flow conditions can result in high surge pressures in the
airframe fuel lines and in very low pressure in the engine fuel lines.

The operation of emergency shut-off valves should be verified by component tests, simulator
test and air vehicle ground test. Valves should be tested for fail-safe features with and without
applied mechanical forces.
The emergency shut off should be demonstrated under the maximum fuel flow likely to be
encountered with pressure instrumentation in both the airframe and engine fuel lines. The
operation of a fail-safe feature for fuel valves should be verified by component tests.

A MIL-V-8608A valve was used as the main engine fuel-shut off valve in the F-16. While looking
into a problem involving uncommanded loss of engine thrust, it was discovered through
component testing that the valve could migrate from an open position to a closed position given
a loss of electrical power to the valve coupled with mechanical forces; that is, fuel flowing
through the valve and the valve experiencing the vibration spectrum for this particular
installation. The MIL-V-8608A specification did not require the valve to be designed to protect
against such a condition. The lessons learned from the F-16 installation indicates that the
655
JSSG-2009A
APPENDIX E
valve’s typical application would require that the valve not change position due to an electrical
failure or due to mechanical forces and have the valve tested accordingly.
E.3.4.5.3 Auxiliary power unit (APU) or jet fuel starter (JFS) interface.
The interface parameters shall be required between the air vehicle fuel subsystem and an APU
or JFS: (TBS) .

The airframe fuel subsystem normally provides fuel for the APU’s and JFS’s. In order to ensure
fuel flow and pressure interface requirements are met, physical connection(s), fuel pressure,
temperature, and flow conditions should be defined. The critical physical connection and flow
conditions should be specified.
TBS: The required interface parameters should be specified. Steady state, transient conditions,
natural, and induced environments should be considered when defining APU or JFS interfaces.
The following parameters from Appendix C, “Auxiliary Power Subsystem”, should be suggested:
a. Physical.
2. Connection loads
3. Connection location
b. Fuel conditions.
1. Flight operable (yes, no)
2. Altitude start and run
3. Temperature (maximum, minimum)
4. Pressure (maximum, minimum)
5. Flow rate (maximum)
APU and JFS functions may have unique operating conditions that include cold soaked
conditions as well as short operating times.
E.4.4.5.3 Auxiliary power unit (APU) or jet fuel starter (JFS) interface.
The fuel subsystem interface with the APU or JFS shall be verified by (TBS) .
APU and JFS interfaces can be a safety or mission critical function.
656
JSSG-2009A
APPENDIX E

TBS: The fuel subsystem interface with the APU or JFS should be verified by analysis, ground,
and flight demonstrations tests.

APU ground simulation labs have been successfully used to reduce risk during production.
E.3.4.5.4 Fuel management.

The fuel subsystem shall provide for normal transfer of all fuel to the engine(s) without action by
the crew to control sequencing, fuel c.g., or operation of pumps. Fuel management shall not
allow the air vehicle c.g. to exceed safe operating limits. The fuel subsystem shall
provideconsider control for thermal management when fuel is used as a heat sink. Priorities of
the fuel management system shall be included in the design.

The desired degree of automation for control of the subsystem should be specified. This is a
flight critical function and its integration affects air vehicle safety. Priorities of the fuel subsystem
must consider criticality levels.

The degree of automation has a large impact on subsystem design and crew workload. The
fuel management system should not permit a shift in the fuel c.g. which will allow the air vehicle
to exceed the safe operating flight envelope dictated by the flight control system. Fuel
management as a result of transfer, fuel depletion, or loading, should not allow the air vehicle
c.g. to exceed safe operating limits. Fuel management systems should satisfy the following
basic criteria:
a. Simplicity. This begins with the design and arrangement of the fuel subsystem itself, such
as locating tanks to provide gravity feed and transfer, or sequencing tanks by using tank
pumps having a different pressure. As the fuel subsystem becomes more complex. More
control functions should be imposed, making the subsystem less reliable.
b. Automatic operation. The fuel subsystem design should be such that minimum attention
of the crew is required. For air vehicles operated by a single pilot the fuel feed and
transfer subsystem should provide for automatic transfer of all fuel to the engine feed
tank(s) without requiring any action by the pilot to control sequencing, fuel c.g., or
operation of pumps. Automation of operations eliminates the problem of slower human
response times and air vehicle survivability is enhanced if the crew’s attention is not
diverted unnecessarily to fuel management. The level of automation for fuel transfer
should be coordinated with crew systems and human factors engineers. For air vehicles
operated with a second pilot or a flight engineer, a semiautomatic system may be used
where the crew members provide control for tank sequencing, pump operation, and
crossfeed. The system should not require any immediate crew attention or action for
normal flight conditions.
Transfer pump(s) should be shut off automatically when the tank is empty.
657
JSSG-2009A
APPENDIX E
c. Minimum effect on flight control. Fuel depletion from multiple tanks should be managed to
control c.g. shift within established limits for the balance of the air vehicle. The fuel
management subsystem should consider failure modes of the subsystem as well as all
expected loading and flight conditions. Supersonic flight may require a programmed shift
in air vehicle c.g. due to the change in the center of lift of the air vehicle.
d. Redundancy. The fuel management subsystem itself should incorporate redundant
features to allow for some degree of continued functional control of the fuel subsystem in
the event of fuel management failure. The engine feed and transfer subsystem should
provide two independent and isolated methods of moving fuel out of each feed tank on the
air vehicle, except for jettisonable external tanks where only one method is required.
The design approach should meet the fuel subsystem criteria for single and double failures.
After the first failure (computer failure considered the worst single failure) the air vehicle should
be able to complete the mission and after the second failure it must be possible to make a safe
recovery of the air vehicle. After the second failure, it must be determined if the fuel quantity
information is necessary for safe recovery of the air vehicle.
MIL-STD-1798 can provide additional guidance on criticality definitions.

The fuel management subsystem should not require movement of fuel solely for c.g. control
except where dictated by air vehicle configuration. The fuel subsystem designer should attempt
as a goal to provide for simple sequencing of fuel transfer to maintain the c.g., both laterally and
horizontally within the required broad limits. More complex air vehicle arrangements may
require rapid fuel transfer to obtain an optimum c.g. position.
The F-102, F-106, and B-58 had complex fuel c.g. control systems and required rapid shifts of
fuel during the transition between subsonic and supersonic flight. System failures requiring a
rapid, unplanned for, change from supersonic to subsonic flight, could result in air vehicle fuel
c.g. being out of limits in the subsonic mode.
The use of computer control is expected to replace manual operation for all new air vehicle.
Most new systems have a completely automatic control system which accomplishes engine
feed, c.g. management, thermal management and provides failure information of the fuel
components to the warning and caution display. The B-2 system contains three computers and
uses an active-standby architecture. The primary computer controls the fuel subsystem. In the
event of a failure of the primary computer, the bus controller turns off the primary computer and
activates the secondary computer. The secondary computer removes control of the system
from the primary computer and takes over operation of the system. This removing of control of
the primary computer is necessary in the event that the failure mode of the primary computer
would not allow the primary computer to turn off. In the event of failure of the secondary
computer, control is transferred to a manual panel. The third computer provides only fuel
quantity information to the manual panel and critical warnings and cautions.
Flameouts have occurred on several fighter air vehicles due to empty main tanks while
considerable fuel was aboard in transfer tanks. Engineering change proposals were
incorporated in the F-105 and F-4C to switch back to the transfer mode automatically when the
low level light is illuminated. This automatic feature was very useful under combat conditions.
658
JSSG-2009A
APPENDIX E
E.4.4.5.4 Fuel management.

Verification of the fuel management shall be accomplished by (TBS) .
Fuel management is a safety and mission critical function.

Fuel system complexity and redundancy requirements require significant testing and
troubleshooting in order to assure full performance verification. The fuel management system is
a safety critical function and its integration with the air vehicle control must be verified.

TBS: Fuel management will be verified by analysis, component tests, software integration
testing, fuel system simulator test, ground tests and flight tests.
The verification of this requirement should be by analyses component testing, integration
testing, air vehicle ground and flight tests.
Fuel subsystem simulators should be used to demonstrate fuel c.g. changes and fuel transfer
operation under simulated flight conditions and power settings. Tests should also be conducted
under engine inoperative conditions on multiengine air vehicles and under gravity feed
conditions.
Flight and ground testing should be used to measure the performance of the fuel delivery,
integration with the Vehicle Computer Management System (VCMS) and interface with the
crew.
Dedicated flight testing of the fuel management system during Engineering and Manufacturing
Development (EMD) should not be required. Instead, suitable information regarding fuel
management system operation and performance should be gathered during testing of other
subsystems or air vehicle missions such as full integration testing including failure modes with
VCMS which at least includes the processing hardware and software and adequately models
sensors and pumps.

The operation of the subsystem will be demonstrated during routine flight tests. Only
malfunctions or inadequate operations need to be recorded during the flight tests. The override
function should be operated to demonstrate correct operation.
Test configurations should include all planned external and auxiliary fuel tanks and useful load
configurations, all expected fuel management control situations, and air vehicle attitude
extremes. Each test should be performed with the air vehicle in its normal flying attitude for
each condition. Fuel should be removed discharged from the engine feed lines at the proper
flow and pressure. c.g. versus air vehicle gross weight for various tank sequence plots should
be prepared and compared with the previously calculated data.
659
JSSG-2009A
APPENDIX E
E.3.4.5.4.1 Fuel transfer.

The rate of fuel transfer into the engine feed tank(s) shall not limit air vehicle performance. All
fuel transfer tanks shall provide at least (TBS) percent available usable fuel during air
vehicle cruise conditions and attitude.

On systems which have multiple transfer fuel from tanks (with or without auxiliary or external)
tanks to a main tank, the transfer capability should be equal to or greater than such that the feed
tank(s) are maintained full until all transfer fuel has been depleted for all air vehicle engine
consumption rates to the engine. If the transfer rate is not sufficient, the main tank can be
depleted even though there is additional fuel onaboard the air vehicle and the system is
operating correctly. The preferred location of the tank siphon tube outlet or transfer pump
location is determined by the attitude of the air vehicle when the last fuel is removed almost
depleted from the tank.

TBS: It is desirable for the rate of fuel transfer to any single main tank should to be equal to or
greater than the maximum rate of fuel consumption of the engine. Air vehicles should normally
be in the cruise attitude when the last fuel almost depleted is removed from the transfer tanks.
The fuel should be available for transfer in level flight at the maximum flow rates to a fuel level
of 2 inches above the pump inlet and then at a reduced flow rate until depleted.

When maximum engine flow rate is large high relative to the quantity of fuel onboard the air
vehicle, as is the case of afterburning fighter air vehicles that have an afterburner capability, the
transfer rate need does not have to match maximum engine capability. When theis transfer rate
is not equal to engine flow, an acceptable compromised rate should be identified and the
operating conditions should be defined.
The object is to maximize available usable fuel and to minimize weight penalties due to
unusable fuel; however, there is a practical limit. For large flat tanks, the pump location and
attitude for removal of the last lower quantitiesy of fuel is extremely critical. Very slight changes
in attitude can cause a significant quantity of fuel to change location. It is not cost effective to
add additional pumps to reduce the unavailable unusable fuel quantity to an insignificant
amount. A trade study should be conducted to determine the optimum equipment for the
minimum unavailable unusable fuel. The capability of the fuel lines to be purged should also be
considered.
In the transfer subsystem, where fuel is transferred from a transfer or auxiliary tank to a main
tank, momentary flow interruptions can be tolerated. For transfer conditions, where fuel is
pumped directly from a transfer tank to an engine, the system must be evaluated for flow
interruptions. This is especially true for air ingestion during the switch over from main tank to
transfer tank.
660
JSSG-2009A
APPENDIX E
E.4.4.5.4.1 Fuel transfer.

The rate of fuel transfer to the feed tanks shall be verified by (TBS 1) . The maximum
availability ofusable fuel quantity in the transfer tanks shall be verified by (TBS 2) .

Tests should be conducted to establish the flow rate and the sequence of usage from the
transfer tanks.

TBS 1: The rate of fuel transfer to the main tank(s) should be verified by analysis and simulator
tests.
TBS 2: The maximum availability of usable fuel quantity in the transfer tanks should be verified
by analysis, and ground tests, or flight tests.

For flight testing, the transfer tanks can be depleted in-flight and then after landing, the air
vehicle must be positioned in the best optimum attitude position for draining and measuring the
remaining fuel in the fuel tanks. For a ground test, the air vehicle must be positioned to a
simulated cruise attitude and deflected structure (wing tips) deflected corresponding to the
cruise attitude before the fuel is pumped out.
E.3.4.5.4.2 Refuel control mode.

The distribution of fuel into the air vehicle when aerial refueling through the (TBS 1) receiver
aerial refueling subsystem shall be controlled by (TBS 2) .
This is an operational and integration requirement.

TBS 1: Identify the specific receiver aerial refueling subsystem on the air vehicle.
TBS 2: Specify whether the fuel distribution into the air vehicle when aerial refueling through the
particular receiver aerial refueling subsystem will be automatically controlled or manually
controlled. If manually controlled, also specify which crew member(s) will have this control
capability. In single-seat air vehicles, the pilot obviously should be given this capability. When
the co-pilot is required to perform any aerial refueling process, the control capability should be
provided. In some receptacle installations, only the flight engineer should be provided this
capability.

(TBD)
661
JSSG-2009A
APPENDIX E
E.4.4.5.4.2 Refuel control mode.

The ability to control fuel distribution when aerial refueling, including aerial refueling through the
(TBS 1) receiver aerial refueling subsystem shall be verified by (TBS 2) .

The ability to verify correct fuel distribution throughout the air vehicle fuel subsystem when
onloading from tanker aircraft is critical due to the catastrophic consequences of putting an
aircraft out of CG limits.

TBS 1: identify the specific receiver aerial refueling subsystem on the air vehicle.
TBS 2: specify ground demonstration and flight demonstration.

(TBD)
E.3.4.5.5 Fuel quantity measurement and indication.

Fuel quantity measurement shall be provided to indicate the weight and distribution of all fuel on
the air vehicle within (TBS) accuracy.

Display of measurement information regarding the weight and distribution of the usable versus
total (usable + unusable) fuel onboard, and unusable (drainable + trapped) fuel are critical
parameters to know for the safe operation of the air vehicle.

Fuel gauging capability and display information should be provided for every air vehicle. Fuel
gauging should measure all tanks where significant usable fuel is contained in the air vehicle,
including external tanks. The required gauging system accuracy should be commensurate with
the air vehicle flight control requirements, and consider the maneuvering requirements
(dependent on the mission requirements) and center of gravity requirements.
TBS should be filled in with one of the following given the gauge class:
Gauges should be of the following classes and should produce the specified accuracies when
installed in the air vehicle:
Class I: +/- 4% of indication, +/- 2% of full scale
Class II: ± /-2% of indication, +/- 0.75% of full scale
Class III +/- 1% of indication, +/- 0.5% of full scale
662
JSSG-2009A
APPENDIX E
Quantity indicators in tanks containing flammable fluids should be designed so that no “single
electrical failure” in any part of the circuit, inside or outside the tank, could cause a spark or arc,
with an energy greater than 0.2 millijoules, within the tank. If transformers are used for power
supply to the gauges in the tank, electrostatic grounded shields should be applied between the
two windings, if a short between the primary and secondary winding could cause a spark or arc,
with an energy greater than 0.2 millijoules in the tank. USN/USMC aircraft typically use Class II
probes unless system requirements dictate more or less precise fuel quantity measurements.

Fuel quantity gauging accuracy requirements should consider measurement accuracy, attitude
effects, fuel sloshing, component (fuel probe) location installation restrictions and fuel property
variability. Where the gauging system forms a part of an automatic fuel management
subsystem then redundancy requirements should be considered to ensure fail safe operation.
Reference SAE AIR1184 for additional information.
a. Fuel probe electrical connectors. In previous air vehicle designs, MIL-C-38999 connectors
were used on the probe harnesses inside the fuel tanks. This design was used in the F-22
air vehicle connector. During the air vehicle ground testing, several erratic probe readings
were reported. After installation of the connectors, it was found to be very difficult to
visually determine if the connector was installed properly and a tightness check could not
be accomplished satisfactorily. The investigation team determined that a USAF bomber air
vehicle had experienced similar problems. The F-22 developed a special procedure to
tighten these connectors properly. USN fuel quantity probes typically have used captive
screw type fasteners for attaching probe harnesses to the individual probes. This type of
connection has proven to be highly reliable and lightweight. Captive fasteners should be
used to reduce the risk of FOD in the fuel system.
b. Ultrasonic fuel probes. The F-22 program office selected these probes due to potential
weight savings and reliability improvement. The probes had been demonstrated on
commercial air vehicles. The probes in the F-22 application were susceptible to air bubbles
that were generated due to vibration or agitation in the fuel tanks. The vibration levels in a
fighter air vehicle are obviously much higher than those of a commercial transport class
aircraft, especially during buffet loads with weapons bay doors open. The probes would
lose their ultrasonic signal, and in many cases the signal would not return. This loss of
signal was caused by the foam and bubbles present inside of the probe tube assembly.
The result of this issue was to change-out all ultrasonic probes in the fuselage with
capacitance-type probes.
E.4.4.5.5 Fuel quantity measurement.

The fuel quantity measurement subsystem requirements shall be verified by (TBS) .

Fuel quantity accuracy verification is important to ensure safe quantity and center of gravity
measurements. Ground conditions should also be assessed to ensure safe towing,
maintenance, and taxi, and to prevent tip over.
663
JSSG-2009A
APPENDIX E

TBS: The fuel gauging system requirements should be verified by analysis, by fuel simulator
testing, and by an air vehicle ground calibration and demonstration.

The installation and calibration of the gauging system on a fuel subsystem simulator will permit
early discovery of errors. Early discovery may permit correction before procurement and
installation of hardware and software on the first air vehicle.
E.3.4.5.6 Fuel tank
E.4.4.5.6 Fuel tank
E.3.4.5.6.1 Fuel expansion space (ullage).

Each fuel tank shall have an expansion space above the fuel level with the air vehicle at normal
ground attitude to allow for the expected thermal expansion of the fuel. The expansion space
shall be (TBS) with the air vehicle in a normal ground attitude.
Space must be provided in each fuel tank to allow for the expected thermal expansion of the
fuel. Even in regions of moderate temperatures, fuel stored in underground tanks will generally
be considerably cooler than the day time ambient air temperatures. After servicing, the fuel will
warm up and expand. On an open vent fuel tank, insufficient thermal expansion space will
result in fuel being spilled overboard.
An expansion space to prevent tank overflow should be provided in each fuel tank.
TBS should be filled in based on the expected usage and natural and induced environment.
Additionally, the thermal expansion properties of any fuel type expected should be considered
as an important parameter. The following conditions have been used in previous designs:
The expansion space should be equal to or greater than 3 percent of the total fuel volume of the
tank with the air vehicle in a normal ground attitude. If overboard leakage is critical such as with
Navy air vehicles on ships, then a 75°F temperature increase (5 percent) should be specified.
For air vehicles which will be serviced and then flown a short time thereafter, similar to airline
type operations, then a lesser amount of temperature differential such as 37°F (equivalent to
2 percent expansion space for JP-4) should be specified.
Approximately 1 percent expansion space should be acceptable for aerial refueling.
664
JSSG-2009A
APPENDIX E

Air vehicle attitude affects the fuel shut off level and therefore affects the expansion space. The
expansion space after refueling should provide for a normally expected air vehicle attitude
including expected variations in cargo or stores. A tolerance should be specified for unlevel
refueling areas.
For tank arrangements where a number of tanks or cells are connected to function as a single
tank the expansion space for the total cluster can be provided in one of the cells.
Air Force Regulation AFR 86-14 specifies requirements for grades for U.S. Air Force runways
and aprons, as follow:
a. Runways: 0.167 percent per 100 foot of runway
b. Runway intersections: 0.4 percent maximum
c. Taxiways and shoulders: 3.0 percent maximum, except for Air Force multi-mission
facilities, a maximum of 1.5 percent.
FAA criteria for tank ullage is 2-percent volume and does not include criteria for aerial refueling.
This is acceptable for commercial aircraft that rarely remain in one place full of fuel for long
durations where large temperature swings are encountered. This may become an issue for
commercial-derivative military aircraft with long-duration alert requirements (such as the KC-46)
which may be fueled during cold periods and remain full when the ambient temperature has
experienced greater than 50 degree temperature swings—in this case, top-offs may need to be
prohibited, or other operational or design changes considered.
E.4.4.5.6.1 Fuel expansion space (ullage).

Fuel expansion space at normal ground attitudes for each tank or cluster of tanks shall be
verified by (TBS) .
Air vehicle ground testing should verify that there is sufficient expansion space for all attitudes of
the air vehicle resulting from different loading conditions on the air vehicle.
TBS: Fuel expansion space should be verified by analysis and by ground tests.
The tests should verify that there is sufficient expansion space for all attitudes of the air vehicle
resulting from different loading conditions. This can be accomplished by filling the air vehicle to
the maximum required capacity and then adding a measured quantity of fuel until overboard
leakage is observed. If tank volume is not critical, that is, there is excess ullage available, then
only analysis may be required. If there is a high confidence in the analysis capability, then
ground testing may be avoided. For pressurized tanks, it should be verified that the interior of
665
JSSG-2009A
APPENDIX E
the vent lines are not part of the expansion space which can hold fuel so that depressurization
of the tank will not blow the trapped fuel out of the vent. The analysis attitudes and test
attitudes should account for the expected apron and runway attitude variation in each axis. A
minimum of 2.0 percent grade should be expected for attitude variation.
E.3.4.5.6.2 Fuel tank low point drainages.

Each tank design shall incorporate the capability to remove condensate water and sediments
from the low point of each tank.

Fuel will absorb water from the atmosphere. With time and a decrease of temperature, water
will separate from the fuel and settle to the bottom of the tank. Condensate water and
contamination should be removed from the fuel tanks to prevent accumulation to a level which
could affect engine operation. Fuel tanks should be designed such that there is only one low
point in each tank.

This is a safety requirement and should not be tailored.
For large air vehicles tanks of 1000 gallons or larger, an automatic water removal system should
be considered as part of the system design. With an automatic drain system, sump (i.e., low
point) drains or a sump scavenge system should also be incorporated to permit manual draining
of the sump and to verify correct operation of the automatic system. For small tanks, only the
low point drain valves should be required and are usually sufficient.
A sump should be provided to collect water. Experience has shown that a sump which is
0.25 percent (0.25%) of the tank volume is adequate to collect the sediment which is likely to
occur. In the past, sump volume design was based upon 0.75 cubic centimeters (cc) of free
water per gallon of fuel in excess of saturation.

The C-5A water removal system, which mixes water from the bottom of the tank with fuel being
fed to the engine, has proven to be effective in removing water. The B-2 and Boeing 747 have
incorporated an in-flight water scavenge.
There should be a means of verifying the proper operation of the water removal system if
automatic water removal or scavenge systems are incorporated. The C-17 has experienced
significant fuel tank corrosion and subsequent fuel contamination problems due to the clogging
and resulting reduced effectiveness of the water scavenging system.
Ensure tank drains are recessed into the tank or suitably protected to prevent actuation during a
crash. Minimize the number of line-mounted drain valves. Design valves are to be positive
locking in the closed position.
Water accumulation is known to contribute to microbial growth in fuel tanks.
666
JSSG-2009A
APPENDIX E
E.4.4.5.6.2 Fuel tank low point drainages.

The ability to remove condensate water from each tank shall be verified by (TBS) .

Excessive free water in the fuel can cause serious complications for the air vehicle fuel and
propulsion systems. For more information on microbial growth/fuel issues, reference
Airworthiness Advisory AA-04-03, Free Water and Microbial Growth in USAF Aircraft Fuels.

TBS: The ability to remove condensate water should be verified by ground tests. Sump
capacity should be verified by ground tests.

Sump capacity tests can be conducted in conjunction with water removal tests. The sump
capacity of each tank can be obtained by measuring the fuel removed from the sump after all
possible fuel has been pumped from the tank by the air vehicle pumps with the air vehicle in the
normal ground attitude.
E.3.4.5.6.3 Fuel tank cleanliness.

When delivered to the procuring agent, the fuel tanks should contain no more than (TBS 1)
milligrams per gallon (gal) of solid contaminant and (TBS 2) fibers per quart of fuel beyond
that contained in the fuel when the air vehicle is refueled.

A level of cleanliness should be established for the air vehicle fuel tanks is required prior to the
delivery of the air vehicle to ensure additional maintenance above that required due to normal
air vehiocle operation is not required. It is impossible for the tanks to be absolutely clean;
therefore, an allowable limit must be specified.

TBS 1: The tank should add no more than 16 milligram (mg) of solid contaminant per gallon.
TBS 2: The tank should add no more than 40 fibers longer than 1500 microns per gallon of fuel
serviced to the tank.

A cleanliness requirement for fuel tanks should be incorporated in the acceptance test
procedure for each air vehicle.
For air vehicles with explosion suppression baffle material (fuel foam) installed in the tanks, an
acceptable increase in solid contamination is 2 mg/gal over that serviced to the air vehicle
during filling. This cleanliness level could be obtained in two to three cycles of fill and drain of
the foam filled tanks. Emphasis should be placed on draining tank sumps and on periodic
667
JSSG-2009A
APPENDIX E
checking of fuel strainers, since foam in low areas of the tank will have a tendency to collect
higher concentrations of foreign particles.
Lint fibers were a difficult problem for the B-2 air vehicle. The fibers were believed to have
come from the cotton coveralls of the fuel tank workers or the cleaning rags used in the fuel tank
sealing process. The flush cleaning process did not effectively remove this contamination in
production air vehicle number 1 and production air vehicle number 2. After flushing, sump
samples were taken and the samples examined visually as suggested by T.O. 42B-1-1. The
procedure allows 10 or less fibers to be in a one-quart sample. The samples appeared
acceptable. After taxi tests and early flights, cotton fibers were found on the face of a heat
exchanger in the engine feed line. More extensive flushing procedures and fuel quality
inspection procedures were incorporated. The defuel line used to remove the fuel after flushing
contained a screen. This screen was inspected for fibers after each flush defueling. When the
screens appeared clean, sump samples were taken. The sump samples were filtered to
measure solid contaminant, and then the filter paper was inspected under a microscope for
fibers. It became obvious that short fibers which could not be detected visually could be
counted under the microscope. The inspection procedures were modified to require that only
fibers longer than 1500 microns in length be counted. For production air vehicle number 3,
eight flushes were required to pass the less than ten fiber count. The procedure could be over
conservative, requiring too many flushes, and a higher fiber count could be tolerated without any
system impact. It must be determined during flight testing if fuel slosh will free or flush
additional fibers into the heat exchangers. If no unacceptable level of contamination is found, it
may be possible to relax the ten fiber limit on fuel samples.
E.4.4.5.6.3 Fuel tank cleanliness.

The cleanliness state of each fuel tank shall be verified by (TBS) .

The cleanliness state of each fuel tank should be verified by ground test.

TBS: The cleanliness state of each fuel tank should be verified by repeated fueling, sampling,
and defueling procedures until the fuel is verified to meet the required cleanliness. The
microscope method should be used for measurement of the fiber content. This should be
accomplished by draining fuel from the tank sump and testing in accordance with the bottle
method of T.O. 42B-1-1 or ASTM D2276-73, Appendix A2.

Operational aircraft air vehicles experienced contamination due to fuel tank rework and cleaning
procedures. For further information on these tank cleanliness/contamination issues, reference
Airworthiness Advisory AA-01-05, Use of Aluminum Oxide (Al2O3) as a Grit Blasting Media
during the Removal of Organic Coatings on USAF Aircraft Fuel Tanks.
668
JSSG-2009A
APPENDIX E
E.3.4.5.6.4 Integral tank sealing.

Integral fuel tank sealing shall be in accordance with JSSG-2006, Structures Joint Services
Specification Guide handbook.

Fuel tank quality and integrity is a major problem for the fuel subsystem area for the life of the
air vehicle.
Refer to the JSSG-2006, Structures Joint Services Specification Guide handbook.

AFFDL-TR-79-3047 was prepared by North American Rockwell Corporation under contract to
the Air Force Flight Dynamics Laboratory in accordance with standards established by the ASD
Fuel Tank Working Group. This handbook contains the most current design guidance for
integral fuel tanks with input and coordination from most prime airframe manufacturers.
AIR STD 4069 was published by SAE to provide additional guidance.
All fuel tank wall penetrations and leak paths (seams) should be sealed with two fuel seals
(primary barrier). Redundant fuel tank seals are desired to minimize fuel tank leaks. A faying
surface seal in combination with a fillet seal or an o-ring with a fillet seal or double o-rings are all
considered double seals. If the sealing integrity of each seal cannot be verified individually,
then the double seals should be considered one barrier, the primary barrier. If the sealing
integrity of both seals can be tested and verified, the double seals can be considered a double
barrier.
Sealant may be required over fastener heads and nut plates for lightning protection in addition
to that required for sealing.
The F-16 full scale development (FSD) air vehicle had numerous fuel leaks due to (1) poor
quality of hole preparation, rivet installation, and sealant application; (2) lack of fillet seals in
many areas due to no access for application; and (3) the choice of blind rivets (NAS 1921,
MS90353, and MS90354) which were unable to fill the poorly prepared holes properly. These
problems were resolved by the addition of 16 access doors to the fuselage integral tanks, the
replacement of blind rivets by bucked rivets, threaded bolts, structural screws, and hi-lok
fasteners. The use of pilot hole drilling and drill blocks to improve hole quality was incorporated
along with the use of rotating fixtures to improve sealant application. Also, permanently attached
nuts were used in inaccessible areas to allow retorqueing of verification of torque on leaking
bolts or bolt replacement.
Integral Fuel Tank Sealing Related Lessons Learned:
a. Fastener area. Blind rivets or blind bolts in sealing areas were prohibited by
MIL-STD-1515, requirement 213, para 3.6. Generally there should be tighter controls on
hole drilling for sealing fasteners. All holes should be drilled with automatic feed
equipment rather than hand held equipment. Where practical, always use interference fit
669
JSSG-2009A
APPENDIX E
fasteners for better fluid sealing, that is, fasteners having a minimum of 0.002-inch
interference per inch of fastener diameter. If interference fit fasteners are not used, then
the alternate choice should be a sealing type fastener with wet (sealant) installed. All
non-interference fasteners should be overcoated coated on the wet side (cap sealed) to
enhance sealing. Do not use cadmium plated fasteners in contact with fuel or sealant to
insure good compatibility with sealant and proper adhesion to the fastener surface. If
dry film lubricant is required on a fastener, it should be a “baked” on type rather than “air”
dried. If a supplemental lubricant is used such as cetyl alcohol, it must be removed after
installation of the fastener and prior to any sealant application. At this time there is no
list of approved fasteners covered by military or industry documentation for sealing fuel
tanks. MIL-STD-1515 requirement 125 defines the requirements for fuel sealing
fasteners and integral fuel tanks.
b. Sealing and sealant types. Three basic sealant types are approved for use in integral
fuel tanks: non-curing groove injection materials (fluorosilicones and cyanosilicones),
curing and thermo setting adhesive sealant.
There are three classes of elastomer seals used in fuel tank components and access
doors: Nitrile, fluorosilicone and fluorocarbon. The best material for overall durability is
Nitrile type, but is limited in high temperature resistance. The fluorosilicone has better
high and low temperature capability but is less resistant to abrasion and compression
set. The Viton has the best high temperature resistance, but is not good for low
temperature. The best method of sealing access doors in fuel tanks is with elastomeric
o-rings or molded seals. Flat gaskets or sealant type seals are much less reliable and
tend to leak more often because they take a permanent set with time. Purging fluids
having low or no aromatics tend to result in elastomer leakage since the elastomers can
shrink with the removal of the aromatics. Good integral fuel tank sealing requires: good
structural joint design, good sealant application and quality control, and good quality
sealant and sealers. Most leakage seems to occur at fasteners or areas where large
structural gaps occur. Poor application of sealant is also a contributor to leaks which are
due in many cases to poor personnel training and sealing techniques. Cleanliness in the
fuel tank sealing area during fabrication and installation is of primary importance. An
environmentally controlled area or controlled hanger is preferred. Sealing should not be
done where painting, oiling, drilling or similar activities are also occurring because
surfaces to be sealed may inadvertently become contaminated which, in turn, adversely
affects sealant application. The use of MIL-C-38736 cleaner and adhesion promoter
(PR-148) has been found to enhance fuel tank sealing by insuring clean surfaces for
sealant application. Provide good access to areas and fasteners that must be sealed.
The wing to fuselage interface is one area that is often over looked and should be
given special scrutiny. The development and availability of good illustrative technical
orders are imperative.
A design, fabrication, and quality assurance program should be conducted for fuel tanks, during
research, development, and production of the air vehicle. Fuel tank quality and integrity is a
major problem area for the fuel subsystem area for the life of the air vehicle. It is essential that a
quality program be established that will address fuel tank problems until after production is
completed.
670
JSSG-2009A
APPENDIX E
E.4.4.5.6.4 Integral tank design.

Integral fuel tank design shall be verified by (TBS). See JSSG-2006, Structures Joint Services
Specification Guide handbook.

It is essential that a verification program be established that will address possible fuel tank
problems.
TBS: Verification should be accomplished by analysis, test, and inspection in accordance with
JSSG-2006, Structures Joint Services Specification Guide handbook. Any incorporation of “Not
Recommended” design methods in the new tank design should be explained and justified.

Test criteria and guidance can be found in AFWAL-TR-80-3100.
The incorporation of two seals on all fuel tank penetrations and leak paths should be verified by
inspection of tank drawing and air vehicle hardware.
Seal verification can be accomplished by pressurizing the inner seal (primary barrier) and
inspecting the cavity drain for leakage, then pressurizing the drain cavity and inspecting the
secondary seal (secondary barrier) for leakage.
E.3.4.5.6.5 Bladder tank cavity.

The structure or cavity surrounding a bladder tank shall be vented, and contain and control any
fuel leaks in the bladder tank cavity at normal air vehicle level attitudes to the designed-in
drainage control paths. Drainage control paths shall be provided to remove any bladder fuel
leakage which may occur.

All structure interfaces, joints, and seams surrounding bladder tanks should be vapor and liquid
tight. Deliberate drains and drain paths should be provided for the cavity to ensure all flammable
fluids are routed safely overboard, and do not collect anywhere within the air vehicle.

This requirement should be considered safety critical. The cavity drain acts as a drain for the
low volume between the bladder and the air vehicle structure. The drain should be used for
removing condensed moisture or fuel which may have leaked from the fuel cell fittings, O-rings,
or diffused through a cut/tear in the the bladder, and should allow for continual continuous
drainage overboard. The termination outside of the air vehicle should be of such design that
any discharge fluid does not re-enter or impinge on the air vehicle during flight.
In addition to drainage, the volume between the structure and fuel cell should be adequately
vented. In an altitude climb, air should be expelled from the volume to prevent cavity
671
JSSG-2009A
APPENDIX E
overpressure. The venting of the cavity during a dive may also be safety critical and is
necessary to prevent fuel cell collapse and should be investigated.

The drain provision for self-sealing bladders may need to be a larger diameter than for standard
bladder tanks. If not protected from fuel on the outside of the fuel cells through the use of a
vapor barrier, fuel spills can cause a reaction with and deterioration of the self-sealing material,
which is generally not protected from fuel on the back side. Strongly recommend Original
Equipment Manufacturers (OEMs) provide exterior barrier protection to prevent activation from
the outside in.
The F-15 air vehicle experienced increased fuel leakage reports during the United States Air
Force fuel conversion from JP-4 to JP-8. Leakages from the fuel cell bladder tank fittings were
reported. Accumulated fuel leakage in the cell folds actuated the self-sealing bladder and
resulted in cell rupture in flight.
Tank bladder leaks began occurring with increasing frequency during the fuel conversion. The
bladder tank leakage was corrected by (1) tightening up quality control in bladder manufacture,
(2) instituting more stringent bladder acceptance procedures, and (3) developing procedures to
insure a greatly improved bladder-to-cavity fit. This experience showed that constant attention
to quality control is imperative in the manufacture of bladder fuel tanks.
For fighter applications, a check valve allows overboard leakage but does not allow backward
air-to-flow through the drain. This traps a vacuum between the bladder and the cavity wall and
prevents movement of the bladder during a dive. It is believed that this feature has contributed
to the high reliability of the system.
E.4.4.5.6.5 Bladder tank cavity.

The sealing, venting, and draining of bladder tank cavities shall be verified by (TBS) .

Verification of the bladder tank cavity sealing, venting, and draining is necessary to ensure the
reliability and durability of the fuel bladders is not adversely affected and should be based on
peace-time failure modes as well as survivability and vulnerability requirements.

TBS: The sealing of bladder tank cavities should be verified by analysis, component testing,
and ground tests prior to the installation of the bladders. Bladder-type fuel tanks should be
capable of passing material compatibility tests for the expected natural and induced
environments.

Aromatic content of fuel has affected bladder tank seal swell.
672
JSSG-2009A
APPENDIX E
E.3.4.5.6.6 Internal auxilary fuel tanks removable tank support.

Rigid, internal, removable auxiliary fuel tanks shall be supported and restrained to prevent
rupture and movement when subjected to the flight inertia load factors and emergency landing
crash load factors specified for the air vehicle in accordance with MIL-STD-1290. The tanks
shall be integrated into the air vehicle's internal fuel system for the purposes of fueling,
defueling, transfer control, quantity gaging, venting, and pressurization. The tanks shall be able
to be fueled and defueled both through the air vehicle's internal fuel system (reference
E.3.4.5.8.4, and E.3.4.5.8.13) and directly via the tank's refuel port. It shall be possible to verify
the quality of fuel in the fuel tanks in accordance with OPNAVINST 4790.2J.

The manner in which rigid, internal, removable fuel tanks are mounted is a safety issue and
failure should not be permitted under the defined loads. The tanks should be integrated into the
air vehicle internal fuel system in order to minimize pilot, crew, and maintainer workload
associated with the auxilary fuel tank operation.

Tank support strength should accommodate flight load factors and emergency crash load
factors.

Rigid, internal, removable tanks should be supported to prevent failure under crash loads. Lug
or screw mountings in the wall of the tank, even though this area is reinforced, has proven to be
the first area of failure in an overload condition. A failure of the lugs will generally pull a section
from the tank wall resulting in severe leakage. Mounting the tank in a cradle with tie down
straps has proven to be more reliable than lugs in the tank wall. A crash resistant bladder
installed in the cavity will provide much improved performance under crash conditions.
E.4.4.5.6.6 Internal auxilary fuel tanks removable tank support.

The support capability under crash loads for rigid internal fuel tanks shall be verified by (TBS).

Verification of removable internal auxiliary fuel tanks is a safety critical function to avoid injury or
death to personnel under normal and transient conditions as well as under crash loads.

TBS: The tank support capability should be verified by component tests on the tank.

Some applications of removable internal auxiliary fuel tanks require the capability to stack cargo
on top of the tanks. This additional load can create a unique design load.
673
JSSG-2009A
APPENDIX E
E.3.4.5.6.7 External tanks.

The tanks shall be designed to be structurally capable of satisfactorily reacting to flight induced
aerodynamic and inertia loads including (TBS) . The tanks shall be integrated into the air
vehicle's internal fuel system for the purposes of fueling, defueling, transfer control, quantity
gaging, venting, and pressurization. The tanks shall be able to be fueled and defueled both
through the air vehicle's internal fuel system (reference E.3.4.5.8.4, and E.3.4.5.8.13) and
directly via the tank's refuel port.
For external fuel tanks intended for use on Naval aircraft (shipboard operations), the
requirements of MIL-T-18847 section 3.15 shall be met.

If the air vehicle’s mission requires the use of external tanks, the number, size capability, and
location of the tanks should be identified.
If tanks are to be used on carrier-based aircraft, survivability requirements must be met.

Values for blanks must be derived for each type air vehicle from its required missions. TBS
should be filled in with consideration given to the following:
For Navy application, inertial loads should include catapult and arrestment landing loads. The
fuel tank should be in accordance with MIL-T-18847.
The basic arrangement of the air vehicle, armament requirements, and the desired range should
drive the requirement for external tanks. Some mission objectives could be achieved without
external tanks; however, the use of external tanks provides much greater flexibility for the air
vehicle. If this flexibility is desired by the user, the requirement for external tanks should be
stated as an operational capabilities requirement in the air vehicle specification. The external
tank and its captive carry tiedown hard points should be typically strength analyzed to
satisfactorily react to all flight induced aerodynamic and inertia loads.
For jettisonable external tanks, the components for the vent control, fuel level control, and level
control shutoff valve pre-check, if required, should be placed in the air vehicle unless system
trade studies justify the increase in tank cost.
External tanks should not preclude the use of weapons on any store station not used by an
external tank. Ground clearance should be sufficient to prevent ground contact under any
combination of the following static or dynamic ground conditions:
a. One or more flat tires
b. One or more shock absorbers flat
c. Pitching and rolling or both caused by variations in anticipated runway and taxiway
surfaces.
In addition, sufficient clearance and access will be provided for installing, filling, draining, and
removing the tank.
For carrier-type air vehicles, the tank installation must clear the catapult bridle and the catapult
bridle must not strike the tank at the end of the launching run.
674
JSSG-2009A
APPENDIX E
The tank cannot obstruct a satisfactory barrier engagement of the aircraft.

It is difficult to add external tank hard points, fuel tubing, vents, and controls after the basic
layout and design of the air vehicle has been completed. If external tanks are desired, the
requirement should be identified early in the program.
For jettisonable tanks, a large number of tanks can be consumed in combat conditions;
therefore, the external tanks will be considerably simpler and cheaper if the functional
components are incorporated in the air vehicle. The weight of these components must be
carried by the air vehicle even when the external tanks are not being carried by the air vehicle.
Navy has experienced loss of life due to catastrophic structural failure of nestable tanks on air
vehicle carriers.
E.4.4.5.6.7 External tanks.

External tank number, size capability, and location shall be verified by (TBS) .

The requirement for store compatibility with the air vehicle, and how many of what size tank
must be installed at one time, must be verified.

The number, size, and location of external tanks should be verified by inspection.
The strength capability of the external tank and its captive carry tiedown hard points should be
verified by static testing. The strength for catapult and arrested landing should be verified
dynamically by test.
The detail design requirements for the tanks should be covered in the other appropriate sections
of the specification such as vent section, and the transfer section.

Function of the external tanks should be considered safety and mission critical.
E.3.4.5.6.8 External tanks installation time.

External tanks shall be capable of being installed or removed in (TBS) .

External tanks are generally designed for rapid installation or removal for fighter-type air
vehicles to permit rapid reconfiguration of an air vehicle in relation to armament load and
mission. On some other type air vehicles the external tanks are semi-permanently mounted.
The requirement for rapid installation or removal must be defined.
675
JSSG-2009A
APPENDIX E

TBS should be filled in based on JSSG-2001 and required missions and turn around times or, in
the absence of a firm operational requirement for rapid turn around, with a maximum of
15 minutes for the installation or removal of an external tank by a maximum of three people.

Installation times should be based on the expected usage and natural and induced
environments of the system.
E.4.4.5.6.8 External tanks installation time.

External tanks installation and removal time shall be verified by (TBS) .

The requirement for store compatibility with the air vehicle, and how many of what size tank
must be installed at one time, must be defined.

TBS: The external tank installation or removal should be verified by analysis and
demonstration. Conditions for the demonstration such as equipment availability, number of
personnel allowed, space limitations due to revetments, and residual fuel in tank should be
specified.

Conducting verification demonstrations under operational conditions will provide the most
realistic information to include in technical data.
E.3.4.5.6.9 External tank capability.

External tanks and their mounting provisions shall be capable of carriage and operation at
(TBS 1) and shall be jettisonable at speeds up to (TBS 2) .
The need for and intended use of external tanks should be specified. A requirement for
supersonic flight for an external tank has a great impact on the design.

TBS 1 should be filled in with the air vehicle operational envelope within which external tanks
will be expected to function. The required operational envelope for external tanks must be
derived from the mission profile of the air vehicle.
TBS 2 should specify the maximum speed at which external tanks may be jettisoned.
676
JSSG-2009A
APPENDIX E
The requirement to carry external tanks at supersonic speeds or to jettison the external tanks
prior to supersonic flight should be defined.

External tank design and interfaces should consider static and dynamic loading conditions as
well as ground handling and maintenance.
E.4.4.5.6.9 External tank capability.

External tank operational envelope and jettison capability shall be verified by (TBS) .
Sufficient tests should be conducted to verify the complete carriage and jettison speed
envelope.

TBS: External tank speed and jettison capability should be verified by analysis and flight test.
Sufficient tests should be conducted to verify the complete carriage speed envelope and the
jettison envelope.

Sufficient integrity should be designed into the tank and tank interfaces to meet operational and
life requirements.
E.3.4.5.6.10 Self-sealing tank.

Self-sealing and partially self-sealing fuel tanks (and associated backing board if required) shall
be necessary to self-seal after puncture from (TBS 1) ordnances. The quantity of fuel to be
protected shall be (TBS 2) .

The protection level for self-sealing tanks must be demonstrated by performance of a gunfire
resistance test.

These values should be derived for each type air vehicle. Also, these requirements should be
considered in conjunction with the survivability and vulnerability requirements.
TBS 1 should be filled in with the size of the projectile against which the tank is expected to
seal.
TBS 2 should be determined by mission analysis of the quantity of fuel in the tank after the tank
has been punctured.
677
JSSG-2009A
APPENDIX E
For fighter style air vehicles, self-sealing tanks that provide sufficient fuel from the longest
mission to return to base should be considered.
Metallic fuel lines should not be installed in contact with the walls of a self-sealing tank.
Air vehicle fuel tanks should be self-sealing according to the appropriate type, class, style, and
protection level per design specification MIL-DTL-5578.

Current tank configurations can seal against various ordinances as detailed in design
specification MIL-DTL-5578 and as defined by the protection level assigned to the tank design.
In the Vietnam war, many air vehicles were modified to provide five minutes of protected fuel.
Five minutes was sufficient to allow a damaged air vehicle to get out to sea for ditching and
permit a safer rescue operation.
E.4.4.5.6.10 Self-sealing tank.

The protection level adequacy of self-sealing and partially self-sealing fuel tanks shall be
verified by (TBS 1) . The quantity of protected fuel shall be verified by (TBS 2) .

Self sealing fuel tanks are required to withstand an ordinance hit and be gun fire resistant with
respect to not allowing leakage or tank failure after such hit. Component testing is used for
such verification.
VERIFICATION GUIDANCE(4.4.5.6.10)
TBS 1: The adequacy of the self-sealing tanks should be verified by component testing. If the
air vehicle contains two or more self-sealing tanks, the most complex shaped tank should be
used for the test.
TBS 2: The quantity of protected fuel should be verified by analysis and component testing.

The fuel tank used in the test should have an air vehicle structure with an adequate backing
board for realistic results. Adequate test structures are difficult to obtain, if not provided for in
the basic program plan.
678
JSSG-2009A
APPENDIX E
E.3.4.5.6.11 Fuel tank location and separation.

Fuel tanks located adjacent to compartments which contain ignition sources shall be separated
from such compartments by a second liquid-tight and vapor-tight barrier in addition to the barrier
provided by the tank. A means to determine if the primary barrier (tank wall) has failed shall be
provided.
Additional protection from fuel leakage must be provided for all areas of the air vehicle where
there is a high probability of igniting fuel vapors.

The following should be considered ignition source compartments: personnel, cargo, gun,
engine or any compartments which contain an ignition source.
In air vehicles without crashworthy fuel systems, the fuel tanks should not be located over
personnel compartments and should not be located in personnel or cargo compartments on a
permanent basis.
Potential fire and ignition hazards should be protected from fuel leakage so that a single failure
or single seal omission of the primary fuel barrier will not permit fuel leakage or spillage into
these areas.
For air vehicle areas where there is a high probability that fuel leakage can be ignited, double
barriers should be provided and sealing integrity verified. The fire zones and ignition zones
should be separated from potential fuel leaks by a secondary barrier with a cavity between the
two barriers. Secondary barriers may contain only one seal.
Each fuel barrier should be capable of being tested and the area between the two barriers
should be continuously drained and vented to ambient conditions outside of the ignition zone.
The drain outlet should be inspected for leakage which indicates a failure of the primary barrier.
A secondary fuel barrier should be required to prevent a single failure (leak) in the primary fuel
barrier causing a fire hazard. The venting and draining of the cavity between the two barriers
should permit detection of any leaks in the primary barrier. Without this feature, a single failure
could go undetected until a failure of the secondary barrier occurs. The secondary barrier
should address the pressure criteria which can occur in the cavity for normal leakage conditions
and for testing.
All areas surrounding fuel tanks should be drained and ventilated to remove the fire hazard
resulting in any fuel spillage or leakage. The drainage and ventilation openings should remain
open at all times.
Location of fuel tanks above engine compartments should be avoided. If fuel tanks must be
located above engine compartments for justifiable reasons, provisions should be made to
prevent leakage of fuel into engine compartments or onto exhaust systems. A ventilated and
679
JSSG-2009A
APPENDIX E
drained space should be provided between fire wall and tank to afford safe disposal of any fuel
leakage from the tank. In the event of an engine fire, insulation should also be provided to
prevent ignition within the tank or in the shrouded air space.

This requirement applies to all types of fuel tanks, including permanent, temporary cargo,
external and other types.
E.4.4.5.6.11 Fuel tank location and separation.

The fuel leakage protection for fire and ignition zones shall be verified by (TBS) .
The freedom of fuel leakage from double barriers should be verified by analysis and inspection.

TBS: Fuel leakage protection for fire and ignition zones should be verified by leak tests of the
primary and secondary barrier and proper draining and ventilation system.

The B-2 and F-22 conducted fuel tank durability tests using scaled fuel tank mock-ups to ensure
tank barriers could meet life requirements.
E.3.4.5.6.12 Tank access doors.

Each fuel tank shall have an access door(s) to permit (TBS) .

Good access to all interior parts of a fuel tank is necessary to permit inspection, cleaning, and
repair of the tank.

TBS: Each fuel tank should have an access door(s) to permit inspection, cleaning, and repair of
the entire interior surface of the tank and access to fuel components. Door seals should be
designed for expected usage including periodic removal and reinstallation.
The size and shape of a flexible tank will determine the size of the access door. The access
door size for flexible tanks will generally be greater than required from the human factors
standpoint.
680
JSSG-2009A
APPENDIX E
E.4.4.5.6.12 Tank access doors.

Tank access will be verified by (TBS) .

Access to fuel tanks should demonstrate maintenance derived requirements.

TBS: Tank access should be verified by analysis and demonstration.
Verification of access for flexible tanks should be accomplished early in the program by the use
of a tank and door mockup.
E.3.4.5.6.13 Crashworthiness.
All fuel tanks, attachments, manifolds, fuel lines, and fittings installed inside the air vehicle shall
be crashworthy. Each fuel tank configuration in the air vehicle shall be capable of withstanding,
without leakage, (TBS) foot per second impact.
Fuel tanks, attachments, manifolds, fuel lines, and fittings shall be designed to allow relative
movement and separation between the tank and structure without fuel spillage during a
survivable crash. Crashworthy fuel systems shall adhere to MIL-STD-1290, including all
internal, external, and auxiliary fuel tanks.

Relative motion between the fuel tank, plumbing, and structure is unavoidable during a
survivable crash. Leakage at fittings, valves, or attach points will occur unless specifically
designed to prevent leakage.

TBS should be filled in with the maximum survivable impact velocity of a human being. Fuel
tanks and systems should be crashworthy in accordance with MIL-STD-1290. If the tanks are to
be crashworthy and self sealing, the tanks must comply with MIL-DTL-27422D. USAAVSCOM
TR 89-D-22A, Aircraft Crash Survival Design Guide, gives further guidance on the design of
crashworthy systems.
Self-sealing break-away couplings should be used to prevent large fuel leaks during hard impact
landings and uncontrolled flight landings.

The maximum survivable impact velocity of a human being is currently understood to be
approximately 60 ft/sec.
681
JSSG-2009A
APPENDIX E
E.4.4.5.6.13 Crashworthiness.
All fuel tanks installed inside the air vehicle shall be crashworthy. Each fuel tank configuration
in the air vehicle shall be capable of withstanding, without leakage, a (TBS 1) foot free-fall
drop, onto a non-deforming surface when filled to maximum capacity with water for testing. If
desired, the test can be performed with a representative portion of air vehicle structure
surrounding the tank. The capability of each fuel tank configuration to withstand the free-fall
drop test shall be verified by (TBS 2) .
Crashworthiness requirements should be defined early in the design process to ensure
sufficient strength is included in the mounts and other components.

TBS 1 should be filled in with corresponding vertical height equal to the maximum load expected
during a crash.
TBS 2 should be filled in with component test.

The production tank with all openings suitably closed should be filled to normal capacity with
water and air removed. The fuel tank should be placed upon a platform and raised to a height
of 65 feet. A light cord may be used to support the tank in its proper attitude. Tanks installed in
air vehicle structure should be raised to a height of 65 feet; no platform should be used. The
platform and structure should be released and allowed to drop freely onto a non-deforming
surface so that the tank and structure should impact in a horizontal position 10 . After the
drop, there should be no visible leakage.
E.3.4.5.7 Fuel tank inerting and explosion suppression.

Fuel tanks and vent subsystems in which air-fuel vapors may be exposed to ignition sources
(such as incendiary gunfire, missile fragments, hot engine fragments, high wall temperatures,
electrical failures, and naturally occurring electrical discharges, etc.) shall be equipped so that
fires and over pressures from explosions cannot occur in these areas. The inerting and
explosion suppression subsystem shall not cause tank pressure in excess of (TBS) .

TBS should not exceed tank structural limits, or prevent transfer of fuel as a result of any single
failure.
The ullage in a fuel tank contains a combination of fuel vapor and air which may or may not be
in a combustible mixture depending on the energy level of potential ignition sources.

A study should be conducted for all hazardous areas to determine the most efficient method of
eliminating the unsafe condition. Combat (survivability) and non-combat (safety, lightning,
static, etc.) conditions should be analyzed to determine the hazards to protect against.
682
JSSG-2009A
APPENDIX E
The application of a passive means to reduce the explosion hazard, such as filling the tank with
explosion suppressant foam, is one of a number of techniques which has proven effective.
There are a number of active systems which are available for explosion prevention. A supply of
inert gas, such as nitrogen, constantly piped into the ullage can be an effective means to
eliminate the explosion hazard. This can be accomplished by using either a stored source of
nitrogen or nitrogen generator like the Onboard Inert Gas Generating System (OBIGGS).
These techniques require plumbing, storage bottles, valves and other associated components.
Whatever the design choice, it should be judged on its merits to prevent explosions and also for
its effect on maintainability, reliability, performance, and reparability.
Fuel lightning hazards. The fuel subsystem should be safe from fire and explosion hazards
caused by direct lightning strikes. Lightning strike should be considered in the design of a fuel
subsystem to minimize the probability of a fuel fire or explosion and the malfunction of the fuel
subsystem components.
Baffle systems. The baffle material should not degrade the performance of the fuel subsystem
beyond the limits specified in the fuel system detail specification. The fuel subsystem should
meet all performance requirements with or without the baffle material installed, excluding the
explosion protection provided by the baffle material. It should be possible to remove the baffle
material from the tanks and operate the air vehicle without removing or adding any other
hardware. Any components fastened in the tank because of the baffle material, should be
sufficiently tested to verify that these components can be retained if the baffle material is
removed. The baffle material should be included in all simulator and ground and flight tests.
Nitrogen inerting systems. Nitrogen inerting should be provided for all fuel tanks. The nitrogen
inerting system should be completely automatic and should require no attention from the flight
crew during flight except for the monitoring of associated caution and advisory lights. The
system should prevent explosions and fire by diluting and maintaining the oxygen concentration
below 9 percent (9%), in the fuel tank(s) ullage space, without the use of ground equipment.
Nitrogen gas should pressurize the ullage and vent spaces during decreases in altitude to
maintain a safe differential pressure between the tanks and ambient pressure. The nitrogen
inerting system should maintain inert ullage and vent spaces with no electrical power applied for
a minimum of 5 minutes with a 10 square inch hole in any one fuel tank.
At no time should the positive or negative pressures in the fuel tanks and vents exceed the
design pressure limits of the air vehicle regardless of failure of any component.

The protection of an air vehicle from lightning should be addressed at the air vehicle system
level. The locations of lightning attachments, the magnitude of the lightning strike, and the
ignition of fuel within a fuel tank are all probabilistic events. The ignition of fuel is driven by the
type of fuel, the mission profile of the air vehicle, the temperature environment during the
mission, and the incorporation of other equipment on the air vehicle such as a fuel tank inerting
system. All of these parameters must be combined by a Safety Hazard Risk Analysis to
quantify the risk to the air vehicle from lightning. The acceptable risk level for fuel tank lightning
protection should be consistent with risk levels for all other air vehicle elements such as air
vehicle structure failure, engine failure, flight control system failure, hydraulic system failure, and
loss of air vehicle from bird strike.
683
JSSG-2009A
APPENDIX E
Paramount to the design of fuel subsystem lightning protection is the Lightning Zone
designation of the air vehicle and the fuel tank area. After zones of the air vehicle have been
designated, MIL-STD-1757 specifies standard test criteria to be used for testing of components
and air vehicle tank skin in each zone. MIL-STD-1757 defines Zone 1A as an “initial attachment
point with low probability of flash hang-on, such as a leading edge” and Zone 2A as a “swept
stroke zone with low probability of flash hang-on, such as a wing mid-span”. Items in zone 1A
are tested with a component A waveform which has a peak amplitude of 200 KA and an action
-6 2
integral of 2 x 10 A s. Items in zone 2A are tested with a component C waveform which has a
-6 2
peak amplitude of 100 KA with an action integral of 0.25 x 10 A s. Based on these action
integrals, there is an 8-fold increase in energy applied to the test article between zones 2A and
1A. Therefore, the zone designation is the major driver on tank design for lightning strike for
composite fuel tanks. The increase in energy transfer does not impact metal tanks as severely
due to the inherent capability of metal to conduct current. Overly conservative zoning of the air
vehicle has a major impact on the protection required for fuel subsystem.
Direct Effects test procedure. Combustion Vapor Ignition of MIL-STD-1757 lists photography as
the preferred technique for detecting sparks. A camera is mounted in a light-tight chamber
behind the test article. The shutter of the camera is opened during the lightning strike. Any light
on the film indicates a spark and the test sample have failed. This is a simple test to conduct
and a simple method to evaluate. This procedure is extremely conservative and does not
address the energy content of the spark and the minimum energy necessary to ignite the fuel.
An “ignition criteria” is a less conservative method of evaluating the test success and provides
an indication of the energy of any spark that is produced during the test. In this method, an
optimum explosive vapor (a fuel mixture slightly richer than a stoichiometric mixture) is placed
adjacent to the test article. This optimum mixture can be ignited with a minimum ignition
energy. If the explosive vapor does not ignite as a result of the test lightning strike, then the
vapor is ignited by a spark plug to verify that an explosive vapor was present in the test
chamber.
A propane air and gas mixture has been used as the explosive vapor on several test programs.
The correct mixture with propane is easy to obtain and provides repeatable results. With
propane, the testing can be performed at room temperature. Air vehicle fuel tests are more
difficult to conduct, but a realistic temperature effect on the tank material is tested in the range
necessary to obtain the fuel mixture.
The B-2 program conducted skin panel lightning tests to evaluate the improvement in safety
afforded by the conversion of the air vehicle to JP-8 as the primary fuel, with JP-4 designated as
an emergency fuel only. A “worst case” batch of JP-8 with a flash point of approximately 100°F
was obtained for the test. A procedure was developed to provide an optimum mixture for the
test chamber. The procedure was developed using a bomb sampler to measure the maximum
pressure rise and the pressure rise time. A maximum pressure rise or a minimum rise time both
indicate a near optimum mixture. This optimum mixture will ignite at a minimum energy level. It
was determined that the near optimum mixture was obtained at a temperature of 150°F for the
test fuel. Higher flash point fuel will require a higher optimum mixture temperature. It is
estimated that the optimum mixture temperature will occur approximately 50 degrees above the
flash point. The prime contractor conducted additional tests to determine the ignition energy of
JP-8 as a function of fuel temperature. As the temperature of the fuel is varied from the
optimum temperature the energy required to ignite the fuel goes up.
684
JSSG-2009A
APPENDIX E
The panel tests were all conducted at the optimum temperature; therefore, this is conservative
with respect to the air vehicle fuel tank conditions. The panels were tested in the new condition.
The effects of aging were not investigated. The air vehicle will only rarely be at the optimum
temperature. Although there was light on several of the test strikes there was only one ignition
at the 200 KA test level during the test. The test results were used to define a probability of
ignition for use in a hazard analysis model.
Reference Aero Propulsion Laboratory reports, AFWAL-TR-85-2057 and AFAPL-TR-75-70, for
information on fuel ignition.
Commercial air vehicle designers use FAA Advisory Circular 20-53 and its associated Manual
AC-20-53 for guidance for protection of airplane fuel subsystems from lightning strikes.
E.4.4.5.7 Fuel tank inerting and explosion suppression.

Operation of the fuel tank inerting and explosion suppression subsystem shall be verified by
(TBS 1) . The effects of the inerting and explosion suppression system shall be verified by
(TBS 2) .

Fuel tank inerting and explosion suppression is important to satisfy safety and mission critical
conditions.

TBS 1: Performance of the fuel tank inerting and explosion suppression subsystem should be
verified by analysis, component, subsystem, and air vehicle flight tests.
TBS 2: The air vehicle risk from fire and explosion hazard due to lightning should be verified by
analysis, component, and subsystem tests as defined by MIL-STD-1757.

The B-2 has operated safely since 1989 using the methods defined in this requirement.
E.3.4.5.8 Refueling and defueling
E.4.4.5.8 Refueling and defueling
E.3.4.5.8.1 Ground refueling rate.

With the air vehicle on the ground and 10 percent fuel onboard, the fuel subsystem shall permit
fueling of all tanks, both internal and external, to design capacity in a flow time not to exceed
(TBS 1) with (TBS 2) to source.
The time allowed to refuel the air vehicle must be specified. The refueling time should be
considered in relation to the required turnaround time of the air vehicle and the capability of the
interfacing ground equipment.
685
JSSG-2009A
APPENDIX E

TBS 1: The allowed refueling time should be derived from JSSG-2000 requirements.
TBS 2: The refueling source(s) should be identified. The pressure and flow rate available will be
determined by the equipment identified. Fuel velocity entering the tank and in line fuel velocity
should be considered to minimize static charge generation. In general, a maximum of 30 feet
per second (ft/sec) should be considered an acceptable fuel line velocity. A maximum of
20 ft/sec is preferred for larger air vehicles. A maximum recommended tank entry velocity is
10 ft/sec.

If a required time has not been specified by the user, the refuel times depicted in table E-IV
should be considered the design objective.
TABLE E-IV. Pressure refueling times.
*NOTES:
If less, the aerial refueling time has precedence over ground refueling time.
These times are for flow times only and do not include time for positioning the air vehicle or refueling equipment.
The time to refuel is dependent on the time to refuel the slowest or the largest tank on the air vehicle.
The flow rate to each tank should be balanced so that all tanks obtain their capacity shut-off point at the same
time. This will produce the minimum time to refuel. The 10 percent (10%) initial load should be distributed in tanks which would
naturally occur in the pump down of the system.
The refuel rate for air vehicles which incorporate auxiliary tanks should be optimized based
upon the auxiliary tanks not being installed. Refueling rate requirements when the auxiliary
tanks are installed should be either stated by the procuring activity, or derived from the specific
missions requiring the use of auxiliary fuel tanks.
686
JSSG-2009A
APPENDIX E
E.4.4.5.8.1 Ground refueling rate.

The flow time to refuel the air vehicle to capacity shall be verified by (TBS).

The time to refuel the fuel tanks must be verified to ensure the air vehicle can meet its mission
requirements.

TBS: The time to refuel the air vehicle to capacity should be demonstrated by analysis, test rig,
and refueling an actual air vehicle.

The starting condition for the refueling must be specified. It is rare that an air vehicle in a service
environment will be empty; therefore, a starting condition of 10 percent of maximum fuel weight
distributed in a manner resulting from normal use of the system is recommended.
It is difficult to obtain ground refueling equipment that will deliver the exact pressure and flow
capacity that is required for the demonstration; therefore, the flow time may be corrected to
account for any difference in delivery pressure.
E.3.4.5.8.2 Receiver aerial refueling rate.
Reference appendix F, F.3.4.6.2.1.2, Receiver aerial refueling rate.
687
JSSG-2009A
APPENDIX E
E.4.4.5.8.2 Receiver aerial refueling rate.

E.3.4.5.8.3 Refueling power conditions.

The fuel subsystem shall be able to refuel and automatically shut off under (TBS) power
conditions.
Refueling systems can be designed which do not require electrical power, which can operate on
air vehicle battery power, auxiliary power unit or external power. Restrictions on the application
of power, internal or external, for reasons of safety or air vehicle self-sufficiency should be
specified.

TBS should be filled in with consideration given to the following: The air vehicle should be
capable of being refueled to capacity without external electrical power applied to the air vehicle.
The air vehicle should be capable of being refueled to any intermediate level with only internal
electrical power applied to the air vehicle. It is possible to design a refuel subsystem which can
shut off at the full level by hydromechanical valves. Intermediate fuel levels require some form
of electrical power.
Refueling at remote operating locations may be required with the availability of external power.
688
JSSG-2009A
APPENDIX E
E.4.4.5.8.3 Refueling power conditions.

Refueling capability under specified power conditions shall be verified by (TBS) .

Verification of refueling power conditions is necessary to ensure that operational requirements
for refueling can be met.

TBS: Verification under specified power conditions should be accomplished by analysis and a
refueling demonstration.

Refueling power conditions should be considered a mission critical requirement.
E.3.4.5.8.4 Pressure refueling.

The air vehicle shall be capable of (TBS) . The adapter shall be in accordance with the
international pressure fueling connection air vehicle standards of MIL-A-25896.
The requirement for pressure refueling should be specified if required.

All air vehicles with a fuel capacity of 600 gallons or greater should incorporate pressure
refueling. The ground pressure refueling connection and refueling pressures were standardized
by international agreements (ASCC AIR STD 25/17 and NATO STANAG 3105). These
standards should be used unless special requirements can be justified.
The MS24484 adapter implements international agreements and is compatible with the
legacy Military Specification MIL-N-5877 nozzle which is currently installed on USAF pressure
refueling equipment. MIL-N-5877 has been replaced by SAE AS5877.
The air vehicle should be capable of pressure refueling at steady state pressures between 20
and 55 psig, measured at the inlet to the air vehicle refueling subsystem.
The refueling adapter should be compatible with pressure fuel servicing nozzles having a
straight or 45 inlet. The adapter should be installed with the adapter face as nearly as possible
in the vertical plane.
Pressure refueling is accomplished by connecting the ground refueling hose to the air vehicle
refueling manifold. Fuel is delivered to each tank under pressure by an air vehicle fuel manifold.
689
JSSG-2009A
APPENDIX E
REQUIREMENTS LESSONS LEARNED (3.4.5.8.4)
In addition to ease of refueling provided by pressure refueling, this method is considerably safer
than the gravity (over the wing) method. In the gravity method, fuel vapor is expelled through
the filler cap opening beside the fuel nozzle. The need for pressurized high flow rate fueling
systems as the primary method for refueling military and commercial airplanes has emerged
because of the following considerations:
a. Increased fuel capacity of airplanes
b. Faster turnaround time required
c. Less ground handling equipment necessary
d. Safety to operator of single point filling
e. Reduced damage to air vehicle skins due to personnel walking on the air vehicle
f. Reduction of contamination introduction into system
g. Aerial refueling
The 600 gallons size recommendation is an arbitrary dividing point. In general, small air
vehicles with only a few tanks to refuel can avoid the complication, weight, and cost of a
pressure refueling system. All air vehicles should incorporate a gravity refueling capability at
least in each main tank for backup in case the refueling adapter is damaged.
E.4.4.5.8.4 Pressure refueling.

The pressure refueling capability shall be verified by (TBS) .

Pressure refueling verification should assess mission requirements to determine the level of
verification

TBS: The pressure refueling capability should be verified by analysis and aircraft test. The
type of pressure refueling adapters should be verified by inspection.

Pressurized refueling has the potential to create high surge pressures. Valve closure rates
should be evaluated to ensure that no pressure transients occur.
690
JSSG-2009A
APPENDIX E
E.3.4.5.8.5 Adapter location.

The ground refueling adapter shall be located to safely permit (TBS) and avoid
environmental contamination from entering the fuel system.
Some missions require accomplishing other functions while the air vehicle is being refueled.
Fighter air vehicles have frequently required ammunition or armament loading during refueling.
Cargo air vehicles could require cargo loading during refueling.

TBS should be filled in with operations allowed to take place concurrently with refueling of the
air vehicle.
The mission plans should be reviewed to determine what operations are required during
refueling. Simultaneous operations during refueling should be identified as early as possible.
Relocating the refueling adapter after the initial design has been approved is very difficult.
Good design practice is to locate the adapter so that ground support elevating devices are not
required for connecting the nozzle; however, some air vehicle designs such as the B-2 may not
have any suitable air vehicle structure which can be reached from ground level for location of
the refueling connection. For this situation a support device must be provided.
For air vehicles where hot refueling is required, the adapter should be located compatible with
other types of air vehicles. F-15, F-16, and F-22 refuel from the left side.
E.4.4.5.8.5 Adapter location.

The ability to conduct simultaneous operations shall be verified by (TBS) .
Verification should be accomplished considering all interface and operational requirements.

TBS: Simultaneous operations during refueling should be verified by analysis and a ground
demonstration.

Low observable requirements may create additional interface requirements on where refuel
adapters may be located.
691
JSSG-2009A
APPENDIX E
E.3.4.5.8.6 Refueling adapter leakage prevention.

The ground refueling adapter installation shall prevent external leakage in the event of adapter
poppet leakage.
This is a safety requirement and should not be tailored.

Fuel pressure applied to the back side of a damaged ground refueling adapter will result in a
fuel leak. The damage to the adapter can go undetected during ground refueling.
Cracked housings, stuck or cocked poppets, and damaged poppet seals have been a common
problem with the ground refueling adapters.
Fuel pressure from the fuel transfer subsystem or from aerial refueling should be isolated from
the back side of the refueling adapter by the use of a check valve or by a motor operated valve.
If a check valve is used, a manual override for the check valve should be considered if the
refueling adapter is used for the defueling process.

When employing an isolation valve between the single point receptacle and the fuel system
ensure that the isolation valve does not create high pressure transients on closure.
E.4.4.5.8.6 Refueling adapter leakage prevention.

The refueling adapter isolation from fuel pressure during flight shall be verified by (TBS) .

Refueling adapters provide redundancy to prevent a large fuel spill in the event that the
refueling adapter fails.

TBS: The isolation of the refueling adapter should be verified by analysis of system design
parameters, aircraft tests and by inspection of the air vehicle.

Isolation valves can become unstable during high velocity flow and create high pressure
transients upon closing.
692
JSSG-2009A
APPENDIX E
E.3.4.5.8.7 Gravity refueling.

The fuel subsystem shall provide the capability to (TBS) . The gravity refuel interface
provisions shall be in accordance with the international standardization agreements
STANAG 3212 and STANAG 3294. A grounding receptacle shall be provided for bonding the
gravity refuel nozzle to the air vehicle.
A requirement for gravity refueling should be specified. Gravity refueling is accomplished by

flowing fuel directly into an air vehicle fuel tank(s). Fuel flowing through a gravity nozzle can
produce static electricity. Unless the nozzle is bonded to the air vehicle, sparks may be
produced at the nozzle and filler opening.

TBS should be filled in with gravity refueling.
All air vehicles should incorporate a gravity refueling capability. A standard grounding
receptacle per MIL-DTL-83413/6 should be provided near each gravity filler opening.
The international standard agreements for gravity filling orifices are ASCC AIR STD 25/11 and
STANAG 3212. International standards for grounding are covered by STANAG 3632.
A gravity refueling capability is desired in the event of a pressure refueling adapter breakage at
a remote site where a replacement part is not available or when an air vehicle must be refueled
and pressure refueling equipment is broken or not available. Gravity refueling is considered as
an emergency backup capability for large air vehicles and may be the only refueling capability
for a small air vehicle.
Some air vehicles have a filler cap on each tank. The current trend has been to incorporate a
filler cap on each main tank.
The main tanks can be gravity refueled and then transfer to other air vehicle tanks by the air
vehicle transfer system to obtain the desired load.
E.4.4.5.8.7 Gravity refueling.

The gravity refueling capability shall be verified by (TBS 1) . The grounding receptacles shall
be verified by (TBS 2) .

(TBD)
693
JSSG-2009A
APPENDIX E

TBS 1: The gravity refueling capability should be verified by a demonstration.
TBS 2: The presence of MIL-DTL-83413/6 grounding receptacles should be verified by
inspection. Resistance tests of the receptacle to structure should be made to verify proper
bonding of the receptacle.

(TBD)
E.3.4.5.8.8 Hot refueling.

The air vehicle shall be capable of being refueled with (TBS) operating.
The requirement to refuel with an engine operating (hot refueling) or to use an air vehicle APU
to provide electrical power for refueling in lieu of battery power or external power should be
identified.

TBS should be filled in with either engine or APU.
The refueling of an air vehicle is a hazardous operation. The operation of an engine or APU
during hot refueling increases the hazard. The requirement for hot refueling should be defined
early in the program by the using command.
Hot refueling reduces the required ground equipment at a base and improves air vehicle turn
around time. Operation of an APU can reduce battery size especially under cold temperature
conditions. A requirement for hot refueling has a large impact on the vent outlet location,
refueling adapter and controls location, and the required reliability of the refueling system. The
vent outlet location in relation to hot brakes and engine or APU exhaust wake should be
considered.
694
JSSG-2009A
APPENDIX E
E.4.4.5.8.8 Hot refueling.

The capability of being refueled with an engine or APU operating shall be verified by (TBS) .

(TBD)

TBS: The capability to refuel with the engine or APU operating should be verified by a
demonstration.
The Using Service should conduct a satisfactory system safety analysis in accordance with that
service’s policies, procedures and directives prior to performing any hot refueling operations.
T.O. 00-25-172 can be used for hot refueling guidance.
E.3.4.5.8.9 Helicopter in flight refueling (HIFR).

If required, rotary wing air vehicles shall be provided with the capability to HIFR. Air vehicle
HIFR refueling provision adapter shall be in accordance with MIL-A-25896.

Most rotary wing air vehicles require HIFR capability to meet design mission requirements.

The air vehicle HIFR system should be capable of receiving fuel at the flow rates and at the
pressures defined in STANAG 1280 and STANAG 3487.
The air vehicle should be configured with HIFR capability which utilizes a Single Point Refueling
(SPR) adapter in accordance with STANAG 3105 and MS 24484. The adapter location should
allow manual connection of an SPR nozzle in the cabin.
The requirement to monitor for water, and/or removal of water from, the fuel during HIFR should
be considered and provisions should be made.
The requirement for HIFR capability should be specified by the procuring activity.

Helicopter in-flight refueling has been a legacy requirement in virtually all naval helicopters.
Recent feedback from helicopter operators indicates that HIFR may not be conducted as part of
normal operations, or as frequently as it has been on legacy helicopters. Although HIFR may
695
JSSG-2009A
APPENDIX E
not be part of normal mission operations, it may still be a viable emergency refueling capability
for shipboard operations in rough-sea states.
E.4.4.5.8.9 Helicopter in flight refueling (HIFR).

The air vehicle HIFR capability shall be verified by (TBS).

The ability to HIFR is important to the mission of the helicopter and should be verified to ensure
it can be safely accomplished.

TBS: Helicopter in in-flight refueling capability should be verified by component test, ground
testing, and flight test.

(TBD)
E.3.4.5.8.10 Fuel subsystem refueling pre-check.

A pre-check capability shall be provided prior to or during the first minute of refueling.
Assurance that the level control valves are operable and will close when each tank reaches the
full or preset fuel level is critical during pressure refueling, and a hot refueling exercise when air
vehicle engines are turning. New, stringent environmental regulations and reporting procedures
for fuel spills make this a highly desirable feature.
This is a safety requirement and should not be tailored. Pre-check should not be implemented
prior to aerial refueling, unless failure to shut-off refueling flow can result in a catastrophic failure
or an unsafe operating condition. A failed pre-check status will not preclude aerial refueling.
Without a pre-check feature, the first sign of a valve failure could be fuel spilling out of the vent.
A pre-check feature is considered to improve the safety of ground refueling. A pre-check system
which operates the valves in a normal manner is preferred.
A “float the float” method where fuel is admitted to chamber surrounding the valves control floats
has proven very reliable. A fuel bypass line controlled by a solenoid valve permits fuel flow to
the chamber. As the chamber fills the control floats will raise thereby activating the valve. When
the valves close, a drastically reduced fuel flow on the refueling unit flowmeters will verify that
the valves have closed. The chamber will drain when the bypass flow is stopped.
The pre-check can be mechanically or electrically controlled.
696
JSSG-2009A
APPENDIX E
E.4.4.5.8.10 Fuel subsystem refueling pre-check.

The pre-check capability shall be verified by (TBS).

The pre-check mechanisms must work and be verified to ensure the fuel system will meet its
safety requirements, not overflow, nor cause a spill.

TBS: The presence and operation of the pre-check system should be verified on the fuel test rig
and during a ground refueling demonstration.

(TBD)
E.3.4.5.8.11 Static discharge in fuel tanks.

The fuel subsystem shall minimize static electricity discharge within the fuel tanks by (TBS)
and system.

Each air vehicle must incorporate design principles and features to minimize the possibility of
sparks and ignition sources occurring within the fuel tank. The system design must consider
fuels having both good conductivity and poor conductivity. A mandatory electrical conductivity
additive has been introduced into JP-4 and JP-8 fuels to minimize static electricity buildup;
however, good design practices must continue to be incorporated, as the electrical conductivity
additive is not required for air vehicle operations should continue to be incorporated. The
primary concern for static electricity is with a highly volatile fuel which does not contain the
electrical conductivity additive. Most commercial fuels do not contain electrical conductivity
additives.

TBS should be filled in with the fuel subsystem will minimize static electricity discharge with
consideration given to the following:
The refueling subsystem should prevent sparking or ignition sources occurring within the fuel
tanks during ground and aerial refueling by:
a. Electrical bonding of all fuel components to structure with a bond resistance of
10 megohms or less, or until proven safe based on the components capability not to
produce the minimum ignition energy of 0.25 millijoule.
b. Limiting fuel velocities within lines to no more than 30 ft/sec (20 ft/sec or less is
preferred).
c. Limiting tank entry fuel velocity to no more than 10 ft/sec.
697
JSSG-2009A
APPENDIX E
d. Ensure fuel flow enters a tank only at the tank bottom with induced flow circulation along
the tank bottom surface.
e. Gravity refuel caps should be manufactured from a material that will not cause an
internal arc when lightning attaches to the exterior.
f. Metallic chain lanyards inside the tank should be avoided.
g. The fuel subsystem tubing and components should be electrically bonded to eliminate
static charge accumulation, provide controlled current return paths, and provide lightning
protection.
These guidance items have been proven beneficial in reducing static build up. Additional
information on static electricity is presented in AFAPL-TR-78-56, AFAPL-TR-78-89, and AIR
1662. Ground refueling equipment has been improved to minimize charge generation in the
refueling equipment by controlling the type and location of filters in the system, minimizing fuel
velocities, and providing charge relaxation capability prior to entering the air vehicle. Insuring
good tank surface contact of the incoming fuel and providing fuel circulation as it enters the fuel
tank will assist charge relaxation of the fuel. Surface contact and fuel circulation techniques
also apply to aerial refueling.
The minimum ignition energy verification is accomplished by measuring the capacitance (C) of
2
the component and then the voltage (Vb) at which electrical discharge occurs. If E = 1/2C(Vb) is
less than 0.25 millijoules, the component is safe without bonding. It was determined on the B-2
air vehicle that even though the fuel tanks are of a graphite composite construction the
requirements are no different than for a metal tank. The conductivity of the graphite composite
material is sufficient that in relation to static electricity any charge generated can be dissipated.
The limiting factor was determined to be the conductivity of fuel tank surface coatings.
For electrical bonding, air vehicle applications to date have used MIL-B-5087 and
MIL-STD-1818. Different bonding classifications were defined in MIL-B-5087. Class C bonding
for current return path of electrical components, Class H for shock hazard, Class L for lightning
protection, Class R for radio frequency (rf) potential, and Class S for static charge. For fuel tank
installations Class C, L and Class S were of concern. In all cases the concern is for sparks or
ignition sources occurring within the fuel tank which can ignite fuel vapors. Each class of
bonding must be considered individually for effects on the system. However, the most severe
applicable requirement for each component installation must be met for the bonding to be
acceptable.
MIL-B-5087B Interim Amendment 3 was the last version of this currently cancelled specification.
Amendment 3 attempted to moderate the static bonding requirements and to address the very
small metallic items which could be installed inside a fuel tank. Small items are defined as
items not large enough to accumulate a charge of sufficient magnitude that when discharged
through an optimum point gap will not ignite an optimum fuel-vapor mixture. For small
components, Amendment 3 permitted a laboratory test to measure the energy of any discharge
which could result. If the spark energy was less than the minimum ignition energy of fuel, 0.25
millijoules, the component did not require bonding.
698
JSSG-2009A
APPENDIX E
For static charge dissipation an electrical bond of 10 megohms is sufficient to prevent

accumulation of charge on the fuel or fuel subsystem components; however, Amendment 3
retained the requirement for major components to be bonded with a resistance not to exceed
one ohm. The one ohm requirement was retained because this level had been easy to obtain
when mounting components on metal structures and was easy to measure and verify the
required bond resistance.
The conservative 1 ohm bond resistance requirement is difficult to obtain and verify, and costly
to maintain for composite structures. Although a 10-megohms bond is sufficient to bleed static
charge, it is not known if a major component which is installed with a bond resistance of 10
megohms or slightly less will maintain this resistance for the life of the air vehicle or after the
component has been replaced. A resistance value for a new installation must be established
which will insure a 10 megohms bond for the life of the air vehicle. The bond resistance chosen
must be cost effective during the fabrication and maintenance of the system.
A mandatory conductivity additive has been added to JP-4 and to JP-8. This has greatly
relieved the concern for static electricity during ground and aerial refueling of air vehicle. Static
during operation of the fuel subsystem has not caused a problem other than that associated
with old non-conductive explosion suppression foam. When the additive is present in a fuel, a
charge accumulation can not be measured on fuel within the air vehicle. A remaining concern is
when ground and aerial refueling occurs with a fuel which does not contain the conductivity
additive into a fuel tank which has previously contained a high volatile fuel such as JP-4 or
Jet B. Fuels that do not contain a conductivity additive could generate a charge and fuel vapors
could remain in the tank from the previous high volatile fuel. When a low volatile fuel without
conductivity additive is ground and aerial refueled into a tank which has previously contained
low volatile fuel, a hazard can only exist when the fuel temperature inside the fuel tank is above
the flash point of the low volatile fuel (above 100°F for Jet A or 140°F for JP-5). For an optimum
fuel vapor mixture to exist which will ignite at the minimum ignition energy, the fuel temperature
must be approximately 50°F above the actual flash point of the fuel.
E.4.4.5.8.11 Static discharge in fuel tanks.

The freedom from static electricity discharge within fuel tanks shall be verified by (TBS) .

Static discharge should be eliminated or must be verified to be below the minimum ignition
energy.

TBS: The freedom from sparks within fuel tanks should be verified by analysis of system design
parameters to verify that the design objectives have been met.
Bond resistance of all components installed inside fuel tanks should be measured (verified)
during manufacture and after replacement during maintenance.

Full scale “static” testing is very difficult, if not impossible, to accomplish. A worst-case scenario
of an active fuel without a static additive and with a high charging ground fueling source must be
simulated to obtain measurable or detectable results. Air vehicle ground test or fuel subsystem
699
JSSG-2009A
APPENDIX E
simulator testing should be accomplished to verify the desired fuel velocities have been
obtained.
Each component’s bond resistance should be measured after installation of the component into
the fuel subsystem. Bonding of the fuel subsystem should be verified by inspection of
installation records for each component.
E.3.4.5.8.12 Defueling method(s).

The air vehicle shall be capable of being defueled by the following method(s) (TBS 1) , under
the following normal and failure conditions (TBS 2) .

Defueling methods should be specified for maintenance and emergency operations.

TBS 1 should be filled in with the methods which could be used to defuel the air vehicle. The
external fuel tanks should have the capability of being defueled through the gravity fuel cap.
TBS 2 should be filled in with the normal and failure conditions which the air vehicle would have
to be defueled under.
Any restriction on the defueling operations should be specified. If electrical power will not be
available to operate air vehicle pumps, then defueling should be accomplished by suction from
the defueling equipment, only. The defueling system design should take into consideration that
failures can occur which may prevent defueling of the tank.
The required defueling rate should be accomplished by suction from the defueling ground
equipment assisted by the air vehicle pumps. It should be possible to defuel each tank with any
single failure in the system. The fuel system will be designed to withstand the negative
pressures encountered during suction defueling.

In a system using only a boost pump for defueling, a failure of the boost pump would cause
great difficulty in defueling the tank to repair the boost pump. This situation could require
draining a large quantity of fuel through a water drain valve or removing a tank access door on a
tank containing fuel.
700
JSSG-2009A
APPENDIX E
E.4.4.5.8.12 Defueling method(s).

The method(s) of defueling shall be verified by (TBS 1) . Defueling of each tank of the air
vehicle with the specified failures in the system shall be verified by (TBS 2) .

The ability to verify the defueling process is important for aircraft missions, and air vehicle
maintenance and operations.

TBS 1: The method of defueling should be verified by a demonstration.
TBS 2: Defueling of each tank with specified failures should be verified by analysis.
The procedures should specify each type of air vehicle ground equipment to be used and the
components in the air vehicle which may be operated during defueling.
E.3.4.5.8.13 Defueling rate.

Defueling of the air vehicle shall be accomplished (TBS) . (Value for blank must be derived
for each type and capacity air vehicle.)
Every tank on an air vehicle must have a defueling capability to permit fuel removal due to a
mission change or for maintenance actions. The allowable time for defueling the fuel subsystem
should be specified.

TBS should be filled in with the defueling rate for the air vehicle. Specify defueling source. The
air vehicle mission should establish limits for defueling in consonance with operation and
maintenance plans.
A defuel rate of 200 gallons per minute (gpm) per defueling connection has been specified for
several different air vehicles. A defueling time based on this rate for the full load of a large
transport could be very long. The required time should be based on a predicted useful function
such as the time to defuel the largest tank on the air vehicle or to remove a specified quantity of
fuel from the air vehicle. Defueling rates of 200 gpm can usually be accomplished by the
defueling ground equipment assisted by the air vehicle transfer or boost pumps. Specifying
unrealistic short defuel times requires a high defuel rate which can impose unnecessary weight
and cost impacts on the air vehicle.
701
JSSG-2009A
APPENDIX E
For air vehicles with a small fuel load, a low defueling rate, such as by gravity drain, would be
acceptable. System design should preclude negative pressures in the tanks during the
defueling process.
E.4.4.5.8.13 Defueling rate.

Defueling rate shall be verified by (TBS) .

Verification of defueling rates is important to ensure mission planning can be accomplished in
the specified time.

TBS: Defueling time should be verified by analysis and a ground demonstration.
The test procedures should specify the quantity and distribution of fuel on the air vehicle.
E.3.4.5.8.14 Defueling crashed air vehicle.

In the event of a wheels-up landing, it shall be possible to defuel (TBS) .
In a crash landing, the defueling adapter could be damaged, preventing defueling. Defueling of
crashed air vehicles is desired in order to reduce hazards and to lighten the weight of the air
vehicle for removal from the runway.

Access should be provided, preferably into the top, of each fuel tank.
An access hole in the top of each tank will allow emergency defueling of the tank without cutting
a hole in the top surface of the tank. The access hole can be any opening such as filler
opening, component cover, or access door which will permit insertion of a stiff hose to the
bottom of the tank. Many air vehicles have used the gravity filler caps on top of each wing to
defuel each tank. The current trend has been to eliminate the gravity filler caps or to install a
gravity filler cap for only the main tanks; therefore, the design problem for emergency is much
more difficult and should be considered early in the design of the fuel tanks.
702
JSSG-2009A
APPENDIX E
E.4.4.5.8.14 Defueling crashed air vehicle.

The capability to defuel each tank under damaged refueling adapter conditions shall be verified
by
(TBS) .

Verification of dufueling a crashed air vehicle is important to allow mishap investigation boards
to be able to conduct an investigation.
TBS: The capability to defuel with a damaged refueling adapter should be verified by analysis.

Moving or gaining access to a mishap air vehicle requires safely removing residual fuel.
E.3.4.5.9 Fuel venting.

The fuel venting shall prevent the pressure of each fuel tank from exceeding its tank proof
pressure and any negative pressure within the tanks’ structural limits. This shall be prevented
during: ground refueling, aerial refueling, including any single fuel subsystem component failure
throughout the usage envelope. Fuel venting shall prevent siphoning and spillage of fuel except
during (TBS) flight maneuvers. The fuel vent shall not ice under any expected ground or
flight conditions.

The primary function of a fuel vent is to maintain the fuel tank pressures within the allowable
structural limits of the air vehicle.

The fuel vent subsystem should prevent the pressure of each fuel tank from exceeding the proof
pressure of the tank.
TBS: The sensitivity of an air vehicle to an uncommanded fuel transfer through a vent is a
function of the air vehicle’s fuel tank (size and geometry), plumbing connectivity and general
architectural arrangement. The weight and cost of preventing all transfers under extreme
attitudes can be high. A quantity which does not adversely affect air vehicle center of gravity or
allow excessive overboard spillage may be permitted. Inter-tank transfer through the vent
subsystem should be minimized.
Fuel tanks are not constructed to withstand high pressures or any appreciable negative
pressure. The design pressure limit for the fuel tanks should be the basis for the vent
subsystem sizing.
703
JSSG-2009A
APPENDIX E
The vent system configuration should prevent the vent path from being closed under all
conditions and attitudes, except for vehicle rollover conditions.
Fuel spillage should be prevented in the event of air vehicle rollover.

The structural requirements for a fuel tank are a combination of several different loads such as
fight loads, gust loads, and pressure loads. The design proof pressure and limit loads for the
fuel tanks must be derived in concert with the total structural criteria and identified for the vent
subsystem design. The significant operating conditions for which the vent subsystem should be
designed and verified are:
a. Maximum desired rate of in-take of air or gas into the fuel tanks due to engine fuel
consumption, fuel transfer, and rapid descent, and refueling.
b. Maximum rate of expulsion of air, vapor, or liquid from the fuel tanks. The design must
account for failure of a level control valve during ground or aerial refueling.
c. Negative pressure limits for maximum rate defueling and descent.
d. Single failures in refueling sources; such asincluding refuel shutoff valves and failed
pressure regulators.
Vent subsystems may be classified according to their function, such as:
a. Dive vent subsystem, which generally ingests air and gas into the fuel tanks.
b. Climb vent subsystem, which generally expels vapor from the fuel tanks.
In addition, vent subsystems may be classified according to their configuration, such as:
a. Open subsystem, where tank pressure is maintained about equal communicated directly
to the outside ambient pressure.
b. Closed or pressurized system, where the tank pressure is maintained at a pressure level
above ambient by installing a vent relief and control valve in the overboard vent line to
regulate the tank pressure in relation to the ambient pressure.
A complete description of vent subsystems and methods of analysis is presented in
NAVAIR 06-5-504.
Failure of a level control or refuel shutoff valve during aerial refueling has typically been the
most critical failure for causing the maximum fuel tank positive pressure. The proper design and
sizing of vent subsystems involves an analysis of all air vehicle operating conditions and failure
modes to determine which are the most critical. Vent lines should not be interconnected to
perform multiple functions, (fuel transfer, fuel dump). In certain applications interconnected
vents may be necessary to reduce weight, space, and system complexity. Vent subsystem
arrangements which interconnect tanks with common vent lines should be examined carefully
for inter-tank fuel transfer for reasonable extreme attitudes. Definition and agreement for the
extreme attitudes to be considered in the design is essential.
All multiple functions of an interconnected vent subsystem arrangement should be identified for
all probable air vehicle operating conditions. The design should consider single fuel subsystem
component and pressurization component failures to assure the proof pressure of any tank will
not be exceeded. The simplest subsystem arrangement is to provide completely independent
704
JSSG-2009A
APPENDIX E
vent lines for each tank; however, this is the most costly in terms of weight and space.
Termination of the vent lines at a common outlet on the air vehicle is generally acceptable. Vent
outlets, which perform multiple functions, such as fuel dump and tank venting, should be
avoided, unless it is verified that tank pressure requirements are never exceeded when the
outlet is performing this multiple function with the most critical single component failure.
The F-15 fuel vent subsystem uses interconnected lines to perform simultaneous functions.
The design permits overboard expulsion of fuel during refueling with a failed level control valve,
permits overboard expulsion of transfer fuel which may overfill feed tanks during negative “g”
operation, and allows overboard expulsion of excessive air flow from the external tanks in the
event of external tank valve failure.
In several cases when the system is performing one of its normal functions in an extreme flight
envelope condition simultaneously with a single failure requiring another vent subsystem
function, a severe fuel tank overpressure condition results. In all of the possible F-15
overpressure cases except one, involving the vent and dump subsystem interaction, either
pressurized fuel or pressurized air is entering the internal tanks through the level control valves.
A possible method of eliminating tank overpressure due to fuel or air flow through the level
control valves would be to provide valves which are both level sensitive (shut off at a prescribed
tank fuel level) and internal tank pressure sensitive (shut off when tank pressure relative to
ambient exceeds the prescribed limit). This type level control valve capability has not been
developed in an integrated single package.
Due to space limitations, which prohibited installation of separate vent subsystem and dump
outlets, the F-15 employed the same outlet to perform both functions. The dump line was
connected downstream of the vent relief valve. A destructive tank overpressure condition was
produced when the pressurization air regulator failed open during fuel dumping operations.
Pressurized fuel being dumped overboard blocked the vent relief valve. Excessive air pressure
from the failed regulator was not relieved through the vent outlet due to the blocking. Pressure
in the tank increased until rupture occurred.
It was also determined on the F-15 that the most critical failure mode of a level control valve
was when the failure occurred in the first tank to fill while other tanks were still filling. The failed
level control valve allowed pressurized fuel to flow into the vent lines and outlets thus restricting
air flow from the other tanks. This combination of conditions can result in a destructive tank
overpressure.
It was extremely difficult to correct these F-15 problems and integrate the fixes into the air
vehicle.
Fuel will start to boil when the ambient pressure at the liquid surface falls below the true vapor
pressure of the fuel. The initiation of boiling, normally called the boiling altitude, for a particular
fuel is dependent on the fuel temperature. The boiling altitude is very high for a low vapor
pressure fuel such as JP-5 or JP-8 at normal temperatures. For JP-4, with a Reid vapor
pressure of 2-3 psia, the boil-off can be significant for high performance air vehicles which use
the fuel as a heat sink and then return it to the tank.
A pressurization subsystem may be desired to pressurize fuel tanks to reduce fuel boil-off at
high altitude, to prevent transfer boost pump cavitation, to transfer fuel by differential pressure,
to transfer fuel from an external tank, or may be necessary in conjunction with an inerting
system. The identification of pressurization requirements must be based on the type and
mission of the air vehicle and the fuel intended for use. If government furnished external tanks
705
JSSG-2009A
APPENDIX E
are provided, it may require pressurization for fuel transfer. Pressurization level is determined in
relation to tank pressure capability and type of fuel. Pressure level and temperature limitations
should be identified during the pressurization subsystem development in relation to modes of
operation and failure of associated subsystem components. The pressurization subsystem
should not cause tank pressures in excess of proof pressure (positive or negative) as a result of
any single failure during any ground or flight condition, or during simultaneous operation of any
other fuel subsystem such as fuel dump subsystem, or component or fuel temperatures in
excess of 450°F. A thermal study should be conducted to verify that the temperatures of
components, tank walls, and ullage space meet the temperature requirements. The
temperature survey should account for any temperature rise which may occur as a result of a
failed pressure regulator, vent valve, or any other selected component. Extended periods of
elevated fuel temperatures will cause an accelerated aging of elastomeric materials in flexible
tanks as well as increasing fuel permeability through tank walls. The pressurization subsystem
design should avoid a sudden release of pressure (depressurization) to minimize the pop bottle
effect and the blowing of fuel out of the vent.
Vent outlet location and the use of flame arrestors in vent lines should be considered in lightning
protection.
Every vent subsystem arrangement should be thoroughly analyzed for transfer through the vent
subsystem and its effect on fuel balance and fuel spillage. It is extremely difficult to prevent all
vent transfer or overboard leakage during flight maneuvers; however, a small quantity can be
tolerated. The establishment of an allowable transfer or leakage limit could prevent unnecessary
complication of the vent subsystem. Fuel from the vent lines can be collected in a collector tank
and then scavenged back into the system.
E.4.4.5.9 Fuel venting.

The ability of fuel venting to limit tank pressure shall be verified by (TBS 1) . The limits of
vent line fuel transfer shall be verified by (TBS 2) .

The fuel venting tests should be conducted to determine the following:
a. Adequacy of vent line size during extreme operating conditions
b. Fuel evaporation loss
c. Effectiveness of tank pressure control system
d. Fuel slugging or siphoning losses, if any, during air vehicle taxing, catapult, or arrested
landing
e. Climb and dive venting
f. Performance during ground refueling and defueling.
TBS 1: The ability of fuel venting to limit tank pressure should be verified by analysis,
development rig tests, and flight tests. Selected conditions should be flight tested to correlate
flight test data with fuel subsystem rig test results.
706
JSSG-2009A
APPENDIX E
TBS 2: The ability of fuel venting to minimize vent line fuel transfer should be verified by
analysis, fuel subsystem rig tests, ground and flight tests. Vent subsystem designs which use
inter-tank fuel transfer through the vent lines should be verified during fuel transfer and vent
subsystem ground and flight tests.

Verification of fuel venting solely by air vehicle tests is not advised because some extreme
conditions could result in excessive pressure and could cause damage to the tank structure.
The vent subsystem should be evaluated under the following conditions and maneuvers:
a. The air vehicle should be flown at maximum rate of climb to its service ceiling followed
by a maximum practical rate of descent to minimum safe altitude. The dive should be
accomplished with the minimum safe quantity of fuel aboard. Pressure data for each
tank should be recorded.
b. With full fuel tanks it should be demonstrated that fuel spillage does not occur as a result
of take-off and landing accelerations or a rejected take-off, uncoordinated turns,
afterburner and speed brake applications.
c. Air vehicles where design performance includes inverted or negative “g” flights should be
flown in this manner for a maximum period as determined by the air vehicle system
specification.
d. Prevention of fuel venting from thermal expansion of full tanks that have been refueled
with cold fuel then exposed to maximum diurnal cycles should be demonstrated. Large
air vehicles can take up to 72 hours to reach thermal equilibrium after being exposed to
extreme ambient conditions. (Source: USAF McKinley Climatic Hangar, Eglin AFB, FL)
For air vehicles where the vent system must be blocked during maintenance to pressure check
the vent system or tanks, special Aerospace Ground Equipment (AGE) should be designed for
plugging the vent lines. The AGE should be so designed that it will not cause damage to the
tank skin in the event it is left in the vent system at the conclusion of the maintenance.
E.3.4.5.9.1 Vent leakage.

Overboard fuel leakage through the vents, while the air vehicle is on the ground or shipboard,
shall be prevented.

Fuel spillage from the vent during ground and shipboard operation, and routine movement of the
air vehicle should be preventedis a fire and environmental hazard.

There should be zero leakage when the air vehicle is parked, during ground and aerial refueling,
during engine run-ups, during taxiing, or during air vehicle shutdown.

Failed components and leaking valves should be considered for potential overboard leakage.
Fuel spillage (“blow out” or discharge) during depressurization of fuel tanks has been a common
707
JSSG-2009A
APPENDIX E
problem for many air vehicles. Fuel which has been trapped in the vent lines will be discharged
out of the vents when the vent valves are opened to relieve fuel tank pressure. This can occur
during touch down where the weight on wheels switch results in the fuel tanks being
depressurized. If this occurs, a safety concern with hot brakes generally follows. Another
common cause of overboard leakage is due to thermal expansion of the fuel.
Although the overboard leakage of high flash point fuel such as JP-8 and JP-5 may not
necessarily be a safety problem, this leakage should be prevented due to its ability to damage
asphalt aprons and runways.
Fuel spillage is considered a serious environmental hazard and may result in costly hazardous
waste management and environmental repair activity.
E.4.4.5.9.1 Vent leakage.

The absence of fuel leakage through the vents shall be verified by (TBS) .

Verification of the absence of fuel leakage should be considered a safety and environmental
hazard.

TBS: The absence of leakage through the vents should be verified by analysis, development rig
tests, and by a ground refueling demonstration and taxi tests.

The C-17 has experienced small quantities of fuel leakages through the vent system caused by
the OBIGGS system.
The V-22 has experienced both small and large quantity fuel spillage through the vents system
due to unreliable rupture disk performance, vent plumbing (including couplings and joints) being
below the normal high level shutoff quantity of the fuel, and high level shutoff failures (during
both refueling and normal fuel transfer).
E.3.4.5.9.2 Vent outlet location.

Fuel or fuel vapors that flow out of the vent outlets shall not impinge onto the air vehicle or come
in contact with the engine inlet and exhaust system, air vehicle brakes, air inlets or air pressure
sensor ports, or other aircraft interfaces that are intolerant of fuel or fuel vapors.

