CS-25 Amendment 28 SUBPART C STRUCTURE

GENERAL

SUBPART C STRUCTURE
GENERAL

CS 25.301 Loads
(See AMC 25.301)
(a) Strength requirements are specified in terms of limit loads (the maximum loads to be expected
in service) and ultimate loads (limit loads multiplied by prescribed factors of safety). Unless
otherwise provided, prescribed loads are limit loads.
(b) Unless otherwise provided the specified air, ground, and water loads must be placed in
equilibrium with inertia forces, considering each item of mass in the aeroplane. These loads
must be distributed to conservatively approximate or closely represent actual conditions. (See
AMC No. 1 to CS 25.301(b).) Methods used to determine load intensities and distribution must
be validated by flight load measurement unless the methods used for determining those loading
conditions are shown to be reliable. (See AMC No. 2 to CS 25.301(b).)
(c) If deflections under load would significantly change the distribution of external or internal loads,
this redistribution must be taken into account.
[Amdt 25/1]
[Amdt 25/18]

AMC No. 1 to 25.301(b) Loads

The engine and its mounting structure are to be stressed to the loading cases for the aeroplane as a
whole.
[Amdt 25/1]

AMC No. 2 to 25.301(b) Flight Load Validation

1. PURPOSE
This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance
with the provisions of CS-25 related to the validation, by flight load measurements, of the
methods used for determination of flight load intensities and distributions, for large aeroplanes.
2. RELATED CERTIFICATIONS SPECIFICATIONS
CS 25.301(b)
CS 25.459
3. BACKGROUND
(a) CS-25 stipulates a number of load conditions, such as flight loads, ground loads,
pressurisation loads, inertia loads and engine/APU loads. CS 25.301 requires methods
used to determine load intensities and distributions to be validated by flight load
measurements unless the methods used for determining those loading conditions are
shown to be reliable. Although this applies to all load conditions of CS-25, the scope of
this AMC is limited to flight loads.

Annex to ED Decision 2023/021/R Page 184 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

(b) The sizing of the structure of the aircraft generally involves a number of steps and
requires detailed knowledge of air loads, mass, stiffness, damping, flight control system
characteristics, etc. Each of these steps and items may involve its own validation. The
scope of this AMC however is limited to validation of methods used for determination of
loads intensities and distributions by flight load measurements.
(c) By reference to vali CS 25.301(b) and this AMC are intended to
convey a validation of the complete package of elements involved in the accurate
representation of loads, including input data and analytical process. The aim is to
demonstrate that the complete package delivers reliable or conservative calculated loads
for scenarios relevant to CS-25 flight loads requirements.
(d) Some measurements may complement (or sometimes even replace) the results from
theoretical methods and models. Some flight loads development methods such as those
used to develop buffeting loads have very little theoretical foundation, or are methods
based directly on flight loads measurements extrapolated to represent limit conditions.
4. NEED FOR AND EXTENT OF FLIGHT LOAD MEASUREMENTS
4.1. General
(a) The need for and extent of the flight load measurements has to be discussed and
agreed between the Agency and Applicant on a case by case basis. Such an
assessment should be based on:
(i) a comparison of the design features of the aeroplane under investigation
with previously developed (by the Applicant) and approved aeroplanes. New
or significantly different design features should be identified and assessed.
(ii)
distributions derived from analytical methods and/or wind tunnel tests. This
experience should have been accumulated on previously developed (by the
Applicant) and approved types and models of aeroplanes. The validation
should have been by a flight load measurement program that was conducted
by the Applicant and found acceptable to the Agency for showing
compliance.
(iii) the sensitivity to parametric variation and continued applicability of the
analytical methods and/or wind tunnel test data.
(b) Products requiring a new type certificate will in general require flight-test
validation of flight loads methods unless the Applicant can demonstrate to the
Agency that this is unnecessary.
If the configuration under investigation is a similar configuration and size as a
previously developed and approved design, the use of analytical methods, such as
computational fluid dynamics validated on wind tunnel test results and supported
by previous load validation flight test experience, may be sufficient to determine
flight loads without further flight test validation.
(c) Applicants who are making a change to a Type Certificated airplane, but who do
not have access to the Type certification flight loads substantiation for that
airplane, will be required to develop flight loads analyses, as necessary, to
substantiate the change.
In general, the loads analyses will require validation and may require flight test
loads measurements, as specified in this AMC.