A vent outlet location(s) should be selected based on the assumption that fuel will flow out from
the vent. Concern for fuel impingement on the air vehicle should be established.

Fuel or vapors discharged from the vent outlets should not blow back onto impinge on the air
vehicle or come into contact with the engine exhaust system, air vehicle brakes, or air inlets or
air pressure sensor ports. The tank vent outlet should be located so that foreign matter thrown
708
JSSG-2009A
APPENDIX E
up by the air vehicle wheels will not enter or block the vent outlet. The outlet should be located
so that any moisture collecting in the line will drain to the outlet and prevent the entrance of
water from entering into the fuel system, or reducing the available flow area through the vent
system. The vent outlet location and configuration should prevent the formation of ice which
could partially or completely block the outlet. Lightning hazards should be considered when
determining the vent outlet location.

To enhance system safety design use flexible hoses at the tank vent outlet connections to allow
tank displacement. Another method is to route the vent line inside the tank in a manner that
prevents spillage at any air vehicle attitude. The vent valve may use a float to close the vent as
fuel reaches it, plus a weight to keep it closed when inverted. The valve should remain open
during normal operation.
In the event of air vehicle rollover, fuel spillage should be prevented with internally mounted vent
valves.
E.4.4.5.9.2 Vent outlet location.

Absence of fuel impingement during fuel venting shall be verified by (TBS) .

If any component failure can cause fuel to vent overboard, tests should be conducted to
determine if impingement is possible.

TBS: Absence of fuel impingement during fuel venting should be verified by analysis,
component test (especially for icing), and flight test.

Appropriate tests should be conducted, as indicated by the failure analysis and simulator tests.
If any component failure can cause fuel to vent overboard, tests should be conducted to
determine if impingement is possible. Dyed fuel or pink fuel sensitive “paint” (e.g., LD5) can be
used during the testing to mark any fuel venting and impingement on the air vehicle. It is
difficult to determine where the leakage fuel flows in flight. The dye on the air vehicle provides
visual proof of leakage during post-flight inspections. Typically, the pink fuel sensitive “paint” on
the air vehicle changes color (i.e., from pink to red) when exposed to fuel, and provides visual
proof of leakage to a chase pilot and during post-flight inspections. A wash coat of material that
will be removed by fuel can also be used to mark fuel impingement.
709
JSSG-2009A
APPENDIX E
E.3.4.5.10 Fuel dump.

Fuel dump shall be provided to achieve a safe landing weight in (TBS) . During fuel dump
operations, fuel shall not re-enter the air vehicle when the air vehicle is in any normal flight
attitude or an emergency descent attitude. The fuel dump operation shall not in any way
adversely affect the controllability of the air vehicle. The dumped fuel shall not impinge on the
air vehicle.

A fuel dump subsystem provides means to dump fuel in flight to reduce the air vehicle fuel load
rapidly to a lower, safer landing weight. This may be desired due to an air vehicle structural
limitation or for an additional safety margin in case of air vehicle failures, battle damage, or due
to an air vehicle structural limitation. The dump mast or dump chute should be located so that
dumped fuel will not re-enter the air vehicle or cause a hazardous condition.

TBS: A fuel dump should be provided to off-load a sufficient quantity of fuel to reduce the
weight of the air vehicle from the maximum take-off gross weight to a desired landing weight in
approximately ten minutes (other times may be used as determined from mission plans or user
requirements).
There should be a quantity of fuel, approximately equal to the reserve fuel quantity, in the feed
tanks, which cannot be dumped. If no other guidance is provided, OPNAVINST 3710.7T
provides a definition of reserve fuel.
For Navy, the air vehicle should achieve carrier landing weight in the time it takes for take-off
and immediate recovery aboard ship.
An explicitly stated, minimum average dump rate is also an acceptable method of defining the
dump subsystem requirement, in lieu of deriving an operational requirement.
The dumped fuel should not impinge on the air vehicle.
It is imperative that an early assessment (before structural and outer mold-line configurations
are finalized) of the fuel dump outlet location be conducted to ensure successful verification of
dump.

A dump rate of one percent per minute of the maximum air vehicle gross weight has been used
as a method of for specifying the dump rate. This has produced a reasonably balanced design
in relation to pump size. A high dump rate is desired to minimize the time to get down to a safer
landing condition; however, the dump rate should not totally solely drive the design in relation to
pump requirements. The dump subsystem should be capable of activatingon or stopping during
any flight condition. The subsystem should be incapable of dumping fuel below the designated
“low fuel warning” level. Some aircraft, such as the X-47, had imposed a specific design
requirement not to allow fuel dump from engine feed tanks. An automatic means of terminating
dump should be considered.
The actual location and design of the dump mast is influenced by aerodynamic considerations.
Dump subsystems are low pressure, high fuel flow systems. The flow rate and flow pattern are
710
JSSG-2009A
APPENDIX E
significantly affected by basic air vehicle attitude and speed. Avoidance of impingement may
not be possible in all flight attitudes, if the proper location is not identified. Areas of the air
vehicle, which may be subjected to fuel impingement, should be sealed with fuel resistant
materials. Fuel spillage or leakage as a result of failure of the dump valve should be considered
for air vehicle ground safety. Controls for the dump subsystem should be protected from
accidental activation.
E.4.4.5.10 Fuel dump.

The operation of the fuel dump shall be verified by (TBS 1) . Absence of fuel re-entry during
normal flight attitude and emergency descent attitude shall be verified by (TBS 2) .

Fuel dump capability for USAF should be considered a safety critical function since fuel dump is
normally commanded during emergency conditions.
Fuel dump capability for USN should be considered a safety critical function since fuel dump is
a normal procedure for USN aircraft and it is required.

TBS 1: The operation of the fuel dump for quantity and rate should be verified by analysis, on
the fuel subsystem development rig simulator, and by ground or flight test. Fuel dump (jettison)
tests should be conducted in flight. Ground tests may be run to indicate capabilities and time
required to jettison. The flight effect on the dump duct exit cannot, of course, be duplicated.
Since an unobstructed free discharge flow is necessary, water may be used in lieu of fuel
provided that the system components are not adversely affected. If fuel is used, it is
recommended that means be provided to collect the discharge fuel and pipe it safely to a
receiver tank.
TBS 2: Absence of fuel re-entry during normal flight attitude or emergency descent attitudes
should be verified by a flight demonstration.

Do not rely on motion pictures only. The air vehicle should be coated with a dye indicator and a
chase aircraft should observe the test during the dump demonstration. The chase aircraft can
observe where the fuel impinges on the surface by watching the dye indicator during the flight.
After the flight, the air vehicle can be inspected for dye indicators which would indicate fuel
impingement.
Fuel-reactive paint has been used on the F-35, F/A-18E/F, and MV-22 to verify fuel
impingement patterns due to fuel discharged from vent and fuel dump outlets.
711
JSSG-2009A
APPENDIX E
E.3.4.5.11 Fuel used as a heat sink.

The fuel system shall be able to operate under the Thermal Management System heat loads
(during ground and in flight). When fuel is used as a heat sink, the following interface
parameters are required between the fuel subsystem and the subsystems to be cooled:
(TBS) .

The required interface parameters should be specified.

TBS should be filled in with the following parameters when fuel is to be used as a heat sink:
a. Physical
2. Connector loads
b. Fuel conditions
1. Pressure (Maximum, Minimum)
2. Flow rate (Maximum, Minimum)
3. Fuel temperature, in (Maximum, Minimum)
4. Fuel temperature, out (Maximum, Minimum)
c. Heat loads
1. Ground
2. In-flight
3. Heat transfer limits
a) Maximum total heat
b) Maximum heat transfer rates.
The physical connections as well as the flow and fuel temperature parameters must be
identified when fuel is used as a heat sink.

When fuel is used as a heat sink, generally the fuel subsystem engineer has responsibility for
the fuel circulation loop, and the subsystem requiring cooling is responsible for the other fluid
loop including prime responsibility for the heat exchanger. Ownership of any interfacing heat
exchanger(s) varies depending on the program. The fuel subsystem engineer should ensure
that the pressure drop of the fuel path for the heat exchanger satisfies all the fuel flow
requirements of the fuel subsystem. The pressure drop of the fuel flow path should include the
effects of contamination, any required filters or screens, and installation line losses. The heat
exchanger should meet the required pressure drop after the contamination test has been
conducted.
712
JSSG-2009A
APPENDIX E
As the systems become more integrated, like in the F-22 air vehicle, a critical assessment
should be made on how best to handle engine heat loads in terms of heat sink management.
The engine, being autonomous of the air vehicle Environmental Control System and Thermal
Management System, needs to be evaluated early in the program to assess the best balanced
design.
Heat loads on weapons systems continue to increase demands of the fuel subsystem.
E.4.4.5.11 Fuel used as a heat sink.

The interface between the fuel subsystem and another subsystem using fuel as a heat sink shall
be verified by (TBS1) . The overall air vehicle Fuel Thermal Management System (FTMS)
performance shall be verified by _(TBS2)_.

Heat transfer from other subsystems to the fuel is safety and mission critical.
TBS1: When fuel is used as a heat sink, the interface should be verified by analyses,
component, subsystem level simulators, ground rig, and flight tests.
TBS2: Overall air vehicle fuel thermal management performance should be verified by
correlation of the FTMS model to actual flight test data. Flight testing of mission representative
flight profiles are necessary to ensure that all air vehicle level thermal management related
assumptions are captured in the model analysis. A flight test aircraft should be instrumented for
all critical fluid and material temperatures, fluid flows, and pressures for the purpose of
correlating the FTMS model. The correlated model can then be used to verify all required
mission profiles and extreme environmental operating conditions.
Thermal loads generally increase as weapon systems are modified with new avionics or
subsystems. Extra thermal capacity should be included as part of the baseline fuel system
design.
An air vehicle’s FTMS is often a “system” in name only, and practically speaking is actually a
function of the Fuel, Environmental Control, and Engine and Auxilary Power Unit Systems. As
such, the hardware that has direct impact on the overall FTMS performance is owned by those
individual subsystem Integrated Product Teams (IPTs), and not the FTMS Team. Therefore, it
is critical that one of those IPTs be given ownership of and complete responsibility for the FTMS
performance. Thermal analysis, in general, and FTMS performance analysis, specifically,
requires unique skills separate from basic subsystem design so a dedicated FTMS performance
analysis team is required to support FTMS development. However, it is critical that one of the
integrated IPTs have ownership of the overall performance to be able to manage the FTMS
development and impact hardware configuration effectively.
713
JSSG-2009A
APPENDIX E
F/A-18E/F program had a high degree of success in the development of their FTMS by
remaining diligent in monitoring and controlling subsystem heat loads through the use of an
integrated IPT process of all FTMS impacted subsystems.
A high degree of confidence in the final verification of Hot Day FTMS performance was
achieved through the correlation of the FTMS model with actual spec mission flight profiles.
Through the use of the correlated model, NAVAIR/Boeing/NGC were able to confirm
occurrences of FUEL HOT cautions were due to inoperative fuel/air heat exchangers and
successfully replicated the critical fluid temperatures experienced by fleet aircraft with similarly
configured aircraft.
E.3.4.5.12 Controls and monitor
E.4.4.5.12 Controls and monitor
E.3.4.5.12.1 Low level fuel warning.

A low level fuel warning indication shall be provided to indicate a sufficient quantity of fuel
remains in the feed tank to support (TBS) fuel remaining. The low level fuel warning
indication shall be independent of the gauging system or operate through redundant hardware
in the gauging system.

A positive, independent alert device (or system) is required to warn the pilot that the tank
supplying fuel to the engine is not being replenished, and will soon be depleted. The device
should inform the pilot that a known increment of time or quantity volume of fuel remains until
the main tank is depleted.

TBS: Should be filled in with quantity of fuel that allows 20 to 30 minutes of flight at a best cruise
and altitude flight condition, plus at a normal descent and landing, with one missed approach. A
range of 20 to 30 minutes of flight time is specified because the quantity of fuel remaining
associated with the low level fuel warning should be related to the reserve fuel requirement in
OPNAVINST 3710.7. In short, the OPNAVINST requires that 10 percent (10%) of mission fuel
or no less than 20 minutes of reserve flight time is required for mission planning purposes.
Since the reserve fuel quantity is mission range dependent, it is not desirable to provide a fixed
flight time requirement.
To eliminate potential failure modes that can affect mass quantity indications of fuel, it is
important that the low level fuel warning indication provide a volumetric indication of fuel
remaining in the engine feed tank.
Low fuel level warnings should be provided for each engine feed tank, and a tank empty
indication should be provided for all other tanks. Tank empty indications need not be
independent from the basic fuel quantity gauging system.
Coordinate the location and presentation display of the low fuel level warning with Crew
Systems and Human Factors engineers.
714
JSSG-2009A
APPENDIX E

Air vehicles have been lost because the pilot failed to notice the low level light when his
attention was outside the cockpit, and he failed to retard throttles to conserve fuel or he failed to
transfer all fuel. These devices and their wiring should be independent of the fuel gauging
system or should operate after up to any two (2) failures of the fuel gauging system. The low
fuel warning(s) normally indicate(s) sufficient fuel remaining for at least 20 minutes flight at best
cruise and altitude, a normal descent, and landing with one (1) missed approach. In any air
vehicle operated by a single pilot, the warning should be both aural and visual to ensure the
warning is not overlooked in the case the pilot’s attention is focused outside the cockpit. In
some air vehicles, this warning signal has also been used to open transfer valves to ensure all
available usable fuel is transferred into the engine feed tank(s). The warning should be damped
or time delayed and/or have sufficient persistance associated with the low level fuel condition to
prevent premature and cyclic warnings due to fuel sloshing.
Give consideration to the low level fuel indication requirement when determining the size and
shape of the feed tank(s). If a feed tank is sized significantly larger than what is required for low
level fuel indication requirements, it can have an adverse impact. Since the low level fuel
indication in a non-failure mode situation represents the end of the mission, it is reasonable to
derive that the full maneuvering and operating envelop (including negative G operations) is not
required after the low level fuel indication is annunciated.
E.4.4.5.12.1 Low level fuel warning.

Low fuel level warning shall be verified by (TBS) .

Low level fuel waning should be considered a safety critical function.

TBS: The correct fuel level activation of the low fuel warning device should be verified by
analysis, fuel system simulator testing, during fuel calibration tests, and during ground test and
flight test. The testing can be accomplished in conjunction with the fuel tank calibration.
The flight time remaining on the indicated fuel level should be verified by analysis.

Verification of low level warning has been verified during fuel calibration tests. Comparing fuel
calibration data to low level warning has been shown to identify discrepancies.
715
JSSG-2009A
APPENDIX E
E.3.4.5.12.2 Fuel temperature indications.

Fuel temperature indication shall be provided for (TBS) .

Fuels with freezing points in the -46°F to -50°F range, such as Jet-A-1, JP-8 and JP-5, could be
used which could impose special operational procedures for low temperature in high altitude
and long endurance air vehicles. Greater use is being made of fuel as a heat sink before
delivery to the engine or returning it to the fuel tanks. These conditions make it desirable to
provide an accurate indication of the fuel temperature in each critical tank.

TBS should be filled in with each fuel tank and each engine feed line.
The bulk fuel temperature and the temperature of the fuel being delivered to the engine are of
concern to the pilot during operation at extreme temperature conditions. A temperature
indication capability should be provided for each critical fuel tank. Temperature warnings should
be provided for both high and low temperature limits.
Coordinate the location and presentation of the fuel temperature indicator with Crew Systems
and Human Factors engineers.

Without temperature indicators, standard air chart temperatures and air speeds must be used to
estimate fuel temperature. This approach generally results in an over-conservative fuel
temperature limit being used which may impose unnecessary restrictions on air vehicle
operation.
The location of the temperature sensor should be carefully considered so that a true fuel
temperature will be indicated.
E.4.4.5.12.2 Fuel temperature indications.

The operation of fuel temperature indicators shall be verified by (TBS) .

The ability to read the fuel temperature allows more accurate fuel temperature limits to be set,
and is critical for air vehicles that incorporate active Thermal Management Systems.

TBS: The operation of fuel temperature indicators should be verified by component tests and by
ground and flight tests.
716
JSSG-2009A
APPENDIX E

(TBD)
E.3.4.5.12.3 Low fuel pressure indication.

Low fuel pressure indication shall be provided for each engine feed line.

Pressure indicators have proved to be a reliable indicator of failure conditions in the engine fuel
feed system.

The necessary engine fuel cannot be maintained when the fuel boost pump is degraded. A low
fuel pressure cockpit indication should be provided for each engine feed line.
A low pressure indication may be desirable for a transfer manifold to indicate low performance
or lack of performance of transfer pumps.
Coordinate the location and presentation of the low fuel level warning with Crew Systems and
Human Factors engineers.

The pressure pick up point should be as close as possible to the engine fuel inlet.
E.4.4.5.12.3 Low fuel pressure indication.

Activation pressure level for low fuel pressure indication devices shall be verified by (TBS) .

Low fuel pressure in the engine feed system can represent a safety of flight condition.
Verification by test is required, can be used to indicate a problem in the fuel system.

TBS: Low fuel pressure indication devices should be verified by ground tests.

(TBD)
717
JSSG-2009A
APPENDIX E
E.3.4.5.12.4 Fuel unbalance indication.

A fuel unbalance indication shall be provided.

A fuel unbalance warning is needed where air vehicle unbalance may restrict maneuvers.
Warnings are especially needed when the pilot’s attention is diverted to other critical air vehicle
functions such as approach and landing or weapons delivery.

A fuel unbalance warning device should be provided, if a fuel unbalance can occur causing the
c.g. to move outside of the allowed limits.
Coordinate the location and presentation of the fuel unbalance warning with Crew Systems and
Human Factors engineers.

Many air vehicles have been lost because the crew was not aware of a c.g. problem until the air
vehicle departed from normal flight. The lack of awareness has been attributed to faulty or
inoperative fuel quantity indications, poor handbook instructions, heads out of the cockpit flying,
and other causes.
For fighter air vehicles, the warning should be audible or incorporated into the heads-up-display.
The warning system should be independent of the fuel quantity gauge system and must be
capable of being checked for proper operation.
E.4.4.5.12.4 Fuel unbalance indication.

The operation of the fuel unbalance indication shall be verified by (TBS) .

A c.g. problem could cause an aircraft to crash, so an indication of fuel unbalance could warn
the pilot of an unsafe condition.

TBS: The operation of the c.g. warning system should be verified by analyses and ground tests.

(TBD)
718
JSSG-2009A
APPENDIX E
E.3.4.5.12.5 Ground refueling controls.

The ground refueling controls shall have the capability (TBS 1) . The refueling controls and fuel
quantity gauges shall be located (TBS 2) .

The requirement is for system flexibility in the refueling subsystem. Refueling controls and
gauges in the cockpit require that a person be in the cockpit to accomplish refueling. If there is a
preference that no one be in the air vehicle during refueling, then this preference should be
stated.

TBS 1: The refueling subsystem should have the capability to fill any individual fuel tank
including external tanks or to prevent filling one or more tanks while filling the remaining tanks.
TBS 2: The refueling controls and quantity gauges should be located adjacent to the pressure
refueling adapter so that the crew chief can operate the refueling nozzle and the refueling
controls. If the air vehicle is always to be refueled to the full level, then fuel quantity indicators
need not be repeated at the pressure fuel servicing adapter.

Under emergency conditions it is beneficial to have the capability to select individual tanks for
filling or to exclude tanks from filling to allow flying of an air vehicle with a battle damaged or
leaking fuel tank. If there are two sets of fuel quantity indicators on the air vehicle there could be
a slight difference in the indicated values between the two indicators due to system tolerances.
For the Airborne Warning And Control System (AWACS) air vehicle, a ground conversion chart
was developed to reconcile the difference between the two indicators so that the ground crew
could load the correct quantity as read on the ground indicator as requested by the flight crew
which would read the quantity on the cockpit indicator. For example, a system with a 2 percent
(2%) error could indicate 98K pounds on one indicator and 100K on the other indicator.
Personnel limitations should be identified early in the development so that the design of the
system or location of the control panel can be in accordance with the required number of
refueling personnel. The air vehicle should be capable of being refueled or defueled by two (2)
maintenance personnel, one person being the crew chief located at the refueling nozzle and
control panel and the other a free observer to overview the refueling for safety.
719
JSSG-2009A
APPENDIX E
E.4.4.5.12.5 Ground refueling controls.

The ability of the refueling subsystem to fill, partially fill, or to avoid filling individually specified
tanks shall be verified by (TBS 1) . The location of controls and fuel quantity gauges shall be

All fuel tanks should be able to be filled on the ground to ensure an aircraft may lift off with full
tanks. The ability of the refueling personnel to control the air vehicle refueling operation
(including precheck and partial refueling) from the adapter location is a servicing and
operational (i.e., combat turnaround) capability driven requirement. The controls and fuel
quantity gauges should provide accurate information to ensure all tanks fill, as required.
Verification by demonstration is required.

TBS 1: The ability of the refueling system to fill individual, partially fill, or to avoid filling tanks
should be verified by analysis.
TBS 2: Location of controls and fuel quantity gauges should be verified by inspections.

Only in the case of an extremely complex system should a test or demonstration be necessary
to substantiate the analysis.
720
JSSG-2009A
APPENDIX E
E.5 PACKAGING
E.5.1 Packaging.
E.6 NOTES
not mandatory.)
E.6.1 Intended use.

The fuel subsystem descriptions in this appendix are intended for use in air vehicle systems
weapon systems.
E.6.2 Acquisition requirements.

E.6.3 Component information
E.6.3.1 Level control.
A level control must operate over a range of flow rates, pressures, and attitudes. During
refueling or fuel transfer an air vehicle fuel tank will not always be at a level attitude and fuel
pressure at the inlet to the valve will vary over a large range. A range of attitudes, flow rates,
and pressures where the level control valves must operate, should be defined. The range of
required tank attitudes and fuel flow and pressure for which the level control must operate
should be derived from the air vehicle mission profiles, ground refueling sources, aerial refueling
tankers, and allowed runway and apron slopes.
In past applications a standard attitude variation of 15° in any direction has been specified by
the general specification for level control valves, see MIL-V-38003. The 15° requirement has
provided valves which are insensitive to air vehicle attitude and are adequate for the attitude
721
JSSG-2009A
APPENDIX E
variations which are encountered during refueling. All refueling sources as well as the air vehicle
tank to tank transfer capability must be considered to define the range of flow rates and
operating pressures. The allowable tank fuel level rise during valve closure, commonly called
overshoot, must be recognized as well as the rate of valve closure for the control of surge
pressure.
Level control valves may be used in a transfer system of a fighter air vehicle and may be
required to function during low and negative “g” flight maneuvers or during vertical upward and
downward attitudes. The operation of the valve under any achievable air vehicle attitude where
fuel transfer can occur must be defined and the performance of the system controlled to prevent
damaging over pressure as a result of this mode of operation.
a. Valve seat leakage. Small leakage past the valve seat could be tolerated and could
result in a simpler, more reliable valve seat. This leakage should be differentiated from
external leakage. Prohibition of external leakage includes both leakage through the valve
casing walls and subassembly gaskets within the tank and leakage external to the tank
when the valve incorporates a mounting plate on the tank wall. Undesirability of leakage
external to the tank is obvious and leakage through casing walls and gaskets, even
though it could be tolerated, indicates poor component quality.
Some leakage past the valve seat and pilot valve can be tolerated within the fuel tank. A
small allowable leakage in these areas can reduce the cost of the valve. The general
specification for level control valves has in the past allowed 100 cc per minute for dual
pilot valves and 50 cc per minute for single pilot valves. Most fuel subsystems can
tolerate this rate of leakage without any noticeable effect.
Level control valve leakage rate should be verified by component tests.
b. Surge pressure/valve closure rate. Level control valve rate of closure should prevent
refueling surge pressures from exceeding proof pressure of the refueling subsystem.
The rate of closure of the level control valve is the primary method of control of surge
pressure during refueling. The level control valve rate of closure should prevent
refueling surge pressure from exceeding the proof pressure of the refueling subsystem.
A specific rate or type of closure cannot be specified since surge pressure developed is
dependent upon the subsystem in which it is installed. The level control valve may also
incorporate a feature to reopen, if high pressure is sensed. For a specified closure time
a valve closure characteristic which has a rapid reduction of flow area during the initial
stage and a slow rate of flow area reduction during the final stage will produce lower
surge pressures. The level control valve rate of closure and surge control should be
verified by component test. The ability of the valve to limit surge to the specified value
should be demonstrated on the fuel subsystem simulator.
E.6.3.2 Boost pumps.
Pump performance. The pump must be capable of providing rated performance with hot or cold
fuel at any operational altitude with a fuel level two inches above the pump inlet. A pump must
be able to establish and maintain full flow while being taken to altitude as well as being started
after taken to altitude. The pump rated output flow and pressure must be established with
specified minimum or maximum fuel temperature, at the maximum operational altitude, and with
722
JSSG-2009A
APPENDIX E
a minimum fuel height above the pump inlet. The pump is to be capable of providing rated
performance with a fuel level of two inches above the pump inlet when started under altitude
conditions.
All pumps are to be capable of operation with the mounting flange in its normal position and with
the air vehicle in any expected flight attitude. Rated pump performance should not depend on a
large fuel head in the tank. Also, the pump must continue to function when rotated from its
normal position as long as the inlet is covered with fuel. Fuel pumps in auxiliary fuel tanks may
be carried to altitude before they are required to operate. These pumps must provide the
required flow and pressure in a time interval sufficient to meet the air vehicle engine feed or
transfer requirements.
Spar mounted, plug-in boost pumps have been used to obtain easy replacement capability for
maintainability; however, this type of installation, which requires a long pump inlet, has a large
impact on the pump performance. Typical boost pumps which are mounted on a tank bottom
are a “submerged type” and have a very short inlet to the pump impeller. The long inlet of the
spar mounted pump introduces a small but significant fuel pressure drop from the tank to the
impeller. This pressure drop along with decreasing tank ullage pressure causes the evolution of
air from the fuel as the fuel is sucked up the inlet. This is especially detrimental with hot, volatile
fuel such as JP-4 or JET B. If the pump is idle during the climb to altitude, air will evolve from
the fuel and collect in the inlet. When the pump is turned on at altitude, the collected air will
impede the priming of the pump and under some conditions prevent the pump from priming,
thus restricting the altitude performance capability of the pump.
Generally, submerged boost pumps have provided very good reliability and performance. The
predicted pump life and the impact on maintainability should be critically reviewed before the
decision is made to incorporate plug-in pumps.
Dry operation. The pump assembly is to be capable of dry operation for a minimum of five
hours. Transfer tank boost pumps can be left operating after the fuel in the tank has been
depleted. The pump assembly should be capable of an extended period of dry operation. A
minimum period of five hours is recommended, unless a shorter dry run period can be justified.
Dry operation of a boost pump is considered a safety requirement. If the pump does not have a
dry operation capability, the pump could over heat and cause a fuel tank ignition. MIL-P-5238
required incorporation of a thermal protector in electrical pumps. Thermal protection is more
difficult in hydraulic or pneumatic pumps. Although thermal protection is essential for operation,
it does not supersede the need for a dry operation capability. The pump should flow and
pressure should be maintained when fuel is replenished to the tank.
Prime. Establishment of fuel flow after a pump has been uncovered is a basic necessity for
each pump. A pump can become uncovered by fuel depletion or by extreme altitudes of the air
vehicle. Special procedures to prime the pump cannot be tolerated.
The pump should be capable of self prime within a predictable, repeatable time interval
following a period of dry operation or when the inlet has uncovered and then re-submerged in
fuel. A maximum period of 5 seconds is suggested unless a system performance analysis
justifies a longer period.
723
JSSG-2009A
APPENDIX E
Pump testing has been guided by MIL-P-5238. Experience indicates that pump performance
should be conducted in several phases; pump down, altitude climb performance, and altitude
start with non-recirculated, unweathered test fuel, as follows:
a. Pump down. With the pump operating in the test stand, the fuel flow controls should be
adjusted to cause the fuel head above the pump to drop at a rate of one inch per minute
while maintaining rated flow and pressure. The head, output flow, and pressure should
be recorded at intervals of no greater than one-inch change of head. If fuel is returned
to the tank in the test setup, it should not impose any additional velocity or turbulence at
the pump inlet. This test should be conducted at ground level pressure with fuel at 60°F
and to the temperature specified in the detail specification at maximum altitude with fuel
at the high temperature. These tests should be repeated with output flow settings at
80 percent (80%), 50 percent (50%), 25 percent (25%), 10 percent (10%), and 5 percent
(5%) of rated flow. The data will be the basis for a family of curves to define pump flow
capability in relation to fuel head and temperature.
b. Altitude climb performance. Install the pump in an altitude test tank in fresh,
unweathered fuel at the high temperature with the fuel flow and head control set for
conditions in accordance with the detail specification. With the pump not operating, the
rate of climb should be established for the test tank. Power should be applied to the
pump within five seconds or less of climb termination. The pump should achieve the
required pressure and flow within five seconds and should maintain them for at least five
minutes. This test procedure should be repeated at increasing 5,000 feet intervals up to
the maximum operational altitude. The Reid vapor pressure of the fuel used in this test
should be in accordance with the detail specification. For JP-4, the Reid vapor pressure
of the fuel should be no less than 2.5 psia. Blending of a high vapor pressure
component(s) may be necessary to obtain the desired vapor pressure. During heating of
the fuel, there should be no hot spots on the surface of the heat exchanger, which
exceed the maximum fuel temperature by more than 10°F. During the test, variations of
output pressure (pump ripple) should be measured using a high response pressure
transducer with a response in the order of 5000 Hertz. Ripple in excess of one psi RMS
should be examined to determine possible interaction within the system.
c. Dry performance. A dry endurance test should be accomplished on all pumps. The
pump should be operated at rated flow and allowed to pump all fuel from the tank. After
the fuel has been pumped out of the tank, the discharge valve should be closed to
prevent circulation of air through the pump section. Any fuel remaining in the discharge
line between the pump outlet and the discharge valve should be drained. In addition,
action should be taken to prevent contact of residual fuel with the pump. The pump
should continue to be operated in this dry condition. The air vapor in the tank should be
maintained at the high temperature ambient. After 5 hours of dry operation, the pump
should be stopped and the tank refilled with fuel at room temperature. The above cycles
should be accomplished five times at sea level pressure and 15 times at the maximum
operational altitude. The instrumentation should locate and record the maximum case
temperature.
d. Prime. The pump should be mounted in a test tank so that it can be rotated (or moved)
to a position such that the inlet is out of the fuel. The pump output, depth of submersion
of the inlet, fuel temperature, and altitude should be established. The pump should then
be moved to uncover the inlet(s) for at least 15 seconds. When the pump is again
724
JSSG-2009A
APPENDIX E
submerged to the original depth, the pump should resume delivery of fuel at the required
flow and pressure within 5 seconds. The test should be conducted at least six times
(twice at each of three different altitude levels). The altitude levels should be in
accordance with the detail specification.
E.6.4 Acronyms.
AB Afterburner
AFML Air Force Material Laboratory
AGE Aerospace Ground Equipment
ALCM Air Launched Cruise Missile
AIT Auto Ignition Temperature
AWACS Airborne Warning and Control system
cc Cubic Centimeter
CRC Coordinating Research Council
ECS/TMS Environmental Control System / Thermal Management System
EMD Engineering and Manufacturing Development
EO Executive Order
ESF Explosion Suppressant Foam
FTMS Fuel Thermal Management System
FMECA Failure Modes and Effects Criticality Analysis
FSD Full Scale Development
GPM Gallons Per Minute
Hg Mercury
HIFR Helicopter In-Flight Refueling
ICD Interface Control Document
JFS Jet Fuel Starter
LCU Level Control Unit
MAGW Maximum Aircraft Gross Weight
NPSH Net Positive Suction Head
OBIGGS Onboard Inert Gas Generating System
OBOGGS Onboard Oxygen Gas Generating System
OEM Original Equipment Manufacturer
725
JSSG-2009A
APPENDIX E
PPM Parts Per Million

PSIA Pounds Per Square Inch Approximate
PSIG Pounds Per Square Inch Graduated
rf Radio Frequency
SPR Single Point Refueling
VCMS Vehicle Control And Management System
V/L Vapor / Liquid
E.6.5 Subject term (key word) listing.

Adapter
Bladder
Contamination
Defuel
Engine
Flow
Fuel dump
Fuel tank
Gravity refuel
Hot refuel
Leakage
Pressure
Refuel
Relief
Surge
Vent
E.6.6 International standardization agreement implementation.

This specification implements STANAG 1135, Interchangeability of Fuels, Lubricants and
Associated Products Used by The Armed Forces of The North Atlantic Treaty Nations;
STANAG 3105, Pressure Fuelling Connections and Defuelling for Aircraft; STANAG 3212,
Diameters for Gravity Filling Orifices; STANAG 3294, Aircraft Fuel Caps and Fuel Cap Access
Covers; STANAG 3632, Aircraft and Ground Support Equipment Electrical Connections for
Static Groundings; STANAG 3747, Guide Specification (Minimum Quality Standards) for
Aviation Turbine Fuels (F-34, F-35, F-40 and F-44); STANAG 7036, Fuels to be Introduced into
and Delivered by The NATO Pipeline System (NPS); ASCC AIR STD 25/11, Diameters for
Aircraft Gravity Filling Orifices; and ASCC AIR STD 25/17, Pressure Fuelling Replenishment
726
JSSG-2009A
APPENDIX E
Connection. When amendment, revision, or cancellation of this specification is proposed, the

preparing activity must coordinate the action with the U.S. National Point of Contact for the
international standardization agreements, as identified in the ASSIST database at
https://assist.dla.mil/online/start.
E.6.7 Responsible engineering office.

E.6.8 Changes from previous issue.

727
JSSG-2009A
APPENDIX F
APPENDIX F
AIR VEHICLE AERIAL REFUELING SUBSYSTEM
F.1 SCOPE
F.1.1 Scope.
information for the Aerial Refueling Subsystem provided for in Part 1 of this specification. The
F.1.2 Structure.
F.1.3 Appendix.
Finally, Lessons Learned is provided to give insight to past events that could impact the tailoring
of the specification.
F.1.4 Deviations.
728
JSSG-2009A
APPENDIX F
F.1.5 Environmental impact.
F.1.6 Responsible engineering office.
F.2 APPLICABLE DOCUMENTS
F.2.1 General.
they are listed.
F.2.2 Government documents
F.2.2.1 Specifications, standards, and handbooks.

729
JSSG-2009A
APPENDIX F

NORTH ATLANTIC TREATY ORGANIZATION (NATO)
STANAG 3447 Air-to-Air Refuelling Equipment: Probe-Drogue Interface
Characteristics
STANAG 3971 Air-to-Air Refuelling – ATP-3.3.4.2(B) – (ATP-56(B))
(Copies of these documents are available at http://quicksearch.dla.mil, http://nsa.nato.int, and

JSSG-2006 Aircraft Structures Joint Service Specification Guide
MIL-N-25161 Nozzle, Aerial Pressure Refueling, Type MA-2
MIL-T-26561 Tester, Type MA-2 Reception Coupling Break-Away Force,
Portable
MIL-PRF-83282 Hydraulic Fluid, Fire Resistant, Synthetic Hydrocarbon
Base, Metric, NATO Code Number H-537
MIL-PRF-83323 Tester, Universal Receptacle, Aerial Refueling

19111-5094 USA.)
F.2.3 Order of precedence.
F.2.4 Streamlining.
section (first tier). All other documents referenced through tiering may be used for guidance
730
JSSG-2009A
APPENDIX F
F.3 REQUIREMENTS
F.4 VERIFICATIONS
F.3.1 Definition
F.4.1 Definition
F.3.2 Characteristics
F.4.2 Characteristics
F.3.3 Design and construction
F.4.3 Design and construction
F.3.4 Subsystem characteristics
F.4.4 Subsystem characteristics
F.3.4.1 Landing subsystem
F.4.4.1 Landing subsystem
F.3.4.2 Hydraulic subsystem
F.4.4.2 Hydraulic subsystem
F.3.4.3 Auxiliary power subsystem
F.4.4.3 Auxiliary power subsystem
F.3.4.4 Environmental control subsystem
F.4.4.4 Environmental control subsystem
F.3.4.5 Fuel subsystem
F.4.4.5 Fuel subsystem
731
JSSG-2009A
APPENDIX F
F.3.4.6 Aerial refueling subsystem.

The air vehicle shall be equipped with (TBS 1) aerial refueling subsystem(s) to provide the
air vehicle the capability to (TBS 2) under (TBS 3) conditions.

This is an operational and integration requirement. If the air vehicle requires aerial refueling, the
type(s) of subsystem must be specified to ensure that the air vehicle will be compatible with the
required tanker and receiver platforms. The function(s) of each subsystem must be specified to
ensure that the subsystem(s) is (are) integrated properly into the air vehicle.

TBS 1: Specify which type(s) of aerial refueling subsystem is (are) required for the air vehicle;
such as, receiver receptacle, receiver probe, tanker boom, tanker drogue, or other.
TBS 2: If TBS 1 identifies receiver subsystem(s), and a "dry" installation is not desired, specify
that the subsystem(s) should provide the air vehicle the ability to safely receive fuel from the
targeted tanker air vehicle(s) while in flight. If a "dry" installation is required, then specify that
the subsystem(s) should permit the air vehicle the ability to safely conduct aerial refueling
procedures (less fuel transfer) with the targeted tanker air vehicle(s) while in flight. In either
case, the targeted tanker(s) is (are) the list of tanker platforms specified in JSSG-2001, that the
air vehicle must be compatible with to aerial refuel. If it is also required to have the air vehicle
be able to refuel through the receiver aerial refueling subsystem(s) while the air vehicle is on the
ground, then also specify that the subsystem(s) should provide the air vehicle the ability to
safely receive fuel from the targeted ground refueling source(s). The targeted ground refueling
source(s) is (are) the list of ground refueling sources specified in JSSG-2001, from which the air
vehicle must be able to refuel. If a tanker subsystem is identified in TBS 1, as a minimum,
specify in TBS 2 that the subsystem should provide the air vehicle the ability to safely transfer
fuel to another air vehicle, or multiple air vehicles (if applicable), while in flight. If it is also
required to have the air vehicle be able to defuel through the tanker aerial refueling
subsystem(s) while the air vehicle is on the ground, then also specify that the subsystem(s)
should provide the air vehicle the ability to safely transfer fuel to targeted ground platform(s)
while on the ground. The targeted ground platform(s) is (are) the list of ground refueling
platform(s) specified in JSSG-2001. If the air vehicle requires tanker and receiver aerial
refueling subsystems, specify the appropriate phrases above.
TBS 3: For in-flight operation of the aerial refueling subsystem(s), specify that the capability
should be provided under specified environmental conditions. For ground operation of the aerial
refueling subsystem(s), specify in what conditions the subsystem(s) should be able to operate.

Ground use of receiver and tanker aerial refueling subsystems should be required as it permits
ground tests to be conducted to verify tanker and receiver compatibility issues, for example
refuel time, refuel rates, refuel delivery pressures, and fuel surge pressures during transfer. The
ability to initially examine these compatibility parameters on the ground rather than in flight is
very beneficial in controlling any hazard(s) that may occur due to an incompatibility and
permitting a broader examination controlled test points. Ground use of the tanker aerial
732
JSSG-2009A
APPENDIX F
refueling subsystem(s) could also be required when the subsystem(s) is (are) to be used to
conduct Forward Area Refueling Point (FARP) or Forward Area Remote Rearming Point
(FARRP) operations.
Aerial refueling subsystems have typically interfaced with fuel subsystems, hydraulic
subsystems, fire and explosion protection subsystems, electrical subsystems, structures,
avionics, and crew subsystems. As such, references have been made within the appropriate
aerial refueling subsystem Guidance and Lessons Learned sections to requirements within
these other technical disciplines to ensure that the integration of the aerial refueling
subsystem(s) onto the air vehicle is properly addressed.
"Dry" receiver installations are typically incorporated into air vehicles for aerial refueling training
purposes only.
F.4.4.6 Aerial refueling subsystem.

The ability of each aerial refueling subsystem to provide the air vehicle its specified capability
under the identified conditions shall be verified by (TBS) .
The ability of each aerial refueling subsystem to provide the specified capability must be verified
to ensure that the air vehicle can successfully fulfill each of its operational requirements.
TBS: Specify inspection, analysis, ground demonstration, ground test, flight demonstration, and
flight test.

(TBD)
733
JSSG-2009A
APPENDIX F
F.3.4.6.1 General subsystem requirements
F.4.4.6.1 General subsystem requirements
F.3.4.6.1.1 Other subsystem interfaces.

The (TBS 1) aerial refueling subsystem shall interface with the air vehicle's (TBS 2)
subsystem(s) in order for it to properly perform its function(s). The aerial refueling subsystem
shall not adversely impact the performance capability of this (these) other subsystem(s) while
the aerial refueling subsystem is operating properly or when the aerial refueling subsystem
experiences a single failure.
This is an integration and safety requirement. The interfaces of the aerial refueling subsystem
must be identified to ensure that the aerial refueling subsystem is properly integrated into the air
vehicle such that the aerial refueling subsystem can successfully and safely perform its
function(s) and not impact the proper operation of the other air vehicle subsystems.
TBS 1: Specify the particular aerial refueling subsystem.
TBS 2: Identify the other air vehicle subsystem(s) that the specific aerial refueling subsystem
must interface with to perform its function(s).

For aerial refueling subsystems, typical interfaces with other air vehicle subsystems have been:
a. the hydraulic and electrical subsystems for mechanical power requirements
b. the electrical subsystem for lights and other power requirements
c. the fuel subsystem for other power requirements and as a depository for the fuel to be
received or transferred
d. the crew subsystems for displays and controls
e. the vehicle management subsystem for fuel management and flight performance
calculations
f. automatic flight control subsystems
g. communication subsystems
h. structures for installation
Since the aerial refueling subsystem typically directly interfaces with the air vehicle's fuel
subsystem, the impact that the aerial refueling subsystem has on the fuel subsystem's
performance capability should be closely evaluated. The operation of the aerial refueling
subsystem (with and without a single failure) should not compromise the fuel subsystem's
engine feed capability; venting capability; fuel transfer capability for thermal management,
734
JSSG-2009A
APPENDIX F
center-of-gravity (c.g.), and dump and defuel purposes; and fuel containment capability. For
example, a separation of a fuel line that is used to receive or transfer fuel during aerial refueling
should not compromise the venting capability of the fuel subsystem's design.
F.4.4.6.1.1 Other subsystem interfaces.

The ability of (TBS 1) to interface with the air vehicle's (TBS 2) subsystem(s) to allow it
to perform its function(s) while not adversely impacting the performance capability of this(these)
other subsystem(s) shall be verified by (TBS 3) .
The ability of each aerial refueling subsystem to interface properly with other air vehicle
subsystems must be verified to ensure that the aerial refueling subsystem is integrated into the
air vehicle, such that, it and the other air vehicle subsystems can successfully and safely
perform their functions.
TBS 1: Specify receiver or tanker.
TBS 2: Identify the appropriate subsystems on the air vehicle that the particular aerial refueling
subsystem must interface with to operate properly.
TBS 3: Specify inspection, analysis, ground demonstration, ground test, flight demonstration,
flight test or a combination.

Each particular aerial refueling subsystem's ability to perform its function(s) should be evaluated
with the specified air vehicle subsystem interface(s) providing only its (their) minimum
performance requirement(s) to the aerial refueling subsystem.
The impact of the particular aerial refueling subsystem's operation on the performance of the
other air vehicle subsystem(s) that it interfaces with must include the impacts when there is a
single failure in that aerial refueling subsystem.
F.3.4.6.1.2 Single failures.

With the exception of (TBS 1) , no single failures within a tanker aerial refueling subsystem
shall preclude the tanker aerial refueling subsystem from being able to perform its function(s).
With the exception of (TBS 2) , no single failures within a receiver aerial refueling subsystem
shall preclude the receiver aerial refueling subsystem from being able to perform its function(s).
This is an operational and safety requirement. The ability for the air vehicle to successfully
transfer or receive fuel during aerial refueling operations can be operationally and safety critical.
735
JSSG-2009A
APPENDIX F
Each aerial refueling subsystem must be able to perform its identified function(s) even under
certain single failure conditions within that particular aerial refueling subsystem.

TBS 1: Specify what single failure(s) should be permitted to prevent the tanker aerial refueling
subsystem from being able to adequately perform its designated function(s).
TBS 2: Specify what single failure(s) should be permitted to prevent the receiver aerial refueling
subsystem from being able to adequately perform its designated function(s). This requirement
does not apply to an aerial refueling subsystem that is a "dry" installation design.
Typically, noted exceptions for "allowable" single failures have been fuel line integrity, but not
fuel line couplings.
F.4.4.6.1.2 Single failures.

Except for the noted special cases, the ability of the tanker aerial refueling subsystem to
successfully perform its function(s) with a single failure shall be verified by (TBS 1) . Except
for the noted special cases, the ability of the receiver aerial refueling subsystem to successfully
perform its function(s) with a single failure in the receiver aerial refueling subsystem shall be
The ability of each aerial refueling subsystem to successfully and safely perform its function(s)
even under single failure conditions within the aerial refueling subsystem must be verified to
ensure that the air vehicle can successfully and safely complete its mission(s).
TBS 1: Specify analysis, ground demonstration, ground test, and flight test.
TBS 2: Specify analysis, ground demonstration, ground test, and flight test.
Those failures which can not be adequately controlled in flight, or can cause loss of power and
control authority to the air vehicle in flight, should not be evaluated in flight test.
736
JSSG-2009A
APPENDIX F
F.3.4.6.1.3 Operating fuel pressure.

The aerial refueling subsystem shall be designed for an operating pressure of (TBS) .

(TBD)

(TBD)

Tanker/receiver aerial refueling subsystem operating pressures must be designed to be
compatible with all targeted receiver/tanker aerial refueling systems.
F.4.4.6.1.3 Operating fuel pressure.

The aerial refueling subsystem operating fuel pressure shall be verified by (TBS) .

(TBD)

(TBD)

(TBD)
737
JSSG-2009A
APPENDIX F
F.3.4.6.1.4 Subsystem isolation.

Each aerial refueling subsystem shall be capable of being isolated from the fuel pressure
resulting from the normal operation of the air vehicle's fuel subsystem or any other aerial
refueling subsystem. For those designs where manual activation is required to provide the
isolation, the manual activation shall be capable of being initiated by (TBS) .
This is an integration, operational, and safety requirement. Damage or breakage to any aerial
refueling subsystem must not interfere with the proper operation of the air vehicle's fuel
subsystem and any other aerial refueling subsystem installed on the air vehicle. Fuel pressure
resulting from normal operation of the air vehicle's fuel system must be isolated from the aerial
refueling subsystem(s). In addition, if the air vehicle incorporates multiple aerial refueling
subsystems, they must be isolated from each other so that damage within one subsystem will
not prevent the ability to safely use the other subsystem(s) and successfully complete the aerial
refueling process.
TBS: Specify which crew member(s) should be provided this capability. In single seat air
vehicles, the pilot obviously should be given this capability. If there is a co-pilot in the air
vehicle, and the co-pilot is required to perform the aerial refueling process, then this capability
should be provided to the co-pilot also, or only. In some installations, only the flight engineer, or
some other crew member, should be provided this capability.
Isolation has typically been accomplished by either a check valve or by a motor operated control
valve. If a motor operated control valve is used, consideration must be given for a manual
override and access to the valve so that a single failure of the valve will not prevent the
capability to aerial refuel the air vehicle.
F.4.4.6.1.4 Subsystem isolation.

The ability to isolate each aerial refueling subsystem from the air vehicle's fuel subsystem and
any other aerial refueling subsystem shall be verified by (TBS) .
It should be verified that each aerial refueling subsystem can be isolated from the air vehicle's
fuel subsystem and any other aerial refueling subsystem to ensure that no single failure hazards
are introduced to the air vehicle, that single failures do not compromise the proper operation of
the air vehicle's fuel subsystem, and that single failures do not prevent the air vehicle from
safely and successfully aerial refueling from any other aerial refueling subsystem.
738
JSSG-2009A
APPENDIX F
TBS: Specify ground demonstration and during flight test of each aerial refueling subsystem.
The ground demonstration should simulate failures of the various aerial refueling subsystems to
verify that one subsystem can be isolated from the other and the air vehicle's fuel subsystem. If
manual activation is provided for any isolation feature, that capability should be verified in the
flight test along with the adequacy and accessibility of the activation method.
F.3.4.6.1.5 Removed Group B hardware.

The (TBS) aerial refueling subsystem shall not be a source for fuel leaks and shall not
adversely impact the performance capability of other air vehicle subsystems when the Group B
hardware for that aerial refueling subsystem has been removed from the air vehicle.
This is an operational, safety, and integration requirement. The air vehicle may have missions
where the Group B hardware of a particular aerial refueling subsystem must be removed.
Recognizing this need will properly integrate that particular aerial refueling subsystem into the
air vehicle and will ensure that the removal of the Group B hardware does not prevent the
proper function of other subsystems or preclude the air vehicle from being able to safely
accomplish its other mission(s).
TBS: Identify the specific aerial refueling subsystem; such as, the wing drogue aerial refueling
subsystem or the probe aerial refueling subsystem.

This requirement has typically been required for wing drogue aerial refueling subsystems where
the Group B hardware is the aerial refueling pods which have to be removed when the air
vehicle has a mission that does not require the pods. This requirement has also been
applicable for probe aerial refueling subsystems where the Group B hardware is the probe mast
which may have to be removed when the air vehicle does not require the probe refueling
subsystem on a given mission.
739
JSSG-2009A
APPENDIX F
F.4.4.6.1.5 Removed Group B hardware.

The ability of the (TBS 1) aerial refueling subsystem to not leak and to not adversely impact
the performance capability of other air vehicle subsystems when the Group B hardware for that
aerial refueling subsystem has been removed from the air vehicle shall be verified by (TBS 2) .
It must be verified that it is possible to remove the Group B hardware of a particular aerial
refueling subsystem without creating a fire hazard to the air vehicle or without impacting the
proper operation of other air vehicle subsystems to ensure that the air vehicle will be able to
accomplish all of its missions safely.

TBS 1: Identify the specific aerial refueling subsystem; such as, the wing pod aerial refueling
subsystem or the probe aerial refueling subsystem.
TBS 2: Specify ground demonstration and during flight test.

Flight test should evaluate the performance of the fuel system and other aerial refueling
subsystems in the air vehicle when a particular Group B hardware to an aerial refueling
subsystem has been removed from the air vehicle. Evaluations should also examine flight
control impacts with the particular Group B hardware removed.
F.3.4.6.1.6 Fuel subsystem issues.

The (TBS 1) aerial refueling subsystem(s) shall be designed such that the fuel subsystem
requirements specified in appendix E, Fuel Subsystem, paragraph(s) (TBS 2) are met.

(TBD)
TBS 1: Identify the specific aerial refueling subsystem(s) on the air vehicle.
TBS 2: Specify the appropriate fuel subsystem requirement paragraphs in the appendix E, Fuel
Subsystem.

Some typical fuel subsystem requirements that should be applicable to the design of the aerial
refueling subsystem(s) are the following:
a. Fuel Designation
b. Material Fuel Resistance
740
JSSG-2009A
APPENDIX F
c. Fuel Contamination
d. Fuel Temperatures
e. Thermal Relief
f. External Fuel Leakage
g. Compartment Drains
h. Electrical Fault and Explosive Atmosphere
i. Fuel Tank Inerting and Explosion Suppression
j. Static Discharge in Fuel Tanks
k. Fuel Vent.
F.4.4.6.1.6 Fuel subsystem issues.

The ability of the aerial refueling subsystem(s) to meet the specified fuel subsystem
requirements shall be verified by (TBS) .

(TBD)
TBS: Identify the same verification methods specified for each referenced fuel subsystem
requirement.

(TBD)
F.3.4.6.1.7 Fire protection considerations.

The (TBS 1) aerial refueling subsystem(s) shall be designed such that the fire protection
subsystem requirements specified in appendix G, Fire and Explosion Hazard Protection
Subsystem, paragraph(s) (TBS 2) are met.

(TBD)
TBS 1: Identify the specific aerial refueling subsystem(s) on the air vehicle.
TBS 2: Specify the appropriate fuel subsystem requirement paragraphs in the appendix G, Fire
and Explosion Hazard Protection Subsystem.
741
JSSG-2009A
APPENDIX F
(TBD)
F.4.4.6.1.7 Fire protection considerations.

The ability of the aerial refueling subsystem(s) to meet the specified fire protection subsystem
requirements shall be verified by (TBS) .

(TBD)
TBS: Identify the same verification methods specified for each referenced fire protection
subsystem requirement.

(TBD)
F.3.4.6.1.8 Air vehicle center of gravity and flight control and handling qualities.
The aerial refueling subsystem shall be designed such that the air vehicle center-of-gravity is
within defined limits and the air vehicle’s flying qualities remain acceptable throughout the entire
aerial refueling envelope for the air vehicle.

(TBD)

(TBD)

(TBD)
F.4.4.6.1.8 Air vehicle center of gravity and flight control and handling qualities.
The air vehicle center-of-gravity and flying qualities shall be verified by (TBS) .

(TBD)
742
JSSG-2009A
APPENDIX F

TBS: Specify that the air vehicle center-of-gravity and flying qualities should be verified by
modeling, simulation, and flight test throughout the entire flight envelope for the air vehicle.

(TBD)
F.3.4.6.1.9 Communication capability.

The communication capability shall be compatible with the aerial refueling procedures defined in
ATP-56 (NATO STANAG 3971).
(TBD)

ATP-56 (NATO STANAG 3971) defines the general, internationally accepted aerial refueling
procedures. If the targeted tanker/receiver(s) or the air vehicle’s mission(s) dictate unique
communication requirements with respect to the aerial refueling process, these new
requirements must be specified.

(TBD)
743
JSSG-2009A
APPENDIX F
F.4.4.6.1.9 Communication capability.

The adequacy of the communication capability during aerial refueling operations shall be
verified by (TBS) .

(TBD)

TBS: Specify that the communication capability should be verified by demonstration in an
operationally-realistic environment.

(TBD)
F.3.4.6.1.10 Support equipment interface.

The (TBS 1) aerial refueling subsystem shall interface with (TBS 2) ground support
equipment to be able to perform (TBS 3) maintenance actions.

This is an operational and safety requirement. Each aerial refueling subsystem must be
designed to interface with the appropriate ground support equipment to ensure the necessary
maintenance actions can be successfully accomplished. This requirement ensures a properly-
functioning aerial refueling subsystem is being fielded, and ideally being made available for
operational use in a timely manner.

TBS 1: Specify the appropriate aerial refueling subsystem.
TBS 2: Specify the appropriate ground support equipment. For drogue aerial refueling
systems, specify a MIL-T-26561 coupling tester (as a minimum). There are other coupling
testers that can perform the same function as the MIL-T-26561 but also have additional
checkout functions and a different design from the MIL-T-26561 tester. For receptacle aerial
refueling subsystems, specify a MIL-PRF-83323 tester. For boom aerial refueling subsystems,
specify an appropriate existing tester(s).

All aerial refueling subsystem support equipment interfaces should be identified based upon the
program’s Supportability Plan for the air vehicle.
For drogue aerial refueling systems, the MIL-T-26561 coupling tester can verify the proper
toggle latching setting in the coupling, thereby assuring the correct break-away force to
disengage the probe nozzle from the coupling. There are other coupling testers available that
744
JSSG-2009A
APPENDIX F
can perform this same function and can also: (1) verify the fuel delivery pressure from the
drogue aerial refueling subsystem to the receiver, and (2) permit a single-point refueling hose to
be connected which would allow fuel off-loading through the drogue aerial refueling subsystem
while the air vehicle is on the ground. For receptacle aerial refueling subsystems, a
MIL-PRF-83323 tester exists which can checkout various functions of the receptacle aerial
refueling subsystem. This tester can be used to: (1) verify proper function of the interface to the
tanker’s Through-the-Boom communication system, (2) verify the capability to perform tanker-
initiated and receiver-initiated disconnects, (3) verify synchronized advancement of the mode
status for the air vehicle’s receptacle aerial refueling subsystem and the tanker’s boom aerial
refueling subsystem, and (4) permit a single-point refueling hose to be connected which would
allow ground refueling through the receptacle aerial refueling subsystem.
For boom aerial refueling subsystems, there is a boom nozzle tester that can be used to:
(1) verify proper function of the air vehicle’s Through-The-Boom communication capability
provided in the boom aerial refueling subsystem, (2) verify the capability to perform tanker-
initiated and receiver-initiated disconnects, (3) verify synchronized advancement of the mode
status for the air vehicle’s boom aerial refueling subsystem and the receiver’s receptacle aerial
refueling subsystem, and (4) permit a single-point refueling hose to be connected which would
allow ground defueling through the boom aerial refueling subsystem. In addition, there is
another boom nozzle tester that can be used to verify the proper torque required to produce
rotation and deflection in the boom nozzle of the boom aerial refueling subsystem.For probe
aerial refueling subsystems, there is a GA-2B adapter (Pressure Fuel Servicing Adapater) that
connects to the probe nozzle and permits ground refueling through the nozzle. There is a
Pull-off Tester that checks the release mechanism of the probe nozzle. There is also a Sleeve
Load Tester that checks the spring load of the probe nozzle’s sleeve.
F.4.4.6.1.10 Support equipment interface.

The ability of the (TBS 1) aerial refueling subsystem(s) to interface properly with the
specified ground support equipment shall be verified by (TBS 2) .

The ability of each aerial refueling subsystem to interface properly with ground support
equipment must be verified to ensure personnel can perform the necessary maintenance
actions to assure the air vehicle is being fielded with an aerial refueling subsystem in proper
working order.

TBS 1: Specify the appropriate aerial refueling subsystem.
TBS 2: Specify ground demonstration.

(TBD)
745
JSSG-2009A
APPENDIX F
F.3.4.6.2 Receiver aerial refueling subsystems
F.4.4.6.2 Receiver aerial refueling subsystems
F.3.4.6.2.1 General receiver aerial refueling subsystem requirements
F.4.4.6.2.1 General receiver aerial refueling subsystem requirements
F.3.4.6.2.1.1 Tanker compatibility.

The receiver aerial refueling subsystem shall be compatible for refueling, under all
environmental operating conditions, with the following tanker aerial refueling subsystem(s):
(TBS) .

(TBD)

(TBD)

(TBD)
F.4.4.6.2.1.1 Tanker compatibility.

Tanker compatibility shall be verified by (TBS) .

(TBD)

(TBD)

(TBD)
746
JSSG-2009A
APPENDIX F
F.3.4.6.2.1.2 Receiver aerial refueling rate.

The (TBS 1) receiver aerial refueling subsystem shall be designed so that the receiver air
vehicle can be refueled from (TBS 2) to (TBS 3) in (TBS 4) from the targeted tanker
(TBS 5) aerial refueling subsystem(s).
This is an operational requirement. The air vehicle's mission should dictate how much time is
allowed for the air vehicle to perform aerial refueling operations. In addition to the fuel pumping
capacity of the tanker aerial refueling subsystem, the receiver aerial refueling subsystem design
will affect how long it will operationally take to fill a receiver from a predetermined fuel quantity
to a final fuel quantity.
TBS 1: Identify the specific receiver aerial refueling subsystem.

TBS 2: Specify the fuel quantity within the receiver air vehicle at the beginning of the refuel
sequence. For example, an initial fuel condition may be 10 percent (10%) fuel in all tanks.
TBS 3: Specify the fuel quantity within the receiver air vehicle at the end of the refuel sequence.
Ideally, the final fuel status desired is a complete filling (top-off) of every fuel tank that the aerial
refueling subsystem is designed to refuel; however, there are situations due to the lack of
system redundancy, proof pressure limitations and structural considerations where refueling to a
capacity less than top-off may be required.
TBS 4: Specify the maximum allowable refuel time (minutes).
TBS 5: Specify the appropriate targeted tanker aerial refueling subsystem(s).
Generally, air vehicles have been designed for a 90 percent load, that is at the initiation of
the refueling process the air vehicle would contain 10 percent of its fuel load evenly
distributed in its main tanks. This is considered a maximum transfer requirement. In order
to minimize the time of refueling, the receiver can be designed for flow rates greater than the
transfer capability of the tanker aerial refueling subsystem. This growth capability is
considered desirable and will enable the tanker aerial refueling subsystem to perform at or
slightly above its rated fuel transfer performance. Unless mission requirements dictate
otherwise, the following values have been used:
747
JSSG-2009A
APPENDIX F
Total Air Vehicle Flow Rate – Referenced Time (Minutes)

Fuel Weight (lb) (GPM) 90% Load
250,000 - 450,000 1500 23 - 42

100,000 - 250,000 1200 12 - 28
50,000 - 100,000 900 8 - 16
25,000 - 50,000 600 6 - 12
10,000 - 25,000 400 4-9
UP TO - 10,000 300 5
The time required for accomplishing a hookup and the time to transfer the fuel which is burned
by the receiver during the refueling must be added to the time of the chart.
748
JSSG-2009A
APPENDIX F
F.4.4.6.2.1.2 Receiver aerial refueling rate.

The ability of the (TBS 1) aerial refueling subsystem to permit the air vehicle to be refueled
as specified within the defined time shall be verified by (TBS 2) .
It must be verified that the air vehicle is able to complete aerial refueling operations from the
targeted tanker aerial refueling subsystem(s) within the allotted time to ensure the air vehicle
can successfully complete its operational mission(s).
TBS 1: Identify the specific receiver aerial refueling subsystem.
TBS 2: Specify analysis, ground demonstration, ground test, flight demonstration, flight test or a
combination.
Ground tests should include evaluations on an aerial refueling and fuel subsystem simulator
testing and on the actual air vehicle or both. Simulator tests allow close control over fuel flow
rate and pressures and monitoring of more subsystem test data than is generally possible on an
air vehicle. In ground tests, it is important to assure that the refuel source is able to replicate the
fuel transfer rate and pressure that the tanker aerial refueling subsystem is able to provide while
aerial refueling. For simulator tests, it is therefore prudent to conduct the evaluations at different
fuel delivery pressures as would be experienced from the tanker aerial refueling subsystem. In
the past, fuel delivery pressures of 25, 35, 45, and 55 psig have been used. Tanker aerial
refueling subsystems that are able perform identically (with regards to fuel delivery rate and
pressure) on the ground as they would in flight allow ground tests with the actual receiver air
vehicle to be valid evaluations for refuel time. The time required to fill the air vehicle should be
determined using the required starting conditions and should be evaluated with each targeted
tanker aerial refueling subsystem. The flow rates to the receiver subsystem should be
determined for various tank open conditions and for each tank open singularly. Successful
completion of the ground test(s) will permit flight testing of the aerial refueling subsystem with
minimum risk.
749
JSSG-2009A
APPENDIX F
F.3.4.6.2.1.3 Refuel control mode.

The distribution of fuel into the air vehicle when aerial refueling through the (TBS 1) receiver
aerial refueling subsystem shall be controlled by (TBS 2) .


TBS 1: Identify the specific receiver aerial refueling subsystem on the air vehicle.
TBS 2: Specify whether the fuel distribution into the air vehicle when aerial refueling through
the particular receiver aerial refueling subsystem will be automatically controlled or manually
controlled. If manually controlled, also specify which crew member(s) will have this control
capability. In single-seat air vehicles, the pilot obviously should be given this capability. When
the co-pilot is required to perform the aerial refueling process, the control capability should be
provided. In some receptacle installations, only the flight engineer should be provided this
capability.

(TBD)
F.4.4.6.2.1.3 Refuel control mode.

The ability to control fuel distribution when aerial refueling through the (TBS 1) receiver
aerial refueling subsystem shall be verified by (TBS 2) .

(TBD)

TBS 1: identify the specific receiver aerial refueling subsystem on the air vehicle.
TBS 2: specify ground demonstration and flight demonstration .

(TBD)
750
JSSG-2009A
APPENDIX F
F.3.4.6.2.1.4 Fuel parameters.

(TBD)

(TBD)

(TBD)

(TBD)
F.4.4.6.2.1.4 Fuel parameters.

(TBD)

(TBD)

(TBD)

(TBD)
F.3.4.6.2.1.5 Low Observable (LO) parameters.

The installation and operation of the aerial refueling system shall be compliant with the
Low Observable requirements for the air vehicle.


(TBD)

(TBD)
751
JSSG-2009A
APPENDIX F
F.4.4.6.2.1.5 Low Observable (LO) parameters.

The impact of the aerial refueling system to the air vehicle’s Low Observable performance shall

(TBD)

TBS: Specify that the Low Observable parameters of the aerial refueling installation, and its
operation, should be verified by analysis and demonstration.

(TBD)
F.3.4.6.2.2 Receptacle receiver aerial refueling subsystems
F.4.4.6.2.2 Receptacle receiver aerial refueling subsystems
F.3.4.6.2.2.1 Type of receptacle installation.

The receptacle installation shall be compatible with tanker boom nozzles which comply with
figures F-1 through F-5. The receptacle installation shall be (TBS) .
This is an integration and operational interface requirement. The specific type of receptacle
installation must be identified to ensure compatibility with the tanker boom system(s) identified
for the air vehicle to aerial refuel from operationally and to insure the proper integration with
other air vehicle subsystems.

TBS: Specify what type of receptacle will be used and specify its interface design requirements.
In the past, the installation has required a receptacle with toggle latches, a slipway, a signal
system, slipway lights, status indicator lights and controls. As such, the interfaces with other
disciplines (fuel, electrical, hydraulic, avionics, structures, and crew subsystems) had to be
identified.

The Universal Aerial Refueling Receptacle Slipway Installation (UARRSI) can be the best
compromise for a receptacle installation in relation to performance, function, volume required,
weight, maintenance, and cost. The development and qualification cost have already been
amortized. The ENFE Technical Exhibit 77-1 standardized the function of the receptacle and
defined all interfaces between the receptacle and the air vehicle. The UARRSI is considered
universal because the receptacle can be positioned between 31 degrees and 46 degrees (in
752
JSSG-2009A
APPENDIX F
5-degree increments) in the UARRSI box to accommodate the installation of the UARRSI box at
different angles or positions on a receiver air vehicle. After the receptacle angle is selected for
a particular air vehicle, a close-out plate is installed on the back of the box to hold the receptacle
at the selected angle. There are four standard close-out plates for 31 degrees, 36 degrees,
41 degrees, and 46 degrees.
Other design options include rollover installations that roll the receptacle over to change it from
the "closed" position to the "open" position. This type of design has been used successfully in
air vehicles that had strict LO requirements that had to be maintained when the aerial refueling
subsystem was not being used for aerial refueling.
The flying boom receptacle specification MIL-R-27521 also contains valid design requirements
for a receptacle to be compatible with boom nozzles which comply with figures F-1 through F-5.
FIGURE F-1. Boom nozzle mating dimensions.
753
JSSG-2009A
APPENDIX F
MAXIMUM MINIMUM
DIM in. mm in. mm REMARKS
A 8.11 205.99 8.095 205.61
B 6.245 158.62 6.22 157.99
C 4.4125 112.08 4.3775 111.19
D 2.865 72.77 2.84 72.14
E 2.165 54.99 2.14 54.36
F 0.5 12.70
G 1.31 33.27 1.17 29.72
H 1.08 27.43
I 0.91 23.11 0.9 22.86
J
2.05 52.07 radius
K 6.21 157.73 6.19 157.23
L 2.9 73.66 radius
M 51.5 degrees
N 0.02 0.51 radius
O 1.4 35.56
P 3.55 90.17 3.53 89.66
R 4.3 109.22 4.29 108.97
S
5.25 133.35 5.248 133.30
T 3.23 82.04 radius
U 2.71 68.83 radius
V 3.31 84.07
W 50* 45* degrees
X 3.89 98.81 3.88 98.55
Y
4.8 121.92 4.798 121.87
Z 0.125 3.18 radius
AA 0.315 8.00 0.290 7.37
BB 0.66 16.76 0.61 15.49
CC 1.345 34.16 1.33 33.78
DD 0.04 1.02 0.03 0.76 radius
EE 1.375 34.93 1.36 34.54
* Angle W revised from MS27604, to reduce receptacle seal damage
FIGURE F-1. Boom nozzle mating dimensions – Continued.
754
JSSG-2009A
APPENDIX F
FIGURE F-2. Nozzle latching and voice coil recesses.
755
JSSG-2009A
APPENDIX F
MAXIMUM MINIMUM
DIM in. mm in. mm REMARKS
A 0.09 2.29 0.06 1.52 radius
B 0.25 6.35 radius
C 18 degrees
D 2.1 53.34
E 1.315 33.40 1.285 32.64
F 2.475 62.87 2.445 62.10
G
0.156 3.96 radius
H 5.58 141.73
I 4.28 108.71
J 4.09 103.89
K 1.88 47.75 radius
L 0.25 6.35 radius
M 0.04 1.02 0.03 0.76 radius
N 4.42 112.27 4.41 112.01
O
4.56 115.82 4.55 115.57
P 5.14 130.56
R 0.98 24.89
S 4.02 102.11
T 0.09 2.29 0.03 0.76 radius
U
0.156 3.96 radius
V 0.59 14.99 0.56 14.22
W 0.45 11.43 0.42 10.67
X 0.19 4.83 0.16 4.06
Y 3.39 86.11
Z
0.675 17.15 0.645 16.38
AA 1.595 40.51 1.565 39.75
BB 1.975 50.17 1.945 49.40
CC 0.054 1.37 See Note 1.
Note 1: Minimum wall thickness is a stress requirement, and may vary depending on the nozzle
material. .054 in. is required for an aluminum nozzle.
FIGURE F-2. Nozzle latching and voice coil recesses – Continued.
756
JSSG-2009A
APPENDIX F
FIGURE F-3. Boom nozzle articulation.
757
JSSG-2009A
APPENDIX F
FIGURE F-4. Tanker nozzle induction coil tolerances.
758
JSSG-2009A
APPENDIX F
The pole faces shall be positioned from flush with the nozzle surface to minus 0.01 from the
outside surface of the nozzle as depicted on figure F-5. The pole faces shall be centered within
0.03 in (0.76 mm) to the left or right of the vertical axis.
66.68/66.65 mm
FIGURE F-5. Tanker nozzle induction coil pole face positions.
759
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.1 Type of receptacle installation.

The type of receptacle installation shall be verified by (TBS) .
The type of receptacle installed in the air vehicle must be verified to ensure that the air vehicle
can be operationally compatible with the tanker boom system(s) identified for the air vehicle to
aerial refuel from and to insure that the installation has been properly integrated into the air
vehicle.
TBS: Specify that the type of receptacle installation on the air vehicle should be verified by
inspection, analysis, ground demonstration, and flight or a combination.

The UARRSI has been completely qualified at the component assembly level. However, the
interface with the air vehicle must be verified by inspection and by functional checkout.
Receptacle qualification testing is required if a previously qualified unit is not used or being
applied in a different environment than previously qualified for. Structural testing of the unit
installed in the air vehicle must also be accomplished to verify the structural interface.
The ground demonstration should be conducted using the Universal Receptacle Aerial
Refueling Tester, NSN 4920-01-006-5709.
F.3.4.6.2.2.1.1 Receptacle actuation provision(s).

There shall be a primary method to: (a) transition the receptacle installation between the "open"
and "closed" positions while in flight and (b) configure the receptacle to accept engagement. If
mission and redundancy requirements dictate, a secondary method shall be provided which
(TBS) .
This is an integration, operational and safety requirement. The receptacle aerial refueling
subsystem must be able to transition between the "open" and "closed" positions to conduct
aerial refueling procedures safely. This capability must not be compromised by a single-failure
as the inability to accept fuel from a tanker can impact the air vehicle's mission or jeopardize the
safety of the air vehicle.

(TBD)
760
JSSG-2009A
APPENDIX F
In the past, a direct manually actuated mechanical control has been successfully used as the
emergency actuation provision, permitting refueling with an electrical or hydraulic failure to the
receptacle installation. The slipway door of the UARRSI will open by spring force with an
electrical or hydraulic failure in the system and permit emergency refueling.
The actuation control(s) must be located such they can not be inadvertently bumped during
aerial refueling and causing the receptacle installation to try to go to the "closed" position with
the tanker boom nozzle engaged in the receptacle. The securing of the actuation control(s) in
the "open" position will prevent this type of incident.
An early model of the UARRSI had a problem with moisture freezing on the door control
mechanism. This problem has been corrected in the UARRSI; however, the cable mechanism
to the UARRSI must also be designed to operate in the presence of moisture and extreme
temperature.
Maintenance personnel should be able to operate both actuation mechanisms while the air
vehicle is on the ground to permit verification that the proper operation of actuation mechanism.
F.4.4.6.2.2.1.1 Receptacle actuation provision(s).

The receptacle actuation provisions shall be verified by (TBS) .
(TBD)

TBS should be filled in with ground demonstration. The ground demonstration should evaluate
the adequacy of the location of the actuation provisions. The suitability of any manually
activated mechanisms in relation to the required forces and operation with failures in the air
vehicle's subsystems should be accomplished by the ground demonstration. The loads that can
be imposed by a crew member under extreme stress on a manually activated mechanism
should be considered.
A mechanical cycling device was once used on a receptacle and probe handle design and had
successfully completed a qualification endurance test. However, during service, over-torquing
of the handle by the pilot caused several failures of the handle bushing. A redesign of the
bushing was required.
761
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.1.2 Receptacle actuation airspeed and altitude envelope.

The receptacle installation shall be capable of being transitioned between the "open" and
"closed" positions by the primary method within an airspeed and altitude envelope of (TBS 1) .
When using the secondary method, the receptacle installation shall be capable of being
transitioned between the "open" and "closed" positions within an airspeed and altitude envelope
of (TBS 2) .
This is an operational requirement. The airspeed and altitude envelope at which the receptacle
installation will be able to be actuated must be identified to ensure that the receptacle can be
placed in "open" position within an envelope similar to the operational airspeed and envelope of
the targeted tanker aerial refueling boom subsystem(s) and can be placed in the "closed"
position within that same envelope to permit the air vehicle to depart the aerial refueling track in
a "clean" configuration.

TBS 1 should be filled in with the primary airspeed (Knots Equivalent Airspeed (KEAS)) and
altitude (Mean Sea Level (MSL)) envelope of operation.
TBS 2: should be filled in with the secondary airspeed (KEAS) and altitude (MSL) envelope of
operation.
The envelopes specified for the above TBS’s may be exactly the same or separate with some
overlap. Specify the airspeed (KEAS) and altitude (MSL) envelope. The airspeed and altitude
envelope should be similar to the operational airspeed and altitude envelope of the targeted
tanker aerial refueling boom subsystem(s). Ideally a receptacle installation should be capable
of being placed in the "open" and "closed" positions by the primary and emergency methods at
all aerial refueling airspeeds up to .9 Mach (M) or 350 KEAS, whichever is lower, and altitudes
from 100 feet to 35,000 feet MSL.

Attention should be given to door and panel airspeed limits to preclude loss of hardware. If the
maximum actuation airspeed is less than the placard limits for the air vehicle, then that limit
must somehow be communicated to the crew.
F.4.4.6.2.2.1.2 Receptacle actuation airspeed and altitude envelope.

The airspeed and altitude envelope that the receptacle installation can be activated to its "open"
and "closed" positions using the primary and emergency activation methods shall be verified by
(TBS) .
The actuation airspeed and altitude envelope for a receptacle installation must be verified to
ensure that the receptacle can be placed in the "open" position within the operational envelope
of the targeted tanker aerial refueling boom subsystem(s) and can be placed in the "closed"
762
JSSG-2009A
APPENDIX F
position within that same envelope to permit the air vehicle to depart the aerial refueling track in
a "clean" configuration.

TBS: Specify the airspeed and altitude envelope that should be verified by flight test.
Flight test should evaluate the actuation envelope under both hot and cold temperature
conditions using the primary and emergency methods. Any condition of low power (hydraulic,
fueldraulic, electrical) being provided to the actuation mechanism of the primary and emergency
methods should be examined for the effects on the receptacle installation actuation envelope.
F.3.4.6.2.2.1.3 Receptacle actuation times.

Using the primary actuation mode, the receptacle installation shall transition from the "closed"
position to the "open" position, and from the "open" position to the "closed" position, in (TBS 1)
within its specified actuation airspeed and altitude envelope. When using the secondary
method for actuation, the receptacle installation shall be able to be transitioned between the
"open" and "closed" positions in (TBS 2) within its specified actuation airspeed and altitude
envelope.

This is an operational requirement. The allowed time for transitioning between the "closed" and
"open" positions must be specified in order for the air vehicle to be refueled within the time
dictated by its mission(s).
TBS 1: Specify the desired time (seconds) for receptacle installation actuation between the
"closed" and "open" positions. The receptacle installation should transition from the "closed"
position to the "open" position, and from the "open" position to the "closed" position, in 5 to
20 seconds when using its primary mode.
TBS 2: Using its emergency mode, the receptacle installation should transition from the
"closed" position to the "open" position, and from the "open" position to the "closed" position,
within 30 seconds.
The receptacle installation must be able to transition between the "closed" and "open" positions
in a reasonably rapid period of time. A transition which is too rapid can cause excessive forces
within the actuation mechanism while a transition time that is too long can impact the total aerial
refueling time for the air vehicle.
763
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.1.3 Receptacle actuation times.

The receptacle actuation times shall be verified by (TBS) .
The time required to transition the receptacle installation between the "closed" and "open"
positions must be verified to ensure that the air vehicle can be refueled within the time dictated
by its operational mission(s).

TBS: Specify that the receptacle actuation times should be verified by ground and flight test.

The actuation times should be measured in flight test after a long period of cold temperature
conditions and icing conditions. The test should determine any effect of air speed and altitude
on actuation time. Any condition of low power (hydraulic, fueldraulic, electrical) being provided
to the actuation mechanism of the primary and emergency methods should be examined for the
effects on the receptacle installation actuation time.
F.3.4.6.2.2.1.4 Slipway illumination.

The receptacle installation's slipway (including the top of the slipway door scuff plate and the
bore of the receptacle) shall be illuminated, when the receptacle installation is in the "open"
position, to assist the boom operator in observing the engagement area for the tanker boom
nozzle within the receptacle installation. The slipway illumination shall be oriented such that it
does not blind or distract the boom operator or the air vehicle crew member(s) during the aerial
refueling process. The slipway illumination shall not be a potential source of ignition of
flammable fuels. The aircrew shall be able to control the intensity of the slipway illumination in
variable increments from “OFF” to “FULL BRIGHT”.

This is an operational and safety requirement. In boom aerial refueling subsystems that require
a boom operator, the entire slipway of the receptacle installation must be illuminated to assist
the boom operator in making clean, safe engagements of the tanker boom nozzle with the
receptacle installation. This assistance is needed during night, twilight, and dawn aerial
refueling operations, and can be required in receptacle installations where the contrast between
the receptacle and the surrounding air vehicle structure is hard to discern due to similar colors
and installation orientation or both.
Since fuel can spray onto the area in and around the receptacle installation when the boom
nozzle disconnects from the receptacle, the slipway illumination provision(s) must not create a
fire and explosion hazard to the air vehicle.
764
JSSG-2009A
APPENDIX F

This requirement should not be applicable for boom and receptacle aerial refueling subsystems
that feature an automatic engagement capability; for example, when a boom operator is not
required to make the tanker boom nozzle connect into the receiver's receptacle.

This requirement is mandatory for night aerial refueling operations, except for automatic
engagement capability.
The light assemblies should not produce bright spots or direct the light toward the tanker boom
operator. The light assemblies should not be a source of ignition since fuel spray onto the light
assemblies can be expected during the disconnect phase of the aerial refueling process. When
operating at maximum intensity and temperature, the assemblies must not fail or fracture when
coming into contact with -65oF fuel.
Ideally, the slipway illumination should automatically occur once the receptacle installation has
been activated to the "open" position and automatically terminate once the receptacle
installation has been activated to the "closed" position.
F.4.4.6.2.2.1.4 Slipway illumination.

The ability to illuminate the slipway shall be verified by (TBS 1) . The inability of the slipway
illumination to be a potential ignition source for flammable vapors shall be verified by (TBS 2) .

It must be verified that the provided slipway illumination is adequately installed to ensure that
the boom operator can make clean, safe engagements of the tanker boom nozzle with the
receptacle installation during aerial refueling procedures. In addition, it must be verified that the
slipway illumination feature is properly designed to insure that it does not create a fire and
explosion hazard to the air vehicle during the aerial refueling process.

TBS 1: Specify ground test and flight test.
TBS 2: Specify analysis and ground test.
The ground test should evaluate the surface brightness of the slipway illumination at the
following locations:
a. Slipway area, forward right-hand corner
b. Slipway area, forward left-hand corner
c. Slipway area, center of forward edge
d. Slipway area, center of aft edge
765
JSSG-2009A
APPENDIX F
e. Slipway area, center of scuff plate

f. Center of poppet face (receptacle bore).
F.3.4.6.2.2.2 Location of receptacle installation.

The receptacle installation shall be positioned on the receiver air vehicle to permit both a
precision contact and a slipway contact of the boom nozzle with the receptacle.
a. Slipway contact. A smooth contact (no hang-up) shall be accomplished by the boom,
within the normal contact envelope of the boom, when a download is applied to the
boom nozzle after contact of the boom nozzle has been made with the slipway.
b. Spatial envelope clearance. With the boom nozzle engaged in the receptacle, the boom
shall not contact the slipway sides when the receiver exceeds the automatic disconnect
envelope of the tanker by five degrees azimuth or boom roll.
c. Disconnect alignment. The receptacle bore axis shall be positioned to provide alignment
at disconnect of the tanker boom centerline, in the center of the normal contact envelope
for all identified tankers, when the receiver is in the normal disconnect pitch attitude.
d. Airflow characteristics. The receptacle installation shall be located so that airflow around
the receptacle installation will not cause boom instability during aerial refueling from
precontact of the boom until completion of aerial refueling. The receiver stability and
control behind all identified tankers shall not be adversely affected during aerial refueling
from the precontact position until the completion of aerial refueling when the boom is
close to or coupled to the receiver.
e. Receptacle visibility characteristics. The receptacle installation shall interface with the
contour of the air vehicle such that optical illusions of the installation are not created for
the boom operator during day or night aerial refueling. The total bore opening of the
receptacle shall be visible from each tanker's boom operator's eye position when both
the tanker and receiver are in the normal contact position.

(TBD)

(TBD)

(TBD)
766
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.2 Location of receptacle installation.

The location of the aerial refueling receptacle installation shall be verified by (TBS) .

(TBD)

(TBD)

(TBD)
F.3.4.6.2.2.3 Receptacle installation drainage.

Spilled fuel and rain water shall be removed from the receptacle installation by (TBS) .

This is a safety requirement. Fuel is typically spilled during disconnect of the boom nozzle and
can accumulate within the receptacle installation. In addition, water can accumulate in the
receptacle installation due to rain and aircraft washings. These fluids must be removed.
Trapped fuel can create a fire hazard and freezing water can interfere with the proper function of
the operating mechanisms located within the receptacle installation.

TBS: Specify the provision(s) for removal of fuel or water. Spilled fuel and water has been
removed from the receptacle installation by connecting one, two, or three drain lines to
appropriate locations in the cavity below the receptacle. The number of drains connected
should be determined by considering all normal ground and flight attitudes of the receiver. The
fluids are then either drained overboard or to an on-board collector tank.

The drain line exit should be at a negative pressure in relation to the interior of the installation.
Unused drain connections must be plugged. This compartment should be drained if the
receptacle is installed in a sealed compartment or pressure shroud. Interconnecting fuel drain
lines should be avoided as much as possible as this makes it difficult to identify the specific
source of the leakage and can also affect proper drainage.
See compartment drains requirements (E.3.4.5.1.10) in appendix E, Fuel Subsystem, for
additional information related to this requirement.
See fuel drainage requirements (G.3.4.7.5) in appendix G, Fire and Explosion Hazard
Protection Subsystem, for additional Lessons Learned related to this requirement.
767
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.3 Receptacle installation drainage.

Receptacle installation drainage shall be verified by (TBS) .

The adequacy of the drains for the receptacle installation should be verified to ensure a
potentially hazardous condition is not created due to fuel accumulation.

TBS: Specify ground demonstration and/or flight demonstration.
The ground demonstration can be accomplished by pouring water into the cavity below the
receptacle installation and observing the quantity of water retained in the cavity at all normal
ground and flight attitudes of the aircraft.
The ground demonstration may require demonstration be conducted with the appropriate
compartment pressurization that would be experienced in flight. In transport and bomber air
vehicles, where the cavity below the receptacle is typically exposed to cabin pressure, the
ground demonstration must include the cabin pressure to ensure such pressurization does not
impact drainage capability. Similarly, if the drain line(s) can be exposed to pressurization while
in flight, then the appropriate compartment(s) which contain the drain line(s) must also be
pressurized during the ground demonstration.
If pressurization of the necessary compartments cannot be accomplished on the ground, then
flight demonstrations should be conducted to ensure adequate drain provisions are provided in
flight. Flight test can also validate that the drained fluid(s) do not re-enter the air vehicle when
drained overboard. Flight testing should also be conducted throughout the entire flight envelope
of the air vehicle to ensure pressure differentials along air vehicle’s mold line do not prevent
drainage from occurring in flight.
768
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.4 Receptacle installation sealing and fairing.

The receptacle installation exterior frame shall (TBS) .

This is an integration and safety requirement. The sealing of the receiver installation from the
interior of the aircraft must be identified, along with the requirement for a smooth fit with the
aircraft skin.

TBS: Specify that the receiver installation exterior frame must make a fuel-tight seal with the
aircraft skin or be installed in a fuel-tight compartment. The aircraft skin should fair smoothly
with the receiver installation edges.

The sealing of the edges can be omitted if the receiver installation is installed in a fuel-tight
compartment that contains fuel drains. The fairing of the receiver installation edges is desired to
reduce drag and to eliminate rough edges.
See JSSG-2006 for additional information regarding fuel sealing in aircraft structures.
F.4.4.6.2.2.4 Receptacle installation sealing and fairing.

Receptacle installation sealing and fairing shall be verified by (TBS) .

Rough edges and installation defects can best be detected by an inspection prior to flight.
Ground water tests can verify the sealing of the unit; however, the aircraft should be inspected
for evidence of fuel entering adjacent compartments after each flight test.

TBS: Specify that the sealing of the receiver installation frame with the aircraft skin and the
smoothness of the edges and adjacent skin should be verified by inspection and ground tests.

(TBD)
769
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.5 Structural loads.

The receptacle installation shall withstand the following load conditions: (TBS) .
This is an operational and safety requirement. The receptacle must be designed to the
appropriate structural loads to ensure that it is structurally compatible with the targeted tanker
boom subsystems and can withstand the loads typically encountered during aerial refueling
operations. Structural incompatibility can result in damage to the tanker boom subsystem and
the receiver receptacle, or both.

TBS: Specify that the receiver’s aerial refueling receptacle should be designed for the following
loads when contacted by the boom nozzle, during fuel transfer when mated with the boom
nozzle, and when disconnected from the mated boom nozzle. These loads should be applied
within the respective contact envelope, fuel transfer envelope and disconnect envelope for the
given tanker boom subsystem:
a. Tension - An ultimate load of 14,000/(Cos A) lbs. applied to the boom-nozzle ball joint,
where the angle A may vary from 0 degrees to 30 degrees.
b. Compression - An ultimate load of 20,000 lbs. applied at the boom-nozzle ball joint
anywhere within a 34 degree cone.
c. Tension and compression working load - A limit load of 9,000/(Cos C) lbs. applied at the
boom-nozzle ball joint where angle C may vary from 0 degrees to 17 degrees.
Angles A and C should be taken relative to the receptacle axis. Fuel flow pressure should be
added to the above loads only when the resulting incremental load is additive. In both cases,
use of ailerons to maintain wings level is a major source of load and the abruptness and amount
of aileron used is highly pilot dependent.

The above load conditions have been historically applied to receptacle installation designs to
ensure structural compatibility with the existing tanker boom subsystems. The limit tension
values are based on a limit load imposed by the existing KC-135 and KC-10 tanker boom
subsystems when a tension disconnect is performed with the receiver at -65oF with a boom
nozzle average retract velocity up to 10 feet per second. Operational experience has shown
that the above values are adequate in assuring aerial refueling operations with existing tanker
boom subsystems can be accomplished safely. Values selected below the recommended loads
will compromise the structural integrity of the receptacle installation while values selected above
the recommended loads will compromise the structural integrity of the tanker boom systems.
When the UARRSI is selected, ensure the four airframe structural attachment points that are
used to mount the UARRSI are able to withstand these loads. The distribution of loads from the
UARRSI to the air vehicle’s structure is critical to the structural integrity of the UARRSI. The
four airframe structural attachment points must be connected by a stiff load path tying the fore
and aft attachment points together to prevent tension overloading of the UARRSI side members.
If the loads are allowed to be evenly distributed between the four structural attachment points, a
770
JSSG-2009A
APPENDIX F
structure failure will occur in the UARRSI side member to the forward bulkhead at approximately
100 percent limit load.
See JSSG-2006’s handbook for additional Structures Lessons Learned related to this
requirement.

The suitability of the receptacle installation in relation to the structural loads that will be
encountered during aerial refueling operations shall be verified by (TBS) .

It must be verified that the receptacle is designed to the appropriate structural loads to ensure
that it is structurally compatible with the targeted tanker boom subsystems and can withstand
the loads typically encountered during aerial refueling operations.
TBS: Specify that verification should be accomplished through analysis, ground test, and during
flight tests.

Flight tests for aerial refueling certification of receptacle-equipped receivers include tension
disconnects to verify that the loads do not exceed the specified limits. For receptacles where
hydraulics is used to control the toggle latches, the tension disconnects will be conducted after
the receptacle installation has been adequately “cold-soaked”. Flight test experience shows
that, for such receptacle designs, the tension disconnect loads are greater when the hydraulic
fluid is cold soaked; i.e., when the viscosity is greater. As such, flight test data has revealed
that the tension disconnect loads are greater when MIL-PRF-83282 hydraulic fluid is used in the
receptacle latching system as compared when MIL-PRF-5606 hydraulic fluid is used. In some
receptacle installations which use MIL-PRF-83282 fluid, the tension disconnect loads come very
close to exceeding the tension disconnect limit value. Exceeding this limit can result in damage
to the tanker’s boom structure.
Ground tests can be conducted on the receptacle as installed in the air vehicle or on the
receptacle installed in a representative air vehicle structure. The UARRSI side member loading
problem was not revealed during component development because the qualification test fixture
stiffness was different from the subsequent flight test airframe structure.
771
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.6 Receptacle installation maintenance.

The (TBS 1) of the receptacle aerial refueling subsystem shall be capable of being removed
and replaced with a like unit and functionally checked in (TBS 2) .
This is an operational requirement. Due to the nature of boom and receptacle aerial refueling
procedures, there are certain items in the receptacle aerial refueling subsystem design that will
require have to be replaced on a regular basis. To minimize the impact on the availability of the
air vehicle to perform its mission(s), these items need to be readily removable and replaceable.

TBS 1: Specify the item(s) of the receptacle aerial refueling subsystem that should most likely
have to be replaced on a regular basis due to the nature of boom and receptacle aerial refueling
procedures and the design of the air vehicle's receptacle aerial refueling subsystem. Typically,
this has been those items which are intentionally or inadvertently impacted by the boom nozzle
during aerial refueling; such as, the receptacle, the slipway scuff plate, the receptacle sliding
valve, and the receptacle slipway doors.
TBS 2: Identify the specific time (minutes and hours) to remove and replace each item and the
number of maintenance personnel.
Normally, the UARRSI should be capable of being removed and replaced with a like unit and
functionally checked in one hour by two maintenance personnel. However, special design
cases may dictate different requirements. The removal and replacement of components within
the UARRSI is possible without requiring the removal of the total UARRSI from the air vehicle.
Maintenance personnel must be provided the appropriate support equipment and access to the
back of the UARRSI to remove internal components of the UARRSI. UARRSI installations
require access to hydraulic lines, fuel lines, and electrical connections. If the UARRSI is fitted
tightly within its pressure box, access to these connections is made difficult even through the
close out plate in the back of the UARRSI. Any access through the pressure box may require
breaking a fuel tight seal. If sealant is used to seal the pressure box, the removal and
replacement of any internal components of the UARRSI may also require surface preparation
time, resealing time, cure time, and a cabin pressure leak check as part of the maintenance
time.
The removal and replacement of receptacle doors is common in receptacle installations that use
the receptacle doors to help guide the boom nozzle into the receptacle and open in such a way
that they are commonly impacted by the boom nozzle while trying to make contact with the
receptacle.
See JSSG AVSS “maintainability”, for other maintenance requirements that may apply to the
removal and replacement of the identified items (such as with chemical and biological gear on,
at night with night vision goggles).
772
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.6 Receptacle installation maintenance.

The capability to remove and replace the (TBS 1) of the receptacle aerial refueling
subsystem within the defined time with the specified number of maintenance personnel shall be
To ensure that the air vehicle will be readily available to conduct its mission(s), it must be
verified that those items in the receptacle aerial refueling subsystem that commonly become
damaged during the aerial refueling process can be removed and replaced by the appropriate
number of the maintenance personnel within the allowable time specified.

TBS 1: Specify the item(s) of the receptacle aerial refueling subsystem that should be removed
and replaced by maintenance personnel.
TBS 2: Specify ground demonstration.

(TBD)
F.3.4.6.2.2.7 Receptacle modes.

The receptacle aerial refueling subsystem shall have the following status modes: (TBS) .
The receptacle aerial refueling subsystem shall provide the means of displaying functional
modes of operation.
(TBD)

(TBD)

(TBD)
773
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.7 Receptacle modes.

The provision of the specified functional modes for the receptacle aerial refueling subsystem
(TBD)
TBS: Specify inspection, ground demonstration or a combination.
A reasonable evaluation of the suitability of the displays for the functional modes of the
receptacle aerial refueling subsystem can be made during the ground demonstration, however,
the ground demonstration must consider sun angles for brightness and glare. As such, final
validation of the indicators should be made by several pilots under various actual refueling
conditions (for example direct sunlight, dawn, dusk, and night with and without night vision
goggles, if applicable) throughout the aerial refueling flight test program.
F.3.4.6.2.2.7.1 Disconnect function.

The receptacle aerial refueling subsystem shall be capable of being advanced from the
"CONTACT" mode to the "DISCONNECT" mode to permit disengagement of the tanker boom
nozzle from the receptacle. Advancing shall be accomplished by (TBS 1) under (TBS 2)
conditions.

This is an operational and safety requirement. At the end of the refueling process, the boom
nozzle must be able to disconnect from the receptacle. In addition, there can be scenarios
where the disconnect must occur prior to the completion of the fuel transfer sequence from the
tanker. As such, the receptacle aerial refueling subsystem must have the capability to advance
from the "CONTACT" mode to the "DISCONNECT" mode upon command whenever required
during the aerial refueling process.

TBS 1: Specify how the receptacle aerial refueling subsystem should be commanded to
advance from the "CONTACT" mode to the "DISCONNECT" mode. From the tanker boom
subsystem, advancement should be able to occur when a disconnect signal is sent from the
boom nozzle’s signal coil to the receptacle’s signal coil when the receptacle subsystem is in
NORMAL status. This disconnect signal should be sent when activated by the boom operator
or should automatically be sent when the tanker’s boom envelope limit has been exceeded.
Also, the occurrence of a boom float-out should automatically advance the receptacle aerial
refueling subsystem from the "CONTACT" mode to the "DISCONNECT" mode.
774
JSSG-2009A
APPENDIX F
TBS 2: Defines the conditions under which disconnect may be accomplished.

From the receiver side, the disconnect function has historically been manually activated by a
crewmember and has operated whether the receptacle subsystem is in NORMAL status or in
OVERRIDE status. Also, a pressure disconnect switch located in the air vehicle’s aerial
refueling manifold has been used to advance the receptacle aerial refueling subsystem from the
“CONTACT” mode to the “DISCONNECT” mode when steady-state fuel delivery pressures from
the tanker exceed the normal range, receptacle subsystem in NORMAL or OVERRIDE status.
Manual advancement from the “CONTACT” mode to the "DISCONNECT" mode must be
provided to the appropriate crew member(s)
Ground maintenance personnel should also have this capability when the air vehicle is on the
ground while using the Universal Receptacle Aerial Refueling Tester to verify proper operation
of the receptacle aerial refueling subsystem.
F.4.4.6.2.2.7.1 Disconnect function.

The ability of the receptacle aerial refueling subsystem to advance from the "CONTACT" mode
to the "DISCONNECT" mode, when commanded, to permit the tanker's boom nozzle to
disengage from the receptacle under the specified conditions shall be verified by (TBS) .

Operationally, it must be verified that the receptacle aerial refueling subsystem is capable of
being advanced from the "CONTACT" mode to the "DISCONNECT" mode when required to
ensure that the aerial refueling process can be terminated safely. Verifying that this capability
exists while the air vehicle is on the ground ensures that maintenance personnel have the ability
to confirm proper operation of the receptacle aerial refueling subsystem.
TBS: Specify that verification should be completed through ground demonstration and during
flight demonstration of the subsystem.

The ground demonstration should use the Universal Receptacle Aerial Refueling Tester,
NSN 4920-01-006-5709, to verify that the disconnect capability functions properly when
commanded. Each method of activation from the "CONTACT" mode to the "DISCONNECT"
mode (automatic or manual) should be evaluated with the receptacle subsystem in the
NORMAL status and in the OVERRIDE status. Each manual advancement feature that has
been provided to a crew member should be individually evaluated. Flight test must also verify
the proper operation of each advancement method from the "CONTACT" mode to the
"DISCONNECT" mode (automatic or manual) with the receptacle subsystem in the NORMAL
status and in the OVERRIDE status. Each manual advancement feature that has been
provided to a crew member should also be individually evaluated during flight test.
775
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.7.2 Reset function.

Whether in NORMAL status or in OVERRIDE status, the receptacle aerial refueling subsystem
shall be capable of being reset from the "DISCONNECT" mode to the "READY" mode after the
tanker's boom nozzle has disconnected from the receptacle. Resetting modes from
“DISCONNECT” to “READY” shall be accomplished by (TBS 1) under (TBS 2) conditions.
This is an operational and safety requirement. After the boom nozzle has disconnected from
the receptacle, the receptacle subsystem is in the "DISCONNECT" mode. Any subsequent
attempt to reinsert the boom nozzle into the receptacle for another contact will not result in a
successful engagement; for example the receptacle toggle latches will not lock into the boom
nozzle in the "DISCONNECT" mode. Resetting the receptacle subsystem to the "READY"
mode will permit a successful and safe re-engagement with the boom nozzle.

TBS 1: Specify how the receptacle aerial refueling subsystem should be commanded to reset
from the "DISCONNECT" mode to the "READY" mode.
TBS 2: Specify under what conditions the receptacle aerial refueling subsystem should be
commanded to reset from the "DISCONNECT" mode to the "READY" mode.

In one receptacle aerial refueling subsystem installation, an automatic reset feature was
incorporated which required an additional switch in the receptacle to determine if the nozzle was
seated in the receptacle. This design also required a time delay in the receptacle subsystem so
that the subsystem would not disconnect, reset, and then re-latch if the boom nozzle was not
cleared away from the receptacle fast enough. The UARRSI control logic does not have
provisions for automatic reset.
Ground maintenance personnel should also have this capability when the air vehicle is on the
ground while using the Universal Receptacle Aerial Refueling Tester to verify proper operation
of the receptacle aerial refueling subsystem.
If reset from the "DISCONNECT" mode to the "READY" mode is to be manually activated, the
appropriate crew member(s) must have the capability to reset.
The reset function usually has been manually commanded by the crew but it can be an
automatic feature that does not require crew activation.
776
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.7.2 Reset function.

The ability of the receptacle aerial refueling subsystem to reset from the "DISCONNECT" mode
to the "READY" mode while the subsystem is in NORMAL or OVERRIDE status, when
commanded, shall be verified by (TBS) .

It must be verified that the receptacle aerial refueling subsystem is capable of being reset from
the "DISCONNECT" mode to the "READY" mode once the tanker's boom nozzle has
disconnected from the receptacle to ensure that the receptacle subsystem can operationally
permit a subsequent re-engagement of the boom nozzle with the receptacle.
TBS: Specify that the proper operation of the reset function should be verified by a ground
demonstration and during flight demonstration of the subsystem.

NSN 4920-01-006-5709, to verify that the reset capability functions properly when commanded.
Each method of activation from the "DISCONNECT" mode to the "READY" mode (automatic or
manual) should be evaluated. Each manual reset feature that has been provided to a crew
member should be individually evaluated. Flight test must also verify the proper operation of
each activation method from the "DISCONNECT" mode to the "READY" mode (automatic or
manual). All evaluations should be conducted with the receptacle aerial refueling subsystem in
the “NORMAL” status and in the “OVERRIDE” status.
F.3.4.6.2.2.7.3 Manual override status.

The receptacle aerial refueling subsystem shall be capable of being placed from the “NORMAL”
status to the “OVERRIDE” status and permit the air vehicle to continue safe aerial refueling with
the targeted tanker boom subsystem(s). Advancing to "OVERRIDE" status shall be
accomplished by (TBS) .
This is an operational and safety requirement. In the event of a signal amplifier failure, the
receptacle aerial refueling subsystem must still be able to allow the air vehicle to safely conduct
aerial refueling procedures with the targeted tanker boom subsystem(s).

TBS: Specify how the receptacle aerial refueling subsystem should be commanded to the
"OVERRIDE" mode.
777
JSSG-2009A
APPENDIX F

In the past, the command to the "OVERRIDE" mode has been manually activated by a crew
member.
The UARRSI incorporates an override mode to accommodate a signal amplifier failure.
Operational sequencing and intercommunication capability will be unaffected, except the
receptacle toggles can only be operated by the receiver crew and the READY light will
illuminate when the slipway door is released.
As this requirement will typically require crew member activation to place the receptacle aerial
refueling subsystem into the OVERRIDE status, the appropriate crew member(s) must have the
capability to select the OVERRIDE status.
F.4.4.6.2.2.7.3 Manual override status.

The ability of the receptacle aerial refueling subsystem to be placed in the “OVERRIDE” status,
when activated, to permit the air vehicle to continue to be safely aerial refueled with the targeted
tanker boom subsystem(s) shall be verified by (TBS) .
It must be verified that the receptacle aerial refueling subsystem is capable of being be placed
in the “OVERRIDE” status when a signal amplifier fails to ensure that the aerial refueling
process can still be conducted safely.
TBS: Specify that verification should be completed through ground demonstration and during
flight demonstration of the subsystem.

NSN 4920-01-006-5709, to verify that the receptacle aerial refueling subsystem functions
properly when placed in “OVERRIDE” status. The ground demonstrations should verify that
only receiver initiated disconnects (automatic and manual activated) can disengage the boom
nozzle from the receptacle. Each method of activation to the “OVERRIDE” status (automatic or
manual) should be evaluated. Each manual advancement feature that has been provided to a
crew member should be individually evaluated. Flight demonstration must also verify the proper
operation of each advancement method from the "CONTACT" mode to the "DISCONNECT"
mode (automatic or manual). Each manual advancement feature that has been provided to a
crew member should be individually evaluated in the flight.
778
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.8 Through-the-Boom voice intercommunication capability.

The receptacle aerial refueling subsystem shall provide a capability for the receiver crew to
clearly and securely voice communicate to the tanker crew via the targeted tanker's Through-
the-Boom intercommunication system when the tanker's boom is engaged in the receptacle and
when the receptacle installation is in “NORMAL” or “OVERRIDE” status.
This is an operational and safety requirement. Boom and receptacle operations can require
voice communication between the boom operator and the receiver crew in order to accomplish
the aerial refueling operation safely. There may be missions where normal radio
communications between the tanker and receiver air vehicles are not allowed for security
reasons. As such, a clear, secure voice communication capability between the tanker and
receiver crews during radio silent conditions would be required.
If the capability for the air vehicle's crew to communicate with the tanker during radio silent
conditions via the tanker's Through-the-Boom intercommunication system is not required or is
not provided in the targeted tanker boom subsystem(s), this requirement should be deleted.
The UARRSI and other receptacles have the capability to transmit voice signals when a MIL-S-
38449 signal amplifier, or equivalent, is installed.
The Through-the-Boom intercommunication system of the United States Air Force (USAF)
KC-10 and KC-135 tankers is provided by a signal coil installed in the boom nozzle and a signal
amplifier system. The capability to transmit voice signals occurs when the receptacle's signal
coil properly mates with the boom nozzle's signal coil once the boom nozzle is inserted into the
receptacle.
Noise has often been a problem with the receptacle subsystem's provision to communicate via
the tanker's Through-the-Boom intercommunication system. Noise prevents the ability of the
tanker and receiver crews to communicate clearly. Noise has been minimized by using
shielded, twisted cables which connect to the air vehicle's intercom subsystem by an on or off
switch and by avoiding tying the wiring to the Through-the-Boom intercommunication system
with other electrical subsystems.
779
JSSG-2009A
APPENDIX F
F.4.4.6.2.2.8 Through-the-Boom voice intercommunication capability.

The ability of the receptacle aerial refueling subsystem, whether in “NORMAL” status or
“OVERRIDE” status, to provide the receiver crew member(s) a clear and secure voice
communication capability with the tanker crew via the targeted tanker's Through-the-Boom
intercommunication system when the tanker's boom is engaged in the receptacle shall be
verified by (TBS) .

The ability of each specified crew member on the receiver air vehicle to clearly communicate via
the Through-the-Boom once the boom nozzle is engaged within the receptacle must be verified
to ensure a secure voice communication is available between the targeted tanker and the
receiver air vehicle during aerial refueling operations which are conducted under radio silent
conditions. Verification ensures that any information that must be shared between the targeted
tanker and the receiver air vehicle crew to safely conduct aerial refueling is not compromised.

TBS: Specify that verification should be through ground demonstration and flight demonstration.
Preliminary evaluations should be made during a ground demonstration with the Universal
Receptacle Aerial Refueling Tester, NSN 4920-01-006-5709. However, final validation should
be made during flight testing with the targeted tanker boom aerial refueling subsystem(s).
Ground demonstrations and flight demonstrations should be conducted with the receptacle
aerial refueling subsystem in its “NORMAL” status and in the “OVERRIDE” status.
780
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.9 Tanker pressure regulation failures.

The receptacle aerial refueling subsystem shall withstand, or protect itself against, the fuel
pressure conditions created during fuel delivery from each targeted tanker boom aerial refueling
subsystem when that particular subsystem’s pressure regulation capability has failed. Any
feature incorporated to provide this protection shall not activate and interfere with the fuel
transfer process when fuel pressure transients occur that are normal during the aerial refueling
process at properly regulated fuel delivery pressures.

This is an operational and safety requirement. A failure in the pressure regulation capability of a
tanker's boom aerial refueling subsystem will result in fuel delivery pressures to the receiver's
receptacle aerial refueling subsystem higher than normally expected. This increase in the fuel
delivery pressure can create surge pressures within the receiver's receptacle aerial refueling
subsystem higher than what would be experienced if the fuel delivery pressure was properly
regulated by the tanker's boom aerial refueling subsystem. If the receiver's receptacle aerial
refueling subsystem is not designed to handle a failure in the tanker's boom aerial refueling
subsystem pressure regulation capability, the resultant higher surge pressures could possibly
damage the receiver's receptacle aerial refueling subsystem; for example, component failures,
fuel leaks. Such damage would terminate any further aerial refueling operations and could
create a fire and explosion hazard to the air vehicle.

(TBD)

The typical design approach to this requirement has been to provide an automatic disconnect
feature that activates when the delivered fuel pressure in the receptacle aerial refueling
subsystem is above the normally expected delivery pressure. Using a sensing switch, a signal
is sent to the receptacle signal amplifier, advancing it to “DISCONNECT” mode, when the fuel
pressure is above the normally expected value. The boom nozzle is automatically disconnected
from the receptacle, thereby terminating fuel flow at the high delivery pressure. With this design
approach, care must be taken to insure that normal fuel pressure fluctuations within the
receptacle aerial refueling subsystem do not cause inadvertent disconnects. Normal pressure
fluctuations that will not activate the automatic pressure disconnect feature would include tanker
pump(s) startup surges and surges created by the automatic closure, or manual selected
closure, of any valve within the receptacle aerial refueling subsystem. Inadvertent disconnects
become an operational nuisance as they add to the aerial refueling time and workload on the
receiver crew and the tanker boom operator. With this design approach, the automatic
disconnect capability should be removed or locked out when the manual override switch is
activated. See “Disconnect Function” and “Manual Override Function” in this appendix.
Another possible design approach to this requirement could be the incorporation of pressure
relief valves and accumulators to accommodate the higher surge pressures that would occur
with the higher fuel delivery pressure. Another possible design approach to this requirement
could be designing the subsystem to a higher proof pressure value, one that assumes an
unregulated fuel delivery pressure from the tanker boom aerial refueling subsystem(s). This
781
JSSG-2009A
APPENDIX F
approach may result in a heavier subsystem design to be able to withstand the higher surge
pressures.
F.4.4.6.2.2.9 Tanker pressure regulation failures.

The ability of the receptacle aerial refueling subsystem to withstand the fuel pressure conditions
created during fuel delivery from each targeted tanker boom aerial refueling subsystem when
that subsystem's pressure regulation has failed, or protect itself only when such a failure
condition exists, shall be verified by (TBS) .
It must be verified that the receptacle aerial refueling subsystem can withstand or protect itself
from the fuel pressure conditions created during fuel delivery from each targeted tanker boom
aerial refueling subsystem when that subsystem's pressure regulation has failed to ensure
damage does not occur to the aerial refueling subsystem.

TBS: Specify ground and flight test.
Special test equipment or procedures are required to generate fuel pressures above the normal
regulated pressure level. If a pressure disconnect feature is used, tests should verify that
normal fuel pressure perturbations within the receptacle aerial refueling subsystem that occur
during properly regulated fuel transfer procedures do not activate the pressure disconnect
function and result in, inadvertent disconnects.
F.3.4.6.2.2.10 Reverse refueling.

If reverse aerial refueling is a requirement, the receptacle aerial refueling subsystem shall be
capable of reverse aerial refueling without exceeding its proof pressure limit and impacting the
performance of other air vehicle subsystems. The minimum reverse refueling rate shall be
(TBS 1) at (TBS 2) fuel pressure.
This is an operational and safety requirement. If the air vehicle has a mission requirement to be
able to reverse refuel a tanker air vehicle due to an in-flight emergency condition on the tanker,
that requirement must be defined so that the aerial refueling subsystem can be designed to
provide a fuel transfer (pumping) capability back to the tanker that does not compromise safety
to the air vehicle or tanker.
This requirement is applicable only if mission dictates.
TBS 1: Specify the minimum fuel flow rate (gallons per minute).
782
JSSG-2009A
APPENDIX F
TBS 2: Specify the fuel pressure (psig) at the air vehicle's receptacle during flow. The specified
fuel pressure should not exceed 60 psig.
Reverse refueling should only be considered for large air vehicles. The capability to reverse
refuel should not degrade the capability of the receiver's fuel subsystem to perform critical
functions to maintain flight and safe control of the air vehicle, such as engine feed and fuel
management. When reverse refueling capability has been added to a receptacle subsystem,
failures have resulted in the aerial refueling manifold due to fuel pressures that have exceed the
proof pressure limit. In reverse aerial refueling operations, the aerial refueling manifold must be
designed to withstand the surge pressures that are generated within the air vehicle's aerial
refueling subsystem when a flowing disconnect from the tanker occurs.
F.4.4.6.2.2.10 Reverse refueling.

The reverse aerial refueling capability shall be verified by (TBS) .
The ability to perform reverse aerial refueling should be verified to ensure the air vehicle can
conduct all its operational missions safely.

TBS: Specify that the reverse refueling capability should be verified by inspection and flight
test.
Reverse aerial refueling is usually accomplished by low pressure transfer pumps, therefore, the
elevation difference between the tanker and receiver must be duplicated to validate flow rate.
This can best be validated in flight. Instrumentation is required to measure surge pressures
when a disconnect is made under fuel flow conditions. (Inspections include assuring pumps
available to reverse flow and no valves to prevent reverse flow.)
783
JSSG-2009A
APPENDIX F
F.3.4.6.2.2.11 Receptacle noise level.

At no time during flight shall the receptacle installation in a closed, open, or transient position
cause an increase in the noise level of the air vehicle's crew compartment beyond (TBS) .
This is a safety and integration requirement. It is possible for a receptacle to cause an

objectionable noise level in the crew compartment, particularly when the receptacle is in the
open configuration (ready to be contacted by the boom nozzle). As such, a maximum limit for
noise resulting from the receptacle installation must be established.
TBS: Specify the maximum noise level in decibels (dB).

(TBD)
F.4.4.6.2.2.11 Receptacle noise level.

The acceptability of noise generated by the receptacle installation in flight shall be verified by
(TBS) .
The level of noise generated by the receptacle installation during flight must be verified to
ensure that the crew compartment noise is maintained to a safe level.

TBS: Specify flight test.

In the closed position, the flight test should examine noise generation within the entire airspeed
and altitude envelope for the air vehicle. In the open position and any position between the
closed and open positions, the flight test should examine noise generation within the entire
airspeed and altitude envelope that the receptacle installation can be actuated to and
maintained in the open position.
784
JSSG-2009A
APPENDIX F
F.3.4.6.2.3 Probe receiver aerial refueling
F.4.4.6.2.3 Probe receiver aerial refueling
F.3.4.6.2.3.1 Type of probe installation.

The type of probe installed on the receiver air vehicle shall be (TBS) .
This is an integration requirement. To successfully accomplish total system integration for the
receiver air vehicle, the type of probe installation must be identified.
TBS: Specify the type of probe installation for the air vehicle, for example, a retractable or fixed
(non-retractable) type. A retractable probe includes those that are fully retractable and those
that are semi-retractable. The type of probe should be selected based on the mission
performance requirements for the air vehicle.

Probe selection can possibly impact the overall aerodynamics of the air vehicle and should be
analyzed to minimize any effects. The drag penalty associated with a fixed probe will degrade
air vehicle performance throughout the receiver's flight envelope. Similarly, if the fixed probe is
to be removed on missions not requiring aerial refueling, the drag penalty associated with the
"cleaned up configuration" must be considered when choosing a probe type. The effects on air
vehicle stability control parameters throughout the receiver's entire flight envelope must be
evaluated if a fixed probe is considered (including probe removed configuration if applicable).
Fully retractable probes drag impacts are typically only associated within the air vehicle's aerial
refueling envelope when the probe would normally be extended. The amount of "retractability"
in a semi-retractable probe will determine the level of impact on air vehicle aerodynamics. With
fully retractable or semi-retractable probes, if single failure modes can prevent the probe from
retracting, impacts on air vehicle aerodynamics should then be considered within the air
vehicle's entire flight envelope.
Maintenance concepts should be considered which probe installation best meets weapon
system requirements. In general, a fixed probe can be installed into the receiver air vehicle
easier than the other types, particularly if the installation is a retrofit effort. Fixed probes are
typically more maintainable than the other probe types since there are usually no movable,
mechanical parts and can be designed to be easily removed on the ground for missions not
requiring aerial refueling.
785
JSSG-2009A
APPENDIX F
F.4.4.6.2.3.1 Type of probe installation.

The type of probe installation shall be verified by (TBS) .
It must be verified that the proper probe design has been installed into the air vehicle to ensure
total system integration has been accomplished.

TBS: The probe type should be verified by inspection.

(TBD)
F.3.4.6.2.3.1.1 Type of probe nozzle.

The probe nozzle attached to the end of the probe mast shall be a (TBS) . The nozzle shall
comply with the interface requirements defined in North Atlantic Treaty Organization
Standardization Agreement (NATO STANAG) 3447.
This is an operational interface requirement. A specific nozzle must be identified to ensure

operational compatibility with the targeted tanker drogue aerial refueling subsystem(s) identified
for the air vehicle.
TBS: Specify that the probe nozzle should be a MIL-N-25161 probe nozzle. A MIL-N-25161
qualified probe nozzle meets NATO STANAG 3447 design requirements but also has other
design requirements which make it the most compatible probe nozzle with all of the current
tanker drogue aerial refueling subsystems and the aerial refueling couplings used in these
subsystems.
Per US government agreements with the international community, the probe nozzle must
comply with NATO STANAG 3447. NATO STANAG 3447 only addresses the mating dimension
and latch operation requirements for a probe nozzle. A MIL-N-25161 nozzle meets
NATO STANAG 3447 requirements but also has other design features that are required for full
operational compatibility with tanker drogue aerial refueling subsystems. For example,
MIL-N-25161 requires flexibility of the nozzle poppet. This flexibility reduces the probability of
nozzle hang-up on the tanker's drogue and coupling during severe off-center disconnects
thereby reducing the chance of probe nozzle damage. This is particularly necessary when
aerial refueling with the KC-135's boom-to-drogue adapter (BDA) kit subsystem that has a
limited hose envelope. The nozzle specification also does not permit structural weak-link
786
JSSG-2009A
APPENDIX F
features incorporated into the design. This feature is prevalent in allied nozzle configurations
and is incorporated with the intent to restrict any resultant structural damage due to excessive
probe loads to the probe nozzle rather than the probe mast structure. Operationally, receiver air
vehicles using this type of nozzle have demonstrated a higher propensity for nozzle breakage
particularly when aerial refueling from the KC-135 BDA kit system. Damage to a probe nozzle
can terminate not only the mission for the receiver (insufficient fuel transferred to complete the
mission) but also end it for the tanker. It is not rare for part of the broken nozzle to remain in the
tanker aerial refueling subsystem's coupling. For tankers without redundant drogue systems,
such a condition renders the tanker incapable of performing any additional aerial refueling tasks.
By having a more damage tolerant design, a MIL-N-25161 nozzle is more ideal for probe
installations.
F.4.4.6.2.3.1.1 Type of probe nozzle.

The suitability of probe nozzle design shall be verified by (TBS) .

It should be verified that the proper nozzle design has been incorporated into the probe
installation to ensure operational compatibility with the specified tanker drogue system(s) can be
attained.

TBS: Specify inspection, ground demonstration, ground test, and flight test. The inspection
should verify that the nozzle meets NATO STANAG 3447 requirements. If the nozzle is a
MIL-N-25161 item, then flight testing should also be used to verify that the selected probe
nozzle is adequate. If the nozzle selected is not a MIL-N-25161 qualified component, ground
demonstrations and tests should first be performed to initially evaluate physical compatibility
with the aerial refueling coupling of each targeted tanker aerial refueling subsystem. Flight
testing must then examine compatibility within the entire aerial refueling envelope for each
tanker drogue aerial refueling subsystem identified for operational use. The flight tests should
ensure that there are no hang-up problems with the probe nozzle on the tanker aerial refueling
subsystem's drogue or coupling and confirm that there is no resultant probe nozzle damage.
(TBD)
787
JSSG-2009A
APPENDIX F
F.3.4.6.2.3.1.2 Probe actuation provisions.

The primary actuation (extension and retraction) method for a retractable probe shall be
(TBS 1) . Given a failure of the primary method, the emergency method to extend the
retractable probe shall be (TBS 2) . Given a failure of the primary method, the emergency
method to retract the retractable probe shall be (TBS 3) .
This is an operational and an integration requirement, applicable to retractable-type probe

designs only. The ability to actuate a retractable probe is required in order to successfully
conduct aerial refueling operations. Providing redundant capability to actuate a retractable
probe prevents a single failure from allowing the air vehicle's mission to be successfully
completed. Identifying how each actuation method is activated and powered addresses air
vehicle subsystem integration requirements.

TBS 1: Specify how the retractable probe should be actuated to and from the "retracted" and
"extended" positions; such as, manually, electrically, or hydraulically.
TBS 2: Specify how the retractable probe should be actuated to the"extended" position; such
as, manually, electrically, or hydraulically.
TBS 3: Specify how the retractable probe should be actuated to the"retracted" position; such
as, manually, electrically, or hydraulically.

Mission requirements will dictate whether the emergency retract capability is required for the
probe subsystem. Recent probe-equipped fighter-type air vehicles did not require the capability
to emergency retract the aerial refueling probe.
F.4.4.6.2.3.1.2 Probe actuation provisions.

The ability of the (TBS 1) to use the primary actuation method to transition the retractable
probe between the "retracted" and "extended" positions while in flight shall be verified by
(TBS 2) . The ability of the (TBS 3) to use the emergency actuation method to transition
the retractable probe to the "extended" position while in flight shall be verified by (TBS 4) .
The ability of the (TBS 5) to use the emergency actuation method to transition the
retractable probe to the "retracted" position while in flight shall be verified by (TBS 6) .

It must be verified that the appropriate crew member(s) has(have) the capability to transition a
retractable probe installation between the "retracted" and "extended" positions while in flight to
ensure that the air vehicle can successfully and safely conduct aerial refueling operations with
the targeted tanker drogue aerial refueling subsystems.
788
JSSG-2009A
APPENDIX F

The suitability of the probe extension control and location can be adequately verified by a
ground demonstration. The testing must consider improper operation, especially if the control is
used for more than one function.
The suitability of the probe extension control and location should be adequately verified by a
ground demonstration.
TBS 1: Identify the specific crew member(s).
TBS 2: Specify ground demonstration and during flight test of the subsystem.
TBS 3: Identify the specific crew member(s).
TBS 4: Specify ground demonstration, and during flight test of the subsystem. The
JSSG-2001 paragraph on “Refuel interfaces” for the air vehicle should specify if ground
operation of retractable probe actuation method(s) is required; hence, whether ground
demonstration is appropriate here. The ground demonstration, and during flight test of the
subsystem, should also evaluate the suitability of the location and accessibility of the primary
and emergency probe actuation control(s).
TBS 5: Identify specific crew member(s).
TBS 6: Specify ground demonstration, and during flight test of the subsystem. The JSSG-2001
requirement for “Refuel interfaces” for the air vehicle should specify if ground operation of
retractable probe actuation method(s) is required; hence, whether ground demonstration is
appropriate here.
(TBD)
F.3.4.6.2.3.1.3 Probe actuation airspeed and altitude envelope.

A retractable probe shall be capable of extension and retraction by its primary method within an
airspeed and altitude envelope of (TBS 1) . Using its emergency method, a retractable
probe shall be capable of extension within an airspeed and altitude envelope of (TBS 2) . A
retractable probe shall be able to retract within an airspeed and altitude envelope of (TBS 3)
when its emergency method is used.
This is an operational requirement. The airspeed and altitude envelope at which the probe will
be able to be actuated must be identified to ensure that the probe can be extended within an
envelope similar to the operational airspeed envelope of the targeted tanker aerial refueling
drogue subsystem(s) and can be retracted within that same envelope to permit the air vehicle to
depart the aerial refueling track in a "clean" configuration.
TBS 1: Specify the airspeed (KEAS) and altitude (MSL) envelope for primary extension and
retraction.
789
JSSG-2009A
APPENDIX F
TBS 2: Specify the airspeed (KEAS) and altitude (MSL) envelope for emergency extension.
TBS 3: Specify the airspeed (KEAS) and altitude (MSL) envelope for emergency retraction.
The airspeed and altitude envelope should be similar to the operational airspeed envelope of
the targeted tanker aerial refueling drogue subsystem(s). Ideally, a retractable probe should be
capable of extension and retraction by the primary and emergency methods at all aerial
refueling airspeeds up to .9M or 350 KEAS, whichever is lower, and altitudes from 100 feet to
35,000 feet MSL.

Attention should be given to door and panel airspeed limits to preclude loss of hardware.
Ensure that the maximum actuation airspeed is somehow communicated to the crew. This has
typically been accomplished with a placard placed adjacent to the probe actuation handle.
probe subsystem.
F.4.4.6.2.3.1.3 Probe actuation airspeed and altitude envelope.

The airspeed and altitude envelope that the retractable probe can be actuated (extended and
retracted) using the primary and emergency methods shall be verified by (TBS) .
The actuation airspeed and altitude envelope for a retractable probe must be verified to ensure
that the probe can be extended within the operational envelope of the targeted tanker aerial
refueling drogue subsystem(s) and can be retracted within that same envelope to permit the air
vehicle to depart the aerial refueling track in a "clean" configuration.

TBS: Specify the airspeed and altitude envelope should be verified by flight test. Flight test
should evaluate the actuation envelope under both hot and cold temperature conditions using
the primary and emergency methods. Any condition of low power (hydraulic, fueldraulic,
electrical) being provided to the actuation mechanism of the primary and emergency methods
should be examined for the effects on the probe actuation envelope.
(TBD)
790
JSSG-2009A
APPENDIX F
F.3.4.6.2.3.1.4 Probe actuation times.

A retractable probe shall have the capability to extend and lock into the extended position, or
retract and lock in the stowed position, in (TBS 1) using the primary mode within its specified
actuation airspeed and altitude envelope. Using the emergency method for extension, a
retractable probe shall have the capability to extend and lock into the extended position in
(TBS 2) within its specified actuation airspeed and altitude envelope. Using the emergency
method for retraction, a retractable probe shall have the capability to retract and lock into the
stowed position in (TBS 3) within its specified actuation airspeed and altitude envelope.
This is an operational requirement. The allowed time for extending or retracting the probe must
be specified in order for the air vehicle to be refueled within the time dictated by its mission(s).
TBS 1: Specify the desired time (seconds) for probe mast extension and retraction,
respectively, using primary means. The probe mast should extend and lock into position, or
retract and lock into the stowed position, in 5 to 20 seconds under its primary mode.
TBS 2: Specify the desired time (seconds) for probe mast extension using emergency means.
Using its emergency mode, the probe mast should extend and lock into position within
30 seconds.
TBS 3: Specify the desired time (seconds) for probe mast retraction using emergency means.
Using its emergency mode, the probe mast should retract and lock into the stowed position
within 30 seconds.

The probe must extend and retract into position in a reasonably rapid period of time. An
actuation which is too rapid can cause excessive forces within the actuation mechanism while
an actuation time that is too long can impact the total aerial refueling time for the air vehicle.
Hydraulic actuators have been used for probe extension on many different systems with good
results. Rotary-wing air vehicles have used engine bleed air to extend the probe. This design
was complex and resulted in a difficult and costly effort to maintain the probes at an acceptable
level of performance.
F.4.4.6.2.3.1.4 Probe actuation times.

The probe actuation (extension and retraction) times shall be verified by (TBS) .
The time required for extending or retracting the retractable type probes must be verified to
ensure that the air vehicle can be refueled within the time dictated by its operational mission(s).
791
JSSG-2009A
APPENDIX F

TBS: Specify that the probe actuation times should be verified by ground and flight test. The
actuation times should be measured in flight tests after a long period of cold temperature
conditions and icing conditions. The test should determine any effect of air speed and altitude
on actuation time. Any condition of low power (hydraulic, fueldraulic, electrical) being provided
to the actuation mechanism of the primary and emergency methods should be examined for the
effects on the probe actuation times.
probe subsystem.
F.3.4.6.2.3.2 Probe location.

The probe shall be located such that it is compliant with NATO STANAG 3447 and so that
(TBS) .
This is an integration, operational, and safety requirement. The criteria for probe location must
be provided so that the probe aerial refueling subsystem is properly integrated onto the air
vehicle and permits the aerial refueling process to be completed successfully and safely. The
adequacy of the location of the probe must be verified to ensure that the probe aerial refueling
subsystem is properly integrated onto the air vehicle and that aerial refueling can be completed
successfully and safely.

The US Government has agreed to comply with NATO STANAG 3447 without reservation or
exception. Thus, all new probe subsystems must meet NATO STANAG 3447.
TBS: Specify that the probe should be located so that:
a. The air flow field around the probe and the air vehicle does not cause instability of the
tanker aerial refueling subsystem's drogue and coupling during the engagement portion
of the aerial refueling process.
b. A minimum of 12 inches of the probe mast, measured from the nozzle tip, should be
visible to the receiver pilot (and co-pilot, if applicable) for observing the hookup with the
drogue and coupling without requiring the receiver pilot (and co-pilot, if applicable) to
change his(their) visual reference on the tanker.
c. The probe should not prevent or degrade the pilot's (and co-pilot's, if applicable) vision
during landing or other critical flight phases.
d. The probe should not prevent, or degrade the safety of, the ground and in-flight egress
or assisted egress of any crew member.
792
JSSG-2009A
APPENDIX F
e. The pilot (and co-pilot, if applicable) should have an unobstructed view of each targeted
tanker's underbody, its formation references, drogue aerial refueling subsystem status
lights, and hose exit area.
f. The probe should not be required to be removed to perform other ground maintenance
actions on the air vehicle.
g. The probe should not interfere with the air flow field around the air vehicle such that it
adversely affects the proper operation of the engine(s) and air data ports.
h. The fuel spray that typically occurs at disconnect from the tanker aerial refueling
subsystem's drogue and coupling should not become ingested into the engine or air data
ports.
i. The probe should not interfere with the proper release of offensive weapons, the release
of defensive countermeasures, and the jettisoning of external stores.

(TBD)
F.4.4.6.2.3.2 Probe location.

The suitability of the probe location shall be verified by (TBS) .
It must be verified that the location of the probe is properly selected to ensure that the aerial
refueling process can be completed successfully and safely with the targeted tanker drogue
aerial refueling subsystem(s) and to insure that the other subsystems on the air vehicle are not
adversely affected with the selected probe location.

TBS: Specify inspection, ground demonstration, and flight test.
The location of the probe in relation to other air vehicle equipment and subsystems can be
verified by an inspection and a ground demonstration; however, its suitability in relation to
hookup with the targeted tanker aerial refueling subsystem can only be verified by flight test.
793
JSSG-2009A
APPENDIX F
F.3.4.6.2.3.2.1 Probe alignment.

The probe, when in the position to make an engagement with the tanker aerial refueling
subsystem's drogue coupling, shall be aligned such that a smooth, positive connection can be
made with the drogue coupling within the receiver closure speed limitations for each targeted
tanker drogue aerial refueling subsystem.
a. The longitudinal axis of the nozzle shall be (TBS 1) .
b. The plane of the vertical axis of the nozzle shall be (TBS 2) .
This is an operational and safety requirement. The proper alignment of the probe is a pre-
requisite to achieving a safe and effective contact with the drogue and coupling of the targeted
tanker aerial refueling subsystem(s).

TBS 1: Specify that the longitudinal axis of the nozzle should be parallel to the line of average
pitch angle during refueling.
TBS 2: Specify that the plane of the vertical axis of the nozzle should be parallel to the local air
flow field around the probe mast.
The local air flow around the probe controls the direction of the forces holding the drogue and
coupling. If not properly aligned, the forces on the drogue and coupling may not be sufficient to
allow a positive contact with the nozzle. The nozzle may push the drogue and coupling and not
establish a complete engagement which is required to create an open fuel flow path between
the tanker aerial refueling subsystem's coupling and the probe nozzle.
F.4.4.6.2.3.2.1 Probe alignment.

The suitability of probe alignment shall be verified by (TBS) .
It must be verified that the probe installation is properly aligned to ensure the air vehicle can
successfully and safely make a positive contact with the drogue coupling of each targeted
tanker aerial refueling subsystem.

TBS: Specify flight test. In the flight tests, the ability to make hookups should be evaluated with
the hose empty and full of fuel.

An empty hose flies in a different location than a hose full of fuel. Operationally, the first
receiver contact on a tanker drogue aerial refueling subsystem in a mission is usually made with
794
JSSG-2009A
APPENDIX F
the hose empty of fuel. Contacts with an empty hose may be the preferred procedure during
training exercises. During the flight test, fuel should be transferred after the contacts to verify
that a positive hookup has been accomplished.
F.3.4.6.2.3.2.2 Probe clearance.

The clearance around the probe shall provide an unobstructed path for the drogue coupling of
the targeted tanker aerial refueling subsystems to approach and contact the probe nozzle. The
probe clearance shall be (TBS) .
This is an operational and safety requirement. In order for the aerial refueling process to
proceed successfully and safely, adequate clearance around the probe must be provided such
that an unobstructed path for the tanker drogue coupling is available as it approaches and
contacts the probe nozzle.
TBS: Specify the clearance around the probe that should be provided to allow the approach
and contact of the tanker drogue coupling from each targeted tanker aerial refueling subsystem.
As a minimum, the clearance should comply with NATO STANAG 3447. For retractable probes,
the clearance specified should apply when the probe has been actuated to its extended
position.

The US Government has agreed to comply with NATO STANAG 3447, without reservation or
exception. As such, all new probe subsystems must meet NATO STANAG 3447 with regard to
clearance around the probe. Existing special purpose tankers (rotary-wing air vehicles) can
have a drogue coupling that is larger than the minimum clearance specified in
NATO STANAG 3447. As such, the probe clearance for receivers that must be compatible with
these tanker aerial refueling subsystems must provide clearance around the probe that is larger
than the size of the drogue coupling on the special purpose tanker's aerial refueling subsystem.
Inadequate probe clearances can result in preventing drogue coupling contact with the probe
nozzle, thereby, not permitting fuel transfer to take place from the tanker to the air vehicle. In
addition, insufficient probe clearance can damage the tanker's drogue coupling which can
render that aerial refueling subsystem of the tanker inoperable for further aerial refueling
transfers during that tanker mission. Any damage to the tanker's drogue coupling or the air
vehicle due to inadequate clearance around the probe can result in a foreign object damage
(FOD) hazard to the air vehicle.
795
JSSG-2009A
APPENDIX F
F.4.4.6.2.3.2.2 Probe clearance.

The suitability of the clearance around the probe to permit the approach and contact of each
targeted tanker aerial refueling subsystem's drogue coupling with the probe nozzle shall be
verified by (TBS) .
The suitability of the clearance provided around the probe must be verified to ensure that the
aerial refueling process can be accomplished safely and successfully.
TBS: Specify ground demonstration and flight test. A ground demonstration should verify that
the specified basic clearance with the drogue and coupling has been provided. A flight test is
required to verify that the actual approach of the drogue coupling to the probe in flight is as
predicted and that there are no obstructions which have been overlooked.

(TBD)
F.3.4.6.2.3.3 Probe compartment fluid accumulation.

Probe compartments shall not accumulate fluids which can create a fire and explosion hazard to
the air vehicle, or which can impact the proper operation of the actuation mechanism for
retractable probes. Fluids within the probe compartment shall be removed by (TBS) . If
drains are used, the drainage requirements of JSSG-2001, “Fire and Explosion Prevention”
shall be met. Fluids within the probe compartment shall not be able to migrate to another
compartment within the air vehicle which can create a fire and explosion hazard.
This is a safety requirement. During aerial refueling operations, the probe nozzle can be
damaged or the probe mast broken. This can result in fuel being spilled in the probe
compartment, particularly with retractable-type probe installations. Also, the accumulation of
rainwater in the compartment must be prevented to avoid the occurrence of icing conditions that
could interfere with the proper operation of the actuation mechanism for a retractable probe.
TBS: Specify how any fluid spilled in the probe compartment will be removed to preclude
accumulation.
Typically, probe compartments have been sealed to prevent fluid leakage into other air vehicle
compartments. The fluid is then drained overboard to prevent accumulation of the fluid in the
796
JSSG-2009A
APPENDIX F
probe compartment. The fluids in question have typically been fuel, rainwater, air vehicle
cleaning solutions, and hydraulic fluid (from the probe actuation mechanism). Any sealant
material used to help prevent the fluids from migrating to another compartment must be
compatible with all fluids expected to be encountered.
See fuel drainage requirements (G.3.4.7.5) in appendix G, Fire and Explosion Hazard
Protection Subsystem, for additional Lessons Learned related to this requirement.
F.4.4.6.2.3.3 Probe compartment fluid accumulation.

Provisions to prevent the accumulation of fluids in the probe compartment shall be verified by
(TBS 1) . The adequacy of the provided method(s) shall be verified by (TBS 2) . The
adequacy of the provided method(s) to prevent fluids from migrating into another compartment
within the air vehicle shall be verified by (TBS 3) .
The provisions for, and the adequacy of, containing fluids in the probe compartment and then
removing those fluids from the probe compartment should be verified to ensure that a safety
hazard has not been introduced to the air vehicle and that proper operation of the probe
actuation mechanism for retractable probes is not compromised.

TBS 1: Specify inspection.
TBS 2: Specify ground and flight tests.
TBS 3: Specify ground test. Ground tests verifying the adequacy of the probe compartment
provisions for containing any fluid and then removing that fluid from the compartment should
evaluate all ground and flight attitudes of the air vehicle.

Water has typically been the fluid used to evaluate sealing and drainage capability of probe
compartments in ground and flight tests. Flight tests have revealed that initial drainage
provisions were not adequate due to pressure differentials across the drainage exit location on
the air vehicle. Adequate drainage capability should be verified throughout the entire flight
envelope for the air vehicle.
F.3.4.6.2.3.4 Probe illumination.

The (TBS) portion of the probe installation, when in the position to make a contact with the
tanker aerial refueling subsystem's drogue coupling, shall be illuminated to assist the air vehicle
crew member(s) to make the engage with the tanker aerial refueling subsystem's drogue
coupling. The probe illumination shall be oriented such that it does not blind or distract the air
vehicle's pilot (and co-pilot, if applicable) during the aerial refueling process and any tanker crew
member who is required to observe the aerial refueling procedure. The probe illumination shall
not be a potential source of ignition of flammable fuels. The aircrew shall be able to control the
intensity of the probe illumination in variable increments from “OFF” to “FULL BRIGHT”.
797
JSSG-2009A
APPENDIX F
This is an operational and safety requirement. When night aerial refueling is required for the
receiver air vehicle, proper probe illumination is required to permit the aerial refueling process to
be successfully and safely completed.
TBS: Specify that, in the precontact position for the targeted tanker drogue aerial refueling
subsystem, the probe illumination should illuminate a minimum of twelve inches of the probe
mast, measured from the probe nozzle tip, and also illuminate the drogue coupling at a distance
of fifty yards. Also specify that, after contact is established, the probe illumination should
illuminate the refueling hose, the hose attachment point to the tanker, and the underside of the
wing or fuselage area of the tanker (depending on the installed location of the drogue aerial
refueling subsystem).

This requirement is mandatory for night aerial refueling operations.
The light assembly should not produce bright spots or direct the light toward the air vehicle pilot
(and co-pilot, if applicable) and any tanker air crew member (if applicable). The light assemblies
in close proximity with the probe installation should be explosion-proof since fuel spray onto the
light assemblies can be expected during the disconnect phase of the aerial refueling process.
When operating at maximum intensity and temperature, the light assemblies must not fail or
fracture when coming into contact with -65°F fuel.
Ideally, for retractable probe installations, the probe illumination should automatically occur once
the probe installation has been activated to the "extended" position and automatically terminate
once the probe installation has been activated to the "retracted" position. For fixed probe
installations, the probe illumination feature will require a dedicated means of activation.
The probe lighting requirements from MIL-L-006730; Lighting Equipment, Exterior, Aircraft
(General Requirements For), have been used in legacy probes.
F.4.4.6.2.3.4 Probe illumination.

The ability to illuminate the probe and the specified tanker references shall be verified by
(TBS 1) . The inability of the probe illumination to be a potential ignition source shall be
It must be verified that the provided probe illumination is adequately installed to ensure that the
air vehicle crew can make clean, safe engagements of the probe nozzle with the tanker
subsystem's drogue coupling during aerial refueling processes and that the appropriate tanker
crew member(s) can properly monitor the aerial refueling procedures, as required. In addition, it
must be verified that the probe illumination feature is properly designed to insure that it does not
create a fire and explosion hazard to the air vehicle during the aerial refueling process.
798
JSSG-2009A
APPENDIX F

TBS 1: Specify analysis, ground test and flight test.
The analysis should examine the adequacy of the probe illumination for the requirements that
apply to the air vehicle and the tanker. The ground test should complete the preliminary
examination of the adequacy of the probe illumination for the air vehicle side of the
requirements; such as amount of probe mast illumination, impact on air vehicle crew visibility,
when the illumination feature is activated. The flight tests should be the final verification of the
adequacy of the probe illumination for air vehicle side of the requirements and the final
verification of the adequacy of the probe illumination for the performance requirements that
impact the tanker. The flight tests should evaluate several different natural night conditions;
such as under twilight, new and full moon conditions.

(TBD)

The probe and the air vehicle attachment and support structure shall withstand loads of
(TBS 1) . The (TBS 2) area surrounding the probe mast shall withstand inadvertent
impact loads of (TBS 3) .

This is an operational and safety requirement. The entire probe and its attachment/support
structure must be structurally compatible with each drogue aerial refueling system on the
identified targeted tanker(s) to permit the aerial refueling process to be successfully and safely
completed. As there are unique loads associated with each different drogue system, the
applicable load criteria must be specified for the probe and its attachment structure. In addition,
since probe nozzle and drogue/coupling engagements/disengagements are not always precise,
the area surrounding the probe must be able to withstand impact loads that can occur due to
inadvertent drogue/coupling strikes.

TBS 1: Specify the static operating, design limit, and ultimate loads. In addition, include
dynamic impact loads encountered when connecting to the coupling of the tanker’s drogue
aerial refueling subsystem.
When aerial refueling with the KC-135’s BDA system, the probe nozzle, probe mast, and air
vehicle attachment/support structure must be able to withstand one of the following limit loads
criteria upon contact, within the specified fuel transfer envelope while engaged to the BDA kit’s
coupling and at disconnect throughout the aerial refueling envelope:
a. a 1000-lb. compression load in combination with a 3000-lb. radial load
b. a 1000-lb. tensile load in combination with a 3000-lb. radial load
799
JSSG-2009A
APPENDIX F
c. a 2000-lb. tensile load

d. a 2000-lb. compression load,
or the following:
d. a 2500-lb. compression load
e. a 1500-lb. radial load.
When aerial refueling from a hose reel drogue system, the probe nozzle, probe mast, and air
vehicle attachment/support structure must be able to withstand the following limit loads upon
contact, within the specified fuel transfer envelope while engaged to the tanker’s drogue
coupling and at disconnect throughout the aerial refueling envelope:
d. a 2000-lb. compression load.
Operating loads at normal refueling positions within the specified fuel transfer envelope of each
drogue system should be maintained within 2/3 of limit load to minimize impact on fatigue life.
Ultimate loads should be 133 percent of the limit loads.
The impact loads during engagements should be based upon a drogue/coupling contact velocity
up to 10 feet per second and using the drogue drag at the maximum airspeed within the aerial
refueling envelope for that particular drogue aerial refueling subsystem.
TBS 2: Specify the applicable area around the probe structure. All structure in front of, beside,
and 6 feet aft of the probe nozzle that is located within 2 drogue diameters circumferentially
about the probe nozzle axis should be designed for inadvertent drogue/coupling strikes. The
drogue diameter to be used must be the largest diameter drogue on the targeted tanker drogue
subsystem(s).
TBS 3: Specify the impact loads to be applied to the defined area around the probe structure
due to inadvertent drogue/coupling strikes encountered during the engagement/disengagement
process. Inadvertent impact loads onto the surrounding structure should be based upon the
loads produced by each targeted tanker drogue subsystem. The impact loads from inadvertent
drogue/coupling strikes during engagements should be based upon a drogue/coupling contact
velocity up to 10 feet per second, using the drogue drag at the maximum airspeed within the
aerial refueling envelope for that particular drogue aerial refueling subsystem, and having the
drogue system’s hose/coupling full of fuel. The impact loads from inadvertent drogue/coupling
strikes during disengagements should be based upon a contact velocity of 2 feet per second
greater than the maximum extension rate for the targeted tanker drogue subsystem when a
receiver is connected to the drogue/coupling.
Reference JSSG-2006, 3.4.1.7.2, for other structural load guidance.
800
JSSG-2009A
APPENDIX F

Probe nozzles which comply with MIL-N-25161 are designed to the first set of limit load criteria
provided above for KC-135 BDA system compatibility. The second set of limit load criteria has
been used by the F-35 as a design solution to air vehicle (probe) weight versus probe load
capability. The KC-135 BDA system, historically, has been the “worst case” USAF tanker
drogue system regarding probe loads. There may be allied/foreign/commercial tanker drogue
systems that may require higher load capability to provide adequate compatibility to permit
successful and effective aerial refueling operations.
The above loads are in addition to any aerodynamic/gust loads that may be imparted onto the
structure of the air vehicle, the probe mast, and the probe nozzle while in flight. Also, when the
resultant incremental load is additive, the additional load conditions created by the presence (or
lack of) cabin pressure and the presence (or lack of) fuel pressure in the fuel line within the
probe mast must be considered. All loading conditions must be applied to the support structure
to which the aerial refueling subsystem/interface attaches.
Impact loads onto the probe should be based upon the loads produced by each targeted tanker
drogue subsystem. Historically, impact loads have been defined when the probe nozzle
contacts the drogue/coupling at angular positions up to 15 degrees off-center of the
drogue/coupling centerline and at a probe contact velocity up to 10 feet per second. The impact
loads should be based upon the drogue drag at the maximum airspeed within the aerial
refueling envelope for that particular drogue aerial refueling subsystem.
JSSG-2001 provides additional guidance on loads for aerial refueling probe subsystems.

The ability of the probe mast and the aircraft attachment and support structure to withstand the
required structural loads shall be verified by (TBS 1) . The ability of the defined area
surrounding the probe mast to withstand the specified impact loads shall be verified by
(TBS 2) .
It must be verified that the probe mast, its attachment/support structure, and the area
surrounding the probe mast are structurally compatible with the specified tanker drogue systems
to ensure that the air vehicle can safely and effectively perform aerial refueling operations.

TBS 1: Specify ground test. A ground test should verify that the probe mast and the aircraft
attachment and support structure can withstand the required loads. No malfunction or
deformation to the probe nozzle, probe mast, or attachment/support structure can occur upon
application of each ultimate loading condition.

The attach point to the air vehicle is generally a critical point in relation to probe strength;
therefore, an actual probe attached to a realistic air vehicle structure must be used to verify the
complete probe installation.
801
JSSG-2009A
APPENDIX F
The tensile loads should be applied at the latching shoulder parallel to the axis of the probe
nozzle. The radial loads should be applied to the probe nozzle sleeve 3.5 inches from the gage
point in the toggle-latching groove. The compression load should be applied at the lip of the
probe nozzle sleeve and parallel to the longitudinal axis of the probe nozzle. The most critical
direction for the radial test load application should be selected for the test.
F.3.4.6.2.3.6 Probe maintenance.

Removal, replacement, and checkout of fully retractable and semi-retractable probe masts shall
be accomplished in (TBS 1) . Fixed probes shall be installed or removed in (TBS 2) .
The probe nozzle shall be replaceable in (TBS 3) .
(TBD)
(TBD)
(TBD)
F.4.4.6.2.3.6 Probe maintenance.

Probe maintenance shall be verified by (TBS) .
(TBD)
(TBD)
(TBD)
802
JSSG-2009A
APPENDIX F
F.3.4.6.2.3.6.1 Fixed probe nozzle cover.

For probe installations that have the probe nozzle continuously exposed to the environment
when the air vehicle is on the ground, a probe nozzle cover with an approved streamer flag shall
be capable of being installed over the probe nozzle.
This is an operational and safety requirement. Probe nozzles that will be continuously exposed
to the environment when the air vehicle is on the ground should be protected from exposure to
extend the service life of the probe nozzle and prevent the possible intrusion of contamination
into the aerial refueling subsystem.

If a nozzle cover is not needed, this requirement should be deleted.
This requirement has typically been applied to fixed probe installations and semi-retractable
probe installations that do not retract the probe nozzle into an enclosed compartment on the air
vehicle.
F.4.4.6.2.3.6.1 Fixed probe nozzle cover.

The ability to install a probe nozzle cover with an approved streamer flag onto the probe nozzle
of a probe installation that has the probe nozzle continuously exposed to the environment when
the air vehicle is on the ground shall be verified by (TBS) .
It must be verified that the probe nozzle can be adequately protected from exposure to ensure
that the probe nozzle is not damaged or that contamination is introduced into the aerial refueling
subsystem.

TBS: Specify inspection and ground demonstration.

(TBD)
803
JSSG-2009A
APPENDIX F
F.3.4.6.2.3.6.2 Probe mast protection.

The probe mast, when not installed on the air vehicle, shall be protected from external
contamination and damage by (TBS) .

This is a safety requirement. A probe mast, when it is removed from the air vehicle, is
vulnerable to being exposed to dirt and other foreign objects. A reinstalled probe mast which
has been damaged can result in fuel leaks and can affect the proper operation of the aerial
refueling subsystem. A reinstalled probe mast which has collected foreign debris can introduce
contamination to the aerial refueling, fuel, and propulsions subsystems which can affect the
proper operation of these subsystems.
TBS: Specify how the probe mast should be protected.
This requirement has typically been applied to probe installations that are removed when aerial
refueling is not required for the air vehicle's mission. This application has usually been to fixed
probe installations that are required only for ferry missions. This requirement, however, could
be applicable to any type of probe when it is removed from the air vehicle for any maintenance
action.
Probe masts have been protected by the use of a cap for the open fuel tube and by the use of a
case for storing the entire probe mast.
F.4.4.6.2.3.6.2 Probe mast protection.

The capability to protect a probe mast from external contamination and damage when removed
from the air vehicle shall be verified by (TBS) .
The ability to protect the probe mast, when it is removed from the air vehicle, from damage or
foreign debris must be verified to ensure the proper operation of the aerial refueling subsystem
once the probe mast is reinstalled and to insure the aerial refueling, fuel, and propulsion
subsystem are not contaminated.

TBS: Specify inspection.

(TBD)
804
JSSG-2009A
APPENDIX F
F.3.4.6.2.3.6.3 Air vehicle probe attachment point cover.

When an aerial refueling probe mast is removed from the air vehicle, the air vehicle attachment
point for the probe mast fuel tube opening shall be protected from potential damage and foreign
object contamination by (TBS) .
This is a safety requirement. The probe mast fuel tube opening attachment point on the air
vehicle must be protected from potential damage and foreign object contamination whenever
the probe mast is removed from the air vehicle for maintenance purposes. Damage to the
probe mast attachment point can result in fuel leakage when the probe mast is reinstalled. The
accumulation of contaminates can introduce foreign matter into the aerial refueling subsystem
which can then make its way into the fuel and propulsion subsystems and possibly affect the
proper operation of these subsystems.
TBS: Specify how the attachment point for the probe mast fuel tube opening will be protected.
probe installations that are required only for ferry missions. This requirement, however, could
be applicable to any type of probe when it is removed from the air vehicle for any maintenance
action.
Attachment points have been protected in the past by the use of a cap on the probe mast fuel
tube opening.
F.4.4.6.2.3.6.3 Air vehicle probe attachment point cover.

The ability to protect the air vehicle attachment point for the probe mast fuel tube opening from
potential damage and foreign objects once the probe mast has been removed from the air
vehicle shall be verified by (TBS) .
The ability to protect the air vehicle's probe attachment point from damage or foreign debris,
when the probe mast is removed from the air vehicle, must be verified to ensure the proper
operation of the aerial refueling subsystem once the probe mast is reinstalled and insure the
aerial refueling, fuel, and propulsion subsystems are not contaminated once the probe mast is
reinstalled.
TBS: If the air vehicle is not required to be able to fly with the probe mast removed, specify
inspection and ground demonstration. If the air vehicle is required to be able to fly with the
805
JSSG-2009A
APPENDIX F
probe mast removed, specify inspection, ground demonstration, ground test, and flight
demonstration.

For air vehicles that must be able to fly with the probe mast removed, the ground test must be a
pressure test that verifies that the provision(s) to protect the air vehicle attachment point so that
the probe mast fuel tube can function properly (no fuel leakage) once the probe mast has been
removed from the air vehicle . A flight demonstration is required to verify that the provision(s)
will function properly and not impact the air vehicle or the operation of other subsystems during
flight .
F.3.4.6.2.3.6.4 Fuel spillage.

It shall be possible to remove a probe mast without the occurrence of uncontrolled fuel spillage.
This is a safety requirement. Uncontrolled fuel spillage during the removal of a probe mast can
create hazards to the maintenance personnel and the air vehicle, and can result in
environmental violations.
If the aerial refueling subsystem design prevents the accumulation of residual fuel in the probe,
then this requirement can be deleted.
probe installations that are required only for ferry missions. This requirement, however, should
be applicable to any type of probe as damage to the probe mast can be encountered during
aerial refueling operations and require the removal of the probe mast from the air vehicle for
repair maintenance. A drain plug has proven to be an effective method to remove residual fuel
from the probe so that removal of the probe mast does not result in fuel spillage.
806
JSSG-2009A
APPENDIX F
F.4.4.6.2.3.6.4 Fuel spillage.

The ability to remove the probe mast without the occurrence of uncontrolled fuel spillage shall
The ability to remove the probe mast without the occurrence of uncontrolled fuel spillage must
be verified to ensure that maintenance actions on the probe mast can be performed safely and
not create environmental hazards.

TBS: Specify ground demonstration. As part of the ground demonstration, during the removal
of the probe mast, any fuel spillage should be captured and measured and any fuel remaining in
the probe mast should be collected and measured.

(TBD)
F.3.4.6.2.3.7 Probe noise level.

At no time during flight shall the probe cause an increase in the noise level of the air vehicle's
crew compartment beyond (TBS) .

This is a safety and integration requirement. A probe can cause an objectionable noise level in
the crew compartment when it is installed on the air vehicle (fixed and semi-retractable types) or
when commanded into its extended position (semi-retractable and fully retractable types). As
such, a maximum limit for noise resulting from the probe must be established.
TBS: Specify the maximum noise level in decibels (dB).
Fixed probes and semi-retractable (retracted position) should not increase crew compartment
noise levels beyond the limit specified by the human factor requirements for all airspeeds.
Semi-retractable (actuated and extended positions) and fully retractable probes should not
increase crew compartment noise levels beyond the limit specified by the human factor
requirements during all airspeeds that the probe can be extended and retracted.

On the F-5E air vehicle, the fixed probe design intended for ferry missions was used by one
foreign operator on a day-by-day basis. At higher airspeeds, the probe caused an objectionable
noise and some loss of control authority, due to the increased drag on one side of the air
vehicle.
807
JSSG-2009A
APPENDIX F
F.4.4.6.2.3.7 Probe noise level.

The acceptability of noise generated by the probe installation during flight shall be verified by
(TBS) .

The level of noise generated by the probe during flight must be verified to ensure the crew
compartment noise is maintained at a safe level.

TBS: Specify flight test.
For fixed and semi-retractable probes (retracted position), the flight test should examine noise
generation within the entire airspeed and altitude envelope for the air vehicle. For semi-
retractable (actuated and extended positions) and fully retractable (actuated and extended
positions) probes, the flight test should examine noise generation within the entire probe
actuation airspeed and altitude envelope.
808
JSSG-2009A
APPENDIX F
F.5 PACKAGING
F.5.1 Packaging.
F.6 NOTES
not mandatory.)
F.6.1 Intended use.

The aerial refueling subsystem descriptions in this appendix are intended for use in air vehicle
F.6.2 Acquisition requirements.

F.6.3 Definitions.
Group B Hardware: This is hardware which is regularly removed and replaced from the air
vehicle by maintenance crews. This includes pylons, tip tanks, and external fuel tanks.
809
JSSG-2009A
APPENDIX F
F.6.4 Acronyms.
AFFTC Air Force Flight Test Center

BDA Boom-to-drogue Adapter
FARP Forward Area Refueling Point
FARRP Forward Area Remote Rearming Point
FC/HQ Flight Control / Handling Qualities
GPM Gallons Per Minute
KCAS Knots Calibrated Airspeed
KEAS Knots Equivalent Airspeed
LO Low Observable
M Mach
MSL Mean Sea-level
UARRSI Universal Aerial Refueling Receptacle Slipway Installation
USAF United States Air Force
F.6.5 Subject term (key word) listing.

Boom
Drogue
Fluid
Fuel
Mast
Nozzle
Probe
Receiver
Receptacle
Slipway
Spillage
Tanker
810
JSSG-2009A
APPENDIX F
F.6.6 International standardization agreement implementation.

This specification implements NATO STANAG 3447, Aerial Refueling Equipment Dimensional
and Functional Characteristics; and NATO STANAG 3971, Air-to-Air Refuelling – (ATP-56).
When amendment, revision, or cancellation of this specification is proposed, the preparing
activity must coordinate the action with the U.S. National Point of Contact for the international
standardization agreements, as identified in the ASSIST database at https://assist.dla.mil.
F.6.7 Responsible engineering office.

F.6.8 Changes from previous issue.

811
JSSG-2009A
APPENDIX G
APPENDIX G
AIR VEHICLE FIRE AND

EXPLOSION HAZARD PROTECTION SUBSYSTEM
G.1 SCOPE
G.1.1 Scope.
information for the Fire and Explosion Hazard Protection Subsystem provided for in Part 1 of
this specification. The appendix has been developed and coordinated by technical personnel
from the Air Force, Navy, and Army and has been approved as an official guide for use by
Government personnel for assistance in tailoring the air vehicle subsystems specification for
acquisition and model specifications. This appendix is a mandatory part of the specification. The
information contained herein is intended for compliance.
G.1.2 Structure.
G.1.3 Appendix.
recommended values or text that the Using Service may use to insert in the (TBS) . When
G.1.4 Deviations.
capability, should be brought to the attention of the Using Service.
812
JSSG-2009A
APPENDIX G
G.1.5 Environmental impact.
G.1.6 Responsible engineering office.
G.2 APPLICABLE DOCUMENTS

G.2.1 General.
they are listed.
G.2.2 Government documents
G.2.2.1 Specifications, standards, and handbooks.
813
JSSG-2009A
APPENDIX G
INTERNATIONAL STANDARDIZATION AGREEMENT
Advisory Group for Aerospace Research And Development (AGARD) Conference

Proceeding
AGARD CP-84-71 Ignition of Fuels by a Hot Projectile
(Requests for copies of this document may be directed to the NATO Research & Technology
Organisation, http://nsa.nato.int; and are also available from the NASA Center for AeroSpace
Information (CASI), 7115 Standard Drive, Hanover MD 21076-1320 USA; help@sti.nasa.gov;
and the National Technical Information Service, http://www.ntis.gov.)
FEDERAL SPECIFICATION
BB-E-2879 Extinguisher, Fire, Carbon Dioxide (CO2), Portable, with
Mounting Bracket, for Aviation Use
COMMERICAL ITEM DESCRIPTIONS
A-A-59503 Nitrogen, Technical
A-A-59155 Nitrogen, High Purity, Special Purpose
MIL-PRF-87260 Foam Material, Explosion Suppression, Inherently Electrostatically
Conductive, for Aircraft Fuel Tanks
MIL-STD-411 Aircrew Station Alerting Systems
Systems
19111-5094 USA.)
G.2.2.2 Other Government documents, drawings, and publications.

AIR FORCE SYSTEMS COMMAND DESIGN HANDBOOKS

AFSC DH 1-6 System Safety
AFSC DH 2-2 Crew Station and Passenger Accommodations
AFSC DH 2-3 Propulsion and Power
814
JSSG-2009A
APPENDIX G
(Copies of these legacy documents are available to qualified users. Contact

AFLCMC/ENRS, 2145 MONAHAN WAY, WRIGHT-PATTERSON AFB OH 45433-7017 USA;
DSN 674-5476; COMMERCIAL (937) 904-5476;
AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL.)
U.S. ARMY, U.S. NAVY, AND U.S. AIR FORCE TECHNICAL REPORTS
USAAVLABS-TR-65-18 Rapid Gelling of Aircraft Fuel
Accession Number AD0629765
USAAMRDL-TR-71-22 Crash Survival Design Guide
USARTL-TR-79-22E Aircraft Crash Survival Design Guide, Volume V –
Aircraft Postcrash Survival
AFWAL-TR-80-2031 Flame Tube and Ballistic Evaluation of EXPLOSAFE
Aluminum Foil for Aircraft Fuel Tank Explosion
Protection
AFWAL-TR-80-2043 Evaluation of EXPLOSAFE Explosion Suppression
System for Aircraft Fuel Tank Protection
WL-TR-95-3039 Halon Replacement Program for Aviation,
SURVIAC TR-95-010 Dry Bay Application, Phase I—Operational Parameter
Study
WL-TR-95-3077 Halon Replacement Program for Aviation,
SURVIAC TR-95-011 Aircraft Engine Nacelle Application, Phase I—
Operational Parameters Study
AFRL-VA-WP-TR-1999-3068 Aircraft Engine APU Fire Extinguishing System
WL-TR-97-SURVIAC-97-028 Design Model (HFC-125)
WL-TR-97-3066 Aircraft Engine/APU and Dry Bay Fire Extinguishing
SURVIAC TR-97-029 System Design Model (HFC-125)
FEDERAL AVIATION AGENCY TECHNICAL REPORT

FAA ADS - 24 Crashworthy Design Principles
(Copies of these documents are available at www.dtic.mil and https://www.dtic.mil to qualified

users; Defense Technical Information Center, 8725 John J. Kingman Rd., Suite 0944,
Ft. Belvoir VA 22060-6218 USA.)
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION TECHNICAL REPORTS

NACA TN 2996 Appraisal of Hazards to Human Survival in Airplane
Crash Fires
NACA TN 4024 Appraisal of the Hazards of Friction-Spark Ignition of
Aircraft Crash Fires
815
JSSG-2009A
APPENDIX G
(Contact the NASA STI Information Desk about availability of these documents at
http://www.sti.nasa.gov/find-sti/; NASA STI Information Desk, Mail Stop 148, NASA Langley
Research Center, Hampton VA 23681-2199 USA.)
G.2.3 Non-Government publications.
ASTM INTERNATIONAL
ASTM D5632/D5632M Standard Specification for Halon 1301,
Bromotrifluoromethane (CF3Br)
(Copies of this document are available from www.astm.org; ASTM International, 100 Barr
Harbor Drive, West Conshohocken PA 19428-2959 USA; and from www.ihs.com to qualified
users.)
SAE INTERNATIONAL
SAE AS1055 Fire Testing of Flexible Hose, Tube Assemblies, Coils,
Fittings, and Similar System Components
qualified users.)
G.2.4 Order of precedence.
G.2.5 Streamlining.
816
JSSG-2009A
APPENDIX G
G.3 REQUIREMENTS
G.4 VERIFICATIONS
G.3.1 Definition
G.4.1 Definition
G.3.2 Characteristics
G.4.2 Characteristics
G.3.3 Design and construction
G.4.3 Design and construction
G.3.4 Subsystem characteristics
G.4.4 Subsystem characteristics
G.3.4.1 Landing subsystem
G.4.4.1 Landing subsystem
G.3.4.2 Hydraulic subsystem
G.4.4.2 Hydraulic subsystem
G.3.4.3 Auxiliary power subsystem
G.4.4.3 Auxiliary power subsystem
G.3.4.4 Environmental control subsystem
G.4.4.4 Environmental control subsystem
G.3.4.5 Fuel subsystem
G.4.4.5 Fuel subsystem
817
JSSG-2009A
APPENDIX G
G.3.4.6 Aerial refueling subsystem
G.4.4.6 Aerial refueling subsystem
G.3.4.7 Fire and explosion hazard protection subsystem.

Fire and explosion hazard protection shall be designed into the air vehicle to ensure the safety
of the crew and passengers and to provide for the safe recovery of the air vehicle. This
protection shall be adequate for all combat and non-combat operating conditions. As a first
priority, methods, both inherent and added to the air vehicle design shall be used to prevent the
occurrence of fire and explosion. When prevention cannot be adequately or feasibly achieved,
methods of detecting and controlling the hazardous effects of fire and explosion shall also be
included in the air vehicle design. The methods used and the locations within the air vehicle
shall be as stated herein.
The dangers of fire and explosion on board an air vehicle are among the most serious hazards
that can occur. Huge fuel loads, a multiplicity of ignition sources, compromise placement of
components and lines, exotic fuels for ancillary units, and the nature of the mission can combine
to produce extremely severe hazards to the safety of the crew and the air vehicle resulting in
compromise of mission completion. The most effective method of obtaining maximum
protection for minimum system penalty is to include fire protection in the designing of the air
vehicle. The prevention of fire and explosion is the preferred method of providing protection.
This will not always be feasible, so fire and explosion detection and control subsystems will also
have to be designed into the air vehicle.
The provision of fire and explosion hazard protection may be based on basic fire safety, or
survivability and vulnerability, or both. Therefore, the design, performance, development,
compatibility, and verification requirements for fire and explosion hazard protection should be
consistent to ensure that all provided protection is compatible. The scope of this document
applies the performance requirements herein to all fire and explosion hazard protection provided
on air vehicles. The requirement herein to provide protection is limited to non-combat (natural)
conditions (basic fire safety) since the requirement to provide protection for combat conditions is
additional to basic fire safety, has a different basis, and rightly derives from survivability and
vulnerability criteria.

The requirement to design fire and explosion hazard protection into the air vehicle is a most
important one. It requires that this problem be addressed during all phases of a development
program. This, in turn, requires that consideration be given to the fact that the provision of fire
(and explosion) safety is an interrelated, two-part effort. One part (basic fire safety) is the
provision of protection adequate to eliminate or control all hazards shown by hazard analyses to
be inherent to the air vehicle design or resultant to air vehicle systems operation (functioning)
are adequate for all non-combat conditions. The other part is the additional protection
determined through survivability and vulnerability analyses to be necessary for the elimination or
control of hazards resulting from operation of the air vehicle in man-made hostile (combat)
environments.
818
JSSG-2009A
APPENDIX G
Because of the great difference in the basis to provide protection for non-combat and combat
conditions, the requirements to do so are stated in separate documents. This specification
requires the provision of protection for non-combat conditions, while the requirements to provide
protection for combat conditions are derived from specific weapon system threat requirements.
Designing fire and explosion hazard protection requires that the design, performance,
development, compatibility, and verification requirements for fire and explosion hazard
protection should be consistent to ensure that all provided protection is compatible. The
requirements are to be applied to all fire and explosion hazard protection provided on air
vehicles.
The following potential fire zones should be considered for monitoring:

a. power sections and accessory sections of reciprocating engine compartments
b. compressor, burner, tailpipe (if applicable), and afterburner compartments of the turbine
engine installations
c. accessory sections of turbine engines, if flammable fluid system components and
sources of ignition are both present
d. engine compartments of rocket engine installations
e. auxiliary power plant compartments if not normally occupied
f. compartments containing electrical or electronic equipment in the vicinity of
combustibles where such compartments are not normally occupied
g. bay or pods that contain flares for explosives squibs.
Include fuels, flammable fluids, ignition sources, component failure modes and effects,
operating environment, mission profile (spectrum), air vehicle complexity, electrical systems,
electro-magnetic interference, crew stations, material selection, protective finishes, production
processes, maintenance accessibility, maintenance overhaul skills, non-destructive inspection
methods, and operating life (air vehicle fleet).
Protection design. Basic fire protection safety responsibility for an air vehicle should be inherent
with each system design. Each engineer concerned with the design of a system or component
should realize its potential to all other affiliated and adjacent items and to the air vehicle as a
whole. The work done in the initial stages of design will determine the final degree of fire and
explosion hazard protection inherent in a new air vehicle or air vehicle modification; therefore,
considerable foresight as to the eventual installation details is necessary. A lack of perception
as to the relationship between a source of ignition and combustible materials or flammable fluids
may result in a combination which no amount of subsequent redesigning can ever completely
remedy. The inevitable design conflicts and the resultant trade-offs and compromises which
arise on any new air vehicle should always consider the potential for fire and explosion in order
to obtain a sensible balance. For this reason, emphasis should be kept on the thought of fire
and explosion hazard protection during preliminary design work. Each engineer responsible for
the design of a component of an air vehicle can contribute most satisfactorily to the basic safety
of the air vehicle if he has a thorough knowledge of the air vehicle fire and explosion hazard
819
JSSG-2009A
APPENDIX G
protection problem. The work of the detail designer trying to protect any particular section of the
air vehicle from fire and explosion is greatly simplified by considering fire and explosion hazard
protection in the preliminary design. Each air vehicle is an individual problem and it should be
realized that many factors will affect the decisions in its design.
The basic design concept to be applied consists of, first, minimizing the occurrence of fire and
explosion and, second, minimizing the seriousness of those effects of fire or explosion that do
occur. This means that the achievement of effective fire and explosion hazard protection entails
the critical assessment of the probability of occurrence of events such as a combustible and an
ignition source coming together (that is, potential fire and explosion hazards inherent in the air
vehicle design), the application of preventive techniques (fire and explosion hazard prevention)
in the design of the air vehicle to minimize the occurrence of such events, and the incorporation
into the design of the air vehicle of appropriate surveillance techniques (fire and explosion
hazard detection) and control techniques (fire and explosion hazard control) to counteract those
resultant fire and explosion hazards that do occur.
Knowledge of hazards. Of the three basic elements of fire or explosion (fuel, igniter and
oxidizer), two are in or may be in combination throughout the air vehicle. In the normal (non-
hazard) situation, each element or double element combination is present under controlled
conditions which exclude the remaining element(s) except at the point of use. However, due to
malfunction or accident, a given element, or combination, may escape the control conditions.
Such uncontrolled presence of basic elements is a hazard that has the potential to result in fire
or explosion. Actual fire or explosion can produce any of several resultant hazards, such as
heat, flame, overpressure, smoke and toxic fumes. Added to the problem is the necessity for
weight limitation. Maximum safety for minimum weight penalty is obtained by designing fire and
explosion hazard protection into the air vehicle.
In order to apply fire and explosion hazard protection properly to the air vehicle in the most
practical and meaningful manner, each designer should have or acquire knowledge about the
physical phenomena of air, other oxidizers or reducing agents, fuels, and ignition sources and
their interrelation which lead to ignition. If he does not have the necessary knowledge at his
command, he may end up with an unsafe air vehicle or he may be forced to be overly cautious
at the expense of performance and cost. The many variable parameters involved in the area of
flammability may make it necessary to resort to specially tailored tests for many applications. In
order to make these tests meaningful and to arrive at the desired result with the least expense,
knowledge of the state-of-the-art is a prerequisite.
Approaches. From the standpoint of overall air vehicle fire and explosion hazard protection, the
most important information will be obtained from a fire and explosion hazard analysis (FEHA)
which should be developed by the airframe contractor during the design phase. It is important
that these analyses be initiated early in the design phase and that they be updated as required
during the various other phases of air vehicle development. The contractor in performing a fire
and explosion hazard analysis of the air vehicle should carefully evaluate each compartment
and determine the potential hazards that may occur. Naturally, fuel and other flammable fluid or
vapor leakage should be considered. Oxidizer or reducing agent fluid or vapor leakage may be
a consideration on air vehicle having exotic fueled systems. The oxidizer and reducing agents
have a greater capability of enhancing a combustion process or ignition source than the natural
presence of air. Some oxidizers and reducing agents may combine directly with air vehicle
820
JSSG-2009A
APPENDIX G
materials. Areas where the above noted fluids and vapors may accumulate in hazardous
concentrations should be identified. The presence of ignition sources or the possibility of their
occurrence should be identified.
After all potential hazards and their locations have been identified, the contractor should then
determine the potential for fire or explosion at each location; that is, the conditions necessary to
cause the uncontrolled combined presence of all three basic elements. The air vehicle may
then be compartmentalized into various type hazard zones.
a. Normally, two basic types of hazard zones have been defined. They are commonly
described as follows:
1. Fire zones: Fire zones are zones where a single failure of a component such as a
flammable fluid line break can result in the potential for fire or explosion (if not the
actual event). These zones include compartments wherein separation or elimination
of potential ignition sources and flammable fluid and vapor components is not
practicable and absolute assurance from ignition cannot be achieved due to
proximity with combustion processes, high temperature surfaces, high temperature
gas leakage or other unpreventable ignition sources. Fire zones contain sufficient
hazards to require fire detection systems and fire control methods, such as fire walls
and fire extinguishing systems. Typical fire zones are engine compartments and
auxiliary power unit (APU) compartments.
2. Potential fire zones: Potential fire zones are zones where two failures must occur to
result in the potential for fire or explosion. These zones may be further defined
according to the basic elements that may be present by design (controlled) and that
may be present through malfunction or accident (uncontrolled).
b. Three possible further definitions are as follow:
1. Flammable leakage and combustible zones. These are zones where flammable fluid
or vapor leakage may occur from contained or adjacent lines and equipment or
directly adjacent fuel tanks (including oxidizer and reducing agents) and zones in
which combustible materials are located. Ignition sources are not contained within
these zones. The two failures necessary to cause the potential for fire or explosion
may consist of combinations that result in ignition source introduction to the zone or
flammable fluid or vapor leakage in the zone. Such zones should be provided with
adequate means to minimize the presence of the above noted fluids and vapors, to
prevent the spread of these fluids and vapors to other compartments, to prevent the
introduction of sources of ignition into these zones, and to prevent the spread of any
resultant fire or explosion to other compartments. Examples of these compartments
are wheel wells, weapon bays, actuator compartments, wing leading and trailing
edge compartments, fuel bladder cell bays, dry bays adjacent to integral fuel tanks,
cargo and emergency power unit (EPU) compartments. Where mixtures too rich to
burn can be maintained in these compartments throughout all flight regimes,
prevention of air circulation rather than ventilation may be employed.
2. Flammable zones. These are zones within which a flammable mixture may exist
during normal operation, as within fuel tanks. Ignition sources are not contained
within these zones. The two failures necessary to cause the potential for fire or
explosion are both related to introduction or an ignition source into this zone.
821
JSSG-2009A
APPENDIX G
Explosion prevention systems are the desired means of protection. However, other
fire and explosion hazard protection means should be included in case the explosion
prevention system becomes inoperative. Also, other means may be deemed to be
sufficient protection, dependent on the intended mission of the air vehicle.
3. Ignition zones. These zones are air vehicle compartments which contain equipment,
components, or subsystems which experience has shown should be considered
ignition sources during normal operating conditions or which may become ignition
sources due to malfunction and, also, regions of the air vehicle which, as a result of
normal operation, malfunction, or failure, may be the source of high temperature.
Flammable fluid or vapor carrying lines or equipment are not normally contained
within these zones. Flexible couplings should be shrouded and drained to a safe
location outside of the ignition zone. The two failures necessary to cause the
potential for fire or explosion are related to flammable fluid and vapor leakage into
this zone. Fire and explosion hazard protection that will prevent flammable fluids or
vapors from entering these zones should be used. Another consideration is means
that will reduce the presence of these fluids and vapors in these zones to a minimum
and contain any fire or explosion that may occur. Those zones where high
temperature is the problem should be provided with a means of controlling the high
temperature and, if overheating is the problem, also with means of detecting this
condition. Air cooled electronic bays, electrical bays and potential arcing sources are
examples of normal operating ignition potentials. Crew compartments are ignition
zones due to food preparation equipment, crew smoking, defogging devices, heaters
and high potential electronic equipment. Examples where high temperature can
occur are hot air ducts and engine turbine and afterburner sections.
Note that the common descriptions above do not refer to oxidizer or reducing agent leakage.
The above descriptions should be modified on an individual basis for those air vehicle that
contain oxidizer or reducing agent systems.
To determine the classification of each hazard zone, the contractor should employ an iterative
process, whereby protection measures are added and the hazard classification reevaluated until
the most acceptable balance of hazard level and required protection is achieved. Where
potential fire zones are recognized by a contractor but are not covered in the air vehicle detail
specification, appropriate recommendations should be made to the procuring activity.
G.4.4.7 Fire and explosion hazard protection subsystem.

The adequacy of the basic air vehicle design and the integration and proper location of fire
protection subsystems to prevent, detect and control fire and explosion hazards and their effects
during all non-combat operating conditions shall be determined by a fire hazards analysis. It
shall be verified that all hazards and their locations have been determined. The fire hazards
analysis should include the following: ___(TBS)___.
The acceptability of the basic air vehicle design to prevent and control the effects of fire and
explosion in all areas of the air vehicle should be based on a fire hazards analysis. This
analysis will be used to determine the need for and location of fire protection subsystems such
822
JSSG-2009A
APPENDIX G
as fire detector systems, fire extinguishing systems, and firewalls, and the adequacy of the
overall fire protection scheme for the air vehicle.
TBS: This analysis should be conducted during the design portion of the program so that costly
redesigns and modifications are avoided. The type of analysis, its detail and complexity should
be appropriate to the phase of the program. In the early phase of a program a preliminary
hazard analysis of a general nature would be appropriate. As the program progresses and the
design becomes more defined, subsystem hazard analysis, failure modes and effects analysis
(FMECA) and system hazards analysis would be appropriate to ensure that unforeseen fire
hazards are not overlooked. Review of these analyses should be accomplished during the
appropriate program review.
It should be ensured, early in the program, that the contractor has established a program which
will adequately address the problem of fire and explosion hazards. The program should include
tasks which identify potential hazards and follow-up procedures which ensure that the identified
hazards are eliminated or controlled. Examination, review and analysis of the air vehicle, the air
vehicle mockup (if available), and appropriate contractor performed analyses, inspections, tests
and demonstrations are essential to ensuring that the requirements of this specification have
been met by the contractor. The procuring activity should review the FEHA compartment
classification to ensure that the criteria are properly applied and examine available data,
analyses and mockups to substantiate classification of the compartments. Procuring activity
inspections should be scheduled at least at the mockup inspection and at the completion of the
first complete experimental air vehicle. Depending on the complexity of the required protection,
additional inspections may be appropriate.
The ideal implementation of this specification is that the procuring activity receives full
compliance with no compromises and no deviations. However, in actuality, the procuring
activity is restricted by two fundamental situations:
a. Many of the systems are air vehicles that come from other sources (such as the Army,
Navy, and commercial off-the-shelf (COTS)) where FAA regulations are the controlling
documents. In these cases, the procuring activity is not in control at the critical design
point and as a rule, it is too late to make major design changes because of their
significant effect upon air vehicle schedules and cost. Many times a decision has to be
made to accept the risks involved. Coordination with the System Safety Organization is
important.
b. Where a weapon system is under the control of the procuring activity, the fire prevention
engineers can have a strong voice in the initial design of the air vehicle and verification
can be provided through inspections at various points in the development cycle. Many
times, it is found that tradeoff decisions have to be made where some other parameter
rules against the fulfillment of a specific design requirement because of weight, cost, or
prior design success.
823
JSSG-2009A
APPENDIX G
G.3.4.7.1 Hazard resistance.
The exposure of a fire and explosion hazard protection subsystem to its related hazard and to
any other hazard which may be assumed to occur at its functional location or along its
installation routing shall not disable the subsystem’s capability to perform its intended function.
Fire protection subsystems should be designed so that exposure to the related hazard or other
hazards which could exist at the functional location or along its installation routing will not
disable the subsystem to the extent that it cannot perform its necessary functions. The
subsystem should include the action components (detectors, agent dispensers), interconnecting
wiring, and all necessary components which can be exposed to the hazard(s). Review Navy
comments.
All potential hazards which could occur at the functional location and along the installation
routing should be identified and the capability of a subsystem to operate after exposure to these
hazards should be verified by test. Usually, the hazards involved are fire and overheat
conditions. A 2000°F flame as described in SAE AS1055 has been used successfully in the
past to verify the capability of systems and components to withstand fire hazards. It is not
anticipated that this requirement will be achievable or practical for all systems; however, the
intent can be achieved by the use of redundant components so that, for example, if a portion of
a detection system is disabled by a fire, the remainder of the system can detect the hazard.
Potential fire zones with high airflows which are equipped with fire extinguishing systems should
be devoid of sheltered areas in the lower quarter of the installations. The use of smooth
fireproof inner liners in these areas should be considered. Where a liner is used, the edges
should be sealed so that burning fluid cannot penetrate under the liner.
Include flame temperature, time, and air temperature.
The wiring for the F-111 engine bay fire detection systems is not fireproof in the wheel well area.
Fires in the wheel well area have caused false alarms with the engine bay system and have
disabled the engine bay systems so that if an engine bay fire did occur, it could not have been
detected. Related reports also indicate that fuel shutoff valve wiring external to the F-111
engine bay firewall has been damaged by engine bay fires causing loss of fuel shutoff
capability.
Stainless steel or other materials with equivalent fire barrier characteristics have proven to be
useful for all portions of fire extinguishing systems within and close to potential fire zones, with
the exception of discharge tubing in cargo and baggage compartments, which may be made of
aluminum alloy, and valve seals, which may be made of elastomeric materials
824
JSSG-2009A
APPENDIX G
The following measures are recommended to prevent the fire extinguishing system from being
disabled due to an electrical failure:
a. Complete electrical circuits should be insured by providing direct ground contact for all
electrical components such as agent containers, solenoids, and directional valves.
b. Relays should be avoided, if possible, but if relays must be used, two independent relays
should be used in such a way that failure of one relay does not cause malfunction of the
system.
c. Where practicable, when the discharge triggering device is electrically operated (squib or
solenoid), two such devices with two separate and independent electrical circuits from
the circuit breaker outward should be provided.
d. A single circuit with single relay is acceptable for protection of equipment which is used
on the ground only.
e. Electrical control systems should be designed so that accidental grounding of the circuit
through a discharged squib does not cause malfunction of other circuits of the system.
f. Care should be taken to make certain the power supply is not affected by these
firefighting control procedures.
The reliability of grounding through tubing or support structure is poor, because the anodized
fittings offer considerable electrical resistance
A pressurized fire extinguisher container should be furnished with a safety outlet incorporating a
frangible-disc-type diaphragm in order to relieve excessive pressure that may occur in the
container. The blowout pressure of the disc should be equal to the container pressure at the
maximum ambient temperature plus 50°F, but not less than 210°F. The fusible plug relief
setting should be 50°F in excess of the maximum ambient temperature, but not less than 210°F.
G.4.4.7.1 Hazard resistance.
It should be verified by ___(TBS)___ that the fire and explosion hazard protection subsystem
shall not be rendered incapable of performing its intended function after exposure to the
hazards which could exist at the functional location and along its installation routing. The
hazards that could be present should be determined by a fire hazard analysis.
To ensure a fire protection system can perform its required function (detection, extinguishing), it
should be verified that the related or other assumed hazards will not disable the system.
TBS: Any required analysis and inspection should be done as part of the fire and explosion
hazard analysis to determine the protection required for the total air vehicle. The most practical
means of verifying a fire protection system's hazard resistance is by laboratory test. Fire
protection subsystems and components should be designed to withstand a 2000 F flame per
SAE AS1055 for 5 to 15 minutes depending on the subsystem or component location and
825
JSSG-2009A
APPENDIX G
particulars of the subsystem design (redundant components, for example). Other suitable
verification tests should be used for lesser hazards.
A single failure in circuit board for an engine fire control panel resulted in loss of all engines on
an operational aircraft.
G.3.4.7.2 Fire and explosion hazard prevention.
Prevention designs intended to preclude or reduce the occurrence of fire and explosion shall be
provided in all locations (areas) where potential hazards can exist or result, either directly or
indirectly, due to a single failure.
As noted previously, fire and explosion hazard prevention is the preferred method of providing
fire and explosion safety. The intent of this requirement is to ensure that prevention designs are
applied to all locations within the air vehicle where potential hazards can result, either directly or
indirectly, due to a single failure. The need for fire and explosion hazard detection and control
will be minimized, reducing the complexity of the total fire and explosion hazard protection
required.
Fire and explosion hazard prevention should not allow the simultaneous uncontrolled presence
of the three basic elements of fire and explosion at any given location. Prevention designs are
most easily applied to the elements of fuel and ignition. The recommended prevention designs
may be generically described as combustible materials hazards reduction, installation hazards
reduction, isolation, separation, ventilation, cooling, drainage, electrical bonding, and lightning
protection. These are described in the following sections.
Explosions in potential fire zones due to the presence of flammable vapors should be prevented
by either adequate drainage or and ventilation. However, explosions in potential fire zones
happen occasionally, and precaution should be taken to restrain the consequences of this
hazard to the greatest practical extent. For this reason, the compartment walls should be strong
enough to withstand a pressure differential of 5 psi. Quick-opening relief holes in the outside
wall should be considered to prevent a pressure rise of over 5 psi, if natural relief is not
provided. Ducts inside the potential fire zones should be designed to prevent a failure caused
by an explosion, such as collapse of an intake duct or an exhaust pipe, to the extent that a
safety-of-flight hazard is prevented.
Provisions should be made to the fullest extent practicable, such that carry-on combustibles
necessary for the mission of the air vehicle and the comfort of the crew should not present a fire
hazard. A thorough application of fire protection to an air vehicle should consider the
combustibles that may be carried on by the crew. Provide storage areas in habitable
compartments as necessary for stowage of items such as blankets, pillows, maps, manuals,
magazines, newspapers, and other similar combustibles. Provide suitable storage areas in
826
JSSG-2009A
APPENDIX G
galleys for food packages. Design these areas so that ignition of the contents cannot occur
from light bulbs, matches, smoking materials, or other heat sources. Provide closed, fire
resistant containers for waste materials. Provide smoking facilities in the form of an adequate
number of fire-proof, self-contained, removable ash receptacles with covers. If compartments
without smoking facilities are desired, these compartments should be placarded against
smoking.
Low observable (LO) design criteria which minimize outer mold line penetrations have
negatively impacted capability to provide ventilation and drainage.
G.4.4.7.2 Fire and explosion hazard prevention.
Fire and explosion hazard prevention shall be verified by ___(TBS)___.
The provision of prevention designs in all required locations is of greatest importance to the
provision of adequate fire and explosion hazard protection on the air vehicle. The need for a
prevention design in a given location is dependent on the probability of occurrence of the
uncontrolled presence of two of the three basic elements of fire and explosion in that location.
TBS should be filled in with analysis and inspection.
During the appropriate system design review, it should be determined by analysis and
inspection that all necessary locations are provided with prevention designs. This analysis and
inspection should be part of a fire and explosion hazard analysis done to determine the
protection required for the total air vehicle.
Verification of fire and explosion hazard prevention should be considered safety critical.
G.3.4.7.3 Isolation and separation of combustibles and ignition sources.
Separation designs shall be used to the fullest practical extent to prevent occurrences of fire
and explosion due to the uncontrolled presence of combustibles and ignition sources.
Separation is an effective method of preventing the occurrence of fire and explosion.
827
JSSG-2009A
APPENDIX G
The general concept of isolation and separation is to require two independent failures to occur
before a fire or explosion takes place. Separation is normally used together with one or more of
the other designs listed in this paragraph. Separation designs have been applied to
combustible materials, flammable fluids and vapors, ignition sources, and oxidizer and reducing
agents. It is therefore mandatory that the greatest possible separation between flammable fluid
components and ignition sources be accomplished when components are involved which are
safety-of-flight items.
a. One separation design is locating lines and equipment to minimize the possibility of
leaking fluid coming into contact with ignition sources through either the effect of gravity,
airflow, or internal line pressure. All flammable fluid lines are best routed below
electrical equipment and lines. Do not route flammable fluid lines through air inlet ducts
or plenums and do not route electrical wiring through drain lines. Fuel lines should not
be routed through personnel, baggage, or cargo compartments; however, in some
instances, an occupied portion of the air vehicle is the only space available for routing of
an aerial refueling line or a ferry tank fuel line. In this situation, fuel lines should be
double walled and couplings should be shrouded and drained to a safe location. Means
to inspect these lines and couplings should be provided so the primary failure mode can
be inspected and repaired.
1. Avoid routing flammable fluid equipment, lines, and joints through inhabited areas,
unless: they are enclosed in a fluid- and vapor-tight shroud which is drained and
ventilated overboard, or they do not incorporate fittings and are sufficiently well-
protected against damage, or the joints in the lines are held to a minimum, and the
joints are shrouded and drained. Avoid routing wiring and flammable fluid lines in
baggage and cargo compartments, unless such wiring and lines are installed as to
be protected from damage by cargo being loaded, carried or shifted. The conduits or
covers for lines which have connectors within the cargo area should be drained
overboard.
2. Do not locate sources of fuel leakage, such as joint couplings, in the vicinity of
materials or conditions that will permit ignition of fuel. This separation design may
also apply to fuel tanks by not locating fuel tanks over personnel compartments.
Fuel tanks should not be located in personnel or cargo compartments on a
permanent basis. Fuel tanks used on a temporary basis (e.g., cargo tanks or
weapons bay fuel tanks) should employ the same design criteria as permanent
tanks. Double walls with ventilated and drained spaces between the tanks are
applicable.
3. Design the fuel vent system to prevent spillage of fuel. During the fuel system
venting operation, the fuel and fuel vapor should clear all parts of the air vehicle so
that no fire or explosion hazard results. Ensure that fuel or fuel vapor does not
impinge upon or reenter any part of the air vehicle. The inclusion of hot refueling in
the air vehicle mission is an important consideration in locating fuel vent and dump
provisions.
b. Another separation design is to prohibit equipment, components, or lines in a fire zone
unless they are required for the operation or functioning of equipment contained in this
828
JSSG-2009A
APPENDIX G
zone. Specifically, do not allow flammable fluid lines, including vent lines, to penetrate
any engine compartments except the ones they feed. Apply the separation design noted
in paragraph a., above, and position flammable fluid lines relative to engine components
and engine bleed air ducts in a manner that will minimize the fire hazards associated
with fluid leakage through normal and accidental means. Route plumbing and wiring
such that no lines pass unnecessarily close to high temperature components. Also in
this separation design is the use of an engine-driven accessory gearbox which is
separated from the engine by a liquid- and vapor-tight fire barrier (see G.3.4.7.20).
Special consideration of power transmission shaft penetration through the fire barrier
shall be considered to ensure a safe design.
This use of separation will reduce the potential for fire or explosions and improve the
effectiveness of extinguishing agents. This design uses engine mounted accessories
only where these accessories are directly necessary to the operation of the engine; that
is, the fuel pump, oil pump, and ignition equipment. All other accessories, such as the
hydraulic pump and generator, are mounted on a gearbox and damage to any of these
accessories or the gearbox does not affect the operation of the engine. With proper
installation design, this system is well adapted to power plant quick change and fire
extinguishing in the necessary section.
These separation designs may be applied to oxidizer and reducing agent lines and systems to
reduce the possibility of severe or difficult fires or explosions. This is done by separating
oxygen lines from fuel, vapor (vent) and electrical lines, and hot surfaces and by separation of
exotic fueled ancillary units (EPU, APU), which is best effected by compartmentation. These
types of units have been placed in compartments that completely separate the unit from the rest
of the air vehicle.
Separation design consideration should be given to the location of flammable fluid carrying lines
and accessories to minimize the likelihood of perforation by high energy fragments from an
uncontained rotor failure. Potential sources of such fragments include the secondary effect of
compressor failures, starter rotors, and other high speed rotating parts. In particular, separation
designs are appropriate to: avoid circumferential routing of flammable fluid carrying lines in the
plane of a high speed rotor; minimize or group flammable fluid carrying lines that cross planes of
a high speed rotor; and, whenever possible, locate such lines and accessories remote to the
starter or other components with high speed rotating parts.
A fire and explosion hazard will exist if pathways exist for flammable fluids or vapors to reach
ignition sources or for burning fluids or vapors to travel to other parts of the air vehicle. Liquid
proof and vapor proof barriers are the best means of providing this isolation. This design is
applicable to the flammable fluid tanks, engine compartments and the air vehicle proper. The
intent is to restrict the spread of flammable fluids and vapors from controlled to uncontrolled
places within the air vehicle. Flammable fluid tanks located adjacent to personnel, cargo,
engine, electrical equipment, ammunition and ordnance compartments should be separated
from such compartments by a second liquid proof and vapor proof barrier, in addition to the
barrier provided by the fluid and vapor storage compartment. This will reduce the fire hazard
from flammable fluid leaks caused by normal means or accidents. This precaution may be
applied to bomb bays which contain flammable fluid tanks that can be jettisoned.
829
JSSG-2009A
APPENDIX G
The engine installations of all air vehicles, regardless of the number or relative position of the
engines, should incorporate a liquid and vapor barrier which separates the accessory and
compressor areas or that section of the compartment which contains the greater part of the
flammable fluid lines and accessories from any engine surface which exceeds a temperature of
700 F. The intent of this barrier is to prevent flammable fluid and vapor contact with the hot
sections of the engine. If it is not practical to isolate engine surfaces which exceed
temperatures of 700 F, the accessories and drives should be remotely located and isolated from
the engine compartment. Isolate flammable fluid system components from electrical equipment
that may produce arcing either normally or accidentally in order to minimize the possibility of
flammable fluid ignition.
Separation design has been extended to baggage and storage compartment lighting. Locate
these lights or protect them so that they will not be an ignition hazard to material placed in these
compartments. Apply separation to plumbing, wiring and component supports. Never use
flammable fluid, flammable vapor, or oxidizer or reducing agent lines to support these or any
other item. Another design is to separate items which have high surface temperatures from
combustible materials through the use of insulation. This design may be extended to cover
conditions that may result from accident or damage. These designs can consist of fire shields
and insulation wraps or blankets and have been applied to items such as bleed air lines and
monopropellant emergency power units (MEPU). The material used should be suitable for
extended use at the expected maximum temperatures. Another isolation design is the use of
explosion proof electrical equipment. This design should be applied to electrical equipment
located in potential flammable fluid leakage areas except for flammable zones (i.e., fuel tanks)
where containment methods should be used for components located within the fuel tank.
Explosionproof aeronautical equipment is designed to prevent ignition of a flammable mixture
within the equipment when operated or to prevent an internal explosion from propagating to the
exterior atmosphere under operational environmental conditions as defined in the air vehicle
model specification.
The requirements for fuel tank isolation, drainage, and ventilation should be applied to fuel tanks
in weapons bays, cargo bays, or other locations where temporary fuel tanks are located.
Burning fluids will occasionally run out the end of exhaust pipes. Positive provisions should be
made either to let this fluid run free and clear of the air vehicle to the ground, or to trap and drain
it within the adjacent structure.
Aluminum oil coolers and other heat exchangers for flammable fluids, and their air intakes,
should be separated from the engine compartment by stainless steel, titanium sheet metal not
less than 0.015 inch thick, or other vapor- and liquid-proof materials. Oil coolers and other heat
exchangers for flammable fluids should be located as low as practical in a power plant
installation so that fluid cannot enter the air intake system in case of a failure. Oil coolers
should not be located in the hot engine section.
Engines arranged in close proximity to each other should be separated by a firewall.
830
JSSG-2009A
APPENDIX G
Drain openings should be provided and arranged to prevent any potential leakage of flammable
fluid from passing through the shaft seal and entering an electrical actuator in the position of
installation. Such leakage should not impinge on or otherwise contact an ignition source.
Electrical actuators should be explosion-proof.
No lines and equipment carrying flammable fluid should be located in the plane of the turbine
wheels, or aft and close to the fuel injection nozzles, except that lines may cross these areas in
a longitudinal direction when necessary.
Hot bleed air ducts and other hot gas ducts and components which can be an ignition source,
due to high surface temperatures or to leaking hot air or gas, should not be located in
compartments containing flammable fluid components with potential leakage, in compartments
adjacent to fuel tanks, or in compartments into which leakage of flammable vapor from other
compartments is likely.
Portions of heating air ducts passing through regions in the air vehicle where flammable fluid
systems are located should be so constructed or isolated from such systems that failure or
malfunction of the flammable fluid system components cannot introduce flammable fluids or
vapors into the heating airstream.
Locate exhaust systems as high in a compartment and in the air vehicle as practical.
Flammable fluid equipment, tanks, and lines should be kept remote from exhaust systems.
Where shrouds cannot be used for the separation of exhaust systems from flammable fluid
components, sandwich-type or other suitable insulation blankets may be used for covering the
hot exhaust surfaces. They should be designed and installed so that all surfaces, edges,
cutouts, and seams are effectively sealed to prevent the entrance of flammable fluids and
should be vented and drained at their lowest point. The vent and drain holes should be
shielded, if required, to prevent entrance of liquids. The insulation material should be "non-
packing" under service conditions. Insulation should be attached to the exhaust system so that
a "single failure" of an attachment will not cause an ignition hazard.
As flight altitude increases, turbine engine exhaust wake fans out to a wider effective area, so
caution should be taken that exhaust does not impinge on unprotected surfaces or create a
hazard by coming close to flammable fluid and vapor drain, vent, and dump outlets.
Discharge of exhaust should not impinge on unprotected surfaces, on the skin of integral tanks,
or other places where a hazard may result during normal operation, or when a failure occurs.
Exhaust should not pass over access doors and filler wells, and it should be remote enough
from flammable fluid and vapor vents and ventilation and fuel jettison outlets to avoid a hazard.
Drain discharge should not create a hazardous condition when in contact with exhaust gases
under any condition of air vehicle maneuvering.
831
JSSG-2009A
APPENDIX G
G.4.4.7.3 Isolation and separation of combustibles and ignition sources.
Isolation and separation of combustibles and ignition sources shall be verified by ___(TBS)___.
The use of this prevention design to the fullest extent practicable is necessary in reducing the
need for detection and control provisions. The adequacy of the provided designs should be
TBS should be filled in with analysis, inspection, component tests, on-aircraft tests, or
demonstrations.
The required analysis and inspection should be part of a fire and explosion hazard analysis
done to determine the protection required for the total air vehicle. Laboratory, component,
ground and flight tests, and demonstrations may be used to verify the provided separation
designs.
Aerial refueling receptacle bays may contain fuel from receptacle leakage. Wiring and electrical
components need to consider isolation methods.
G.3.4.7.4 Cooling and ventilation.
Ventilation designs shall be used to the fullest extent practicable to prevent the occurrence of
fire and explosion due to the uncontrolled presence of combustibles and ignition sources.
Ventilation is an effective method of preventing the occurrence of fire and explosion.
Ventilation is commonly used in combination with cooling and drainage and is normally used
together with one or more of the other designs listed herein. Ventilation designs have been
applied to flammable fluids and vapors, and oxidizer and reducing agents. Ventilation uses
airflow to prevent the accumulation of flammable, reactive, or corrosive vapors and explosive
vapor-air mixtures within air vehicle compartments. This design is applicable to all
compartments in the air vehicle where hazardous fluid or vapor leakage can occur.
a. Incorporate ventilation provisions adequate to remove all hazardous vapors to a safe
location outside of the air vehicle during all expected flight and ground conditions. The
ventilation should be designed to lean out flammable mixtures below the lower limits of
flammability, minimize dwell time of flammable fluid and vapor on hot surfaces and
reduce environmental temperatures. One to three air changes per minute have proven
832
JSSG-2009A
APPENDIX G
to be adequate, whereby the lower value applies to compartments with only low leakage
rates are expected and the higher values apply to compartments with potential high
leakage rates, which can be the case in power plant accessory sections.
b. Consider leakage from normal means as well as accidental damage when sizing and
locating ventilating provisions. Locate ventilating air intakes so that flammable, reactive
or corrosive liquids and vapors and engine exhaust gases cannot enter the system.
c. Do not permit system flow reversals or no flow conditions during any ground or flight
condition; provide unidirectional airflow under all conditions.
d. Ensure that vapors that are removed from the air vehicle do not come in contact with the
engine exhaust gas wake or wheel brakes or impinge on or reenter the air vehicle under
any operating condition and cause an unsafe condition. The one exception to this is that
engine compartment ventilation, may, of necessity, have to contact the exhaust gas
wake.
e. The air intake(s) location should not be susceptible to ice accretion. If ice formation is
critical to an extent that airflow is adversely affected, ensure that the intake has suitable
ice protection.
f. In compartments divided by liquid and vapor barriers, provide separate air intakes for
each compartment and ensure that there is no air exchange between these
compartments.
g. Air from other ventilation systems may discharge into fire zone compartment(s) provided
the air temperature is 200°F or less and cannot be contaminated with flammable,
reactive, or corrosion vapors which may result from any form of leakage throughout any
flight attitude or engine operating mode. Ensure that airflow used to ventilate any fire
zone compartment or exotic fueled ancillary power unit (APU, EPU, or SPU)
compartment is discharged overboard and is not discharged into any other ventilation
system.
h. The ventilation provided for dry bay spaces around the fuel tanks and enclosing
flammable fluid lines and equipment is a useful means, along with drainage, for checking
the integrity of the primary flammable fluid and vapor barrier. Normally, these dry bays
are closed compartments and the primary barrier cannot be viewed. The presence of
vapors at the ventilation exit is an indicator that the primary barrier has failed. This use
of ventilation is especially important in the case of fuel tanks located over engine
compartments or other fire zones.
i. Ventilation of auxiliary power plant compartments should be provided in flight, regardless
of the power plant being used or not in flight. If an exhaust ejector is used to provide
ventilation for an auxiliary power plant compartment, protection should be provided
against ignition of flammable fluids and vapors by the exhaust or exhaust pipes, or by
the hot turbine after shutdown.
j. Cooling is commonly used in combination with ventilation and is normally used together
with one or more other designs. This design is applicable to all compartments and other
areas of the air vehicle where hot surfaces can exist and present ignition hazards. The
cooling provided should be of sufficient capacity to ensure that all established
temperature limits within the air vehicle are not exceeded under any operating condition.
This includes the temperature of the installed item, any accessory equipment, the
833
JSSG-2009A
APPENDIX G
supporting structure and the compartment itself. Engine and power unit compartments
and nacelles are a main area of application of cooling designs. Compartments with
electronic, electrical installations and equipment, and those with armament installations
are areas of concern. Consider hot surfaces caused by normal means as well as
accidental damage when sizing and locating cooling provisions. Locate the cooling air
intakes so that flammable, reactive or corrosive liquids and vapors and engine exhaust
gases cannot enter the system. Do not take cooling air from the engine air inlet duct or
plenum except engine fan ducts. Air from fan ducts has been used to cool engine
components. Provide for unidirectional airflow under all ground and flight conditions. Do
not permit system flow reversals or no flow conditions during any ground or flight
condition. Ensure that flammable, reactive or corrosive vapors removed from the air
vehicle with the cooling air do not come in contact with the engine exhaust gas wake or
wheel brakes or impinge on or reenter the air vehicle under any operating condition and
cause an unsafe condition. The one exception to this is that engine compartment
cooling air, may, of necessity, have to contact the exhaust gas wake.
k. Ensure airflow used to cool any fire zone compartment, or compartments housing
equipment such as oil coolers, generators, inverters, electric motors or exotic fueled
power units is discharged overboard and is not discharged into any other cooling
system.
All compartments containing flammable fluid components with potential leakage, compartments
adjacent to fuel tanks, and compartments into which flammable vapor can enter from other
compartments should be ventilated if these compartments also contain potential ignition sources
such as electrical equipment.
Exhaust ejectors have been used successfully for the cooling of exhaust pipes and the
ventilation of compartments. This method is particularly suitable for helicopters and auxiliary
power plants where ram air is not available in all flight and ground phases. When exhaust
ejectors are used which draw the cooling air from compartments containing flammable fluid
components with potential leakage, protection should be provided against ignition of flammable
fluids and vapors by the exhaust or exhaust pipes, or by the hot turbine wheel after shutdown.
Ventilation inlets should be so located that flames cannot enter from other zones. Ventilation
inlets to potential fire zones and to other compartments containing potential ignition sources
should be located so that flammable fluids and vapors cannot enter. The inlet air to these
compartments should not pass over or through any device containing flammable fluid, such as
heat exchangers. The inlet air, under condition of failure, should not contain flammable fluid or
vapor. Ventilation air inlets to a potential fire zone should have fire shutoff valves, if the airflow
from a single inlet is higher than 5 cu.ft./min, and if fire extinguishing is provided for the zone.
Ventilation discharge from potential fire zones should not impinge on surfaces of integral tanks,
on critical structure, or on equipment, if such impingement can cause an additional hazard in
case of fire. Ventilation discharge from potential fire zones should not enter any other
compartment or re-enter the air vehicle through openings downstream of the discharge.
Ventilation discharge from compartments containing flammable fluid components and from
compartments adjacent to fuel tanks should not discharge or re-enter into compartments with
834
JSSG-2009A
APPENDIX G
potential ignition sources.
The ventilating airflow should be distributed as evenly as practicable throughout the

compartment with emphasis on high airflows at areas of potential flammable fluid leakage.
Openings should be provided in engine compartments which provide natural convection

ventilation during ground operation. Ground support equipment or fans may be required to
ensure safe ventilation during maintenance in rotary wing air vehicles. Ventilation by ram air
cannot be accomplished for all flight conditions. Ventilation by artificial means such as exhaust
or bleed air ejectors, or engine or electric motor driven fans should be applied. Ventilation
airflow through two or more compartments, which can carry a hazard from one compartment to
another, should be avoided. Such interconnection is prohibited from passing through fire
barriers which isolate potential fire zones from the rest of the airplane.
G.4.4.7.4 Cooling and ventilation.
Cooling and ventilation shall be verified by ___(TBS)___.
The use of this prevention design to the fullest extent practicable is necessary to reduce the
TBS should be filled in with analysis, inspection, and ground and flight tests.
ground and flight tests, and demonstrations may be used to verify the adequacy of the provided
ventilation designs.
Demonstration is the best means of verifying that none of the exhausted vapors reenter any
portion of the air vehicle or cause any other unsafe condition.
It is important that the maximum ambient temperature environment to which each item (engine,
equipment, structure) in a hot surface location may be exposed be determined for all periods of
air vehicle flight operation, ground operation and after engine shut down. The manufacturer's
temperature limitations for the engine, and equipment should be complied with. In establishing
post-shutdown temperature limitations, consider that a gas turbine engine together with its usual
installation orientation does not lend itself to pronounced convective circulation of cooling air.
Post-shutdown cooling may be further restricted due to adverse operating conditions such as
blowing dust or salt spray which will require that all openings in the air vehicle be covered as
soon as possible after engine shutdown. Post-shutdown temperature limits should be satisfied
without the use of auxiliary ground cooling equipment since such may not always be available or
835
JSSG-2009A
APPENDIX G
its use may not be practicable.
Ventilation and cooling tests have been conducted in the past in accordance with legacy Military
Specification MIL-T-25920 procedures.
G.3.4.7.5 Drainage.
Drainage designs shall be used to the fullest extent practicable to prevent the occurrence of fire
and explosion due to the uncontrolled presence of combustibles and ignition sources.
Drainage is an effective method of preventing the occurrence of fire and explosion.
Drainage is useful for eliminating combustible, conductive, reactive or corrosive fluid leakage
build-up and will assist in preventing the accumulation of flammable, reactive or corrosive
vapors within the air vehicle compartments. It is often used in conjunction with a companion
design, ventilation, and is normally used together with one or more of the other designs. This
design is applicable to all compartments in the air vehicle where hazardous fluid leakage can
occur. Incorporate drainage provisions adequate to remove all hazardous fluid leakage to a
safe location outside of the air vehicle during all expected flight and ground conditions. Places
that have historically required drainage are engine compartments, particularly the accessory
section and the afterburner ducts during non-operation of the engine; ancillary power units;
bladder tank cavities; dry bay spaces around fuel tanks and enclosing fuel, oil, and hydraulic
lines and equipment; sheet metal pockets and traps; and other similar places. Drainage is an
inherent part of rapid shutoff and purge systems such as those used for fuel at engine
manifolds. Drainage is a positive solution to quick engine shutoff, if the risk of self-ignition is not
serious.
Consider leakage from normal means as well as accidental damage when sizing and locating
drainage provisions. Provide a sufficient number of drain holes in pylons, bulkheads, stiffeners
and skin that should permit the normal flow of leakage to collect at low points and exit from the
bottom of the fuselage, nacelle, wing or pylon. Locate the drain openings in areas where the
local air streams are such that drained fluids should exit freely and should not be driven back
into the drained compartment or any other compartment during any ground or flight condition. A
rear scoop may be necessary on drains to ensure that back flow of air should not occur and
carry the drained liquids or their vapors back into the compartment. All drains should be located
so that scavenging suction is produced in flight. Insure that drains are installed so that no
drainage should come into contact with a potential ignition source (such as APU or EPU
exhaust, the engine exhaust gas wake or wheel brakes) or impinge on or reenter the air vehicle
under any operating condition and cause an unsafe condition. The minimum ventilating air flow
in fuel tank compartments with potential ignition sources should be one air change per minute.
The minimum recommended internal diameter for drain holes and lines is 9.5 millimeter (mm)
(3/8 inch). Smaller sizes have a tendency to clog. When single drain holes are used for an
836
JSSG-2009A
APPENDIX G
entire compartment, the size should be increased accordingly. For example, when a single
drain opening is used for the entire engine accessory section drain system, it should be sized to
accommodate all leakage including that resulting from equipment failure. The minimum
recommended size in this case is 13 square centimeters (cm2) (2 square inch (in2)) free area.
Drain size openings may need to include LO design requirements.
Do not permit drain lines to be interconnected where return of any fluid or vapor may create a
fire hazard or damage any interconnected components. Specifically, engine combustor drains,
pressurizing and dump valve drains, and afterburner or tailpipe drains should not be connected
with each other or any other drain.
Do not interconnect fuel drains with component seal drains or with drain lines for electrical
accessories which drain oil, hydraulic fluid, or water-alcohol. However, drain lines for each
particular type of fluid may be joined at the overboard point provided it can be shown that there
is no feedback from one to another. These drains may be interconnected if line sizes are made
adequate to ensure proper drainage. Therefore, it is permissible to run all normal drains from
2 2
fuel pumps through one drain, enlarging it to maintain the minimum 13 cm (2 in ) free area.
The drainage provided for dry bay spaces around fuel tanks and enclosing combustible fluid
lines and equipment is a useful means, along with ventilation, of checking the integrity of the
primary flammable fluid and vapor barrier. Normally, these dry bays are closed compartments
and the primary barrier cannot be viewed. Leakage of the contained fluid appearing at the drain
is an indicator that the primary barrier has failed. This use of drainage is especially important in
the case of fuel tanks located over engine compartments or other fire zones.
The function of drains should be assessed for all operating conditions including static ground,
taxi, and all inflight conditions. Ensure delta pressure from inside the aircraft to the outside
ambient conditions is in the right direction to ensure efficacy of drains.
Minimum drain angles should be greater than 5° throughout the normal range of flight and
ground attitudes. All drain lines should be free of traps. Drainage provisions should be
designed so that pressure differentials and correlative airflows across the drainage paths do not
alter the gravity flow and prevent proper function of the drainage provisions. No drain lines
should be manifolded together except at the point of overboard discharge. In cases where
manifolding is necessary, pressure differentials in drained compartments or equipment cavities
and their possible cause of a fire or explosion, and the ability to identify drained fluids should be
carefully considered. Drained fluids which are manifolded should be compatible. Minimum
diameter of drain lines and drain holes should be 3/8 inch inner diameter for gravity flow.
For fixed wing Navy air vehicles, a container should be provided for collecting fuel drainage.
The container should be designed and located so that flammable vapors from the container
cannot enter an engine compartment or any other compartment which contains potential ignition
sources, and that the fluid in the container cannot be ignited. If the possibility of ignition in the
container cannot be eliminated, the drainage system should be designed to contain a fire
without causing a hazard to drained components.
837
JSSG-2009A
APPENDIX G
All compartments containing flammable fluid components should be drained, unless leakage
from these components is extremely unlikely. All areas surrounding fuel tanks should be
drained. All drains should be so arranged so that no trapped fluid can accumulate at any place
in the compartment. Cavities in flammable fluid components should be drained if leakage into
these cavities is possible and this leakage can cause an ignition hazard, as in components in
which separation of flammable fluids from electric equipment is accomplished by seals or
bellows. All filler unit scuppers which can collect spilled fuel should be provided with drains.
G.4.4.7.5 Drainage.
Drainage shall be verified by ___(TBS)___.