Annex to ED Decision 2023/021/R Page 185 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

(d) The Applicant is encouraged to submit supporting data or test plans for
demonstrating the reliability of the flight loads methods early in the certification
planning process.
4.2. New or significantly different design features.
Examples of new or significantly different design features include, but are not limited to:
Wing mounted versus fuselage mounted engines;
Two versus three or more engines;
Low versus high wing;
Conventional versus T-tail empennage;
First use of significant sweep;
Significant expansion of flight envelope;
Addition of winglets;
Significant modification of control surface configuration;
Significant differences in airfoil shape, size (span, area);
Significant changes in high lift configurations;
Significant changes in power plant installation/configuration;
Large change in the size of the aeroplane.
4.3. Other considerations
(a) Notwithstanding the similarity of the aeroplane or previous load validation flight
test experience of the Applicant, the local loads on the following elements are
typically unreliably predicted and may require a measurement during flight tests:
Loads on high lift devices;
Hinge moments on control surfaces;
Loads on the empennage due to buffeting;
Loads on any unusual device.
(b) For non-deterministic loading conditions, such as stall buffet, the applicant should
compile a sufficient number of applicable flight loads measurements to develop a
reliable method to predict the appropriate design load.
5. FLIGHT LOAD MEASUREMENTS
5.1. Measurements.
Flight load measurements (for example, through application of strain gauges, pressure
belts, accelerometers) may include:
Pressures / air loads /net shear, bending and torque on primary aerodynamic
surfaces;
Flight mechanics parameters necessary to correlate the analytical model with flight
test results;
High lift devices loads and positions;
Primary control surface hinge moments and positions;

Annex to ED Decision 2023/021/R Page 186 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

Unsymmetric loads on the empennage (due to roll/yaw manoeuvres and buffeting);

Local strains or response measurements in cases where load calculations or
measurements are indeterminate or unreliable.
5.2. Variation of parameters.
The test points for the flight loads measurements should consider the variation of the
main parameters affecting the loads under validation. Examples of these parameters
include: load factor, speeds, altitude, aircraft c.g., weight and inertia, power settings
(thrust, for wing mounted engines), fuel loading, speed brake settings, flap settings and
gear conditions (up/down) within the design limits of the aeroplane. The range of
variation of these parameters must be sufficient to allow the extrapolation to the design
loads conditions. In general, the flight test conditions need not exceed approximately
80% of limit load.
5.3. Conditions.
In the conduct of flight load measurements, conditions used to obtain flight loads may
include:
Pitch manoeuvres including wind-up turns, pull-ups and push-downs (e.g. for wing
and horizontal stabiliser manoeuvring loads);
Stall entry or buffet onset boundary conditions (e.g. for horizontal stabiliser buffet
loads);
Yaw manoeuvres including rudder inputs and steady sideslips;
Roll manoeuvres.
Some flight load conditions are difficult to validate by flight load measurements, simply
because the required input (e.g. gust velocity) cannot be accurately controlled or
generated. Therefore, these type of conditions need not be flight tested. Also, in general,
failures, malfunctions or adverse conditions are not subject to flight tests for the purpose
of flight loads validation.
5.4. Load alleviation.
When credit has been taken for an active load alleviation function by a particular control
system, the effectiveness of this function should be demonstrated as far as practicable
by an appropriate flight test program.
6. RESULTS OF FLIGHT LOAD MEASUREMENTS
6.1. Comparison / Correlation.
Flight loads are not directly measured, but are determined through correlation with
measured strains, pressures or accelerations. The load intensities and distributions
derived from flight testing should be compared with those obtained from analytical
methods. The uncertainties in both the flight testing measurements and subsequent
correlation should be carefully considered and compared with the inherent assumptions
and capabilities of the process used in analytic derivation of flight loads. Since in most
cases the flight test points are not the limit design load conditions, new analytical load
cases need to be generated to match the actual flight test data points.
6.2. Quality of measurements.
Factors which can affect the uncertainty of flight loads resulting from calibrated strain
gauges include the effects of temperature, structural non-linearities, establishment of