The use of this prevention is necessary to reduce the need for detection and control provisions.
The adequacy of the prevention designs should be verified to eliminate poor designs and avoid
costly retrofits.
TBS should be filled in with analysis, inspection, and component and flight testing.
ground and flight tests and demonstrations may be used to verify the adequacy of the provided
drainage designs.
Drains which appear questionable where adequate drainage is concerned, should be subjected
to drainage tests. Consider the drain's configuration, location, type, and quantity of fluid
drained. Drainage tests conducted with dyed fluids should be used to verify that the
performance of all questionable and potentially hazardous drains is acceptable at all applicable
air vehicle ground and inflight operating attitudes and conditions. The drains which will require
testing and the associated test procedures can be identified from the system analysis.
Demonstrate that no fuel or fumes impinge on or enter any portion of the air vehicle or cause
any other unsafe conditions under all possible conditions which may be encountered in service.
Inspect the air vehicle for the presence of the dyed fluid to insure that there was no
impingement. Record data, including movies, during selected operating conditions.
Low observable requirements have influenced the design of drain restricting the type of design
that can be used. These conflicting requirements have resulted in poor performance of LO type
drains. Ensure LO requirements are considered early in the design phase, and drain types are
tested for drain performance and LO requirements.
838
JSSG-2009A
APPENDIX G
G.3.4.7.6 Electrical bonding and lightning protection.
Electrical bonding and lightning protection designs shall be used to the fullest extent practicable
to prevent the occurrence of fire and explosion due to the uncontrolled presence of
combustibles and sources of ignition.
Electrical bonding and lightning protection are effective methods of preventing the occurrence of
fire and explosion.
Electrical bonding and lightning protection are normally used together with one or more of the
other designs listed herein.
Electrical bonding should be used to prevent fires and explosions caused by uncontrolled
presence of ignition sources from electrical equipment, wiring and static electricity generation.
Electrical bonding methods should be in accordance with the "Electrical interface" requirements
defined in JSSG-2001.
The shell of an air vehicle generally provides satisfactory protection against lightning strikes
causing ignition within this shell. There are a few exceptions, however, where precautions must
be taken in design to prevent penetration of fuel tank walls, arcing within fuel tanks, and flame
propagation through vent lines into fuel tanks.
Some areas on the air vehicle, primarily extremities, have been found to be prone to frequent
direct lightning strikes of the type which penetrate air vehicle skins. If fuel must be stored in any
of these areas, for justifiable reasons, the following means of protection should be evaluated:
a. The tank skin thickness should be sufficient to carry the electrical current surge of
lightning at the points of potential entrance to and exit from the skin, without causing skin
penetration due to resistance heating. Skin thicknesses of 0.08 inches seems to give
satisfactory safeguard against skin penetration for most lightning strikes.
b. A composite skin structure consisting of the load-carrying skin, a fiberglass cloth layer
and an aluminum sheet bonded together. The resistance of such a composite structure
to lightning penetration has been demonstrated to be considerably better than for a
single aluminum sheet of the same total thickness.
c. Lightning diverters. Lightning current traveling through the fuel tank skin on its path from
the point of entrance to the air vehicle to the point of exit, should not cause electric arcs
within fuel tanks with the possible consequence of vapor ignition. The use of electrically-
conducting gaskets or seals should be considered for all access doors, flanges of filler
units, quantity gages, and pumps, in the plane of the skin to ensure a direct and
omnidirectional path for the current. If other current bridges are incorporated across
839
JSSG-2009A
APPENDIX G
openings in the skin, the tendency of inductive current to follow a straight path and the
necessity to make the function of the bridge independent of potential maintenance
omissions should be considered. The load-carrying capacity of the bridge should not be
less than the equivalent of a bonding jumper consisting of tinned copper-stranded cable
with a cross-sectional area of 20,000 circular mils. Materials and surface treatments
should be selected at joints in the bridge which prevent current-resistant corrosion
deposits at the surfaces of contact. Chains or other spark-producing metallic links
should not be used for securing filler caps against their loss. Some areas on the air
vehicle have been found to be prone to frequent direct or swept lightning strikes which
have sufficient energy to ignite fuel vapors emanating from a fuel tank vent line under
certain conditions. Fuel tank vent discharge openings should therefore be avoided in the
following areas:
1. In the wing plan form area closer than twelve inches to the wing leading and trailing
edges, and in the area at the wing tip, and not closer than twelve inches from the
wing tip.
2. Within a zone extending behind a propeller which is thirty-six inches wider than the
diameter of the propeller.
3. In extremities and protrusions of the air vehicle and in the wake of such extremities
and protrusions.
4. Close to any sharp corners, or in the wake of such corners, in vent masts, or in the
proximity of static discharge wicks.
If required, flame arrestors of a proven design should be installed in fuel tank vent discharge
openings. The flame arrestors should be installed so that the exteriors of the flame arrestors
are flushed by the ambient airstream to prevent flames from clinging to sheltered pockets.
If location of fuel vent discharge openings per subparagraphs 1. through 4., above, is not
practical; or vent masts must be used; present-day flame arrestors are sufficient protection. A
configuration with the vent outlets shielded against direct lightning strikes has proven to be
successful in simulated lightning tests where simple flame arrestors failed. Lightning diverters in
combination with present-day flame arrestors may also give satisfactory protection, whereby
the diverters prevent direct hits to the vent opening, and the flame arrestors protect against
potential swept strikes and heat radiation.
Lightning diverters, when used as suggested in the previous paragraphs, should be arranged
strategically so that the critical areas or points are shielded from all directions of potential
lightning approach. The diverters should be resistant to erosion and to airstream loads, and
should carry the current through the diverter base without skin puncture. The tendency of a
lightning stroke to be swept away from a lightning diverter by the airflow, or to seek a shortcut,
make the design of an effective diverter difficult and testing of every new arrangement almost
mandatory.
Under certain conditions lightning discharges have sufficiently steep rates of current rise to
produce an inductive potential sufficient to not only cause arcing across fuel tank discontinuities,
but also to induce voltages into fuel capacitance gage wiring and into the probes within the
tanks. The latter can easily be caused by a strike to a wing tip light or an antenna, if its wiring is
840
JSSG-2009A
APPENDIX G
contained in the same bundle as the fuel capacitance gage probe. Such induced voltages also
can cause inadvertent discharge of a fire extinguisher, or can trigger ordnance equipment.
Circuitry prone to lightning strikes should be routed away from other electrical wiring, or should
be shielded.
Antenna lead-in wires should incorporate lightning arrestors if they are not sufficiently shielded
against lightning by the air vehicle shell.
Pressure fueling inlets to fuel tanks should be sized and designed to minimize fuel splashing.
Splashing is an important contributing factor to electrostatic charging of the fuel and can lead to
sparking in the tank vapor space.
Fuel dipsticks should be designed to prevent arc-over from a dipstick to tank structure during
gaging.
Electric ground receptacles for grounding pressure and gravity fueling nozzles should be
provided.
G.4.4.7.6 Electrical bonding and lightning protection.
Electrical bonding and lightening protection shall be verified by ___(TBS)___.
The use of these prevention designs to the fullest extent practicable is necessary to reduce the
TBS should be filled in with analysis and inspection.
Analysis, laboratory, component and ground tests and demonstrations may be used to verify the
adequacy of the provided electrical bonding and lightning protection designs. This should be
part of a fire and explosion hazard analysis done to determine the protection required for the
total air vehicle.
MIL-STD-464 can be used as a reference for electrical bonding requirements.
G.3.4.7.7 Post-crash fire prevention.
The following shall be applied to the fullest extent practicable to prevent the occurrence of post-
crash fire and explosion hazards.
a. Flammable fluid containment features.
841
JSSG-2009A
APPENDIX G
b. Ignition source reduction features.

The prevention of post-crash fire is another primary concern in designing-in fire and explosion
hazard protection. Records show the casualty rate in generally survivable crashes involving fire
is much higher than in those where fire does not result.
Under crash conditions the fuel onboard an air vehicle is the greatest fire hazard. It is subject to
spillage and vaporization and is therefore vulnerable to sources of ignition. These sources are
varied and include hot engine compartments, sparks struck from metal impact, and sparks from
broken electrical components and circuits. The highly volatile nature of the fuel causes rapid
burning, making fire control difficult and casualties likely. Prevention of fuel burning can be
accomplished by several methods, such as elimination of ignition source, fuel containment, and
alteration of fuel characteristics. The last method, involves changing the characteristics of the
fuel to modify its dispersion properties and consequently reducing its susceptibility to ignition
and sustained burning during the initial impact and deceleration phase. The following should be
considered to minimize post-crash fire and explosion hazards:
a. The air vehicle should be designed to prevent fire and flammable fluid leakage during a
wheels up landing.
b. Flammable fluid components should not be located in areas that could be damage
during a wheels up landing.
c. Integral fuel tanks in and close to the wing roots are exposed to high bending and
twisting loads in a crash landing and should be avoided
d. If fuel tanks must extend close to the bottom of the fuselage, tank fittings and tank
accessories should not protrude from the tank surface, or they should be so designed
that they tend to recede into the tank without leakage in a crash.
e. Fuselage fuel tanks should not extent close to the bottom of the fuselage and should be
protected by bottom structure.
f. Fuel tanks should be located so that a collapsing landing gear does not result in a major
fuel tank leak.
g. Wing fuel tanks should be located behind spars and leading edges to provide maximum
protection against horizontal crash impact loads. Prevention of major fuel leakage
caused by fuel inertia loads in the tanks during a crash landing should be considered in
tank design to the greatest practicable extent. Fuel tanks which withstand, without major
leakage, the same crash inertia loads as the seats of the occupants are desirable for a
balanced crash safety level of an air vehicle.
h. Components and accessories containing flammable fluids should be located where
ground contact is impossible avoided in a crash environment. Flammable fluid lines
should be routed so they are protected by structure upon impact.
i. Flexible flammable fluid lines with ample slack should be used in areas where
deformations are likely to occur in a crash.
842
JSSG-2009A
APPENDIX G
j. Metals which have low friction-spark tendency should be used in areas of the air vehicle
that come in contact with the ground during a wheels up landing, whenever practicable.
k. The electrical system should be designed so as not to provide an ignition source after a
crash. A method for quickly de-energizing electrical ignition sources should be provided.
l. Electrical components should be located and installed in such a manner as to avoid
becoming an ignition source.
m. Electrical components should be mounted near heavy structure and away from
flammable fluid tanks and lines.
Include fuels and other flammable fluids and their system design and location, electrical system
design and location, materials selection, high temperature systems and equipment location, and
component failure modes and effects.
Bladder cells should be considered in locations where damage to fuel tanks is likely in a belly
landing. Three and a four ply nylon fabric with rubber liner and with plies laminated on the bias
have proven to be very suitable for cell construction due to their inherently high elongation
values and strength.
Engine nacelles and pylons should be constructed so that fuel leakage from ruptured wing fuel
tanks, which is carried spanwise by wetting conduction, is prevented from entering an engine
compartment. The nacelle and pylon skin joint with the lower wing surface, and pylon and
nacelle skins should be as liquid-tight as practicable to dispose of major leakage of fuel along
the fuselage skin to the ground.
The following paragraphs contain some of the safety guidelines to be employed to give an air
vehicle an inherent resistance to post-crash fire hazards. Protective measures may be provided
by active system and passive designs for ignition source suppression and by designs for fuel
alteration and fuel containment. Generally, the ignition sources which should be considered
during a crash episode are electrical sources, hot surfaces, friction sparks, or flames. While fire
prevention can be affected by the control of any or all of the three basic elements of fire;
prevention designs are most easily and effectively applied to the elements of fuel and ignition
sources, hence these two methods are discussed in greater detail.
a. Fuel containment. Containment of air vehicle engine fuel is the most significant means
of minimizing or preventing fire fatalities to occupants who have survived a moderate-to-
severe crash. During the design phase, ensure fuel containment designs which will
result in crash hazards to the air vehicle occupants or permit fuel tanks to be easily
damaged are eliminated. Concern should be applied to the areas of the tank location,
shape, materials, fittings, and attachments. Apply the designs noted in the guidance for
separation (see "Isolation and separation of combustibles and ignition sources" in this
appendix), such as prohibition of permanent fuel tanks in personnel or cargo
compartments. Consider the fuel containment design criteria contained in USARTL-TR-
79-22E, and the documents listed therein. Another recommended document is
FAA ADS - 24.
843
JSSG-2009A
APPENDIX G
Good initial fuel containment design features can complement the primary strength of
the structure and should eliminate the need for modifications that must be included later,
adding needless weight and cost.
b. Flammable fluid components and lines. Locate components and accessories containing
flammable fluids where ground contact is impossible in a crash environment. Route
flammable fluid lines so that they are protected by structure upon impact. Avoid locating
fuel or hydraulic lines in the wing leading edge section and utilize flexible lines with
ample slack in areas where crash deformation is likely. Consider using breakaway, self-
sealing couplings or impact operated shutoff valves in high hazard areas which justify
their complexity. Shutoff valves are required in the tank-to-engine lines and
consideration should be given to their location and operation. Containment is lost, if the
shutoff valves are carried away with detached pod, pylon, or fuel line. Ideally, locate the
valves inside the tank at the outlets. Maintainability considerations may preclude this
location and a location immediately outside the tank may be required. Shutoff valve
operation from the cockpit is usually manual. However, unanticipated emergencies
require that more consideration be given to adequate automatic valve operation. Fuel
tanks which withstand, without major leakage, the same inertia loads as the seats of the
occupants are desirable for a balanced crash safety level of an air vehicle.
Bladder cells should be considered in locations where damage to fuel tanks is likely in a
belly landing. Three and a four ply nylon fabric with rubber liner and with plies laminated
on the bias have proven to be very suitable for cell construction due to their inherently
high elongation values and strength.
Engine nacelles and pylons should be constructed so that fuel leakage from ruptured
wing fuel tanks, which is carried spanwise by wetting conduction, is prevented from
entering an engine compartment. The nacelle and pylon skin joint with the lower wing
surface, and pylon and nacelle skins should be as liquid-tight as practicable to dispose
of major leakage of fuel along the fuselage skin to the ground.
c. Fuel alteration. Studies are now being made regarding the feasibility of using antimist
additives to alter the dynamic dispersion of low volatility fuel in a manner which negates
the mist fire and explosion hazards associated with the neat fuel. The additives
generally consist of high molecular weight polymers and dramatically affect the number
and relative size of fuel droplets formed under dynamic crash or gunfire impact
conditions. The combination of a low volatility fuel with this additive provides an
excellent approach for minimizing both the fuel vapor and mist fire and explosion threats.
Fuel alteration compatibility studies and experimental efforts are presented in the
literature. Some of the relevant reports are AGARD CP-84-71, Army Contract DAA 005-
73-C-0249 Report 9130-73-112, and USAAVLABS-TR-65-18. Fuel misting additives
have been incorporated into military applications. The preceding information is provided
for historical purposes only.
d. Hot surfaces. Locate landing lights where they should not be exposed to direct crash
impact. It has been verified that the incandescent filament in a landing light is hot
enough to provide fuel ignition for a period of 0.75 to 1.50 seconds after the bulb has
been broken. Since crash tests using simulated fuels have shown massive fuel spillage
in progress as early as 0.20 second after impact, it is readily apparent that this ignition
844
JSSG-2009A
APPENDIX G
source deserves careful attention for a crashworthy design. A location in the vicinity of
the trailing edge is considered satisfactory.
e. Friction sparks. Use metals which have low friction sparking tendencies where ground
contact can occur during a crash landing. Hot surface hazards and primary sparking
should develop as a result of friction between contacting surfaces during a crash. If the
abrading metal produces sparks of high enough thermal energy, ignition is possible.
The thermal energy of the spark is a function of bearing pressure, slide speed of the
metal, hardness of the metal, and the temperature at which the metal particles will burn.
See table G-I for the minimum conditions under which certain abrading metals will ignite
combustible mist. A reduction of the friction spark ignition hazard can best be achieved
by selecting materials of the lowest possible sparking characteristics (table G-II),
particularly for those areas of predictable crash damage (see NACA TN 2996 and
NACA TN 4024).
TABLE G-I. Minimum conditions for ignition of abraded metal particles.
MINIMUM BEARING
PRESSURE DRAG SPEED
METAL lb/in2 m/h
Titanium 21-23 less than 5
Chrome-Molybdenum 30 10
Magnesium 37 10-20
Stainless Steel 50 20
Aluminum 1455* 40
*Ignition was not obtained with aluminum.
(extracted from USAAMRDL-TR-71-22)
TABLE G-II. Sparking characteristics of common construction metals.
SPARK
MATERIAL APPEARANCE IGNITION CAPABILITY
Aluminum None Minimum
Steel Thin, orange streaks Possible
Titanium Bright Certain
845
JSSG-2009A
APPENDIX G
f. Electrical ignition sources. Since the vehicle electrical system extends to virtually every
part of the vehicle and since the minimum electrical energy required for ignition is so
small (about 0.15 25 milli Joule under ideal conditions), it constitutes an excellent ignition
source. Therefore, in the electrical design, provide a method for quickly de-energizing
electrical ignition sources, such as batteries, generators, and inverters. Provide for
either a pilot or a crash-activated system with adequate precautions included to prevent
inadvertent operation. Ensure that the activation time does not exceed 0.20 second.
Design the system so that all nonessential buses are de-energized and only the
emergency DC circuits needed to operate minimum lighting, communication, and crash-
fire prevention systems remain energized. Route and protect electrical power lines
required for emergency systems to minimize the possibility of crash damage and ignition
of any combustible material. In addition, locate the elements listed below outside of the
areas of anticipated impact:
1. Electric batteries. Electric batteries which can be an ignition source should be
located where they are unlikely to be exposed to crash damage. Batteries retention
should be designed to withstand the same acceleration loads as the crew seats.
2. Wire bundles
3. Inverters
4. Generators and alternators
5. Magnetos
6. Radar reflector and related electronics
g. Crash-fire prevention systems. Combine the above elements into an integrated system.
Design a crash fire prevention system that provides for rapid inerting of ignition sources
(engine and electrical) and prevention of the dispersion of flammables at the moment of
crash. The utilization of phenomena peculiar to the crash environment (excessive
displacement or structural break) to activate automatic fuel containment measures
should be considered. Design electrical circuitry so that a single operation deactivates
all circuits which are not necessary for crash-fire emergency operation. Crash-fire
prevention system activation circuits can be designed to include any level of automatic
and manual interrelationship. Every redundancy adds complexity and only an
engineering analysis of a given situation can provide a basis for final selection of a
circuit.
G.4.4.7.7 Post-crash fire prevention.
Post-crash fire prevention shall be verified by ___(TBS)__.

This verification requirement is dictated by crew safety.
846
JSSG-2009A
APPENDIX G
TBS should be filled in with analysis and inspection and should be part of a fire and explosion
hazard analysis done to determine the protection required for the total air vehicle. Analysis,
laboratory, component and ground tests; and demonstrations may be used to verify the
adequacy of the provided post-crash fire prevention designs.
Post-crash fire prevention should be considered a safety-critical condition.
G.3.4.7.8 Fire and explosion hazard detection.
The function of the detection system is to detect a fire, overheat, or explosion and transmit that
information to the crew. Hazard detection systems shall be installed in all areas containing
power plant installations and areas where the uncontrolled release of energy or combustible
materials could result in a fire, overheat, or explosion hazard to the air vehicle or personnel. A
separate detector system shall be provided for each fire zone that requires a different
emergency procedure.
Although good design practice dictates that all reasonable fire and explosion hazard prevention
techniques be employed in the design of an air vehicle system, it is not always possible to
prevent the occurrence of fire and explosion hazards to an acceptable level. In these cases, a
detection system is required to detect the hazard, provide warning to the crew, and provide for
the initiation of automatic corrective action where provided. The intent of this requirement is to
ensure detection systems are provided in all the stated locations. Propulsion and ancillary
power unit installations are examples of areas where the occurrence of fire related hazards
cannot always be prevented.
While conducting the fire hazard analysis, determine the areas of the air vehicle in which fire
and related hazards can occur. These hazard areas are characterized by the existence of a
combustible material and an ignition source at an unacceptable level of risk. The hazard of
concern at a given location can be excess temperature, fire, explosion (combustion in a
confined space with associated pressure rise), smoke, or combustible vapors. The detection
system should be able to detect the specific hazard.
Analysis should be conducted during the design phase to determine if potential hazards exist
which require detection and crew warning. The C-5, and F, F-111, and B-1B were both
modified with additional detection systems and other fire protection systems in areas which
were not previously protected.
847
JSSG-2009A
APPENDIX G
G.4.4.7.8 Fire and explosion hazard detection.
Fire and explosion hazard detection shall be verified by ___(TBS)___.
The need for a detection system in a given location is dependent on the probability of the
uncontrolled coexistence of the three basic elements of fire and explosion in that location.
Detection systems are required in all propulsion installations because the necessary elements
for fire are always present when an engine is operating as has been shown by many years of
experience. It should be ensured that these systems are installed where required.

TBS should be filled in with analysis, component tests, ground tests, and inspection.
The required analyses and inspections should be part of a fire and explosion hazard analysis
done to determine the protection required for the total air vehicle.
Experience has shown that fire hazards which require a detection system can occur in air
vehicle areas, such as wheel wells, weapon bays, accessory drive compartments, avionics
compartments, cargo compartments, and around bleed air ducts.
It is a difficult task to determine with absolute certainty whether or not a detection system is
required in a certain area other than propulsion installations. The need for a detection system is
dependent on a hazard of sufficient probability, which cannot be eliminated or controlled by
other design means. In order to preclude the necessity of a modification program because of
insufficient detection system coverage, as was the case in the C-5, and , F-111, and B-1B
programs, it should be ensured during the design phase that adequate coverage is provided.
G.3.4.7.9 Detection system performance.
The ___(TBS 1)___ detection system(s) installed in ___(TBS 2)___ shall detect ___(TBS 3)___
in ___(TBS 4)___.
The requirements for hazard detection sensitivity, range, and response time can vary depending
on the nature of the hazard and location. Detection system performance requirements and the
type of hazard to be detected may be different for different areas of the air vehicle. If these
requirements are different, then a separate set of requirements should be stated for each
location.
848
JSSG-2009A
APPENDIX G
TBS 1 Fill in blank with type of detection system.
TBS 2: Fill in blank with detection system location(s).
TBS 3: Fill in blank with the detection system performance parameters like detection distance,
detection temperature, flame size.
TBS 4: Fill in blank with detection system response time.
Fire detection systems should be provided for all potential fire zones. The detector system
should be designed for highest reliability to detect a fire and to minimize the occurrence of false
alarms. It is desirable that it only respond to a fire and misinterpretation with a lesser hazard
such as engine over-temperature, exhaust gas and bleed air leakage should not be possible. If
indication of lesser hazard conditions is desirable, an independent system should be used. A
fire detection system should be reserved for a condition requiring immediate measures such as
engine shutdown, fire extinguishing, or bailout. A separate detector system should be provided
for each fire zone. One single detector system may be provided for two or more fire zones if a
fire or overheat condition in either zone requires the same emergency procedure. A fire in any
zone should be identified to the crew with sufficient information to control the hazard. Fire
detection systems should not be incorporated with other systems, which if failed, could prevent
normal operation of the detector system.
a. Function. The detector system performance:
1. The detection systems should be capable of responding to fire and overheat hazards
when the compartment is designed to contain these hazards.
2. The alarm signal should continue as long as the hazard exists.
3. The fire and overheat detection systems should clear the alarm output when the
hazard no longer exists.
4. The fire and overheat detection systems should reset after alarm clearance and be
capable of hazard detection for all subsequent fire or overheat conditions.
5. Detector system components located within and close to potential fire zones should
withstand, without failure, a 2000°F flame for a period not less than 5 minutes.
b. Types of detectors. Fires or dangerous fire conditions should be detected by one or any
combination of the following techniques:
1. Radiation sensing detectors: Radiation detectors operate on the principle of sensing
visible flame. They are most useful where the material present will burn brightly soon
after ignition, such as in a power plant accessory section.
2. Continuous-type fire detectors. These detector systems employ continuous lengths
of heat sensing wires and can be used wherever the hazard is evidenced by
temperatures exceeding a predicted set value. Also, some continuous-type systems
operate on a temperature rate-of-rise principle in addition to a discrete level.
849
JSSG-2009A
APPENDIX G
3. Unit type. As the name implies, the unit type detector is a single element, which
operates on a heat sensing principle. Unit type detectors are most effectively used in
small compartments or confined passages.
4. The detector system should be of rugged construction, to resist maintenance
handling, exposure to fuel, oil, dirt, water, cleaning agent, extreme temperatures, fire,
vibration, salt air, fungus, and altitude or any other natural and induce environment.
The detector units should be light in weight, small and compact, and readily
adaptable to desired positions of mounting.
Two or more engines should not be dependent upon a single detector system. The installation
of common zone detection equipment prevents the detection system from distinguishing
between the engine installations, necessitating shutting down both engines in the even of fire.
For the detection of fire and overheat conditions in propulsion and secondary power
installations, the vast majority of military and commercial air vehicles utilize temperature sensing
systems which were designed in accordance with MIL-F-7872. These systems have a 5-second
response to a 2000°F fire when a 6-inch length is heated. The 5-second response is adequate
for fire and over-heat hazards when the compartment is designed to contain these hazards.
When it is determined that 5-second response to a fire is not adequate or if it cannot be ensured
that the thermal detection can be optimally located to detect the fire, then an optical detection
system with a response time and a detection distance should be specified. The specified
distance should be compatible with the compartment dimensions and the mounting locations for
the detectors. The required detection time is dependent on the allowable fire size and duration.
Detection systems which detect infrared (IR) or ultraviolet (UV) radiation from a fire can provide
volumetric coverage of distances of 10 feet or more if necessary, with a response time of 1
second or less, down to the millisecond range. These systems can be used to detect fire or
developing explosions, but cannot detect an overheat condition. For most fire situations,
detection of a 1 foot diameter pan fire at a distance of 10 feet within 1 second should be
sufficient. If dual hazards exist which require fast fire detection and over temperature detection,
then two systems will be required. Smoke detection systems have been used in cargo
compartments, avionics compartments, and other areas of the air vehicle where a fire hazard
may exist in class A materials. Smoke detection systems are an FAA requirement and should
be required for Air Force air vehicle if FAA certification is necessary.
Heat sensing fire detector sensing elements should be located as close as practicable to
sources of flammables such as fuel strainers, and ignition sources such as generators and
alternators, where the proximity of these flammables and ignition sources constitute a possible
source of fire. They also should be located at points where the ventilation air leaves the
compartments so that temperature indication can be obtained with a minimum length or
minimum number of sensing elements. Radiation detectors should be located such that any
flame within the compartment is sensed, considering the cone of vision of the sensor and the
fact that direct flames as well as reflected flames are sensed. Detectors should not be located
directly adjacent to combustion sections or any area where in the event of “burnthrough,” the
high temperature would incapacitate the system prior to providing alarm. They should however
be located so that they will indicate the “burnthrough.”
850
JSSG-2009A
APPENDIX G
Diodes should not be used to separate the detector systems.
Types of detectors. Fires or dangerous fire conditions should be detected by one or any
combination of the following techniques:
a. Radiation sensing detectors: Radiation detectors operate on the principle of sensing
visible flame. They are most useful where the material present will burn brightly soon
after ignition, such as in a power plant accessory section.
b. Continuous-type fire detectors. These detector systems employ continuous lengths of
heat sensing wires and can be used wherever the hazard is evidenced by temperatures
exceeding a predicted set value. Also, some continuous-type systems operate on a
temperature rate-of-rise principle in addition to a discrete level.
c. Unit type. As the name implies, the unit type detector is a single element, which
operates on a heat sensing principle. Unit type detectors are most effectively used in
small compartments or confined passages.
The detector system should be of rugged construction, to resist maintenance handling,
exposure to fuel, oil, dirt, water, cleaning agent, extreme temperatures, fire, vibration, salt air,
fungus, and altitude or any other natural and induce environment. The detector units should be
light in weight, small and compact, and readily adaptable to desired positions of mounting.
Detector system components located within and close to potential fire zones should withstand,
without failure, a 2000°F flame for a period not less than 5 minutes.
Detector system components for any fire zone should not pass through or be close to other fire
zones, unless they are protected against false warnings and being rendered inoperative from
fires in such zones. This requirement should not be applicable with respect to zones which are
simultaneously protected by the same warning and extinguisher system.
The minimum allowable bend radius of continuous type sensing elements, as recommended by
the manufacturer, should be adhered to. Mounting brackets should be as short as possible, and
spaced according to the manufacturer’s recommendation in order to prevent damage by
vibration. Where sensors are located in the area of high pressure ratio exhaust systems,
special provisions, such as close interval support should be made to prevent destructive-sensor
vibration.
Sensor systems should be designed so that it is not necessary to disassemble or remove

sections to perform frequent maintenance on the air vehicle. Connectors should be readily
accessible.
Connectors used in firewalls should remain intact and prevent flame penetration for at least
15 minutes when exposed to a 2000°F flame and the vibration of application. Firewall
connectors and connectors used in or close to potential fire zones should be able to remain
operable for at least 5 minutes when subjected to a 2000°F flame and the vibration of
application. All connectors used in the detector systems should be environment-free. Exposed
terminal blocks should not be used in any portion of the system.
851
JSSG-2009A
APPENDIX G
Electric wires or components for the detector system which are located in or close to a fire zone
should withstand a flame of 2000°F for 5 minutes under the vibration of application.
G.4.4.7.9 Detection system performance.
Detection system performance shall be verified by ___(TBS)___.
The detection capability (response time, detection distance) should be verified to ensure that the
fire hazard can be detected in sufficient time to allow for corrective action and safe recovery of
the air vehicle.
TBS should be completed with analysis, component tests, on-aircraft tests, and inspection.
done to determine the protection required for the total air vehicle. Detection system
performance can most easily be determined by laboratory test.
Fire detection response time should be used as part of a fire timeline to determine total time that
a fire hazard condition may exist on an aircraft.
G.3.4.7.10 Detection system failures.
In the event a critical detection system(s) fails in a manner that the intended hazard can no
longer be detected, the system shall provide an automatic system fail indication to the crew. All
detection systems shall have a manual test feature which will allow the crew to determine if the
system is operational. All propulsion installation fire detection systems and the following
systems are considered critical: ___(TBS)___.
The ability of a hazard detection system to function is important to the overall safety of the crew
and air vehicle. Therefore, the pilot or some other crew member should have the capability to
determine if the detection system(s) can perform its intended function at the beginning of a
mission and at other times if deemed necessary. In certain situations, the inability to detect a
hazard may be a necessary bit of information to the pilot or crew. In this situation, an automatic
fail indicator should be provided. A means to determine which detection systems are critical
should be established and accomplished.
852
JSSG-2009A
APPENDIX G
TBS should be filled in with a list of critical systems.
The detection system should provide an automatic indication to the crew in the event of a failure
of the detection system (fault evident). The detection system should be designed so that no
single system fault should leave a potential hazard area without detection.
While the fire hazard analysis is being conducted during the design phase, a determination of
critical hazard detection systems which require an automatic fault warning for the crew should
be made. Include the hazard criticality and potential consequences of undetected hazard.
Long-term maintenance damage or wear and tear as well as sudden catastrophic failures such
as an engine turbine disk failure can cause the detection system to fail in such a manner that a
fire cannot be detected.
G.4.4.7.10 Detection system failures.
It shall be verified by (TBS) that in the event a critical detection system(s) fails in a manner
that the intended hazard can no longer be detected, that the system provides an automatic
system fail indication to the crew.
Fire detection systems are required to ensure safety of flight. It is necessary to be able to
conduct a preflight test to ensure that the system is capable of providing this necessary function.
This is presently a standard feature on Air Force systems. However, these systems can fail in
flight without the crew knowing that a safety of flight system is non-operational. The crew should
be informed of this situation.

TBS should be filled in with analysis, component tests, on-aircraft tests, and inspection.
done to determine the protection required for the total air vehicle. The existence of system
failure indication features and manual test features can be determined by analysis and
inspection during the appropriate system design review. The actual performance of these
failure indication systems can be verified by laboratory test.
False indications of a fire in a USAF bomber resulted in crew ejection from an aircraft when no
fire occurred.
853
JSSG-2009A
APPENDIX G
G.3.4.7.11 Detector output.
The detection system(s) shall provide an alarm signal output which is suitable for interfacing
with the appropriate crew warning systems and any provided automatic fire control system or
the respective explosion suppression system. Each individual detection system shall interface
with a separate crew warning device, unless the multiple systems convey the same information
to the crew and result in the same crew action.
It should be ensured that the necessary system interfaces are considered and provided early in
the program so that costly redesign will not be required. Separate crew warning devices are
required for warning systems requiring separate crew actions in order to prevent confusion.
The detection systems should provide an alarm signal output that interfaces with the appropriate
cockpit warning system. Alarm outputs from detection systems for separate hazards that require
different procedures should not be combined into a common alarm signal.
During the appropriate design reviews during the preliminary design phase, inspections should
be conducted to ensure that the necessary crew warning interfaces are provided.
Include the crew warning system and system test.
The above requirements have been standard practice for many years although not formally
stated.
Each detector system should actuate an individual light or lights which are in the direct line of
sight of the crew member responsible for execution of the emergency procedure. The lights
should indicate the location of the fire. If these indicator lights are not also in the direct line of
sight of the remaining cockpit crew members, master warning lights should be provided which
are in the direct line of sight of these crew members. The master warning light should be
illuminated when any indicator light is illuminated.
Detector output interfaces and displays should be coordinated with cockpit working groups to
ensure that pilots or crew have an opportunity to provide inputs to the design.
Failure to include pilot/crew inputs on the design has resulted in redesign of systems after
deployment.
G.4.4.7.11 Detector output.
It shall be determined by inspection and analysis that an alarm signal has been provided to
warn the crew of a hazard detection and that this output is suitable as the input to the
854
JSSG-2009A
APPENDIX G
appropriate crew warning system and any required automatic fire control system or the
respective explosion suppression system. The inspection and analysis will verify that the alarm
outputs from detection systems for separate hazards which require differing emergency
procedures have not been combined into a common alarm signal.
Inspection and analysis are required during the design phase to ensure that the required and
desired system interfaces are developed and maintained.
done to determine the protection required for the total air vehicle. Ensure the necessary
verification inspections are conducted.
Detector output and performance should be considered a safety-critical function.
G.3.4.7.12 False alarm.
The detection system(s) shall not produce a false alarm due to system failure or exposure to
normal or expected ambient environmental conditions.
All hazard detection systems should provide dependable and reliable detection of hazards in
order that the crew can quickly perform the necessary emergency procedures. The integrity of
the system will be compromised if the design, installation, and integration of a hazard detection
system into an air vehicle results in multiple false alarms. This can result in the hesitation of
crews carrying out necessary emergency procedures as well as costly mission delays and
aborts. Normal or failure conditions, which are not hazards, should not cause an false alarm.
The detection systems should not produce a false alarm due to any single system fault or
exposure to normal environmental conditions. Non-environmental factors such as component
failures, faults, or wire shorts should be considered required.
The United States Air Force (USAF) has had a wide range of experience with false alarm rates
on air vehicle detection systems. The F-4, T-38, and F-111 experienced high false alarm rates,
while the C-9, A-7, and A-10 air vehicles have experienced low false alarm rates. The F-4,
T-38, and F-111 were all difficult installations, because installation clearances were minimal,
resulting in a high probability of damage to detectors and wiring. These air vehicles required the
855
JSSG-2009A
APPENDIX G
use of numerous sensors, connectors, and interconnecting wiring which increased the potential
for maintenance and installation damage.
G.4.4.7.12 False alarm.
It shall be determined by analysis, component tests, inspections, and ground tests, that the
detection system will not produce a false alarm when exposed to normal or expected
environmental conditions.
The surest means of determining if a detection system will not have false alarm problems is by
an extended service test in the air vehicle while operating under the most severe conditions for
the particular detection system. Prototype or full scale development testing may be necessary.
If air vehicle testing is not possible, then a series of laboratory tests should be conducted under
the most severe conditions (defined via analysis) that can occur in the air vehicle which may
cause a false alarm.
The required analysis and inspection should be part of the fire and explosion hazard analysis
done to determine the protection required for the total air vehicle. Environmental conditions can
be tested in the laboratory to determine if false alarms result. If a new detection concept is
being contemplated, flight-testing should be considered. It could also be verified by analysis per
similar systems’ performance that the acceptable false alarm rate will not be exceeded.
The lack of strict attention to detail during the design of detection system installation has
resulted in poor performance from the standpoint of false alarms in some USAF air vehicles.
G.3.4.7.13 Detection set point.
The alarm set point of the ___(TBS 1)___ detection system shall be ___(TBS 2)___.
The selection of the alarm set point of a hazard detection system is a tradeoff between detection
sensing and the probability of false alarms. If the alarm set point selected is too low, detection
time and sensitivity will be improved; however, normal ambient conditions may result in an
alarm. If the alarm set point is too high, false alarms will be less likely, but the hazard may not
be detected in a timely manner. The trade-off between sensitivity and tendency to false alarm
should be based on the criticality of the potential fire hazard. The alarm set-point may be
dictated by other performance requirements.
856
JSSG-2009A
APPENDIX G
TBS 1 should be filled in with the type of detector (i.e., IR, UV, smoke, vapor, or other).
TBS 2 should be filled in with the detector alarm set point. The alarm set point should be
established as high as possible without causing the system sensitivity or response time to be
adversely effected. For thermal detection systems, previous practice has been to set the alarm
point 150-250°F above the maximum expected temperature which would be sensed by the
detection system. This philosophy should preclude false alarms due to higher than expected
normal temperatures, hot day environments, or due to minor non-hazardous leakage of hot gas
or air from the propulsion installation. This same philosophy should be applied to other types of
detection systems such as IR, UV, smoke, vapor, or other detection systems to ensure normal
and non-hazardous conditions do not result in a system alarm. This requirement should also
include ambient environmental conditions and desired detection response time.
Improper detection set point of the F-4 fire detection may be a major source of false alarms on
that air vehicle. Testing conducted by Ogden Air Logistics Center indicated that engine bay
temperatures equal to or slightly exceeding the nominal fire detector set points can exist for
short time periods under certain flight conditions.
G.4.4.7.13 Detection set point.
The alarm set point of the detection system should be verified by ___(TBS)___.
Some means of establishing an alarm set point should be specified to ensure acceptable
system sensitivity without unnecessary tendency for false alarms.
TBS should be filled in with analysis, inspection, and ground tests. The verification should be
part of a fire and explosion hazard analysis done to determine the protection required for the
total air vehicle. The surest method of properly establishing the alarm set point is by conducting
an instrumented flight test under the worst case environmental and flight conditions. If this is
not practical during the design phase, the set point should be established by analysis or from
engine qualification tests. Instrumented flight tests should then be conducted on one of the first
prototypes or production air vehicles. During the appropriate system design review, it should be
determined, by inspection and analysis, that an appropriate alarm set point has been
established.
857
JSSG-2009A
APPENDIX G
Lack of verification testing on the F-4 air vehicle resulted in the detection system set point being
too close to normal operating temperatures. More recent designs have successfully defined the
alarm rate so that few false alarms are experienced.
G.3.4.7.14 Detection indication clearance.
The ___(TBS 1)___ detection system shall clear the alarm output when ___(TBS 2)___.
Information that a hazard no longer exists is necessary information for the crew, as is the
warning of the initial hazard. All systems require the capability to inform the crew, within a
reasonable period of time, when the hazard being detected no longer exists. This will provide
vital information of the effectiveness of any hazard control procedures that may have been
employed and whether or not additional actions are necessary.
TBS 1 should be filled in with the type of system (for example IR, UV, smoke, vapor, or other)
TBS 2: It is desirable that the alarm output clear as soon as possible after the hazard has
terminated. Temperature sensing systems have to cool down and the time required is a
function of thermal mass and differential temperature. A 30-second time has been specified in
the past for this type of system. UV, IR, and other types of systems may be able to clear the
alarm in a shorter time.
A fire timeline is a useful tool to determine the total time that a fire hazard may exist. This time
line should start with initiation of the fire through all procedures available to the crew to eliminate
the hazard.
G.4.4.7.14 Detection indication clearance.
Detection indication clearance shall be verified by ___(TBS)___.
Detection indication clearance should be verified by analysis, component tests, on-aircraft tests,
and laboratory test. The laboratory test should simulate air vehicle conditions as much as
possible.
858
JSSG-2009A
APPENDIX G
TBS: The analysis and inspection should be part of a fire and explosion hazard analysis done
to determine the protection required for the total air vehicle. Detection systems which utilize
different detection techniques may require different clearing times.
System integration tests on the air vehicle should be conducted during qualification as well as
during Acceptance Testing.
G.3.4.7.15 Detection repeatability.
The detection system(s), after ___(TBS 1)___ resets, shall be capable of ___(TBS 2)___
hazard detection.
The detection system should be a resetting type in order to provide warning in the event the
hazard reoccurs after a period of remission.
TBS 1: A minimum required number of resets should be specified. A minimum of 3 is

recommended.
TBS 2: If reduced detection performance is allowable after the detection system is exposed to
the hazard, it should be stated.
The detection system should not require manual resetting.
Include the hazard type and hazard damage potential to detection systems.
Ensure that a fire time line is prepared including reset times of the detection system. The fire
timeline can be used to define other requirements such as containment, ventilation, and
suppression requirements.
G.4.4.7.15 Detection repeatability.
Detection repeatability shall be verified by ___(TBS)___.
The most practical method to determine alarm repeatability is by laboratory test.
859
JSSG-2009A
APPENDIX G
TBS: The required analysis and inspection should be part of a fire and explosion hazard
analysis done to determine the protection required for the total air vehicle. A minimum number
of alarm cycles should be specified if the system does not have an unlimited reset capability.
The verification test setup should be representative of the actual installation and actual hazard
being detected.
Detection reset times are faster with optical sensor versus eutectic salt or pressure devices.
G.3.4.7.16 Fire and explosion hazard control location.
Control systems and designs shall be provided for all areas which are fire or explosion potential
areas and those adjacent areas as required to ensure effective hazard control.
It is not always possible to prevent the occurrence of fire or explosion hazards to an acceptable
level, even though all reasonable prevention techniques have been employed in the design of
the air vehicle. Generally, there are areas of the air vehicle where all three basic elements of
fire and explosion are present simultaneously and a single failure will result in fire or explosion
(fire and explosion potential areas). Additional protection in the form of fire and explosion
hazard controls will be required in these areas. This control may need to be extended to
adjacent areas to ensure effective protection. The intent of this requirement is to guarantee that
control systems and designs are provided in all stated locations.
Distinct examples of fire and explosion potential areas (historically known as fire zones) are the
propulsion and ancillary power unit installations. By analysis and inspection, it can be
determined to what other areas hazard control should be extended. Fuel tank dry bays,
electronic bays and cargo compartments have been provided with control methods on past and
present air vehicles. Areas or hazards of concern at a given location can be excess
temperature, fire, explosion, smoke, and toxic vapors, including the space available for control
systems and design installations.
Fire extinguishing systems which incorporate a second discharge line should be designed so
that the first discharge is directed to its respective compartment without requiring positioning of
valves to select the compartment.
The discharge openings of the lines should not be threaded so as to minimize the possibility of
closure by caps which could be left on by oversight.
Stainless steel or other materials with equivalent fire barrier qualities should be used for all
portions of extinguishing systems within and close to potential fire zones. Exceptions are
860
JSSG-2009A
APPENDIX G
discharge tubing in cargo and baggage compartments, which may be of aluminum alloy, and
valve seals, which may be of an elastomer material. This material should not react chemically
with the extinguishing agent to cause leakage.
The containers should be readily accessible for installation, removal and inspection. Containers
should be located in such a manner that the pressure gage is readily visible for inspection by
maintenance personnel.
Control systems for fire extinguisher systems should not pass through any potential fire zone.
Any portion of the controls which must be located in a potential fire zone for justifiable reasons
should be able to operate for a period of no less than five minutes when subjected to a 2000°F
flame without failure. The fire extinguishing system may be electrically or mechanically
controlled.
Electrical components and circuitry of fire extinguishing systems should be as simple and
reliable as possible. When electrical components and circuitry are located in fire zones, they
should be able to operate for at least fifteen minutes when subjected to a 2000°F flame without
failure. They should also integrate into the air vehicle electrical system so that any other
electrical failure will not affect the operation of the system. Complete electrical circuits should
be ensured to provide direct ground contact for all electrical components such as agent
containers, solenoids, or directional valves. The reliability of grounding through tubing or
support structure is poor because the anodized fittings offer considerable electrical resistance.
Relays should be avoided if possible. If relays must be used, two independent relays should be
used in such a way that failure of one relay does not cause malfunction of the system. When
the discharge triggering device is electrically operated (squib or solenoid), two such devices with
two separate and independent electrical circuits from the circuit breaker outward should be
provided. A single circuit with single relay is acceptable for protection of equipment that is used
on the ground only. Electric control systems should be designed so that accidental grounding of
the circuit through a discharged squib does not cause malfunction of other system circuits.
Care should be taken to make certain the power supply is not affected by fire control
procedures.
Squibs in container discharge valves should be protected against inadvertent discharge due to
heat influx from a fire if such a discharge jeopardizes the intended function of the extinguisher
system. Any squib should be an integral part of the electrical connector or other provisions
should be made to ensure that the squib(s) cannot be left out when the connector is attached to
the container.
A fire extinguishing systems which incorporates a second discharge line should be designed so
that the first discharge is directed to its respective compartment without requiring positioning of
valves to select the compartment.
Seal materials should not react chemically with the extinguishing agent and cause leakage
861
JSSG-2009A
APPENDIX G
Ambient temperature around the container should neither rise to a point causing inadvertent
discharge at maximum ambient operating temperature, nor fall below the minimum temperature
necessary for adequate rate of discharge. If the container is located adjacent to the area which
it protects and could be subjected to overheating in case of a fire, discharge through the relief
line into the protected area is acceptable. Each container should be furnished with a safety
outlet incorporating a frangible disc type diaphragm in order to relieve excessive pressure that
may occur in the container. The blowout pressure of the disc should be equal to the container
pressure at the maximum ambient temperature plus 50°F, but not less than 210°F. The fusible
plug relief setting should be 50°F in excess of the maximum ambient temperature, but not less
than 210°F.
Use of the main discharge outlet as a means of safety relief is also acceptable.
Pressure indicators should be of such design as to enable reading with accuracy sufficient to
determine safe operating levels of the pressure vessel. An indicator with temperature
compensation should be used whenever possible. If temperature compensated gages are not
used, a placard should be placed near the gage to provide container pressure variations with
agent temperature. For example, this placard should be used as follows: When the pressure
indication is below the value shown on the placard at the estimated agent temperature, the
container should be removed and weighed. If the weight is below the weight indicated on the
container, the container should be charged with nitrogen to 600 psi +25 –0 at 70°F as indicated
on the container gage.
Each container should be furnished with a safety outlet incorporating a frangible disc type
diaphragm or a fusible alloy type plug in order to relieve excessive pressure that may occur in
the container. The blowout pressure of the disc should be equal to the container pressure at the
maximum ambient temperature plus 50°F but not less than 210°F. Refer to pressure variation
as a function of temperature for the agent being used.
G.4.4.7.16 Fire and explosion hazard control location.
It shall be verified by ___(TBS)___ that hazard control designs and systems have been
provided in all locations as specified.
The provision of control systems and designs in all required locations should be verified to
ensure the completeness of the fire and explosion hazard protection provisions.
The need for a hazard control design or system in a given location is dependent on the
probability of the uncontrolled co-existence of the three basic elements of fire and explosion in
that location.
TBS: During the appropriate system design review, it should be determined by analysis and
inspection that all necessary locations are provided with control designs and systems. This
862
JSSG-2009A
APPENDIX G
analysis and inspection should be part of a fire and explosion hazard analysis done to
determine the protection required for the total air vehicle.
Failure of component testing of fire protection control panels has resulted in operational failures
which resulted in an aircraft mishap.
G.3.4.7.17 Combustible fluid control.
Provisions shall be made to terminate the flow of flammable fluids and oxidizer and reducing
agents into identified compartments. Limit the quantity of these fluids that may enter the
compartments when the fluid quantity is sufficient to contribute to the cause, size, and scope of
any fire or explosion within these compartments. These provisions shall function in conjunction
with any provided fire extinguishing system.
The objective of this requirement is to limit the fire size and duration by cutting off the supply of
fluids that can contribute to the fire.
Normal means to accomplish this is by use of shutoff valves, either electrical or mechanical.
This requirement applies to fluids entering the identified compartment. Engine oil and hydraulic
system shutoff means are not required for turbine engine installations having integral or engine
mounted oil tanks. Traditionally, these engine oil and hydraulic systems have been designed
without shutoff valves because inadvertent actuation could result in complete power loss and
expensive repairs. These systems are otherwise designed to minimize fire and explosion
hazards (see FAR Part 25).
Include the type of fluids to be controlled, availability of space for control location, location
chosen for control, control actuation time, control type (mechanical or electrical), material
selection and environmental conditions at control location.
Air vehicles in the past have generally been designed to meet the following criteria:
Special consideration should be given to the location of the fire shutoff valves. For a pylon-
mounted engine, the fire shutoff valve should be mounted on the upper end of the pylon. For a
fuselage or wing mounted engine, the fire shutoff valve should be mounted as near as possible
to the engine compartment, but not in the compartment. Some installations may require both a
tank shutoff valve and a fire shutoff valve to minimize the quantity of fuel which can drain into
the engine compartment after the valve is closed and to minimize the length of unprotected line
which can drain the tank if the line is broken.
863
JSSG-2009A
APPENDIX G
Electrically-operated valves should not change position during flight as a result of a short circuit,
stray voltage, electrical power failure, or normal mechanical forces. Shutoff valves need not be
provided for drain lines and lines used with a closed-loop fluid system peculiar to a system or
equipment within the fire zone. For example, the integrated drive generator oil cooling system
lines between the generator and the heat exchanger. Fuel fire shutoff valves and their
associated wiring should be located so that they will not be damaged in the event of an engine
burst or a landing gear failure.
The preferred location for the shutoff valves is outside the fire zone. If the valves are located
inside the fire zone they should be able to withstand 2000°F flame for 5 minutes to permit
operation of the valve and be capable of remaining closed without internal or external leakage
for the duration of the fire. Controls for the shutoff valve that are located inside the fire zone
should meet the same fire resistance requirements as the shutoff valve. Hydraulic controls
should also meet these fire resistance requirements without leakage of hydraulic fluid.
Oil shutoff valves have been provided for each engine of multi-engine air vehicles. The
emergency procedure should incorporate a separate step for closure of the oil valve if engine
rotation cannot be stopped and if major damage of the engine can be expected from oil
starvation. The control should be such that the oil valve is always open when the fuel feed
valve is open.
Shutoff valves actuated by a servomechanism should travel from full-open to full-closed in one
second or less. Electric shutoff valves which employ terminal switches for limitation of valve
travel should be so designed that reasonable tolerances are allowed for adjustment of the
terminal switches. Solenoid shutoff valves should not be used for equipment which is essential
for mission performance and should be designed to shut off the flow to a fire zone when failed.
G.4.4.7.17 Combustible fluid control.
It shall be verified by analysis, test, and inspection that fluid control has been provided in all
specified locations. The adequacy of the control provisions should be verified by ___(TBS)___.
The lack of this control method in a required location will complicate, if not defeat, the crew
actions necessary to control a potential or actual fire hazard. The same is true if the control
provisions are inadequate.
TBS: The required analysis, test, and inspection should be part of a fire and explosion hazard
analysis done to determine the protection required for the total air vehicle. Functional checkout
and adequacy of the control provisions are normally verified by ground tests. Special cases
may also require laboratory or component tests. The use of ground tests and demonstrations
will determine whether the provisions work as designed without impacting flight safety.
864
JSSG-2009A
APPENDIX G
Location of the main fuel shutoff valve was an important consideration for control fuel flow to the
engine compartment on a developmental fighter program. Improper access by ground fire
fighting personnel resulted in the inability to shut off fuel to a burning air vehicle.
G.3.4.7.18 Ventilation termination.
Means shall be provided to terminate the ventilation or cooling airflow when termination of this
airflow will contribute to the extinguishment of fire occurring within specified compartments.
The objective of this requirement is to limit the fire size and intensity by cutting off air to the fire.
The preferred location for the shutoff devices and controls is outside the fire zone. If they are
located inside the fire zone, they should be able to withstand 2000 F for 5 minutes without
failure.
Air shutoff valves should be provided for potential fire zones which are equipped with fire
extinguishing, for any single air inlet flowing more than five cubic feet per minute of air to a fire
zone, unless it can be demonstrated by analysis or test that the airflow is not defeating the
effectiveness of fire extinguishing. Bleed air shutoff valves should be provided on multi-engine
air vehicles, using an interconnected distribution system, unless the duct is made of stainless
steel or titanium not less than 0.015 inch thick, or equivalent material, within the fire zone. The
shutoff valve may be a simple check valve or a controlled valve. Shutoff valves should be
provided in air ducts which originate in a potential fire zone and lead to another compartment in
the air vehicle. Shutoff valves actuated by a servomechanism should travel from full-open to
full-closed in one second or less. Electric shutoff valves which employ terminal switches for
limitation of valve travel should be so designed that reasonable tolerances are allowed for
adjustment of the terminal switches. Solenoid shutoff valves should not be used for equipment
which is essential for performance of a mission and should be designed to shut off the flow to a
fire zone, when failed.
During a fire emergency, the doors close with actuation of the firewall shutoff valves. However,
with the advent of the extinguishing agent concentration analyzer and jet engine installations
with low air flow, the need for engine nacelle ventilation shutoff has been almost eliminated.
With the analyzer, it is possible to determine agent concentration under air flow conditions.
There are still other compartments that may benefit from ventilation shutoff. The use of this
control method will need to be determined separately for each particular compartment.
Include availability of space for ventilation termination, location chosen for ventilation
termination, actuation time, type (mechanical or electrical), material selection, and
environmental conditions at chosen locations.
865
JSSG-2009A
APPENDIX G
Some installations have used cooling air intake doors to achieve nacelle or compartment
isolation.
G.4.4.7.18 Ventilation termination.
It shall be verified by analysis and inspection that the ventilation termination required has been
provided in all specified locations.
actions necessary to control a potential or actual fire hazard. The same is true when the control
done to determine the protection required for the total air vehicle. Ground tests and
demonstrations should be used to functionally checkout and verify the ventilation termination
provisions. The use of ground tests and demonstrations will determine if the provisions work as
designed without impacting flight safety.
Low observable requirements can create unique interfaces for requirements and verification.
G.3.4.7.19 Electrical ignition source control.
Provisions shall be made to de-energize all electrical ignition sources that could contribute to
the cause, size, and scope of fire or explosion within specified compartments. These provisions
shall function in conjunction with any provided fire extinguishing system.
The intent of this requirement is to limit the sources of electrical ignition or re-ignition in a fire
situation.
In the case of an engine nacelle fire, the generator is normally deactivated and power into the
nacelle is cut off. Lesser means may be sufficient for other compartments. Include the location
chosen for control, control actuation time; control type (electrical or mechanical), material
selection, and environmental conditions at location of control.
866
JSSG-2009A
APPENDIX G
In the past, the shutoff of electrical power was accomplished by deactivating the generator and
cutting off power to the affected compartment or nacelle when the fire emergency control was
operated. Since electrical arcing and sparking due to electrical faults or subsequent to heat or
fire damage could be a source of ignition or re-ignition, these sources are normally eliminated
by deactivation. The preferred location of the shutoff devices is outside the fire zone. If the
shutoff devices and controls are located inside the fire zone, they should be able to withstand a
2000°F flame for five minutes without failure.
G.4.4.7.19 Electrical ignition source control.
It shall be verified by analysis, inspection, and ground tests that the electrical ignition source
control has been provided in all specified locations.
The required analyses and inspections should be part of a fire and explosion hazard analysis
demonstrations should be used to functionally checkout and verify the adequacy of the electrical
ignition source control provisions. The use of ground tests and demonstrations will determine if
the control provisions work as designed without impacting flight safety.
It is also important to ensure battery back-up circuits are de-energized.
G.3.4.7.20 Fire barriers.
Fire barriers shall be provided to control the spread of fire between specified compartments and
adjoining compartments and areas. The barriers between ___(TBS 1)___ and ___(TBS 2)___
areas shall withstand temperatures of ___(TBS 3)___ F for ___(TBS 4)___ minutes without
failure.
Fire barriers are an established extension of isolation used to control fire spread and to control
overheating.
867
JSSG-2009A
APPENDIX G
TBS 1, TBS 2: Describe the compartments and areas. Include the barrier location, size and
shape, hazards involved (fire or explosion), material selection, particulars of air vehicle
construction, and environmental conditions at installed location. Fire barriers can consist of
firewalls, fire shrouds, and insulation blankets and can include the air vehicle skin and structure.
Appropriate design should be used to ensure that fire barriers will function to prevent the spread
of fire.
TBS 3, TBS 4: The materials used in the fire barrier should be fireproof and able to withstand a
2000 F flame for 15 minutes using standard test methods under the environmental conditions
that exist at the installed location, especially pressure differentials and vibration.
Firewalls and fire shrouds are usually made of stainless steel or titanium at least 0.012-inch
thick, or other materials of equivalent fireproof capability. Insulation blankets are constructed
from various suitable insulating materials with metal foil backing or wrap. The thickness of fire
barriers depends on the materials chosen and the particulars of the installed location, especially
the presence of structure. In order to prevent blanket expansion due to pressure differentials,
provide small shielded vent holes in the cold side foil in areas least susceptible to fuel exposure.
The recommended minimum foil thickness for insulation blankets is 0.004 inch. A screen has
been incorporated on the cold side of blankets with thin foils to prevent the loss of insulating
material from damaged blankets. Use a lacing method that will not decrease the thickness of
the blanket due to diametrical expansion of the protected component. Fire barrier connectors
and the passage of all plumbing, ducts, wiring, and controls, through fire barriers should be as
fireproof as the fire barrier itself. Under no fire conditions should the fire barrier be penetrated
by fire because of failure of fittings. Special concern should be given to the location of insulation
blankets to bleed air lines. Ensure that the blanket integrity will not be compromised by leaking
or ruptured bleed air lines.
The fire barrier should be as tight as possible in order to preclude leakage of liquids and vapors.
A hole of 0.040 inches diameter in a firewall 0.015 inches thick can cause propagation of flames
through the firewall. Experience has also shown that access doors or joints in fire barriers
should be avoided since fire barriers may buckle severely due to heat, resulting in gaps in the
fire barrier at the doors or joints. If access doors or joints must be provided in fire barriers for
justifiable reasons, they should be closed by closely-spaced fasteners of such type that
hazardous gaps will not result during a fire.
The closer the fire barrier must be installed to the outer case of a combustor, the more
protection will be required to cope with the torch-like flame resulting from a burned-through
combustor. Titanium should not be used for fire barrier material in the vicinity of burner cans,
where molten material can drip on it when a burn-through occurs, or when the fire barrier is a
vital load-carrying structural member. Fasteners, grommets, and sealants should possess the
same fireproof characteristics as the fire barrier material. Fillers should be used sparingly and
only where necessary.
868
JSSG-2009A
APPENDIX G
Consideration should be given to the difficulties of removing and replacing any movable pieces
of airframe which have been sealed with fillers. Structurally loaded fire barriers should be
avoided so that early failure will not occur due to the loss of strength even though flame
penetration may not be imminent.
Materials used close to the protected side of the fire barrier should be of a type which will not
burst into flames as a result of heat conduction or radiation from a fire in the fire zone. Structure
and equipment should be protected by insulation, shielding, or cooling if heating due to a fire
can cause a safety-of-flight hazard. High-strength fasteners with aluminum components, such
as lock-bolts and high-shear rivets, should not be used.
The accessory section of a power plant should be separated from the hot burner, turbine, and
tailpipe section by a liquid and vapor-tight fire shield, when practical. It is desirable to govern
the pressure of the burner, turbine, and tailpipe section above that of the accessory section to
compensate for the lack of complete sealing which may occur after a reasonable service time.
The entire fire shield, or portions thereof, may be made of aluminum alloy if the hazard from an
existing fire is not increased in case of burn-through. Partial aluminum alloy fire shields, with
the rest of the fire shield made of stainless steel, should be considered when local burn-through
can be accomplished by proper location of ventilation openings or by burnout panels. Careful
consideration should be given to the possibility of high pressures building up in the hot engine
compartment in case of a failure which causes release of exhaust gases. Such pressure in
combination with the high exhaust temperature could cause penetration of an aluminum fire
shield and carry an ignition source into the accessory compartment, thereby increasing the
hazard potential.
Engines with high compression ratios may require location of the fire shield forward of the last
compressor stage to prevent ignition of leaking flammable fluid by the hot compressor case.
A fire shield should be provided between the hot section and the accessory section of an
auxiliary power plant, when practical. The fire shield should be liquid and vapor-tight. It is
desirable to govern the hot section pressure above that of the section containing the flammable
fluid components.
Whenever satisfactory isolation of exhaust systems from flammable fluid equipment, lines, and
tanks by location is not practical, isolation by steel shrouds should be considered. Sufficient
distance between exhaust pipe and shroud, plus forced air cooling and insulation if necessary,
should be applied to keep the surface on the side of the potential flammable fluid leakage at
least 50°F below the minimum autogenous ignition temperature of the flammable fluids involved.
The shrouds should be liquid-tight.
Exhaust systems and shrouds tend to warp. Such warping should be considered in the design
of exhaust systems so that exhaust and flammable fluid leakages will not occur to cause a fire
hazard or a false fire warning signal.
Heat radiation from exhaust flanges and annular heavy sections may be sufficient to directly
damage wiring, aluminum alloy structure, and hose assemblies located in the plane of the
flange. Adequate shielding or insulation should be provided, if necessary.
869
JSSG-2009A
APPENDIX G
The skin and skin structure of potential fire zone enclosures (or portions thereof), or the skin and
skin structure adjacent to potential fire zone enclosures (or portions thereof), should be made of
stainless steel or titanium, at least 0.012 inch thick, or of equivalent material, if necessary, to
protect against the following:
a. Burning of a fire out of a potential fire zone and subsequent burning into non-protected,
adjacent areas, around the fire barrier, either through the skin or through openings in the
skin.
b. Burning of a fire out of a potential fire zone through the skin and subsequent
impingement of flames on vital structure or on integral fuel tanks, if such impingement
can cause safety-of-flight hazard. In order to prevent re-entry or impingement of a fire
with the minimum use of stainless steel or titanium skin structure, the following should be
considered:
1. Openings such as ventilation outlets in the skin of potential fire zones should be
located and designed so that re-entry of flames, or impingement with resulting
hazard, downstream of the fire zone cannot occur.
2. Fire egress should be encouraged at places where re-entry or impingement cannot
occur. This can be done by proper location of ventilation openings, or by burnout
panels.
3. Fire penetration is most likely in areas of potential flammable fluid leakage, at
ventilation air exits, and at and near the bottom of the compartment. These areas
should receive highest attention in a fire containment analysis.
Ensure design of the fire barrier permits ground fire fighting equipment to be used in engine
bays or nacelles.
G.4.4.7.20 Fire barriers.
It shall be verified by analysis and inspection that fire barriers have been provided in all
specified locations. The adequacy of the provided fire barriers should be verified by
___(TBS)___.
done to determine the protection required for the total air vehicle.
TBS: Laboratory, component and ground tests and demonstrations should be used to verify the
adequacy of the provided fire barriers. Unique firewall connectors or passages should be
demonstrated to be satisfactory by actual test. The adequacy of fire barriers is normally
870
JSSG-2009A
APPENDIX G
determined by using the fireproof tests of SAE AS1055. The test fire apparatus per
SAE AS1055 produces a test fire with a heat flux of approximately 10 BTU/ft2/sec. This ideally
simulates the heat flux from a typical JP-8 fire with free convection which is nominally
9 BTU/ft2/sec. Other test fire apparatus such as propane burners only produce heat fluxes up to
6 BTU/ft2/sec and do not provide an adequate materials test. Pressure differential across the
fire barrier should be simulated. These tests will closely simulate a severe in-flight fire and
permit an acceptable assessment of fire barrier material. Worst case conditions (airflow,
location) should be considered and risk acceptance should not be used in determining barrier
requirements.
New spray-on or formed fire barrier materials have proved effective for fire containment which
may negate the need for a stainless steel or titanium shield.
G.3.4.7.21 Fire hardening.
Fire hardening provisions shall be used to protect components or systems which if damaged by
fire, explosion or overheat conditions, would result in an increased hazard or the uncontrolled
propagation of the hazard to other air vehicle compartments. These identified components shall
maintain their functional integrity for ___(TBS)___.
In areas of the air vehicle where it has been determined that fire, explosion, or overheat hazards
can occur, components, devices, or systems which contain flammable fluids, or oxidizer or
reducing agents should be designed or protected in such a way that these components,
devices, or systems will not release the flammable fluids, or oxidizer or reducing agents for a
specified period of time. By protecting these components from failure other hazardous fluids will
not add to the already existing hazard and compound the hazard control problem.
TBS: It is recommended that the provided fire hardening be required to resist the identified
hazard for 5 to 15 minutes. Examples of components or systems to be considered would be
fuel and hydraulic lines or components, oil lines or tanks, and airlines or other components
which contain materials which would compound the hazard if destroyed by the original hazard.
These fire hardening requirements should apply to other flight critical components located in the
hazard area such as flight controls, electrical equipment, and critical structure.
Lines and equipment which carry flammable fluids and are located close to the burner, turbine,
and exhaust sections of the engine should be of the highest possible order of reliability and
should be fireproof. Tubes carrying flammable fluids in or close to a potential fire zone should
be made of stainless steel, or equivalent material. Hoses carrying flammable fluids in or close
to a potential fire zone should withstand a flame of 2000°F for at least 5 minutes without
871
JSSG-2009A
APPENDIX G
leakage, at the lowest fluid flow rate and the highest fluid temperature, and under vibration of
operation. Fittings should have an equal resistance to fire. These requirements of fire
resistance apply also to vent and drain lines, unless a failure of such lines and fittings will not
add to a fire hazard. Hoses for emergency equipment in fire zones should be as fireproof as
possible, and they should be routed and protected, if necessary, so that they are not damaged
by consequence of the failure which started the fire, thereby incapacitating the hoses when they
are needed most.
Shielding of high-pressure hydraulic lines should be considered to minimize the possibility of

hydraulic fluid contacting ignition sources by spray. Hose assemblies should be protected by
shielding or other means against temperatures in excess of the maximum specified allowable
operating temperature for the particular hose.
Oil tanks for auxiliary power plants may be located in their surrounding compartment, but should
be designed to withstand a 2000°F fire for ten minutes without leakage.
Combustion air ducts should be of fireproof construction for a distance sufficient to prevent
damage from backfiring or reverse flame propagation.
G.4.4.7.21 Fire hardening.
It should be verified by analysis, coupon tests per SAE AS 1005 and inspection that fire
hardening as specified has been provided in all specified locations.
done to determine the protection required for the total air vehicle. Laboratory, component and
ground tests, and demonstrations may be used to verify the fire hardening provisions.
SAE AS1055 should be referenced for test methods to determine the capability of items to
withstand fire.
Ensure the actual aircraft configuration is used for testing.
G.3.4.7.22 Smoke and other hazardous vapor control.
Means shall be provided for the protection of the crew and passengers from smoke and other
hazardous vapors that occur within these compartments or enter these compartments from
outside sources.
872
JSSG-2009A
APPENDIX G
The dangers to the health of the crew and passengers presented by smoke, toxic products of
combustion, fire extinguishing agents, fuels, reducing agents and similar vapors indicate a need
to provide the crew and passengers with means of protection from smoke and these vapors.
Provisions should be made to evacuate smoke and fire extinguishing agent and any other of the
noted vapors from crew and passenger compartments. After every discharge of extinguishing
agent in the cabin, cargo or baggage compartment, the crew and passenger compartments
should be ventilated whether or not smoke is present. In the case of a fire, the smoke and
vapors should be evacuated as soon after fire extinguishment as possible. It is desirable that
the cabin ventilation system has capacity sufficient to supply fresh air in quantities great enough
to allow quick purging of personnel compartments. To prevent re-ignition, ventilation should not
be re-established too soon to confined areas, such as lavatories and coat compartments.
Means should be provided to close off airflow between crew and passenger compartments.
Provisions of smoke masks and goggles for crew members should be considered.
Ensure commercial-grade electronics (e.g., laptop computers) that are installed aircraft can
meet the requirements for smoke and hazardous vapor control.
G.4.4.7.22 Smoke and other hazardous vapor control.
It shall be verified by analysis and inspection that means for the control of smoke and other
hazardous vapors as specified has been provided in all specified locations.
demonstrations should be used to functionally checkout and verify the means provided to
protect the crew and passengers from smoke and other hazardous vapors. The use of ground
tests and demonstrations will determine if the provisions work as designed without impacting
flight safety.
Aircraft that are used for passengers or (including VIP aircraft) may have non-military-qualified
equipment installed.
873
JSSG-2009A
APPENDIX G
G.3.4.7.23 Overheat control.
Provisions shall be made to control overheat conditions which are of sufficient temperature to
cause a hazard to the air vehicle.
Overheat hazards, such as leakage of high temperature bleed air or high temperature gases
from an engine or APU can cause serious damage to an air vehicle and various subsystems. If
these hazards can occur, there should be a method of terminating the over-temperature
condition or protecting against the effects of the overheat condition. Uncontrolled overheat
conditions can result in more serious hazards.
When it has been determined that overheat conditions occur in a given area, it should be
ensured that adequate control measures have been incorporated. These control measures
could be shutting off the source of bleed air in the case of a bleed air leak or shutting down an
engine in the case of a hot gas leak from an engine. In some cases it may be possible to
design the equipment or structure to withstand the over-temperature condition.
Certain older air vehicles such as USAF models of the F-4 have extensive high temperature
bleed air systems which do not have an overheat warning system or the capability to shutoff the
bleed air in the event of a leak. There have been several cases of serious accident, destroyed
air vehicles, and crew fatalities which were directly attributed to bleed air overheat conditions
which went undetected and developed into uncontrolled fires.
G.4.4.7.23 Overheat control.
It shall be verified by analysis, inspection, and on-aircraft tests that overheat control as specified
has been provided in all specified locations
demonstrations should be used to functionally checkout and verify the overheat control
provisions. The use of ground tests and demonstrations will determine if the provisions work as
designed without impacting flight safety.
874
JSSG-2009A
APPENDIX G
Overheat control sensors may become part of an integrated mission system on an aircraft and
the integrations should be verified.
G.3.4.7.24 Engine and auxiliary power unit compartment fire extinguishing.
Fire extinguishing systems shall be provided for fire control and termination in the engine
compartment(s) when fire within these engine compartments cannot be controlled and
contained by other lesser means. The system shall provide within the compartment a
concentration of agent sufficient to extinguish any fire within a time duration sufficient to
minimize damage within the compartment and prevent the spread of the fire to other
compartments. This agent concentration shall be maintained within the compartment for a time
duration sufficient to prevent reignition of the fire.
The purpose of this requirement is to establish the need and performance requirements for
engine compartment fire extinguishing.
Fire extinguishing systems should be provided in the main power plant installation of all multi-
engine air vehicles. Fire extinguishing systems are not required in single-engine air vehicles,
except for first procurement of a small quantity of a new model air vehicle.
Spring-loaded fire access doors in main and auxiliary power plants should be provided only if
required by the air vehicle model specification. This door should be in such a position that the
nozzle of a CO2 extinguisher can be thrust against the door, forcing it open, and permitting CO2
to be injected directly into the compartment. The spring should be sufficiently strong to hold the
door shut against air loads. Quick-release latches should not be used. The size of the door
should be 51/2 x 10 inches. The door should be located near the bottom, at a point where
burning flammable fluid cannot drain on the operator of the extinguisher nozzle. The door
should be marked, "Access for Fire Extinguisher." For auxiliary power plants, a door should be
provided if a fixed fire extinguishing system is not provided.
Oil tanks for auxiliary power plants may be located in their surrounding compartment, but should
be designed to withstand a 2000°F fire for ten minutes without leakage.
The use of halons, as well as other halogenated fluorocarbons, was determined to be

associated with the destruction of Earth’s ozone layer. Production of halons was stopped in the
United States by Presidential decree on 1 January 1994, and no new procurements requiring
the use of ozone depleting chemical (ODCs) were allowed by the Department of Defense after 1
July 1993. As a result, the Halon Replacement Program for Aviation was initiated by the U.S.
Air Force in collaboration with the U.S. Navy, Army and the FAA, to develop and demonstrate
the best available substitutes for halons for air vehicle engine nacelle and dry bays applications.
875
JSSG-2009A
APPENDIX G
Under this program, HFC-125 was chosen as the best extinguishant for subsequent
development. Details on the experimental program, test conditions, and results that created the
data used to develop the design model are outlined in WL-TR-95-3077 (SURVIAC TR-95-011),
and associated Phase II and III Wright Laboratory Technical Reports. Reference the AFRL-VA-
WP-TR-1999-3068 (WL-TR-97-SURVIAC-TR-97-028) report for the design model developed to
facilitate the sizing of air vehicle on-board fire protection system with HFC-125.
“ENGINE NACELLES/AUXILIARY POWER UNITS (APUs) HFC-125 DESIGN EQUATIONS,”

an extract from AFRL-VA-WP-TR-1999-3068 (WL-TR-97-SURVIAC-TR-97-028) report, reads:
The engine nacelle is defined as the region surrounding the exterior of the jet engine
case, shrouded by an outer cover, and typically ventilated. Auxiliary Power Units (APU)
are machinery units that provide supplemental, auxiliary, or emergency power to all or
some subsystems of the aircraft.
Limitations: The design formulas has been configured to provide protection for fire
events not subject to hot surface re-ignition, as is consistent with the performance of
existing halon systems. If hot surface temperatures cannot be avoided (such as
insulated bleed air ducts), the duration period required for the design concentration
during certification may have to be expanded to the duration of time that the fuel will be
expected to be in proximity to the hot surface. Under these conditions, the sizing
estimation formula will not be sufficient to assess final sizing requirements.
The sizing formula (used to estimate the expected extinguishant mass required to meet
certification standards) features a quantity Xe/(100-Xe) in the second term of the formula
(Xe being the required concentration of extinguishant), which is not present in the
original halon formulas. This design model process will identify required concentrations
in the range from 14.5 percent (14.5%) to 26 percent (26%), depending upon the
operating conditions.
Two step design formula process:

a. Calculate the design concentration required using the formula E-1, using relevant
values of air temperature, air mass flow rate, and fuel type.
1. If the range of air temperature and air mass flow rate vary considerably in the
flight envelope, several combinations of relevant maximum air temperature and
corresponding mass flow rates should be tried to assure the highest air
temperature and minimum m air mass flow rate will give a conservative worst
case estimate, but could be a slight overdesign.
2. For this formula the values input for maximum air temperature and air mass flow
rate should never be outside the bounds relevant for the formula ((100oF to
275oF) and (0.9- 2.7 lb/sec), respectively). If the actual maximum operating
condition is outside of this bound, the closest extreme value should be used.
The impact on the accuracy of the results has been shown in experiment to be
minimal.
876
JSSG-2009A
APPENDIX G
3. If more than one flammable fluid is present in the engine nacelle or APU (such as
hydraulic fluids or oils), use the highest fuel constant value corresponding to the
fluids present.
4. If a single system protects both one or more engine nacelles and an APU,
calculate the required concentration and corresponding mass for either
application independently, and use the higher of the two mass requirements.
b. Calculate the expected extinguishant mass requirement, using the concentration
calculated in "a.", the volume of fire zone (nacelle or APU) and the actual air mass
flow rate (even if outside the bounds considered in “a.”).
c. Design the extinguishant container capacity consistent with current design practice
and use mass estimates in "b.", for use in design trade-study comparisons and as a
starting point for certification testing.
d. Perform the certification discharge experiments (using existing Halonizer or Statham
analyzer equipment as is used for halon systems to measure concentrations real-
time, but recalibrated for HFC-125), with the criteria being the attainment of the
design concentration calculated in "a." at all measurement points in the nacelle
simultaneously for at least 0.5 seconds.
e. If certification is not met, increase the container capacity or modify the distribution
system to eventually pass certification.
Concentration Xe Estimation Formula:
Equation E-1:
Xe+ 21.10 + 0.0185 AIRT - 3.124 Wa + 5.174 (Fuel Constant) + 0.0023 (AIRT) x (FUEL
CONSTANT) + 1.597 (Fuel Constant)2
Xe: certification design concentration
AIRT (oF): maximum ventilation air temperature in the nacelle or APU during
operations
Wa: internal air mass flow rate in the nacelle or APU during operations
Fuel Constant: coefficient to account for presence of JP fuel, hydraulic fluids, or

oil
The variables ranges permissible for insertion into formula E-1 are:
AIRT 100-275°F
Wa 0.9-2.7 lb/sec
877
JSSG-2009A
APPENDIX G
Fuel Constant
If JP fuel, use 0.3586
If hydraulic fluid, use 0.4053
If oil, use 0
If fire-resistant hydraulic fluid (Skydrol), use 0
(use highest coefficient of fluids present)
Note the following limitations:

a. Evaluate maximum engine nacelle and APU air temperature and corresponding air mass
flow rates at various points in the flight envelope to determine the maximum necessary
Xe (overall maximum air temperature and minimum air mass flow rate in flight can be
used as conservative estimate).
b. If value of actual air temperature or Wa is outside bounds of permissible variable ranges,
then input at allowable extreme closest to actual value (this impact on the effectiveness
of calculated Xe has been shown in experiment to be minimal).
c. If an engine nacelle and APU are both protected with a single system, determine
required concentration and mass separately for both applications independently, then
size for larger requirement.
Concentration duration for certification: All measuring probes should measure at least Xe
simultaneously for a minimum of 0.5 seconds.
Engine and APU Mass Estimation Formula E-2:
The formula E-2 is a theoretically derived formula (not empirical) to estimate the mass of
extinguishant required in storage in a system to pass the certification process with Xe
calculated from E-1. The formula was derived with similar principles to that used for earlier
halon certification, and the formulas are similar in structure. Formula E-2 will calculate
system sizes that will range between 2.3 and 4.3 times the volume of optimally designed
halon systems for identical applications, with a corresponding weight growth ratio only
about 80 percent (80%) of the volume growth ratio compared to a halon system. The
estimated HFC-125 system size and weight may actually be much closer in size to an
existing halon installation, due to the oversizing of many previous halon designs.
878
JSSG-2009A
APPENDIX G
Equation E-2:
MASS(lb) = 0.003166XeV + 4.138 x (Xe /(100-Xe))x W actual
Xe (from formula E-1): engine/APU concentration for certification (Formula E-1)
V: free volume of nacelle or APU (subtracting volume due to internal

components)—ft 3
W actual : actual maximum air mass flow rate (no experimental bounds)—
lb/sec “
In military air vehicles, single engine air vehicles are usually not fitted with fire extinguishing
systems. On some Air Force air vehicles such as the B-52 and KC-135, the engines are located
in pods below the wing and separated from the rest of the air vehicle by a pylon. The engine
compartment is isolated from the pylon with a horizontal firewall. These air vehicles have no fire
extinguishing system installed on the basis that it is improbable that a nacelle fire would be
totally destructive to the air vehicles. There are also other military multiengine combat air
vehicles such as the F-4 which do not incorporate fire extinguishing systems on a calculated risk
basis. However, almost without exception fire extinguishing is provided in all military transport
and cargo-type air vehicle engine nacelles.
Most air vehicle engine installation fire extinguishing systems generally employed a halogenated
hydrocarbon type fire extinguishant (table G-III) because of its greater effectivity and attendant
reduced system weight penalty. Table G-IV illustrates the two types of systems currently in use.
The conventional and high rate discharge (HRD) systems are very similar with the exception of
the method of agent distribution. The HRD system utilized open-end nozzles and relies on the
high velocity of the agent discharge for proper dispersal within the nacelle. Consequently, high
vapor pressure agents such as halon 1301 are best.
suited for HRD applications. In contrast, the conventional system utilized perforated tubing for
agent distribution with consequent penalties of restricted flow and generally higher total system
weight. Low vapor pressure agents such as Bromochloromethane (Halon 1011) (CH2BrC1) are
best suited for the latter application. Dibromodifluoromethane (Halon 1202) (CBr2F2), an
intermediate volatility extinguishant, has been used successfully in both types of systems.
Recently developed air vehicles utilize the HRD type system.
The USAF has had excellent experience with the various halogenated agents. A review of
accidents and incidents over a six-year period (1964-1970) showed that these fire extinguishing
system installations have been more than 90 percent (90%) effective. In cases where the
system has failed, extenuating circumstances were usually involved such as lack of rapid fire
879
JSSG-2009A
APPENDIX G
detection, utilization of improper fire emergency procedures, and mechanically damaged

nacelles.
The use of halons, as well as other halogenated fluorocarbons, was determined to be

associated with the destruction of Earth’s ozone layer. Production of the halons was stopped in
the United States by Presidential decree on 1 January 1994, and no new procurements
requiring the use of ODCs were allowed by the Department of Defense after 1 July 1993.
Halons deplete the ozone layer and are cited for information only.
General: Following shutdown of combustible flow into the protected zone, the extinguishing
system should control and extinguish the fire and control a possible reignition of the fire. The
recommended extinguishing agent for hydrocarbon-air fires is Bromotrifluoromethane
(Halon 1301) (CBrF3) described in ASTM D5632/D5632M. The recommended Halon 1301
concentration and duration is at least 6 percent (6%) by volume in air for at least 0.5 second to
control hydrocarbon-air fires such that damage within the affected compartment is kept to a
minimum, fire spread to other compartments will be prevented, and reignition will be prevented.
These recommendations are based on conditions at normal cruise and may need to be adjusted
for other flight conditions or unusual fire situations. Current agent discharge times are on the
order of 1 second. This may vary between agents, but the idea is to provide the necessary
concentration of agent within the shortest possible time after fire awareness.
a. Quantity of agent: As a design guide, the following formulas may be used to determine
the minimum quantity (weight) of agent to be discharged into each engine:
1. For rough nacelle interior with low airflow and for smooth nacelle interior regardless
of airflow, whichever of the following formulas provides the larger value of W:
W = 0.05V
W = 0.02V + 0.25Wa
2. For rough nacelle interior with high airflow: W = 3(.02V + 0.25Wa)
3. For deep frame nacelle interior with high airflow: W = 0.16V + 0.56Wa .
880
JSSG-2009A
APPENDIX G
TABLE G-III. Physical properties of selected agents.
BROMOCHLORO- DIBROMODIFLUORO- BROMOCHLORO- BROMOTRIFLUORO- DIBROMOTETRA-

CHEMICAL NAME
METHANE METHANE DIFLUOROMETHANE METHANE FLUOROETHANE
Halon Number 1011 1202 1211 1301 2402
Chemical Formula CH2BrC1 CBr2F2 CBrC1F2 CBrF3 CBrF2CBrF2
Molecular Weight 129.4 209.8 165.4 148.9 259.8
Boiling Point, 153.0 73.0 24.8 -72.0 117.3
Atmos. Press., F
Freezing Point, F -125.4 -223.0 -257.0 -282.0 -166.8
Critical Temp., F 567.0 390.0 309.0 153.5 418.0
Critical Press., psia 953. 593. 595. 574. 500.
Critical Density, 5.75 6.96 5.94 6.2 6.58
lbs./gallon
Density at 70 F, 16.1 19.0 15.25 13.1 18.0
lbs./gallon (liquid)
Density at 130 F, 15.4 17.9 14.15 10.4 17.1
lbs./gallon (liquid)
Heat of Vaporization 101.5 50.9 57.6 50.8 45.0
at 760 mm. Press. Btu./lb
Vapor Press. At 130 F 0. 25. 75. 435. 4.
Psig
Vapor Press. At -65 F 0. 0. 0. 2.5 0.
Psig
881
JSSG-2009A
APPENDIX G
TABLE G-IV. Types of air vehicle fire extinguishing systems.

1
SYSTEM TYPE AIRCRAFT Agent AGENT NACELLE NACELLE AGENT TOTAL DISTR.
QUANTITY NET VOLUME WT/SHOT SYSTEM RQMT.
3
FORMULA 1 ft lbs WT COMPLIANCE
lbs
Conventional C-130 CH2BrC1 (Design 1726 61 13.5 60 Motion
Guide) Pictures
B-57 C H2BrC1 1189 42 13.5 52
0.56 Wa +
C-97 CH2BrC1 0.16V 3396 120 33.0 120
2
High Rate DC-9 CBrF3 W = 0.05V 3679 130 8.4 37.1 Agent
Discharge Or Concentration
W = 0.02V + Analyzer
C-141 CBr2F2 0.25 Wa 3255 115 7.0 72
C5-A CBr2F2 (Whichever is 3934 139 7.5 87.2

greater)
1
V = Net volume of zone in cu. ft.
Wa = Air flow (normal cruise) in lbs/sec.
2
Includes APU and both engines
Where: W = Weight of agent in pounds

Wa = Pounds of air per second passing through the zone at normal cruising
condition
V = Net volume of the zone in cubic feet (gross volume of the zone less the
volume of major items of equipment)
b. Definitions:
1. Low airflow signifies airflow rate of 1 pound or less per second at cruise
2. High airflow signifies airflow rate exceeding 1 pound per second at cruise
3. Smooth nacelle denotes no circumferential ribs protruding into nacelle
4. Rough nacelle denotes circumferential ribs protruding less than 6 inches into nacelle
5. Deep frame nacelle denotes circumferential ribs protruding 6 inches or more into
nacelle or nacelle configuration with cavities 6 inches or more in depth (measured
transversely)
For potential fire zones not located in nacelles, the formula of "1." may be used.
Where long discharge lines are used, an increase in the value of W obtained in the formulas
may be required in order to compensate for agent lost in wetting the discharge lines.
Include the location of system, location of agent storage containers, agent quantity, agent,
system actuation method, type of compartment (fuselage, wing, nacelle), material selection, and
environmental conditions at system locations.
Development of engine fire extinguishing equipment for the protection of air vehicle in flight
parallels air vehicle development. The need for fire extinguishing systems is reflected in these
legacy Air Force Design Handbooks and Military Specifications: AFSC DH 1-6, AFSC DH 2-2,
882
JSSG-2009A
APPENDIX G
AFSC DH 2-3, MIL-I-83294, and MIL-E-22285. Military Specification MIL-E-22285 requires the
use of Ozone Layer Depleting Substances and is cited merely for illustration.
The Solid Propellant Gas Generator (SPGG) is a viable alternative to halon for in-flight fire
suppression. SPGG technology relies upon the controlled burning of solid reactants to produce
inert gases such as CO2, N2, and H20. Additionally, chemical flame inhibitors can be added to
the propellants to enhance their extinguishing efficiency. SPGG is a non-ozone depleting fire
suppression technology and it has many advantages over typical liquid fire extinguishing agents
that are commonly stored in pressurized bottles. For instance, SPGG systems do not require
periodic hydrostatic testing, and large volumes of gas are conveniently stored by the reactants
in a solid form. Moreover, the mass flow rate of the SPGG discharge can be tailored to increase
system effectiveness in preventing hot surface re-ignition.
The SPGG technology is limited by the high temperature of the discharge gases. The high
temperatures necessitate cooling of the discharge gases and insulation of the distribution lines.
If these actions are not taken, the distribution lines may melt and they could become potential
ignition sources for leaking fuel. Furthermore, hot distribution lines have a tendency to increase
in length during generator discharge, and an inadvertent actuation of the system could pose a
hazard to maintenance personnel. Remedies for these limitations have been developed, but
they have all contributed to a more complex system design that results in increased cost and
weight. Additional concerns include the high cost of qualification and a high life cycle cost. The
SPGG propellants are based on automotive airbag technology but they are not produced in high
volume. Also, present designs requires that the squib be an integral part of the generator,
thereby limiting the life of the generator to the life of the squib. Moreover, particulate in the
exhaust of the generators could be a concern from a clean up and corrosivity point of view.
Since the extinguishing mechanisms are not well understood, a metric for sizing SPGG systems
has not been developed, and if such a metric is developed, it is likely to be different for each
different propellant and propellant manufacturer. More development testing of SPGG is required
to refine the understanding of the extinguishing mechanisms and provide better insight into how
to design an SPGG system and incorporate it into an airframe. Limited development testing of
this technology have been accomplished by Air Force Research Laboratory Flight Dynamics
Directorate’s Vehicle Subsystems Division. All testing data and recommendations will be
documented in two technical reports. The first was drafted by Battelle Memorial Institute and
scheduled for completion on 25 November 1997. This report is a comprehensive assessment
and description of the test program and the data collected. The second report was drafted by
the National Institute of Standards and Technology. This report concentrates on an analysis of
the data collected in an effort to provide insight into the extinguishing mechanisms of the gas
generator. This report was due on 15 November 1997. All reports will be available through the
Defense Technical Information Center (DTIC).
The Navy has also conducted substantial SPGG development testing for application on the F/A-
18E/F engine bay fire extinguisher system.
G.4.4.7.24 Engine and auxiliary power unit compartment fire extinguishing.
It shall be verified by analysis and inspection that fire extinguishing systems have been provided
in all specified locations. It should be verified by ___(TBS)___ that the systems will produce
and maintain an agent concentration as required.
883
JSSG-2009A
APPENDIX G
The lack of this control method in a required location or an inadequacy in a provided system or
equipment will result in uncontrolled fire damage to the air vehicle.
ground and flight tests and demonstrations may be used to verify the adequacy of the provided
fire extinguishing system(s). Under actual or simulated cruise condition or at some other
preferred flight condition, the system should be discharged and agent concentration and
duration goals should be verified by use of an appropriate method of measuring agent
concentration (such as the Statham Analyzer).
TBS: Through use of the Statham Analyzer, it is possible to determine agent concentration and
duration and establish adequacy of the fire extinguishing system without the need for fire
testing. In addition, the fire extinguishing system can be tailored to the installation to provide a
minimum weight system.
When conducting verification tests that require discharge of a fire suppressant ensure all
regulatory and environmental requirements have been met.
G.3.4.7.25 Habitable compartment fire extinguishing.
Provisions shall be made for the extinguishing of fire in habitable compartments of the air
vehicle when the fire hazard therein cannot be controlled by lesser means.
a. When a total flooding fire suppression system is used, the system shall provide within
the compartment a concentration of agent sufficient to extinguish any fire within a time
duration sufficient to minimize damage within the compartment, minimize the production
and spread of smoke and toxic vapors within the compartment and prevent the spread of
the fire to other compartments. This agent concentration shall be maintained within the
compartment for a time duration sufficient for the crew to perform any necessary
additional corrective actions. The agent, in its use concentration range, shall not present
a toxic hazard nor interfere with vision.
b. When portable fire extinguishers are used, they shall be in accordance with BB-E-2879.
The quantity and placement of extinguishers per compartment shall be in accordance
with ___(TBS)___.
The intent of this requirement is to establish the criteria for the systems and equipment to be
provided for habitable compartment fire extinguishing.
884
JSSG-2009A
APPENDIX G
If the respective Service maintains an Occupational Safety and Hazard Standard for fire
extinguisher placement and quantity, the TBS should be replaced with the reference.
Habitable compartments are considered fire zones when combustible materials are used in the
furnishings or lines or equipment containing materials, which can participate in fire or explosion,
are located therein. Materials less fire-resistant than aluminum alloys should not be used where
ambient temperatures exceed 500°F. Materials used for cabin interiors should not ignite
spontaneously at the highest temperatures of installation, or at temperatures lower than 140°F,
and they should be self-extinguishing after removal of the flame. Whenever possible, cabin
interior finish materials should be those which produce the smallest amount of toxic gases when
burned or decomposed by heat. Fabrics of vegetable, animal, and synthetic textile fibers and
plastics should not be used where ambient temperatures exceed 250°F.
Crew smoking is considered a most likely source of ignition, thus berths should be placarded
against smoking. Compartments where smoking facilities are not provided should be placarded
against smoking. If provided, smoking facilities should be in the form of an adequate number of
fireproof, self-contained, removable ash receptacles with covers.
The habitable compartment fire zone definition should consider paper and other materials and
supplies the crew will be required to have to perform a normal mission. The amount of these
materials, equipment, and supplies or the size of the compartment may require fire
extinguishing provisions to control adequately the possible fire hazards that may occur. The
control provisions may be either total flooding (system), portables (fire extinguishers), or a
combination of both. Compartment size is a major deciding factor in the make-up of the
provisions. Considerations for each type of protection are as follows:
a. Total flooding is an extension of the engine type fire extinguishing system with limits on
the maximum concentration of agent in habitable compartments to protect personnel.
The usual system for total flooding uses Bromotrifluoromethane (Halon 1301) at
6 percent (6%) by volume for various time duration depending on the hazard. The
system on the C-5 air vehicle maintains this concentration for five minutes. Additional
guidance is given below:
1. Function: Active: Fire extinguishment in crew, passenger, cargo, avionics, and other
enclosed compartments.
2. Configuration: Radiation detector or thermal detector and fire extinguisher agent
container(s), dischargeable by squib, containing Bromotrifluoromethane, both placed
inside the compartment to be protected. The remainder of the system incorporates
control and test panels and necessary wiring.
3. Principle of Operation: The flame or the heat buildup triggers the detector(s) which
activates a warning light on the panel(s). Then, agent can be manually or
automatically discharged in the selected zone.
4. Application Constraints: Use this type of system where there is a fixed enclosure
about the hazard that is adequate to enable the required concentration to be built-up
and maintained for the required period of time to ensure the effective extinguishment
of the fire in the specific combustible materials involved and for the crew to perform
any necessary additional corrective actions. Use concentration of less than 10
percent (10%) by volume to prevent toxic hazards to personnel. Six percent (6%) by
885
JSSG-2009A
APPENDIX G
volume of Halon 1301 will extinguish most flammable solids and gases. Obtain
latest design details from: AFLCMC/EZFA, WRIGHT-PATTERSON AFB OH 45433-
7017 USA; AFLCMC.EZF.MAILBOX@US.AF.MIL.
5. Performance: Excellent method for fire extinguishment in a closed compartment,
where an electrically nonconductive medium is essential or desirable and a clean
agent is needed.
6. Penalties: Weight from the standpoint of an airborne system; however, if an
extinguishing system is needed, Halon 1301 has the best weight vs. extinguishing
potential.
7. Weight: .03 - .08 lbs/cu ft
8. Availability: Well developed systems for total flooding systems are available. These
systems are very similar to engine compartment fire extinguishing systems which
have considerable service experience.
9. Maintainability: System requires thorough inspection and checkout, including
container periodic weight and pressure check.
b. Portables should be procured to an existing specification for flight qualified units.
Portable fire extinguishers for existing and new Navy air vehicles should contain carbon
dioxide as the fire extinguishing agent and be procured to BB-E-2879.
Include the location of system and portables, location of agent storage containers and portables,
agent quantity, agent, system actuation method, type of compartment (cockpit, crew, troop,
cargo), size of compartment, hazards within compartment, material selection, and
environmental conditions at system and portable locations.
Total flooding systems should be designed so that their operation does not present hazards to
the crew or to other personnel. Portable fire extinguishers should contain sufficient agent to
combat incipient fires and should have a spray pattern and effective agent throw range suited to
the hazards to be protected against and the compartment size. The agents used should not
reduce visibility upon discharge and should not cause mechanical problems, be corrosive, or
electrically conductive.
Wood and plywood used for cabin interiors should be permanently covered with a flame-
resistant material. Textiles that are used for upholstery, floor covering, and interior trim, which
are made flame-resistant by treatment, should not lose their flame-resistant quality after dry
cleaning or laundering. If treated textiles are used which lose flame resistance with age, or dry
cleaning, or laundering, suitable safe maintenance requirements should be given in the
applicable Maintenance Instruction Manual. Treatment of materials of any kind (coating,
doping) should not impair the flame resistance qualities of material used in habitable
compartments. Nitrate dope should not be used in cabin interiors.
Storage facilities provided for storage of blankets, pillows, magazines, and newspapers should
be located and designed so that the contents will not be ignited by light bulbs, matches, or
cigarette ashes. Blankets are acceptable without treatment if they contain a minimum of 95
percent (95%) wool. Closely-woven, short-napped textiles are superior. Fire resistant
containers for waste material should be made of aluminum alloy or other material with
equivalent fire barrier qualities.
886
JSSG-2009A
APPENDIX G
G.4.4.7.25 Habitable compartment fire extinguishing.
It shall be verified by analysis and inspection that provisions have been made for the
extinguishing of fire in habitable compartments of the air vehicle.
done to determine the protection required for the total air vehicle. Laboratory, component, and
ground tests and demonstration may be used to verify the fire extinguishing provisions.
(TBD)
G.3.4.7.26 Non-habitable compartment fire extinguishing.
Provisions shall be made for the control and termination of fire in all non-habitable
compartments of the air vehicle (other than engine), when fire within these compartments
cannot be controlled and contained by lesser means. Provisions shall address whether fire in
such compartments is or is not accessible in flight. Systems for compartments that are not
accessible in flight shall provide within each compartment a concentration of agent sufficient to
extinguish any fire within a time duration sufficient to minimize damage and prevent the spread
of the fire to other compartments. This agent concentration shall be maintained within the
compartment for a time duration sufficient to prevent reignition of the fire.
The systems used for non-habitable compartment of an air vehicle can be just as hazardous as
uncontrolled fire in engine compartments. The location, size, or usage of a non-habitable
compartment may disallow access or make impractical the application of lesser means of fire
control.
Non-habitable compartments such as baggage and cargo compartments should be completely

lined with fire resistant material such as aluminum alloy or other material with equivalent fire
barrier qualities. Consideration should be given to the effect of heat within non-habitable
compartments on adjacent parts of the air vehicle.
If a fire is easily discernible and is accessible in flight, a hand fire extinguisher for each non-
habitable compartment such as baggage and cargo compartments should be provided.
887
JSSG-2009A
APPENDIX G
If sufficient access to non-habitable compartments such as baggage and cargo compartments is

available in flight to extinguish a fire with a hand fire extinguisher, but a fire is not easily
discernible, a separate system of smoke or fire detectors for each compartment, and a hand fire
extinguisher readily available for each compartment, should be provided. No hazardous
quantities of smoke, flames, or extinguishing agent should enter crew or passenger
compartments when access to the non-habitable compartment is opened.
If the fire is not easily discernible and is not accessible in flight, separate systems of smoke or
fire detectors for each non-habitable compartment, and a built-in, total-flooding fire extinguisher
system should be provided. Agent containers for built-in systems should not be located within
baggage or cargo compartments. No hazardous quantity of smoke, flames or extinguishing
agent should enter the crew or passenger compartments. Ventilation and draft within each non-
habitable compartment should be controlled so that fire extinguishing is effective. The total
flooding fire extinguishing systems used for non-habitable compartments may be variations of
the halon agent systems used for engine compartments or may be liquid nitrogen (LN2)
systems. These systems may be applied to fuel tank dry bays, electronic bays, electrical supply
bays, or ancillary power units. For LN2 systems, which are an extension of the fuel tank inerting
system, agent concentration is measured by the effect the nitrogen has in reducing the oxygen
level within the compartment. This type of system is designed to flood the compartment and to
lower the oxygen level to 10 percent (10%) or less in the time duration necessary to cope with
the particular fire hazard. LN2 systems are not recommended for habitable compartments.
Additional guidance is given in below:
a. Function: Active: Fire extinguishment in unmanned compartments of the air vehicle.
b. Configuration: Liquid nitrogen for these compartments is supplied from the on-board LN2
inerting system tank.
c. Principle of Operation: When a fire is detected in one of the unmanned zones, a
corresponding alarm zone light comes on. Nitrogen is fed into the selected compartment
to reduce the oxygen concentration to levels which will not support combustion.
d. Application Constraints: This system would normally be used only when LN2 is available
on-board from the LN2 fuel tank inerting system. Design the system: (a) to provide
sufficient LN2 flow to lower the oxygen concentration in the protected zone to 10 percent
(10%) or less in ten seconds, and (b) so that the nitrogen discharge will not result in
pressure above the design limit of the compartment. Obtain latest design details from
AFLCMC/EZF, WRIGHT-PATTERSON AFB OH 45433-7017 USA;
e. Weight: .1 - .5 lbs/cu ft (Nitrogen only)
f. Penalties: Logistics problems of LN2, however if LN2 is available for fuel tank inerting, it
will be available for fire fighting.
g. Availability: Valving and system components are similar to those used in LN2 inerting
system.
h. Maintainability: Required maintenance is compatible with that performed on typical fuel
and vent systems.
If a fire can be completely confined without endangering the air vehicle or the occupants, no
detector or extinguishing system should be required. However, flame, smoke, and noxious
gases should not enter crew or passenger compartments in hazardous quantities. Ventilation
888
JSSG-2009A
APPENDIX G
and draft within the baggage and cargo compartments should be controlled. Ventilation and
draft airflow through such compartments should not exceed three cubic feet per hour per cubic
foot of volume and should preferably be less. For larger compartments, lesser airflow may be
applicable.
For air vehicles used exclusively to transport cargo, separate systems of smoke or fire detectors
should be provided. Means should be provided to shut off the ventilating airflow to or within the
compartment. No hazardous quantities of smoke, flames, or extinguishing agent should enter
the flight crew area.
Portable fire extinguishers for existing and new Navy air vehicles should contain carbon dioxide
as the fire extinguishing agent and be procured to BB-E-2879.
Include the type of compartment, in-flight accessibility, location of system, location of agent
storage containers, agent quantity, agent, system actuation method, material selection, and
environmental conditions at system location.
A fire incident on a cargo air vehicle equipped with a LN2 fire fighting system indicated a need
for fireproof extinguisher discharge line. The use of aluminum lines in this application was
based on weight consideration, early detection, and timely agent discharge. In this case the fire
burned a large opening in the compartment and the nitrogen was not fully effective. Early
detection by optical means with automatic agent discharge may be necessary in some zones.
In fire zones the standard practice has been to make tubing and nozzles fireproof to ensure
discharge of the agent at specified locations.
Re-entry of exhaust gases into wing cavities may occur on installations with engines mounted
on the wing. Gases may travel spanwise under some flight conditions. The wing cavities
should be analyzed for potential fire hazards and for hazardous deterioration of structural
material, and appropriate protection should be provided.
The occurrence of ignition and sustained burning within baggage is very unlikely. Generation of
moisture and inert gases during the smoldering action within baggage may cause any fire to die
out, or many hours will probably pass before even a small open flame results. The probability of
continued burning is further reduced by increased altitude, decreased air temperature,
increased relative humidity, and increased density of clothing pack. Increasing velocity of air
passing over baggage containing fire increases the burning rate of the fire. The degree of
increase depends on the compactness of the baggage.
G.4.4.7.26 Non-habitable compartment fire extinguishing.
It should be verified by analysis, inspection and test that fire extinguishing systems have been
provided in all specified compartments. It should be verified by ___(TBS)___ that the systems
will produce and maintain an agent concentration as required.
889
JSSG-2009A
APPENDIX G
TBS: The required analysis and inspection should be part of a fire and explosion hazard
analysis done to determine the protection required for the total air vehicle. Analysis, and
laboratory, component, and ground tests and demonstrations should be used to verify the fire
extinguishing provisions. Fire tests of the LN2 system should be run in a compartment that is
sized to be similar to the air vehicle component. The detection system should be used to signal
for activation of the nitrogen flow. Lines sizes, flow rates, and flow duration of the LN2 system
should be replicated for tests.
Performance of the LN2 fire extinguishing system can best be assessed by actual fire tests at
this time. A multiprobe oxygen analyzer with rapid response is needed to substitute for fire
tests.
G.3.4.7.27 Explosion suppression.
Areas containing or adjacent to those containing flammable fluids which are not designed to
withstand overpressures that may result from combustion reactions shall be provided with
explosion suppressive systems either when prevention designs are not sufficient, practicable or
the most efficient means of providing the required overpressure protection, or in accordance
with ___(TBS 1)___. Both active, automatically operating systems and passive systems may be
provided. When provided, explosion suppression system(s) shall comply with the following
requirements:
a. System characteristics (type and size) shall be based on the highest expected energy-
level mission-related ignition source.
b. The system shall be fully functional and provide required performance during the
following phases of ground or flight operations: ___(TBS 2)___.
c. Pressure increases that may result from combustion reactions of flammable fluids which
are contained within or may enter the protected areas shall be limited to levels which will
not cause damage to the protected area (compartment, system, or air vehicle structure).
The structural pressure limit shall be determined by _(TBS 3)_.
d. The system shall prevent subsequent reactions.
The intent of this requirement is to establish the need for explosion (combustion reaction
overpressure) suppression system(s) and to establish the criteria applicable to these systems.
TBS 1: (TBD)
TBS 2: (TBD)
TBS 3: (TBD)
890
JSSG-2009A
APPENDIX G
Explosion suppression systems have been used to prevent catastrophic fuel tank explosions
and destruction of the air vehicle. Less complex means (fire and explosion hazard prevention
designs) should first be investigated and proven not to be the best means of providing this
protection. Also, the basic air vehicle compartments, equipment’s and systems should be
designed so that under normal operating conditions, explosion suppression systems are not
required.
Usually, the requirements for an explosion suppression system are based on survivability and
vulnerability considerations. In a few cases, non-combat air vehicle may require the protection
provided by an explosion suppression system. For example, supersonic air vehicles, such as
the SR-71, have a fuel tank inerting system because of the high skin and fuel tank wall
temperatures generated during supersonic flight. It may be desirable to protect the fuel tanks of
certain, high value and critical resource air vehicles (C-5, for example) as an extra precautionary
measure. If the requirement for explosion suppression is know to exist prior to conducting the
various analyses, the requirement may be so stated.
System criteria should be based on experience with present and past systems. The factors
which most influence system characteristics are ignition source, the protected fluids, and
required operational capability. The suppressing media and its method of usage, along with the
allowable maximum overpressure, should be described for both active and passive systems.
Based on system operational or hazard analysis, it should be specified when the explosion
suppression system is required to be placed in use. On some air vehicles, the fuel system may
require full-time protection while other air vehicles may only require protection during particular
operational or mission conditions. Active systems require a description of desired crew displays
and controls.
Include the hazard to be protected against, type of system, locating of system, suppressing
media, method usage, system actuation method (if used), type and size of protected area,
material selection, detection system characteristics (if used), and environmental conditions at
system location. Consider overhaul periods, and maintenance cost and service.
The invention of explosion suppression was initiated by an obvious need for the protection of
fuel tanks in combat air vehicles. The vast majority of air vehicles which presently have fuel
system explosion protection capability are combat air vehicles protected with reticulated foam
which was developed and widely used during the war in Southeast Asia (SEA). A limited
number of air vehicles such as the C-5 and SR-71 are protected with a nitrogen inerting system.
The F-16 uses halon fire extinguishing agent to inert the fuel tanks.
An explosion is caused by the combustion of fuel and heating of air which causes a rapid
increase in pressure inside the compartment or fuel tank. Explosion protection has been
provided by preventing or limiting the amount of fuel which can burn, or the release of energy
due to heating, through oxygen dilution, heat absorption and chemical flame quenching
techniques. Nitrogen inerting, passive baffle and chemical inerting or suppression systems are
approaches currently employed. Fuel slosh and agitation (over-enrichment) and fuel additives
(fuel alteration) have not been used much beyond the R&D test phase.
The allowable structural pressure limits should be determined by test or conservative analysis.
The allowable overpressure should be known before the explosion suppression system
characteristics can be determined. Also needed is identification of the protected fluids and of
891
JSSG-2009A
APPENDIX G
the possible ignition sources since these can be a factor in determining the needed suppressing
media. Ignition source determination should be used on hazards analyses, survivability-
vulnerability studies, or other operational requirements and should consider all possibilities
(electrical arc, lightning, 50 cal. API, 23 mm High Explosive Incendiary Tracer (HEIT)).
The nature of the ignition source, size, energy, and number of ignition sources can have an
influence on the design of the selected explosion suppression system. The energy and number
of ignition sources will increase the rate of pressure rise of the combustion process. For
chemical flame quenching (inerting) systems using halon fire extinguishing agent, the energy of
the ignition source affects the concentration of agent required to prevent the maximum
allowable compartment pressure rise from being exceeded. For chemical flame quenching
(suppression) systems (which use fast reaction detection and extinguishing agent discharge
systems) multiple ignition sources may require faster acting detection and agent discharge
systems to prevent the maximum allowable compartment pressure rise from being exceeded.
The following considerations are particular to each of the four types of systems presently in use:
a. Oxygen dilution systems. The dilution of a potentially explosive atmosphere by an inert
gas is an effective means of eliminating the fire or explosion hazard. This approach
utilizes an inert gas such as nitrogen to reduce the oxygen concentration to a level that
will not support the normal combustion process. Data generated under natural or
combat-induced ignition sources (gunfire) indicates that for most applications,
maintaining the oxygen concentration below the nine volume percent level will preclude
the damaging combustion overpressures. The inerting concept has been successfully
demonstrated on both commercial and military air vehicles and the entire fleet of C-5A
air vehicles has been retrofitted with inert gas protection based on a stored LN2 system.
The C-5A inerting system converts the stored LN2 to gas prior to the introduction of the
nitrogen into the fuel system. The nitrogen is released either into the fuel or the ullage.
The bubbling of the nitrogen through the fuel serves two functions. First, it scrubs
(removes) the dissolved oxygen that would be released during flight, and second, it
improves the thermal stability of the fuel. The control of the rate and size of the nitrogen
bubble is critical to ensure that the oxygen is removed (nitrogen scrubbing requires
droplet size in the order of 2.5 mm (0.10 inch diameter). The oxygen rich gas is swept
out of the ullage and through the vent system. Make-up nitrogen required by fuel usage
or altitude changes is provided via the vent system. Typical design considerations for
LN2 inerting systems are described below. A LN2 system is used on the SR-71 air
vehicle.
1. Design.
(a.) Nitrogen inerting system: The nitrogen inerting system should be completely
automatic and should require no attention from the flight crew during flight
except for the monitoring of high and low fuel tank pressure indicator lights.
The system should prevent explosions and fire by maintaining the oxygen
concentration of the ullage space below the level of 9 percent (9%). The
nitrogen may also be made available for fire extinguishing in other areas of the
air vehicle.
(b.) Configuration: Fuel and vent systems should be closed systems for nitrogen
inerting. Dry bays need not be closed, but should be designed for minimum
nitrogen usage.
892
JSSG-2009A
APPENDIX G
(c.) Inerting gas: The nitrogen gas used for inerting should be stored onboard the
air vehicle in the liquid form and converted to gas as required. The liquid
nitrogen should comply with A-A-59503 or A-A-59155.
(d.) Self-Generating inerting gas: If exhaust gas is used as the inerting agent, a
flame arrestor should be used to prevent flame from entering the fuel tank and
a check valve should prevent flow of fuel or fuel vapor into the inerting gas
supply system. The temperature of the inerting agent at the tank entrance
should not exceed 120°F. The inerting gas, when entering the fuel tanks,
should be free of harmful amounts of water, corrosive material, and materials
which contaminate the fuel or fuel system. The gas should not adversely affect
the pumpability, burning, and electrical characteristics of the fuel.
(e.) Nitrogen storage: The liquid nitrogen should be stored in lightweight dewars.
The dewar assembly should include a pressure relief valve and a blowout disc.
The heat transfer characteristics of the dewar should be the minimum
practicable without sacrificing necessary strength and rigidity. There should be
no leakage from the dewar. The dewar should have a quantity and pressure
readout capability.
(f.) Capacity: The capacity of the liquid nitrogen dewar should be adequate to
supply nitrogen gas for inerting for the duration of a mission or, if specified by
the procuring activity, for two or more missions. A reserve should be provided
that will supply nitrogen gas for inerting an unattended air vehicle for a
minimum of 48 hours after completion of the missions without reservicing.
Provisions for growth capability should be incorporated as specified in the air
vehicle system specification.
(g.) Operation: Nitrogen gas should dilute the oxygen content below 9 percent
(9%) in all ullage and vent spaces and maintain a slight positive pressure at all
times for all operating conditions to prevent the entrance of air. The nitrogen
should fill the volume as fuel is used by the air vehicle.
(h.) Entrained air: The nitrogen inerting system should remove oxygen from the air
entrained in fuel to prevent the oxygen concentration from exceeding 9 percent
(9%) during increases in altitude. This method should not include the use of
ground equipment.
(i.) Pressurization: Nitrogen gas should pressurize the ullage and vent spaces
during decreases in altitude to maintain a safe differential pressure between
the tanks and ambient.
(j.) Ground: The nitrogen inerting system should maintain inerted ullage and vents
while no electrical power is applied to the air vehicle and the air vehicle is
unattended.
(k.) Damage: The nitrogen inerting system should maintain inert ullage and vent
spaces with no electrical power applied for a minimum of 5 minutes with a 100
square inch hole in any one fuel tank.
(l.) Pressures: At no time should the positive or negative pressures in the fuel
tanks and vents exceed the design pressure limits of the air vehicle, regardless
of the failure of any component. In the event that the supply of nitrogen is
depleted or that a malfunction or pressurization occurs, the inerted areas
should vent to ambient.
893
JSSG-2009A
APPENDIX G
(m.) Malfunction: Crew override controls should be provided to vent the tank and
shut off the inert gas supply.
(n.) Servicing: The system should be serviced through a single-point, dry-break,
quick-disconnect coupling. The coupling should be for liquid nitrogen only and
it should not be possible to connect any other liquid gas servicing coupling.
The system should be capable of receiving nitrogen at a minimum rate of 10
gallons per minute (gpm) at pressures from 40 to 150 psig. The servicing
connection should be accessible from the outside of the air vehicle, and the
instrumentation necessary for servicing (such as quantity and dewar pressure
gages) should be visible from the servicing coupling. A cover should be
provided to protect the coupling when not in use.
(o.) Nitrogen inerting system components: Components of the nitrogen inerting
system should comply with applicable specifications.
(p.) Vent valves: Vent valves should control internal tank pressure within the limits
of the air vehicle.
(q.) Checkout panel: A panel should be provided to test all phases of the inerting
system for proper operation during preflight checkout. Indicator light(s) should
be provided on the panel to signal when the vent valves have allowed air to
enter the system.
(r.) Gas analyzer: A means should be provided as a part of the air vehicle to verify
that the fluid serviced to the nitrogen inerting system is an inert gas.
(s.) Redundancy: Redundancy of components should be incorporated as
necessary to ensure a fail-safe system.
2. Test.
(a.) Nitrogen inerting system tests: The operation of the nitrogen inerting system
should be demonstrated for each required mission profile to verify that the
quantity of nitrogen is adequate and that the oxygen concentration of the
inerted space never exceeds the 9 percent (9%) limit. Also, the pressure in
each tank should be measured and recorded during maximum rate of climb
and descent with the nitrogen inerting system operating.
(b.) A failure effect demonstration test program should be conducted based upon
the results of failure analysis studies. Only those failures where a reduced
level of performance may occur or where special crew attention or control
techniques are required need be demonstrated. When the failure effect has
been demonstrated during subsystem tests, the test need not be repeated;
however, the previously conducted failure demonstrations should be described
in the failure analysis report.
(c.) Nitrogen inerting components: The nitrogen inerting system components
should be tested in accordance with approved contractor specifications.
(d.) Dewar holddown test: Before first flight it should be demonstrated that the
holddown fixture for the dewars can withstand the specified loadings.
Advanced inerting concepts under development will be self-generating. This will
eliminate the need for replacement of the nitrogen as required by the LN2 system. Two
potential concepts are promising, a permeable membrane system and a molecular sieve
system. These systems generate inert gas onboard the air vehicle by separating oxygen
894
JSSG-2009A
APPENDIX G
and nitrogen from the air. Both systems are in the development phase for air vehicle
use, but are being used in commercial applications for N2/O2 separation.
b. Heat absorption systems. The use of baffle material to quench the initial combustion
reaction flame front has proven to be an effective method of explosion suppression.
Overpressure damage to air vehicle fuel tanks and cavities is prevented by controlling
the rate of burning after ignition of the fuel vapors. Control is accomplished through the
removal of energy from the combustion process by the absorption of heat and by
mechanical interference of the baffle material. The reduced burning rate results in lower
combustion overpressure within the fuel tank and provides time for overpressure to relax
within the fuel tank and to be vented through the fuel tank vent system.
The baffle material generally used by the U.S. Air Force is a flexible, reticulated,
polyurethane foam which conforms to MIL-PRF-87260. Types I and II (coarse pore) and
type III (fine pore) are polyether foams. Type IV (coarse pore) and type V (fine pore) are
polyether foams. Type IV is intended for use in previous types I and II applications.
Type V is intended for use in previous type III applications. The foams are intended for
use in a temperature range of -30 F to +160 F (+135 F for polyester) with intermittent
temperatures not to exceed +200 F.
Three additional characteristics of importance to the herein intended usage are weight,
fuel displacement, and fuel retention. At a nominal foam density of 1.3 lb/ft3, the foams
weigh 0.18 lb/gallon of volume. Fuel displacement by the foam is the same for both fine
pore and coarse pore at 2 percent (2%) (nominal) by volume. In respect to fuel
retention, the amount of fuel which will be retained on the surface of the foam, and is no
longer usable to the air vehicle, is 4 percent (4%) (nominal) by volume for the fine pore
foam and 2 percent (2%) (nominal) by volume for the coarse pore foam.
A fourth additional characteristic of importance herein is volume swell upon exposure to
fuel. The actual amount of swell is dependent upon the percentage of aromatics in the
fuel. Past foam usage with available jet fuels has disclosed a fuel swell factor of up to
5 percent (5%) (nominal) for the polyester foams (types I, II, and III) and fuel swell
factors from 10 percent (10%) to 20 percent (20%) for the polyether foams (types IV and
V).
Two other types of baffle material are expanded metal mesh and fibrous nylon material.
Two reports on testing of the metal mesh material by the Air Force Research
Laboatory’s Propulsion Directorate are available: AFWAL-TR-80-2031 and AFWAL-TR-
80-2043.
Described below are typical design considerations regarding baffle material usage for
explosion suppression in Air Force air vehicle fuel tanks. Reticulated foam has been
used on several air vehicles, including the A-7, A-10, F-15, and C-130.
1. Design: Baffle material used in the fuel subsystem should comply with
MIL-PRF-87260 and should be installed in accordance with the installation criteria
provided by the procuring activity. The baffle material should not degrade the
performance of the fuel subsystem beyond the limits specified in the fuel subsystem
detail specification. The fuel subsystem should meet all the performance
requirements with or without the baffle material installed, excluding the explosion
protection provided by the baffle material. It should be possible to remove the baffle
material from the tanks and operate the air vehicle without removing or adding any
other hardware. For example, bladder tanks should be designed for sufficient
support without the baffle material installed. Any components fastened in the tank
895
JSSG-2009A
APPENDIX G
because of the baffle material should be sufficiently tested to verify that these
components can be retained if the baffle material is removed. For example, if vent
guards are placed at vent openings to prevent the baffle material from getting into
the vent openings, these guards should be subjected to vibration tests without the
baffle material in place. The baffle material should be included in all specified
simulator and ground and flight tests. Testing of components should be conducted in
the most severe condition. The baffle material acts as a slosh and vibration
attenuator, therefore, slosh and vibration tests for components should be conducted
without the baffle material installed.
2. Test: There are no specific simulator tests for the baffle material; however, the fuel
subsystem should be monitored during all testing to determine any detrimental
effects on the subsystem caused by the baffle material. Reference should be made
to procuring activities’ installation criteria.
c. Chemical flame quenching (chemical extinguishant inerting systems). The provision for
fuel tank explosion protection by using a halon fire extinguishing agent to inert the fuel
vapors has recently been applied to the F-16 air vehicles. The agent is dispensed at the
option of the pilot. Additional agent is bled in to keep the agent concentration at the
proper level.
d. Chemical flame quenching (chemical extinguishant suppression systems). This type of
system is presently used on the 707 air vehicles for surge tank lightning strike protection
and on the ALL air vehicles to protect the device compartment. Additionally, several
military air vehicles were equipped with this type of system in the 1950s. The British
developed this type of system which consists of extremely sensitive pressure or flame
detectors which sense an impending explosion and cause discharge of an inhibiting
agent. This agent suppresses the explosion before the pressure can reach a dangerous
level. The theoretical pressure resulting from a vapor-phase explosion is independent of
the size of the tank and the intensity of the ignition source except in the case of
extremely small tanks. It is dependent on the ratio of combustible to oxidizing medium,
pressure of the mixture prior to ignition, and the temperature of the mixture prior to
ignition. The effect of the fuel vent on the rate of pressure rise has been studied. Any
opening to atmosphere will tend to relieve the pressure buildup in the tank and, if a
sufficient ratio of vent area to tank volume can be obtained, the results are significant.
Vapor-air concentrations are used as a criterion to establish the effectiveness of
chemical extinguishant explosion suppression systems. However, vapor-mist explosions
can occur over a wide range of conditions. The effect of total pressure on the minimum
ignition temperature is small, so little effect on explosion generation can be realized by
tank pressure changes. Chemical extinguishant explosion suppression systems rely on
a one-shot ordnance operated device to distribute the suppression agent. Therefore,
specify this type of system only if recurrence of an explosion from the same cause is
unlikely. Ensure that the explosion suppression system senses the explosion initiation
and quenches the burning before an unsafe pressure level is reached. Design the
system installation so that the complete area volume is protected. Specify the required
response time for dispensing the extinguishing agent.
e. Neither of the remaining two methods have been applied to air vehicles. These are
described in the following paragraphs:
1. Over-enrichment: Laboratory testing has shown the feasibility of preventing fuel tank
explosions by keeping the vapors fuel rich. This was done through artificial means of
fuel slosh and agitation. This method has not been applied to air vehicle usage.
896
JSSG-2009A
APPENDIX G
2. Fuel alteration: This is another method that has not progressed past research and
development testing. Additives are put into the fuel to change its characteristics and
reduce vapor production.
G.4.4.7.27 Explosion suppression.
It should be verified by analysis, inspection, and component-, subsystem- and system-level

tests that explosion suppression systems have been provided in all specified locations.
equipment will result in uncontrolled explosion and fire damage to the air vehicle.
done to determine the protection required for the total air vehicle. During the appropriate design
reviews, it should be determined by inspection of the appropriate analyses and system
requirements whether an explosion suppression system is required and if so, is it being
provided. The requirement for an explosion suppression system can be generated by several
different sources and it should be ensured that adequate review is conducted.
Inspection, analysis, laboratory, component, ground and simulated flight test and
demonstrations may be used to verify the system provisions. Analysis, inspection and test
should be used for verifying that the provided explosion suppression system(s) are fully
functional and capable of required performance during the planned phases of ground or flight
operations. Under actual or simulated flight condition, active systems should be discharged and
agent concentration, time to reach suppression levels, and goals should be verified by use of an
appropriate method of measuring agent concentration. By analysis, inspection, and test of the
selected design during the appropriate design review, it should be determined that the explosion
suppression system will limit the overpressures to the required levels.
Verification requirements for oxygen dilution and flame quenching systems, in accordance with
MIL-F-38363, are contained above in "Explosion suppression" Lessons Learned.
G.3.4.7.28 Dry bay and void compartment fire and explosion protection.
Provisions shall be made for fire extinguishing in dry bays and void compartments when the fire
hazards cannot be controlled by lesser means.
Dry bay fire and explosion protection systems are in widespread use for new combat air
vehicles. A fire in a dry bay typically requires a rupture of the flammable fluid components and
the generation of an ignition source. For this reason, it is assumed that this scenario is created
when a ballistic projectile impacts a dry bay in flight, rupturing fuel system components and
generating tremendous ignition energy. Although this is the assumed primary initiation means,
897
JSSG-2009A
APPENDIX G
other initiation sources such as overheated, shorting electrical circuits in avionics bays or
burning stored munitions propellants can also be responsible in certain instances.
Dry bays of US military air vehicles and helicopters are those areas within the air vehicle that lie
between the skin mold line and some inner enclosures, and are volumes formed by adjacent air
vehicle structure, such as stiffeners and bulkheads. Dry bays can include wing leading and
trailing edges, landing gear, avionics and weapons bays, and related zones where a
catastrophic rupture of flammable fluid and an ignition supply, such as from a ballistic impact,
can create a sustained fire. Dry bays should be considered continuous if they are pneumatically
connected to other bays.
Both passive and active techniques have been developed to prevent ignition or suppress an
early dry bay fire. The passive approach consists of filling the void completely or partially, which
is especially applicable for thin voids. The active approach consists of timely automatic
suppression of ignition with inert gas, or a liquid or power chemical extinguishing agent. This is
especially applicable for large equipment dry bays.
Some dry bay protection methods and materials are similar to those used for ullage protection.
The main difference is that the ullage is a closed void, whereas dry bays are open. The best
approach or combination of techniques depends on the anticipated threat(s), and the design of
the fuel system, including its surrounding air vehicle structure.
Dry bay fire protection was designed into, but not limited to, the following military air vehicles:
A-10, C-5, C-130, F-4, F-5, F-14, F-15, F-16, F-18,F-22, UH-60, and AH-64.
The Halon Replacement Program for Aviation generated data which supported the development
of extinguisher system sizing models using HFC-125 for dry bays. It also assessed the ballistic
impacts as the means of fire initiation. Details on the experimental program, test conditions,
and results are outlined in WL-TR-95-3039 (SURVIAC TR-95-010). The design model equation
can be found in WL-TR-97-3066 (SURVIAC TR-97-029).
G.4.4.7.28 Dry bay and void compartment fire and explosion protection.
It should be verified by analysis and inspection that fire and explosion suppression have been
provided in all dry bays and void locations.
The lack of this control method in a required location or an inadequate provided system or
equipment will result in uncontrolled explosion and fire damage to the air vehicle.
done to determine the protection required for the total air vehicle. Determination should be
made during the appropriate design reviews whether an explosion suppression system is
898
JSSG-2009A
APPENDIX G
required. The requirement for an explosion suppression system can be generated by several
different sources and it should be ensured that the adequate analysis is conducted.
Inspection, analysis, and laboratory, component, ground, and simulated flight tests and
demonstrations may be used to verify the adequacy of the system protection provisions.
Analysis, inspection, and test should be used to verify the explosion suppression system(s)
provided are fully functional and capable of required performance during the planned phases of
ground or flight operations. Under actual or simulated flight conditions, active systems should
be discharged and agent concentration, time to reach suppression levels, and goals should be
verified by use of an appropriate method of measuring agent concentration. It should be
determined by analysis, inspection, and test of the selected design during the appropriate
design review that the explosion suppression system will limit the overpressures to the required
levels.
Different fuel types may have flammability limits that affect dry bay fire protection. During the
conversion from JP-4 to JP-8, the envelope of flammability changed and an update to fire
protection design and verification was required.
G.3.4.7.29 Control systems actuation display and operating devices.
A means of operating fire and explosion control systems and of displaying crew warnings and
automatic actuation of the system shall be provided.
This requirement is to define the characteristics of the system to be provided to indicate to the
aircrew the need to operate a control system and provide the means of actuation.

Include the details of fire and explosion hazard protection monitoring and actuation and
operating device interlocks.
After a fire and overheat hazard condition and its location have been detected, it is necessary to
perform the correct emergency operation immediately and in the proper sequence to effect
prompt hazard elimination. For this reason the basic design of the crew display and operating
device system and the arrangement of the warning devices, handles, switches and circuitry
should be such that the emergency procedure is as simple and clear as possible. Each new air
vehicle should be analyzed to determine the type of crew display and operating device system
which should be incorporated. The procedures should be as simple and clear as possible and
the arrangement of the handles and switches and the circuitry of the system should be such that
misdirection of the charge of agent is impossible.
Single operation devices should be used, where space permits, to shut off all fire and explosion
sources such as flammables, air, oxidizer or reducing agents, and ignition sources for every
region possibly affected by the hazard condition and also initiate necessary operational
functions evolving from the shutoff. When fire extinguishing is provided, the switches for its
activation should be located so that they are covered by the emergency handles and cannot be
activated before the emergency handle is pulled.
899
JSSG-2009A
APPENDIX G
Where space is limited, push button warning lights have been used as a substitute for “T-
handles”. The buttons are usually covered by frangible covers to prevent inadvertent actuation
and provide a visual indication that the buttons have been actuated. These covers have been a
source of trouble on some air vehicles. Also, active type explosion suppression systems
(oxygen dilution, fuel vapor inerting and flame suppressing) require crew controls to activate and
deactivate the system.
Emergency operations and their sequencing may vary with different air vehicles. However, in
general, the following emergency operations are required in the event of fire:
a. Engine fire.
1. Feather propeller, if applicable.
2. Shut off engine.
3. Apply engine brake, if applicable.
4. Shut off all non-essential flammable fluids to the engine (fuel, oil, hydraulics, anti-
icing fluid). Essential fluids are those required to:
(a.) prevent further damage to the engine,
(b.) allow safe continuation of flight,
(c.) allow a safe auto-rotation landing, or
(d.) accomplish the required emergency procedures.
5. Shut off ventilating and cooling air, if required.
6. Shut off bleed air from other engines if they can discharge into a fire zone such as in
the case of a bleed air duct burnthrough in a potential fire zone.
7. De-energize electrical circuits to the engine compartment or nacelle (with the
exceptions of the feathering, fire-fighting and essential circuits).
8. Select and arm the circuit for discharge of the extinguishing agent.
9. Actuate fire extinguishing system.
b. Equipment fires.
1. Shut off equipment.
2. Shut off all flammable fluids to the equipment.
3. Shut off ventilating and cooling air, if required.
4. De-energize electrical circuits to the equipment compartment.
5. Select and arm the circuit for discharge of the fire extinguishing agent.
6. Actuate fire extinguisher.
The indicator lights should stay illuminated as long as a fire warning indication persists.
Dimming provisions should not be provided for the fire warning indicator lights.
Where light signals are used for fire warning, each signal should include at least two MS or AN
lamps of equivalent wattage.
900
JSSG-2009A
APPENDIX G
The emergency handle should be red in color and have the words “FIRE-PULL” engraved or
embossed thereon, or the words should be integrally lighted in accordance with MIL-STD-411.
Adequate marking adjacent to the handle to indicate the potential fire zone associated with the
control should identify each emergency handle.
Single emergency handles should require 20 to 25 pounds of pull to operate them. The
operation of the emergency handle should either be reversible, or reactivation of the shut-down
engine should be established by other means.
If APU’s are being operated on the ground provide an automatic mode to detect, shut down the
APU, and discharge fire suppressant if required.
G.4.4.7.29 Control systems actuation display and operating devices.
The means of control system actuation display and operating devices shall be verified by
analysis, inspection, component tests, and on-aircraft tests.
Verification of the proper sequencing, configuration, and location of the fire and explosion
hazard control systems actuation displays and operating devices is necessary to the flight safety
of the air vehicle.
demonstrations should be used to functionally checkout and verify the provided control systems
actuation display and operating devices. The use of ground tests and demonstrations will
determine if the provisions work as designed without impacting flight safety.
A Fire Timeline is useful when developing verification requirements for control system response.
G.3.4.7.30 Control systems integrity assurance provisions.
Provisions shall be made for the crew to confirm that the system is 100 percent (100%) fully
operational.
This requirement defines the features of the systems intended to be used by the crew during
preflight checks to determine the operational condition of the circuits and components of the
control systems.
901
JSSG-2009A
APPENDIX G
System safety dictates the inclusion of necessary controls and displays to indicate that the
systems are operational and fully functional and to indicate that a system has failed and
protection is not being provided. Configuration, location, and method characteristics should be
specified. Design the monitoring system so that its electrical continuity can be verified as part of
the preflight or prelaunch check. For continuity checks, specify equipment that is specifically
designed for this application. Inadequate equipment may cause system actuation during the
check. Indicator light standards dictate an amber light, if crew response is not required, and red
light, if immediate crew response is required.
The standard method to verify fire extinguishing agent container pressure has been by providing
a pressure gage on the container. On the C-5 air vehicles, where the containers are
approximately 20 feet above the ground, or on others, where the pressure gages are not readily
available, pressure switches are used on the containers with lights in the cockpit. When the
bottle pressure falls below a preset pressure, the light will come on.
On explosion suppression systems using LN2 the suppressant reservoirs are usually
hermetically sealed and have no gages. However, the system is usually provided with a status
indicator which indicates if the system has been used.
G.4.4.7.30 Control systems integrity assurance provisions.
It shall be verified by analysis, inspection, and test that a means to ensure 100 percent (100%)
full operational capability has been provided.
Verification of the proper location, configuration, and operation of the control systems integrity
assurance provisions is necessary to the flight safety of the air vehicle.
demonstrations should be used to functionally checkout and verify the 100 percent (100%) full
operational capability of the control systems. The use of ground tests and demonstrations will
determine whether the provisions work as designed without impacting flight safety.
Control System Integrity should be considered a Safety Critical Function. Further guidance can
be found in MIL-STD-1798.
902
JSSG-2009A
APPENDIX G
G.3.4.7.31 Ground fire fighting.
Ground fire fighting access provisions shall be provided for all designated fire zones. These
ground fire fighting access provisions shall be compatible with standard ground fire fighting
extinguishing agent dispensing systems. Ground fire fighting provisions shall also be considered
for other internal areas.
Preplanned access doors or other access provisions could greatly facilitate the introduction of
fire extinguishing agent to potential fire sites.
In addition to providing access doors to known fire zones, consideration should be given to
providing ground access to other potential fire areas which could be caused by gear up landing
or be due to maintenance.
Include the fire zone location, size, weight, and extinguishing agent flow requirements.
Spring loaded, push-in doors and louvers have been used successfully to provide ground
access for propulsion installations.
G.4.4.7.31 Ground fire fighting.
The adequacy and proper installation of ground fire fighting access provisions should be verified
by inspection.
Inadequate access to internal fire sites will hamper or defeat ground fire fighting actions.
In some cases, this requirement has been deleted when the location of the protected area made
the design impractical. For example, the C-5 engine installation is located 20 feet above the
ground, where the average fire fighter has difficulty reaching.

(TBD)
903
JSSG-2009A
APPENDIX G
G.5 PACKAGING
G.5.1 Packaging.
G.6 NOTES
not mandatory.)
G.6.1 Intended use.
The fire and explosion hazard protection subsystem descriptions in this appendix are intended
for use in air vehicle systems developed to perform combat and combat-support missions in
environments unique to military weapon systems.
G.6.2 Acquisition requirements.

G.6.3 Definitions.
Detection system: The detection system is defined as all those components, wiring, connectors,
relays, control units, crew displays, power supplies, and any other components necessary to
detect a hazard and transmit that information to the crew and for everyday operations and test
of the system.
G.6.4 Acronyms.
COTS Commercial Off The Shelf
EPU Emergency Power Unit
FEHA Fire and Explosion Hazard Analysis
FMEA Failure Modes and Effects Analysis
904
JSSG-2009A
APPENDIX G
HEIT High Explosive Incendiary Tracer

HRD High Rate Discharge
IR Infrared
LN2 Liquid Nitrogen
LO Low Observable
MEPU Monopropellant Emergency Power Units
ODC Ozone Depleting Chemical
SEA Southeast Asia
SPGG Solid Propellant Gas Generator
SPU Secondary Power Unit
UV Ultraviolet
G.6.5 Subject term (key word) listing.

Alarm
Combustible
Cooling
Detector
Drainage
Fire barrier
Fire hardening
Hazard resistance
Isolation
Lightning
Ventilation
G.6.6 Responsible engineering office.
G.6.7 Changes from previous issue.
905
JSSG-2009A
APPENDIX G
906
JSSG-2009A
APPENDIX H
APPENDIX H
AIR VEHICLE ELECTRICAL POWER SUBSYSTEM
H.1 SCOPE
H.1.1 Scope.
information for the Electrical Power Subsystem provided for in Part 1 of this specification. This
H.1.2 Structure.
H.1.3 Appendix.
H.1.4 Deviations.
907
JSSG-2009A
APPENDIX H
H.1.5 Environmental impact.
H.1.6 Responsible engineering office.
H.2 APPLICABLE DOCUMENTS

H. 2.1 General.
they are listed.
908
JSSG-2009A
APPENDIX H
H.2.2 Government documents
H.2.2.1 Specifications, standards, and handbooks.

NORTH ATLANTIC TREATY ORGANIZATION/

AIR AND SPACE INTEROPERABILITY COUNCIL
ASCC AIR STD 25/18 Connectors for 28 Volt DC Servicing Power
STANAG 3109 Symbol Marking of Aircraft Servicing and Safety/Hazard Points

STANAG 7073 Connectors for Aircraft Electrical Servicing Power
(Copies of these documents are available at http://quicksearch.dla.mil, http://nsa.nato.int,
www.airstandards.org, and www.ihs.com to qualified users.)
MIL-E-7016 Electric Load and Power Source Capacity, Aircraft, Analysis of

MS17793 Schematic Wiring Diagram (External AC Power Connector,
Aircraft)
MIL-PRF-18148/3 Receptacles, Electric, Aircraft Storage Battery

MIL-STD-704 Aircraft Electric Power Characteristics
MIL-STD-7080 Selection and Installation of Aircraft Electric Equipment

19111-5094 USA.)
909
JSSG-2009A
APPENDIX H
H.2.3 Non-Government publications.
SAE INTERNATIONAL
SAE AS35061 Connector, Receptacle, External Electric Power, Aircraft
28 Volt DC Operating Power
SAE AS50881 Wiring, Aerospace Vehicle
SAE AS90362 Connector, Receptacle, External Electric Power, Aircraft
115/200 Volt, 400 Hertz
qualified users.)
H.2.4 Order of precedence.
H.2.5 Streamlining.
910
JSSG-2009A
APPENDIX H
H.3 REQUIREMENTS
H.4 VERIFICATIONS
H.3.1 Definition
H.4.1 Definition
H.3.2 Characteristics
H.4.2 Characteristics
H.3.3 Design and construction
H.4.3 Design and construction
H.3.4 Subsystem characteristics
H.4.4 Subsystem characteristics
H.3.4.1 Landing subsystem
H.4.4.1 Landing subsystem
H.3.4.2 Hydraulic subsystem
H.4.4.2 Hydraulic subsystem
H.3.4.3 Auxiliary power subsystem
H.4.4.3 Auxiliary power subsystem
H.3.4.4 Environmental control subsystem
H.4.4.4 Environmental control subsystem
H.3.4.5 Fuel subsystem
H.4.4.5 Fuel subsystem
H.3.4.6 Aerial refueling subsystem
H.4.4.6 Aerial refueling subsystem
911
JSSG-2009A
APPENDIX H
H.3.4.7 Fire and explosion hazard protection subsystem
H.4.4.7 Fire and explosion hazard protection subsystem
H.3.4.8 Electrical power subsystem.

The electrical power subsystem shall be sized and configured to provide onboard generation,
conversion, storage, distribution, and control of the electric power required for all phases of
vehicle operation, including ground maintenance.
The electrical power subsystem is the primary energy source for operation of electrical and
electronic equipment onboard the air vehicle. Proper specification of the functional and
performance characteristics is essential for the safe and reliable operation of the electrical
power subsystem.
There are a number of options that should be considered when configuring an electrical power
subsystem. Some elements of the design are dependent on the criticality of utilization
equipment regarding safety and mission success. Some aspects of the electrical subsystem
configuration are discussed below.
Consideration should be given to the use of uninterruptible power sources for fly-by-wire flight
controls and other flight critical loads that require continuous power to maintain control of the air
vehicle. Not only are redundant sources typically required, but these sources usually should be
capable of instantly assuming the loads without manual or automatic switching which would
degrade subsystem integrity. In contrast to the emergency power units for less critical loads,
which may operate only when needed, sources of uninterruptible power should be capable of
continuous in-flight operation. The number of failures of sources of uninterruptible power which
should be accommodated without interruption or degradation of power to flight critical loads
normally should be identified. On air vehicles with flight critical subsystems requiring electrical
power, the electrical power subsystem also becomes flight critical.
Independent emergency power sources are normally required in the event of failure of the
primary power source. Emergency sources usually should operate over the entire flight
envelope and be capable of supplying all loads essential for control of the vehicle and personnel
safety. A means of verifying the operational readiness of the emergency power source prior to
flight should be provided. Transfer of essential loads to and from the emergency power source
should be accomplished without transients of a magnitude hazardous to the vehicle or
personnel.
The required period of operation of an emergency source is a critical parameter that should be
specified. When the emergency source is energy-limited as in the case of a storage device
such as a battery, the available energy should be sufficient to ensure operation for the required
time period. 30 minutes is the minimum time for emergency power operation that should be
912
JSSG-2009A
APPENDIX H
considered. This period is generally sufficient for the crew to regain control of the air vehicle
and make an emergency landing. Other types of emergency sources, such as generators, may
not be time limited. The power rating of the emergency source should be sufficient to supply the
emergency loads identified by an electrical load analysis. This analysis can be performed in
accordance with MIL-E-7016.
The response time for initially supplying emergency power is also a consideration. This area
involves factors such as means of sensing power failure, manual or automatic power transfer,
and the time required for the emergency unit to come up to speed or otherwise respond.
Should normal power subsequently be restored, manual or automatic means for returning loads
to the main source should be provided. Automatic transfer can be detrimental if it surprises the
crew with an additional disturbance at a critical time.
To maintain confidence in the reliability of the emergency power source, it should be given an
operational check before each flight, if possible. If not, other means of verifying operational
readiness should be provided.
Air vehicle operational requirements may necessitate an onboard auxiliary power unit (APU) to
provide electric power for certain modes of ground or air operation. The electrical power
subsystem should be capable of generating, controlling, and distributing APU electric power in a
safe and effective manner. Auxiliary power requirements for ground maintenance, subsystem
checkout, manned alert, lighting, cargo loading, starting, or other operations should be specified
as determined from analysis of air vehicle operational requirements. The quantity of APU power
required should be specified; whether both ground and airborne operation are required, whether
parallel operation with main generator(s) or ground power is required, or whether
no-break power transfer to and from the APU is required. In some installations, the APU may
be able to serve as an emergency power source.
Electrical power subsystems often provide several different power forms such as 115 volt,
400 Hz, AC; 115 volt, 60 Hz, AC; 270 volt DC; and 28 volt DC. There is normally one primary
power source with electronic conversion equipment being used to change the primary power
form to other forms. This conversion equipment often forms a major portion of the electrical
power subsystem and its successful design is important in achieving a stable and reliable
subsystem.
Additional guidance on tailoring the specific requirements of the electrical power subsystem is
provided in the individual subparagraphs.
Experience has shown that an emergency power source intended for operation only after a
malfunction has occurred is not a suitable backup for fly-by-wire flight controls. The startup and
operating reliability of the emergency power units in the past have been deficient for this
purpose. Consideration should be given to have full-time redundant power sources to meet the
fly-by-wire requirements.
One air vehicle started out with a mechanical flight control system with a fly-by-wire system as a
backup. Part way through the design, the fly-by-wire became primary with the mechanical
913
JSSG-2009A
APPENDIX H
system only usable in certain portions of the flight envelope. This late change resulted in
significant redesign of the electrical subsystem to meet redundancy and uninterruptible power
requirements.
Despite excess capacity, redundancy, and all other measures taken to ensure a reliable
subsystem, total failures of the primary power sources do occur. For multi-generator air
vehicles there is the tendency to assume that the redundancy of main generators will suffice for
the emergency requirement. Experience has shown otherwise. Many modern multi-generator
air vehicles have experienced total failure of the primary power subsystem. An independent
emergency power source should be considered for this situation. Installation of a permanent
magnet generator on each engine shaft is an approach to provide last ditch power to keep the
air vehicle in the air.
Serious consideration has been given to eliminating the emergency generator from several
programs as a cost and weight savings. However, on several occasions during the flight test
program, the emergency generator was required to supply power following multiple failures of
the main electrical subsystem.
The method of returning emergency loads to the normal power source on one air vehicle was
changed from automatic to manual following an in-flight incident. A flight control transient
resulting from main generator failures had just settled out when normal power was again
restored. When the flight controls were then automatically transferred back to main power, the
crew was surprised with a second disturbance as severe as that caused by the original failure.
Another incident illustrates the criticality of emergency power control logic. A partial failure of
the hydraulic subsystem powering the emergency generator caused it to be powered up to
speed by an overlooked hydraulic “sneak circuit.” When the emergency generator tried to
power the essential bus, there was insufficient hydraulic power to support it. As a consequence,
the essential bus cycled on and off a malfunctioning emergency power unit thereby adding a
critical electrical problem to the original hydraulic failure.
APUs have proven to be beneficial to most air vehicles. They eliminate the need to connect
external electrical power for any maintenance, checkouts, and other operations. They can also
provide electrical power for alert situations, emergency power, and hot turns.
H.4.4.8 Electrical power subsystem.

The size and configuration of the electrical power subsystem to provide onboard generation,
conversion, storage, distribution, and control of the electric power required for all phases of
vehicle operation shall be verified incrementally by (TBS) .
Verification is required to assure that performance, interface, and functional requirements are
met.
914
JSSG-2009A
APPENDIX H
TBS: Verification should be accomplished incrementally and encompass planning, procedure

preparation, and reporting. Verification should be accomplished by test, analysis, inspection, or
a combination thereof.
Analysis should be considered for many aspects of the development such as assessing
electrical loading, distribution bus structure, circuit sizing, and failure mode assessment.
Electrical load analysis techniques, such as those in MIL-E-7016, are crucial to understanding
the electrical loading of each component of the electrical power subsystem under various flight
and ground conditions.
Laboratory tests should be performed on a subsystem mockup that accurately simulates the air
vehicle installation. Testing should include the most adverse electrical loading, environmental,
fault, and endurance conditions required of the subsystem.
Air vehicle ground and flight tests of the installed electrical power subsystem should be
performed under the most adverse conditions of electrical loading, cooling, and flight
maneuvers. Failure modes that are hazardous to personnel or the air vehicle should be
simulated.
Some aspects of the subsystem can be verified by inspection such as installation of external
power connectors.
The development of a laboratory based electrical power subsystem demonstrator has been
shown to be essential in evaluating electrical power subsystem performance under various
operating conditions. With the ever-increasing integration of different subsystems onboard air
vehicles, the need for high fidelity capability in subsystem integration laboratories is paramount.
H.3.4.8.1 Electrical power characteristics.

The characteristics of the electrical power provided at the terminals of the power utilization
equipment shall be in accordance with (TBS) .
It is necessary to establish a standardized electric power interface to ensure electrical

compatibility between the electrical power subsystem and the equipment using electric power.
This standard establishes both electrical power quality requirements that the electrical power
subsystem is to provide as a supplier of power to utilization equipment and the parameters
within which the using equipment must operate acceptably. Interface characteristics typically
controlled include voltage, frequency, distortion, and phase displacement, including steady state
and transient limits.
915
JSSG-2009A
APPENDIX H
TBS should normally be filled in with the current issue of MIL-STD-704 for the electric power
interface for new air vehicles. If there are overriding considerations that require deviation from
the standard, the appropriate limits and interface requirements from MIL-STD-704 together with
the peculiar air vehicle limit and interface requirements should be specified. Interface
characteristics that are typically controlled include voltage, frequency, distortion, and phase
displacement, including steady state and transient limits.
When the electrical power subsystem of an existing air vehicle is modified, the specified power
quality should be compatible with the original air vehicle requirements to ensure that existing
utilization equipment will continue to function properly. Therefore, the current version of
MIL-STD-704 should be specified for modifications only if it ensures power quality equal to or
better than the original requirement. Comparison of the requirements of the current version of
MIL-STD-704 with earlier versions of the specification should be performed to make this
determination.
For unmanned air vehicles, special requirements may dictate electrical power with different
characteristics than MIL-STD-704. In these cases, MIL-STD-704 should be considered as a
guide when preparing the electrical power characteristics specifications for both the electrical
power subsystem and the using equipment.
Since the requirement in this specification actually only defines the electrical power quality of
the electrical power subsystem, the compatibility of all utilization equipment with the electrical
power subsystem should be checked. The power quality standard should be included in each
vendor specification and all utilization equipment should be tested prior to installation on the
vehicle.
Some air vehicles have had problems of incompatibility between air vehicle power and
utilization equipment. In some cases, the electrical power subsystem had to be reworked to
accommodate the equipment even though the original power quality requirements were met.
Frequently, utilization equipment have not been designed or tested to the vehicle power quality
standards, resulting in incompatibilities and redesign of the equipment. These problems point
out that the power interface requirements should be carefully chosen and consistently applied to
both the electrical power subsystem and the utilization equipment.
Requirements for power quality are contained in MIL-STD-704, which was first issued in
October 1959. Present requirements have evolved through several revisions to MIL-STD-704.
Requirements for some unmanned air vehicles have deviated from this standard.
Commercial standards such as SAE AS1831 are very similar to MIL-STD-704 and should be
given consideration as an alternative power quality standard, if trade studies show a cost or
weight savings. Company standards and commercial standards must be reviewed closely when
used to define power quality supplied to Government Furnished Equipment (GFE). Government
Furnished Equipment typically is qualified to a version of MIL-STD-704 and may have problems
operating on company standards.
916
JSSG-2009A
APPENDIX H
H.4.4.8.1 Electrical power characteristics.

Electrical power subsystem compliance with the electrical power characteristics requirements
Verification is required to ensure that performance, interface, and functional requirements are
met.
TBS should be filled in with the particular analyses and tests appropriate for the electrical power
subsystem under consideration. The following elements should be considered in determining
these requirements.
a. Component requirements and test results should be analyzed to ensure that component
performance is consistent with overall subsystem requirements.
b. The entire electrical power subsystem should be tested as a whole to verify that the
power quality at the inputs to the utilization equipment is within specified limits for all
normal and abnormal conditions. Laboratory testing of the electrical power subsystem in
an air vehicle configuration should be conducted to demonstrate this requirement. The
electrical power subsystem laboratory testing should be in a configuration that includes
all components of the subsystem up to the utilization equipment (including wire, cabling
and connectors and circuit protection devices). Testing should include the most adverse
electrical loading, fault, and endurance conditions required of the subsystem.
Experience has shown that retaining functional subsystem mockups throughout the life of the
program allows for continued testing and analyses of subsystem design and resolution of
failures.
H.3.4.8.2 Capacity.
The electrical power subsystem shall provide electrical power in sufficient quantity for all modes
of vehicle operation plus additional capacity for growth loads as follows: (TBS) . In addition,
the capacity for generating, conversion, emergency, and starting equipment shall be defined
separately.
It is essential to define the required capacity of the electrical power subsystem since it is a
critical design parameter affecting the air vehicle design. Weight and volume impacts can be
significant.
917
JSSG-2009A
APPENDIX H
TBS should be filled in with the required capacity of the electrical power subsystem as
determined by the total electrical power requirements of the air vehicle. All modes of air vehicle
operation should be considered as well as provisions for load growth and any necessary
redundancy. Electrical power subsystem capacity should normally be at least twice the
maximum continuous load of the initial production air vehicle to provide for growth, unless other
overriding considerations prevent this growth capacity. Providing for this level of growth is
commonly implemented for cargo and bomber air vehicles. Smaller growth margins (on the
order of 30 percent (30%)) are often used for fighter air vehicles because the increased weight
associated with larger capacity components is usually considered to be unacceptable. Factors
listed below should be considered.
a. Steady state and short duration load requirements
b. Component power ratings
c. Capacity derating factors such as temperature and altitude (including oil supply, input
speed, and horse-power)
d. Growth requirements
e. Redundancy for flight critical subsystems
The MIL-E-7016 procedures can be used for the analysis of load requirements and power
source capacity.
Some limited application air vehicles and most missiles do not require growth capacity. In such
cases, consultation with the procuring activity should be considered.
As a general rule, air vehicle electrical loads continue to grow after the initial design. Some air
vehicles have been forced to eventually change to larger generators or add additional
generating capability as the loads increased. Experience has shown that extra capacity has
also been needed for failure conditions, which resulted in a generator loss, to ensure that all
subsystems can still function. Growth capacity has also prevented brownouts from occurring.
Some air vehicles that were converted over to special mission purposes required an entirely
new electrical subsystem. At times, even a 100-percent (100%) growth capacity has not be
enough. It has not been uncommon to see original equipment 40 KVA generators replaced with
120 KVA generators.
918
JSSG-2009A
APPENDIX H
H.4.4.8.2 Capacity.
The ability of the electrical power subsystem to meet the capacity requirements shall be verified
by (TBS) .
Analyses of air vehicle requirements are needed to establish the capacity required of the
electrical power subsystem for initial loads, growth and redundancy. Subsequent testing is
necessary to confirm actual air vehicle loads and electrical power subsystem capacity.
TBS should be filled in with the appropriate mixture of analysis and test for the particular
application. MIL-E-7016 provides an approach and associated procedures for summarizing and
documenting both steady state and short duration electrical loading conditions in determining
the required capacity of the electrical power subsystem and its components.
Actual air vehicle loads and installed subsystem performance should be determined by air
vehicle testing.
Actual loads of individual electrical power users often will not be available until vendors have
tested their equipment to verify the actual power utilized. Close work with the vendors early in
the program can obtain the best estimates on loads so that the electrical power subsystem may
be sized correctly from the start.
In the early stages of design, the electrical power needed is usually underestimated by the
vendor; and by the time the first operational air vehicle is delivered, the actual loads are above
the original estimates. Experience has shown that careful review of vendor estimates of needed
power early in the program has been helpful to assure that the electrical subsystem was sized
correctly. Adding 25 percent (25%) larger generators halfway through the design can severely
impact the total subsystem design.
919
JSSG-2009A
APPENDIX H
H.3.4.8.3 External ground power compatibility.

The electrical power subsystem shall accept and distribute maximum required levels of power
from external sources identified as being required for ground operations, while maintaining
electrical power characteristics in accordance with “Electrical power characteristics” in this
appendix; including transfer between onboard equipment and the external sources in both
directions. The electrical power subsystem shall protect against unsuitable external power
being applied to the air vehicle. If applicable, external power receptacles shall meet interface
requirements in accordance with the latest international agreements included in North Atlantic
Treaty Organization Standardization Agreements (NATO STANAGs) and Air Standardization
Coordinating Committee (ASCC) Standards and shall meet the following additional
requirements: (TBS) .
External power is usually necessary for ground operations such as maintenance, ground alert,
air vehicle lighting, and engine starting. Therefore, the ability to utilize external ground power
sources, and to interface with such, is important.
TBS should be filled in with consideration of the following.

a. External power receptacles should be accordance with international agreements
included in NATO STANAGs and ASCC Standards.
b. External power receptacles should be accessible from ground level and should be
located to minimize hazards to ground personnel. They should not be located in or near
hazardous areas such as air inlets or exhausts, APU or jet fuel starter exhaust,
propellers or propeller blasts, or fuel servicing or vent areas. The safe and convenient
location of external power receptacles should be a prime consideration to facilitate
servicing and to minimize hazards to the ground crew.
c. When dictated by operational requirements, the receptacle should be designed so that
the power cable and plug will pull out of the receptacle when the air vehicle moves
forward, if ground maintenance personnel forget to remove the plug.
d. Consideration should be given to the use of the external power receptacle for connecting
load banks to the air vehicle for ground checkout of the electrical power subsystem.
e. Receptacles should be isolated from air vehicle power circuits when the mating plug is
disengaged to ensure that dangerous voltages are not present.
The quantity of ground power that the electrical power subsystem is to be designed to handle
can be obtained from the electrical load analysis per MIL-E-7016. Protection against poor
quality external power should be considered to prevent damage to the electrical power
subsystem and power-using equipment. MIL-PRF-24021 covers external power monitors that
provide this protection. Some air vehicles require that the transfer from ground power to air
vehicle power, and the reverse, be made without power interruption because of sensitive on-
board equipment. This requirement should be invoked as needed. Peculiar power transfer
920
JSSG-2009A
APPENDIX H
transients over and above MIL-STD-704 or alternative power quality standards should be
specified.
NATO STANAG 7073 and ASCC AIR STD 25/18 presently specify interface requirements for
28 volt DC and 115 volt, 400 Hz, external power connectors.
NATO STANAG 3109 specifies marking requirements. Receptacles for 28-volt DC external
power should meet SAE AS35061 to comply with the documents. Receptacles for 115 volt,
400 Hz external power should meet SAE AS90362 and be connected in accordance with
MS17793. Pins E and F of these receptacles should not have 115 volt AC applied by the air
vehicle since these pins mate to 28 volt DC circuits in some ground power carts. Prominent
identification of the receptacle should be used to facilitate air vehicle servicing by ground crews.
Some air vehicles use the external power receptacle to connect loads to the air vehicle for
ground check of the onboard electrical power subsystem. This approach has eliminated the
need to operate onboard equipment as loads for this purpose.
Use of incompatible interfaces has caused damage to air vehicle equipment when using the
ground power carts provided by some installations.
H.4.4.8.3 External ground power compatibility.

The ability of the electrical power subsystem to meet external ground power requirements shall
Analyses of external power requirements are necessary in order to design the electrical power
subsystem interface with external power. Subsequent testing is required to confirm that the
external ground power performance requirements of the electrical power subsystem are met.
TBS should be filled in with an appropriate combination of tests, analysis, and inspection in
consideration of the following.
The procedures of MIL-E-7016 can be used to analyze the electrical loading requirements for
external power. The capability of the electrical power subsystem to accept and distribute the
maximum external power requirements while maintaining the required power quality should be
determined by a combination of analyses and tests. Testing should normally be performed at
both an electrical mock-up and onboard the air vehicle.
Protection of the air vehicle against accepting unsuitable external power should be verified by
analyses and tests.
921
JSSG-2009A
APPENDIX H
Proper selection and installation of external power receptacles can be verified primarily by
inspection of applicable drawings and the air vehicle.
External power receptacles have been standardized to assure that any air vehicle can be
provided external power at any location. This approach eliminates the need for onboard APUs.
If the standard power receptacle is not used, then special power carts or adapters will be
required at remote locations.
H.3.4.8.4 Power distribution.

Electric power shall be distributed from the various power sources to the air vehicle loads as
follows: (TBS) .
An effective distribution subsystem is needed to transmit electric power to the using equipment
in a safe and reliable manner.
TBS should be filled in with consideration of power quality, load priorities, reliability,
vulnerability, and safety.
The bus structure and distribution circuits should be configured so that normal electrical power
subsystem operational loads receive power from the air vehicle primary power source(s),
ground power, or an auxiliary power source as applicable.
If an electrical power subsystem failure reduces the amount of available power below total air
vehicle requirements, non-flight critical and pre-selected loads should be automatically
disconnected as necessary to maintain subsystem integrity.
Flight critical loads should have first priority to primary power and should be supplied from the
emergency power source when primary power is not available.
Load management should be implemented by vehicle control and management system for all
flight loads (for example, electromechanical and electro-hydrostatic actuators), except the flight-
critical loads, through Electrical Load Management Centers (ELMCs). This will allow for better
load management or load shedding in case of different conditions of loss of power for different
mission scenarios.
The distribution wiring should be sized such that the power quality requirements of “Electrical
power characteristics” in this appendix are maintained at the terminals of the utilization
equipment. The power distribution subsystem interfaces with avionics wiring and the airframe.
Therefore, the requirements of SAE AS50881 should be applied. In addition, the requirements
922
JSSG-2009A
APPENDIX H
of MIL-STD-7080 for the installation of electrical equipment should be considered. The air
vehicle structure should be considered as return or ground for primary power distribution where
possible. This will provide wiring weight reduction.
Convenient means should be provided for disconnecting ground power from equipment not
requiring power during ground operation.
The power distribution subsystem on some air vehicles has malfunctioned or been improperly
designed. The malfunction in the distribution subsystem resulted in partial or total loss of all
electrical power.
Automatic load shedding has been shown to be important in the event of a partial loss of the
electrical subsystem. This provision has reduced the likelihood of the entire subsystem being
lost due to one item failing. The crew cannot be expected to shut down equipment in time to
prevent a total electrical subsystem failure. Some air vehicles without load shedding have lost
total electrical power due to one small failure that could have been automatically detected and
isolated.
Program experience has shown that mission completion success rate has been low because of
failures caused by mission-critical loads. The Fail-Op fault tolerance for the mission-critical
loads should be extended to the distributed bus (ELMC) level.
H.4.4.8.4 Power distribution.

Compliance with the power distribution requirements shall be verified by analyses and tests as
follows: (TBS) .
Analyses and tests are the appropriate means of verifying compliance with this requirement.
TBS should be filled in with the appropriate mix of analysis and test. The following items should
be considered.
a. Analyses appropriate for this requirement include electrical load analyses per
MIL-E-7016, hazard analyses, failure mode and effect analyses, and circuit analyses.
b. Testing should be used to verify distribution subsystem performance in the laboratory
and on the vehicle. The laboratory testing should duplicate actual electrical loads and
simulate normal and fault conditions.
923
JSSG-2009A
APPENDIX H
Experience has shown that the distribution subsystem needs the same careful design and
analysis effort as the main electrical subsystem itself.
H.3.4.8.5 Control and protection.

The electrical power subsystem shall provide the following control and protective functions:
(TBS) .
Appropriate means of control and protection are necessary for the safe and effective operation
of the electrical power subsystem.
TBS should be filled in with the specific functions necessary for the particular application.
Factors that should be considered include crew instrumentation and controls, failure modes and
effects, automatic control and protection, reliability, vulnerability, and safety. The following is
provided to aid in determining these functions.
a. Routine operations of the electrical power subsystem such as normal start-up, shut-
down, paralleling, and voltage and frequency regulation, which require no crew
decisions, should be performed automatically. Fault clearing in a list of routine
operations should be performed automatically. The control function, if automatic, should
allow for anticycling. The crew should be provided with the instruments and manual
controls necessary for effective control of the electrical power subsystem for both normal
and abnormal operation. These provisions need to include indications of all subsystem
faults and malfunctions that affect flight safety or mission effectiveness. Means of
controlling the electrical power subsystem should be provided such that mission and
safety requirements are met without unnecessarily burdening the crew. On the other
hand, the crew should be involved in non-routine situations in which crew action can
improve mission effectiveness or control abnormal or hazardous conditions.
b. Automatic protective functions should be provided for abnormal conditions of the electric
power subsystem which require a prompt predetermined response and for which no
crew decisions are needed. Faults and malfunctions should be detected, isolated, and
de-energized in a manner which eliminates the hazardous condition to ensure safety of
the air vehicle and minimize performance degradation.
c. All distribution circuits including generator feeders, bus ties, and load circuits should be
protected against short circuits and overloads throughout their total length. Each load
circuit should be individually protected to prevent a single fault from affecting more than
one critical function.
d. Redundant power circuits and components should be routed and located separately to
minimize vulnerability. Means should be provided for detecting the failure of each
redundant component. The advantages of redundant components are realized only if
the components are sufficiently isolated electrically and physically so that multiple
924
JSSG-2009A
APPENDIX H
failures are improbable. Furthermore, if there is no way to detect the failure of a

redundant component, the value of redundancy is lost.
e. For fault protection mechanisms to perform properly, it is important that equipment
subject to electrical faults of primary power be properly bonded and grounded to the air
vehicle structure. The impedance of the entire fault return path should be low enough
such that the available fault current will quickly trip the protective devices (typically, tens
of milliseconds).
f. Circuit breakers that are essential for flight safety should be able to be easily re-set by
the crew.
One electrical power generation subsystem was designed to parallel the main generators
through bus tie contactors. As originally designed, the bus tie contactors would open to provide
isolated generator operation only for certain fault conditions. Opening was automatic. No crew
control was provided. During flight testing it was discovered that faults on the parallel
subsystem could produce excessive voltage transients on all buses before the bus tie
contactors could open. This situation was corrected by automatic control. On the F/A-18C/D air
vehicle, the pilot has manual control to reset the bus tie circuitry. However, this control allows
the pilot to re-apply both main generators into a fault.
Switching of one essential bus from the emergency generator back to the main generator was
changed from automatic to manual to give the crew better control of an abnormal situation.
The multiplexing of control signals for the electrical power subsystem and for the monitoring and
control of individual load circuits is a possible option to reduce the amount of wiring required.
The use of a multiplexed data bus for load control signals and related data proved to be a
successful approach on the B-1 air vehicle. A significant reduction of wiring weight and volume
was achieved.
Multiple wire feeders for the essential bus of one air vehicle have been instrumental in
maintaining electrical power under emergency conditions. Attempts to remove this capability
during modification programs were met with great resistance from the user community.
Power controllers are power switching devices that connect power to the appropriate bus or
load. They generally are mechanical devices such as switches, relays, or contactors; but also
include solid state devices for various applications. Experience has indicated that the main
drivers in selection of a power controller are current requirements and operational voltage.
Solid state devices, which have an inherent voltage drop, have been limited to low current
applications because of the heat dissipation (P = IV), but can be used at higher ratings if
dissipation is not a main concern (that is, short duration or adequate cooling).
Electromechanical contactors are used for high current applications. However, at 270 Vdc,
concern exists about breaking the arc on opening, and additional features are required
compared to some 115 Vac counterparts that can take advantage of the zero crossing for arc
suppression.
925
JSSG-2009A
APPENDIX H
Conventional protective devices such as circuit breakers or fuses have been used to protect the
distribution subsystems; they are located at appropriate points on the distribution bus. In many
remote applications, the switching and protective functions can be combined into one
component, thereby reducing weight and volume. Applications of particular types of power
controllers include generator bus contactors, cross-tie contactor, remote control circuit breaker,
solid state power controller, and vacuum relays.
H.4.4.8.5 Control and protection.

Compliance with the electrical power subsystem control and protection requirements shall be
verified by (TBS) .
Analyses and tests are the appropriate means of verifying compliance with this requirement.
TBS should be filled in with the appropriate mix of analysis and test for the particular application.
Initial verification of control and protection requirements can be accomplished by circuit
analyses, including analyses of failure modes and effects. Qualification testing should normally
be used to verify that the control and protection requirements of individual components are met.
Performance of the complete subsystem can be verified by laboratory and vehicle testing.
Verification of the control and protection subsystem to isolate and remove faults is essential.
This verification will show subsystem capability to provide power to non-affected areas. One
subsystem failed to detect a small fault that eventually grew until the entire electrical subsystem
shut down. Adequate fault detection and isolation would have prevented this occurrence.
926
JSSG-2009A
APPENDIX H
H.5 PACKAGING
H.5.1 Packaging.
H.6 NOTES
not mandatory.)
H.6.1 Intended use.
The electrical power subsystem descriptions in this appendix are intended for use in air vehicle
H.6.2 Acquisition requirements.

H.6.3 Component information
H.6.3.1 Wiring.
Electrical power subsystem performance and reliability is dependent to a large extent on the
integrity of the wiring that interconnects the subsystem. Consideration should be given with
respect to wiring components and their compatibility for the application, with particular attention
given to the application environment. Considerations for wiring installation should include
maximum reliability, minimum interference and coupling between subsystems, accessibility for
inspection and maintenance, and protection against damage. Since the wiring is normally
expected to last for the entire service life of the air vehicle, special care is should be considered
in its design and installation. The legacy defense specification MIL-W-5088 and its successor,
SAE AS50881, provide guidance based on years of experience with air vehicle wiring
installations and on the capabilities of wiring components.
927
JSSG-2009A
APPENDIX H
Most problems with air vehicle wiring have involved deterioration caused by the environment,
aging, improper application of materials and components, and abuse of various kinds. Moisture,
heat, vibration, and rough handling are common hazards that should be recognized and
guarded against during subsystem design.
In Vietnam, air vehicles experienced a major problem when the potting compound in the
electrical connectors reverted to a sticky, gummy mass because of heat and humidity. This cost
millions of dollars and extensive downtime to repair. Environmentally-sealed connectors which
do not require potting are now preferred for most applications. Where potting is required, use
should be restricted to those materials that have been qualified to the service environment.
Short, easy replaceable harnesses to go between the equipment and air vehicle wiring should
be considered for use with equipment that is frequently removed (such as liquid oxygen
converters). As the equipment is removed and replaced, the connectors become worn and
have to be replaced. After a few replacements, the wires are no longer long enough and an
entire harness must be replaced.
Aluminum wire is used on some air vehicles to feed power to the load centers from the engine
pylons, and from the load centers to points throughout the air vehicle. Loose connections,
electrolysis, and galvanic reactions have led to corrosion and arcing at the terminal lugs. Fires
and loss of electrical power have resulted. Therefore, aluminum wire should not be approved
for use unless solutions to termination problems have been proven.
H.6.3.2 Batteries.
Batteries that are components of the vehicle electric subsystem should be capable of providing
the specified battery power under the environmental and operational conditions to which they
will be subjected.
A battery relay should be installed in each battery circuit to enable the flight crew to isolate the
battery from the rest of the electric subsystem. The battery relay should be controlled by a crew
station battery switch. Any circuits that must remain connected to the battery with the battery
switch OFF should be connected directly to the battery through suitable fuses or circuit
breakers.
On-board charging of sealed battery subsystems with aqueous electrolyte solutions should be
controlled to enable the battery to become fully charged without excessive gassing or heating
throughout the entire range of specified battery temperatures. The charging rate should be
sufficient to maintain the battery in a state of charge that will meet the battery power demands of
normal ground and airborne operation of the air vehicle.
Each battery should be located and installed so that it can be readily inspected and easily
removed from the air vehicle without removing other components except for a readily opened
access panel or door. The location and design of the battery installation should be such that the
release of heat, smoke, gases, electrolyte or other products of a severe battery failure will not
damage adjacent components or structure, endanger personnel, or adversely affect crew
performance. Since all batteries can vent, the battery compartment, and particularly the battery
should be ventilated to prevent the accumulation of explosive mixtures of gases. All vent tubes
928
JSSG-2009A
APPENDIX H
leading to the exterior of the air vehicle should be designed to preclude the collection of
rainwater and other liquids for all ground and flight environments.
The installation should provide for maintaining battery temperature within the limits specified for
battery operation. Any heater or thermal insulation required for low temperature operation
should be provided as an integral part of the battery and not as part of the air vehicle’s battery
compartment.
Valve-regulated lead-acid (VRLA) and vented nickel-cadmium (VNC) batteries are the two types
of secondary rechargeable batteries most used in air vehicles. VRLA batteries are less costly
and easier to maintain. Both can be effectively charged from a simple constant-potential
source. Nickel-cadmium batteries can provide better high-rate performance, especially at low
temperature, and are more resistant to vibration. The disadvantages of VNC batteries include
higher cost, and some can require special maintenance procedures. MIL-PRF-81757 and
MIL-PRF-8565 are Tri-Service specifications for VRLA and VNC batteries. These standard
batteries, which are the product of considerable Tri-Service experience and research, should be
used where suitable. They are procured competitively and in quantities that result in lower cost.
If none of the MIL-PRF-81757 or MIL-PRF-8565 standard batteries are suitable, the next best
choice for a nickel-cadmium battery would be a non-standard battery. Such non-standard
batteries should be designed such that cell removal and replacement is separately impeded. For
interface reasons, receptacle should meet MIL-PRF-18148/3.
The effects of temperature, charging efficiency, aging, and other derating factors should be
considered in the selection of a battery so required ampere-hour capacity and other
performance requirements are met.
Battery sizing depends on the degree of non-interruptible power required and assumes that
emergency power can be brought online in certain time duration.
There are two cases: the fly-by-wire system for a traditional electro-hydraulic air vehicle and
flight control actuation for the more-electric air vehicles. For precise battery estimates, actuator
requirements and capabilities need to be known. Also, some actuator schemes involve the
utilization of energy extracted from the air stream in the back drive mode to enhance the overall
efficiency. This potential regenerative power source may well reduce the battery sizing
requirements.
The air vehicle should be provided with an automatic means to disconnect the battery so that it
can be electrically isolated in the event of battery failure. It may be necessary, however, for
some circuits to remain connected to the battery at all times.
Effective on-board charging is required to keep secondary batteries adequately charged.

Batteries are very sensitive to applied voltage. If the voltage is too low, the battery will not
become fully charged. If it is too high, the battery will become overcharged with excessive
heating and loss of electrolyte. Excessive overcharging can lead to a catastrophic failure when
a battery overheats. It is not good practice to float a sealed nickel-cadmium battery directly on a
high current DC bus. Better control of the charging current is needed.
929
JSSG-2009A
APPENDIX H
A generally accepted procedure for charging sealed nickel-cadmium batteries is to supply a

constant-current charge until a predetermined, temperature-compensated battery voltage is
reached. At that point charging is terminated or reduced to a small trickle-charge rate. The
“constant” current may be a continuous direct current or a series of pulses of a controlled
average value. In addition, charging is terminated when battery temperature becomes
excessive. This method of charge control requires sensing battery temperature. Temperature
sensors should be added to any battery charged by a constant current airborne charger.
The following factors should be given careful consideration in designing the battery installation.
a. Because of the requirement for maintenance, the battery should be readily accessible for
inspection and removal. Handles or carrying straps on batteries are desirable. There is
no battery in use in any military air vehicle today that will not require maintenance of
some type over the life of the air vehicle.
b. The potential hazard of a battery failure should be recognized in subsystem design.
Failure effects can range from excessive gassing to complete thermal destruction.
c. The possibility of hydrogen gas evolution, even with “sealed” subsystems, emphasizes
the need for adequate ventilation of the battery to prevent explosive concentrations from
developing.
d. The sensitivity of batteries to temperature, vibration, and other environmental factors
should be considered.
e. Battery electrolyte will corrode many types of materials. Such materials should not be
used in nearby areas or components, or else they should be protected against the
electrolyte. In addition, consider using snorkel-type electrolyte deflectors, such as those
in MIL-PRF-81757/2 for acrobatic applications.
Indication of battery subsystem malfunctions such as over-temperature, battery discharging,
and low battery voltage should be provided to the crew as necessary to meet subsystem safety
and reliability requirements.
Catastrophic failures and loss of power have resulted in the loss of both air vehicles and
personnel. Instances of less severe problems have caused personnel injury, air vehicle
damage, mission aborts, poor maintainability and reliability, and high replacement costs.
Some specific lessons learned are:

a. One air vehicle required a non-standard battery because of available space and the
need for thermal insulation. Several deficiencies were later discovered in the design and
installation of the unit.
1. A non-standard cell that was much more costly than an equivalent standard cell was
originally selected for the battery. It was later found that the standard cell could be
substituted without loss of performance.
2. The thermal insulation was designed as an integral part of the battery case. This not
only increased the initial and replacement costs, but also downgraded battery
reliability because of susceptibility to cracking and contamination by the electrolyte.
Making the insulation (or other thermal conditioning) a part of the air vehicle battery
930
JSSG-2009A
APPENDIX H
compartment rather than a part of the battery would have been a better approach.
These points also apply to battery heater blankets.
3. The original configuration of the battery vent tube allowed rain water to enter the
battery and contribute to corrosion of thermal switches. A redesign of the vent was
required to correct this problem.
4. Access to the battery required the removal of a structural fuselage panel secured by
approximately 50 stubborn screws. This is unsatisfactory for an item that requires
frequent maintenance.
b. Through the 1970’s, numerous instances occurred of thermal runaway of VNC batteries
directly connected to high current DC generators. The loss of one air vehicle and one of
its crew members was attributed to this cause. There has also been a recent history of
VRLA battery overheating, leading to mission aborts and air vehicle damage. Safe
limitations on charging current and battery isolation capability are needed for all
batteries.
c. As a result of its location in the cockpit, the A-7 and SH-60 air vehicle batteries not only
required seat removal or movement for battery maintenance, but also subjected the crew
to smoke and fumes in the event of a major battery failure. The cockpit is a poor
location for the air vehicle main battery or any battery not part of essential life support
and survival gear.
d. Because of the weight and space penalties involved, batteries are often selected which
are inadequate for the required performance. Insufficient derating for temperature,
aging, on-board charge efficiency, and high discharge rates are common pitfalls that
cause maintenance effort to be at least 1 order of magnitude greater than they should
be.
e. One air vehicle’s batteries are installed in fiberglass boxes with attached circuit breakers.
The entire assembly (box, battery, circuit breaker, wiring, and connector) must be
removed each time the battery is removed for maintenance. Due to the close proximity
of components, electrical shorting is reported to be a frequent problem during such
maintenance.
f. Sealed lead-acid batteries are now gaining support due to their reduced maintenance
factors and cost. Adequate charging subsystems are required and heaters may be
needed for cold-temperature use.
g. Improved lithium batteries used in any air vehicle application should be submitted for
safety review in accordance with S9310-AQ-SAF-010. (Copies of this document are
available at www.marcorsyscom.usmc.mil and https://mercury.tdmis.navy.mil/cert/
certtest.cfm.) Such batteries offer several unique performance advantages compared to
other batteries. However, lithium batteries may present a severe hazard to crew and air
vehicle if venting occurs.
h. Silver-zinc secondary batteries were used in one aircraft because of their very high
energy density. However, these batteries have a very limited cycle life and are extremely
susceptible to internal shorting. Because of the numerous catastrophic failures that were
experienced, this type of secondary battery is not recommended for air vehicles.
931
JSSG-2009A
APPENDIX H
H.6.3.3 Generators.
The design and performance of the generator subsystem are essential contributors to the
overall performance of the electrical power subsystem. The fundamental subsystem power
parameters of voltage, frequency, and capacity are established primarily by the main generators
and associated components. Constant frequency 400 Hz power can be obtained from a
generator driven directly from a prime mover when the prime mover operates at fixed speed.
Generator subsystems of this type should be in accordance with MIL-G-21480 with changes as
necessary for the specific application.
When the prime mover operates at varying speeds, either of two types of generator subsystems
can be used for producing constant frequency power. One approach is to use a constant speed
drive between the prime mover and the generator. The second approach is to drive the
generator directly from the prime mover at varying speed and convert the variable frequency
produced by the generator to constant frequency by means of an electronic converter.
MIL-E 85583 should be specified for subsystems of this type. Generators in accordance with
MIL-DTL-6162 are suitable for 28 volt DC subsystems. Generator subsystem capacity is often
limited by the amount of cooling available. Therefore, particular attention should be given to this
aspect of the installation.
Oil-cooled, oil-lubricated generators have proven to be smaller, lighter and more reliable than
their air-cooled, grease-lubricated predecessors.
Constant speed drive oil level has been critical to satisfactory operation on various air vehicles.
Furthermore, filling to the proper level has been adversely affected by temperature, air vehicle
attitude, and inadequate oil level indication. New designs should be less critical with respect to
oil level and should provide for simple and accurate filling and inspection procedures.
Consideration should be made with respect to the drive being capable of operation under all
specified “g” conditions over the entire range of specified oil levels. When an external oil cooler
is used in a generating subsystem, it should be protected against contamination from the
generating subsystem. An outlet or scavenge filter can provide this protection. On one air
vehicle, when an integrated drive generator had a hardware failure, metal could and did
contaminate the oil cooler, which meant the cooler had to be replaced. An engineering change
proposal for a scavenge filter was later approved and added to the subsystem.
Due to recent advancements in high power, high temperature, solid-state switching devices,
high power density motors and generators; efficient, high power converter topologies; and the
evolution of fault-tolerant electrical power subsystems coupled with technology breakthroughs in
electrically driven actuators have rekindled interest in the more-electric air vehicles. Thought
should be given to 270-volt DC subsystem design and verification in the area of power
generators. Experiences have shown that a major air vehicle DC generator design requirement
is to maintain a constant voltage over a wide speed range. The magnetic section is sized for
maximum load at minimum speed. As speed increases or load decreases, either the magnetic
field must decrease accordingly or the resulting higher voltage amplitude waveform must be
controlled to maintain a constant output. Three 270-volt DC generator design concepts exist and
they should be carefully selected. They include the wire-wound rotor, permanent magnet
generator, and the switched-reluctance machine.
932
JSSG-2009A
APPENDIX H
H.6.3.4 Converters.
When equipment that is essential for safe flight derives power from an inverter, a spare inverter
should be provided. Changeover from the main inverter to the spare should be automatic in the
event of main inverter failure. Spare inverters may be used as operative units to supply power
to nonessential loads, but these loads should be dropped in the event of main inverter failures.
When the outputs of two or more AC to DC converters are paralleled to supply a common DC
bus, no single unit should be loaded beyond its rating for the worst-case load unbalance or
failure mode which can occur.
The electrical power subsystem is often required to supply power of a type different from that
provided by the primary source. In this event a means of power conversion is needed.
Typically, the conversion is from 115-volt, 400 Hz power to 28 volts DC (rectification) or from
28-volt DC to 115-volt, 400 Hz, 3-phase or single-phase (inversion).
Requirements for AC to DC converters (transformer-rectifiers) should be based on MIL-C-7115.
Converters are frequently used in the subsystem to provide voltages other than the ones
provided by the main generators. This results in an electrical subsystem that is more efficient
overall. Many air vehicles use off-the-shelf equipment which do not operate on normal air
vehicle power and converters are the best way to provide the electrical power these equipment
need.
H.6.4 Definitions.
Utilization equipment: Utilization equipment is that equipment which receives power from the
electrical power subsystem.
Utilization equipment terminals: Utilization equipment terminals provide the interface with the
electrical power subsystem. Power interconnections within the utilization equipment or
equipment system are excluded.
H.6.5 Acronyms.
ELMC Electrical Load Management Center
VNC Vented Nickel-Cadmium
VRLA Valve Regulated Lead-Acid
H.6.6 Subject term (key word) listing.
Battery
Capacity
Converter
933
JSSG-2009A
APPENDIX H
Power
Wiring
H.6.7 International standardization agreement implementation.
This specification implements NATO STANAG 3109, Symbol Marking of Aircraft Servicing and
Safety/Hazard Points; NATO STANAG 7073, Connectors for Aircraft Electrical Servicing Power;
and ASCC AIR STD 25/18, Connectors for 28 Volt DC Servicing Power. When amendment,
revision, or cancellation of this specification is proposed, the preparing activity must coordinate
the action with the U.S. National Points of Contact for the international standardization
agreements, as identified in the ASSIST database at https://assist.dla.mil/online/start.
H.6.8 Responsible engineering office.
H.6.9 Changes from previous issue.

assumes no liability whatsoever for any inaccuracies in these notations. Bidders and contractors
are cautioned to evaluate the requirements of this document based on the entire content
irrespective of the marginal notations and relationship to the last previous issue.
934
JSSG-2009A
APPENDIX I
APPENDIX I
AIR VEHICLE MECHANICAL SUBSYSTEMS
I.1 SCOPE
I.1.1 Scope.
information for the Mechanical Subsystems provided for in Part 1 of this specification. The
specifications.
I.1.2 Structure.
I.1.3 Appendix.
I.1.4 Deviations.
I.1.5 Environmental impact.
935
JSSG-2009A
APPENDIX I
I.1.6 Responsible engineering office.
I.2 APPLICABLE DOCUMENTS

I.2.1 General.
they are listed.
I.2.2 Government documents
I.2.2.1 Specifications, standards, and handbooks.

JSSG-2006 Aircraft Structures Joint Service Specification Guide
MIL-HDBK-1599 Bearings, Control System Components, and Associated Hardware
Used in the Design and Construction of Aerospace Mechanical
Systems and Subsystems
936
JSSG-2009A
APPENDIX I

19111-5094 USA.)
I.2.2.2 Other Government documents, drawings, and publications.

DOT/FAA/AR-MMPDS Metallic Materials Properties Development and
Standardization (MMPDS)
(Information on this document’s availability is provided at www.mmpds.org or via e-mail at
bcommpds@batelle.org.)
I.2.3 Non-Government publications.
AEROSPACE INDUSTRIES ASSOCIATION OF AMERICA, INC.

NAS 0331 Bearing Installation and Retention by Swagging or Staking
NASM1312 Fastener Test Methods
(Copies of these documents are available via www.aia-aerospace.org; Aerospace Industries
Association, 1000 Wilson Boulevard, Suite 1700, Arlington VA 22209-3928 USA.)

ASME B1.15 Unified Inch Screw Threads (UNJ Thread Form)
(Copies of this document are available from https://www.asme.org; ASME, Three Park Avenue,
New York NY 10016-5990 USA.)
SAE INTERNATIONAL
SAE ARP777 Gas Actuators (Lineary and Vane Rotary Type)
SAE ARP4058 Actuators: Mechanical, Geared Rotary
SAE ARP4255 Electrical Actuation Systems for Aerospace and Other
Applications
SAE ARP4386 Terminology and Definitions for Aerospace Fluid Power, Actuation
and Control Technologies
SAE AS6038 Bearings, Ball, Bellcrank, Antifriction, Airframe
SAE AS6039 Bearings, Ball, Rod End, Double Row, Self-Aligning
937
JSSG-2009A
APPENDIX I
SAE AS7949 Bearings, Ball, Airframe, Antifriction

SAE AS8914 Bearings, Roller, Self-Aligning, Airframe, Antifriction
SAE AS81820 Bearings, Plain, Self-Aligning, Self-Lubricating, Low Speed
Oscillation
users.)
STANDARDS AUSTRALIA INTERNATIONAL LTD

SAI AS 3990 Mechanical Equipment – Steelwork
(Copies of this document are available from www.standards.com.au; SAI LTD, PO Box 1055;
Strathfield, NSW; Australia 2135.)
I.2.4 Order of precedence.
I.2.5 Streamlining.
938
JSSG-2009A
APPENDIX I
I.3 REQUIREMENTS
I.4 VERIFICATIONS
I.3.1 Definition
I.4.1 Definition
I.3.2 Characteristics
I.4.2 Characteristics
I.3.3 Design and construction
I.4.3 Design and construction
I.3.4 Subsystem characteristics
I.4.4 Subsystem characteristics
I.3.4.1 Landing subsystem
I.4.4.1 Landing subsystem
I.3.4.2 Hydraulic subsystem
I.4.4.2 Hydraulic subsystem
I.3.4.3 Auxiliary power subsystem
I.4.4.3 Auxiliary power subsystem
I.3.4.4 Environmental control subsystem
I.4.4.4 Environmental control subsystem
I.3.4.5 Fuel subsystem
I.4.4.5 Fuel subsystem
I.3.4.6 Aerial refueling subsystem
I.4.4.6 Aerial refueling subsystem
939
JSSG-2009A
APPENDIX I
I.3.4.7 Fire and explosion hazard protection subsystem
I.4.4.7 Fire and explosion hazard protection subsystem
I.3.4.8 Electrical power subsystem
I.4.4.8 Electrical power subsystem
I.3.4.9 Mechanical subsystems.