Annex to ED Decision 2023/021/R Page 187 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

flight/ground zero reference, and large local loads, such as those resulting from the
propulsion system installation, landing gear, flap tracks or actuators. The static or
dynamic nature of the loading can also affect both strain gauge and pressure
measurements.
6.3. Quality of correlation.
A given correlation can provide a more or less reliable estimate of the actual loading
condition depending on the "static" or "flexible dynamic" character of the loading action,
or on the presence and level of large local loads. The quality of the achieved correlation
depends also on the skills and experience of the Applicant in the choice of strain gauge
locations and conduct of the calibration test programme.
Useful guidance on the calibration and selection of strain gauge installations in aircraft
structures for flight loads measurements can be found, but not exclusively, in the
following references:
1. Skopinski, T.H., William S. Aiken, Jr., and Wilbur B. Huston,
-Gage Installations in Aircraft Structures for Measurement of

2.
597 (NASA-13445), October 1994.
6.4. Outcome of comparison / correlation.
Whatever the degree of correlation obtained, the Applicant is expected to be able to
justify the elements of the correlation process, including the effects of extrapolation of
the actual test conditions to the design load conditions.
If the correlation is poor, and especially if the analysis underpredicts the loads, then the
Applicant should review and assess all of the components of the analysis, rather than
applying blanket correction factors.
For example:
(a) If the level of discrepancy varies with the Mach number of the condition, then the
Mach corrections need to be evaluated and amended.
(b) If conditions with speed brakes extended show poorer correlation than clean wing,
then the speed brake aerodynamic derivatives and/or spanwise distribution need
to be evaluated and amended.
[Amdt 25/1]

CS 25.302 Interaction of systems and structures

For aeroplanes equipped with systems that affect structural performance, either directly or as a result
of a failure or malfunction, the influence of these systems and their failure conditions must be taken
into account when showing compliance with the requirements of Subparts C and D. Appendix K of CS-
25 must be used to evaluate the structural performance of aeroplanes equipped with these systems.
[Amdt 25/1]

Annex to ED Decision 2023/021/R Page 188 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

CS 25.303 Factor of safety

Unless otherwise specified, a factor of safety of 1·5 must be applied to the prescribed limit load which
are considered external loads on the structure. When loading condition is prescribed in terms of
ultimate loads, a factor of safety need not be applied unless otherwise specified.

CS 25.305 Strength and deformation

(a) The structure must be able to support limit loads without detrimental permanent deformation.
At any load up to limit loads, the deformation may not interfere with safe operation.
(b) The structure must be able to support ultimate loads without failure for at least 3 seconds.
However, when proof of strength is shown by dynamic tests simulating actual load conditions,
the 3-second limit does not apply. Static tests conducted to ultimate load must include the
ultimate deflections and ultimate deformation induced by the loading. When analytical
methods are used to show compliance with the ultimate load strength requirements, it must
be shown that
(1) The effects of deformation are not significant;
(2) The deformations involved are fully accounted for in the analysis; or
(3) The methods and assumptions used are sufficient to cover the effects of these
deformations.
(c) Where structural flexibility is such that any rate of load application likely to occur in the
operating conditions might produce transient stresses appreciably higher than those
corresponding to static loads, the effects of this rate of application must be considered.
(d) Reserved
(e) The aeroplane must be designed to withstand any vibration and buffeting that might occur in
any likely operating condition up to VD/MD, including stall and probable inadvertent excursions
beyond the boundaries of the buffet onset envelope. This must be shown by analysis, flight
tests, or other tests found necessary by the Agency.
(f) Unless shown to be extremely improbable, the aeroplane must be designed to withstand any
forced structural vibration resulting from any failure, malfunction or adverse condition in the
flight control system. These loads must be treated in accordance with the requirements of
CS 25.302.
[Amdt 25/1]

CS 25.307 Proof of structure

(See AMC 25.307)
(a) Compliance with the strength and deformation requirements of this Subpart must be shown for
each critical loading condition. Structural analysis may be used only if the structure conforms to
that for which experience has shown this method to be reliable. In other cases, substantiating
tests must be made to load levels that are sufficient to verify structural behaviour up to loads
specified in CS 25.305.
(b) Reserved
(c) Reserved

Annex to ED Decision 2023/021/R Page 189 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

(d) When static or dynamic tests are used to show compliance with the requirements of
CS 25.305(b) for flight structures, appropriate material correction factors must be applied to
the test results, unless the structure, or part thereof, being tested has features such that a
number of elements contribute to the total strength of the structure and the failure of one
element results in the redistribution of the load through alternate load paths.
[Amdt 25/1]