Mechanical subsystems shall consist of (a) doors, hatches, and ramps; (b) airframe bearings;
(c) fasteners; and (d) utility actuators.
Mechanical subsystems are used where securing, fastening, and mechanizing is required.

a. Doors, hatches, and ramps. See “Doors, hatches, and ramps” in this appendix.
b. Airframe bearings. See “Airframe bearings” in this appendix.
c. Fasteners. See “Fasteners” in this appendix.
d. Utility actuators. See “Utility actuators” in this appendix.
(TBD)
I.4.4.9 Mechanical subsystems.
Mechanical subsystems function and performance shall be verified incrementally by (TBS) .
Verification is essential to assure that mechanical requirement are met.
TBS: Verification should be accomplished incrementally and should include inspection,

analysis, demonstration, or test, or a combination of these methods.
(TBD)
940
JSSG-2009A
APPENDIX I
I.3.4.9.1 Air vehicle doors, hatches, hinged access panels, and ramps subsystem.
Air vehicle door, hatch, and ramp mechanical subsystems shall provide latching, locking, door
status monitoring, door control, and sealing.
Air vehicles in general require numerous openings in the fuselage to permit access to and
escape from the flight and passenger compartments, the cargo and baggage hold, and
equipment and subsystem bays. The purpose of the air vehicle door and hatch mechanical
subsystems is to provide the mechanization of these functions.

a. Jamming or blocking of air vehicle doors. The air vehicle doors and hatches should be
designed so jamming or blocking by cargo, baggage, or foreign objects in the open or
closed position is not possible.
b. Jam loads in the subsystem. The air vehicle doors and hatches should withstand jam
loads at any point without detrimental deformation.
c. Holding of air vehicle doors. For ground operation with power off, means should be
provided to hold the air vehicle doors in the open or closed position. Subsequent power
operation of the doors, with these means left in place, should not result in damage.
d. Main entrance doors. Main entrance doors should permit passage of personnel and
necessary equipment. Main entrance doors for patrol, transport, antisubmarine warfare
and utility air vehicles should be provided with a lock and key for locking the door from
the outside, however, the doors should be operable from the inside when locked.
e. Cargo doors. Special consideration should be given to cargo doors for ease of loading
and unloading. Main cargo-loading openings should admit packages of maximum
practicable dimensions so that as varied a cargo as possible may be carried. The main
side-cargo-loading-opening should be on the left side, unless such openings are
symmetrical about the centerline of the air vehicle. Cargo doors should be flush with the
floor except where it is required to make them watertight or pressure-tight. Cargo door
locations and the manner of opening should render minimum interference to cargo
loading and unloading, and should not restrict the use of loading platforms, cranes, fork
lift trucks, or such, for transferring cargo. Servicing of the air vehicle should be possible
without interference with loading or unloading when done simultaneously.
f. Paratroop doors. Doors for parachute jumping should be operable from the inside in
flight and located for safe egress. There should be no projections on which personnel
might stumble or foul their clothing or gear in preparing to jump or while jumping. Air
vehicles capable of carrying more than 20 troops should be provided with 2 door spaces
to permit simultaneous jumping. Doors for parachute jumping should be at least 36
inches wide by 70 inches high and should be flush with the floor.
g. Compartment hinged access panels. Compartment hinged access panels and other
openings with covers should be provided as required. The covers and hatches should
permit ready securing or opening and should be watertight in flight. All equipment
941
JSSG-2009A
APPENDIX I
compartments should be accessible without the use of workstands or platforms and

should be eye level or lower to permit maintenance personnel access to equipment
contained therein. Equipment compartments should be free of structural obstruction and
armament recesses.
h. Seaplane and amphibian boarding doors. All seaplane and amphibian air vehicles
should have provisions for boarding to and from boats brought along side in choppy
water. Doors most suitable for this purpose should be clearly designated. Recessed
fittings should be provided forward and aft of entrance doors for steadying or securing a
small boat raft. Amphibian air vehicles should have provisions for boarding from the
ground when ashore.
a. Subsystem bearings. Air vehicle door and hatch bearings should be selected in
accordance with MIL-HDBK-1599.
b. Mechanical joints. Air vehicle door mechanical joints that do not have standard bushings
or bearings should have a life equal to the air vehicle service life with at least one
rework. Parts containing friction surfaces subject to wear should be designed for easy
repair or replacement. Joints of air vehicle doors and hatches should be smooth with no
gaps to cause a breakdown of airflow.
c. Performance requirements. The performance requirements of JSSG-2006 apply to the
air vehicle door and hatch mechanical components.
d. Door sills and edges. Door sills, coamings, and lower edges of doors should be so
constructed as to provide edges that may not be readily damaged by normal personnel
traffic. Additionally, all corners of doors, hatches, panels, or covers should be rounded
to preclude injury to maintenance personnel with the doors, hatches, panels, or covers in
the open position.
I.4.4.9.1 Air vehicle doors, hatches, hinged access panels, and ramps subsystem.
Testing required to verify the door, hatch, hinged access panels and ramp mechanical
subsystems shall be conducted. The design and operating characteristics shall be substantiated
by analysis.
The design and operating characteristics of the mechanical subsystems to fulfill the functional
needs of the air vehicle must be made known prior to operational deployment.
The integration of the mechanical subsystems should be demonstrated in a mock-up simulating

the expected loads and structural attachments. Testing should be designed and conducted to
establish integrity and durability of the mechanisms. The sizing and operating characteristics
should be determined analytically.
942
JSSG-2009A
APPENDIX I

(TBD)
I.3.4.9.1.1 Air vehicle door maintenance.
Air vehicle door, hatch, hinged access panels and ramp hinges requiring disassembly for
maintenance shall be installed by a method that will prevent damage to all the corrosion
protected surfaces.
All door hardware (latches and hinges) and any items mounted to or within the door or hatch
structure shall be readily accessible for lubrication, rigging, adjustment, removal, and
replacement without disassembly of structure.
The purpose of this requirement is to ensure that the installation techniques will not damage the
corrosion protected surfaces of bushings and joints during the assembly process, and that the
door hardware will be easily serviced.
Hardware should not require lubrication at the organizational or intermediate level. All latches
and locks should be accessible without the use of special tools, equipment, or workstands.
(TBD)
I.4.4.9.1.1 Air vehicle door maintenance.
Verify by analysis of the design drawings that air vehicle door bushings and joints requiring
disassembly for maintenance will be installed by a method that will prevent damage to all
corrosion protected surfaces. Also verify that design can allow easy access for maintenance of
door hardware.
Verification is needed to confirm that the manufacturing process used in the installation of
bushings will not induce corrosion in protected surfaces and that door hardware will be easily
accessed for maintenance.
943
JSSG-2009A
APPENDIX I
Analysis of the drawings should include inspection of the installation tolerances of the assembly
methods with particular attention to the corrosion protected surfaces. Ease of maintenance for
the door hardware should also be inspected.
(TBD)
I.3.4.9.1.2 Powered door position.
Powered doors shall not change position due to loss of power in any associated system.
The purpose of this requirement is to ensure the loss of a powered door will not cause injury or
damage.
A positive mechanical device should be provided to prevent change in selected door positions
due to fluid bleeding down after fluid power is shut off or loss of electrical power.
(TBD)
I.4.4.9.1.2 Powered door position.
Powered door position requirements shall be verified by (TBS) .
This verification is necessary to assure continued controlled flight and landing in the event of a
door loss or door component failure.
TBS should include an inspection of the air vehicle drawings. In addition a failure modes and
effects analysis should be conducted to predict the consequence of hydraulic, electrical, or
mechanical failures.
(TBD)
944
JSSG-2009A
APPENDIX I
I.3.4.9.1.3 Latching.
Latches shall keep the doors and hinged access panels secured under all design conditions.
The latches shall withstand limit design loads without detrimental deformation or loss of
fuselage pressurization and shall withstand ultimate loads without failure.
Door latching secures doors to prevent loss in flight.

a. Unlatching due to deflection. Maximum possible relative deflection between the air
vehicle structure, doors, and the latches should not cause unlatching under any ultimate
design loading condition.
b. Latching cycle. The latches should be incapable of completing the latching cycle under
all operating conditions unless the doors are in the fully closed position.
c. Latch installation visibility and accessibility. Latch installations on the doors that affect
the safety of flight and are operational in flight should be visible and accessible by
ground crew and by air crew members to ensure a fully latched condition by direct visual
observation.
d. Latching subsystem independence. The latches should be independent of the locks so
that any inadvertent unlatching attempt will not cause unlocking.
e. Flight and pressurization loads. Flight and pressurization loads should not exert an
unlatching force.
f. Latch damage or permanent deformations. Damage or permanent deformation to the
latches or support structures should not result from the most critical jam load conditions.
g. Latch selection. Single, simple action door latches should be used. Latches on exterior
doors should be of the irreversible type. Spring action should not be used to return the
latch to the locked position; however, it may be used to hold the latch in the locked
position and resist vibration forces tending to unlock the door. Latching mechanisms of
hair trigger type should not be used. Latches on interior doors that do not open into
water-tight or pressurized compartments may utilize simple spring actuated
mechanisms.
(TBD)
945
JSSG-2009A
APPENDIX I
I.4.4.9.1.3 Latching.
The security, under all design to conditions, of air vehicle door and hinged access panel latches
The tests are intended to ascertain whether or not door openings could occur subsequent to
simulated single latch failure or combination of probable multiple failures.
TBS: Testing should be accomplished in conjunction with other tests whenever possible. To
accomplish this goal, all suitable latch tests should be coordinated with the structural test
program to avoid duplication. Tests should be conducted duplicating the most critical conditions.
In conjunction with these tests, all failures should be analyzed for any detrimental after effects
caused by the initial failure.
(TBD)
I.3.4.9.1.4 Locking.
The door locks shall prevent the door latches from opening unless the door locks are opened.
The purpose of this requirement is to ensure that the locks hold the latches closed under all air
and ground load conditions and single failure modes.

a. Deflection of lock actuation. Maximum possible deflection of the lock actuator, linkage
and support structure should not cause unlocking under any ultimate load conditions.
b. Lock indication. The locks should be incapable of locking or indicating they are locked
unless all the latches are properly latched in the fully secured position. This requirement
applies to the following door subsystems: (TBD) .
c. Lock service life. The locks and their components should have an actuation service life
of (TBD) cycles.
d. Visibility of lock installation. The lock installation on the door subsystems should be
accessible to the flight and ground crew members to ensure a fully locked condition by
direct visual observation. In addition, the lock installation should be visible to the air
crew members for doors that are in the pressurized volume; or that affect safety of flight,
and are opened and closed in flight.
946
JSSG-2009A
APPENDIX I
e. Inadvertent unlocking. The locks should be independent of the latches and inadvertent
unlocking should not cause unlatching. Inadvertent latch activation should not cause
unlocking or unlatching with the locking subsystem engaged.
f. Unlocking at unsafe pressure levels. The locks should be incapable of unlocking at
unsafe pressurization levels.
g. Lock damage or permanent deformation. Damage or permanent deformation to the
locks or support structure should not result from the most critical jam load conditions.
(TBD)
I.4.4.9.1.4 Locking.
Verify by analysis and test that the air vehicle door locks shall prevent unlatching under all
operating and ultimate load conditions.
It must be verified that the door latches do not yield due to pressurization loads or single failure
modes.
All testing should be accomplished in conjunction with the door latch test on the full-scale test
model.
(TBD)
I.3.4.9.1.5 Pressurization.
All air vehicle pressurized doors, whose inadvertent opening would present a probable hazard
to personnel or to continued safe flight and landing, shall have provisions to prevent
pressurization of the air vehicle if the doors are not fully closed, latched, and locked.
The air vehicle could over pressurize or lose pressurization if a door is not secured properly.
The provisions not only must give positive evidence of an improperly locked and latched door,
but also guard against unsafe pressurization.
947
JSSG-2009A
APPENDIX I
The air vehicle doors should be designed so that the air vehicle cannot be pressurized unless
the doors are completely closed, latched and locked. The design of the doors should prevent
pressurization of the air vehicle at the maximum airflow rate from the pressurization system.
(TBD)
I.4.4.9.1.5 Pressurization.
Verify by analysis and inspection that doors and hatches are designed to prevent the cabin from
being pressurized if they are not properly closed, latched, and locked.
Analysis and inspection are necessary to verify that door and hatch designs will not permit the
cabin to be pressurized if doors and hatches are not properly closed, latched, and locked.
Analysis and inspection should cover all the probable failure modes of the subsystem.
Demonstrations should be performed on a full-scale article.
(TBD)
I.3.4.9.1.6 Unlocking under pressurization.
When the air vehicle is pressurized, the doors and hatches shall not unlock with the locks
energized to the open position.
The intent of this requirement is to ensure that the pressurization prevention design will hold the
locks in the closed position when the fuselage is pressurized and the locks are energized to
open.
This requirement primarily applies to the larger doors, whose in-flight loss could cause a safety
hazard.
948
JSSG-2009A
APPENDIX I
(TBD)
I.4.4.9.1.6 Unlocking under pressurization.
Verify by demonstration that the design shall prevent unlocking when the air vehicle is
pressurized with the locks energized to the open position.
Demonstration is intended to ascertain whether or not unlocking can occur while the air vehicle
is pressurized.
Demonstration should be accomplished at various fuselage pressure differentials until the

pressure is low enough to permit unlocking. A determination should then be made regarding
the safety aspects of the door opening at that pressure. All demonstrations should be
performed on a full-scale test model.
(TBD)
I.3.4.9.1.7 Pressurization prevention device failures.
(TBS) failures of the pressurization prevention device shall not permit the fuselage to be
pressurized without air vehicle doors being locked and latched.
The purpose of this requirement is to prevent the air vehicle from pressurizing with the locks in
the open position. This requirement is included to ensure that in no case will a single or multiple
failure permit the fuselage to be pressurized.
TBS should be completed by referring to JSSG-2001, “Reliability”.
(TBD)
949
JSSG-2009A
APPENDIX I
I.4.4.9.1.7 Pressurization prevention device failures.
Verify by analysis that a single failure or multiple failures of the pressurization prevention device
from permitting the fuselage to be pressurized without the proper positioning of the door locks
and latches.
The analysis is intended to ascertain whether or not hazardous pressurization can occur
subsequent to a single pressurization system failure or a combination of probable multiple
failures.
All failures in the pressurization system, which were identified in the analysis, should be tested
to ascertain the severity of the failure. The most critical condition can be identified by structural
analysis.
(TBD)
I.3.4.9.1.8 Door status monitoring.
The indication subsystem shall continuously monitor and provide an unsafe indication when the
doors, latches, or locks are unsecured, and provide a safe indication when they are secured.
The following air vehicle doors shall require indicators: (TBS) .
The purpose of this requirement is to ensure that the safe or unsafe status of the doors is
continuously presented to the aircrew members. The indicators also assist in trouble shooting
in the event of a malfunction.
TBS should be completed with a listing of all power-operated doors and other doors considered
critical to air vehicle safety.
a. The flight status of the pressurized air vehicle doors should be communicated by
multiple indicators (mechanical or electrical). Each indicator should be energized by a
separate sensor and an independent circuit. At least a single indicator should be
considered for unpressurized doors that are operated in flight.
b. Indicator sensors should sense the position of the doors, latches, and locks directly
without the use of auxiliary devices such as sensor targets.
c. Mechanical indicators should use positive mechanical linkage for extension and
retraction.
950
JSSG-2009A
APPENDIX I
d. The indication subsystem should be such that the deflection of the air vehicle structure
under all ground and flight load conditions should not cause false indications.
e. Indication that latching is complete should result only from full engagement of the mating
latch members.
f. Indication that locking is complete should result only from full engagement of the mating
locking members.
g. Remote electrical indication subsystems should incorporate a built-in test capability to
test the integrity of the indicator lights and circuits, and should not fail passively for any
probable failure modes.
(TBD)
I.4.4.9.1.8 Door status monitoring.
Verify by analysis and demonstration that each indication subsystem will continuously monitor
and provide an unsafe indication when either the door, latch, or lock is unsecured; and provide a
safe indication when they are secured.
Analysis and demonstration is intended to confirm that the indication subsystem continuously
monitors the door status.
Demonstration should be accomplished on the full-scale article in conjunction with other tests,
such as the life cycle tests and should include all the malfunctions that could give a false
indication determined by the analyses. Particular emphasis should be placed on those
malfunctions that could give a safe indication for an unsafe condition.
(TBD)
951
JSSG-2009A
APPENDIX I
I.3.4.9.1.9 Door control.
Controls shall be provided for all doors and hatches by (TBS) .
The purpose of this requirement is to ensure that controls are provided for doors in a manner
that will enable the crew to open or close the doors quickly and safely.
TBS: The following should be considered:

a. Door control interruption. Control power interruption or a reversal of the door controls
during an actuation cycle should not cause subsystem damage. Reversal of the controls
during a cycle should cause reversal of the door movement. The controls should be
capable of stopping door movement at any time in the cycle at the option of the operator
by selecting the control stop position. In the event of a power interruption, the door
controls should go to the stop position and it should not require reprogramming upon
resumption of power.
b. Manual actuation of door control subsystem. The controls should be designed for
emergency operation by means of manual actuation of the door sequence.
c. Inadvertent door actuation. Means should be provided to prevent inadvertent actuation
of the doors.
d. Malfunction or failure during cycle. The controls should automatically stop the sequence
in the event a malfunction or failure occurs part way through a cycle.
e. Alternate power. An alternate power source should be provided that will operate any
door that would require an alternate power source if the main power source is lost. The
time to operate the door with alternate power should reasonably approximate the time
using main power.
(TBD)
952
JSSG-2009A
APPENDIX I
I.4.4.9.1.9 Door control.
Verify by analysis and demonstration that the door controls are provided in a manner such that
the aircrew can operate the controls quickly and safely without the danger of damaging the air
vehicle.
Analysis and demonstration is intended to confirm that the door controls can be operated safely
and efficiently.
Demonstration should be accomplished on the full-scale article in conjunction with other tests,
such as the life cycle tests. The door controls should be tested both opening and closing from
several points in the actuation cycle. Manual operation of the door and a reversal of door
movement should also be tested.
(TBD)
I.3.4.9.1.10 Sealing.
All door and hatch seals and their supporting structures shall retain air pressurization during all
flight and ground operations when the engines are running.
The purpose of this requirement is to ensure that cabin pressurization is not lost as a result of
fuselage or canopy deflections.
The seals should retain air pressurization caused by maximum fuselage deflections. Seals
should be positively retained by methods other than or in addition to adhesive bonding and
should be designed for easy removal and replacement.
(TBD)
953
JSSG-2009A
APPENDIX I
I.4.4.9.1.10 Sealing.
Verify by analysis and demonstration that the seals will retain cabin pressurization as a result of
expected fuselage or canopy deflections.
Pressurization tests are intended to demonstrate the canopy and door seals’ ability to maintain
cabin pressurization.
Tests should be performed on a full-scale air vehicle under full load and maximum
pressurization.
(TBD)
I.3.4.9.1.11 Ramp load cycle time.
The ramp shall be capable of lifting ramp maximum load from the normal open to the fully
closed position in (TBS) .
The purpose of this requirement is to ensure that ramp actuation can be accomplished within
the allowable time specified.
TBS: Time should be determined by referring to JSSG-2001.
(TBD)
I.4.4.9.1.11 Ramp load cycle time.
Ramp load cycle time shall be verified by analysis and test.
The purpose of the analysis and test is to verify that the ramp is designed properly to lift the
specified loads in the specified time.
954
JSSG-2009A
APPENDIX I
All testing should be performed at rated system pressure and voltage and at normal actuation
rates. Ground test on the full-scale article should precede flight tests.
(TBD)
I.3.4.9.1.12 Extending and holding the cargo ramp.
The ramp shall have the capability of extending and holding full operational load in a position
level with the floor during ground and flight operations.
The purpose of this requirement is to ensure that the ramp will not drop with its load as a result
of a power system failure or interruption. All probable failure modes that may cause a ramp to
drop should be considered.
Specify the failure modes which the ramp is expected to withstand in order that it be restrained
in the loaded, fixed position. If trapped hydraulic pressure is used to hold the ramp, the trapping
valve should be located at the actuator port.
(TBD)
I.4.4.9.1.12 Extending and holding the cargo ramp.
Verify by analysis and test that the ramp will stop and hold its position while loaded to its
operational capability in the event of power system failure or interruption.
Analysis and test are intended to reveal any deficiency that would permit the ramp to drop in the
event of a failure.
Various hydraulic and electrical power interruptions singularly and in combination should be
simulated for the tests. Consult the structure engineers for the maximum ramp loads. All tests
955
JSSG-2009A
APPENDIX I
should be performed on the full-scale article before testing on test air vehicle. If a hydraulic
trapping value is used, verify that it is located at the actuator port.
(TBD)
I.3.4.9.1.13 Weapons bay door.
Weapons bay door latches shall be provided with a positive lock to prevent external air loads
from moving the weapons bay doors toward their open positions while the air vehicle is in flight
with the door controls set in the closed position. Manually operated hold-open latches shall be
provided to secure doors in the open position, shall incorporate a lock, and shall be located in
an area where personnel can access safely.
The purpose of this requirement is to ensure that the weapons bay doors do not open or close
unexpectedly due to external air loads.
Hold-open latches should be located away from turbine engine bleed-air exhausts, engine
intakes and exhausts, propellers, and such.
(TBD)
I.4.4.9.1.13 Weapons bay door.
Verify by analysis and inspection that weapons bay doors will not open due to external air loads.
Verify by analysis and test that latches are in place to secure weapons bay doors in the open
position.
Analysis and test are intended to reveal any design deficiencies that may permit the weapons
bay doors to open or close unexpectedly.
In flight-testing should be performed under various flying conditions to ensure weapons bay
doors do not open or close unexpectedly. Ground testing on the full-scale test model should
precede any ground or flight tests on test air vehicle. Tests on the full-scale test model should
simulate the wind loads.
956
JSSG-2009A
APPENDIX I
(TBD)
I.3.4.9.1.14 Weapons bay door performance.
Weapons bay doors shall be designed to travel from fully closed to fully open in (TBS 1)
under a (TBS 2) knot wind.
The purpose of this requirement is to ensure the weapons bay door can be opened within the
allowable time specified at the speed specified.
TBS 1 and TBS 2: Refer to JSSG-2001.
(TBD)
I.4.4.9.1.14 Weapons bay door performance.
Weapons bay door performance shall be verified by analysis and test.
The verification is intended to demonstrate that the operation of the weapons bay doors is
completed within the established time period under the specified load.
The demonstration should be performed on a fully assembled subsystem, preferably on a full-

scale article. Ground tests should precede flight tests. In-flight tests should be performed at
maximum speed.
(TBD)
957
JSSG-2009A
APPENDIX I
I.3.4.9.2 Airframe bearings.
Airframe bearings shall be capable of joining mechanical elements; transmitting design loads
through the full range of the system operating parameters; permitting rotation, misalignment, or
both while maintaining a specified dimensional relationship between the joined elements;
reducing friction and wear; and making friction and wear more predictable. Airframe bearings
shall be standardized to the maximum extent possible without compromising performance.
Proper selection of airframe bearings will provide structurally efficient joints that are trouble free
in service at the lowest possible total cost. Standard bearings are given priority in new design
in order to minimize the cost of procurement and testing, reduce schedule and technical risk,
and obtain multiple sources of supply.
MIL-HDBK-1599 should be used for selection, application, and installation of airframe bearings.
The information contained within MIL-HDBK-1599 is considered guidance that may be deviated
from when adequate technical justification exists. Parts listed in MIL-HDBK-1599 are standard
parts and should be given selection priority in mechanical and functional system design.
The system operating parameters are the basis of selecting what type of bearing should be
used for a particular application. Table 201-VII in MIL-HDBK-1599 provides bearing selection
parameters. The first step in the selection of an airframe bearing is to determine whether an
antifriction or a plain bearing would best fit the needs of the application. Under normal
circumstances, the type of bearing that is superior in the greatest number of desirable properties
would be the logical choice. However, in some instances one property may be so important that
a selection can be made on the basis of this quality alone.
Standard bearings should be used in all possible application because:

a. Nonstandard bearings may be priced from 3 to 20 times the cost of equivalent standard
bearings.
b. Due to lack of reliable data on load-life relationships and static limit loads, calculations
alone are used on nonstandard bearings by the vendor to determine capacity. No
qualifications or service testing has been done, making the performance of the bearing
the responsibility of the purchaser.
c. Standard bearings can, in many cases, be obtained from stock or from frequent
production runs which should shorten the lead time needed to obtain bearings. Special
bearing can require up to one year from the time the order is placed to delivery.
d. It is wise to have a multiple source of supply because strikes, disasters, or material
shortages can cause long delays when special bearings are obtained from one vendor.
Standards with Qualified Products Lists are required to identify at least two suppliers.
958
JSSG-2009A
APPENDIX I
Bushings have been provided for all bolts and pins subject to angular or other motions, which
tend to distort or enlarge the hole. Bushings have been economical replaceable elements that
protect expensive structural members from wear and galling. Bushings that have been securely
installed and assume all of the wear and deformation at the joint have assured that: (1) relative
motion, and thus wear, occurred at the intended surface; (2) the bushing have not migrated out
of the housing; and (3) proper stresses have been maintained in the bushing and housing.
Bushing installed with a sliding fit have been used as a spacer to eliminate clevis deflection in a
clevis-and-lug bearing joint. Bushings have not been necessary in standard items such as fork-
end cable terminals and turn buckles.
In previous applications it has been found that only a portion of the shaft will be in contact with
the bearing surface due to shaft bending in large length-to-diameter bushings. Therefore, when
the effective projected area was computed to determine static capacity, the length used in the
computation did not exceed the bushing diameter even though the length of the bushing may
have exceeded the diameter.
In the past, design activities prepared a Program Parts Selection List (PPSL). Design selection
of parts from a PPSL promoted standardization. All parts introduced in the design of equipment,
system or subsystem were listed on the PPSL.
I.4.4.9.2 Airframe bearings.
The airframe bearing shall be verified by (TBS) .
Analysis and test of the airframe bearing reduces the risk of costly design changes, which would
result from the need to increase bearing capability. A design change could also impact
surrounding structure design. The risk of bearing replacement becoming a high maintenance
item is also reduced.
TBS: MIL-HDBK-1599 should provide guidelines for analysis of airframe bearings. Verify by
demonstration that airframe bearings are standardized to the maximum extent possible without
comprising performance. Analysis and testing of nonstandard bearings should take into
account the nonstandard features of the bearing as well as the design application for which the
nonstandard bearing is intended.
(TBD)
959
JSSG-2009A
APPENDIX I
I.3.4.9.2.1 Capacity.
Airframe Bearings shall have the highest load capacity rating consistent with space and weight
as specified in (TBS) .
Growth of air vehicle capabilities generally result in bearing design load increases as the air
vehicle program matures. Providing the highest capacity bearing that will fit in the available
space during the initial design will preclude overloading bearings in future model air vehicles or
expensive structural redesign to incorporate larger bearings.
TBS: MIL-HDBK-1599 should be used to provide capacity equations for the most common
airframe bearing types. The capacity equations or other analytical tools should be used to
compare candidate bearings.
The proper size of the bearing have been determined after choosing what type of bearing best
meets the operating parameters. The two primary load conditions that have been considered to
properly select a bearing for aerospace vehicle applications were (1) “static” loading, which is
concerned with the strength of the bearing and its ability to resist significant deformation and
fracture, and (2) “dynamic” loading, which is concerned with the oscillation or rotation of the
bearing while under fixed or changing load and is limited by fatigue and wear. After a tentative
selection was made on the basis of static capacity, the size selected was reviewed to determine
if it had adequate life for the rotation or oscillation desired.
I.4.4.9.2.1 Capacity.
Airframe Bearing capacity shall be verified by (TBS) .
Analysis and test of the airframe bearing capacity reduces the risk of costly design changes,
which would result from the need to increase bearing capacity. The risk of bearing replacement
becoming a high maintenance item is also reduced.
TBS: Verify by test or analysis that the bearing meets the capacity requirements of the
application. Analysis of bearing capacity using the capacity equations of MIL-HDBK-1599
should be sufficient to verify the requirement of most airframe bearing applications. When
unique applications or nonstandard bearings are used, use of other analytical techniques may
be appropriate.
960
JSSG-2009A
APPENDIX I
An airframe bearing may be subjected to radial, axial and moment loading at the same time. It
will be necessary to calculate the equivalent thrust load and to determine the proper size
bearing by a comparison of the calculated equivalent load and the limit thrust load using
appropriate analytical techniques.
I.3.4.9.2.2 Installation and retention.
Bearings shall be sized to fit within a housing as specified in (TBS) . If lubrication of the
bearing is required, the bearing shall be lubricated when installed and provisions shall be made
for re-lubrication, inspection and replacement.
The proper fit of bearings within the housing will preclude adverse effects such as fretting
corrosion, unacceptable stress levels in either the bearing or housing, migration of the bearing
out of the housing, and reduced bearing fatigue and wear life.
Some bearings require periodic re-lubrication to achieve rated life. Provisions are needed for
the maintainer to re-lubricate the bearings with standard tools.
TBS should be filled in with AIA/NAS 0331, MIL-HDBK-1599, or other specifications that provide
guidelines for airframe bearing installation, retention, and replacement. Requirement 202 of
MIL-HDBK-1599 provides guidelines for establishing engineering criteria and design information
relative to the installation and retention of bearings, including recommended shaft and housing
fits to mount standard bearings. Requirement 203 of MIL-HDBK-1599 provides guidance for
establishing standard practices for the lubrication of the bearings and bearings surfaces.
Nonstandard bearings may require special consideration to select the proper fit for the bearing
to operate as designed.
Landing gear trunnion bearings require a special fit to ensure the landing gear meets the
requirement to drop and lock under its own weight.
I.4.4.9.2.2 Installation and retention.
Compliance with the installation and retention requirement shall be verified by (TBS) . Verify
by inspection that bearings that require lubrication are lubricated when installed and provisions
have been made for re-lubrication, inspection and replacement.
961
JSSG-2009A
APPENDIX I
Verification of installation requirements during the initial design assures that the bearing
operates as intended when exposed to the loads, temperatures and contaminants of the design
environmental conditions. Verification of lubrication requirements assures that bearings operate
as intended when installed and that proper maintenance can be performed.
TBS should be filled in with inspection. Inspection of assembly, installation, and fabrication
drawings, process specifications confirms that proper provisions have been specified for
installing, maintaining, and replacing airframe bearings. AIA/NAS 0331 and MIL-HDBK-1599
provide a basis for evaluating installation and lubrication provisions on engineering drawings.
Unique application or nonstandard bearings may require provisions that differ from
AIA/NAS 0331 and MIL-HDBK-1599, which is acceptable with adequate justification.
(TBD)
I.3.4.9.2.3 Antifriction bearings.
If required, antifriction bearings shall be in accordance with (TBS 1) . Design and usage
limitations shall be as follows (TBS 2) .
Standard bearings should be given priority in new design in order to minimize the cost of
procurement and testing, reduce schedule and technical risk, and obtain multiple sources of
supply. Design and usage limitations reflect accepted design practices within the aerospace
industry to provide structurally efficient joints that are trouble free in service.
TBS 1 should be filled in with MIL-HDBK-1599 selection recommendations, SAI AS 3990, and
SAE AS6038, AS6039, AS7949, and AS8914.
TBS 2 should be filled in with information from table 201-VII of MIL-HDBK-1599, which provides
guidance for design and usage limitations.
Antifriction (or rolling element) bearings have several advantages over plain bearings. A life
with essentially no wear, a comparatively small lubricant requirement, and a low starting and
dynamic friction coefficient are the principal advantages. Their use results in reduced control
system friction and pilot effort. The extremely close internal clearances permit backlash or
looseness to be reduced to a minimum.
962
JSSG-2009A
APPENDIX I
Caution: antifriction bearings are manufactured to very close tolerances and are adversely
affected by contaminants or moisture. Rough and careless handling and installation can
seriously reduce the life.
When nonstandard bearings were used they were approved via the program process for
inclusion in the PPSL.
I.4.4.9.2.3 Antifriction bearings.
Antifriction bearings shall be verified by inspection.
Conformance with the specified standards is necessary to achieve required performance.
The inspection should verify that the Antifriction Bearing are in accordance with MIL-HDBK-
1599, SAI AS 3990, and SAE AS6038, AS6039, AS7949, and AS8914.
Additional laboratory testing is not necessary for parts listed on a DOD approved qualified
products list as long as the proposed application is well within the loads and conditions
established in the associated specification and standards.
I.3.4.9.2.4 Plain bearings.
If required, plain bearings shall be in accordance with (TBS 1) . Design and usage
limitations shall be as follows: (TBS 2) .
Standard bearings should be given priority in new design in order to minimize the cost of
procurement and testing, reduce schedule and technical risk, and obtain multiple sources of
supply. Design and usage limitations reflect accepted design practices within the aerospace
industry to provide structurally efficient joints that are trouble free in service.
TBS 1 should be filled in with MIL-HDBK-1599 selection recommendations and SAE AS81820,
AS81934, AS81935, AS81936, and AS8952.
TBS 2: Select one or more of the listed limitation parameters that apply to the air vehicle
subsystem and equipment:
963
JSSG-2009A
APPENDIX I
a. Table 201-VII of MIL-HDBK-1599 provides guidance for design and usage limitations.
b. Self-aligning bearings should be employed where linkage geometry or structural
deflections would induce unacceptable stress levels in rigid bearings.
c. Sintered bearings generally are not suitable for airframe applications. If used the
following limitations should be observed:
1. Design loads should be less than 1000 psi.
2. The bore should not be reamed since metal can be smeared over the voids in the
bearing surface, thus preventing oil from being released from the porous structure.
3. Use in continuous rotation applications only. Oscillation under unidirectional load
does not allow liberated oil to be spread freely on the bearing surface, resulting in
accelerated wear.
4. Do not use where subjected to shock loads.
d. Plain annular and plain self-aligning bearings are generally not suitable in air vehicle
primary control systems and other critical applications. They are intended for use where:
1. Moderate friction and bearing play at low rotational speeds are not objectionable.
2. Wear is not excessive.
Bearings are not subject to vibratory shocks and alternating loads.
Generally, plain (or sliding surface) bearings have higher friction than antifriction types of the
same size but have greatly increased static load capabilities. Dynamic life is a function of the
type of lubricant and the imposed load and is the limiting condition for this class of bearing.
Dynamic load allowables are much lower than static load allowables, which is a major difference
when compared to antifriction bearing values. In general, plain bearings are more rugged than
antifriction types and can better tolerate contamination and careless handling.
For SAE AS81820 plain spherical bearings, the radial static limit load is calculated for the
capacity of the bearing, housing, and pin. Because the wide series has a greater pin bending,
the radial capacity is rated lower than the bearings listed in the narrow series.
Nonstandard plain bearings have been approved via the program process for inclusion in the
PPSL may be used.
964
JSSG-2009A
APPENDIX I
I.4.4.9.2.4 Plain bearings.
Verify by inspection and test that plain bearings are in accordance with (TBS) . Verify by
inspection that plain bearing design and usage limitations are followed.
Inspection of assembly, installation, and fabrication drawings confirms that specified plain
bearings conform to the specified standards or have been approved via the PPSL process and
that design and usage limitations have been followed.
TBS should be filled in with SAE ARP5448, which provides recommended practices for testing
plain bearings.
Additional laboratory testing is not necessary for parts listed on a DoD-approved Qualified
Products List (QPL) (https://assist.dla.mil/online/start) if the proposed application is within the
loads and conditions established in the associated specification and standards. Non-standard
bearings may require additional testing as recommended in SAE ARP5448 to verify the bearing
will meet the performance requirements of the application.
I.3.4.9.3 Fastener subsystem.
The fastener subsystem shall be capable of joining and securing airframe structural members,
air vehicle components, access panels and doors while preserving the structural integrity of the
elements being joined. The fastener subsystem shall use common fasteners and attributes to
the maximum extent possible without compromising performance.
It has been estimated that 20 to 30 percent (20-30%) of the cost of air vehicle procurement and
maintenance can be attributed to fasteners and fastening subsystems. The selection of
appropriate fasteners is of extreme importance. Standard fasteners should be given priority in
new aerospace systems design.
The design activity should prepare a PPSL. A PPSL inhibits the proliferation of fastener designs
used in aerospace applications; and assists in reducing part numbers, lowering procurement
cost, utilizing common maintenance practices, and reducing support tool variations. All parts
introduced in the design of equipment, system or subsystem should be listed on the PPSL.
965
JSSG-2009A
APPENDIX I
Where possible and practical, mating parts (except where flush head bolts or plate nuts are
used) should have similar external wrenching configurations.
(TBD)
I.4.4.9.3 Fastener subsystem.
The fastener subsystems ability to join and secure airframe structural members, air vehicle
components, access panels and doors while preserving the structural integrity of the elements
being joined shall be incrementally verified by (TBS) . Verify by demonstration that the
fastener subsystem uses common fasteners and attributes to the maximum extent possible
without compromising performance.
Standard fasteners and fastener subsystems are expected to be used in most applications. This
requirement can be verified through analysis and test of new fasteners and fastener subsystems
to determine their mechanical and physical properties. This verification also establishes the
methods to demonstrate that the fastener subsystem uses common fasteners and attributes.
TBS should be filled in with analysis, inspection, demonstration, test, or a combination of these
methods.
AIA/NASM1312 describes the unified standard methods of testing, analysis of data, and
presentation of results.
(TBD)
966
JSSG-2009A
APPENDIX I
I.3.4.9.3.1 Fastened joint allowables.
The fastener and joint design allowables shall not exceed those design allowable values
specified in (TBS 1) . Where the design allowables are nonexistent, they shall be as
established in (TBS 2) .
To determine the strength of mechanical joints, it is necessary to know the strength of the
individual fastener, both by itself and when installed in various thicknesses of various materials.
TBS 1 should be filled in with DOT/FAA/AR-MMPDS, Chapter 8, which presents joint design
allowable loads for a variety of mechanically fastened joints.
TBS 2 should be filled in with DOT/FAA/AR-MMPDS, Chapter 9, which establishes procedures

necessary to develop joint design allowable loads.
(TBD)
I.4.4.9.3.1 Fastened joint allowables.
The fastener and joint design allowable loads shall be verified by (TBS) .
The design allowable loads in DOT/FAA/AR-MMPDS are used in the design of aerospace
structures and elements. DOT/FAA/AR-MMPDS is the most authoritative document reflecting
the actual properties of the products covered.
TBS should be filled in with test or analysis. The joint design allowable loads can be confirmed
with the use of DOT/FAA/AR-MMPDS, Chapter 8. Where the design allowable loads have not
been predetermined, DOT/FAA/AR-MMPDS, Chapter 9 provides the detailed information on the
generation and analysis of joint data that results in the determination of joint allowable loads.
The minimum data requirements and analytical procedures are defined in this chapter for the
establishment of DOT/FAA/AR-MMPDS design allowable loads. AIA/NASM1312 is the
recommended source for the test procedures in developing joint allowable load information.
(TBD)
967
JSSG-2009A
APPENDIX I
I.3.4.9.3.2 Fastener threads.
Fastener threads shall be as defined (TBS 1) . Fastener threads used in safety critical
applications shall be as defined (TBS 2) . Military engineering cognizant activity for air
vehicle subsystem and equipment shall approve designation of a fastener thread as safety
critical.
Selection of thread geometry should be limited to a single specification to standardize on thread

dimensions (preferred diameter-pitch).
TBS 1 should be completed using the following guidance. The UNJ thread form has been
adopted by the aerospace industry as the all-purpose thread standard, with the exception of
thread sizes .138 inches and smaller, which may use the UN thread form. Within standard UNJ
threads, the use of fine threads should be given preference to facilitate the maximum usage of a
limited number of threads. For aerospace applications, Classes 3A and 3B should be used.
ASME B1.15 contains basic thread data for all standard pitches of threads.
TBS 2 should be filled in with consideration given to the following safety critical applications:
(1) thread failure that results in structural failure, or loss of canopy, or landing gear failure, or
subsystem failure, or engine ingestion of foreign objects; (2) thread failure that is not the result
of multiple failures; and (3) the primary joint failure mode is tension.
It is the responsibility of the design activity of new equipment to identify safety critical
applications. The designation of a fastener thread as safety critical indicates that the fastener is
used in a safety critical application.
(TBD)
I.4.4.9.3.2 Fastener threads.
Configuration compliance shall be verified by (TBS) .
(TBD)
TBS should be filled in with inspection.
968
JSSG-2009A
APPENDIX I
(TBD)
I.3.4.9.3.3 Fastener usage limitations.
Fastened joint usage limitations shall be as follows (TBS) .
This requirement provides fastener usage limitations associated with their use. These usage
limitations have been developed by the military and aerospace industry, and indicate accepted
design practices necessary for air vehicles and subsystems.
TBS should be filled in by selecting one or more of the listed limitation parameters that apply to
the air vehicle subsystem and equipment.
a. In the design selection of inserts, consideration should be given to the axial load-carrying
capabilities of the installed insert in a specific parent material.
b. Inserts should be installed in accordance with manufacturer’s instructions or approved
user procedures to insure prevention of their movement during installation or removal of
the externally threaded part.
c. Screw thread or screw-locking inserts should not be used in the following applications
unless the externally threaded part is held by a positive-locking device that requires
shearing or rupture of material before torsion loads would be applied to the externally
threaded part in such a manner as to relieve the initial stress of the assembly:
1. At joints in control systems, at single attachments, or where loss of the threaded
member affect safety of flight.
2. With an externally threaded part that serves as an axis of rotation.
d. Externally threaded fasteners used in conjunction with self-locking inserts should be
selected to ensure full engagement of locking device and sufficient thread engagement
to guarantee full development of the required design tension load.
e. Silver plated or cadmium plated inserts should not be used in titanium housings.
f. Self-locking inserts require suitable lubricant at thread interface when being mated with
titanium or corrosion resistant screws or bolts.
g. When using studs in tapped holes, consideration should be given to eliminating the
possibility of stud rotation when installing or removing the mating unit.
h. Stepped studs may be used to provide higher strength capabilities in relatively low
strength structural (parent) materials with a shorter length of engagement than required
for straight studs (both ends same diameter). In the design selection of studs for
969
JSSG-2009A
APPENDIX I
structural applications, it is necessary that the proper degree of consideration be given to

the axial load carrying capabilities of the installed stud in the specific parent materials at
the maximum operating temperature of the assembly. The axial load capability of an
installed stud is determined by the lesser value of either the minimum tensile strength of
the nut end or by the resistance to pull out from the parent material.
i. Resistance to pull out of the installed stud is the product of the shear engagement area
of the stud end thread and the allowable shear stress of the parent material at the
maximum operating temperature. It does not represent a dimension of either of the
members in an unassembled condition.
j. The allowable shear stress for most metallic materials is listed in DOT/FAA/AR-MMPDS.
The shear engagement areas of the stud end thread may be obtained from the stud
standard. Most studs are intended to be loaded primarily in tension. Joints carrying
shear loads should be designed to preclude subjecting the studs to shear loads or use
only those studs whose features allow their use under shear loading.
k. Quick release pins may be of the following types: positive-locking, single-acting, and
positive-locking, double-acting. Quick release pins are primarily designed to be used in
applications that require double shear strength capabilities combined with quick-
disconnect features.
l. The specific shear and tension load capabilities are a function of the material being
attached, hole size, and hardness of application material. Typical applications are quick
attachment and removal of ground support equipment and attaching warning streamers
to critical joints.
m. Plain washers may be used to accommodate variations in grip length, and under a nut to
protect surface from damage and to reduce the stress of the joint by increasing the
bearing area. Plain washers should be used to avoid electrolytic corrosion by preventing
contact of dissimilar metals.
n. Lock washers should not be used in airframe applications.
(TBD)
I.4.4.9.3.3 Fastener usage limitations.
Fastener usage limitations shall be verified by (TBS) .
Inspection and demonstration are considered the most appropriate verification methods to
confirm that the fasteners meet the requirements.
970
JSSG-2009A
APPENDIX I
TBS: Verification of this requirement should be accomplished by an inspection of assembly,

installation, fabrication drawings and processing specifications to confirm the fastener
adherence to the design and usage limitation requirements.
(TBD)
I.3.4.9.3.4 Externally threaded fastener usage limitations.
Externally threaded fastener usage limitations shall be as follows: (TBS) .
This requirement provides screw and bolt usage limitations associated with their use. These
usage limitations have been developed by the military and aerospace industry, and indicate
accepted design practices necessary for air vehicles and subsystems.
a. Structural screws and bolts loaded in shear should have sufficient grip length so that no
threads are in bearing.
b. Interference between the hole and the head to shank radius should be avoided. It is
standard design practice to use countersunk washers or countersunk bolt holes under
high-strength (160 ksi and above) protruding head screws and bolts for clearance of the
head-to-shank fillet radius.
c. Screws and bolts smaller than .250 inches in diameter should not be used in any single
bolted structural connection, including primary control systems, or any application where
failure would adversely affect safety of flight.
d. The smallest recommended diameter for 100º reduced flush head screws and bolts is
normally .250 inches. However, .190 inches diameter 100º reduced head screws and
bolts may be used in panels whose removal is not required for scheduled maintenance.
e. Aluminum alloy threaded screws and bolts should not be used in structural applications.
f. Silver- or cadmium-plated screws and bolts should not be used in contact with titanium
structure. Cadmium plated screws and bolts should not be used in temperature probes,
electrical or life support space vehicle components or subsystems, portable water
supplies, or food processing equipment.
g. Titanium alloy screws and bolts should not be used with silver plated self-locking nuts at
temperatures above 600ºF, or cadmium plated nuts at temperatures above 200ºF.
971
JSSG-2009A
APPENDIX I
h. Self-locking screws and bolts or screws and bolts utilizing self-locking elements should
not be used as follows:
1. at joints in control systems, at single attachments, or where the loss of the bolt would
affect safety of flight;
2. as an axis of rotation for another part unless the fastener is held in a positive locking
device that requires shearing or rupture of material before torsion loads would be
applied to the bolt in such a manner as to relieve the internal stress of the assembly
or turn the bolt loose;
3. at any single bolted structural joint that serves as a primary load path, the failure of
which would endanger the safety of personnel or would render the equipment
inoperative or cause its destruction.
i. Self-locking screws and bolts, or screws and bolts utilizing self-locking elements should
not be used to attach access panels or doors, or to assemble any parts that are routinely
disassembled at intervals less than 400 flight hours.
j. Self-locking screws and bolts, or screws and bolts utilizing self-locking elements should
not be used on jet engine air vehicle locations where a loose fastener could fall or be
drawn into the engine intake.
k. For screws and bolts utilizing a self-locking element, the entering end of the threaded
holes used in conjunction with the self-locking externally threaded fastener should be
countersunk 90º to 120º. This countersink should have a minimum diameter of .015
inches larger than the major thread diameter of the fastener. This is to prevent the first
thread from cutting the self-locking element.
l. Unthreaded holes, or portions of holes through which a bolt utilizing a self-locking
element must pass, should have a minimum diameter sufficient to clear the locking
element.
Self-locking screws and bolts, or screws and bolts utilizing self-locking elements should not be
used with castellated nuts or self-locking nuts.
Fasteners of the same diameter having the same grip length, but different shank length; or
those having the same shank length, but different grip length; should not be used in the same
bolt circle or in proximity where they could be inadvertently interchanged.
(TBD)
972
JSSG-2009A
APPENDIX I
I.4.4.9.3.4 Externally threaded fastener usage limitations.
Externally threaded fastener usage limitations shall be verified by (TBS) .
confirm that the screws and bolts meet the limitation requirements.
TBS should be filled in with consideration given to the following: Verification of this requirement
should be accomplished by an inspection of assembly, installation, fabrication drawings, and
processing specifications to confirm the screw and bolts adherence to the design and usage
limitation requirements.
(TBD)
I.3.4.9.3.5 Nut usage limitations.
Nut usage limitations shall be as follows (TBS) .
This requirement provides nut usage limitations associated with their use. These usage
limitations have been developed by the military and aerospace industry, and indicate accepted
design practices necessary for air vehicles and subsystems.
a. Self-locking nuts are preferred over non-self-locking nuts in air vehicle applications.
Self-locking nuts for use with bolts or studs with a minimum ultimate tensile strength of
160 ksi and designed for high tension fatigue loading should be external wrenching nuts,
barrel nuts, or plate nuts which will develop the full tensile strength of the bolt.
b. Plain or self-locking nuts used in:
1. any joint that serves as an axis of rotation, or
2. any joint that is designed to transmit motion which may result in relative rotation
between components in the joint, or
3. any bolted structural joint with less than three bolts and serves as a primary load
path, the failure of which would endanger the safety of personnel or would render the
973
JSSG-2009A
APPENDIX I
air vehicle inoperative or could cause its destruction, should be secured by positive
type mechanical locking devices.
c. Bolts, studs or screws should extend through the self-locking nut for a length equivalent
of two threaded pitches. This length includes the chamfer.
d. Self-locking nuts that are attached to structure should be attached in a positive manner
to eliminate the possibility of their rotation or misalignment when tightening is to be
accomplished by rotating the bolts or screws. The manner of attachment should permit
removal without injury to the structure, and permit replacement of the nuts. When
projection spot-welding is used for attaching plate nuts, control should be maintained in
order that removal by drilling out welds permits replacement with drilled plate nuts.
e. Self-locking nuts should not be used:
1. at joints in control systems at single attachments, or
2. where loss of the bolt would affect safety of flight, unless the treaded parts are held
by a positive locking device that requires shearing or rupture of materials before
torsion loads relieve the initial stresses of the assembly.
f. Self-locking nuts should not be used with bolts or screws in locations where the loose
nut, bolt or screw could fall or be drawn into an engine air intake duct.
g. Self-locking nuts should not be used with bolts, screws, or studs to attach access
panels, doors or to assemble any parts that are routinely disassembled prior to or after
each flight.
h. All nuts, except self-locking nuts and nuts for machine screws, should be locked by
cotter pins or safety wire.
(TBD)
I.4.4.9.3.5 Nut usage limitations.
Nut usage limitations shall be verified by (TBS) .
confirm that the nuts meet the requirements.
TBS should be filled in with consideration given to the following: Verification of this requirement
can best be accomplished by an inspection of assembly, installation, fabrication drawings and
processing specifications to confirm the nuts’ adherence to the design and usage limitation
requirements.
974
JSSG-2009A
APPENDIX I
(TBD)
I.3.4.9.3.6 Blind fastener usage limitations.
Blind fastener usage limitations shall be: (TBS) .
This requirement provides blind fastener usage limitations associated with their use. These
usage limitations have been developed by the military and aerospace industry, and indicate
accepted design practices necessary for air vehicles and subsystems.
a. Solid rivets or blind fasteners should be used in structural joints only where shear loads
are the primary design load consideration.
b. The edge distance (center of hole to edge of sheet) for the location of rivets in sheets
should be a minimum of two rivet diameters. The minimum spacing for riveted joints in
fuel tight areas should be three rivet diameters; other minimum spacing should be four
rivet diameters in the same adjacent rows or in staggered patterns.
c. To minimize galvanic corrosion of the joint, rivets should not be anodic to the most
anodic material in the joint.
d. Solid rivets should be driven utilizing tools that conform to acceptable aerospace
practices for the rivet size and material being upset. When using rivet material harder
than the material to be joined, particular care should be taken to avoid distortion during
riveting. Special care is recommended when selecting rivet types and materials for
installation through nonmetallic structures. Soft materials may be riveted by using
washers under the rivet-upset trail.
e. Spot-facing should be used to provide a flat surface under upset heads when:
1. the surface slope is greater than 8° under the upset head of the rivets;
2. a curved surface has a radius less than three times the rivet shank diameter;
3. and the roughness of the facing surface under the heads is greater than 500 RHR.
f. Solid rivets should not be used where forces required to upset the rivet that could be
detrimental to the structure.
g. Blind rivets and fasteners are intended for applications where inaccessibility precludes
the use of conventional fasteners, and as a repair fastener for solid rivets.
975
JSSG-2009A
APPENDIX I
h. Blind rivets and fasteners should not be used in liquid tight areas. Blind rivets and
fasteners should not be used in applications where they are subject to removal during
routine servicing and overhaul. Blind rivets and fasteners should not be used on control
surface hinges, hinge brackets, flight control actuating systems attachment, wing attach
fittings, landing gear fittings, or similar applications.
i. Mechanically locked spindle blind rivets may be used in engine inlet areas. Friction
locked spindle blind rivets should not be used in engine inlet areas. Blind rivet holes for
dimpled assembly should be drilled to size after dimpling.
(TBD)
I.4.4.9.3.6 Blind fastener usage limitations.
Blind fastener usage limitations shall be verified by (TBS) .
confirm that the blind fasteners meet the requirements.
TBS should be filled in with consideration given to the following: verification of this requirement
can best be accomplished by an inspection of assembly, installation, fabrication drawings and
processing specifications to confirm blind fastener adherence to the design and usage limitation
requirements.
(TBD)
I.3.4.9.3.7 Fastener sizing.
The shank diameter of threaded structural fasteners shall not be less than .190 inches.
The rationale for having a fixed minimum fastener diameter for threaded structural applications
is to provide structural integrity in the bearing and shear load paths. When a .190-inch minimum
diameter for structural fasteners is established, maintainability is greatly aided. Fasteners with
diameters less than .190 inches are easily over-torqued by hand-held drivers.
976
JSSG-2009A
APPENDIX I
This requirement should apply only to threaded structural fasteners that are torqued or installed
by a driving recess in the head of the fastener. This requirement should not apply to rivets,
either solid or blind, or pin and collar type fasteners where the driving recess is in the thread end
when utilized with the intended or designed mating torque-off collar. When a regular nut or non-
torque limiting device is used in conjunction with the point drive threaded fasteners, then the
above requirement should apply.
When small diameter fasteners are utilized in long grip length, bolt bending also becomes a
problem and joint stiffness is lost.
I.4.4.9.3.7 Fastener sizing.
Fastener sizing shall be verified by (TBS) .
Sizing must be verified to assure adequate strength and fastener life is achieved.
TBS should be filled in with inspection and demonstration.
Since some Military, industry, prime contractor and vendor drawings on threaded fasteners
allow or call out diameters smaller than .190 inches diameter, it is easy for a weight conscious
designer to inadvertently select a smaller than .190 inch diameter. Merely checking a PPSL list,
which usually does not go into detail as to diameter or limitations, will not find this problem. Also
PPSL’s usually do not indicate the mating parts, such as nut or collar with the pin or bolt.
Inspection is the only way to determine what parts are mated together. Various shop practices,
rework and repair procedures and deviations from design drawings also may change what
diameters are actually used from what is called out. Also there are “gray” areas where a
designer may believe that his application is not structural or critical and select a smaller than
.190 inch diameter.

(TBD)
977
JSSG-2009A
APPENDIX I
I.3.4.9.3.8 Head angle.
The head angle of countersunk fasteners and the nominal fastener recess angle shall be
(TBS 1) , except for (TBS 2) , whose head angle shall be (TBS 3) .
To determine the proper fastener head angle or countersink for flush type fasteners, it is
necessary to know the joint thickness or top sheet skin thickness as well as the materials
physical strength, such as sheet bearing, shear, and compression. The head countersink
included angle of 100 has been accepted as an aerospace industry standard to prevent any
countersink mismatch and subsequent fastener hole deformation. Also, it provides for cross-
servicing of air vehicles between NATO countries. For thin sheet joints, 120 and 130 head
angles have been used.
TBS 1 should be completed using a specific value for the head angle of the countersunk
fasteners.
TBS 2 should be completed by indicating any exceptions to the value in TBS 1.
TBS 3 should be completed by giving the value(s) for the exceptions indicated by TBS 2. For
metallic structure, the 100º countersink head angle has been accepted as an aerospace
industry standard to prevent any countersink angle mismatch in assembled joints, and has been
determined by test and field service life to be the optimum balance between sheet thickness and
fastener strength for air vehicle structural materials. For non-metallic structure, tests have
shown that head angles of 130º work satisfactorily. Some solid rivets, which can be used in
structural applications, provide head angles of 120º. Fasteners with head angles of 130º and
120º provide the capability of utilizing thinner joint materials.
(TBD)
978
JSSG-2009A
APPENDIX I
I.4.4.9.3.8 Head angle.
Head angle shall be verified by (TBS) .
Verification of the proper countersink angle is accomplished by inspection since that is the only
positive method of insuring the compliance with this requirement. There are no quick,
economical tests that will discern countersink angles with the fastener installed. Inspection of
the physical parts and components as well as drawing inspection can accomplish this most
readily.(Rewrite)
TBS should be filled in with inspection.
Since various countersink-included angles exist, not only on the fasteners but also in the sheet
or plate in which the countersink fastener is installed, many inadvertent combinations exist. The
wrong countersink fastener may be placed in the correct countersink hole. The correct
countersunk fastener may be installed in the wrong countersunk hole, or the wrong countersunk
fastener installed in a different but still wrong (per drawing call out) countersunk hole. These
misapplications can only be detected by inspection. Inspection of drawings and PPSL will
usually indicate the proper head countersink angle and the statistical probability that the
physical hardware is per the drawing should be very high.
(TBD)
I.3.4.9.3.9 Fasteners used in single point linkages.
In critical single point linkages, such as flight control linkages, the fastener subsystem shall use
self-retaining bolts.
Single-bolt linkage-joints are used throughout an air vehicle. In many cases, loss of this single
bolt could cause catastrophic failure and loss of the air vehicle and life. Examples of such
usage are fuel controls, throttle controls, and flight controls. Two types of self-retaining bolts
(SRB) have been developed to solve this critical flight safety requirement. These are described
below as well as guidance for their selection. Both are equal in overall performance.
Two types of SRB have been developed for critical flight safety applications and are considered
of comparable performance. Type I, positive locking bolts, are designed to be installed and
979
JSSG-2009A
APPENDIX I
removed after the retaining element release button is actuated to allow the locking elements to
retract into the bolt body. Type II, impedance type bolts, are designed to be installed and
removed by overcoming the frictional force of the retaining elements.
The joint should be designed so that with a self-retaining bolt installed, the joint integrity is not
dependent on washers or any other normally removable parts, other than the bolts. A maximum
of two washers may be used to adjust for tolerance variation and, when required, they should be
used under the head of the bolt, but not under the nut. Bridging spacers may be used on
positive-locking bolts only.
Self-retaining bolts should be used in control systems where the bolt serves as an axis of
rotation and where separation of the linkage will affect safety of flight. These include controls for
flight, fuel, engine air reduction, and propeller systems. The bolts should be additionally locked
in position by counterbored-castellated nuts with captive washers. Type II, impedance, self-
retaining bolts are less expensive to manufacture, easier to install and remove and have a
higher shear and tensile capability, however, the positive loading type I will ensure a positive
joint, if installed properly. Corrosion-resistant steel parts are preferred over alloy steel parts.
(TBD)
I.4.4.9.3.9 Fasteners used in single point linkages.
Verify by inspection and demonstration that the fasteners used in critical single point linkages
(such as flight control linkages) are self-retaining bolts.
The type I and II self-retaining bolts specified in the requirements section have been developed
specifically to solve the critical flight safety problem and have done so successfully whenever
applied. Only by physical inspection and demonstration that all single bolt linkage joints actually
contain a SRB can this requirement be met.
Many means of insuring linkage integrity or connections exists. There are double and triple
redundant systems, permanent fasteners whereby a piece or part has to be destroyed to be
removed, cotter pining or safety wiring, and directives mandating that safety inspections should
be rigorously complied with. However, none of these methods are practical or reasonable from
the life cycle maintenance standpoint. Joints need to be periodically removed. Ground
functional checks and inspections will only determine that a bolt is in the linkage joint and nut or
cotter pin (or both) is installed. Therefore, because of the criticality of this item, inspection and
demonstration methods of verification compliance are essential.
(TBD)
980
JSSG-2009A
APPENDIX I
I.3.4.9.3.10 Fastener drive and wrenching element configuration.
Fastener drive and wrenching elements, installation and removal tooling, and torque control
shall be as defined (TBS) .
This requirement provides for the selection of drive and wrenching elements for use with
aerospace structure fastener subsystems. The fastener recess design selected should
influence maintenance manpower, maintenance cost and driver inventory requirements.
In all applications of internal drive configuration fasteners, loads are applied in both torsional
directions for removal and installation. If the recess cannot withstand or transmit sufficient
torsional force in the installation direction, the desired pre-load is not reached and clamp up is
not sufficient, which could result in failure. If the torsional strength of the recess is insufficient in
the removal direction, then either the recess cams out or the driver bit breaks (or both), resulting
in the fastener having to be drilled out, which increases both maintenance cost and the mission
down time of the weapon system.
Hexagon drive external wrenching elements should be limited to use for fasteners up to
180,000 psi maximum ultimate tensile stress. All externally and internally threaded fasteners
heat treated to 180,000 psi minimum ultimate tensile stress and higher should have spline drive
or 12-point external wrenching element. Preference should be given to spline drive external
wrenching element on high-strength fasteners. Fasteners less than 180,000 psi may use spline
drive external wrenching element.
The cruciform recess may be used in fastener heat treated up to 160,000 psi maximum ultimate
tensile stress. Fastener heat treated above 160,000 psi maximum ultimate tensile stress with
cruciform recess may be used in secondary structure. Six lobe drive, offset cruciform and offset
cruciform-ribbed recesses should be used in fastener heat treated to 160,000 psi minimum
ultimate tensile stress and higher. These recesses may be used in fasteners below 160,000 psi
in order to reduce the recess types used in each system. The use of dovetail slot recesses
should be avoided.
Internal hexagon recesses, should be limited to the threaded end of pins without a head driving
recess.
Care should be exercised to ensure that the correct size bit or wrench is identified, particularly
for internal drives, so that specified installation torque requirements are not exceeded.
(TBD)
981
JSSG-2009A
APPENDIX I
I.4.4.9.3.10 Fastener drive and wrenching element configuration.
Fastener drive and wrenching elements shall be verified by (TBS) .
Inspection is the most suitable verification method to confirm the selection drive elements and
compatibility with the wrenching elements.
TBS should be filled in with inspection of installation, assembly and fabrication drawings.
(TBD)
I.3.4.9.3.11 Fasteners used in doors and access panels.
Except for captive fasteners, fasteners used to retain access panels and doors shall be of equal
diameter and length. Formed-in-place gasket material shall not be used as a spacer or in place
of a counterbore for the retaining rings.
This requirement defines the basic design and engineering requirements for panel fastener
assemblies for attaching structural load-carrying and non-structural panels, inspection doors,
quickly detachable plates, control and instrument panels, and equipment rack systems.
Fasteners used in doors and access panels should be classified as fully-captive screws and
semi-captive screws. Fully captive screws should be inseparable assemblies incapable of
removal either from their retainer or from their associated panels without the use of special
tools. Semi-captive screws should be capable of removal from their retainers or the retainers
should be capable of removal from their associated panels without special tools. Semi-captive
screws are single lead threads only.
Captive and semi-captive screws should be used to secure any panel, door, or other fastener
retained device that must be routinely opened or released for maintenance, service, or
equipment adjustment. These fasteners should be used where loss of attaching hardware could
cause loss of system integrity, whether structural or electronic, or could endanger system
operating personnel. These fasteners should be used where extensive equipment tear down for
the retrieval of ordinary attaching hardware would be required.
982
JSSG-2009A
APPENDIX I
The performance criteria for these fasteners should be indicated by requirements of individual
applications. Consideration should be given to each application for fastener tensile and shear
load carrying capabilities, clamp-up capabilities, and resistance to axial push-out forces.
(TBD)
I.4.4.9.3.11 Fasteners used in doors and access panels.
Fasteners used in doors and access panels shall be verified by (TBS) .
(TBD)
TBS should be filled in with inspection and demonstration.
(TBD)
I.3.4.9.4 Utility actuation subsystem.
Mechanical actuation subsystems shall provide motion and position locking functions for
stowable and deployable surfaces such as folding wing panels, folding rotor blade systems,
folding tail rotors/pylons, air scoops, air vents, and weapons bay doors in ground and air
applications for both operational and maintenance purposes. The mechanical actuator
subsystem shall be capable of providing these functions via air vehicle or ground power and
shall provide for manual operation as well in applications necessary for maintenance,
accessibility enhancement, or stowage or folding.
Mechanical actuation systems are necessary to provide motion to various stowable and
deployable surfaces such as folding wing panels, folding rotor blade systems, folding tail rotors
and pylons, air scoops, air vents, and weapons bay doors in ground and air applications for both
operational and maintenance purposes.
a. Motive/locking functionalities. Motion is typically of a limited (2 position) nature and may

require positive locking in either one or all positions; locking and motive functions should not be
983
JSSG-2009A
APPENDIX I
susceptible to extraneous interference causing inadvertent commands or motion (such as

electromagnetic interference (EMI)).
b. Aerodynamic induced load effects. Actuation subsystems should be capable of operating

normally through all points of the flight envelope where the subsystem in question may be used;
including manual and automatic operation.
c. Oscillating loads effects. Irreversible-gearing should not be used as the sole means of
position retention due to oscillating load effects.
d. High actuator case temperature/combustible environment separation. Actuator subsystems

should not exhibit external case temperatures sufficient to provide a source of ignition for fuels
or hydraulic fluid in the event of an actuator stall.
e. Motive source thermal protection. Means of ensuring subsystem shutdown, rather than a
hiatus in subsystem operation, should be incorporated into the integration of safety/mechanism
protection devices, such as thermal overheat switches, to prevent continued subsystem
operation where such operation could result in an inadvertent deployment.
f. Externally-applied-load backdrive protection. All actuation subsystems should incorporate

positive means of preventing backdriving of the motive source (motor, hand crank, or such.)
caused by loads being carried by the surface or device being actuated; these means should be
in addition to the positive locking mechanism.
g. Maintainer-induced overload protection. Provisions should be made to prevent damage to

actuation subsystems in case of over-torque or over speed conditions during improper manual
operations (for example, using a high-power rotary tool instead of speed wrench).
h. Integration of cycle requirements between related systems: The cycle requirements of

systems that operate in conjunction with each other, such as blade and wing stow subsystems
on the same air vehicle, should be integrated with a common overall cycle requirement in mind.
i. Possibly applicable industry standards and recommended practices: Some Industry

documents which may prove beneficial for background information include SAE ARP4058,
“Actuators, Mechanical, Geared Rotary, General Specification For”; SAE ARP4255, “Electrical
Actuation Systems for Aerospace and Other Applications”; SAE ARP777, “Gas Actuators”; and
SAE ARP4386, “Terminology and Definitions for Aerospace Fluid Power, Actuation and Control
Technologies”.
j. Design life cycles: The actuation system should be designed, in fracture or flight critical
cases, to a minimum of 4 lives as measured in actuation cycles and flight hours to ensure a
statistically robust system.
a. Oscillating loads effects. A no-back mechanism was used on an example air vehicle
subsystem when irreversible-gearing mechanism failed to operate as designed. The cause of
the failure was a “ratchet-type” effect, induced by oscillating loads.
984
JSSG-2009A
APPENDIX I
b. Aerodynamic induced load effects. Example air vehicle ECS auxiliary scoop mechanism
experienced several problems related to aero-induced loads that were poorly understood at the
time. Conservative approaches should have been used in estimating the loads.
c. Motive source thermal protection. Means of ensuring subsystem shutdown, rather than a
hiatus in subsystem operation, should be incorporated into the integration of safety/mechanism
protection devices, such as thermal overheat switches, to prevent continued subsystem
operation where such operation could result in an inadvertent deployment. Example air vehicle
experienced inadvertent deployment of the boarding ladder due to thermal switch activation.
Command was generated, actuator thermal protection engaged, actuator stopped (actually in
mid-operation), then re-engaged later during ground engine runs when thermal switch cooled,
allowing actuator to continue in motion. If this had happened just prior to flight, the weight-on-
wheels switch would have disconnected power on takeoff, creating the condition of a “live”
boarding ladder ready to deploy as soon as the air vehicle hit the runway. The actuator
command logic path didn’t adequately address this situation; it was also misidentified in the
failure mode effects analysis as a “Failure” (which creates the impression of a fully-
nonfunctional/subsystem-off situation). It really was a “hesitant operation” scenario instead.
The command path was changed to utilize a regular switch as opposed to the momentary
“depress-and-walk-away” switch used earlier.
d. Special accessibility. All actuation subsystems that can conceivably be performed on the
deck should have their design closely coordinated with the fleet supportability and carrier
suitability areas. An air vehicle blade-fold system was designed to accommodate the
requirement that one side of the rotor system, due to deck spacing, would not be accessible on
a carrier. This same system also required careful accessibility planning due to the possible
dangers to maintainers and equipment from nearby APU exhaust during manual fold operations.
e. Integration of cycle requirements between related systems: The cycle requirements of

blade and wing stow subsystems on the same example air vehicle were not readily integrated
into a common overall cycle requirement. The existence of two, stand-alone, requirements had
the potential to cause confusion.
I.4.4.9.4 Utility actuation subsystem.
The function of the utility actuation subsystem shall be verified by (TBS) .
Verification of utility actuation subsystems is necessary to validate performance and envelope

derived requirements. Verification, dependent on the specific system, may be required by
analysis, testing, or by similarity to existing, prequalified systems.
985
JSSG-2009A
APPENDIX I
TBS should be completed by considering the following:

a. Oscillating loads effects. The ability to meet this constraint should be validated by test,
analysis, and inspection as follows: Analysis, Qualification Testing.
b. Aerodynamic induced load effects. The ability to meet this constraint should be
validated by test, analysis, and inspection as follows: Analysis, Qualification Testing.
c. High actuator case temperature/combustible environment separation. The ability to
meet this constraint should be validated by test, analysis, and inspection as follows:
Analysis, Qualification Testing.
d. Oscillating loads effects. The ability to meet this constraint should be validated by test,
analysis, and inspection as follows: Analysis, Qualification Testing (Vibration, Cyclic
Loading, Backlash measurements).
e. Motive source thermal protection. The ability to meet this constraint should be validated
by test, analysis, and inspection as follows: Analysis, Qualification Testing
(Load/Repetitive Cycling).
f. Externally-applied-load backdrive protection. The ability to meet this constraint should
be validated by test, analysis, and inspection as follows: Analysis, Qualification Testing.
g. Maintainer-induced overload protection. The ability to meet this constraint should be
h. Special accessibility. The ability to meet this constraint should be validated by test,
analysis, and inspection as follows: Analysis, Qualification Testing, Maintainability
Demonstrations.
i. Integration of cycle requirements between related systems: The ability to meet this
constraint should be validated by test, analysis, and inspection as follows: Analysis,
Qualification Testing.
j. Test life cycles: The actuation system should be tested, in fracture or flight critical
cases, to a minimum of 2 lives as measured in actuation cycles and flight hours to
ensure a statistically robust system.
a. Aerodynamic induced load effects. Example air vehicle ECS auxiliary scoop mechanism
experienced several problems related to aero-induced loads. Laboratory equipment that could
not reproduce transition between externally induced ECS airflow and Engine-Inlet airflow during
testing was significant cause of incorrect analysis validation.
b. Motive source thermal protection. Example air vehicle boarding ladder actuation motor
testing failed to reveal possible consequences of thermal protection engagement to control
circuit; also actual operating environment should be as fully emulated as possible
c. Similarity based verification & testing. Use caution when using verification and testing
based on similarity. An example air vehicle boarding ladder actuator was tested in an
986
JSSG-2009A
APPENDIX I
orientation 90 from its air vehicle installation orientation. This caused problems related to limit
switch travel requirements on the air vehicle (“sagging” of components that did not appear in
tested orientation).
I.3.4.9.4.1 Ground wind environment.
All actuation subsystems shall be able to:

a. be locked and unlocked;
b. provide for folding, unfolding, and deploying; and
c. be folded, unfolded, and deployed
within a wind environment that shall encompass both atmospheric and weather-induced
conditions, wind-over-deck from carrier vessel movement, and downwash and jetwash
conditions from other vehicles on or near the carrier vessel deck.
The actuation subsystems are intended to operate in, and therefore withstand, an environment
that includes loads caused by atmospheric conditions (weather and sea states), wind-over-deck
from carrier vessel movement, and downwash and jetwash conditions from other vehicles on or
near the carrier vessel deck.
a. Wingfold-wing pivot wind environment. Air vehicle: wingfold-wing pivot systems should be
able to withstand:
1. 60 Kt winds from any horizontal direction in the unlocked and folding condition,
2. 60 Kt winds from any horizontal direction in the unlocked and folded condition, and
3. 100 Kt winds from any horizontal direction in the locked and folded condition.
It should also be possible to fold and unfold the wings in winds up to 60 Kts from any direction.
b. Bladefold wind environment. Rotorcraft: bladefold systems should be able to withstand:

2. 45 Kt winds from any horizontal direction in the unlocked and folded condition,
3. 100 Kt winds from any horizontal direction in the externally secured and unfolded
condition, and
4. 100 Kt winds from any horizontal direction in the locked and folded condition.
It should be possible to fold and unfold the blades repeatedly in winds up to 45 knots from any
direction.
987
JSSG-2009A
APPENDIX I
c. Tailboom-tailrotor wind environment. Tailboom-tailrotor systems should be able to

withstand:
2. 60 Kt winds from any horizontal direction in the unlocked and folded condition,
3. 100 Kt winds from any horizontal direction in the locked and folded condition, and
4. 100 Kt winds from any horizontal direction in the externally secured and unfolded
condition.
It should be possible to repeatedly fold and unfold the tailboom-tailrotor in winds up to 60 knots
from any direction.
d. Boarding ladder wind environment. Boarding ladder systems should be able to withstand:
1. 60 Kt winds from any horizontal direction in the unlocked and deploying condition,
2. 60 Kt winds from any horizontal direction in the unlocked and deployed condition, and
3. 100 Kt winds from any horizontal direction in the locked and deployed condition.
It should be possible to deploy and stow the boarding ladder repeatedly in winds up to 60 knots
from any direction.
Experience with large rotorcraft in the vicinity of other air vehicles with folding-surfaces indicates
those downwash-induced loads from such vehicles, whether from incidental overflight conditions
or normal landing/takeoff/hover operations in the vicinity of the folded air vehicles may induce
damage.
Jet blast loads are a particular concern with respect to fixed-wing air vehicle and their
associated deployable and folding devices and surfaces.)
I.4.4.9.4.1 Ground wind environment.
The ability to meet this constraint shall be verified by (TBS) .
The ability of the specific system to withstand the specific wind environment for its specific
application must be verified to ensure a robust and reliable actuation system.
TBS should be completed with consideration of the following:

a. Wingfold-wing pivot wind environment. The ability to meet this constraint should be
988
JSSG-2009A
APPENDIX I
b. Bladefold wind environment. The ability to meet this constraint should be validated by
test, analysis, and inspection as follows: Analysis, Qualification Testing.
c. Tailboom-tailrotor wind environment. The ability to meet this constraint should be
d. Boarding ladder wind environment. The ability to meet this constraint should be
(TBD)
I.3.4.9.4.2 Positive locking features.
Mechanisms that provide a structural load path shall incorporate redundant means of locking
the mechanism in position. Locking mechanisms shall incorporate a means of operational
command interrupt to prevent in-flight actuation of ground-only operating systems.
Safety of Flight concerns necessitate the use of redundant means of securing & locking a
mechanism in position. Operational command interrupts are necessary because of the hazard
inherent in operation a system not intentionally designed for aerodynamic loads (such as
boarding ladder systems, and access door actuation systems) in a flight condition which might
cause damage or departure of the system from the air vehicle.
Generally applicable positive locking features. Provisions should be made for locking folding
wings, blades or other folding/stowing surfaces in the folded/stowed position. Locks should be
an integral part of and operate in the sequence of the folding mechanism. Locks should be
positive and should not depend on any power source to remain engaged. The control and lock
subsystem should be shielded against EMI, and the “fold” sequence should require two
separate deliberate pilot actions in the case of flight critical surfaces such as wings/rotor blades.
All mechanical and powered locks and actuators should be designed to prevent ground-type
system (such as a boarding ladder) deployment in flight or undesired deployment during ground
operations. Provisions should be incorporated to prevent inadvertent actuation following the
activation and subsequent relief of safety devices such as thermal switches, or fuses. The
locking arrangement should be positive and easily operable by maintenance personnel
providing rapid engagement and disengagement of the locking mechanism. Locks should be
capable of withstanding forces created by 100-knot winds from any horizontal direction. All
mechanical and powered locks and actuators should be designed to prevent undesired surface
positioning in flight. A positive identification of engagement should be provided by the
mechanism.
989
JSSG-2009A
APPENDIX I
Warning flag and locking feature ice layer penetration. Actuation subsystems that require
ground operation should be able to operate successfully with a coating of ice covering any
locking mechanism or locked/unlocked indicating mechanism.
Braking devices. Various subsystems have incorporated electromechanical brakes to “lock”

actuator/linkage in place when actuator is not in motion. Experience with air vehicle ECS
Auxiliary Scoop Actuator subsystems has shown care must be taken to design the brake to
accommodate any uncertainty in loads (such as aerodynamic and friction); existing brake
design had difficulties when aerodynamic loads were higher in actual operation.
In-flight actuation command interrupts. Most air vehicle applications utilize a “weight-on-wheels”
(WOW) switch to prevent operation of ground-only actuating subsystems, such as a bladefold
and wingfold, while in-flight or above a certain ground speed.
Detachable handles, props, struts for deployment and locking. An example air vehicle boarding
ladder system initial design had a detachable handle to allow maintainers of different height
extremes to actuate the ladder, but it was found that the ladder’s close proximity to an engine
intake presented too much of a possibility for foreign object damage (FOD), for example, placing
the handle on the intake after use and inadvertently leaving it there.
I.4.4.9.4.2 Positive locking features.
The ability to meet this constraint shall be validated by test, analysis, and inspection as follows:
(TBS) .
The ability of the specific system to provide positive locking for its specific application must be
verified to ensure a robust and reliable actuation system.
TBS should be completed with consideration of the following:

a. Generally applicable positive locking features. The ability to meet this constraint should
be validated by test, analysis, and inspection as follows: Analysis, Qualification Testing.
b. Warning flag and locking feature ice layer penetration. Actuation subsystems that
require ground operation should demonstrate the ability to operate successfully with a
coating of ice covering any locking mechanism or “locked/unlocked” indicating
mechanism. The ice should be applied as a mist of water under freezing conditions to
allow penetration and subsequent freezing in areas normally accessible to rainwater.
The mechanism should then be subjected to low temperatures as specified.
c. Braking devices. The ability to meet this constraint should be validated by test, analysis,
and inspection as follows: Analysis, Qualification Testing.
990
JSSG-2009A
APPENDIX I
d. In-flight actuation command interrupts. The ability to meet this constraint should be
Built-in-test: Several example air vehicle programs have demonstrated the need to include
postulated lifetime Built-In-Test cycles into the aggregate Lifetime cycles used for Qualification
Testing. These seemingly innocuous cycles sometimes cause relatively high loading over a
short period of time, even though the actual actuation unit is under low or zero load conditions
itself.
I.3.4.9.4.3 Cockpit positive engagement indication.
The locked-or-unlocked condition of mechanisms used during ground operations or in the

interior of the vehicle (cargo or cockpit spaces) shall be displayed in the cockpit.
The indication of the locked/unlocked condition is of high importance for both ground and flight
safety concerns as well as mission integrity.
Cockpit positive engagement indication systems should be closely coordinated with the parties
responsible for cockpit display design.
The use of Indicating sensors linked to the actual surface being operated is preferable to having
the sensor mounted on the actuating unit itself; experience with an existing air vehicle has
shown that a failed kinematic linkage but operating actuator caused a surface to fail open yet
the cockpit indication showed a “closed” condition since it was receiving a signal from the
“healthy” actuator. Such failures are relatively rare and may be mitigated by linkage designs, but
they can still occur.
I.4.4.9.4.3 Cockpit positive engagement indication.
Cockpit positive engagement indication shall be verified by (TBS) .
The ability of the specific system to provide proper cockpit indication of its operation for its
specific application must be verified to ensure a robust and reliable actuation system.
991
JSSG-2009A
APPENDIX I
In some cases, subsystems may be activated from some other area than the actual pilot
location (for example, cargo bay). Demonstration of visibility from a crew viewpoint (pilot or
crew chief) in areas around the interior of the air vehicle is very important, especially with
regards to night operations.
TBS should be filled in with Analysis, Qualification Testing, and Ergonomic Evaluation.

(TBD)
I.3.4.9.4.4 Actuation control.
Where applicable, a means shall be provided for controlling utility actuation. Where possible, a
separate means for “Motion” and “Locking” control may be desired.
It is necessary to maintain control over the actuation system for mission success as well as
flight and ground safety concerns.
(TBD)
Example air vehicle Wingfold control had to be redesigned during the course of the flight test
effort to accommodate need to fold wings independently in certain carrier hangar
stowage/maintenance accessibility situations. Better communication with shipboard R&M team
would have led to this being in design from outset.
Example air vehicle had nosewheel steering gain-control connected to wingfold control handle
with separate “unlock” and “fold/unfold” positions; when wingfold control changed to single
unlock/motion position this caused adverse crew comments; there was a desire to engage
higher-gain steering with “unlocked” but not necessarily “folding” wings.
992
JSSG-2009A
APPENDIX I
I.4.4.9.4.4 Actuation control.
Analysis, Qualification Testing, Ergonomic Evaluation, EMI Analysis.
The ability of the specific system to provide proper cockpit control of its operation for its specific
Any means used to prevent inadvertent actuation of a control (such as guards) should be
evaluated by actual pilots to determine suitability as soon as possible in the design process.
This also applies to visibility of those controls.
(TBD)
I.3.4.9.4.5 Maintainer safety.
Actuation subsystems that have provision for manual operation shall include safety devices to
prevent injury to maintainers in case of inadvertent application of power during a manually
powered operation. Actuated devices shall also be evaluated with respect to possible APU
exhaust impingement hazards during actual use and maintenance operations (for example,
built-in-test operations and pre-flight checks). Possible hazards include overheat and
overpressure of structural components as well as high temperature hazards to personnel.
The safety of the maintainer as well as the equipment and air vehicle itself needs to be
safeguarded during operation of the actuation system.
Actuation subsystems such as boarding ladders that require the maintainer to be in very close
proximity during stowage or deployment should incorporate some means of controlling
deployment speed to a specified safe rate.
This is based on experience with several helicopter programs: the relatively small size of a
helicopter fuselage makes APU exhaust routing an important concern during operations such as
Blade-Fold.
993
JSSG-2009A
APPENDIX I
I.4.4.9.4.5 Maintainer safety.
The ability to meet this constraint shall be validated by test, analysis, and inspection.
The ability of the specific system to provide maintainer safety features in its operation for its
specific application must be verified to ensure a safe, robust and reliable actuation system.
Analysis, Qualification Testing, and Ergonomic Evaluation should be conducted. Thermal and
acoustic analyses of areas necessary for maintainer/crew positioning during actuation
processes during various operating conditions (for example, the APU on, main power plant on,
or ground carts on) should be performed to validate personnel safety.
(TBD)
I.3.4.9.4.6 Ground power operability.
Utility actuation subsystems shall be capable of operating from the ground power supplied to
the air vehicle as well as air vehicle supplied power.
Utility Actuation systems need to operate safely and properly when using ground power to
facilitate system checkout and maintenance functions.
Utility Actuation subsystems should be designed to accommodate air vehicles and ground
power and to safely accommodate transitions between the two states.
(TBD)
994
JSSG-2009A
APPENDIX I
I.4.4.9.4.6 Ground power operability.
The ability of the specific system to provide proper ground power operability for its specific
Analysis, Qualification Testing, and Ergonomic Evaluation should be conducted. Analysis or

testing should be performed to verify that transitions from ground to air vehicle power could be
safely performed without harm to personnel or equipment.
VERIFICATION LESSONS (4.4.9.4.6)
(TBD)
I.3.4.9.4.7 Actuation time.
All actuation subsystems shall be able to perform their specified function within (TBS) time
and cycle. Allowable intervals between actuation cycles shall also be specified as well as total
cycles expected during the application lifetime.
Specific mission requirements will require a system perform within a specified band of time.
TBS: Example fixed-wing air vehicle wingfold system had actuation time of 10-14 seconds.
Example air vehicle wingstow system had total actuation time of 90 seconds (12 seconds to
Index rotors, 30 seconds to fold blades, 12 seconds to rotate nacelles, and 45 seconds to
actually rotate wings to stowed position). Example air vehicle boarding ladder system had
actuation time of 7 seconds (3.6 second actuation cycle time plus 3 second ladder deployment
time). Example air vehicle bladefold system had powered actuation time of 42 seconds
(12 seconds to index rotors; 30 seconds to fold blades).
(TBD)
995
JSSG-2009A
APPENDIX I
I.4.4.9.4.7 Actuation time.
The ability of the specific system to provide proper actuation time performance during its
operation for its specific application must be verified to ensure a robust and reliable actuation
system.
Actuation time should be validated by test in an environment that is representative of the actual
air vehicle installation and air vehicle loads; if the loads change during the actuation process this
should be accounted for also.
(TBD)
I.3.4.9.4.8 Surface interference prevention.
Utility actuation subsystems shall incorporate some means to prevent damage to adjacent
movable surfaces (for example, flaps) during folding and unfolding operations. Also, means
shall be incorporate to allow any movable control surface to be in any position on the panel
being folded/unfolded.
Damage to adjacent surfaces or to the system itself are not acceptable during system operation
because of safety and maintainability/reliability concerns.
(TBD)
Most existing air vehicle wingfold systems utilize some mechanical interlock to prevent ailerons
on the outer, folding, wing panel from interfering with the flaps on the inner, non-folding portion
of the wing during the wingfold process.
Example air vehicle required aileron interlock to prevent damage to inboard flaps during
wingfold operations.
996
JSSG-2009A
APPENDIX I
I.4.4.9.4.8 Surface interference prevention.
The ability of the specific system to provide proper surface interference prevention through
design or specific features for its specific application must be verified to ensure a robust and
reliable actuation system.
Analysis, Qualification Testing, and Ergonomic Evaluation should be conducted. It is important

to consider adjacent structural areas during the design of the actuation subsystem to prevent
damage during operation; verification by demonstration may provide results too late to be of
much benefit.
(TBD)
I.3.4.9.4.9 Replaceable attachments.
The actuation subsystem attachment shall not be an integral part of the air vehicle structure,
such as wing rib, but shall be a replaceable attachment which shall be designed so that, in case
of an overload or fatigue failure event, failure of the attachment shall occur in lieu of air vehicle
primary structural component failure.
Damage to the primary air vehicle structure itself is usually not acceptable during system
operation because of safety and maintainability/reliability concerns. Damage to the actuation
system is preferable to air vehicle structural damage because of cost, flight safety, and ground
safety concerns.
It is desirable to have the attachment point of the actuation subsystem function as a “structural
fuse,” an overload/jam condition would fail the attachment prior to the much more costly air
vehicle primary structure.
(TBD)
997
JSSG-2009A
APPENDIX I
I.4.4.9.4.9 Replaceable attachments.
Replaceable attachments shall be verified by (TBS) .
The inclusion of replaceable attachments in the specific system must be verified to ensure a
robust, maintainable, and reliable actuation system.
TBS should be filled in with test, analysis, and inspection.
(TBD)
I.3.4.9.4.10 Folded and stowed position clearance.
Clearance shall be provided in the deployed or stowed position and during the deployment
operation to prevent damage to the surface, attached equipment, and to other areas of the air
vehicle.
Damage to adjacent surfaces or to the system itself are not acceptable during system operation
because of safety and maintainability/reliability concerns. Therefore positive clearance values
must be maintained for a variety of conditions.
Conditions that include special maintenance positions or equipment location should be

examined. Unsymmetrical landing gear deflections, in the case of one surface such as a wing or
rotor blade being folded before the others, should be combined with a flat tire or compressed
landing-gear-ground-interface-device (skid, air cushions) on the low side in determining critical
clearances. With the surfaces folded or swept or stowed it should be possible to retract and
extend the landing gear for maintenance purposes. Except when the landing gear retracts into
the folded portion of the wings, a complete retraction and extension cycle, including up-lock
operation, should be possible.
(TBD)
998
JSSG-2009A
APPENDIX I
I.4.4.9.4.10 Folded and stowed position clearance.
Folded and stowed position clearance shall be verified by (TBS) .
The ability of the specific system to provide proper deployed and stowed position clearance
during its operation for its specific application must be verified to ensure a safe, robust, and
reliable actuation system.
TBS should be filled in with test, analysis, and inspection.
(TBD)
I.3.4.9.4.11 Manual deployment and drive input.
Utility actuation mechanisms used during ground operations shall have a purely manual backup
available for motive power and locking/unlocking purposes if the primary mode of operation is
automatic or powered (or both). Subsystems used for purely in-flight applications shall also
have means incorporated to allow cockpit controlled activation for ground maintenance actions.
Manual backup for deploying and stowing an actuated surface or device is necessary for
maintenance power-off conditions as well as to accommodate emergency conditions in
situations where the operation of other air vehicles may also be impacted as well (such as
hangar deck obstructed by air vehicle(s) with spread wings/rotor blades with failed power units).
Wing folding and spreading operation should be accomplished by both manual and powered
means. Wings folded/pivoted by power should permit decoupling of the wing locking mechanism
and should have manual or other alternate provision for folding and spreading the wings.
Provisions should be made to prevent hazards to maintenance personnel, wing-mounted
equipment (such as pylons), or damage critical components that could cause wing/tail control
surface damage as well as control loss or damage to electrical connectors, control lines, or such
during normal, manual, or externally powered wing-folding and spreading.
Blade folding should be accomplished by manual or powered means. Provisions should be

made to prevent hazards to maintenance personnel or damage critical components that could
cause blade/wing/tail surface control loss or damage to electrical connectors, control lines, or
such during normal, manual, or externally powered blade-folding and spreading.
999
JSSG-2009A
APPENDIX I
Manual operation of example air vehicle folding mechanism caused damage through the use of
unauthorized, but frequently used, ammunition-loading power tools. A torque-limiting
mechanism was later incorporated to address this problem.
I.4.4.9.4.11 Manual deployment and drive input.
The inclusion within the specific system of manual deployment and drive input features and their
system.
Wingfold-wing pivot manual deployment and drive input should be validated by test, analysis,
and inspection as follows: Analysis, Qualification Testing.
Bladefold manual deployment and drive input should be validated by test, analysis, and
inspection as follows: Analysis, Qualification Testing.
(TBD)
I.3.4.9.4.12 External securing.
Removable Surface securing devices shall only be used in lieu of integral locks when
specifically authorized by the Government. These devices shall be capable of withstanding
rough handling without damage and shall have strength equal to or exceeding that of the air
vehicle. The removable devices shall be such that one man can secure the surface in winds up
to 60 knots from any horizontal direction.
External securing provisions are necessary to accommodate situations where high wind/sea
state conditions occur and it is not feasible to move the air vehicle to a safer location or within a
hangar.
Actuation subsystem external securing devices should be designed to reduce or eliminate the
possibility of FOD during removal/installation.
1000
JSSG-2009A
APPENDIX I
Due to the nature of rotorcraft operations, it is desirable that external bladefold securing devices
be transportable within the air vehicle to remote staging and operating areas.
An example air vehicle boarding ladder system initial design had a detachable prop to lock the
ladder in place and also function as a deployment assistance handle. It was found that the
ladder’s close proximity to an engine intake presented too much of a possibility for FOD. For
example, placing the handle on the intake after use and inadvertently leaving it there.
I.4.4.9.4.12 External securing.
The ability of the specific system to provide proper external securing during operation for its
specific application must be verified to ensure a robust and reliable actuation system.
Wingfold-wing pivot external securing should be validated by test, analysis, and inspection as
follows: Analysis, Qualification Testing.
Bladefold external securing should be validated by test, analysis, and inspection as follows:
Detachable Securing Devices should be tested with regard to maintainer induced loads
(including potential jam/forcing conditions) as well as normal environmental loads, such as wind,
or shipboard movement.
Example air vehicle wingfold system suffered component failures due to excessive force applied
during manual fold operations. The design did not take into account normal usage induced
increase in friction creating temporary high load conditions at manual input location.
1001
JSSG-2009A
APPENDIX I
I.3.4.9.4.13 Visual positive engagement identification.
The locked-unlocked condition of mechanisms used during ground operations or in the interior
of the vehicle (cargo or cockpit spaces) shall be displayed visually, externally, internally, or both
if required, by purely mechanical, non-electric means. This is in addition to the “cockpit positive
engagement indication” in this appendix.
Indication of positive engagement of locking mechanisms is necessary to ensure safe operation

of an actuating system.
Cockpit and external indication means are both necessary because of the possibility of purely
manual deployment, such as when no one is in the cockpit.
Engagement identification devices should be designed to allow visibility during day or night
conditions. These devices should be visible from any area that a maintainer could be expected
to be during the actuation cycle; they should not become occluded during any portion of the
actuation cycle. Flags, distinctively colored cylinders, and distinctively-colored portions of the air
vehicle surface that are revealed by the actuating mechanism itself are suitable means of
external indication.
Several different means of positive engagement Identification are in use including mechanical
striped “barber poles”, rotating colored or uncolored discs, and exposed or covered brightly-
painted areas.
I.4.4.9.4.13 Visual positive engagement identification.
The ability of the specific system to provide proper positive engagement identification during its
system.
Positive engagement identification should be verified my maintainer demonstrations as early in

the program as possible; including the use of partial mockups (real or virtual) when available.
(TBD)
1002
JSSG-2009A
APPENDIX I
I.5 PACKAGING
I.5.1 Packaging.
I.6 NOTES.
not mandatory.)
I.6.1 Intended use.
The mechanical subsystem descriptions in this appendix are intended for use in air vehicle
I.6.2 Acquisition requirements.
I.6.3 Acronyms.
PPSL Program Parts Selection List
QPL Qualified Products List
SRB Self-retaining Bolt
I.6.4 Subject term (key word) listing.
Bearing
Door
Fastener
Latch
1003
JSSG-2009A
APPENDIX I
Lock
Seals
Weapons bay
I.6.5 Responsible engineering office.
I.6.6 Changes from previous issue.
1004
JSSG-2009A
APPENDIX J
APPENDIX J
AIR VEHICLE CARGO, AERIAL DELIVERY,

AND SPECIAL OPERATIONS SUBSYSTEM
J.1 SCOPE
J.1.1 Scope.
This appendix provides requirements, verifications, tailoring guidance, and background

information for the Cargo, Aerial Delivery, and Special Operations Subsystem provided for in
Part 1 of the Air Vehicle Subsystems Specification. The appendix has been developed and
coordinated by technical personnel from the Air Force, Navy, and Army and has been approved
as an official guide for use by Government personnel for assistance in tailoring the air vehicle
subsystems specification for acquisition and model specifications. This appendix is a mandatory
part of the specification. The information contained herein is intended for compliance.
J.1.2 Structure.
J.1.3 Appendix.
J.1.4 Deviations.
1005
JSSG-2009A
APPENDIX J
J.1.5 Environmental impact.
J.1.6 Responsible engineering office.
The responsible engineering office (REO) for this appendix is AFLCMC/EZFC (ATTLA),
WRIGHT-PATTERSON AFB OH 45433-7017 USA; DSN 986-9849, COMMERCIAL (937) 656-
9849; AFLCMC.EZF.MAILBOX@US.AF.MIL.
J.2 APPLICABLE DOCUMENTS

J.2.1 General.
they are listed.
1006
JSSG-2009A
APPENDIX J
J.2.2 Government documents
J.2.2.1 Specifications, standards, and handbooks.

INTERNATIONAL STANDARDIZATION AGREEMENT
AIR AND SPACE INTEROPERABILITY COUNCIL

AIR STD AM 1048 Restraint Factors for Fixed Wing Aircraft
(Copies of this document are available at http://quicksearch.dla.mil, www.airstandards.org, and

MIL-STD-1791 Designing for Internal Aerial Delivery in Fixed Wing Aircraft

19111-5094 USA.)
J.2.2.2 Other Government documents, drawings, and publications.

U.S. ARMY
Field Manual Airdrop of Supplies and Equipment:
4-20.103 (FM 10-500-3)/ Rigging Containers
Marine Corps Reference Publication
MCRP 4-11.3C/
Air Force Technical Order
T.O. 13C7-1-11
(Copies of this document are available online at https://rdl.train.army.mil for access by qualified
users.)
1007
JSSG-2009A
APPENDIX J
U.S. MARINE CORPS

FMFLant OP3000.3 Standard Operating Procedure
(Requests for this document should be made via http://www.marines.mil.)
U.S. NAVY
NAVAIR Instruction 13100.15 Engineering Technical Review of
Commercial-Derivative Aircraft Programs
(Copies of this document are available online at
https://mynavair.navair.navy.mil/portal/server.pt/community/directives/1595 to qualified users.)
J.2.3 Non-Government publications.
SAE INTERNATIONAL
SAE AS8905 Fittings and Cargo Rings, Tiedown, Aircraft Floor
SAE AS21234 Fitting, Tiedown, Cargo Ring (5,000 LB) and Seat Stud, Type I
SAE AS21235 Fitting, Tiedown, Cargo Ring (10,000 LB) and Seat Stud, Type II
SAE AS21236 Ring, Cargo Tiedown (10,000 LB), Type III
SAE AS21237 Ring, Cargo Tiedown (25,000 LB), Type IV
qualified users.)
J.2.4 Order of precedence.
J.2.5 Streamlining.
1008
JSSG-2009A
APPENDIX J
J.3 REQUIREMENTS
J.4 VERIFICATIONS
J.3.1 Definition
J.4.1 Definition
J.3.2 Characteristics
J.4.2 Characteristics
J.3.3 Design and construction
J.4.3 Design and construction
J.3.4 Subsystem characteristics
J.4.4 Subsystem characteristics
J.3.4.1 Landing subsystem
J.4.4.1 Landing subsystem
J.3.4.2 Hydraulic subsystem
J.4.4.2 Hydraulic subsystem
J.3.4.3 Auxiliary power subsystem
J.4.4.3 Auxiliary power subsystem
J.3.4.4 Environmental control subsystem
J.4.4.4 Environmental control subsystem
J.3.4.5 Fuel subsystem
J.4.4.5 Fuel subsystem
J.3.4.6 Aerial refueling subsystem
J.4.4.6 Aerial refueling subsystem
1009
JSSG-2009A
APPENDIX J
J.3.4.7 Fire and explosion hazard protection subsystem
J.4.4.7 Fire and explosion hazard protection subsystem
J.3.4.8 Electrical power subsystem
J.4.4.8 Electrical power subsystem
J.3.4.9 Mechanical subsystems
J.4.4.9 Mechanical subsystems
J.3.4.10 Cargo, aerial delivery, and special operations.
The cargo, aerial delivery and special operations subsystem shall provide ease of loading and
unloading of the air vehicle, accommodate and secure internal and external loads such as
bundles and palletized cargo, facilitate the safe aerial delivery of personnel and cargo, and be
compatible with essential equipment for Special Operations.
The cargo subsystem must be designed to minimize the time required for loading and unloading
operations. The cargo subsystem design should facilitate the loading and unloading to the
maximum extent possible; thereby minimizing the delivery mission turn-around times. The
cargo subsystem design must be able to support the unique mission defined Special Operations
requirements while not jeopardizing the safety of personnel or airworthiness of the air vehicle.
JSSG-2001 should be used as a primary reference to ensure all performance capabilities are
included in the cargo subsystem specification. The mission stated in JSSG-2001 should
determine the range of performance capabilities and functions required of the cargo subsystem.
Cargo subsystems need to be Tri-Service interoperable. Past challenges have been and will
continue to be the size and performance capability of cargo subsystems. The cargo
subsystem’s design needs to consider the range of cargo compartment sizes and interfaces. In
addition to interface compatibility problems, air vehicles have not always been designed for
efficient conversion to accommodate multiple cargo delivery missions. Often, lengthy conversion
times are needed to accommodate various cargo loads as in the case of air vehicles that have
only a drive-on floor or a strictly roll-on floor. These types of designs require considerable time
to convert to other cargo requirements; such as the KC-10 which has to place pallets on top of
the rollers in order to drive vehicles on board the air vehicle.
1010
JSSG-2009A
APPENDIX J
J.4.4.10 Cargo, aerial delivery, and special operations.
The capability of the cargo subsystem to provide for ease of loading and unloading of the air
vehicle; securing of required cargo loads; safe aerial delivery of personnel, bundles and
palletized cargo; and essential equipment for Special Operations shall be verified incrementally
by ___(TBS)___.
Verification is necessary to confirm those cargo subsystems operational procedures, load

capacity, and flight envelope performance is compatible with the air vehicle.
TBS should be filled in with the demonstrated capability of the cargo subsystems to operate
throughout their intended flight envelope and at the required operating conditions. Individual
components should be certified as airworthy through test and analysis. Analyses should include
test data that proves the subsystem meets all stress levels, environmental conditions, and
failure modes. However, individual tests need not be repeated during demonstration when
integrated as a system with the air vehicle. The demonstration tests should consist of several
completed operations of the subsystem in accordance with the operator’s manual in normal
modes; electrical, hydraulic and manual as applicable. Alternate modes or emergency
procedures are typically demonstrated during one operation.
Although component testing should verify strength and stress levels; testing as an integrated
system is still required to verify component interfaces and operational performance as an
integrated system. Several individual components may be designed and constructed by
individual manufacturers. Although each vendor manufacturer should have demonstrated their
individual components and parts qualification through test, it does not guarantee operational
performance as an integrated system. Several interface and performance problems have
occurred in the past when components were integrated as a complete system.
1011
JSSG-2009A
APPENDIX J
J.3.4.10.1 General cargo requirements
J.4.4.10.1 General cargo requirements
J.3.4.10.1.1 Cargo restraints.

The restraint system shall be ___(TBS 1)___ to restrain unpalletized and palletized cargo loads
to prevent forward, aft, vertical, and lateral load movement under all air vehicle flight conditions,
including severe turbulence and crash. The restraint system crash load factors for the
attachment hardpoints and carry-through structure shall be ___(TBS 2 )___.
Cargo must be restrained to maintain safe operation of the air vehicle and must be secured in
the event of the crash to allow safe exit of personnel and to prevent further personnel injury or
air vehicle damage.
TBS 1 should be filled in with one or a combination of the following options (“a.” through “c.")
dependent upon the air vehicle's cargo mission (see JSSG-2001, “Cargo and Payload”):
a. Floor and sidewall tiedowns. Selection and placement of tiedown devices should be
based on a pattern that permits maximum flexibility in the application of tiedown devices
and quantity required for maximum cargo payload. Ensure identified tiedown fittings are
compatible with the identified tiedown devices, to include the rated load capacities, and
that they can provide the rated restraint capacity throughout the hemisphere of action
above the mounting surface. Tiedown fitting selection is dictated by matching the
interface size openings and load capacities to the intended tiedown devices.
Historically, the 463L cargo system has used the cargo ring load capacities shown in
table J-I.
TABLE J-I. Cargo ring load capacities.

DESIGN LOAD PROOF ULTIMATE
TYPE (RATED CAPACITY) LOAD LOAD
I - Cargo Ring and 5,000 lb. 5,000 lb. 7,500 lb.
Seat Stud
II - Cargo Ring and 10,000 lb. 10,000 lb. 15,000 lb.
Seat Stud
III - Ring 10,000 lb. 10,000 lb. 15,000 lb.
IV - Ring 25,000 lb. 25,000 lb. 37,500 lb.
(extracted from SAE AS8905)
1012
JSSG-2009A
APPENDIX J
Rated capacity is the proof load and should be used in the calculations for restraint.
1. Typical tiedown ratings and dimensions. Tiedown number and pattern selection
needs to consider the intended cargo mission of the air vehicle as stated in the
operational requirement document. As an example, there are established medical
evacuation missions that require the modification of air vehicle. These modifications
need an adequate number and correct rating of tiedown fittings to support the
installation of a medical evacuation kit which typically consists of a seat and
converter assembly unit and a litter support unit. An example in rotary-wing air
vehicles is the UH-60, a general purpose utility air vehicle, which uses 5,000 lb.
tiedown fittings in the floor with 3,500 lb. rated cargo restraint net rings on the walls
and ceiling. Medium to large transport rotary-wing air vehicles, such as the CH-47D
Chinook, use eighty-three 5,000-lb. capacity tiedown fittings in the cargo floor,
equally spaced in five rows 20 in. apart longitudinally. There are also eight
10,000-lb. tiedown fittings that can be installed only when necessary by screwing the
fittings into the threaded receptacles at the fitting locations. The primary objective in
selecting the tiedown numbers and pattern is to ensure the air vehicle's maximum
flexibility in performing its operational mission requirement. Further detailed
information regarding floor tiedown fittings may be found in SAE AS8905.
The proposed design should have the minimum clear openings and maximum cross-
sectional diameters shown in table J-II to maintain compatibility with currently-fielded
463L cargo subsystem components.
TABLE J-II. Tiedown fittings dimensions.

YIELD MIN. CLEAR MAX. DIAMETER OF
STRENGTH - OPENING RING CROSS
TYPE LBS. DIAMETER - IN. SECTION - IN.
I - Cargo Ring and Seat Stud 5,000 1.5 .375
II - Cargo Ring and Seat Stud 10,000 1.5 .375
III - Ring 10,000 2.5 .500
IV - Ring 25,000 2.5 .750

(extracted from SAE AS21234, AS21235, AS21236, and AS21237)
The proposed tiedown fittings and devices should not project above the floor when
not in use and should not have any openings by which dirt, dust, or debris can pass
through to the space below the floor. Protective coating treatments which might
crack, chip, or scale should be avoided.
2. Typical tiedown devices and load limiters. Tiedown devices have traditionally
consisted of two chain types for the 10,000 lb. and 25,000 lb. capacity tiedowns and
fabric strap types for the 5,000 lb. capacity tiedowns. Each type consists of two
components: 1) a primary hook and tensioner unit and 2) a secondary hook
attached to a length of chain or strap. The strap devices are generally designed as
one assembly, whereas the chain devices can usually remove and stow the chain
1013
JSSG-2009A
APPENDIX J
separately from the tensioner. The tiedown devices should be designed for easy
operation by personnel wearing heavy gloves.
Dynamic cargo restraint tiedowns, enclosures, and barrier nets should incorporate
load-limiting energy absorbing type devices. The resulting controlled cargo
displacement under a crash load condition should be considered when evaluating
the safety of occupants and their subsequent post crash egress from the air vehicle.
During take-off, flight, and landing, for both normal and turbulent flight conditions,
cargo restraint systems should not permit cargo to shift. When load limiters are
used, tiedown straps should be of a material with low elongation characteristics.
Cargo restraint enclosures or floor-to-ceiling low-elongation barrier nets used in
conjunction with load limiters may be considered for palletized or other bulk cargo.
High stretch materials, such as nylon, are not acceptable for use as primary load
restraints.
Secure storage for cargo restraint equipment should be provided and should ensure
easy and efficient access and removal.
b. Bundle cargo restraint. For airdrop of A-7A, A-21, and A-22 type cargo secured to
appropriate sized skidboards a system of restraint should be provided to achieve vertical
and lateral restraint through sufficient interface with the conveyor rail system. For further
guidance, see Army Field Manual 4-20.103 (FM 10-500-3)/Marine Corps Reference
Publication MCRP 4-11.3C/Air Force Technical Order T.O. 13C7-1-11. A-7A and
A-21 bundles should be securable for flight through direct tiedown to the air vehicle floor
tiedown fittings. Forward restraint for heavy bundles should be provided through the use
of a barrier or buffer assembly. The barrier should provide all necessary forward
restraint for the entire complement of bundles to be carried on the air vehicle. The
barrier should be moveable or convertible to accommodate smaller numbers of bundles.
Aft restraint for heavy bundles should be provided with a means that can be readily
released to permit dropping the bundles on command from the cockpit.
c. Pallet cargo restraint. Cargo pallets and airdrop platforms should be restrained through
a system of indent locks compatible with the 463 system of detents in the platform
siderails. For logistics missions, the system locks should provide all forward and aft load
restraint. For airdrop missions, the system should have the capacity to release aft
restraint when a set level of aft force is achieved on the platform. The release force
should be selectable and settable for each lock and individual locks should be capable of
use in parallel or in series. The interface of the pallet and platform lips under the air
vehicle’s rail system provides the necessary lateral and vertical upward restraint.
TBS 2 should be filled in by specifying the forward, aft, vertical, and lateral load factors as a “g”
number. The “g” force is the resultant force exerted on an object by gravity or by reaction to
acceleration or deceleration. The “g” is an acceleration ratio (a/g) of the item’s acceleration (a)
to the acceleration of gravity (g). When multiplied by an item’s weight the ratio gives the force
experienced by the item due to acceleration or deceleration. The changes in velocity ( V) or
rate of onset, of the air vehicle floor in the directions of up and down should also be specified.
For tactical airdrop missions the g-force is dependent upon the type of extraction: Low Altitude
Parachute Extraction System (LAPES) or Low Velocity Airdrop (LVAD). The LAPES is a type
of airdrop for platform loads wherein the load is extracted from a C-130 or C-17A aircraft, flying
1014
JSSG-2009A
APPENDIX J
at approximately 130 knots, and at a ramp height of up to 15 feet above ground level (AGL).
Recovery parachute systems are not used. NOTE: LAPES is not currently in use by the US Air
Force (USAF) or the US Army (USA). The LVAD is a type of airdrop for platform loads where
the load is extracted from a C-130 aircraft flying at 140 knots or from C-5 and C-17A aircraft
flying at 150 knots by extraction parachutes at an altitude of 700 feet or more. Recovery
parachutes are attached to the load to slow the descent and to allow an impact velocity of less
than 28.5 ft/sec.
The LAPES restraint computations are based on the required longitudinal restraint criteria of
12g forward restraint for platform extraction and 8g forward restraint for an item extraction. The
LVAD computations are based on the required longitudinal restraint criteria of 3g forward for
either platform or item based extraction. Typical restraint of cargo for both LAPES and LVAD
applies a 10,000 pound load on each tiedown provision, based on the minimum breaking
strength of the tiedown strap being utilized, with the straps oriented at an angle of 30° from the
longitudinal centerline of the load and 34.4° from the horizontal plane.
Each Service has established different restraint criteria for current and future acquisitions and
upgrades. Tailor the TBS 2 in accordance with the unique service program restraint
requirements and by the type of air vehicle as shown in tables J-III and J-IV.
The restraint factors for fixed-wing aircraft are the subject of international standardization
agreement Air and Space Interoperability Council Air Standard AIR STD AM 1048. When
different crash load factors are chosen for the design of attachment hard points and carry-
through structure of the restraint system than as listed in the referenced air standard, the
preparing activity of the program-unique specification will take appropriate reconciliation action
through international channels including departmental standardization offices, as required.
1015
JSSG-2009A
APPENDIX J
TABLE J-III. U.S. Air Force fixed-wing restraint criteria.
DIRECTION STATIC DYNAMIC
Pulse Duration or Rate of Onset -

Load Factor V
Forward 3.0 10.0 ft/sec
Aft 1.5 5.0 ft/sec
Lateral 1.5 5.0 ft/sec
Up 2.0 10.0 ft/sec
Down 4.5 11.5 ft/sec
(extracted from MIL-STD 1791)
TABLE J-IV. Cargo restraint criteria for U.S. Navy/Marine Corps fixed-wing aircraft.
FWD AFT LAT UP

TYPE/CATEGORY OF AIRCRAFT G's G's G's G's
Helo/Tiltrotor 4 3 3 3
C-130 3 2 1.5 2
Fixed Wing Cargo-Transport 3 2 2 2
Carrier Onboard Delivery (C-2) 20 7 7 4
Commercial Derivatives1
1
Use G-Levels above for applicable type/category or the FAA requirement,
whichever is higher. For FAA requirements lower than the values above,
approval will be based on guidelines set forth in NAVAIR Instruction 13100.15.
Cargo restraint is a trade-off between theoretical values and operational practice. In theory,
most previous pressurized cargo air vehicle fuselages could achieve a deceleration force of up
to 8 or 9g before rupturing and losing structural integrity. However, restraint of internal cargo to
8g became unworkable with the advent of current air vehicles because the payload capacity
exceeded the practical limits for the application of tiedowns and because most large items of
cargo could not withstand this magnitude of loads. Weight considerations limit the number of
tiedown devices, which the air vehicle carries and most vehicles will not remain integral under
1016
JSSG-2009A
APPENDIX J
the application of high forces. Based on statistical data from past years of operation, the USAF
adopted a policy that limits the applied restraint to the values shown in table J-III, above. The
3g maximum forward is considered to be a survivable condition encountered in a take-off or
landing accident wherein the air vehicle is virtually intact afterward. Accidents having g forces
between 3g and 20g while carrying cargo are statistically rare. Accidents resulting in g loads in
excess of 20g are non-survivable.
Caution should be taken to ensure the correct selection of the tiedown fittings, which is
accomplished by matching the fittings' rated strength to the payload weight of the intended
cargo. The correct selection can be determined by verifying the weight range of the intended
cargo payloads stated in the air vehicle's operational requirements document. Also ensure the
tiedown fittings are compatible with the selected tiedown devices. Current cargo air operations
use devices rated (working) at strengths of 5,000 lbs., 10,000 lbs., and 25,000 lbs. Additionally,
misapplications of the proof versus ultimate loads can also result in incorrect installations and
require expensive retrofit operations. Proof load ratings should be used to ensure a greater
margin of safety in cargo operations. In addition to verifying compatibility, the stated load of the
tiedown fitting should be for the full range of motion at all angles of restraint. If it is not possible
to attain the stated load throughout the full range of motion; angle specifications of load restraint
for tiedown applications should be identified.
Another example of incorrect fitting installation occurred with detent locks. Detent locks are not
symmetrical; typically forward restraint capacity is greater than aft. Incorrect installation (in the
reverse direction) will result in system failure.
J.4.4.10.1.1 Cargo restraints.