AMC 25.307 Proof of structure

1. Purpose
This AMC establishes methods of compliance with CS 25.307, which specifies the requirements
for Proof of Structure.
2. Related Certification Specifications
CS 25.303
CS 25.305
CS 25.651
3. Definitions
3.1. Detail. A structural element of a more complex structural member (e.g. joints, splices,
stringers, stringer run-outs, or access holes).
3.2. Sub Component. A major three-dimensional structure which can provide complete
structural representation of a section of the full structure (e.g., stub-box, section of a
spar, wing panel, wing rib, body panel, or frames).
3.3. Component. A major section of the airframe structure (e.g., wing, body, fin, horizontal
stabiliser) which can be tested as a complete unit to qualify the structure.
3.4. Full Scale. Dimensions of test article are the same as design; fully representative test
specimen (not necessarily complete airframe).
3.5. New Structure. Structure for which behaviour is not adequately predicted by analysis
supported by previous test evidence. Structure that utilises significantly different
structural design concepts such as details, geometry, structural arrangements, and load
paths or materials from previously tested designs.
3.6. Similar New Structure. Structure that utilises similar or comparable structural design
concepts such as details, geometry, structural arrangements, and load paths concepts
and materials to an existing tested design.
3.7. Derivative/Similar Structure. Structure that uses structural design concepts such as
details, geometry, structural arrangements, and load paths, stress levels and materials
that are nearly identical to those on which the analytical methods have been validated.
3.8. Previous Test Evidence. Testing of the original structure that is sufficient to verify
structural behaviour in accordance with CS 25.305.
4. Introduction
As required by subparagraph (a) of CS 25.307, the structure must be shown to comply with the
strength and deformation requirements of Subpart C of CS-25. This means that the structure
must:

Annex to ED Decision 2023/021/R Page 190 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

(a) be able to support limit loads without detrimental permanent deformation, and:
(b) be able to support ultimate loads without failure.
This implies the need of a comprehensive assessment of the external loads (addressed by
CS 25.301), the resulting internal strains and stresses, and the structural allowables.
CS 25.307 requires compliance for each critical loading condition. Compliance can be shown by
analysis supported by previous test evidence, analysis supported by new test evidence or by
test only. As compliance by test only is impractical in most cases, a large portion of the
substantiating data will be based on analysis.
There are a number of standard engineering methods and formulas which are known to
produce acceptable, often conservative results especially for structures where load paths are
well defined. Those standard methods and formulas, applied with a good understanding of their
limitations, are considered reliable analyses when showing compliance with CS 25.307.
Conservative assumptions may be considered in assessing whether or not an analysis may be
accepted without test substantiation.
The application of methods such as Finite Element Method or engineering formulas to complex
structures in modern aircraft is considered reliable only when validated by full scale tests
(ground and/or flight tests). Experience relevant to the product in the utilisation of such
methods should be considered.
5. Classification of structure
(a) The structure of the product should be classified into one of the following three
categories:
New Structure
Similar New Structure
Derivative/Similar Structure
(b) Justifications should be provided for classifications other than New Structure. Elements
that should be considered are:
(i) The accuracy/conservatism of the analytical methods, and
(ii) Comparison of the structure under investigation with previously tested structure.
Considerations should include, but are not limited to the following:
external loads (bending moment, shear, torque , etc.);
internal loads (strains, stresses, etc.);
structural design concepts such as details, geometry, structural arrangements, load
paths;
materials;
test experience (load levels achieved, lessons learned);
deflections;
deformations;
extent of extrapolation from test stress levels.
6. Need and Extent of Testing

Annex to ED Decision 2023/021/R Page 191 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