Cargo restraints shall be verified by ___(TBS)__.
Proper operation of all cargo restraint provisions requires verification of load and strength
capacity to ensure safe performance of the air vehicle. Verification is also needed to ensure the
subsystem’s capability to meet stated operational requirements in cargo, aerial delivery, and
special operations missions.
TBS: Verification of cargo restraint provisions consists of analyzing the system capability to
restrain the load in accordance with JSSG-2001. The analysis should require both functional
demonstration and laboratory testing. Typical internal cargo restraint provisions include tie-
down fittings and secure inter-locking floor designs. Proper operation of all tie-down fittings and
devices should be demonstrated. Representative demonstration cargo should be made up and
secured in the air vehicle using the procedures defined in the cargo-loading manual. Particular
emphasis should be placed on accessibility and ease of operation of tie-down provisions.
1017
JSSG-2009A
APPENDIX J
Laboratory strength tests of cargo furnishings, pallet lock mechanisms, attachments, and fittings
to the air vehicle structure (cargo floor) should be completed prior to demonstration tests.
Palletized loads may require that pallets be used as load input devices to test the restraint lock
system and demonstrate functioning in all required modes. Typically, these tests are
accomplished not only for flight but also for crash landing conditions as cargo tie-down
provisions, but should also meet emergency restraint requirements. Crashworthiness structural
requirements are identified in JSSG-2001, or as emergency landing conditions in the FAA
standards. It should also be demonstrated that the cargo restraint provisions maintain the air
vehicle center of gravity position within the approved limits and the subsequent center of gravity
movement associated with the cargo airdrop is within limits.
Qualification tests should be extended to the attachment hardware, such as the fitting bolts.
Attention should be given for all components as incorrect selection of bolts has occurred and
resulted in lost test time and dollars. Incorrect substitutions will also cause invalid test results or
failure.
J.3.4.10.1.2 Ease of loading and unloading.

___(TBS)___ shall be provided to facilitate ease of loading and unloading the air vehicle for
both logistical and aerial delivery missions.
Efficient loading and unloading equipment must be integrated into the cargo subsystem to
ensure mission operational turn around times are met.
TBS should be filled in with one or a combination of the following state of the art equipment,
dependent upon the air vehicle’s stated Operational Requirements Document (ORD) cargo
mission requirements (See JSSG-2001, “Cargo and Payload”):
a. guide rails and rollers
b. cargo winch and snatch-block pulleys
c. treadway flooring
d. ramp extenders
e. stabilizing struts.
Refer to section J.6 “Component information” in this appendix, for background information on
items “a.” through “e.”, stated above.
1018
JSSG-2009A
APPENDIX J
J.4.4.10.1.2 Ease of loading and unloading.

The means of easily loading and unloading the air vehicle for both logistical and aerial delivery
missions shall be verified by ___(TBS)___.
The ease of loading and unloading must be verified as a functional capability of the cargo
subsystem.
TBS should be filled in with a demonstration that exercises all subsystem components to assess
their effectiveness in loading and unloading operations.
Analyses and subsystem component testing will not adequately verify subsystem capabilities. It
is necessary to demonstrate fully all operations which pertainto loading and unloading the air
vehicle to ensure compatibility and interoperability with currently-fielded cargo systems.
J.3.4.10.1.3 External cargo capability.

Rotary-wing and Vertical Take-off and Landing (VTOL) air vehicles shall be provided with
___(TBS 1)___ to meet air vehicle mission requirements to secure external loads. The air
vehicle shall have a rated external cargo lifting capacity of ___(TBS 2)___. The external cargo
system shall be equipped with a ___(TBS 3)___ fail safe mechanism to prevent sudden shifts in
the aircraft center of gravity.
Air vehicles require external cargo attachment devices to meet the external air transport
operational requirements. The determination of the size, quantity, and capacity is defined by
the lifting capability of the air vehicle.
TBS 1 should be filled in with the number and capacity of external cargo attachment points. A
thorough analysis of the air vehicle's ORD needs to identify the types of cargo not only in terms
of weight, but also design of the end items. This has a direct impact upon the number and the
spacing of attachment points required.
1019
JSSG-2009A
APPENDIX J
TBS 2 should be filled in with the external cargo lifting weight capacity required of the air
vehicle. A means to control the external cargo-securing device should be provided to the
appropriate crewmembers.
TBS 3 should be filled in with a type of fail-safe mechanism for the external cargo design
selected. As an example, multiple load attachment point installations require automatic
jettisoning capability in the event of one attachment point failing. Means of controlling the
external cargo-securing device should be provided to the appropriate crewmembers. Typically,
the pilot has priority control from the cockpit.
The incorrect number and location of external cargo attachment points negatively impact the
aeroelastic stability and control of the air vehicle. Past designs have resulted in air vehicle
control problems due to an inadequate number or installation location of attachment points. In
addition, the external cargo subsystem’s design needs to consider the range of cargo
compartment sizes and interfaces. As an example, the Army 25-lb. nylon apex-fitting roller is
too large to fit a standard 10K external cargo hook. In order to use the system, the apex-fitting
roller must be removed before attachment to the hook can be made.
J.4.4.10.1.3 External cargo capability.

The ability of the air vehicle to secure external loads shall be verified by ___(TBS 1)___. The
rated capacity shall be verified by ___(TBS 2)___.
External cargo systems require in-flight demonstration to ensure complete functional integration
into the air vehicle as a complete air delivery system. Demonstration needs to show that
externally carried loads can be safely transported from one location to another within extremes
of the flight envelope without adversely affecting the air vehicle.
Verification for external cargo delivery systems is needed at the component, subsystem, and
system levels.
TBS 1 should be filled in with component-level testing and flight testing for all conditions that are
critical to strength, maneuverability, stability and control, and aeroelastic stability. All
components within the external cargo load path should undergo strength and fatigue testing
prior to subsystem and system-level testing. Test loads should be increased at incremental
levels up to the maximum air vehicle rated load. The maximum subsystem rated load is to be
used for these tests unless a lesser load is more critical for demonstrating dynamic stability.
Typical measurements are structural, dynamic, aeromechanical, aeroelastic, and electrical test
parameters; to include combined system and cargo weight, sling loads, aerodynamic forces,
vibrations, and airspeed.
1020
JSSG-2009A
APPENDIX J
TBS 2 should be filled in with testing the hoist and installation with maximum rated loads. Other
measurements include proof load, acceleration forces, and quick-disconnect forces. All release
modes should be demonstrated. All release modes including normal, automatic, and semi-
automatic hook engagements; automatic touchdown; manual ground; and emergency releases
should be demonstrated. Emergency release should be demonstrated during turns at the
maximum allowable bank angle and speed and while carrying maximum rated loads. Quick
disconnect devices and cable cutters should be actuated at the most critical load conditions.
Re-latch features are to be operated, and proper operation of safety or warning devices, such
as unlatched load beam indicator lights, should be verified. Operating procedures defined in the
operator’s manual should be followed throughout the demonstration. These tests may be
carried out jointly with the test of the hoist subsystem. Airworthiness and crashworthiness of the
host air vehicle should not be degraded.
The U.S. Army Natick Research, Development, and Engineering Center (NRDEC) is the
Department of Defense (DoD) executive agent in external air transport certification. As such,
the center is an excellent source of technical expertise in the analysis of dynamic vibration,
helicopter and load mass differential, and rotor wash patterns. NRDEC, in coordination with
each Service's aeronautical engineering program office, provides test and evaluation guidance
to individual acquisition and development programs.
External loads are classified as either single-point or dual-point loads depending upon the
number of cargo hooks. Traditional guidelines for external load verification include:
a. The load should be within the lifting capability of the desired air vehicle.
b. The load is rigged in accordance with the certified rigging procedures.
c. The maximum stable airspeed limitation specified for the load in the applicability section
of the rigging procedure should be maintained.
There are certain items of equipment that are prohibited from external air transportation and
which would not be used for verification testing. These items have either structural deficiencies
or have exhibited unstable flight characteristics during previous flight-testing. Each Service
transmits this information by a separate list once identified. In addition, item selection of
previously certified equipment (either single or dual point loads) is not an acceptable method.
Loads should not be selected and cannot be certified for dual-point lift based on previously
certified dual-point rigging procedures because of the differences in dual-hook air vehicles, such
as the distance between the two cargo hooks. Each load needs to be evaluated with the
intended air vehicle. Avoid selecting low-density equipment with low weight and large surface
area (flat surfaces) such as shelters, empty trailers, pallet loads, and empty fuel or water drums.
These items are likely to become extremely unstable when externally air transported, even at
low airspeeds.
1021
JSSG-2009A
APPENDIX J
J.3.4.10.2 Aerial delivery
J.4.4.10.2 Aerial delivery
J.3.4.10.2.1 Static line capability.

The cargo subsystem shall be equipped with a means to permit airdropping of personnel or
cargo bundles using static line deployed parachutes. The system shall be compatible with the
3
/8-in. opening of the static line snap hook.
Currently, both fixed-wing and rotary-wing air vehicles deploy anchor systems designed to
3
/8-in. anchor cable system. Fixed-wing air vehicle have static-line-deployed systems designed
to attach to a 3/8-in. diameter anchor cable system. Rotary-wing air vehicles utilize modified
anchor line cable systems consisting of fabric webbing anchor strap with eight D-rings arranged
in a rectangular loop attached to tiedown rings which also requires 3/8-in. compatibility with static
lines.
In air vehicles equipped with anchor line cables, the system should permit multiple sticks or
rows of paratroopers to use each designated jump exit. Adjustable stops and intermediate
supports should be used to allow one cable to serve as the anchor for both side door and rear
ramp exits on each side of the air vehicle. Intermediate support should not impede the motion
of the static line snap hook along the anchor line cable when these supports are not required, as
in the case of ramp exits. The anchor line cable should be at a height to allow for the range of
population sizes of all designated jumpers to attach the static line snap hook of their parachute
to the anchor line cable. The system should be stowable and removable when not in use.
In certain air vehicles, the parachutists are seated at or near the exit, such as in rotary-wing air
vehicles. These air vehicles are equipped with anchor points that only allow limited motion, the
anchor points should be located in such a way that:
a. The parachutist or jumpmaster should be able to attach the static-line.
b. The static-line should have a clear path to the exit point and will not interfere with or
impede other parachutists or crew.
The static-line anchor cable and all supporting structure and stops should be stronger than the
static-line itself. If the anchor cable or other supporting structure fails then the towed jumper
and all subsequent jumpers would have a total malfunction that would result in a catastrophic
event. Therefore, the anchor line cable needs to withstand forces at least equal to the strength
of the static-line plus an appropriate safety factor. Installation strength should support a
minimum defined load applied over the range of expected angles to include: parachutist exits,
parachute deployment, towed jumper, and towed jumper retrieval. Surfaces that the static-line
and anchor cable or anchor points can come into contact with should not reduce the effective
strength to the point that there are premature failures or damage to the system during normal or
abnormal operation such as the towed jumper scenario. The main factors are edge radius,
1022
JSSG-2009A
APPENDIX J
roughness, and material. Good practice is to have smooth, well-radiused surfaces on all air
vehicle parts, which the static line could contact.
In an effort to increase interoperability and improve the safety of airborne soldiers, the USA and
USAF set up an Integrated Concept Team which met and formulated the requirements for a
single static-line, called the Universal Static Line (USL). The USL will potentially replace the
existing 15-foot static line. The proposed design for the static line capability will have to interface
with the new USL and be suitable for static line operations in all current air vehicles. The USL
will require that the static-line strength not exceed 3,600 lbs. but with the 1.5 safety factor, the
anchor line cable needs to withstand an ultimate load of 5,400 lbs.
J.4.4.10.2.1 Static line capability.

The cargo subsystem’s ability to permit airdropping of personnel or cargo bundles using static
line deployed parachutes shall be verified by ___(TBS 1)___. System compatibility with the
static line snap hook, clevis, or other hardware used to attach the static line to the anchor line
cable or anchor point shall be verified by ___(TBS 1)___.
Static line capability is a crucial function in personnel airborne missions and the safe
performance and equipment interoperability needs to be verified to assure a very high system
reliability required of personnel parachutes and to assure there is no risk to the air vehicle.
TBS 1 should be filled in with component-level test and demonstration with the air vehicle.
Parachute performance and reliability should also have to be evaluated for complete system
verification. This would include all current static-line parachutes, such as the T-10C, T-11,
MC1-1B/C, and MC-5. Performance and reliability should be evaluated over the range of
operating conditions during an airdrop. The following elements should be covered in the
verification:
a. Ground testing to assure adequate strength of air vehicle components.
b. Ground testing to assure compatibility with parachute systems, both personnel and
cargo static deployed parachute systems.
c. Flight safety verification for personnel and cargo static deployed parachute systems (will
the static-line interfere with flight control surfaces). This includes ground and air testing.
d. Static line and deployment bag trailing characteristics.
e. Static line and deployment bag retrieval, to include back-up retrieval procedures when
applicable.
1023
JSSG-2009A
APPENDIX J
f. Strength of air vehicle components and static-line with maximum weight towed jumper at
maximum achievable distance along static line.
g. Trailing and retrieval of minimum and maximum weight jumper, to include normal and
emergency procedures (This is normally not done with rotary-wing air vehicles where the
jumper will be retrieved.)
h. The air vehicle influences initial parachute testing with dummies. All aspects of
parachute performance should be addressed, including:
1. Jumper and deployment bag contact
2. Potential for hazards and collisions resulting from the tendency of parachutes from
opposite sides of the air vehicle to move towards each other (cross-over, or
centerlining)
(a.) Execute live jumps to address the parachutist, jumpmaster, and aircrew actions
to include safety and static-line control. Begin the demonstration with a number
known as a safe condition. Incrementally increase the number of parachutists
up to the stated maximum capacity to demonstrate reliability for operational
use.
The strength of a static line and anchor cable system under actual operating conditions is
difficult to define. Loads depend upon jumper weight, elasticity of the static-line material, and
additional load attenuation resulting from the anchor line cable deflection under load. Strength
can be negatively impacted from the static-line being in contact with the edge of the door or
ramp. The US Army NRDEC is the DoD Executive Agent for technical evaluations of static-line
personnel parachuting and related system issues. NRDEC is considered the engineering focal
point for test evaluation of static-lines, parachute deployment, trailing deployment bags,
deployment bag retrieval, and towed jumpers.
J.3.4.10.2.2 Static line retrieval.

The cargo subsystem shall provide a means of retrieving all static lines deployed outside of the
air vehicle during flight.
An air vehicle closes its exit openings as soon as jump operations are completed. Efficient
retrieval of deployed static lines is necessary to close exit openings and resume normal flight
operations.
The retrieval assist system should permit a single loadmaster to retrieve a hung paratrooper
completely into the air vehicle. The system should have the capability to retrieve a fully combat-
loaded paratrooper, weighing a minimum of 400 lb, including the additional aerodynamic loads
1024
JSSG-2009A
APPENDIX J
placed on the hung jumper. The retrieval assist should have a backup or alternate capability to
provide high reliability and confidence levels.
Ineffective static line retrieval equipment and recovery measures result in loadmaster and
jumper injuries, in addition to air vehicle and equipment damage. It is imperative to retrieve a
hung paratrooper to eliminate the additional load placed upon the static-line and anchor cable
system. The average weight of a fully combat-loaded soldier has steadily increased over time;
therefore it is necessary to start with a minimum weight of 400 lb. as stated in the requirement
guidance. Additional coordination with the U.S. Army NRDEC is advised as paratrooper weight
and resulting proof load has shown itself to be a fluctuating factor in the past.
J.4.4.10.2.2 Static line retrieval.

The means of retrieving all static lines deployed outside of the air vehicle shall be verified by
___(TBS .
Static line retrieval is an essential function of the cargo subsystem that is crucial to the safe
performance of the air vehicle and personnel.
TBS should be filled in with component-level test and demonstration with the air vehicle. Data
should be provided to demonstrate the capability of the retriever's motor throughout the
intended flight envelope. Also verify during the demonstration that the retriever’s cable should
be at least 4 in. above the anchor line for safety purposes.
Past demonstrations in static line retrieval emphasize verifying that the retriever spools are
secured forward of the intermediate cable support and are tied to supports with webbing.
J.3.4.10.2.3 Aerial delivery go – no go indication.

An indication of go or no go upon reaching the computed aerial delivery release point shall be
provided throughout the air vehicle cargo compartment so that it is visible to all personnel and
loadmasters during paratroop or cargo aerial delivery missions.
The release point must be clearly understood through a visual signal by all crew members and
jump personnel to ensure successful mission completion. Visual signals are required as the
primary indicators even if aural systems are available. The signals are tied to the jump window
1025
JSSG-2009A
APPENDIX J
such that personnel or cargo exiting the air vehicles during the jump or release phase (green
light) are assured to be within the Computed Air Release Point (CARP) envelope for drop
accuracy. Generally, the release point’s signal for personnel jumps is the same one used to
initiate a heavy airdrop of cargo.
Jump indications should also be located at or in the door exits to be visible to the jumper just
before departure from the air vehicle.
Jump indicators should be controllable from the cockpit and linked to the air vehicle navigational
system and tied into the air vehicle CARP. Jump indicators should be dimmable from full bright
to off, and be compatible with night vision mission requirements and equipment.
The indicators should provide an unambiguous, symbology-based indication for “approaching

the release point” (red light), “prepare to jump or release” (yellow), and “jump or release”
(green). This may be followed at any time by the “stop” indicator (usually a return to the red
light). Indicators should have the equivalent of a red light, yellow light, and green light system.
Indicators should be symbology-based as opposed to strictly color due to night vision goggle
(NVG) operations.
J.4.4.10.2.3 Aerial delivery go – no go indication.

The visibility of the indication for go or no go upon reaching the CARP shall be verified by
___(TBS)___.
The effectiveness and accuracy of the subsystem’s delivery capability needs verification as part
of an integrated system with the air vehicle.
TBS should be filled in with analysis and demonstration as part of the air vehicle’s performance.
Effectiveness of the go-no go indicators (jump signals) have been verified via demonstrations
with test jumpers aboard the air vehicle. Test flights are made during various lighting conditions
ranging from full daylight to dark and with the air vehicle flying in the most adverse conditions for
viewing the signals (for example, looking into the sun). Jump personnel with full equipment
packs are seated in all possible locations and are asked to fill out a questionnaire during the
flight and again after the jump that reflects how well they could see the signals. Jump personnel
1026
JSSG-2009A
APPENDIX J
are also queried on how well they could see the jump signals when they were poised in or near
the jump exits awaiting the initial command. All personnel should be able to see the signals at
all times, because these may be the only commands given and each individual is personally
responsible for jumping or staying in the air vehicle, based on the jump signals. The loadmaster
and jumpmaster are prohibited from physically intervening in the jumper’s progress throughout
the jump. Past efforts to stop a jumper physically after the stick was in progress have resulted
in injury and death.
J.3.4.10.2.4 Bundle release.

A means shall be provided to release single or multiple large cargo bundles (A-22 type) when
given a go indication. Hardware shall be provided to perform the operations required for the
gravity-based airdrop of heavy equipment at altitude, equipment and cargo at low altitude
(LVAD) and containers. Capability to release bundles and equipment shall be provided to the
crew.
Large heavy weight bundles require a quick release capability to initiate gravity-based airdrops.
Although this is a gravity-based extraction, this requires an equally precise release point. As
these bundles cannot be automatically released, a quick and safe manual release capability is
necessary to meet target objective.
The aft restraint gate should be designed with a means of being mechanically released or
severed on a signal coinciding with the green light.
The release system should be capable of being rigged at any station within the cargo
compartment and provide for release of multiple gates simultaneously or in sequence, and
should be designed to easily accommodate missions involving multiple drop sites.
All airdrop mission equipment should be stowable onboard the air vehicle outside the cargo
compartment envelope and without interference with other mission configurations.
Increased airdrop accuracy to the present day delivery capability is needed to resupply
deployed ground forces effectively. A reliable bundle release mechanism is needed to ensure
accurate delivery throughout the range of delivery altitudes, which is determined by the anti-air
vehicle threat.
1027
JSSG-2009A
APPENDIX J
J.4.4.10.2.4 Bundle release.

The means of providing for the release of single or multiple large cargo bundles (A-22 type)
when given a go indication shall be verified by ___(TBS)___. The capability of the crew to
initiate the release of bundles shall be verified by ___(TBS)___.
An accurate and reliable bundle release mechanism is a critical element for precise air delivery
missions.
TBS should be filled in with analysis and demonstration as part of the air vehicle’s performance.
Ideally, service personnel perform the demonstration test as part of the air vehicle’s
performance utilizing the system manuals. The bundle sequence is determined before loading.
If single bundles are to be dropped, a restraint strap and release lanyard are required for each
bundle. If multiple bundles are to be dropped in units of two or three, a restraint strap and
release lanyard are required for the aft bundle in each unit. Before demonstration test, ensure
the bundle release mechanism (currently release plates and lanyards) are correctly installed in
accordance with proposed design.
Past experience has placed an emphasis upon verifying that the effects of the bundle release
operations upon the air vehicle's center of gravity position are within the approved limits
associated with cargo airdrop operations. Changes in the host air vehicle's control forces’ yaw
rates need to be measured throughout bundle release operations.
J.3.4.10.3 Special operations
J.4.4.10.3 Special operations
J.3.4.10.3.1 Search and rescue operations.

The air vehicle shall incorporate a rescue hoist to conduct search and rescue missions relating
to personnel extraction and rescue. The rescue hoist shall have the (TBS) operational
capability.
Search and rescue designated air vehicles must have the means to conduct rescue missions
effectively.
1028
JSSG-2009A
APPENDIX J
TBS should be filled in with the following minimum operational capabilities:

a. Performance and cooling. A rescue hoist should be provided that has an operating
capacity of at least 600 lbs. at a continuously variable speed range up to 200 feet per
minute. A circulating fan is a desired safety factor to provide cooling for the motor. The
rescue hoist should include a corrosion and rotation resistant cable with the free end
terminated with a SAE AS8905 Helicopter Rescue Hook attached through the means of
ball-bearing swivel.
b. Safety measures. The Helicopter Rescue Hook should have a means to prevent cable
payout under any load up to 1.5 times operating capacity when not in the payout
condition or when inoperative. It should sustain a minimum of 5-lbs. tension at no load
during all extending operations. A fail-safe mechanism is desired to limit the induced
loading weight to the hoist to a pre-determined weight. Typical systems use 1,200 lbs.
as a maximum weight. The rescue hoist should have normally employed limit and safety
controls and sustain operation at up to 45° bank angles. The rescue hoist should also
contain a cartridge-actuated cable cutter mounted on or near the hoist.
c. Modes of operation. The rescue hoist should be operable by both the cabin operator
and the pilot (to include pilot capability to override cabin operator control). Additional
safety measures should include a manual method of controlling hydraulically powered
hoists in the event of failure of the air vehicle electrical systems. An additional safety
factor is the location of the hoist to permit maximum clearance and safety for both the
hoist operator and the rescued personnel being retrieved into the cabin, to include
provisions for a safety belt for the hoist operator.
Not all branches of the Services currently have dedicated air vehicle assets equipped with the
necessary search and rescue equipment. Therefore, it is necessary to ensure the air vehicle
has the capability to perform the rescue operations or possess the capability of being modified
to accept specialized equipment. Search and rescue operations include the following tactical
insertion and extraction methods: aerial insertion and extraction by fixed-wing assault landings,
parachute (static line, free fall), rotary-wing landings, hoists, rappelling, fast ropes, Stabilized
Tactical Airborne Operation (STABO), Special Patrol Insertion and Extraction (SPIE), and rope
ladder.
J.4.4.10.3.1 Search and rescue operations.

Search and rescue operations capability shall be verified by ___(TBS)___.
Search and rescue operations are one of the most time-sensitive missions that require a high
readiness posture and fast response capability. This requires early verification of the air
vehicle's search and rescue capability so that necessary improvements in performance can be
made before deployment.
1029
JSSG-2009A
APPENDIX J
TBS should be filled in with analysis and demonstration of each rescue component as part of
the air vehicle's performance. There is a high degree of risk involved during rescue hoist
operations.
Therefore, demonstrations should occur after the air vehicle design has been verified through
flight tests. The proposed design may include both internal and external mount positions. Both
mount positions need to be tested. The hoist also needs to be demonstrated with all associated
equipment to evaluate the full range of performance. Current rescue hoist systems' associated
items include:
a. forest penetrator
b. litters (sked and stokes)
c. survivor sling (horse collar).
The full range of performance includes operation in all modes of operation. The pilot and hoist
operator's controls and all safety measures are verified in the demonstration.
Past experience indicates a greater emphasis is needed on verifying that the subsystem is not
adversely affected by a specified electromagnetic field. This includes verifying the various
human factor performance requirements.
J.3.4.10.3.2 Rope suspension operations compatibility.

The cargo subsystem shall be capable of meeting special operation mission requirements by
providing air vehicle attachments points and compatible interfaces for ___(TBS)___. When
specified, special operations subsystem functions shall include a means to conduct Rotary-wing
and VTOL air vehicle rope suspension operations. Rope suspension operations include
rappelling, fast roping, SPIE, and Jacob’s ladder which require air vehicle attachment and
interface points.
Air vehicles must have cargo subsystems that can support the unique operation requirements of
rope suspension special operations missions. In particular, rope suspension operations enables
combat equipped troops to negotiate obstacles or terrain that would be otherwise non-
negotiable by allowing insertion and extraction from areas which restrict helicopter landings.
Secure anchor points that are easily accessible and readily rigged for usage on the air vehicle
are essential in assuring troop safety during these operations.
1030
JSSG-2009A
APPENDIX J
TBS should include fast rope, Jacob’s ladder, SPIE rigging, rappelling and other operations as
required. Attachment points for required rope suspension operations should make use of
existing cargo rings, fittings, and hooks to the maximum extent possible. Additional attachment
points to accommodate specific rigging equipment should be provided when necessary. Refer
to Fleet Marine Force, Altantic Operating Procedure FMFLant OP3000.3 for Standard Operating
Procedures for specific attachment information. Whenever possible, hand holds should be
provided to assist ropers' movement to the rope stations. Positioning of the attachment point(s)
should permit combat equipped troops to safely access the ropes. Location points above the
end of the cargo ramp should permit ropes to hang vertically with no interference from the ramp,
but remain easily accessible by personnel on the ramp. Location points above the cabin entry
door(s) may take advantage of support structure already included from a rescue hoist. All
anchor points may make use of existing cargo tiedown rings or the external cargo hooks to
provide secure attachment of special rigging hardware (for example gantry, Schlomer frame).
Each rope system should include a safety pin to secure the rope to prevent accidental release
and a quick release mechanism that will allow release once the safety pin is removed. The
following design criteria formula for the structural attachment point ultimate load is normally
used:
N (Number of Troops) x 240 lbs.
(Estimated weight of an equipped military person) x 1.5 F.S. x a limit load factor of 2.
The priority for special operations compatibility in air vehicle design is to ensure limited
conversion time. Consequently, the necessary attachment points should be designed into the
basic structure of the air vehicle.
J.4.4.10.3.2 Rope suspension operations compatibility.

Compatibility of the cargo subsystem attachment points and interfaces with rope suspension
operations equipment shall be verified by ___(TBS)___.
In order to insure safe operation and meet mission requirements, it is necessary to verify the
cargo subsystem's interoperability with the rope suspension operations equipment.
TBS should be filed in with coordinated analysis from the appropriate organizations in each
Service's Special Operations branch.
1031
JSSG-2009A
APPENDIX J
Emphasis should be placed upon the identification through analysis of the following required
interfaces: sufficient number and placement of tiedown devices and the capability to receive or
mount the required rope suspension operations rigging.
1032
JSSG-2009A
APPENDIX J
J.5 PACKAGING
J.5.1 Packaging.
J.6 NOTES
not mandatory.)
J.6.1 Intended use.
The cargo subsystem descriptions in this appendix are intended for use in air vehicle systems
weapon systems.
J.6.2 Acquisition requirements.

J.6.3 Component information
J.6.3.1 Guide rails and rollers.
In the past, air vehicles with a cargo mission requirement have utilized a system of lateral and
longitudinal cargo guide rails and rollers in the air vehicle to ease in the loading and unloading
of palletized logistical cargo and aerial delivery missions. Historically, for logistical cargo
missions the guide rails and rollers have been compatible with the 463L system of pallets. For
aerial delivery, the guide rails and rollers have been compatible with aerial delivery platforms
and skidboards. In the design of past cargo subsystems, the following has also been
considered when guide rails and rollers have been used in the air vehicle:
a. Palletized cargo. Interface of the guide rails with the platform and pallet side rails should
be designed to space rollers close enough to accommodate all types of pallets. Pallet
runner size, spacing, and orientation should be considered in the selection and design of
conveyors. Guide rollers height should accommodate over-hang of the pallets. Guide
rails have had a bumper or stop at the forward end and have been flared at the aft end
to permit easy entry of palletized loads. Provisions have also been made for the
continuity of the rail where it traverses the hingeline of the air vehicle ramp.
1033
JSSG-2009A
APPENDIX J
b. Cargo aerial delivery. For interface with the Type V platform runners, the lateral spacing
of the rollers has provided contact between butt lines 10.6 and 21.75 L&R for the inboard
runners and butt lines 36.75 and 53.5 L&R for the outboard runners. Roller contact
width has been a minimum of 3 in. and roller height above the floor has not been less
than 1 in. Longitudinal spacing of individual rollers combined with individual roller
capacities has also provided a load capacity at least equal to that of the airdrop platform
(2500 lb. per linear ft. for the Type V). Heavy-duty teeter rollers provided at the end of
the cargo ramp have had a capacity to support the maximum weight airdrop platform
(60,000 lbs. for the Type V) during ground loading and airdrop. Intermediate teeter
rollers have been provided at the conveyor ends to support logistic pallet loads of at
least 10,000 lbs. cresting the junction of the ramp and floor when the ramp is not
coplanar with the floor.
c. Bundle aerial delivery. Lateral and longitudinal roller spacing has been compatible with
the skidboard dimensions and center of gravity locations of cargo bundles as contained
in Army Field Manual NO. 4-20.103 (FM 10-500-3)/Marine Corps Reference Publication
NO. 4-11.3C/Air Force Technical Order NO. 13C7-1-11. Historically, minimum skidboard
width for A-7A and A-21 bundles has been 42 in. For airdrop of A-22 bundles, the air
vehicle has had a guide rail system which should accommodate skidboard widths of
48 in. and thickness of 1 in. For vertical restraint, the guide rails have been designed
with lateral edges (lips) that overhang the plywood skidboard by at least ¾-in. on each
side.
J.6.3.2 Cargo winch.
In the past, air vehicles with a cargo mission requirement have utilized a winch in the cargo
compartment with ancillary devices to enable pulling the maximum designated cargo into and
out of the air vehicle. The winch has been controllable in both speed and direction and from any
point in the compartment or outside the air vehicle to just beyond the point where the cargo
would begin loading. High-speed operation for payout and rewind without loads has been
utilized to assist loadmasters in spooling out cable quickly. Variable speed operation under load
has been demonstrated to be very useful for moving large objects under exacting conditions. To
prevent the winch from exceeding cable design limits, a load limiting feature is provided that
prevents application of loads greater than a predetermined limit based on the known cable
strength. Historically, pulling force has been limited to half the minimum breaking strength of
the cable and the load limit feature is set for 65 percent (65%) to 70 percent (70%) of the
minimum breaking strength.
J.6.3.3 Treadway floor.
The air vehicles need to have a treadway area on the cargo floor and any ramp surface to
enable drive-on loading of wheeled or tracked vehicles. The treadway width should be dictated
by the tread widths of the largest and smallest vehicles to be accommodated. If the air vehicle
is designed to carry dual rows of vehicles, the treadway width would extend across the entire
cargo floor. The treadway area, including any integral hardware for palletized cargo or any
imbedded tiedown provisions, should be specified to support the required wheel and axle loads
(single and dual axles) at maximum pneumatic tire pressures (usually 100 psi). It should also
track loads, hard wheels, or skid mounted bulk cargo requirements based on actual contact
1034
JSSG-2009A
APPENDIX J
area. The treadway area should be equipped with an antiskid treatment effective under all
conditions of mud, oil, water, grease, or combinations thereof.
J.6.3.4 Cargo ramp extensions (ramp toes).
For drive on loading of rolling stock, the air vehicle should be equipped with extensions to the
cargo floor and ramp such that a smooth and shallow transition is provided. End loading air
vehicles should have one or more hinged ramps that can be lowered to make ground contact,
with removable or deployable ramp toes that extend the treadway surface of the ramp to the
ground line and bridge the vertical drop-off at the structural end of the ramp. When deployed,
the ramp extensions or toes should be long enough to provide approximately the same
approach angle as the cargo ramp. These ramp extensions or toes should accommodate the
entire range of wheel tracks for all envisioned cargo but should be easily removed or folded
away to permit the ramp and cargo door closure and to support airdrop operations from a
coplanar ramp. Ramp extensions or toes should support the same loads as the treadway floor,
but only at ground loading conditions.
J.6.3.5 Stabilizer struts.
The cargo floor and ramp should have the capability to be stabilized as necessary during
loading such that there should be no significant change in air vehicle position, ramp angles, and
floor height as the cargo is moved into the required compartment(s). The amount of movement
to be allowed may be expressed as a function of floor or ramp height changes during the
loading process. The stabilizer system should function primarily when the ramp does not make
contact with ground (as when coplanar loading of platforms). The stabilizer system should be
equipped with a load limiter feature to prevent damage to the air vehicle if the designed load
limits are exceeded. The stabilizer system should be readily deployable and removable by the
loadmaster.
J.6.3.6 Passenger seats.
A mixed cargo and troop capability is normally stated in an air vehicle's ORD, and usually states
a minimum of installed inboard facing seats along each side of the air vehicle. The seats should
be compatible with paratroop jumping operations. In stowage the seats should not interfere with
normal full floor cargo. While in use, the seats should not reduce the original cargo floor space
by more than 25 percent (25%), or as stated in the ORD. The seat components should be
interchangeable from one side of the air vehicle to the other by the loadmaster while in flight
without the use of special tools. The seats should be designed to accommodate combat
equipped troops. The seat base should be a minimum of 18 in. wide and laterally adjacent
seats should be minimum of 24 in. on the center. The seat bottoms should move out of the way
for paratrooper jumps and should be easily operable by combat-equipped paratroopers. Seat
backs and bottoms should provide space and support for the seated individual's parachute and
any other condition stated in the ORD. Passenger seat restraint requirements should be in
accordance with the ORD.
1035
JSSG-2009A
APPENDIX J
J.6.4 Definitions.
A-7A Airdrop Cargo Sling Assembly: The A-7A consists of four identical sling straps, each
188 in. in length. Each strap is fitted with a
parachute harness adapter (friction adapter) and a
floating D-ring. The straps are placed around cargo
loads up to 500 lbs in either a two, three, or four
strap configuration, in a manner to support and
suspend the load under the recovery parachute,
which can be either one to three 68-in. pilot chutes
or one G-13 or G-14 cargo parachutes.
A-21 Cargo Bag Assembly: The A-21 cargo bag is an adjustable size container
consisting of a sling assembly with scuff pad, fixed
quick-release strap and assembly, two O-ring
straps, three quick release straps, and a 97 x 115 in.
canvas cover. The A-21 cargo bag assembly has a
500-lb load capacity and is typically used with one
G-13 or G-14 cargo chute for low velocity drops.
Three 68-in. pilot chutes, one 12-foot high velocity
cargo chute, or one 15-ft cargo extraction chute can
be used with the A-21 for high velocity drops.
A-22 Cargo Bag Assembly: The A-22 cargo bag assembly is an adjustable
cotton duck and nylon webbing container. It
consists of a sling assembly, a cover, and four
suspension webs. The load may be rigged with or
without the cover. The rigged load size may be up
to 48-in. x 48-in. x 83 in. high with the
G-12 recovery parachute. All A-22 containers are
secured to ¾-in. or 1-in. thick plywood skidboards,
atop varying thickness of paper honeycomb
depending on the type of drop. Weight capacity is
501 to 2200 lbs. For cargo items which exceed the
48-in. length limitation, double A-22 configurations
may be made by linking two sling assemblies
together and using a 48 x 96-in. sheet of plywood for
the skidboard.
A-23 Cargo Bag Assembly: The A-23 cargo bag assembly is a reinforced
version of the A-22 used primarily for high altitude
high velocity airdrops.
1036
JSSG-2009A
APPENDIX J
J.6.5 Acronyms.
AGL Above Ground Level
ATTLA Air Transportation and Test Loading Activity
CARP Computed Air Release Point
LAPES Low Altitude Parachute Extraction System
LVAD Low Velocity Airdrop
NRDEC Natick Research, Development, and Engineering Center
ORD Operational Requirements Document
SPIE Special Patrol Insertion and Extraction
STABO Stabilized Tactical Airborne Operations
USL Universal Static Line
J.6.6 Subject term (key word) listing.
Passenger
Ramp
Restraint
Static line
Tiedown
J.6.7 Responsible engineering office.
AFLCMC/EZFC (ATTLA), WRIGHT-PATTERSON AFB OH 45433-7017 USA; DSN 986-9849,
COMMERCIAL (937) 656-9849, AFLCMC.EZF.MAILBOX@US.AF.MIL. Requests for additional
J.6.8 Changes from previous issue.
1037
JSSG-2009A
APPENDIX K
APPENDIX K
AIR VEHICLE VERTICAL TAKEOFF AND LANDING (VTOL) — SHORT

TAKEOFF AND LANDING (STOL) POWER DRIVE SUBSYSTEMS
K.1 SCOPE
K.1.1 Scope.
information for the VTOL — STOL Power Drive Subsystems provided for in Part 1 of this
specification. The appendix has been developed and coordinated by technical personnel from
the Air Force, Navy, and Army and has been approved as an official guide for use by
Government personnel for assistance in tailoring the air vehicle subsystems specification for
acquisition and model specifications. This appendix is a mandatory part of the specification. The
information contained herein is intended for compliance.
K.1.2 Structure.
K.1.3 Appendix.
K.1.4 Deviations.
1038
JSSG-2009A
APPENDIX K
K.1.5 Environmental impact.
K.1.6 Responsible engineering office.
The responsible engineering office (REO) for this appendix is AFLCMC/EZFP, WRIGHT-
K.2 APPLICABLE DOCUMENTS
K.2.1 General.
they are listed.
K.2.2 Government documents
K.2.2.1 Specifications, standards, and handbooks.

MIL-PRF-7808 Lubricating Oil, Aircraft Turbine Engine, Synthetic Base
DOD-PRF-85734 Lubricating Oil, Helicopter Transmission System, Synthetic Base
1039
JSSG-2009A
APPENDIX K

MS3325 Drive Pad - Accessory, 2.653 BC Square, Design Standard
MS3326 Drive Pad - Accessory, 5,000 BC Square, Design Standard
MS3327 Drive Pad - Accessory, 5,000 BC Round, Design Standard
MS3336 Accessory Drives, Aircraft Engine, Reference Chart for
MS9948 Cover - Accessory Drive, 10,000 BC Round, QAD
19111-5094 USA.)
K.2.3 Non-Government publications.
AMERICAN NATIONAL STANDARDS INSTITUTE/

AMERICAN BEARING MANUFACTURERS ASSOCIATION
ANSI/ABMA 9:1990 Load Ratings and Fatigue Life for Ball Bearings
ANSI/ABMA 11:1990 Load Ratings and Fatigue Life for Roller Bearings
(Copies of these documents are available from http://webstore.ansi.org; ANSI, 25 West 43rd
Street, 4th Floor, New York NY 10036-7422 USA; and from www.ihs.com to qualified users.)
SAE INTERNATIONAL
SAE AMS2430 Shot Peening, Automatic

qualified users.)
SOCIETY OF TRIBOLOGISTS AND LUBRICATION ENGINEERS
STLE Life Factors for Rolling Bearings, 1992

(Copies of this book may be ordered from www.stle.org; STLE, 840 Busse Highway, Park Ridge
IL 60068-2302 USA; Information@stle.org).
1040
JSSG-2009A
APPENDIX K
K.2.4 Order of precedence.
K.2.5 Streamlining.
1041
JSSG-2009A
APPENDIX K
K.3 REQUIREMENTS
K.4 VERIFICATIONS
K.3.1 Definition
K.4.1 Definition
K.3.2 Characteristics
K.4.2 Characteristics
K.3.3 Design and construction
K.4.3 Design and construction
K.3.4 Subsystem characteristics
K.4.4 Subsystem characteristics
K.3.4.1 Landing subsystem
K.4.4.1 Landing subsystem
K.3.4.2 Hydraulic subsystem
K.4.4.2 Hydraulic subsystem
K.3.4.3 Auxiliary power subsystem
K.4.4.3 Auxiliary power subsystem
K.3.4.4 Environmental control subsystem
K.4.4.4 Environmental control subsystem
K.3.4.5 Fuel subsystem
K.4.4.5 Fuel subsystem
K.3.4.6 Aerial refueling subsystem
K.4.4.6 Aerial refueling subsystem
1042
JSSG-2009A
APPENDIX K
K.3.4.7 Fire and explosion hazard protection subsystem
K.4.4.7 Fire and explosion hazard protection subsystem
K.3.4.8 Electrical power subsystem
K.4.4.8 Electrical power subsystem
K.3.4.9 Mechanical subsystems
K.4.4.9 Mechanical subsystems
K.3.4.10 Cargo, aerial delivery, and special operations
K.4.4.10 Cargo, aerial delivery, and special operations

K.3.4.11 VTOL-STOL Power drive subsystems.
The power drive subsystem shall transmit, on an “as required” basis, the power from the
engine(s) to all load absorbers (main rotor(s), tandem rotors, tail rotor, accessories), without
destructive and/or undesirable vibrations, at the appropriate torque and speed for all allowed
environments, loads, attitudes, and misalignments at all air vehicle ground, flight and
emergency operations for which the power drive subsystem is required to function. The power
drive subsystem shall provide for disengagement and engagement of the load absorbers from
the engines for purposes of autorotation, one engine inoperative (OEI) conditions, and other
applicable modes of operation. The power drive subsystem may also be required to perform the
separate functions of braking, holding and, if needed, locking the rotor system for the purposes
of shut down, initial start up, storage, or other defined phases of operation.
This requirement defines the critical function of reliably transmitting mechanical power from the
main engine to the main propulsor (for example the air vehicle rotors or lift fan). It also
establishes the basis from which other functional or performance requirements are derived.
The power drive subsystem should be of a robust design capable of operating beyond its
maximum rated condition for those instances where excursions may occur such as autorotation,
other emergency conditions and defined transients. Excursion capabilities should be defined
as:
a. An input torque of at least 20 percent (20%) greater than the input for the subsystem
maximum rating.
b. An output shaft speed of at least 20 percent (20%) greater than the maximum operating
speed of the power absorber.
1043
JSSG-2009A
APPENDIX K
The contractor should also define the load limits of the system in terms of torque.
A detailed description of the entire drive subsystem, including all related subordinate systems
such as gearboxes, shafting, and torque control; should include the configuration, arrangement,
weight, system interfaces, design margins, and ratings. Appropriate schematics should depict
bearings, gears, rotor brake, clutches, shafts, couplings, cooling systems, accessories, and
APU and engine input drives. The design of the power drive subsystem should be supported by
extensive analyses including, but not limited to, structural, dynamic, and thermal and should
address maintenance concepts, producibility, reliability, safety, survivability, and corrosion
resistance.
Each gearbox of the power drive subsystem and associated components should be rated at the
most severe input power condition (torque and speed) for all allowed operating modes (OEI
included) exclusive of transient conditions. Transient capability of the power drive subsystem
should be defined by the contractor relative to the specific application. The rating should be
based on the durability, dynamic response, and structural integrity requirements specified.
Sealant. Sealants have been successfully used at parting planes of gearbox housings to
prevent intrusion of moisture into faying surfaces, therefore helping to reduce corrosion.
Sealants of a low adhesion type with low peel strength to facilitate easy removal during
disassembly have been preferred. Sealant should be applied to prime painted surfaces prior to
topcoat.
Gear meshes. In the past, under certain circumstances associated with manufacturing or
design tolerances, gear meshes with whole number gear ratios (for example non-hunting gear
meshes) have caused vibration problems in other subsystems such as the engine. However,
new technology manufacturing may keep errors to a level where vibration is not a problem.
K.4.4.11 VTOL-STOL power drive subsystems.
Verification shall be performed incrementally by analysis and a series of bench and system-level
tests to insure structural integrity, endurance, performance, and capability to withstand all
specified transient excursions, and operational and environmental conditions including
emergency conditions and autorotation.
This requirement is needed to verify that the power drive subsystem can continuously and
reliably transmit the necessary power to meet air vehicle mission requirements. The extent and
timing of the testing is intended to reasonably ensure that the power drive subsystem is ready
for each phase of the development program. The requirement is also used to control and
identify production parts for official tests prior to flight testing.
1044
JSSG-2009A
APPENDIX K
Analysis should consist of a detailed description with associated schematics, drawings, and
calculations for the entire power drive subsystem and all related modules and components
(gearboxes, shafting, bearings, gears, clutches, accessories, rotor brakes, couplings, and oil
cooling systems). The analysis should identify the arrangements, functional relationships,
weight, system interfaces, design margins, and associated structural, vibration, and cooling
analysis. In addition, the analysis should address maintenance concepts, producibility, safety,
survivability, and corrosion resistance.
a. Bench and system-level testing: In the tests described below, the gearbox configuration
should reflect the latest changes as documented in the gearbox drawings and should
ideally represent the configuration intended for production. The contractor should
document all gearbox components being tested for each specific test, including
component part and serial number, vendor, and total test time. If a component is
replaced during testing, the reason for replacement should be annotated. The gearbox
lubrication system should not be augmented or bypassed. Accessory drives should
impose maximum loading and overhung moments and should be configured to impose
maximum angular misalignment if specified. Additional tests may be required if
production configuration tests are not successful.
What constitutes a “system level” test should be defined. At a minimum, it represents all
the components associated with the propulsion system, which includes the entire power
train including the engines, power drives, accessories, and a load absorbing system. In
many cases, it also includes the rotor system, rotor and engine control, hydraulic and
pneumatic systems, starter system, fire detection and extinguishing system, auxiliary
power units, electrical system and fuel system. It is quite often represented by a ground
test vehicle as in a rotary-wing air vehicle tie down test.
The gearbox bench test stands should be capable of operating at variable speeds (up to
a minimum of 125 percent (125%)) and imposing all power and load (thrust and bending)
parameters (up to a minimum of 130 percent (130%) of the maximum load) encountered
under any rotor speed and flight condition allowed by the air vehicle flight spectrum
(including autorotation). The test stand should provide for monitoring of all gearbox
operating parameters. A means of cleaning and flushing debris accumulated due to
manufacturing and assembly prior to power rotation should be provided. The bench
stand should be able to accommodate all main power train gearboxes and
interconnecting shafting and coupling. However, due to space limitations, shortened
shafts or abbreviated shafting trains are often used. Normally, a regenerative (back-to-
back) torque load system is employed for economy and ease of applying controlled
conditions over a range of speed and torque. A separate bench test for the tail take-off
shafting and gearboxes is usually used for rotary-wing air vehicle applications.
Bench and system-level tests that should be conducted are described in the following
sub-paragraphs:
1. Integrity bench test: It is important that an integrity test be conducted on each
gearbox design early in the program and before the Production Configuration
Verification Bench Test in order to evaluate its capability to operate satisfactorily
beyond the rated torque and speed but within its mechanical limits. Over torque and
1045
JSSG-2009A
APPENDIX K
over speed excursions can be expected to occur as a result of emergency conditions

and autorotation. The test should also serve to identify the need for configuration
changes. The test should be conducted after completion of the gear tooth bending
test and should incorporate the optimized gear pattern developed during pattern
development tests (see “Durability” verification in this appendix) and optimized
lubrication from the “Oil Management Test” (see “Lubrication” verification in this
appendix). A minimum 200-hour test is recommended in a test stand which
integrates the gearboxes and shafting in the main power train and with a loading
spectrum consisting of the distribution shown in table K-I.
TABLE K-I. Test stand loading spectrum distribution.
INPUT POWER LEVEL DURATION
120% gearbox rated power 100 hours
100% of gearbox rated power 60 hours
The time at 120 percent (120%) rated power should be predominately above rated
torque but should include some time at overspeed condition.
If applicable, the tail takeoff should be tested for a minimum of 60 hours at
120 percent (120%) of tail takeoff rating. Power level for any remaining time is
discretionary. When component design changes are made during the test, the test
duration should be increased until the new component is tested for the duration and
power levels required by the test plan. The testing should verify operation with each
lubricant selected. A tear-down inspection, along with resolution of all discrepancies,
should be conducted before initiation of further verification testing.
2. Production configuration verification bench test: For each production source, a 200-
hour test is recommended for each transmission and gearbox configuration proposed
for production. The configuration should be audited prior to test to verify that
essential production configurations are incorporated with all design configuration
changes. A loading spectrum should be established which reflects mission profile
and verifies the latest design changes. An intermediate tear down inspection should
be conducted after 60 hours of testing and should occur prior to the 50-hour
Preliminary Flight Acceptance Test (PFAT) at the system level as described below.
A resolution of all discrepancies should be required before continuation of the bench
test and initiation of the 50-hour PFAT. The recommended criteria for successful
completion of this test are that the gearbox is operating satisfactorily and tear-down
inspections do not reveal failure, impending failure, or undue wear which would
compromise safety-of-flight or reliability.
3. System level PFAT: A 50-hour, system-level test should be completed without
component replacement before first flight using a missionized test cycle that
simulates projected use of the air vehicle. The configuration of the propulsion
components such as engines, should be equivalent to the flight test air vehicle
1046
JSSG-2009A
APPENDIX K
configuration. Tear-down inspection results should be used to establish inspections,

limitations, and restrictions for flight release.
4. System level verification test: A 200-hour test should be run without component
replacement using the PFAT test cycle. The test hours should accrue at a rate to
lead the flight hours of the lead flight test vehicle by at least a 2 to 1 ratio until that
high time air vehicle attains 100 flight hours. The intent is to expose the propulsion
components to actual powers and loads as part of an integrated air vehicle system
before they are encountered in the air vehicle. This serves to reduce the flight test
risk. During all phases of testing, degraded modes of operation should be
investigated. A complete tear down inspection of all systems should be conducted.
The recommended criteria for successful completion of this test are that the gearbox
is operating satisfactorily and tear-down inspections do not reveal failure, impending
failure, or undue wear which would compromise safety-of-flight or reliability.
5. Long-term reliability maintainability system-level test: This test should commence
following completion of the 200 hour system level verification test. The test spectrum
should consist of a composite of the mission profile of the air vehicle. The intent of
the test is to reveal any possible long-term endurance component problems. A
duration of 1,250 hours is recommended using a missionized test cycle.
6. Special or Additional Tests: Testing such as the rotor brake engagement test, clutch
tests, environmental tests, or testing of some special feature should be integrated
into the bench or system-level test program where practical.
The Test Plan: Successful tests have contained the following elements that were reflected in
the test plan:
a. Oil servicing. The oil system was drained and filled with new oil at the start of the
specific transmission system or component test with the specified lubricant. Provisions
were also made to document the amounts of lubricants drained. An oil consumption log
was maintained during testing that reference oil servicing, test time, seal drain leakage
and leakage locations.
b. Oil temperature and pressure. It was recommended to run a portion of the test at
conditions of maximum specified oil temperature (measured at the location monitored by
cockpit temperature indicator) with the pressure adjusted to minimum steady state value.
The remaining test time was recommended at nominal conditions.
c. Test data.
1. Accuracy of data. All instruments and equipment were calibrated as necessary to
assure that the required degree of accuracy was maintained. Typical accuracies are
as follow:
(a.) Rotational speeds: ±0.5 percent (±0.5%) of the value obtained at maximum
rating.
(b.) Shaft torque: ±2.0 percent (±2.0%) of the value obtained at maximum rating.
1047
JSSG-2009A
APPENDIX K
(c.) Displacement and strain: ±5 percent (±5%) of the value obtained at maximum
rating.
(d.) All other data: ±2.0 percent (±2.0 %) of the value obtained at maximum rating.
2. Data acquired. The data to be recorded and maintained was specified by the user.
The serial number of the components on test, test condition, and the desired power,
torque, and rotational speed was recorded on each log sheet. Gearbox oil
consumption was recorded at specified intervals of operation (10 hours was typical).
The following test data were recorded at specified intervals (normally less than
30 minutes or once during each test condition, whichever is shorter):
(a.) total test time
(b.) actual time of day
(c.) revolutions per minute of the gearbox input shaft
(d.) ambient air temperature
(e.) oil temperature out of each gearbox or in the sump
(f.) oil temperature into each gearbox
(g.) oil pressure gearbox
(h.) gearcase pressure (frequency of measurements defined in the test plan)
(i.) loads: torques, thrusts, moments.
Notes were placed on the log sheets describing all incidents of the test, such as
special lubrication, leaks, vibrations, noise changes, oil filter bypass indications and
any other irregular functioning of the component or the test equipment, and the
corrective measures taken.
3. Quality evidence inspections. Evidence of the quality of materials, parts, and
components was based on physical inspection and process control data. The
inspections and process data were sometimes supplemented by physical and
chemical tests to determine the extent of conformance to requirements of the
contractor’s specifications and drawings. They included sampling plans, magnetic
particle inspection, fluorescent penetrant inspection of nonmagnetic parts, nital etch,
and visual inspection.
4. Calibration: Prior to initiation and after completion of the verification tests, the
transmission system components were calibrated to establish, within the
instrumentation limits, the efficiency characteristics of the transmission system
components.
5. Inspection procedure. The inspection procedure following official tests was defined.
Typically the procedure was divided into two phases. The first phase was a “dirty”
inspection of all parts immediately after disassembly to inspect for evidence of
leakage, oil coking, unusual heat patterns and other abnormal conditions. The “dirty”
inspection was conducted before any part cleaning processes were initiated. The
second phase consisted of a “clean” inspection following a complete detailed
analytical inspection by the contractor. The user inspection team participated in both
“dirty” and “clean” inspections and prepared discrepancy reports for action and
1048
JSSG-2009A
APPENDIX K
disposition by the contractor. Inspection techniques for the analytical inspection

have included, but was not limited to: visual, dimensional, magnetic particle,
fluorescent, penetrant, X-ray, and ultrasonic. Upon completion of the “clean”
inspection, the user was provided all results of nondestructive tests, and
recommendations for modification or redesign of deficient parts.
A coating applied to the gear prior to test has aided in the inspection of teeth for
pattern definition and identification of surface distress. However, the coating has, in
some gear teeth, hindered the inspection for surface distress.
In the past, the gearboxes have been flushed with lubricating oil to clean debris prior
to power rotation using externally driven lubrication pumps. An electric motor was
used to slowly rotate the drive system during the flushing process.
K.3.4.11.1 Vibration and dynamics.
The power drive subsystem and individual components shall be free of destructive and/or
undesirable vibration at all operating speeds and powers, including steady-state, autorotation
and transient operation. When the engine, engine accessories, rotor, propeller, or fan
system(s), and all power drive subsystem dynamic components are operated as a combined
dynamic system, there shall be no dynamic coupling modes that are destructive or limit the air
vehicle for all permitted ground and flight modes. Critical speeds shall be at least (TBS)
percent from air vehicle operating speeds, including idle, all flight conditions and autorotation.
Absence of destructive vibration and dynamic response is essential to maintain good structural
and mechanical integrity of the power drive subsystem. The intent of this requirement is to
obtain a power drive subsystem with acceptable levels of vibration and margin by describing
general design considerations for the manufacturer. Rotary-wing air vehicle power drive
subsystems have had a history of special vibration problems and the associated stresses can
shorten the fatigue life of components or even become destructive. Emphasis on all
components operating as a combined system recognizes the fact that one component can
induce destructive vibrations in another component through interconnecting shafting. Also, a
thorough understanding and definition of the dynamics of the system are needed to insure that
the system responds properly (such as without torsional instabilities) to engine power demands.
TBS: The margin from critical speeds should be in the range of 20 to 30 percent (20 - 30%)
above applicable speed. The margin should be both above and below critical speed for
supercritical shaft operation.
If supercritical shafting is used during transient operation, damping should be provided to the
extent necessary to prevent stress and deflection amplitudes from exceeding design allowables.
Range of vibratory characteristics at the power drive system interfaces should be defined.
Vibration limits should be defined.
1049
JSSG-2009A
APPENDIX K
Close cooperation with the engine control system designer is necessary to insure adequate gain
and phase margins to avoid torsional instabilities. In some cases, it may be necessary to limit
torsional spring rate within the power drive subsystem.
In the past, shafts were either balanced in production or provisions were made for balancing as
part of the maintenance procedures. Some manufacturers balanced to a level such that
maximum imbalance did not exceed 25 lb. force at operating condition.
K.4.4.11.1 Vibration and dynamics.
Vibration requirements shall be verified by analysis and test.
Thorough analysis and test are required to verify the desired characteristic of the vibration and
dynamic response are met, and to identify and minimize potential vibration and dynamic
response problems of the power drive subsystem which includes the external “plumbing”
components (tube network), the plumbing “support structure” (clamps and brackets), and
interconnecting rotating machinery.
Verification should be through a combination of analyses, static (such as Rap Test of

components to confirm modal prediction) and dynamic testing. Analysis should show all critical
speeds in relation to operational speeds throughout the range of possible shaft misalignments.
The critical speeds of all shafting should be determined by demonstration. Demonstration of
critical speeds on supercritical shafts should include measurement of stresses at the critical
speed to insure they are within design limits. Data should also be provided to show the
absence of dynamic coupling modes that are destructive or limit the use of the air vehicle for all
permitted ground and flight modes. Data should also be shown that define all power drive
subsystem spring constants, inertia and damping coefficients for use in torsional stability
assessments.
The power drive subsystem dynamic analysis should consider engine control system interfaces
to avoid torsional instabilities in the power drive subsystem.
Resonance frequencies and mode shapes should be determined for each gear. For the gear
resonance test, the dynamic stress levels in each gear should be measured in locations
sensitive to all significant vibratory modes. A speed scan from 0 to the speed of maximum
overspeed should be performed with:
a. minimum load
b. approximately 50-percent (50%) load
c. maximum load.
1050
JSSG-2009A
APPENDIX K
This is usually accomplished in conjunction with gear stress survey of “Durability” verification in
this appendix.
The externals should use Rap Testing and Shake Rig Testing based on plumbing location which
demonstrates High Cycle Fatigue (HCF), and Vibration Dynamic Response capabilities are
adequate for full life. These goals can be accomplished for using combination of Rap Testing
and Shake Rig Testing. Option is based on plumbing location, and environment. All methods
require an assembled engine or representative engine mockup to perform the component test.
(TBD)
K.3.4.11.2 Misalignment.
A maintenance-free means shall be provided to accommodate continuously the maximum

permissible misalignment of coupled drive shafts at combinations of torque and
speed (TBS) .
High reliability of critical coupling mechanisms to accommodate misalignment is essential to

avoid catastrophic failure. The intent of this requirement is to improve reliability by insuring the
coupling will operate satisfactorily under the worst conditions that might reasonably be expected
in service (for example, at maximum torque that could be delivered at worst permissible
misalignment). Maintenance-free design is required to avoid the necessity of maintenance
before every flight.
TBS: Combinations of torque and speed should reflect representative operational scenarios.
Replacement of coupling mechanisms should not require realignment of the associated

shafting.
Coupling mechanisms should be identified as being subject to the damage tolerant

requirements of “Durability” and its subparagraphs in this appendix.
Couplings should be the dry type to avoid the necessity of doing maintenance checks before
every flight.
Coupling designs that have failed to consider the effects of transient misalignment in high
speed, high torque applications have resulted in premature failure.
1051
JSSG-2009A
APPENDIX K
Laminated disk type couplings have been known to be limited in misalignment capability and
subject to fretting in high speed applications due to a lack of enough preload (bolt clamp-up
force) to provide drive in friction to prevent fretting.
Coupling designs that have failed to consider misalignment induced loading has resulted in
accelerated wear of internal engine and gearbox components.
Cracking in some diaphragm type couplings has been detected by a clicking sound upon shaft
rotation.
K.4.4.11.2 Misalignment.
Misalignment requirements shall be verified by analysis and component testing.
It is essential to perform testing to verify and demonstrate that the coupling meets the desired
endurance and damage tolerance performance characteristics.
It is also essential to verify at a system level both the shafting system dynamic response and
displacements are within the requirement operational parameters.
Damage and fault tolerance tests on coupling components should be conducted in accordance
to the guidance of the verification subparagraphs under “Durability” in this appendix. The test
conditions should be based on worst case air vehicle operating conditions as a minimum. The
test should demonstrate continued operation from initial failure indication to complete loss of
function for a duration of at least three times the normal inspection interval.
Testing should include anti-flail testing of coupling components where applicable. (See
JSSG-2001, “Failures”.)
See “Durability” in this appendix for coupling endurance testing.
Damage tolerance testing has been recommended in one of the following ways:
a. Test after intentionally damaging the coupling.
b. Continue the endurance test after coupling has experienced a detectable crack.
c. Test after hanger bearing mount isolation system damage.
d. Test after hanger bearing contamination (water, sand, etc.).
1052
JSSG-2009A
APPENDIX K
K.3.4.11.2.1 Drive shaft supports.

For multiple-segment drive shaft systems such as a single main rotor with tail rotor drive
system, tandem rotor aircraft with synchronization shafts or a tilt-rotor with an interconnect drive
shaft system, the supporting bearings and their interface to the airframe shall be of a
maintenance-free configuration.

The bearing and the bearing mount are critical components which are both required to support
the segments of a drive shaft in a system.

(TBD)

(TBD)
K.4.4.11.2.1 Drive shaft supports.

The shafting system support components (bearings and mounts) shall be verified by analysis,
component, and system level testing.
The ability of bearings and bearing mounts to support the segments of a drive shaft must be
verified.

(TBD)

(TBD)
1053
JSSG-2009A
APPENDIX K
K.3.4.11.3 Rotor braking, positioning, and holding.
If required, a means of slowing (braking) to a stop, securing (holding), and indexing the rotors
shall be provided:
a. The rotors can be held from rotating in winds up to (TBS 1) knots in any direction at
engine power up to and including ground idle upon start up and while the air vehicle is
not in use. Engine control interlock safeguards shall be provided to prevent inadvertent
actuation of the system.
b. The braking system (consisting of aerodynamic rotor drag and subsequent mechanical
braking) shall be able to stop the rotor (TBS 2) times, without requiring the
replacement of any part, from 100 percent (100%) speed in not less than (TBS 3) but
not more than (TBS 4) seconds after engine shutdown. For emergency shutdown
purposes, the braking system shall be capable of stopping the rotor when applied from
100 percent (100%) speed. The brake is permitted to be non-functional after the
emergency stop.
The requirement for a rotor system control relates to:

a. Shipboard operations where air vehicle cycling time constraints are driven by mission
needs or when quick dispersal and rapid concealment are needed in ground operations.
b. Minimizing hazard to ground or deck personnel when securing the vehicle.
c. Avoiding ground accidents from concentrated air vehicle activity in congested areas.
d. Emergency stopping when fast egress is required.
e. There may be a requirement to stop a rotor system in a specific position with respect to
the airframe, engine exhaust, and the point or points of egress/ingress.
Rotor system control includes the dynamic (slowing to stop), static (securing/holding/locking),
and rotor/dynamic system component positioning for aircraft stowage.
Beyond transferring power from the engines to the rotor system, in some instances the drive
system is required to effectively restrain the speed of the rotor system or prevent the rotor
system from turning at all. Rotor speed reduction and rotation control may be accomplished via:
a. Rotor Braking System.
The rotor braking system is normally hydraulically powered and either manually or
electrically actuated and controlled. The hydraulic power actuates a brake caliper/rotor
disc system that is mechanically coupled to the drive/rotor system that when actuated
will restrain the rotor system to the desired level.
1054
JSSG-2009A
APPENDIX K
The Rotor Braking System procedures may include:

1. Rotor Holding.
The rotors can be held from rotating in high winds in any direction at engine(s) power
up to and including ground idle upon start up and/or while the air vehicle is not in use
(parked with engines off).
2. Normal Operational Rotor Braking.
The rotor brake system must be able to repeatedly slow the rotor system to a
complete stop in a maximum specified amount of time without significant degradation
that would impact mission capability and not exceed the operational design margins
of the power drive system.
3. Emergency Operational Rotor Braking.
The rotor brake system for a manned rotary wing aircraft must be able to stop the
rotor system in the required amount of time after engine shutdown to allow
emergency egress from the aircraft.
b. Rotor Lock Mechanism.
The rotor lock mechanism is a passive mechanical lock which locks the rotor system
from rotating and must provide a locking device to prevent the rotor(s) from rotating in
high winds while the air vehicle is not in use. Refer to I.3.4.9.4.1, Ground wind
environment, for more specific information.
c. Rotor Positioning (Indexing) System.
The rotor positioning system is required to index the rotors to a position required for
main rotor blade/tail pylon fold. The system may also be required to index (position) the
rotor system to prevent degradation of the blades from engine exhaust heat. After the
rotor system has been stopped by the brake system, the positioning system is used to
index the rotor system upon demand with all engines off. In this method of operation, a
separate motoring system is employed to move the rotor system. Usually, the system is
a separate electrical-mechanical system or can be integrated into the rotor brake system
to control movement of the rotor system.
The rotor positioning (indexing) system may be integrated into the rotor brake system. It
must provide motion and position of the rotors for correct blade fold and pylon fold in air
vehicle storage purposes and correct engine(s) start up. Refer to I.3.4.9.4, Utility
actuation systems, for more detailed information.
The rotor system control must contain a control interlock safeguard device to prevent
inadvertent actuation of the system. Refer to I.3.4.9.4.2, Positive locking features, for more
detailed information.
TBS 1: Insert wind speed and number of startup cycles. Usually 45 knots is specified.
TBS 2: Insert number of stops. The number of stops is dependent on TBS 4.
1055
JSSG-2009A
APPENDIX K
TBS 3: Lower time limit in seconds should be based on a load or structural analysis to protect
power drive subsystem gears and other components from overloads due to sudden stops. The
brake is applied at 100 percent (100%) speed for the emergency stop.
TBS 4 is usually dependent on shipboard operational time to cycle air vehicles for landing and
stowage. The total stopping time consists of the combined effects of normal rotor speed decay
due to aerodynamic drag and subsequent mechanical braking. The number of stops should be
about 400 for a time of 40 seconds.
The interlocks used to prevent inadvertent application of the braking system during those
conditions of engine operation when the brake should not be applied or held should be
specified. Normally the interlock should prevent actuation of the system when the engine is
running. However, the user may need to be able to apply the brake when the engine is running
at or below ground idle. Also, the brake should not be capable of continued application if the
control is forward of the ground idle position. Consideration should be given to prevent slippage
of air vehicles under various ground conditions as a result of applying the rotor brake.
In the past, it was estimated that a reasonable maximum value for TBS 4 for shipboard
operations was in the range of 40 to 50 seconds and a practical minimum value for TBS 3 was
typically 30 seconds.
In the past, it was determined that the location of the brake with relation to the transmission may
cause dynamically unstable conditions.
K.4.4.11.3 Rotor braking, positioning, and holding.
Rotor braking, positioning, and holding shall be verified by analysis and test.
The drive system rotor brake testing and qualification requirements are as follow:
1. Rotor Holding:
a. At engine start-up and in high wind conditions (demonstrate ability to hold rotor system
from rotating up to (TBS 1) knots wind in any direction and against engine(s)* at
powers up to and including ground idle).
b. Parking (demonstrate ability to hold the rotor system while engines are off for (TBS 3)
period of time) if required.
*The number of engine(s) with which the rotor brake system will have to power against is
dependant upon the control logic of the aircraft.
2. Rotor Braking:
The rotor brake system (consisting of aerodynamic rotor drag and subsequent mechanical
braking) should be able to perform a spectrum of 400 operational non-emergency braking
cycles plus the equivalent of one operational emergency rotor system stopping procedure
while not exceeding any design margins within the drive system. The brake is permitted to
be non-functional after the emergency stop.
1056
JSSG-2009A
APPENDIX K
For normal operational non-emergency braking cycles:

a. the spectrum of rotor speeds at which the brake is applied, (TBS 4)
b. maximum time duration of each braking cycle, (TBS 2)
c. interval between brake applications, (TBS 5)
d. whether the brake is applied after engine shut down or dynamically against the
torque of the engine(s), (TBS 2)
For operational emergency rotor braking:
Initial speed of rotor system, and time duration to complete stop the rotor system,
(TBS 6) shall be specified in the air vehicle performance specification and/or by the
airframe manufacturer and approved by the using service.
Under normal or emergency rotor brake operations, the system shall not cause fire.
Rotor Lock Mechanism: refer to I.4.4.9.4.1, Ground wind environment, for more detailed
information.
Rotor Positioning System: refer to I.3.4.9.4, Utility actuation systems, for more detailed
information.
In some instances, the rotor brake system in conjunction with the torque of an engine(s), may
be required to re-position the rotor system for non-standard operational requirements. In this
case, appropriate testing and analysis are required to prove operational suitability.
Analysis, testing, and qualification shall accompany demonstration to show design margins are
not exceeded.
Testing verifies that the rotor brake and locking mechanism can stop and hold the rotor as
specified without damage to other components and also meet durability requirements. Bench
testing is necessary under realistic conditions to identify any potential dynamic problems and to
insure durability requirements. The suggested 400 stops is primarily based on the state-of-the-
art. Testing also shows the amount of wear to be expected on the brake linings or pads that
can be used to assess its impact on readiness.
TBS 1 is the wind speed (typically, 45 knots, but should be specified in the air vehicle
specifications).
TBS 2 must be in accordance with the air vehicle specifications.
TBS 3 is usually dependent on shipboard operational time to cycle air vehicles for landing and
stowage.
1057
JSSG-2009A
APPENDIX K
TBS 4 is spectrum of rotor speeds Nr that is chosen is dependant on the diameter of the rotor,
as well as the rotor speed decay due to the aerodynamic drag.
TBS 5 is usually dependent of the heat capacity of the rotor disc and caliper pads and must be
agreed upon between the using service, the OEM, and NAVAIR to be incorporated into the test
plan.
TBS 6 is the initial rotor speed dependant upon the operational configuration of the aircraft rotor
brake system and the time duration to stop the rotor system completely, and must be specified
in the air vehicle specifications.
Analysis should include heat generation, provisions for isolation from flammable materials or
fluids, energy absorption rate, and effects on the dynamic response of the transmission.
Verification should be by component, bench, and system-level testing. The ability of the brake to
stop the rotor within the specified stop time (at the specified engagement speed) and number of
braking cycles from the specified speed, should be demonstrated in both component bench and
system level testing. This should be followed by emergency stops which should also be
demonstrated from 100 percent (100%) speed. The component bench test should be conducted
in a test facility that duplicates the mass moment of inertia of the vehicle dynamic system.
Detailed inspection of the rotor brake components should be made prior to and after conducting
the tests.
The brake's ability to perform the specified repeated single engine startup cycles at the
specified power without failure should be demonstrated in component endurance tests and a
limited demonstration at the system level.
The system-level test should demonstrate the ability of the engine interlock safeguard system to
prevent actuation during specified periods.
The test series of the normal stops should be considered successfully completed when:
a. The test component is operating satisfactorily at the end of the tests.
b. Recalibrations do not reveal excessive performance deterioration.
c. Tear down inspections do not reveal failure, impending failure, or undue wear which
would compromise safety-of-flight.
In the past, testing included wear measurement to confirm estimates of brake pad wear life.
Also, the test plan specified the endurance cycle, such as cool down period of the brake.
1058
JSSG-2009A
APPENDIX K
K.3.4.11.4 Lubrication.
The system shall provide adequate and sufficiently filtered lubricant to all required components
including bearings, gears, and splines for lubrication and cooling under all allowed attitudes and
under all operational conditions during flight and ground operations. Gearbox breathers shall
prevent the loss of lubricating oil and shall minimize the ingestion of debris and moisture into the
gearbox.
This requirement is to specify the lubrication system upon which the power drive subsystem
performance and reliability are based. The complexity and high load demands of the
mechanical system are such that a properly sized and well functioning lubrication system is
essential for high reliability. Also the need to provide lubrication during autorotation is essential
to avoid any bearing seizures or gear failures that would interfere with the autorotation function.
The primary purpose of lubrication is to provide cooling oil to remove heat generated due to
friction at gear meshes and bearings and also to provide an oil film to reduce wear between
sliding elements. This requirement is also needed to provide guidance to the elements that
make up the lubrication system.
The system used to lubricate the drive subsystem gearboxes and associated accessories
should be independent from that used for other components and power plants to:
a. Avoid contamination from other systems.
b. Allow the use of lubricants optimized for gearbox operation.
c. Minimize exposure vulnerable areas. Precaution should be taken to prevent cross
contamination of the lubricant, the gearbox, and associated accessories.
The maximum allowable static and dynamic oil loss should be specified to avoid unnecessary
maintenance, thereby avoiding inadvertent gearbox damage during leak repairs. Dynamic leaks
above the maximum allowable leak rate should result in a pilot caution. Essential functional
elements of the lubrication system should include:
a. Gearbox Breathers. Breathers should be located to prevent loss of oil from the gearbox
under all operating conditions and gearbox attitudes. Breathers should allow the
passage of gearbox air and vapor during heat-up and cool down cycles and during
changes in atmospheric pressure. Breathers should also prevent entrance of particulate
contamination and water into the gearbox (for example during air vehicle waterwash)
that can cause damage to internal components such as bearings and gears. Gearbox
breathers should be replaceable without removal of any other gearbox components.
b. Lubricant Filtering. The lubricant filter should be able to remove particles whose size
can cause distress to contacting surfaces. The design should incorporate features that
preclude the contamination of the lubricant during operation and servicing (see lessons
learned). The capacity should be sized to preclude frequent replacement under normal
operating conditions. An integral bypass should be provided to bypass the filter element
should it become clogged. The filter impending bypass indicator should have a thermal
1059
JSSG-2009A
APPENDIX K
lockout feature that prevents actuation of the indicator when the oil temperature is low.
The bypass level should be set to allow direct visual observation of the indicator before
actual bypass under all operating conditions. The filter should be replaceable without
removal of any other gearbox component and without draining of all the lubricant. A
method (screens are usually used) to protect each individual oil jet or group of oil jets
from clogging should be incorporated into the lubrication design.
c. Filling provisions. The contractor should specify the arrangement and location of the
filling provision for the gearbox lubrication system to prevent oil contamination and
spillage (see lessons learned). Pertinent information as to the type, grade and quantity
of lubricant should be indicated on the filler cap or adjacent to it on the gearbox housing.
d. Gearbox oil drain. A means should be provided to drain the oil. Gearbox oil drain
should be accessible without removal of any other gearbox components.
e. Lubricant Selection. Lubricants should conform to DOD-PRF-85734 for normal
operating conditions and MIL-PRF-7808 Grade 3 for cold weather conditions. Other oils
should be used if substantiating data verifies its benefits and logistics impact to the field.
f. Cooling System. Suitable heat exchanger(s) should be provided to maintain the gearbox
oil-in temperature below the maximum allowed under all possible operating
combinations (gearbox power level, ambient conditions, lubricant flow rates and
pressures, gearbox attitudes and air flow rates). An integral temperature and pressure
bypass should be provided to bypass the heat exchanger when the oil temperature is too
low or the pressure to high. Failure of the heat exchanger blowers should not cause
failure of the power drive subsystem or any of its components.
g. Valves and pressure pumps. The pump(s) should provide the required flow rate and
pressure without degradation of performance at all attitudes up to and including the air
vehicle maximum operating altitude. Loss of one pump should not degrade operation of
other pumps in a multi-pump system. No air traps should exist at the pump inlet. The
pump should be a line replaceable unit (LRU). The system pressure regulating valve
should have provisions for changing system pressure during assembly and overhaul and
be properly secured to prevent arbitrary field adjustment. Pressure fluctuations should
not damage lubrication system components.
h. Oil level indication. Suitable means should be provided for direct visual observation
during servicing, without the use of tools, of the oil quantity of each gearbox lubrication
system when installed in the air vehicle at all ground attitudes. The oil level indicator
should be directly marked to indicate low oil levels and the oil quantity to be added to
reach the specified operating oil level and overfill condition. The oil level indicator
should be located to minimize errors due to attitude position of the gearbox. Should the
indicator be a sight glass, the lens should be resistant to staining.
i. Oil Leakage. The lubrication system should not leak onto the air vehicle structure.
Provisions should be made for collection and routing to overboard drains in those cases
where a small amount of oil seepage is possible. Provision should be made to alert the
pilot in the event of a rapid oil leak.
1060
JSSG-2009A
APPENDIX K
Filtration and Contamination. Successful design features which have been developed or have
been recommended to prevent contamination of the gearbox were:
a. The oil filter was located on the pressure side of the pump to prevent contamination of
the main gearbox should the pump fail.
b. The bypass was designed such that when it opens, it did not dump accumulated
particles into the lubricant system.
c. The filter housing was oriented such that entrapped oil within the filter housing is
removed when the filter is removed.
d. Filter elements were non-cleanable, disposable types.
e. The bypass indicator was resettable only when the filter was removed.
f. The minimum size of the filtered particles were usually on the same scale as the film
thickness of contacting surface in gears and bearings and were on the order of 3 to
5 microns.
g. Oil jet protection screens having screen openings of a maximum of 1/2 the minimum jet
orifice diameter and a total open area of 100 times larger than the total jet area being
protected to assure proper jet functioning during cold starts (minimum orifice diameter of
0.040" for single jet and 0.030" for multiple jets recommended).
Filling Provision. The lubrication system filler arrangement was provided with a scupper and
drain connection, and was readily accessible when installed in the airframe. The filling port cap
was positioned higher than the scupper to prevent intrusion of contaminants with a clogged
scupper drain. The filling port had a 16 mesh or finer screen to prevent particles from entering
the gearbox during servicing. The strainer was removable and cleanable at the Organizational
Level.
Gearboxes that share oil with accessories have had problems in which accessory-produced
debris entered and contaminated the gearbox lubrication system.
In the past, external lines and fittings were minimized to reduce the vulnerability of the
lubrication system. Also design features which helped were the use of gearboxes that
incorporated a wet sump type of oil supply system in which all oil passage connecting points in
the same gearbox were located within the gearbox and the oil cooler-heat exchanger was
directly mounted to the gearbox.
In the past, splash-lubed (non-pressurized) gearboxes have lost critical amounts of oil during
extended flights that resulted in undetectable failures. The continuous-monitoring temperature
sensor and chip detector both depended on the gearbox oil (now missing) to be the thermal and
debris transporter.
Gearbox breathers were commonly designed to limit gearbox internal gauge pressure to no
more than 0.5 pounds per square inch. Desiccant breathers have been incorporated on newer
platforms in an attempt to limit internal corrosion of gears and bearings.
1061
JSSG-2009A
APPENDIX K
Provisions were included to permit convenient removal of small quantities of oil for physical
property testing. The location was selected to permit obtaining a true representative sample of
the oil in the system.
K.4.4.11.4 Lubrication.
Lubrication requirements shall be verified by analysis and test.
The capability of the power drive subsystem to operate within specified temperature limits and
efficiencies at all loads using the specified lubrication system can only be verified by analysis
and extensive testing. The intent here is to determine if the lubrication system and its cooling
provisions are adequate for all operating environments and to know what margins exist,
especially under conditions of maximum gross weight in hover on a hot day.
Verification should be by analysis and testing at the element, component, and system levels.
Analysis should include a functional description of the lubrication system indicating the limits of
the lubrication system with respect to environments (high and low temperature) and air vehicle
flight envelope limits (attitude and altitude) and associated schematics showing all components
and indicating minimum flow rates to each oil jet. The design of the cooling system for all
transmissions and gearboxes should be substantiated by applicable schematics, analysis and
pertinent testing. The cooling system or heat balance analysis should include consideration of
the highest ambient air condition specified herein, the minimum gearbox oil flow, the maximum
allowable oil temperatures and the minimum cooling airflow as a basis for sizing the cooling
system.
a. Filter component tests. To verify performance, the filter assembly should successfully
complete a series of functional and integrity tests. These should include:
1. filter element multi-pass filtration ratio test
2. maximum particle passed test
3. filter bypass performance test
4. impending bypass indicator performance test
5. cold start and temperature lockout test
6. filter assembly clean pressure drop test
7. filter assembly proof pressure test
8. filter housing burst test
9. filter element bubble point test
10. filter element collapse pressure test
1062
JSSG-2009A
APPENDIX K
11. pressure build-up (dirt capacity).

b. Heat exchanger component test. The following tests should be conducted on a heat
exchanger representative of production units to substantiate compliance with
requirements:
1. oil pressure drop test
2. decongeal test
3. anti-congealing test
4. static pressure drop test (air side)
5. pressure cycling test (0 to max operating pressure)
6. thermostatic control valve performance test
7. environmental testing (including vibration)
8. thermal capacity.
c. Heat exchanger blower component. Test should include:
1. self-induced vibration test
2. performance tests
3. endurance test (at least 200 hours)
4. Ground-Air-Ground (GAG) cyclic testing (Low Cycle Fatigue (LCF)) should include
start/stop cycles for LCF
5. overspeed test
6. Containment test: blade or hub burst
d. Pressure pump. Test should include:
1. performance verification
2. endurance (with and without contamination, 500 hours recommended)
(a) 200 hours with no contamination
(b) 150 hours with water contamination
(c) 150 hours with water/metal contamination
3. 50-hour altitude endurance.
e. Oil management test. This test is to optimize the oil distribution, jet targeting, flow rate,
capacity and heat rejection for each gearbox. Tests should be run at all applicable
attitude conditions.
System-level tests may be run in conjunction with tests described in “VTOL-STOL power
drive subsystem” verification in this appendix, and flight test. The tests should include:
1. measurement and quantity of usable oil
2. measurement of oil tank expansion space if applicable
3. oil tank pressure capability if applicable
1063
JSSG-2009A
APPENDIX K
4. oil bypass demonstration

5. gearbox vent system
6. calibration of oil tank quantity indication
7. oil cooling in all flight modes; for example, hover, climb, cruise
8. oil pressure fluctuation
9. verification of satisfactory oil distribution within the gearbox.
(TBD)
K.3.4.11.5 Power train condition monitoring.
Condition monitoring shall provide appropriate personnel all necessary information for their
action. It shall supply warning of impending failure that could result in mission abort, loss of the
air vehicle, or prevent a safe landing. Elements of the power train condition monitor shall
include (TBS) information. If required, some or all of the elements of the power train
condition monitor shall be configured for incorporation with other subsystems into any planned
integrated diagnostic system.
Special power drive subsystem Condition Monitoring fault detection, isolation, and parametric
recording capabilities for maintenance or life tracking actions should be specified to insure
operational readiness.
TBS: Elements of condition monitoring may include:

a. Debris monitoring. Debris monitors capable of detecting oil borne particles for the
purpose of identifying an impending failure should be used on all gearboxes and
transmissions. The monitors should be capable of isolating faults to each gearbox or
module. The monitor should be insensitive to normal wear debris. Monitors should be
self-closing, if necessary, to allow removal without draining the gearbox lubricant. See
Lessons Learned for important design features.
b. Lubrication system - oil pressure and temperature. The oil operating temperature and
pressure for pressurized systems should be provided on a continuous real time basis
along with indications of out-of-control limits to cockpit instrumentation. Temperature
and oil level for non-pressurized (splash-lubricated) systems should be provided through
a monitoring system.
c. Health monitoring. Sensor number and location should be selected to isolate the
condition of critical rotating components including drive shafts, heat exchanger blowers
1064
JSSG-2009A
APPENDIX K
and internal gearbox components. Sensor mounting positions should be provided as an

integral part of the gearbox and drive shaft system design.
d. Usage monitoring. A system should be provided for accurate in-flight monitoring of the
power drive subsystem operational usage (power and time) for life management of
specified components.
Removable components should be made readily accessible without necessitating the removal of
other components.
A removable, cleanable screen was usually installed downstream of the monitor to protect the
lubrication pump. Experience has shown that for pressurized oil systems, it was important for
early failure detection, to locate the monitors:
a. so that all the lubricant passed through it
b. prior to the filter or pump in the oil circuit.
For non-pressurized oil systems consideration was given to locating the monitor to optimize
debris collection. A gearbox that had areas where debris particles could collect and not be
exposed to the monitor has been known to experience an undetected failure. There is no
established correlation between gearbox oil level and vibration that is suitable for oil level
monitoring.
K.4.4.11.5 Power train condition monitoring.
Verification of power train condition monitoring shall be by analysis, demonstration, and test.
The elements of the condition monitoring need to be analytically and functionally verified to
ensure their usefulness as diagnostic and parametric recording and trending tools.
Analysis should include a review of designs, schematics and functional descriptions of the
monitoring systems for compliance with requirements.
a. Debris monitor. Debris monitors representative of production units should be tested to
substantiate that it can detect debris of the size shape and material defined by the
contractor to be characteristic of debris that is considered abnormal and demonstrate
insensitivity to normal wear. Also, capture efficiencies should be demonstrated in
component-level tests, as necessary.
b. Health monitoring. Data should be recorded during development, verification and
acceptance testing to form a characteristic normal baseline for applying diagnostic
indicators to isolate mechanical component faults. Data should be recorded in a manner
that can be used for incorporation into any planned integrated diagnostic system (see
Lessons Learned). The number of sensors, tachometer frequency, recorder
1065
JSSG-2009A
APPENDIX K
specifications, and record length should be selected so as to adequately isolate the

characteristics of the dynamic components in each gearbox.
Health monitoring was traditionally done through vibration monitoring. Experience in the
development of integrated diagnostic systems has shown that acquired raw broadband data
with a usable band width up to at least 20 kHz, (for example, a digitization rate of
80,000 samples per second was needed in order to take full advantage of the latest diagnostic
algorithms). A high frequency, phase accurate synchronous tachometer signal (best if on high
speed shaft) was recorded with the vibration data for post test processing. Related parameters
such as temperature and torque have also been recorded for correlation with flight test data.
K.3.4.11.6 Durability.
All gears shall have infinite life in tooth bending at 100 percent (100%) of rated torque. Surface
durability of gears, without scoring, and bearings shall be at least (TBS 1) hours at (TBS 2)
power conditions. The life shall be specified at the (TBS 3) level. Driveshaft coupling
mechanisms shall have an endurance life, under conditions of maximum permissible
misalignment and 110 percent (110%) of rated torque. All other power drive subsystem
components shall have a minimum of (TBS 4) hours life.
The special durability requirements of the power drive subsystem must be applied since they
are the primary criteria for the structural design of the subsystem components. The
requirement, based on experience, is expected to achieve acceptable endurance without
imposing an unnecessary weight and volume burden.
TBS 1 through TBS 3 should be completed with the information in table K-II. Analysis of
durability should consider a detailed determination of loads and stresses from all sources
including vibration, thermal, transmitted torque, and housing deflections.
a. Gear tooth bending fatigue. Life calculation should be based on American Gear
Manufacturer Association (AGMA, www.agma.org) standards. No increase of endurance
stress allowables should be taken for gear materials as a result of inducing beneficial
residual compressive stresses such as results from shot peening.
b. Surface durability (spalling and pitting) should include all the conditions in table K-II.
1066
JSSG-2009A
APPENDIX K
TABLE K-II. Surface durability.
COMPONENT TBS 1 TBS 2 TBS 3
Gears 4500 hours L1 life level Mean effective load based on the
power spectrum or 70 percent (70%)
rated power, whichever is greater
Gears 1500 hours L1 life level 100 percent (100%) rated power
Bearings 4500 hours B10 life Mean effective load based on the
power spectrum or 70 percent (70%)
rated power, whichever is greater
Bearings 1500 hours B10 life 100 percent (100%) rated power
The use of Lundberg-Palmgren bearing life models which use life adjustment factors derived
from ANSI/ABMA 9:1990; ANSI/ABMA 11:1990; and Society of Tribologists and Lubrication
Engineers (STLE) Life Factors for Rolling Bearings, 1992; or other substantiated data should be
acceptable. Life of critical rolling element bearings should be derived from a detailed analysis of
the internal load distributions using state-of-the-art computer programs.
Other components:
TBS 4: 4500 hours based on fatigue related failures, at any power level and duration allowed
by the flight spectrum. Fatigue calculations should be based on minus 3-sigma working curves.
Deflections of the gearbox and transmission housings should not affect the durability of internal
components under any combination of input loading and air vehicle operating condition.
Shot Peening. It was necessary with some vendors to employ a fully-automated, computer-
controlled process for shot peening to be effective and not detrimental in improving gear tooth
fracture resistance. SAE AMS2430 provides further guidance.
K.4.4.11.6 Durability.
Durability verification shall be by analysis and test.
Thorough analysis and testing are necessary to verify durability requirements are met. The
incremental tests described, resulting from many years of experience, are expected to provide a
high level of assurance that the power drive subsystem will meet the durability goals or will
reveal durability problems early enough in the development program for timely corrective action.
1067
JSSG-2009A
APPENDIX K
a. Analysis: Vibration and stress analyses of all components subjected to potential stress or
vibration induced failure should be conducted prior to component testing. The analysis
should include prediction of the range of values for steady, cyclic and vibratory stresses, and
the design point and life predictions relative to the analysis. Verification by analysis should
insure the loading reflects the influence of all environmental and operational factors on the
life calculation methods of all fatigue sensitive components especially critical components
such as bearings and gears. Bearing analysis methods should be evaluated for accurate
predication of internal load distribution among the rolling elements. If bearing life analyses
employs an endurance stress limit criterion, data should be presented that clearly
establishes the value of the limit stress. All material and operational life factors should be
substantiated by pertinent data. Finite element analysis of the main gearbox and
transmission housings should be provided. The deflections of the housings under worst-
case conditions of input loading and air vehicle flight condition should be determined. The
main gearbox housings should be included as part of the transmission mounting system
fatigue tests. Housings should be instrumented during bench tests to determine deflections
and loads.
b. Gear testing: Prior to endurance testing, gearboxes should undergo gear pattern
development tests, and a gear tooth load distribution survey and fatigue test as follows:
1. Gear pattern development tests. The contractor should build-up a gearbox, using the
latest configuration parts and assembly procedures, for the purpose of developing the
gear tooth contact patterns of all internal gears. The torque level at which the patterns
are optimized should be defined and justified by the contractor. The patterns should be
acceptable over the range of loading specified in the flight spectrum. There is no
duration requirement for this test.
2. Gear load distribution survey. Following successful completion of the gear pattern
development test, a gear load distribution survey should be conducted. A gearbox
should be built up, using the latest configuration parts and assembly procedures, for the
purpose of performing a gear load distribution survey. The primary load gear teeth
should be strain-gauged in the gear teeth's roots, gear webs, and gear rims. The
gearbox should be operated at input loads of up to at least 120 percent (120%) of
Gearbox Power Rating and at speeds up to the maximum speed. Testing should also
be conducted to minimum speeds including ground idle. Gear loads should be less than
design allowables. The survey should be conducted at normal oil-in operating
temperatures.
3. Fatigue. Infinite gear tooth bending fatigue life should be substantiated by bench testing
each gearbox to typically 130 percent (130%) rated torque (to account for the 3 sigma
factor) at 100 percent (100%) rated speed to accumulate sufficient cycles on the slowest
rotating gear to substantiate infinite life. It is usually not economically feasible or timely
to run a sufficient number of test samples and test hours to verify the surface durability
design life of all bearings and gears. Therefore, verification is dependent on accurate
load analysis and well established surface durability fatigue data for the materials
selected as well as on bench and system-level tests as described in the “VTOL-STOL
power drive subsystem” verification in this appendix.
1068
JSSG-2009A
APPENDIX K
c. Couplings: Test a minimum of six couplings to substantiate the endurance life.
(TBD)
K.3.4.11.7 Engagement and disengagement of load absorbers.
Means shall be provided to permit engagement and disengagement of the engines from the
load absorbers as required for all applicable modes of air vehicle operation. For rotary-wing air
vehicles in autorotation mode, the engine(s) not supplying torque shall be immediately and
automatically disengaged from the power drive subsystem. For multi-engine air vehicles
conducting single engine operations, the engines not supplying torque shall be similarly
disengaged to permit continued operation of the rotor system and accessory drive for 2 hours
without damage to the clutch/overrunning mechanism.
This requirement for clutching devices is essential to provide for:

a. autorotation of the rotor blades during total power failure without the rotational drag of
the failed engines
b. single engine failure in the case of multi-engine configuration
c. disengagement of the lift fan.
The number of engagements without losing the ability to transmit the required power (torque
and speed) should be consistent with all applicable reliability and operational requirements.
The location of the clutch(es) should allow for the continuation of necessary functions of the
transmission system and safe operation of the air vehicle for any combination of clutch
engagement and disengagement. Clutch engagements should not damage components of the
clutch or other components of the power drive subsystem.
K.4.4.11.7 Engagement and disengagement of load absorbers.
Verification shall be by (TBS) .
These tests are necessary to verify the operational capability, durability, and reliability of the
clutching design. The clutch can be a problem area in terms of excessive wear, failure to
engage, and failure to provide the overrunning function.
1069
JSSG-2009A
APPENDIX K
TBS: The following bench tests should be conducted:

a. Static torque test. During the static torque check, the torsional spring rate (angular
deflection of the outer race relative to the inner race) of the clutch should be determined.
Static torque should be gradually increased until the occurrence of slip such that further
torque increase is not possible. The torque transmitted should be based on the limit of
system dynamic loads as determined by test or equal to 200 percent (200%) maximum
rated torque.
b. Cyclic fatigue (stroking) test. Stroking tests should be performed to define the clutch’s
fatigue characteristics.
c. Overrunning test. The overrunning clutch test should be conducted in two parts. The
first should be a differential overrunning test at 100 percent (100%) differential speed
(the clutch driving member stationary and the driven member at 100 percent (100%)
speed). The second overrun test should be to the worst case engagement element
pressure velocity (PV). Each test should be conducted for two hours.
d. Cold temperature engagement test. The clutch should be subjected to cold temperature
engagement tests, using the lubricants selected under the “Environment” requirement in
Part 1 of this specification guide.
e. Clutch durability test. A minimum of 2,400 clutch engagements should be conducted on
two of each clutch configuration of the power drive subsystem. In each engagement, the
clutch should be loaded to rated torque and speed after engagement. The clutch
engagements should include a minimum of 1500 dynamic engagements, for example
second engine starts, practice autorotation (for engine clutches), in percentages that
estimates usage. A dynamic engagement is defined as a condition where the clutch
engages a rotating shaft in a manner that simulates how it will be used in service. The
time between engagements should represent the minimum time expected in usage.
After completion of the 2400 engagements, the static torque test should be conducted to
verify component condition.
(TBD)
1070
JSSG-2009A
APPENDIX K
K.3.4.11.8 Loss-of-lubricant operation (loss of lubrication).
The gearboxes shall function for at least 30 minutes after complete loss of the lubricant from the
primary lubrication system and shall be in a condition such that the gearbox is still capable of
transmitting the required power and that no components shall be in a state of imminent failure.
The operational conditions shall be such that the loss of lubricant occurs at the most severe
power condition and that the air vehicle can transition to cruise and land vertically at the end of
the 30-minute period. Also, the power drive subsystem shall be capable of safe operation in the
overrunning mode for at least 30 minutes with complete loss of gearbox lubricant. The running
mechanism shall be permitted to be non-repairable after 30 minutes of loss-of-lubricant
operation.
The requirement is necessary to provide the capability to egress the hostile area in the event
the lubricant or oil pressure is lost. Oil lines are particularly vulnerable to damage because of
the extensive lubrication system connecting various components (pumps, heat exchangers,
filters). The 30 minutes of operation is considered within the state-of-the-art without imposing an
undue weight and volume burden on the system.
Any resulting attitude limitations during loss of lubricant operation should be defined if an
alternative or additional, or back-up or secondary lubrication system be used to meet this
requirement.
(TBD)
K.4.4.11.8 Loss-of-lubricant operation (loss of lubrication).
Verification shall be by bench testing a gearbox and/or alternative/auxiliary lubrication system

and transmission in its production configuration.
Testing is needed to verify this requirement.
Two thirty minute tests should be conducted. A teardown inspection should be conducted
following each thirty minute test. Testing should be conducted after completion of the system
level verification test described in the “VTOL-STOL power drive subsystem” in this appendix.
Test article dimensions and clearances should be recorded prior to test and should be
representative of a production configuration. Transmission and gearbox lubrication systems
1071
JSSG-2009A
APPENDIX K
should be starved at the system’s supply side (downstream from the pump) and continue to
scavenge. Operation should be demonstrated for a 30-minute period, typically, as follows:
a. Two minutes at rated power to simulate hover.
b. Twenty six minutes at a power condition to simulate cruise.
c. Two minutes at a power condition simulating vertical landing.
Creditable run time should start at the point at which the cockpit low oil pressure warning would
be displayed. For non-pressurized gearboxes, creditable run time should start when the oil
being drained from the gearboxes ceases to flow in a steady stream. The transmission should
be configured in an air vehicle attitude simulating the cruise power condition. For a VTOL air
vehicle, the test spectrum and attitudes should be commensurate with expected field use.
Inspection of components should not indicate a condition of impending failure. However, the
components need not be in a condition suitable for further service.
A thirty minute loss-of-lubrication overrunning test consistent with the loss-of-lubricant test
spectrum above should be conducted. The residual lubricant trapped in the clutch need not be
separately drained for this test.
An oil starvation test is not equal to a loss of lubricant test. Oil starvation testing requires
starving a specific component(s) while the rest of the primary lubrication system continues to
operate without any loss of lubricant in the system. An oil starvation test can potentially be
impacted by splashing lubricant or oil mist inside the gearbox housing which can reach the
starved component, and is therefore not equal to a loss-of-lubrication test.
K.3.4.11.9 Rotor meshing.
For intermeshing-rotor systems, phased externally, means shall be provided in the power drive
subsystem to prevent operation with rotors which are not properly phased for safe operation.
Means shall be included for cockpit indication that the rotors are locked in phase.
The purpose of this requirement is to prevent the blades of one rotor from contacting the blades
of the other rotor, thereby preventing catastrophic failure. Such contact can occur on systems
having intermeshing or overlapping blades unless the rotors are locked in phase.
Rotor phasing devices should be provided with positive mechanical and/or electrical interlocks
to prevent engine starting unless they are locked in phase. The proper definition of applicable
maintenance actions is required to insure the aircraft configuration will be safe following drive
system maintenance.
1072
JSSG-2009A
APPENDIX K
(TBD)
K.4.4.11.9 Rotor meshing.
Verification shall be by analysis and demonstration.
Analysis and demonstration are required to verify functionality.
Analysis and demonstration should be accomplished during system-level verification in “VTOL-

STOL power drive subsystem” in this appendix.
(TBD)
K.3.4.11.10 Accessory drives.
Cover plates shall be provided for use when accessories are not installed. Failure or seizure of
any individual accessory shall not cause damage to any power drive subsystem components.
For rotary-wing air vehicles, accessories shall be driven whenever the rotor system is rotating,
including during autorotation, and when the rotor system is not rotating if required to support
ground operations.
The main purpose of this paragraph is to provide essential design requirements for the
accessory pads and drives. It is essential that certain accessories continue to operate during
autorotation; these include main generators, lubrication oil pumps that supply the main gearbox,
oil cooler fans, tachometer generators that provide a rotor rotations per minute (rpm) indication
to the pilot, and hydraulic pump drive for the rotor controls.
Accessory drive splines should be protected from wear with non-metallic inserts or should be
positively lubricated with oil when functioning.
Refer to MS3325, MS3326, MS3327, MS3328, MS3329, and MS3336 for accessory drive pad
standards. Refer to MS9948, MS9949, and MS9950 for cover plate standards.
1073
JSSG-2009A
APPENDIX K
K.4.4.11.10 Accessory drives.
Verification of accessory drives shall be by inspection and testing.
Testing and inspection are needed to verify the functionality during normal and autorotation
operation. Verification should be incorporated in system-level testing to minimize impact on
development schedule.
Testing and inspection should be accomplished during system-level verification of “VTOL-STOL

power drive subsystem” verification in this appendix.
(TBD)
1074
JSSG-2009A
APPENDIX K
K.5 PACKAGING
K.5.1 Packaging.
K.6 NOTES
not mandatory.)
K.6.1 Intended use.
The VTOL/STOL power drive subsystem descriptions in this appendix are intended for use in air
vehicle systems developed to perform combat and combat-support missions in environments
unique to military weapon systems.
K.6.2 Acquisition requirements.
K.6.3 Acronyms.
AGMA American Gear Manufacturer Association
GAG Ground-Air-Ground
LCF Low Cycle Fatigue
LRU Line Replaceable Unit
OEI One Engine Inoperative
PFAT Preliminary Flight Acceptance Test
PV Pressure Velocity
rpm Rotations Per Minute
STLE Society of Tribologists and Lubrication Engineers
STOL Short Takeoff and Landing
1075
JSSG-2009A
APPENDIX K

K.6.4 Subject term (key word) listing.
Accessory drive
Bearings
Dephased
Gearbox
Gears
Load absorber
Lubricant
Phased
Power train
Rotors
Vibration
K.6.5 Responsible engineering office.
information or assistance on this appendix can be obtained from
AFLCMC.ENEZ.ENGINEERING.STANDARDS@WPAFB.AF.MIL; AFLCMC/ENRS, 2145
MONAHAN WAY, WRIGHT-PATTERSON AFB OH 45433-7017 USA; DSN 674-5476;
COMMERCIAL (937) 904-5476.
K.6.6 Changes from previous issue.
1076
JSSG-2009A
APPENDIX L
APPENDIX L
AIR VEHICLE PROPELLER SUBSYSTEM
L.1 SCOPE
L.1.1 Scope.
information for the Propeller Subsystem provided for in Part 1 of this specification. The appendix
has been developed and coordinated by technical personnel from the Air Force, Navy, and
Army and has been approved as an official guide for use by Government personnel for
L.1.2 Structure.
L.1.3 Appendix.
L.1.4 Deviations.
1077
JSSG-2009A
APPENDIX L
L.1.5 Environmental impact.
L.1.6 Responsible engineering office.
L.2 APPLICABLE DOCUMENTS
L.2.1 General.
they are listed.
L.2.2 Government documents
L.2.2.1 Specifications, standards, and handbooks.

JSSG-2007 Engines Joint Service Specification Guide
1078
JSSG-2009A
APPENDIX L

MIL-STD-704 Aircraft Electric Power Characteristics
19111-5094 USA.)
L.2.3 Order of precedence.
L.2.4 Streamlining.
1079
JSSG-2009A
APPENDIX L
L.3 REQUIREMENTS
L.4 VERIFICATIONS
L.3.1 Definition
L.4.1 Definition
L.3.2 Characteristics
L.4.2 Characteristics
L.3.3 Design and construction
L.4.3 Design and construction
L.3.4 Subsystem characteristics
L.4.4 Subsystem characteristics
L.3.4.1 Landing subsystem
L.4.4.1 Landing subsystem
L.3.4.2 Hydraulic subsystem
L.4.4.2 Hydraulic subsystem
L.3.4.3 Auxiliary power subsystem
L.4.4.3 Auxiliary power subsystem
L.3.4.4 Environmental control subsystem
L.4.4.4 Environmental control subsystem
L.3.4.5 Fuel subsystem
L.4.4.5 Fuel subsystem
L.3.4.6 Aerial refueling subsystem
L.4.4.6 Aerial refueling subsystem
1080
JSSG-2009A
APPENDIX L
L.3.4.7 Fire and explosion hazard protection subsystem
L.4.4.7 Fire and explosion hazard protection subsystem
L.3.4.8 Electrical power subsystem
L.4.4.8 Electrical power subsystem
L.3.4.9 Mechanical subsystems
L.4.4.9 Mechanical subsystems
L.3.4.10 Cargo, aerial delivery, and special operations
L.4.4.10 Cargo, aerial delivery, and special operations
L.3.4.11 VTOL-STOL power drive subsystem
L.4.4.11 VTOL-STOL power drive subsystem
L.3.4.12 Propeller subsystem.
The propeller subsystem shall be capable of operating without excessive vibration while
accepting power from a shaft power engine and providing thrust to the air vehicle as demanded
by the controlling input in all modes of flight and ground operation for all allowed environments
and within its operating envelope and operating limits. It shall maintain control of power and
thrust in a manner to assure continuous operational compatibility between the propeller and
engine.
The function of the propeller subsystem is to convert the power delivered by a shaft power
engine to a propulsive thrust for the air vehicle as required in all modes of flight or ground
operation while assuring compatibility with engine operation and minimization of mechanical and
aerodynamically generated vibrations. The propeller must be able to deliver the appropriate
thrust as determined by pilot input to its control, and the engine operating status (such as
torque, rotational speed, and proximity of engine limits) and air vehicle operating status (such as
the position in the air vehicle flight envelope or taxi and landing regime).
The propeller should provide for a ground idle mode sufficient for control of taxiing on the
ground and a flight idle mode for control of thrust and drag during idle descent.
For propeller control systems with a mechanical interface, the torque required to operate the
control input lever or any additional levers necessary to control the propeller through their range
of travel should be no greater than 25 in.-lbs. throughout all flight loads and conditions.
Movement of the control input lever(s) throughout the operating range should be free of abrupt
1081
JSSG-2009A
APPENDIX L
changes in actuating torque. The torque variation with travel should be no greater than
10 in.-lbs.
All propeller steady-state and transient operating limits (maximum, minimum) and polar moment
of inertial and steady-state governing speed should be specified. The specified limits should be
predicated on the most critical tolerances and operating limits of the propeller and engine. The
propeller system should operate satisfactorily in all thrust modes up to these limits.
The propeller should be free from flutter in both forward and reverse thrust modes under
conditions up to 120 percent (120%) of maximum rated engine speed and at powers up to the
standard day maximum take-off power rating of the engine.
Any limitation of the propeller system caused by loss of hydraulic power should be specified.
Any limitation of the propeller system caused by loss of electrical power should be specified.
When power is required from the air vehicle electrical system, the following should apply:
a. The electrical power requirements of the propeller system such as voltage, current,
phase, and frequency should be specified.
b. Propeller system electrical equipment should operate satisfactorily under the applicable
long term and transient voltage variations set forth in MIL-STD-704.
The design of propeller blades should take into consideration the fact that blades must not
deflect to such a degree as to contact any parts of the airframe or engine during all phases of
propeller operation.
The blade cuff should be described. The attaching means should be such that injury will not
result to the blade from chafing and maximum corrosion protection will be afforded.
The dry weight of the complete propeller subsystem should be specified. The weights of
propeller components which are not mounted on the propeller should be listed and included in
the dry weight of the propeller. The location where the propeller center of gravity (c.g.) occurs
The estimated weight of residual fluids remaining in the propeller after operation and drainage,
while the propeller is in its normal attitude should be specified. The location where the propeller
c.g. occurs with the specified residual fluid conditions should be specified.
The total mass of fluids in an operating propeller should be specified. The location where the
c.g. occurs with the specified operating fluids conditions should be specified.
A propeller should incorporate an ice control system if the propeller operating envelope requires
it. (See Lessons Learned for design information.)
1082
JSSG-2009A
APPENDIX L
a. External mechanical power. When external mechanical drives for mounting and driving
propeller components have been utilized, they have been specified in the model
specification.
b. Structural design considerations. Table L-I presents load factors which have been specified
for propulsion system components in the past.
TABLE L-I. Propulsion system load factors.
LOAD TYPES LIMIT ULTIMATE
Externally-applied loads 1.0 1.5
Thermal loads 1.0 1.5
Thrust loads 1.0 1.0
Internal pressures 1.5 2.0
Air vehicle flow field loads 1.0 1.5
Crash loads N/A 1.0
NOTES:
For all castings, a safety factor of 1.33 should be applied to the limit and ultimate load
factors specified above, unless the castings have been fully characterized.
Factors of safety should be applied to design usage induced loads to establish limit and
ultimate conditions.
c. Blade index marking. A mark has been needed in the past to provide an indication of
reference station to determine blade pitch in order to index the blades to the control and to
each other. This mark has historically been specified as a stripe of yellow enamel, 1/8-in. by
2 in., which conformed to TT-E-527, color No. 33538 of Federal Standard No. 595, applied
on the thrust face of each blade. The stripe is along the chord of the referenced station
used for blade indexing. The stripe is centered on the referenced chord within 1/16 in.
longitudinally and within 1/2 in. laterally.
1083
JSSG-2009A
APPENDIX L
L.4.4.12 Propeller subsystem.
The propeller subsystem requirements shall be verified incrementally by analysis and a series of
component and propeller tests to insure propeller and engine compatibility, controllability,
structural integrity, endurance, performance, aerodynamic and mechanical limits, and capability
to withstand transient excursions and emergency conditions.
The design and operating characteristics should be known before completion of full-scale
development to ensure performance and functional requirements of the weapons system are
met.
Analysis should consist of detailed descriptions with associated schematics and drawings of the
entire propeller subsystem and all related modules and components to include but not limited to,
blades, barrel, control system, pitch change system, and anti-icing system. The analysis should
also identify the propeller subsystem’s arrangement, functional relationships, weight, engine
interfaces, design margins, and growth potential, and associated structural, vibration, and
cooling analyses. In addition, the analysis should address maintenance concepts, producibility,
safety, survivability, and corrosion resistance.
Propeller subsystem testing consists of the following four major types of tests:
a. Component testing wherein many cycles of operation, high loads, or wide excursions are
required which are not achievable in a propeller system test
b. Whirl tests wherein a calibrated, instrumented, variable-speed rig is used to drive the
propeller throughout and beyond its range of normal operation
c. Propeller and engine test stand tests wherein the propeller is operated on a test stand
with its intended operational engine
d. Air vehicle tests wherein the propeller is tested on the ground and in flight with its
intended operational air vehicle
e. Component tests
1. Conditions. Test apparatuses necessary for conducting the tests, method and
procedures of tests, and data obtained during the tests should be determined by the
contractor and approved by the procuring activity.
2. Structural. The blades and barrel should be subjected to fatigue tests to assure their
durability under all service applied loads. The components subject to test, the
methods and procedure of test, and data to be obtained during the test should be
specified.
3. Durability. Prior to installation of the propeller on the prototype or first production air
vehicle, the components of the propeller designed to perform certain functions
should be subjected to applicable tests. This is recommended in order to establish
the capability of the components to perform their respective functions for at least a
1084
JSSG-2009A
APPENDIX L
recommended period of 1,500 hours between overhaul, removal, or service

interruption. The tests should be of a "cycle" type for the specified time duration or
number of cycles and should be conducted on those control or emergency system
components which are not limited to the following. Where possible, a Reliability
Growth Testing methodology should be employed to determine the actual number of
test hours and components to be tested to achieve the recommended hours between
overhaul, removal, or service interruption.
(a.) Control unit. (such as a complete, unitary-housed control assembly which
provides general control and pitch change power) Test duration should be for
a minimum of 500 hours.
(b.) Pitch change mechanism. Test duration should be for a minimum of
500 hours.
(c.) Low pitch stop. Exposure should be of the maximum magnitude which the
component will encounter in service. Test duration should be for a minimum of
100 cycles.
(d.) Mechanical pitch lock. Exposure should be at various rates of actuation. Test
duration should be for a minimum of 1,500 cycles.
(e.) Feathering and unfeathering. Exposure should be under various conditions of
speed and power. Test duration should be for a minimum of 500 cycles of
which no less than 100 cycles should be accomplished at maximum conditions
of propeller operation.
(f.) Negative torque signal. Exposure should be under those conditions normally
expected to be encountered in service. The test should be for a minimum of
1,000 cycles.
(g.) Ice control system. The propeller electrical ice control system components,
including brushes and rings, should be subjected to a 500-hour durability test at
the temperature-altitude conditions specified in the model specification.
4. Teardown inspection. After completion of the tests, the propeller components which
underwent test should be completely disassembled for examination of all parts and
measured as necessary to disclose excessively worn, distorted, or weakened parts.
These measurements should be compared to measurements taken before assembly
and the contractor’s drawing dimensions and tolerances. Records should be made
of failures, wear, and other unusual conditions.
f. Whirl Stand Tests.
Adequate whirl flutter modeling and analysis should be performed by the propeller/blade
manufacturer to demonstrate stable operation of the propeller under all operating conditions
within the given flight operating envelope of the air vehicle on which the propeller system is
to be used. Modeling and analysis should be performed prior to any whirl rig testing. The
flight envelope must be defined along with mission profiles which define each phase of each
mission profile; i.e., climb, cruise, descent, braking maneuvers, etc.
1085
JSSG-2009A
APPENDIX L
Whirl stand tests should be performed at a time in the program which will permit analysis of
all test data prior to first flight. The whirl stand tests of the propeller should be conducted on
a test apparatus capable of developing horsepower and variations of rotations per minute
(rpm) without forward velocity, in excess of that specified in the propeller specification.
The same test propeller should be used for all the whirl stand tests and should consist of
specification aerodynamic configuration blades assembled in the hub and properly
restrained to assure a fixed setting for test under the following testing. When whirl rig
testing does not allow for use of full-size blades, blade simulator stub arms may be used
provided they accurately reproduce centrifugal loads, bending moments, and propeller polar
moment of inertia, and adequate whirl flutter analysis has been performed.
1. Pre-test disassembly inspection. The propeller submitted for test should be
completely disassembled to allow a detailed inspection of all vital working parts.
Exception to the disassembly inspection are those components which are
permanently joined together. Individual parts or components should be examined for
evidence of suitable quality of materials based on physical inspections and process
control data, and may be supplemented by physical and chemical tests to determine
the extent of conformance to contractor's specifications and drawings. The condition
of the individual parts or components should be approved by the procuring activity.
After instrumentation, the propeller should be reassembled for test.
2. Vibratory stress survey. A vibration stress survey should be conducted on the whirl
stand to determine the stress characteristics of the hub and blade and the flutter
characteristics of the blade. The data obtained in this survey should be used in
determining the test operational limitations for subsequent testing of the propeller on
the whirl rig. Blade angle settings for the test should be selected so that, if flutter is
present, a flutter boundary can be determined for the propeller. This vibratory stress
survey could be conducted simultaneously with the calibration test.
3. Calibration test. The propeller calibration procedure should establish the sea level
static performance characteristics of the complete propeller. The propeller should be
calibrated at various rotational speeds up to 120 percent (120%) of the maximum
rated speed of the propeller, in increments of not more than 5° settings of the blade
angle over the range specified for the test program. Data should be recorded at
each blade angle at appropriate increments of rpm. The increments of rpm at which
data are recorded should be reduced to obtain more detailed information in the
suspected high stress conditions. The blade angle absorbing minimum power
should be determined and recorded. Blade deflection data should be recorded
during calibration runs. Curves should be drawn showing corrected power and thrust
at various speeds for each blade angle from data obtained during the test. The
estimated blocking factor attributed to the test rig should be noted on the curves.
4. Endurance run. A 20-hour endurance run should be conducted on the propeller
including spinner, cuffs, and ice control equipment. During the run the blade angle
should be set at that angle at which the propeller absorbs maximum continuous rated
actual static sea level horsepower at maximum continuous rated rpm. The propeller
should be run at an rpm at which the propeller absorbs 150 percent (150%) of the
maximum propeller rated horsepower.
1086
JSSG-2009A
APPENDIX L
5. Overspeed run. A one-hour overspeed run should be conducted on the propeller

including spinner, cuffs and ice control equipment. During the run, the blade angle
should be set at that angle at which the propeller absorbs at least maximum
continuous rated actual static sea level horsepower at 120 percent (120%) of the
maximum rated propeller rpm. The propeller test should be run at 120 percent
(120%) of the maximum rated speed.
6. Teardown inspection. After completion of the above whirl stand tests the propeller
and components should be completely disassembled for examination of all parts and
measured as necessary to disclose excessively worn, distorted, or weakened parts.
These measurements should be compared to measurements taken before assembly
and the contractor’s drawing dimensions and tolerances. Photographic records
should be made of failures, wear, and other unusual conditions.
7. Overspeed feather test. The propeller should be reassembled with counterweights
and control assemblies necessary for conduct of the overspeed feather test. The
propeller should be subjected to an overspeed feather test consisting of 25 cycles of
operation of the control mechanism as follows:
(a.) Feathering action should be initiated from the low pitch stop blade angle at
141 percent (141%) of maximum rated rpm.
(b.) The rpm should be reduced at a linear rate from 141 percent (141%) at the low
pitch stop blade angle to 120 percent (120%) at a 45° blade angle.
(c.) After 45°, rpm can be reduced to prevent exceeding the test facility torque and
power limitations.
The propeller should demonstrate that feathering can be accomplished at the
conditions descibed, above, to overcome the encountered maximum centrifugal
twisting moment in normal and emergency operation.
g. Propeller and engine test stand tests.
Two propeller and engine test stand tests should be conducted. A 50-hour test should
be conducted at a time which will permit analysis of all test data prior to first flight. A
150-hour test should be conducted at a program timing which will permit analysis of all
data prior to commencement of initial production.
1. 50-hour test. The test should be conducted on a test stand equipped with the engine
model specified for use with the propeller. The stand should include provisions to
mount the engine and accurately control engine temperatures, pressures, speed,
and fuel rates so that the desired power conditions may be maintained during
propeller testing. The same test propeller should be used for the entire 50-hour test.
(a.) Calibrations, checks, and adjustments. Engine and propeller performances
should independently meet the requirements specified in their respective model
specifications prior to the 50-hour engine test.
(b.) Installation static functional check. The propeller and engine test installation
should be checked in the static condition to determine the functional
characteristics of the control linkages, voltages, continuity of control circuitry
and typical preflight checks. The relationship between all lever positions and
signal levels and the propeller blade angle should be established for the
1087
JSSG-2009A
APPENDIX L
complete range of lever and signal excursions for increasing and decreasing
power conditions. Any adjustments required should be made using only
external means to obtain the limits required.
(c.) Vibratory stress survey. A vibration stress survey of the propeller covering all
appropriate conditions of engine operation should be conducted on the test
stand to determine the stress characteristics of the propeller when operated in
the stand environment.
(d.) Instrumentation. The instrumentation and techniques used for the required
vibratory stress survey of the 50-hour engine test should be the same as that
specified for the whirl stand vibratory stress survey.
(e.) Control response test. The control response test should be conducted
concurrently with the vibratory stress survey and should include the response
of the engine-propeller to power and speed changes throughout the range of
operation of the engine under normal ground and simulated flight conditions of
the air vehicle.
(f.) Steady-state check. The steady-state check procedure should establish that
the static sea level performance characteristics of the complete engine-
propeller combination satisfactorily meets the required values of the
contractors' model specifications. External adjustments should be made to
obtain the required operational performance. Further propeller adjustments
should not be permitted without appropriate approval. After all adjustments
have been made, a calibration procedure should be conducted to obtain
steady-state data for a series of power lever settings. The appropriate power
settings are as follow:
(1.) Full reverse
(2.) Ground idle
(3.) Flight idle
(4.) 60 percent (60%) maximum continuous power
(6.) Maximum continuous power
(7.) Intermediate power
(8.) Maximum power (if applicable).
The steady-state operation at each of the various power lever settings
specified, above, should be recorded by automatic equipment.
(g.) Transient check. After completion of the steady-state check, the engine-
propeller control system should undergo a transient check to determine the
stability of the control system, rate of pitch change, and response of the
engine-propeller combination. The procedure during the transient check
should be conducted in the order given unless otherwise approved by the
procuring activity. For all power lever and input mechanism movements, if
applicable, the lever should be advanced or retarded in 1 second or less.
1088
JSSG-2009A
APPENDIX L
Transient checks should be conducted in accordance with the schedule shown

in table L-II, and automatic equipment recordings should be made at each
transient throughout the specified power lever movement.
TABLE L-II. Transient schedule.
NORMAL TRANSIENTS I.A.S. (KNOTS)1 ALTITUDE1
Flight idle to 60% Max continuous to flight idle 0, 150, 250, 350, and Sea level to Max in
normal operating speed 10,000-ft increments
Flight idle to 80% Max continuous to flight idle
Flight idle to Maximum to flight idle
Flight idle to Maximum to ground idle 0 and Max landing speed Sea level
Flight idle to Maximum to max reverse
Flight idle to Maximum reverse 0 Sea level

Ground idle to flight idle
Maximum to 60% Max continuous to Maximum 0, 150, 250, 350 VNO Sea level to Max in
Maximum to 80% Max continuous to Maximum 10,000-ft. increments
Maximum to ground idle to Maximum 0 and Max landing speed Sea level
Maximum to Max reverse to Maximum
SPECIAL TRANSIENTS
Ground idle to flight idle to Maximum to ground idle2
Ground idle to flight idle to Maximum to Max reverse2
Flight idle to Max reverse to Maximum
1
Applicable only when transients are conducted as part of flight tests.
2
A maximum of 5 seconds should be expended in going from ground idle through flight idle to intermediate; holding full take-off
power for 3 seconds before moving to next power setting.
NOTES: Power lever movement is 1 second or less for all transients. Sufficient time should be allowed at each new power setting
for stabilization of all normal transients. A pause of 3 seconds is permitted at the middle power setting for the special
transients before moving to the final power setting.
If the engine installation incorporates bleed, all the transients should be repeated with maximum bleed.
Power transients should be checked with "dry" and "wet" if the engine has a wet rating.
Intermediate power should be substituted for maximum power if the engine has no maximum rating.
1089
JSSG-2009A
APPENDIX L
(h.) Miscellaneous checks. Miscellaneous system operation checks, as applicable,

should be conducted on the propeller. The propeller should be subjected to
operating loads simulating as nearly as practicable those encountered during
emergency operations. Sufficient instrumentation should be provided to
indicate the performance of each applicable component and to indicate that the
functional relationships of components acting together are maintained as
required by the applicable test schedule. Functional checks should be
performed to indicate that no calibrated component has changed its
calibrations beyond allowable service limits and that the function of
uncalibrated components is unimpaired. When applicable, the miscellaneous
systems operation checks should be as follow:
(1.) normal feather shutdown
(2.) emergency feather shutdown with simultaneous manual fuel shutoff
(3.) manual feather and unfeather after shutdown
(4.) emergency negative torque signal by means of a momentary fuel
interruption
(5.) effects of changes in electrical voltage and power supply within the limits
specified in MIL-STD-704
(6.) effects of ac power failures
(7.) overspeed mechanical pitch lock
(8.) mechanical low pitch stop.
A continuous recording should be made at each of the miscellaneous checks,
above.
(i.) Cyclic tests. Following the control response tests, the propeller should be
subjected to the cyclic test consisting of 50 successive one-hour cycles of
operation. A continuous recording should be made of the transitory and steady-
state conditions prior to and after the cyclic test. Visual inspections should be
accomplished as a precautionary measure for detection of parts failure and
other irregular functioning of the propeller. These inspections should be
accomplished after the first, third, sixth, and every tenth hour interval thereafter
unless test conditions warrant more frequent intervals. Each cycle should
consist of the following runs shown in table L-III.
1090
JSSG-2009A
APPENDIX L
TABLE L-III. Cyclic tests.
Type of Running
Time at Setting or Power Lever Position
5 Ground idle
N/A Taxi cycles
N/A Ground idle to Maximum reverse
N/A Maximum reverse to flight idle
N/A Flight idle to ground idle
5 Maximum
5 Intermediate
10 Maximum continuous power
10 90% Maximum continuous
10 75% Maximum continuous
4 Flight idle
1 Maximum reverse
5 Repeat of taxi cycles
NOTE: Repeat approximately 10 times with alternate slow and rapid power lever
motion.
The number of creditable hours of testing should be disallowed if any of the

following discrepancies are detected after start of the cyclic test:
(1.) Linkages which pertain to the propeller require adjustment.
(2.) Propeller speed setting exceeds the established schedule by ±0.5 percent
(±0.5%).
(3.) Failure of any component adversely affecting propeller control performance
(4.) Failure of any component adversely affecting propeller integrity
(5.) Detection of any failure of any component directly or indirectly affecting
control performance during teardown inspection
(6.) Detection of excessive wear of any part or component during teardown
inspection
(7.) Necessity to add operating fluid, if applicable.
A suitable retest penalty might be imposed in the event of a discrepancy of a
propeller component.
1091
JSSG-2009A
APPENDIX L
(j.) Teardown inspection. After completion of the 50-hour engine test, the propeller
and components should be completely disassembled for examination of all
parts and measured as necessary to disclose excessively worn, distorted, or
weakened parts. These measurements should be compared to measurements
taken before assembly and the contractor’s drawing dimensions and
tolerances. Photographic records should be made of failures, wear, and other
unusual conditions.
2. 150-hour test. The 150-hour test should be conducted on the same or similar test
stand used for the 50-hour test. A production representative propeller should be
used for these tests and the same propeller should be used for the entire test. The
test should consist of 150 cycles of the same endurance cycle used in the 50-hour
endurance test. In addition, the ice control system should be operated continuously
during the cyclic test in accordance with the contractor's model specification.
Applicable ice control data should be recorded in conjunction with other data. Prior to
operation during the cyclic test, the ice control system(s) should be initially checked to
establish proper functioning.
(a.) Teardown inspection. After completion of the 150-hour engine test, the propeller
and components should be completely disassembled for examination of all
parts and measured as necessary to disclose excessively worn, distorted, or
weakened parts. These measurements should be compared to measurements
taken before assembly and the contractor’s drawing dimensions and
tolerances. Photographic records should be made of failures, wear, and other
unusual conditions.
h. Air vehicle tests.
1. Preliminary air vehicle test. The preliminary air vehicle test should be completed and
all data analyzed before the initiation of the air vehicle flight test program. The
preliminary air vehicle test of the propeller should be conducted on an air vehicle test
bed or a suitable air vehicle having a nacelle configuration similar to the proposed
application. If the propeller is a replacement propeller design for an existing air
vehicle, that air vehicle type with modifications required for incorporation of the
propeller should be used. The same test propeller should be used for all the
preliminary air vehicle tests and should be in accordance with the contractor's model
specification.
(a.) Installation static functional check. The propeller and engine test installation
should be checked in the static condition to determine the functional
characteristics of the control linkages, voltages, continuity of control circuitry
and typical preflight checks. The relationship between all lever positions and
signal levels and the propeller blade angle should be established for the
complete range of lever and signal excursions for increasing and decreasing
power conditions. Any adjustments required should be made using only
external means to obtain the limits required.
(b.) Steady-state check. The procedure for the steady-state check should be such
as to establish that the static sea level performance characteristics of the
complete engine-propeller combination satisfactorily meets the required values
of the model specifications. External adjustments should be made to obtain the
1092
JSSG-2009A
APPENDIX L
required operational performance. Further propeller adjustments should not be

permitted without appropriate approval. After all adjustments have been made,
a calibration should be conducted to obtain steady-state data for a series of
power lever settings. The appropriate power settings are as follow:
(1.) Full reverse
(2.) Ground idle
(3.) Flight idle
(6.) Maximum continuous power
(7.) Intermediate power
(8.) Maximum power (if applicable)
(9.) The steady-state operation at each of the various power lever settings
specified above should be recorded by automatic equipment.
(c.) Transient check. After completion of the steady-state check, the engine-
propeller control system should undergo a transient check to determine the
stability of the control system, rate of pitch change, and response of the
engine-propeller combination. For all power lever and input mechanism
movements, if applicable, the lever should be advanced or retarded in 1
second or less. Transient checks should be conducted in accordance with the
schedule shown in table L-II, and automatic equipment recordings should be
made at each transient throughout the specified power lever movement.
(d.) Ground vibratory stress survey. A ground vibratory stress survey of the
propeller should be conducted on all nacelles of the air vehicle to determine the
stress characteristics of the propeller when operated in the air vehicle
environment.
(e.) Flight vibratory stress survey. A flight vibratory stress survey of the propeller
should be conducted on all nacelles of the air vehicle to determine the stress
characteristics of the propeller when operated in the air vehicle environment.
(f.) Miscellaneous checks. Individual miscellaneous system operation checks, as
applicable, should be conducted on the propeller. The propeller should be
subjected to operating loads simulating as nearly as practicable those
encountered during emergency operation. Sufficient instrumentation should be
provided to indicate the performance of each applicable component and to
indicate that the functional relationships of components acting together are
maintained as required by the applicable test schedule. Functional checks
should be performed to indicate that no calibrated component has changed its
calibrations beyond allowable service limits and that the function of
uncalibrated components is unimpaired. When applicable, the miscellaneous
systems operation checks should be as follow:
(1.) Normal feather shutdown
1093
JSSG-2009A
APPENDIX L
(2.) Emergency feather shutdown with simultaneous manual fuel shutoff

(3.) Manual feather and unfeather after shutdown
(4.) Emergency negative torque signal by means of a momentary fuel
interruption
(5.) Effects of changes in electrical voltage and power supply within the limits
specified in MIL-STD-704
(6.) Effects of ac power failures
(7.) Overspeed mechanical pitch lock
(8.) Mechanical low pitch stop.
A continuous recording should be made at each of the miscellaneous checks
described, above, throughout the contractor's procedures.
2. Prototype air vehicle test. The prototype air vehicle test of the propeller should be
conducted on the prototype or first production air vehicle which would provide
suitable means for testing the propeller. In the case of a multiengine air vehicle
application, the test should be conducted on all nacelles. The propeller(s) used for all
the air vehicle tests should be in accordance with the model specification except for
modification required for instrumentation. For multi-engine air vehicles, all nacelles
should incorporate identical models of the propeller.
(a.) Ground vibratory stress survey. A ground vibration stress survey of the
propeller should be conducted on all nacelles of the air vehicle to determine the
stress characteristics of the propeller when operated in the air vehicle
environment.
(b.) Flight vibratory stress survey. A flight vibratory stress survey of the propeller
should be conducted on all nacelles of the air vehicle to determine the stress
characteristics of the propeller when operated in the air vehicle environment.
(c.) Control response test. A control response test should be conducted. The test
should include the response of the engine propeller to power and speed
changes throughout the range of operation of the engine under all normal
ground and flight conditions of the air vehicle.
(d.) Temperature survey. A temperature survey should be conducted on the
propeller during ground and flight operation to demonstrate propeller cooling
within specified temperature limits.
(e.) Fluid tank test. If an airframe mounted fluid tank is furnished as a part of the
propeller system, the tank should withstand without failure the vibration and
slosh tests as specified by approved test procedures.
a. Whirl test facilities. The Whirl Tests specified in the guidance above assume the availability
of a suitable Whirl Test facility, typically available at most propeller OEMs. Wright-Patterson
Air Force Base (WPAFB) in Ohio maintained a Whirl Test facility used by the Navy to
develop and qualify the E2/C2 and OV10 propellers in the late 1970’s. The facility consisted
1094
JSSG-2009A
APPENDIX L
of a number of pedestals on top of which were mounted dc motors of various power

capabilities. These motors were powered and controlled by motor-generator sets in an
adjacent building. The Wright-Patterson facility provided the ability to drive propellers at
rotational speeds and torques beyond the capabilities of the engine planned for the
developmental propeller while measuring thrust, shaft torque, and propeller deflections.
These capabilities are necessary to map fully the propeller aerodynamic characteristics,
flutter boundaries, vibration characteristics, and blade deflections. In addition, the overspeed
and overtorque capabilities provide the means to conduct structural proof testing. All the
data obtained during these tests is essential to propeller development.
b. Test plans. In the past, test plans have specified the following:
1. General test conditions.
During all testing, the fluid pressure adjustments, if any, should be made at the
beginning of the test to the values specified in the test plan. No further adjustments that
may affect the loading, functioning, or operation of the components or the propeller
should be permitted during the test.
The fluid system should be drained and filled with new fluid at the start of each specific
test. When externally supplied hydraulic power is a requirement, only new makeup fluid
should be introduced into the system subsequent to initial servicing. No fluid should be
drained from or added to the system during the test unless authorized. The system
should further be maintained in accordance with the requirement of hydraulic system
contractor.
2. Test data.
(a.) The following data should be recorded during the whirl stand tests, where applicable, in
multiple increments of 50 or 100 rpm, as may be required, throughout the total rpm
range of the test run:
(1.) Time of day
(2.) Total test time
(3.) Broad band strain gauge readings
(4.) Propeller speed, rpm
(5.) Blade angle, degrees
(6.) Corrected horsepower
(7.) Corrected thrust, lbs.
(8.) Torque, ft-lbs.
(9.) Barometer, in.
(10.) Ambient temperature, oF*
(11.) Established formula for determining corrected horsepower, thrust and torque
(12.) Data for reading oscillograph recordings of stress traces
*Note: Ambient temperature should be recorded at intervals not greater than 60 minutes.
1095
JSSG-2009A
APPENDIX L
(b.) The following data should be recorded during the propeller and engine test stand tests,
where applicable, at intervals not greater than 60 minutes:
(1.) Time of day
(2.) Time of starts and stops, and total time accumulated
(3.) Total test time
(4.) Engine speed, rpm
(5.) Engine actual shaft horsepower*
(6.) Torque, ft-lbs
(7.) Engine case or gearbox vibration at points shown on installation drawing, mils
(8.) Fuel flow, lbs/hr*
(9.) Main or manifold pressure, psi or in. mercury
(10.) Primary pump pressure, psi
(11.) Secondary pump pressure, psi
(12.) Transient recovery time*
(13.) Oil inlet pressure, psi
(14.) Oil inlet temperature, oF
(15.) Engine compressor inlet and discharge pressure, psi
(16.) Engine compressor inlet and discharge temperature, oF
(17.) Engine compressor bleed opening point*
(18.) Engine or gearbox oil outlet temperature, oF
(19.) Engine turbine inlet temperature, oF*
(20.) Condition or power lever positions, degrees
(21.) Synchrophaser operation
(22.) Negative torque signal operation
(23.) Ambient temperature, oF
(24.) Propeller pitch pressure, psi
(25.) Propeller speed, rpm*
(26.) Propeller operating fluid temperature, oF
(27.) Blade angle, degrees*
*Note: For steady-state and transient calibrations, items marked with an asterisk, as
applicable, need be recorded and such other data as may be pertinent to the installation.
1096
JSSG-2009A
APPENDIX L
(c.) Instrumentation. The instrumentation and techniques used for recording the vibratory
stress survey of the whirl stand and air vehicle tests should be subject to review and
approval. The instrumentation and techniques include:
(1.) The distribution and number of each type of strain gauges used
(2.) The range of operating conditions over which vibratory stress data will be recorded
(3.) The type of recording equipment used and the intervals at which recordings will be
made
(4.) The propeller components to be subjected to the vibratory stress survey.
Additional or revised instrumentation similar in nature is permitted. The instrumentation
should be sufficient to record stress traces, propeller rpm, and blade angle. As a
general guideline, strain gauges should be installed on one blade of the propeller for
measurement of blade shank and airfoil longitudinal and transverse stresses. A limited
number of strain gauges should be installed on adjacent or opposite or both adjacent
and opposite propeller blades, as required. The instrumentation data format should be
specified for strain gauge installation on the propeller blade and their respective
connection to the data acquisition system used for making the vibratory stress survey.
L.3.4.12.1 Control signals.
The control signal input or output from the airframe and propeller shall be (TBS) .
The characteristics of the control signals must be described. This will provide for compatibility
and interchange of information between the propeller, engine, and air vehicle flight controls.
TBS: The propeller control system should be compatible with and receive and process airframe
signals for propeller control input. Propeller control interpretation of input signals should be
defined.
A single input (pitch actuating) mechanism should be provided for the propeller to modulate
blade pitch throughout the operating range. The total travel and position of this mechanism
should be compatible with the air vehicle system. In the governing and beta regimes the
relationship between the motion of the propeller input mechanism should be essentially linear.
If reversing features are provided as part of the propeller system, a reverse thrust condition
should be reached by movement of an appropriate mechanism. The total travel and position
should be compatible with the air vehicle system.
The propeller should provide for an input of an engine Negative Torque Signal (NTS). This
signal should be used to command increase pitch action on the propeller which will minimize
1097
JSSG-2009A
APPENDIX L
windmilling drag and prevent the engine from exceeding negative torque limits. The sensitivity
and adjustment range of the NTS system should be specified.
The propeller should provide for the input of a feather command. This command should result
in an increase pitch action at the fastest rate available from the pitch actuating system. Pitch
change should traverse fully to the full feather position without further pilot commands.
Propeller governor speed setting. In the past, propeller controls have often provided for the
input of a propeller speed set command. Variation of this input signal has provided a
corresponding variation in the propeller governor speed setting. When incorporated, the
characteristics of the required signal and the corresponding governor response have been
specified.
L.4.4.12.1 Control signals.
The control signals requirements shall be verified by test.
The control signals must be verified to ensure that no incompatibility exists
The satisfactory operation of the control signals should be verified by the installation static
functional checks, conducted during the engine and propeller test stand and air vehicle tests
specified in “Propeller subsystem” verification in this appendix.
(TBD)
1098
JSSG-2009A
APPENDIX L
L.3.4.12.2 Propulsion interface.
The interface of the propeller with the airframe shall allow the propeller to perform as (TBS) .
The interfaces between the airframe and the propeller should be established and controlled to
ensure compatibility. The propeller, airframe, and engine contractors must control the interface
to ensure the propeller will work properly when installed in the air vehicle.
TBS: The maximum allowable loads for all parts that interface with the airframe should be
specified.
The maximum effective mass moment of inertia about the resultant rotational axis of the
propeller rotating system and the direction of rotation when looking forward from the propwash
If propellers are used in a multi-engine air vehicle they should be suitable for installation in any
engine position in the air vehicle with minimum parts replacement.
The components which define each propeller module, and the length of time to remove and
replace each module, should be specified. These modules should include at a minimum, the
propeller control, individual blades, and the spinner. All modules should be capable of removal
and replacement on the wing without the removal of other engine or propeller modules. All
modules should be replaceable at the organizational or intermediate maintenance level.
The allowable range of characteristics of the propeller at the engine interface should be
specified. No resonant frequency should be transmitted to or from the engine through the
propeller.
The propeller mounting type should be specified and should be of a type which conforms to and
is compatible with the engine or gear box design. The mounting should retain the propeller
including retained fluids and externals at all flight, takeoff and landing, and ground conditions
and withstand elastic limit loads without permanent deformation and ultimate tensile strength
loads without complete fracture. The propeller loads transmitted to the engine propeller shaft
(i.e., bending moment spectrum), should be specified and not negatively impact the service life
of the propeller shaft or the propeller gear box. The allowable range of characteristics of the
propeller at the engine interface should be specified. No resonant frequency should be
transmitted to or from the propeller through the engine. The propeller should receive and
transmit signals as required by the airframe and ground support systems. The signals, signal
characteristics, and physical interface should be specified.
The propeller control system interface should ensure compatibility between the airframe power
demand output signal or load, and the control system. The control lever(s) should not move
with the engine operating unless external torque is applied. The maximum allowable loads at
1099
JSSG-2009A
APPENDIX L
the control lever connections should be specified for the static (1g) axial, shear and overhung
moment, and for the maximum maneuver loads defined.
There should be no leakage of fluids from any part of the propeller except at the drains provided
for this purpose. The flow rate into all drains should be specified.
Propeller subsystems that interface with the airframe and ground support system; and control
system human interface for any required propeller control system adjustments, maintenance
data input or retrieval, and system fault data should be specified.
Components mounted on engines or gearboxes should be located to provide the necessary
installation clearances.

(TBD)
L.4.4.12.2 Propulsion interface.
The Propulsion interface requirement shall be verified by inspection, analysis, and test.
The interfaces must be verified to ensure they are functionally and physically correct.
Analysis should consist of a detailed description of the propeller interface with associated
schematics and drawings of the propeller, engine, and airframe interface, all related modules
and components, their arrangements functional relationships, interface loadings, weight, and
position. In addition, maintenance concepts should be addressed, especially as related to
module replacement “on-the-wing” and interfaces with ground support systems. Analysis
providing rotor mass moment of inertia should be provided.
Removal and replacement “on-the-wing” and the modular maintenance concept should be
verified by a demonstration test based upon procedures specified in the maintenance manuals.
Resonant frequency characteristics should be verified by analysis of data acquired during the
propeller and engine test stand and air vehicle tests in “Propeller subsystem” verification in this
appendix.
Control system interface should be verified by the installation static functional checks during the
air vehicle tests of “Propeller subsystem” verification in this appendix.
Verification of no external leakage should be by inspection of all test articles before, during, and
after test.
(TBD)
1100
JSSG-2009A
APPENDIX L
L.3.4.12.3 Ground handling.
The propeller shall incorporate provisions for ground handling as (TBS) .
The propeller must be compatible with the logistic system equipment for ease of transportation.
TBS: Ground handling mounts should be provided which support the propeller, including all
propeller-mounted equipment and externals, components, and operating fluids, under at least
the following inertia load conditions, without deformation to the mounts or damage to the
propeller: 4g’s axial, 2g’s lateral, and 3 g’s vertical acting in combination at the propeller c.g.
(TBD)
L.4.4.12.3 Ground handling.
The ground handling requirement shall be verified by analysis and test.
Ground handling provisions need to be verified to ensure the propeller will not be damaged
during handling and shipment.
Adequacy of the ground handling mounts should be verified as part of the structural design
analysis. In addition, a static test should be conducted which applies a static load to each
ground handling mount position equivalent to the load which would occur as the result of
applying the specification inertial load conditions.
(TBD)
1101
JSSG-2009A
APPENDIX L
L.3.4.12.4 Performance characteristics.
The performance shall be (TBS) .
All propellers must meet or exceed minimum performance to ensure the capability of the
weapon system to accomplish established missions. Performance computer programs provide
a means of estimating performance without actual testing of hardware.
These performance characteristics should be determined using the specified electrical supply,
grade and quantity of lubricants and fluids, if applicable, together with the engine, engine
control, and air vehicle system which should be specified.
The propeller steady-state performance requirements should be defined by a steady-state

performance computer program which should be controlled by a date and identifying number.
Tables should be used to specify rated performance. These tables specify performance points
at sea level static conditions for the atmospheric temperatures which are appropriate to the
usage of the air vehicle.
Tables should also be used to specify performance at selected altitude, True Airspeed (TAS),
and inlet temperature conditions. The computer program should take precedence in the event
of a conflict between tables and the performance computer program.
During all permissible power transients and times of accomplishment of such transients
established for the engine, the propeller response should be compatible with the transient
engine performance requirements stated in the engine model specification. Transient response
of the propeller system should be defined by a transient performance computer program which
should be identified by a date and identifying number.
The propeller feathering, unfeathering, and forward and reverse thrust operating limits should be
specified for the specification operating environment.
(TBD)
1102
JSSG-2009A
APPENDIX L
L.4.4.12.4 Performance characteristics.
The performance characteristics shall be verified by test.
The propeller performance characteristics must be verified by test to ensure steady state and
transient performance is adequate to meet projected air vehicle mission requirements.
The propeller aerodynamic performance characteristics should be verified by data obtained

during the whirl tests in “Propeller subsystem” verification in this appendix.
Transient performance characteristics should be verified during the transient checks of the air
vehicle tests in “Propeller subsystem” verification in this appendix.
Feathering, unfeathering, forward and reverse thrust limits should be verified by data obtained
during the whirl tests in “Propeller subsystem” verification in this appendix.
In the selection of specific test points for performance verification, consideration should be given
to the fact that any performance data produced as an output of the steady state and transient
computer programs but not specifically verified by test should be considered to be estimated
performance.
(TBD)
L.3.4.12.5 Control of propeller.
The control system shall control propeller operation to attain the steady state and transient
propeller performances as (TBS) .
Control of the propeller is accomplished by means of a propeller control system which is

required to assure compatibility with the engine and air vehicle requirements under steady state,
transient and emergency conditions. The control system architecture and related functional
propeller capability requires a description that shows compliance with operational,
environmental, and mission requirements.
TBS: The propeller control system should include all necessary provisions required for proper
and complete automatic, manual, or emergency control of the propeller. These provisions
1103
JSSG-2009A
APPENDIX L
should be listed and defined. These provisions depend upon the requirements for a given
application and should include one or more of the following:
a. All elements of self-contained type propeller control systems required for speed governing
in normal or reverse pitch, for control in the beta regime, and for emergency features
should be contained within the propeller and should function independently of the
synchronizer. The only elements that might be mounted remotely are the synchronizers
of the governor trimming type, the elements that must be incorporated in the pilot’s or
flight engineer’s power control unit, sources of emergency signals such as NTS and
items of secondary importance, such as tachometers and generators. In other type
systems, emergency features not self-contained within the propeller should be defined
and listed.
b. The primary features of self-contained propeller control systems should function
independently of the engine oil system or the air vehicle electrical system insofar as
flight safety features are concerned. Other functions such as back-up protection or
those that do not involve flight safety of the air vehicle such as speed synchronization,
phase synchronizing, or feathering near zero rpm may utilize electrical power from the
air vehicle electrical system. In other types of control systems, functions dependent
upon the engine oil system or the air vehicle electrical system, should be defined and
listed.
c. The propeller control system should incorporate the following emergency features:
1. A mechanical low pitch stop
2. A feathering system operable under all flight conditions including windmilling dives.
An emergency means of initiating feathering should be incorporated which is
independent of the normal means for such operations. Upon receiving a signal from
the airframe for feathering the propeller pitch should advance completely to the
feather position within an appropriate period of time. The time required for the
propeller to achieve full feather position should be consistent with flight safety
requirements as determined by asymmetric thrust on multi-engine air vehicles and
loss of flight energy due to drag on single engine air vehicles. Rotation of the
propeller should not be required to complete the feathering cycle.
3. A control linkage which when connected with the engine NTS output mechanism
should provide protection against catastrophic drag.
4. An adequate overspeed protection system that engages in the event of
overspeeding or loss of hydraulic pressure or similar failure. The system should act,
when engaged, to prevent motion of the blades toward low pitch in the normal
governing range but should permit motion of the blades toward high pitch. System
settings should be specified.
d. Speed and phase synchronization of propellers for multi-engine air vehicles should be
provided as a secondary speed control and should be described. The control should act
to maintain the rotational speed of the slave propeller(s) to that of the master propeller
within 2 rpm in the propeller normal governing range. Phase synchronization should
maintain the blade phase angle relationship of all propellers to one another within 15°
under all normal steady-state flight conditions in smooth air.
1104
JSSG-2009A
APPENDIX L
e. Reverse operation to a fixed negative blade angle compatible with the engine. Overspeed
during propeller reversal should be compatible with engine overspeed limits. Maximum
time to reverse from the low pitch stop should be specified.
f. The propeller response should be sufficiently rapid that it will not permit overspeeds in
excess of those specified in the engine specification. Transient limitations may be a
function of the engine overspeed mechanism on installations where applicable. The system
exclusive of the synchronizer should prevent speed oscillations in excess of 0.5 percent
( 0.5%) under stabilized flight conditions.
Normal and reverse governing should be specified. Selective constant speed governing at any
selected speed within the range necessary for optimum performance of the applicable engine
should normally be incorporated into the propeller design. Where the propeller is controlled by
a governor which is not an integral part of the propeller assembly, the governor should be
constructed to conform to the mounting specified by JSSG-2007, Engines Joint Services
Specification Guide. The governor should regulate the propeller speed between the limits
specified.
Adequate provisions should be provided for situations in which it is desired to change pitch
while the propeller rotational speed is at zero.
Control system adjustment. In the past, external adjustment to the control have been limited to
adjustments which can be made correctly with the propeller assembled. These adjustments
have been clearly marked and accessible with the propeller installed. All other adjustments
have been protected to avoid tampering. These external adjustments were listed and defined.
When adjustments of limiting values of the controlled propeller variables were required, positive
features were provided so that it would not be possible to preset the adjustments to the extent
that would result in catastrophic consequences to the air vehicle.
L.4.4.12.5 Control of propeller.
The control of the propeller requirements shall be verified by analysis and test.
Verification of the ability of the propeller control system to control the propeller is required to
ensure air vehicle mission capability throughout all flight and ground handling regimes including
emergencies.
Analysis should consist of detailed descriptions with associated schematics and drawings of the
entire propeller control system and its component parts, their arrangement, functional
relationships, and engine and engine control interfaces.
1105
JSSG-2009A
APPENDIX L
Demonstration of satisfactory control of the propeller should be accomplished through the

control response test, the steady state check, the transient check and miscellaneous checks
conducted as part of the engine and propeller test stand and air vehicle tests specified in
“Propeller subsystem” verification in this appendix.
(TBD)
L.3.4.12.6 Vibration and balance.
The propeller shall be free of vibration and dynamic response that could cause the equipment to
operate below specified requirements or cause excessive crew discomfort. It shall be free of
destructive vibrations at all steady-state and transient operating conditions.
Since the propeller is the largest and highest energy piece of rotating equipment on the air
vehicle, its ability to produce discomforting as well as destructive vibration is substantial.
The propeller should be adequately balanced to achieve satisfactory operation and suitable
crew comfort and should contain provisions for maintenance rebalancing. The contractor
should specify vibration limits and associated locations.
Propeller critical speeds existing below the operating range should be at least 20 percent (20%)
below the minimum steady state operating speed. Critical speeds existing above the maximum
operating speed should be at least 20 percent (20%) above the maximum allowable transient
shaft rotational speed.
Means of limiting these vibrations should be aggressively considered in the design and
construction of the propeller. Maintenance methods should also provide for methods of
assuring the maintenance of the propeller vibration within design limits. Vibration limits and
their associated locations should be specified to provide for installation of instrumentation as
required to detect when the propeller is producing vibrations beyond the design operating limits.
a. Blades. Prior to or after painting, as the design allows, all blades should be balanced
against a master balance which has been approved, the blade should balance horizontally
and vertically at any two blade angles 90° apart. The rotation of the blade caused by
horizontal out-of balance should be stopped or reversed by an opposite moment determined
as the weight of the blade times an eccentricity of .002 in. except that a moment of
.010 lb-in. minimum should be used. The rotation of the blade caused by vertical out of
balance should be stopped or reversed by an opposite moment determined as the weight of
the blade times an eccentricity of .004 in. except that a moment of .020 lb-in. minimum
1106
JSSG-2009A
APPENDIX L
should be used. It is permissible to use equipment of equivalent accuracy in which the

balance is determined with the blade centerline located in either a horizontal or vertical
position. Where balancing equipment other than a knife edge is used, the unbalance
moment specified above may be applied as scale reading deviations from the specified
master components.
1. Ground adjustable. For correction of unbalance in ground-adjustable blades a
concentric hole should be bored in the shank end of the blade in such a manner that it
will not be detrimental to the strength of the blade. The balancing material placed within
the hole should be adequately secured.
2. Wood. Final balance of wood blades should be attained by the removal of material not
to exceed the minimum allowable tolerances specified in the model specification. Other
means should be subject to approval.
b. Hub. The rotation of the hub caused by out-of-balance should be stopped or reversed by an
opposite moment determined as the weight of the hub times an eccentricity of 0.0005 in.
applied in such a manner that no force other than the mass of the applied balancing or
reversing weight is the indicating feature. When equipment other than knife edges is used
the same tolerance should be applied in an equivalent manner.
1. Ground adjustable. The hubs should be balanced without the clamp rings being in
place. In order to attain final balance of the finished hub about the axis of the shaft,
metal may be removed.
2. Controllable pitch. In the case of hubs which have been provided with means of
correcting the unbalance of the completely assembled propeller, the balancing of the
hub assembly should be accomplished with this balancing means adjusted to its neutral
or mean position so as to retain its maximum effectiveness for correcting any unbalance
of the completely assembled propeller. Other means should be used to correct any
unbalance of the hub assembly.
3. Fixed pitch. Final balance of the finished hub about the axis of the shaft should be
attained without the addition of weights. Metal may be removed to meet the final
balance requirements.
c. Spinner. The means used to support the spinner for balancing should provide the same
degree of accuracy of centering and aligning the spinner as will be obtained when the
spinner is installed on the propeller. Spinner balance should be attained by either or both of
the following means:
1. Static. The assembled spinner with all parts attached should be balanced on knife
edges so that the rotation of the spinner caused by out-of-balance should be stopped or
reversed by an opposite moment. The opposite moment should be determined as the
weight of the spinner times an eccentricity of 0.0005 in., applied in such manner that no
force other than the mass of the applied balancing or reversing weight is the indicating
factor. Other equipment of equivalent accuracy may be used in which case the
unbalance may be applied as a scale reading.
2. Dynamic. The assembled spinner with all parts attached should be balanced at
__(TBS)__ rpm on a machine having an accuracy of correction for balance in terms of
1107
JSSG-2009A
APPENDIX L
displacement of 0.000025 in., to secure an unbalance of not more than 2.0 ounce-in. in
each of two planes.
d. Propeller.
1. Provisions. Provisions should be made for attaching balance weights in each of two
balancing planes located as far apart axially as practicable, fore and aft of the plane of
the blades. Points of attachment must be readily accessible with the propeller mounted
on the air vehicle.
2. Propeller balance. Propeller balance should be attained by any of the following means:
(a) Static. The rotation of the propeller caused by out-of-balance should be stopped or
reversed by an opposite moment. The opposite moment should be determined as
the weight of the propeller times an eccentricity of 0.0005 in. applied in such manner
that no force other than the mass of the applied balancing or reversing weight is the
indicating factor.The balance requirement should be met with any blade in a vertical
and horizontal position. It is permissible to use equipment giving equivalent accuracy
which balances the propeller in a horizontal plane, in which case the unbalance may
be applied as a scale reading.
(1) Ground adjustable. Horizontal balance should be accomplished without
additional provisions.
(2) One piece wood. One-piece wood propellers should be balanced with a hub
bolted securely onto the propeller. Balance may be secured by the
application of liquid finish to the lighter blades for horizontal balance, or by
securing a brass plate to the wood portion of the hub for vertical balance.
(b) Dynamic. The assembled propeller with all parts attached should be balanced at
100 percent rpm once installed on-wing to a vibration level of __(TBS)__ inches per
second (ips).
L.4.4.12.6 Vibration and balance.
The vibration characteristics of the propeller shall be verified by test and analysis. The
provisions for balancing and rebalancing shall be verified by inspection. Adequacy of balance
shall be verified by test.
Only actual operational tests with appropriate instrumentation can verify that the propeller is not
producing excessive vibration. Balancing is critical to operating the propeller at a minimum
vibration level. Since propeller balance can change due to service wear and damage, the
provisions for balancing and rebalancing must be verified by actual testing of the resultant
balance.
1108
JSSG-2009A
APPENDIX L
Verification should be through a combination of analysis and testing. Analysis should show all
critical vibratory modes, their frequencies and stresses as a function of blade angle and rpm.
This vibration analysis should form the basis for instrumentation and data reduction during
testing. The vibratory characteristics of the propeller should be verified from the data obtained
during the vibratory stress surveys conducted during the whirl stand tests, the engine and
propeller test stand tests and the air vehicle tests in the “Propeller subsystem” verification in this
appendix. Data representing all bending and twisting modes as well as unbalance should be
identified and compared to design calculated values and to specified limits.
Verification of balancing methods should be based on analysis of vibration data obtained during
propeller and engine stand tests and flight tests. Verification of balancing and re-balancing
provisions should be obtained by inspection of assembly and maintenance procedures.
(TBD)
1109
JSSG-2009A
APPENDIX L
L.5 PACKAGING
L.5.1 Packaging.
L.6 NOTES
not mandatory.)
L.6.1 Intended use.
The propeller subsystem descriptions in this appendix are intended for use in air vehicle
L.6.2 Acquisition requirements.

L.6.3 Component information
L.6.3.1 Propeller anti-icing system.
a. Ice control system. The propeller should incorporate an ice control system for the blades,
cuffs, and spinner. Either electrical, fluid, gas, compound, or mechanical ice control systems
may be used when approved by the procuring activity. As an alternattive to these ice control
systems the physical shape and or surface finish of the blades, cuffs, and/or spinner may
prevent or reduce ice accumulation without negatively impacting system performance or
causing damage to the propeller, engine, or aircraft. In this case, upon approval by the
procuring activity, an ice control system will not be required. Specify in the model
specification the ice control system(s) or alternate means of preventing or reducing ice
accumulation.
1. Type of ice control. The type of ice control may be continuous, cyclic, or a combination
of both as specified in the model specification. Unless continuous ice control is provided,
operation of the ice control system should be accomplished either automatically or
1110
JSSG-2009A
APPENDIX L
manually as specified in the model specification. Continuous operation of the ice control
system in flight should not damage the propeller system. Requirements for indication of
the operation of the ice control system should be identified.
2. Electrical ice control system.
(a.) Electrical contact surface. All aluminum-oxide films, lacquers, or similar
nonconducting coatings should be removed from the actual contact area of all
surfaces required to act as a path for electrical power and from the local areas under
screws, nuts, or the like used for assembly or mounting purposes to provide an
electrical connection in accordance with the requirements of MIL-W-5088.
(b.) Electrical ice control circuits. All electrical circuits pertaining to ice control systems
should be so physically and electrically isolated that no interference with the
propeller operation or control will result. The leads used to conduct electrical power
to the heating elements should withstand the aerodynamic centrifugal and vibratory
loading to which they will be subjected during propeller operation.
(c.) Bonding materials. Cements, adhesives, or brazing used to bond blade, spinner, or
cuff electrical heating elements should be specified in the model specification.
Bonding processes which cause a reduction in physical properties of the item to
which the element is bonded should be specified in the model specification.
(d.) Cover surfaces. Surfaces exposed to the air blast should consist only of materials
designed to resist abrasion and corrosion. External surfaces of installed heating
elements should be aerodynamically smooth. Externally mounted rubber or plastic
surfaced elements should be inherently of sufficient flexibility and elasticity to allow
installation in service areas without special dies, and stretching equipment.
(e.) Blade heating area. The heating elements should heat the inboard section of the
exposed blade length to the propeller radius approved by the procuring activity. The
width of the blade heated on both the thrust and camber faces should extend from
the leading edge back to a distance at no point less than 17 percent (17%) of the
blade chord.
(f.) Cuff heating area. The heating elements should heat the leading edge of the cuff for
its entire length and at least 20 percent (20%) of both cuff face areas emanating from
the leading edge.
(g.) Blade heating elements. Heating elements for propeller blades not equipped with
cuffs should be continuous throughout their length. The heated area should
approach as near as practicable the juncture between the blade and spinner or hub.
Heating elements for propeller blades equipped with cuffs may be of two pieces with
the cuff element and blade element separate, but compatible and designed for a
single electrical supply circuit. The non-heated length between cuff and blade
elements should not exceed 2 in. The external heating element installation should
result in no distortion of the propeller airfoil contour.
(h.) Spinner heating area. The heating elements should heat the entire area of the
rotating spinner surface.
(i.) Power requirements. The power requirements of the ice control system depend on
the mission, performance and design of the specific air vehicle application and
1111
JSSG-2009A
APPENDIX L
should be specified in the model specification. Heating element wattage should be

calculated after reducing the voltage by an amount equal to the voltage drop in the
complete circuit to each heating element. The type of phase loading, overload, and
open-circuit sensing devices should be described.
(j.) Cycle heating controls. A cyclic control unit should be provided as a component part
of the system. The schedule of the cyclic control should be specified in the model
specification.
3. Fluid ice control system.
(a.) Fluid flow pattern. The system should accomplish a flow pattern of the fluid on the
propeller blades, cuffs, and spinner, as necessary, to provide satisfactory ice control
under all anticipated icing meteorological conditions.
(b.) Fluid. The fluid, flow rate, and pressure should be specified.
(c.) Connecting lines and fittings. Straight thread fittings should be in accordance with
MIL-F-5509.
4. Compound ice control system.
(a.) Compounds. The compound used should produce a surface which will prevent ice
adhesion when applied to the spinner, cuff, or blade surface as applicable. No
damage to the protected surface should occur from the solution resulting when the
compound comes into contact with water. The kind of compound used should be
specified.
(b.) Protected blade area. The blade area to be protected by the compound should not
be less than 75 percent (75%) of the blade length on inboard section and
transversely from the leading edge to include approximately 25 percent (25%) of the
chord.
(c.) Protected cuff area. The cuff area to be protected by the compound should be at
least 20 percent (20%) of the cuff area on both cuff faces along the entire leading
edge.
(d.) Protected spinner area. The entire spinner surface should be protected by the
compound.
5. Gas ice control system. Gas ice controller systems should produce sufficient heat to
melt the layer of ice adhering to the surface of the blade, cuff, and spinner, as
applicable, which should permit ice removal by action of centrifugal force or produce
sufficient heat to prevent ice formation on the blade, cuff, and spinner, as applicable, and
should not affect the functional operation of the propeller or produce any undesirable
structural or aerodynamic effects.
(a.) Ice control pattern. The system should accomplish a pattern of heat on the propeller
blades, cuffs, and spinners, as necessary, to provide satisfactory ice control underall
anticipated icing meteorological conditions.
(b.) Heat requirements. A complete definition of the heat source and heat requirements
of the system should be specified.
1112
JSSG-2009A
APPENDIX L
(c.) Controls. Protective devices supplied as part of the propeller system should be
specified.
L.6.3.2 Pitch-changing system.
The pitch-changing system should function satisfactorily throughout all regimes of flight and
ground operation and should be described in model specification.
a. Hydraulic operation. When the pitch-changing system is hydraulically actuated, in whole
or in part and the source of hydraulic power or fluid is self-contained, the system should
be independent of the engine lubricating system and the air vehicle hydraulic system. If
the engine lubricating oil is used, the propeller manufacturer should utilize the oil
passages provided by the applicable engine or external lines if passages are not
provided.
b. Electric operation. When the pitch-changing system is electrically operated, in whole or
in part, the voltage and frequency of the current for which the pitch-changing system is
designed should be compatible with the air vehicle electrical system. In cases where the
propeller manufacturer provides the source of power that is independent of the air
vehicle electrical system, the electrical source should be contained within the propeller.
c. Mechanical operation. When the pitch-changing system is entirely mechanically
operated, the pitch change operating force should be available at all propeller speeds.
Provisions for unfeathering of the propeller should be provided.
L.6.3.3 Lubrication system.
If the propeller incorporates a lubrication system the following should be considered.
If the propeller lubrication system is shared with the engine lubrication system, provisions
should be made to prevent contamination of the engine oil system from debris that
originates from the propeller lubrication system.
The propeller should meet the requirements of the specification when using the specified
lubricating oil. The maximum and minimum operating oil pressure limits, maximum transient
and maximum allowable steady-state oil temperature limits should be specified. The
maximum and minimum oil pressures during starting and initial operation should be
specified.
The maximum allowable oil consumption rate should be specified.
Unvented oil reservoirs should meet pressure vessel requirements. If the lubrication system
and hydraulic systems share a common reservoir, the lubrication system should be
protected from total depletion in the event of a hydraulic failure.
The oil reservoir should contain features to determine the oil level in the reservoir for all
operating attitudes. An oil quantity signal should be provided to the airframe. The reservoir
should have a drain system and should have features for overfill protection. Oil servicing
should be possible with the propeller in a range of positions from 15° nose-up to 20° nose-
down.
1113
JSSG-2009A
APPENDIX L
Drain ports should be provided at appropriate low points in the oil system for draining the oil
and taking oil samples with the propeller in a range of positions from 15° nose-up to
20° nose-down.
Oil filter type(s), micron size, capacity, and filtration ratio should be specified. Primary filter
assemblies should incorporate a pressure relief bypass, an impending bypass, and a
bypass indicator. The bypass indicators should provide both local and remote indications
and incorporate provisions to preclude activation during low-temperature starts. The
indications should be visible until manually reset.
L.6.3.4 Hydraulic system.
a. Self-contained hydraulic system. The capacity of any self-contained hydraulic system

b. External hydraulic power. When externally-supplied hydraulic power is required for the
propeller system, the pressure, flow, and quantity requirements should be specified.
c. Fluids. The operating fluid should be specified. The fluid should be selected from defense
specifications, and no change in fluid should be required for operation throughout the
complete ground and air temperature range.
d. Fluid contamination. Hydraulic filter capacity should be such as to allow operation between
the filter inspection periods specified by the propeller manufacturer.
1. Self-contained hydraulic systems. The propeller manufacturer should specify the
filtration requirements of fluid being installed in the systems.
2. Non-self-contained hydraulic systems. The propeller should operate on the fluid being
supplied.
L.6.3.5 Propeller rotating assembly.
a. Blades. Prime attention in the selection of materials and methods of construction of the
blades should be given to such factors as abrasion, moisture, corrosion, and other
deteriorating operational factors that tend to have adverse effects on structural integrity and
safety.
1. Blade pitch. The variation in pitch between blades when the propeller is assembled
should not affect propeller performance. Means should be provided to assure the
limitation in variation is maintained during assembly or to provide for adjustment to within
this limitation.
2. Blade track. Corresponding points adjacent to the tips of the blades of the propeller
should be in the same plane perpendicular to the axis of rotation within the tolerance
specified.
3. Blade vent hole. When vent holes are required they should be specified.
4. Standard blade shank ends. Ground adjustable blade shank ends should be specified.
1114
JSSG-2009A
APPENDIX L
5. Finishing wood blades. The external surface of wood blades should be specified in the
model specification. After finishing, the tip of each blade should be painted for an
inboard distance of 4 in.
b. Spinner. A spinner which provides an airflow compatible with airframe and engine
requirements should be specified. Spinner designs should provide access for inspection
and servicing of the propeller pitchchange mechanisms, propeller brushblock and slipring
assembly, oil filler opening, lubrication fittings and such other items as may be applicable to
the installation. It should accurately maintain its form in the installed position when rotating
under operating conditions as well as when subjected to normal handling during
maintenance or overhaul.
1. Symmetry. Dimensional symmetry should be maintained throughout the entire axial
length of the spinner.
2. Balance provisions. Provisions for correcting static or dynamic unbalance condition
should be identified.
3. Spinner blade seals. The seals should be replaceable parts and mounted without
restriction to movement between the blade and hub and capable of withstanding
rotational forces without loss or impairment.
4. Quick detachment. Quick detachment features should be incorporated in the spinner.
External fasteners or other attaching means should be designed and installed to prevent
their separation from the spinner in the unlocked condition.
5. Installation. The spinner should be such that when installed it should in no way impair
the strength of the propeller and should not interfere with the functioning of the propeller
or propeller controls. Mounting provisions for accurately centering the spinner on the
hub should be capable of withstanding frequent installation or removal of the spinner
without damage.
c. Hub. The hub should withstand all loads imposed during all operating regimes of the
propeller.
Cone and cone seats. Cone seats of hubs with splined bores should be free from plating
and able to provide an evenly-distributed bearing area contact and interchangeability of
mating cones.
L.6.4 Definitions.
Engine operating status. The torque, rotational speed, and proximity of engine limiters
Air vehicle status. The position in the air vehicle flight envelope or taxi and landing regime
L.6.5 Acronyms.
IAS Indicated Airspeed
NTS Negative Torque Signal
TAS True Airspeed
1115
JSSG-2009A
APPENDIX L
L.6.6 Subject term (key word) listing.

Anti-icing
Balance
Blade
Calibration
Deicing
Hub
Hydraulic
Pitch
Propulsion
Spinner
Vibration
Whirl stand
L.6.7 Responsible engineering office.
L.6.8 Changes from previous issue.
1116
JSSG-2009A
APPENDIX M
APPENDIX M
AIR VEHICLE PNEUMATIC SUBSYSTEM
M.1 SCOPE
M.1.1 Scope.
information for the Pneumatic Subsystem provided for in Part 1 of this specification. The
M.1.2 Structure.
M.1.3 Appendix.
M.1.4 Deviations.
1117
JSSG-2009A
APPENDIX M
M.1.5 Environmental impact.
M.1.6 Responsible engineering office.
M.2 APPLICABLE DOCUMENTS
M.2.1 General.
they are listed.
M.2.2 Government documents
M.2.2.1 Specifications, standards, and handbooks.

JSSG-2010 Crew Systems Joint Service Specification Guide
MIL-DTL-5513 Swivel Joint, Hydraulic
MIL-DTL-7891 Filler Valve, Aircraft Oxygen
1118
JSSG-2009A
APPENDIX M

MIL-STD-961 Defense and Program-Unique Specifications Format and Content
MIL-STD-5522 Test Requirements and Methods for Aircraft Hydraulic and
Emergency Pneumatic Systems
19111-5094 USA.)
M.2.2.2 Other Government documents, drawings, and publications.
USAF TECHNICAL REPORTS

AFWAL-TR-84-4104 Preliminary Review of Statistical Treatment of S-Glass/
Epoxy Stress Rupture Data (Accession Number ADA149810)
(Copies of this document are available at www.dtic.mil to qualified users; Defense Technical
Information Center, 8725 John J. Kingman Rd., Suite 0944, Ft. Belvoir VA 22060-6218 USA.)
M.2.3 Non-Government publications.
SAE INTERNATIONAL
SAE ARP584 Coiled Tubing - Corrosion Resistant Steel, Hydraulic Applications,
Aerospace
SAE ARP994 Recommended Practice for the Design of Tubing Installations for
Aerospace Fluid Power Systems
SAE AMS-P-5510 O-Ring, Preformed, Straight Thread Tube Fitting Boss, Type I
Hydraulic (-65 to 160 °F)
SAE AS8879 Screw Threads - UNJ Profile, Inch Controlled Radius Root with
Increased Minor Diameter
SAE AMS-P-83461 Packing, Preformed, Petroleum Hydraulic Fluid Resistant,
Improved Performance at 275 Degrees F (135 Degrees C)
1119
JSSG-2009A
APPENDIX M

qualified users.)
"Stress-Rupture of S-Glass/Epoxy Multi-Filament Strands," T.T. Chiao and R.L. Moore, Journal
of Composite Materials, Vol. 5, 1971.
(This report is available from the Air Force Research Laboratory Materials & Manufacturing
Directorate at http://www.wpafb.af.mil/afrl/rx/; AFRL/RX, WRIGHT-PATTERSON AFB OH
45433-7734 USA).
M.2.4 Order of precedence.
M.2.5 Streamlining.
1120
JSSG-2009A
APPENDIX M
M.3 REQUIREMENTS
M.4 VERIFICATIONS
M.3.1 Definition
M.4.1 Definition
M.3.2 Characteristics
M.4.2 Characteristics
M.3.3 Design and construction
M.4.3 Design and construction
M.3.4 Subsystem characteristics
M.4.4 Subsystem characteristics
M.3.4.1 Landing subsystem
M.4.4.1 Landing subsystem
M.3.4.2 Hydraulic subsystem
M.4.4.2 Hydraulic subsystem
M.3.4.3 Auxiliary power subsystem
M.4.4.3 Auxiliary power subsystem
M.3.4.4 Environmental control subsystem
M.4.4.4 Environmental control subsystem
M.3.4.5 Fuel subsystem
M.4.4.5 Fuel subsystem
M.3.4.6 Aerial refueling subsystem
M.4.4.6 Aerial refueling subsystem
1121
JSSG-2009A
APPENDIX M
M.3.4.7 Fire and explosion hazard protection subsystem
M.4.4.7 Fire and explosion hazard protection subsystem
M.3.4.8 Electrical power subsystem
M.4.4.8 Electrical power subsystem
M.3.4.9 Mechanical subsystems
M.4.4.9 Mechanical subsystems
M.3.4.10 Cargo, aerial delivery, and special operations
M.4.4.10 Cargo, aerial delivery, and special operations
M.3.4.11 VTOL-STOL power drive subsystem
M.4.4.11 VTOL-STOL power drive subsystem
M.3.4.12 Propeller subsystem
M.4.4.12 Propeller subsystem
M.3.4.13 Pneumatic subsystem.
The pneumatic power subsystem shall generate and store, condition, and distribute pneumatic
power to the control and actuating devices dependent on pneumatic power for normal, alternate,
or emergency operation. The pneumatic power subsystem may include components in using
systems dependent upon pneumatic power. The pneumatic power subsystem(s) shall be sized
and configured to supply pneumatic power, as required, to the selected using functions in all
modes of ground and flight operations.
Pneumatic subsystems are used where air vehicle intermittent and emergency power is
required; including, landing gear and wing flap extension, and wheel brake application.
The following should be considered for pneumatic subsystems:
Pneumatic power subsystem back pressure should be limited to preclude performance

degradation and subsystem malfunction(s). This is a concern in multiple subsystem pneumatic
circuits. To control damping back pressures in pneumatic subsystem actuators using a 4-way
valve control, the valve pressure poppets should open prior to return opening. Return gas
should be vented overboard. Damping back pressure is not available during the actuator
stroke, if the return is opened too early.
1122
JSSG-2009A
APPENDIX M
Tubing size and gas velocity should be selected to be consistent with design limits and to
control actuator rates. Actuation systems should operate at limited speeds and with sufficient
deceleration characteristics to prevent structural damage. Although actuator speed is often
controlled by restriction or flow regulation and snubbing, line size can be a factor. The
subsystem should operate within design limits which permit suitable control of actuator rates.
For example, stopping or snubbing a cylinder piston at full stroke can be a design problem.
The snubbing pressure of a pneumatic cylinder depends on the driving pressure and the time
available for back-pressure bleed off. Trouble arises if the back pressure can bleed away
before the damping function is complete. Use of the differential area for the effective output
force ensures proper damping and maintains a controlled pressure in the damping section.
Cylinders installed in such a system can be subjected to expansion forces if high leakage rates
occur across the piston seal.
Pneumatic compressor systems were used in some World War II USAF aircraft after the
development of an automatic gun charger and the development of an electric-motor-driven air
compressor unit. One of the early military applications was the gun charger for the B-25 medium
bomber. The B-29 and B-50 bombers used electric-motor-driven 1500-psi pneumatics to
operate bomb bay doors. On a bomb run, the doors could be opened in a fraction of the time
compared to electric system operation. Some advantages of pneumatic power are:
a. Energy is easily stored because of gas compressibility;
b. Operation is essentially independent of temperature;
c. Distribution lines are relatively small;
d. Fire hazard is negligible; and
e. Fast actuation.
Some concerns are:
a. Not practical for continuous operation; for example, air vehicle flight controls
b. Leakage
c. Moisture removal
d. Lubrication
e. Compressor output at altitude
f. Dieseling
g. Insufficient actuator column stiffness to resist flutter.
M.4.4.13 Pneumatic subsystem.
The capability of the pneumatic subsystem to provide for generation and storing, conditioning,
and distributing pneumatic power to the control and actuating devices dependent on pneumatic
power for normal, alternate, or emergency operation shall be verified incrementally by (TBS) .
1123
JSSG-2009A
APPENDIX M
Verification is required to ensure performance, interface, and functional requirements are met.
TBS: Verification should encompass planning, procedure preparation, and reporting; and
should be accomplished by inspection, analysis, demonstration, or test, or a combination of
these methods.
Operating performance should be shown by appropriate laboratory component and subsystem

tests, and applicable ground, taxi, and flight tests (using MIL-STD-5522 for guidance).
Component tests should be performed using applicable defense or contractor-prepared
specifications. Pass criteria is based on successfully meeting all test objectives. Exceptions
can be allowed where verification can be substantiated by valid comparisons to subsystems
previously qualified on other programs.
(TBD)
M.3.4.13.1 Gas.
The subsystem gas medium shall be (TBS ) .
The selection of the gas medium can be a critical item from the viewpoint of availability, cost,
servicing, and performance.
TBS should be filled in with the type of gas medium to be utilized within the subsystem. Air is
cheap and universally available.
Dry nitrogen may be preferred for stored-gas bottles because it is inert and generally available.
Helium may be preferred for stored gas in missiles because of its compressibility factor which
results in more energy at low temperatures (-65°F) than air or nitrogen.
Stored helium gas was selected for the Maverick missile. Analysis showed that helium was
superior to air or nitrogen because of the better compressibility factor which resulted in greater
energy at colder temperatures for a given stored gas volume. This fact was also demonstrated
in 1980 on a development missile which used stored gas to deploy control surfaces. The
control surfaces would not deploy at altitude with stored nitrogen gas, but did deploy when the
nitrogen was replaced with helium.
1124
JSSG-2009A
APPENDIX M
M.4.4.13.1 Gas.
Subsystem gas medium selection shall be verified by (TBS) .
Verification will ensure the gas medium within the system is the required gas.
TBS: The gas medium selected should be verified by test, analysis, or inspection, or a
combination of these.
(TBD)
M.3.4.13.2 Pressure.
Operating pressure shall be (TBS 1 ) psi at (TBS 2 ) F. Pressure transients during

subsystem operation shall not exceed (TBS 3 ) percent of operating pressure.
Control of pneumatic subsystem pressures at a specified temperature is needed to prevent

subsystem malfunctions and failures. Pressure selection affects availability, standardization,
and testing parameters.
TBS 1 should be filled in with the main subsystem operating pressure.
If a pressure reducer is used, the subsystem should be able to operate at the primary pressure
or have a pressure relief device to accommodate a pressure reducer malfunction.
TBS 2 should be filled in with the operational temperature.
TBS 3 should be filled in with a specific percentage of operating pressure, or taken from a table
which lists pressure values (reference legacy Military Specification MIL-P-5518).
Pressure transients exceeding 10 milliseconds should not exceed the proof pressure of the
subsystem.
(TBD)
1125
JSSG-2009A
APPENDIX M
M.4.4.13.2 Pressure.
Subsystem pressure requirements shall be verified by (TBS ) .
Verification will ensure that the pressure within the system is the required pressure.
TBS should be filled in with either analysis or test, or both.
Subsystem pressure characteristics are generally verified by analysis of design reports and
drawings, laboratory tests of components, and system tests.
Laboratory and flight tests should verify adequate pressure to meet operational and life
requirements when blowdown bottle systems are used.
(TBD)
M.3.4.13.3 Status indication.
A means shall be provided to indicate pneumatic power subsystem status.
Flight-station or maintenance personnel need to know the status and operating condition of the
pneumatic power subsystem(s) prior to flight, and to be made aware of the status of the
pneumatic power subsystem during flight. Status indication can provide alternate choices or
corrective actions to the aircrew or maintenance personnel.
This requirement should be in consonance with JSSG-2010, Crew Systems Joint Service
Specification Guide.
(TBD)
1126
JSSG-2009A
APPENDIX M
M.4.4.13.3 Status indication.
The means of indicating pneumatic subsystem status shall be verified by (TBS) .
Verification is to ensure that pneumatic status indications are adequate to meet operational
needs.
TBS should be filled in with analysis, inspection, and test.
(TBD)
M.3.4.13.4 Moisture content.
The pneumatic power subsystem shall operate with moisture content not to exceed (TBS ) .
Moisture content which exceeds the maximum allowed value leads to degraded subsystem
performance. Limiting the moisture content in the gas to a low value limits corrosion-induced
failures and ice formation.
TBS should be filled in with the grains of moisture per pound of dry air (specific humidity) that
the subsystem design will allow.
Drains should be placed at low points in the subsystem to drain accumulated water periodically.
Components should not be installed in low point(s) in the subsystem without adequate drainage
provisions.
If applicable, there should be means to remove entrained moisture from the pneumatic power
subsystem gas during flight, ground, and servicing operations.
Filter elements, where used, should be easily replaced.
Past practice has been to limit air discharged from dehydrators used in airborne-compressor-
charged systems to no more than 0.12 grains of moisture per pound of dry air (specific
1127
JSSG-2009A
APPENDIX M
humidity). A solenoid valve installed at a low point in a bomb bay door system froze due to
accumulated moisture and made the valve inoperable.
Experience has shown that maintenance personnel must be continuously aware of the
importance of keeping contamination out of pneumatic power subsystems. The maintenance
Technical Orders (T.O.s) should provide adequate instructions to prevent subsystem
contamination when the systems are opened for maintenance and inspections.
M.4.4.13.4 Moisture content.
The operation of the pneumatic power subsystem with the allowed moisture content shall be
verified by (TBS ) .
Moisture content which exceeds the maximum allowed value leads to degraded subsystem
performance and failure.
TBS should be filled in with test, or test and analysis.
(TBD)
1128
JSSG-2009A
APPENDIX M
M.5 PACKAGING
M.5.1 Packaging.
M.6 NOTES
not mandatory.)
M.6.1 Intended use.
The pneumatic subsystem descriptions in this appendix are intended for use in air vehicle
M.6.2 Acquisition requirements.

M.6.3 Component information
M.6.3.1 Clearance.
Clearance should be maintained between moving subsystem components and structure or other
components to ensure no possible combinations of temperature effects, airloads, wear, or
structural deflections can cause binding, rubbing, or jamming. There should also be adequate
clearance for component installation, removal, and maintenance. The intent is to prevent
binding, chafing, or jamming of components in static or operating modes. In addition, there are
minimum clearances necessary to accommodate removal and installation of components.
Component installation should have separation clearances which are maintained under all air
vehicle operating modes. There should be clearance for hand tools required to remove and
install components. There should be sufficient space to remove and install components. This
may require additional access panels and doors. Refer to SAE ARP994 for detailed guidance.
1129
JSSG-2009A
APPENDIX M
M.6.3.2 Actuators.
Actuator design and performance requirements should be defined in the contractor's

specification(s). Provision should be made for control of rates of operation for resisting,
assisting, and no load conditions. Actuators are usually nonstandard components with unique
requirements. The actuator performance, design, and verification requirements should be
established in accordance with MIL-STD-961.
The problem areas with linear actuators have been:

a. Fatigue, especially with aluminum parts
b. Rod end fitting backout
c. Structural deformation of attach point; also, bearing distortion
d. Rod end attachment cracking at thread relief
e. Rod seal leakage
f. Bore wear in aluminum barrels
g. Leakage through "faulty" chrome plating
h. Column buckling of piston rods.
General considerations in actuator design module:
a. Use of steel barrels
b. Use of generous radii (to avoid stress risers)
c. Use of rolled threads when practical
d. Provision of positive attachment and anti-rotation locking of the rod end. Ordinary jam
lockouts have not been sufficient.
M.6.3.3 Multiple control valves.
In subsystems which incorporate two or more directional control valves, provision should be
made to prevent the medium from being transferred inadvertently, at any possible valve setting,
from the cylinder ports of one valve into the cylinder ports of another valve. The control of the
air flow is required so that subsystem operation will not be affected by interflow between valves.
M.6.3.4 Fittings.
Straight-threaded fittings should be used. Unless specifically approved by the procuring activity,
no thread lubricants should be used on straight-threaded fittings. All nonstandard fittings should
require approval by the procuring activity. Standardization of fitting threads is essential.
Threads which conform to SAE AS8879 are preferred for high-stress applications but are more
costly to produce. Fitting threads in accordance with legacy Military Specification
MIL-S-7742 have proven satisfactory for many years. Defense-standard fittings should be used
to reduce the inventory of nonstandard fittings.
1130
JSSG-2009A
APPENDIX M
Only straight threads should be used for reconnectable fittings. The use of permanent-type
fitting connectors employing no screw threads requires procuring activity approval. In the late
1940s, the 37° cone "flared" fitting was the only tube fitting standard and required mechanical
flaring of the connecting tube. In the 1950s, the flareless fitting was made available as an
alternate standard because of its increased resistance to vibration. In the 1960s, the
introduction of higher strength tubing made the standard flared and flareless fitting inadequate,
because the harder tubing is difficult to flare, and also too hard for the flareless sleeve to
penetrate the tube surface. New fittings were introduced for attachment to the harder tubing.
This has created changes such as special tools and mechanical equipment to assemble the
fittings to the tubing. The procuring activity should either specify tube fittings or consider a trade
study.
Pipe-thread fittings tend to leak after repeated assembly and disassembly and were
discontinued for use in air vehicles. Permanently installed pipe-thread fittings were permitted as
plugs, but today there are other accepted methods for air vehicle component plugs. Use of
pipe-threaded plugs for external sealing of drilled passages can set up internal stresses in
component houses resulting in cracks.
Flared fitting sleeves of aluminum bronze are subject to stress corrosion cracking and are
prohibited for use.
Aluminum flared fittings should not be used with steel tubing in sizes smaller than -8 because of
the low relative yield strength of aluminum.
Aluminum fittings and aluminum tubing are not permitted in designated fire zones.
The use of free-machining steels such as American Iron and Steel Institute (AISI) Code 1137
and Code 1141 have caused problems because of marginal yield strength when subjected to
repeated fitting assembly.
M.6.3.5 Seals.
Packing and gasket materials should be compatible with the fluid medium and capable of
performing under the specified environment. Packing and gasket materials should have good
compatibility with the fluid medium so that their sealing performance and life are not
compromised in the specified environment. Aerospace Material Specification SAE AMS-P-5510
and MIL-P-83461 may be used as guides for materials compatible with the fluid medium.
Legacy Military Specification MIL-P-8564 may be used for guidance for pneumatic component
design. The Air Force Research Laboratory Materials & Manufacturing Directorate (AFRL/RX,
2977 P STREET, SUITE 1, WRIGHT-PATTERSON AFB OH 45433-7734 USA;
http://www.wpafb.af.mil/afrl/rx/) is one source for data on fluid-elastomer seal compatibility.
Allowable leakage is a function of subsystem needs and ground servicing criteria.
1131
JSSG-2009A
APPENDIX M
M.6.3.6 Tubing.
Tubing and tube connectors should have a subsystem durability life equal to or greater than the
life of the air vehicle. Because of the cost and downtime required for tubing replacement, tubing
and tubing connectors should have a subsystem life equivalent to the life of the air vehicle.
When new tubing material or tube fittings are proposed, endurance-limit tests should be
conducted. It is also recommended that SAE ARP994 be used for guidance.
Early tubing failures have occurred in areas of extreme vibration. Engine nacelle and pylon
areas can induce resonance which can fail tube supports and tubing. For example, in the
engine area of one type air vehicle, tubing failures occurred within 90 flight hours. The very
early failures were caused by a combination of resonant frequency, marginal strength loop
clamps, and tubing cross section which had excessive ovality (out-of-roundness at the tube
bend). Corrective action was to change from carbon-steel clamps to stainless-steel clamps, add
additional loop clamps, use some block clamps, and revise quality assurance procedures.
All pneumatic lines should be identified (reference legacy Military Standard MIL-STD-1247). For
maintenance purposes, the pneumatic lines should be identified (1) as pneumatic lines and
(2) for function; for example, landing gear down, flaps down, and so on. Identification is
required as often as necessary, to track the line function, particularly on lines entering and
emerging from closed compartments. Other unique requirements can be added.
Repair and replacement methods for tubing and fittings should be established. This information
should be included in appropriate technical manuals and technical orders (T.M.s and T.O.s). A
recommended procedure is required for repair and replacement of damaged sections of
pneumatic lines by maintenance personnel at organizational levels. It has been a standard
practice, when a factory-made replacement is not available, to make full tubing replacement
with 304 1/8 Hard tubing which is easier to form than the high-strength AM350 or 21-6-9 tubing
material. Partial tube replacement has been with 304 1/8 Hard tubing and Permaswage® fittings.
Titanium tubing repair may require special procedures.
M.6.3.7 Relative motion.
Means should be provided to accommodate relative motion. Relative motion between two
points is usually accommodated by:
a. Hose assemblies: Standard tetrafluoroethylene (TFE) hose assemblies are preferred to
rubber hose assemblies, especially when age limitations and high temperatures are a
factor. Proper routing of hoses is critical. Allow for flexibility without binding or crimping.
Do not use hose(s) under constant pneumatic pressure because of gas permeability with
time. Use SAE ARP994 as a guide. Rubber hose assemblies have leaked or failed
because of heat aging. Teflon hose should be used in higher temperature applications.
If rubber hose is used, it should not exceed the recommended temperature environment,
and should be inspected on a periodic basis. Hose assemblies, like rigid tubing, should
be installed for chafing resistance by making allowance for minimum clearance during
normal operation and structural deflection and vibration.
Chafe-resistant sleeves are available but should not be used as a substitute for good
installation practices.
1132
JSSG-2009A
APPENDIX M
b. Coiled tubing: Use SAE ARP584 as a guide. Coiled tubing has been used successfully
in commercial and military air vehicle installations. Coiled tubing has been used most
successfully in tube diameters of 3/8 inch or less.
c. Swivel joints: Use MIL-DTL-5513 as a guide. Swivel joint leakage has been a problem.
Nonplanar actuation (side loading on the swivel joint) is a contributing factor. The C-141
swivel joints were susceptible to dirt entering the seal cavity. Laboratory tests were
conducted on the swivel joints with dust excluders and the leakage problem was
significantly reduced.
M.6.3.8 Air compressors.
When an airborne compressor package(s) is used, general and specific requirements should be
defined in a Critical Item Development specification. The operating characteristics and
associated equipment for a compressor package must be defined in detail. Legacy Military
Specification MIL-C-6591 can be used for guidance for either an electric-motor-driven package,
or for a compressor (engine-driven or hydraulic-motor-driven). A compressor package may
include:
a Driven air compressor
b. Relief valve
c. Moisture separator
d. Chemical dehydrator
e. Check valve
f. Priority (or back-pressure valve)
g. Means for periodic draining of the moisture separator
h. Pressure switch and relay
i. Cooling means to prevent exceeding maximum operating temperature.
Experience has led to the following criteria:
a. The moisture separator should provide conditioned air to the reservoir which is relatively
moisture-free to prevent blocking of expansion lines by freezing. At rated discharge
pressure, air entering the inlet at sea level pressure, and a dewpoint temperature of
+85 F, the dewpoint of the discharge air should not exceed a specified maximum value
based on sea level pressure.
b. Automatically, at intervals specified in the air compressor package specification and at
shutdown, the condensate in the moisture separator should be purged to atmosphere.
During the purging process, there should be no backflow of air from down stream of the
moisture separator. The moisture separator should be provided with a heater that
operates concurrently with the air vehicle operation to prevent any remaining
condensate from freezing, and should be thermostatically controlled.
c. One or more blow-out disks should be incorporated as necessary to provide against
possible explosions within the compressor package.
1133
JSSG-2009A
APPENDIX M
d. Pressure switch contacts should be snap action and should be moisture sealed.
e. The compressor package should be lubricated from its own oil supply.
At altitude, there may be insufficient inlet air for compressor operation. Supercharging of
the compressor inlet may be necessary for adequate performance. Another problem at
altitude, or even at sea level, is adequate ram-air cooling flow. At one time, the F-84
package was located in the air vehicle wing root where ram-air cooling flow was
insufficient.
M.6.3.9 Air bottles.
When air bottles are used, the general and specific requirements, quality assurance provisions,
and preparation for delivery requirements should be defined in a Critical Item Development
specification. Air bottles are safety-critical items. Legacy Military Specifications MIL-P-5518
and MIL-R-8573 can be used as guidance. Unique characteristics can be added when
appropriate. Gas bottles should be located in an area where bottle failure will not result in
personnel exposure to fragmentation and will minimize structural damage.
Materials impact:
a. A helium bottle ruptured in a stored short-range attack missile (SRAM). Failure was
attributed to stress corrosion which may have been caused by cleaning agent(s) residue.
Room-temperature pressure was 7,700 psi; burst pressure, 24,000 psi; material was 18
Ni 200 maraging steel.
b. F-102 and F-106 filament-wound plastic pressure bottle explosions occurred at 2,100 psi
during filling on the ground. Maximum allowable pressure was 3,100 psi. The bottle(s)
increased considerably in circumference when pressurized. Loss of strength occurred
after repeated proof pressure tests (circa 1959).
c. A 5,000-psi nitrogen storage bottle, of fiberglass S-Glass-epoxy composite structure,
ruptured and caused major air vehicle damage. The bottle had been pressurized for
more than eight years. Failure was attributed to the phenomenon known as "stress
rupture." Stress rupture of S-glass has been extensively investigated by Dr. T.T. Chiao
and associates of the Lawrence Livermore National Laboratory. Empirical data shows
an inverse relationship between the safe life of S-glass/epoxy composite structures and
the ratio of loading stress to ultimate stress of the composite structure. A discussion of
the stress rupture phenomenon in composites is presented in "Stress-Rupture of
S-Glass/Epoxy Multi-Filament Strands" published in the Journal of Composite Materials.
Technical Report AFWAL-TR-84-4104 contains tabular life data as a function of the fiber
stress, quantile level, and confidence interval.
Consider the following points in air bottle design and installation:
a. Use moisture bleed valves in accordance with MIL-DTL-7891. Fittings designed to the
since-cancelled Air Force-Navy Aeronautical Standard AN814 resulted in "O"-ring
blowout during bleeding.
b. Proper bottle positioning and air vehicle access for water purging are required.
c. Avoid allowing water to spray on electronic equipment.
1134
JSSG-2009A
APPENDIX M
d. Installations requiring moisture pick-up tubes should have a flex tube long enough to
reach the lowest point of bottle. Use a plastic end to avoid bottle interior coating
damage.
e. Do not drop sharp objects on fiberglass bottles.
f. Problems have occurred with the internal coating inside air bottles flaking off and then
obstructing the control valve. Studies showed the problem was caused by rapid ground
charging of the air bottles. The bottles were being charged on the ground with an
external source in approximately one second. The temperature inside the bottle would
be over 400°F which would cause the internal coating to flake off. The solution was to
charge the bottles more slowly (approximately 1 minute for 0 to 3000 psi).
M.6.3.10 Electric motors.
Electric-motor-driven equipment should be capable of continuous operation. Other

requirements for electric-motor-driven equipment such as test duty cycle(s), operational
temperature range, rated voltage, altitude, explosion proofing and, automatic control versus
manual control should be defined. Legacy Military Specifications MIL-M-7969 and MIL-M-8609
can be used as guides for preparation of electric motor design requirements. Electric motor-
driven equipment has been subject to early failures when the electric motors were rated for
intermittent duty. For reliability and long life, it is necessary to have electric motors with
continuous-duty capability.
M.6.3.11 Snubbing.
The pneumatically-powered B-29 bomb bay doors departed the air vehicle during a ground
demonstration because adequate snubbing was not provided to slow the piston actuator after
full stroke. This was corrected by restricting the air on the back side of the actuators to provide
a snubbing air cushion.
Canopy cylinder failures have been caused by air loads stalling the motion of the actuator
during the closing cycle allowing the snubbing pressure to be lost. The original canopy cylinder
design did not have differential area design. Canopies have also been jettisoned because of
loss of damping air on the retract side of piston during the canopy opening cycle.
M.6.3.12 Chemical dryers.
Chemical dryers should be large enough to meet specifications for moisture removal. They
should not require too frequent cartridge removal under the most adverse conditions. Use of
the pneumatic power subsystem, such as for normal or emergency functions, is a determining
factor. Drier housing and cartridge housing materials should resist corrosion (e.g., plastic shell
cartridge). Dissimilar metals should be avoided because of electrolytic action. Use built-in
filters to prevent desiccant powder migration. The unit should be rigidly mounted to facilitate
servicing. Although molecular-sieve is frequently used in air vehicle over silica-gel as a
desiccant because of its greater moisture holding ability, it can attack aluminum in the presence
of water. Therefore, maximum corrosion protection is required. Visual moisture indicators
would simplify cartridge removal time and save on cartridges.
1135
JSSG-2009A
APPENDIX M
Chemical dryer problems:

a. Cracked housing. Fix: material change.
b. Corrosion throughout unit. Fix: plastic cartridge. Also, consider sealing cartridge in
housing at inlet end instead of outlet end. This will allow cartridge housing to be
pressurized with dry air to avoid corrosion.
c. Desiccant particle migration. Fix: better cartridge filter. Porous bronze filter allowed
desiccant migration.
d. Rigidity of mounting inadequate for servicing. Fix: Rigid mount capable of withstanding
wrenching torques.
M.6.3.13 Filters.
At least 25-micron absolute filters should be provided in all systems. These filters should be
used to filter all the gas supply in the subsystem. Reservoir filters should be of the replaceable
element type in refillable or rechargeable systems. The total gas supply should be filtered
through a 25-micron absolute filter before use in the subsystem. In some subsystem(s) finer
filtration, less than 25-micron absolute may be required.
M.6.4 Acronyms.
SRAM Short-Range Attack Missile
M.6.5 Subject term (key word) listing.
Fittings
Gas
Moisture
Pressure
Seals
Snubbing
Tubing
M.6.6 Responsible engineering office.
1136
JSSG-2009A
APPENDIX M
M.6.7 Changes from previous issue.
1137
JSSG-2009A
Custodians: Preparing activity:

Navy – AS Air Force – 11
Air Force – 11 (Project 15GP-2009-002)
Review activity:
Air Force – 99
NOTE: The activities listed above were interested in this document as of the date of this
document. Since organizations and responsibilities can change, you should verify the currency
of the information above using the ASSIST Online database at https://assist.dla.mil.
1138

JSSG 2009a

Uploaded by

Copyright:

Available Formats

JSSG 2009a

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

JSSG 2009a

Uploaded by

Copyright:

Available Formats

Downloaded from http://www.everyspec.

AIR VEHICLE SUBSYSTEMS

This specification guide is for guidance only.

Comments, suggestions, or questions on this document should be addressed to

AMSC N/A FSC 15GP

JOINT SERVICE SPECIFICATION GUIDE (JSSG) RELEASE NOTE

This specification guide is predicated on a performance-based business environment

The following direction and guidance is applicable to this document:

2. The complete set of JSSGs establish a common framework to be used by Government-

3.3 DESIGN AND CONSTRUCTION ....................................................................... 8

4.2.7.4.4 DAMAGE TOLERANCE ................................................................................... 13

6.4 ACRONYMS ..................................................................................................... 23

JOINT SERVICE SPECIFICATION GUIDE

AIR VEHICLE SUBSYSTEMS

This specification establishes the item definition, performance, operating characteristics,

1.5 Environmental impact.

Materials, processes, and environmental control equipment necessary to meet these

The contractor will conduct an environmental analysis of air vehicle subsystems.

1.6 Responsible engineering office.

2.2 Government documents

2.2.1 Specifications, standards, and handbooks.

DEPARTMENT OF DEFENSE SPECIFICATIONS

DEPARTMENT OF DEFENSE STANDARD

(Copies of these documents are available online at http://quicksearch.dla.mil or from the

TABLE I. Subsystems functions.

3.1.1 Functional diagram.

3.1.2 Interface drawing.

3.2.2 Computer resources.

3.2.3.1 Electromagnetic emissions.

Electromagnetic emissions shall be in accordance with (TBS) .

3.2.7 Integrity and environment

3.2.7.1 Service life and usage

3.2.7.1.1 Design service life.

a. Natural environment: (TBS 1) .

3.2.7.3 Crash worthiness.

Subsystems shall be in accordance with JSSG-2001, Air Vehicle “Crash worthiness”.

3.2.7.4 Materials and processes.

3.2.7.4.1 Coatings and finishes.

3.2.7.4.2 Prohibited materials and processes.

The following materials and processes shall be prohibited:

3.2.7.4.4 Damage tolerance.

3.2.7.4.4.1 Safety and mission critical functions.

3.2.7.4.4.2 Damage tolerant - fail safe evident subsystems and components.

3.2.7.4.4.3 Mechanical component damage tolerance.

Component strength shall be (TBS) .

3.2.7.6 Durability and economic life.

3.2.7.6.2 High cycle fatigue (HCF).

3.2.7.6.3 Low cycle fatigue (LCF).

3.2.7.6.4 Dielectric materials.

3.2.9 Integrated diagnostics.

3.2.9.1 Fault detection and isolation.

3.2.10 Nameplate and product marking.

3.3 Design and construction.

Design and construction shall be in accordance with JSSG-2001.

3.3.3.1 Safety criteria.

Subsystem safety criteria shall be defined.

3.3.3.2 Foreign object damage (FOD).

Subsystem tolerance of foreign object damage shall be defined.

3.3.3.3 Software safety.