The following factors should be considered in deciding the need for and the extent of testing
including the load levels to be achieved:
(a) The classification of the structure (as above);
(b) The consequence of failure of the structure in terms of the overall integrity of the
aeroplane;
(c) The consequence of the failure of interior items of mass and the supporting structure to
the safety of the occupants.
Relevant service experience may be included in this evaluation.
7. Certification Approaches
The following certification approaches may be selected:
(a) Analysis, supported by new strength testing of the structure to limit and ultimate load.
This is typically the case for New Structure.
Substantiation of the strength and deformation requirements up to limit and ultimate
loads normally requires testing of sub-components, full scale components or full scale
tests of assembled components (such as a nearly complete airframe). The entire test
program should be considered in detail to assure the requirements for strength and
deformation can be met up to limit load levels as well as ultimate load levels.
Sufficient limit load test conditions should be performed to verify that the structure
meets the deformation requirements of CS 25.305(a) and to provide validation of internal
load distribution and analysis predictions for all critical loading conditions.
Because ultimate load tests often result in significant permanent deformation, choices
will have to be made with respect to the load conditions applied. This is usually based on
the number of test specimens available, the analytical static strength margins of safety
of the structure and the range of supporting detail or sub-component tests. An envelope
approach may be taken, where a combination of different load cases is applied, each one
critical for a different section of the structure.
These limit and ultimate load tests may be supported by detail and sub-component tests
that verify the design allowables (tension, shear, compression) of the structure and often
provide some degree of validation for ultimate strength.
(b) Analysis validated by previous test evidence and supported with additional limited
testing. This is typically the case for Similar New Structure.
The extent of additional limited testing (number of specimens, load levels, etc.) will
depend upon the degree of change, relative to the elements of paragraphs 5(b)(i) and (ii).
For example, if the changes to an existing design and analysis necessitate extensive
changes to an existing test-validated finite element model (e.g. different rib spacing)
additional testing may be needed. Previous test evidence can be relied upon whenever
practical.
These additional limited tests may be further supported by detail and sub-component
tests that verify the design allowables (tension, shear, compression) of the structure and
often provide some degree of validation for ultimate strength.
(c) Analysis, supported by previous test evidence. This is typically the case for Derivative/
Similar Structure.

Annex to ED Decision 2023/021/R Page 192 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

Justification should be provided for this approach by demonstrating how the previous
static test evidence validates the analysis and supports showing compliance for the
structure under investigation. Elements that need to be considered are those defined in
paragraphs 5(b)(i) and (ii).
For example, if the changes to the existing design and test-validated analysis are
evaluated to assure they are relatively minor and the effects of the changes are well
understood, the original tests may provide sufficient validation of the analysis and further
testing may not be necessary. For example, if a weight increase results in higher loads
along with a corresponding increase in some of the element thickness and fastener sizes,
and materials and geometry (overall configuration, spacing of structural members, etc.)
remain generally the same, the revised analysis could be considered reliable based on the
previous validation.
(d) Test only.
Sometimes no reliable analytical method exists, and testing must be used to show
compliance with the strength and deformation requirements. In other cases it may be
elected to show compliance solely by tests even if there are acceptable analytical
methods. In either case, testing by itself can be used to show compliance with the
strength and deformation requirements of CS-25 Subpart C. In such cases, the test load
conditions should be selected to assure all critical design loads are encompassed.
If tests only are used to show compliance with the strength and deformation
requirements for single load path structure which carries flight loads (including
pressurisation loads), the test loads must be increased to account for variability in
material properties, as required by CS 25.307(d). In lieu of a rational analysis, for metallic
materials, a factor of 1.15 applied to the limit and ultimate flight loads may be used. If
the structure has multiple load paths, no material correction factor is required.
8. Interpretation of Data
The interpretation of the substantiation analysis and test data requires an extensive review of:
the representativeness of the loading ;
the instrumentation data ;
comparisons with analytical methods ;
representativeness of the test article(s) ;
test set-up (fixture, load introductions) ;
load levels and conditions tested ;
test results.
Testing is used to validate analytical methods except when showing compliance by test only. If
the test results do not correlate with the analysis, the reasons should be identified and
appropriate action taken. This should be accomplished whether or not a test article fails below
ultimate load.
Should a failure occur below ultimate load, an investigation should be conducted for the
product to reveal the cause of this failure. This investigation should include a review of the test
specimen and loads, analytical loads, and the structural analysis. This may lead to adjustment
in analysis/modelling techniques and/or part redesign and may result in the need for additional

Annex to ED Decision 2023/021/R Page 193 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GENERAL

testing. The need for additional testing to ensure ultimate load capability, depends on the
degree to which the failure is understood and the analysis can be validated by the test.
[Amdt 25/1]

Annex to ED Decision 2023/021/R Page 194 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT LOADS

FLIGHT LOADS

CS 25.321 General
(a) Flight load factors represent the ratio of the aerodynamic force component (acting normal to
the assumed longitudinal axis of the aeroplane) to the weight of the aeroplane. A positive load
factor is one in which the aerodynamic force acts upward with respect to the aeroplane.
(b) Considering compressibility effects at each speed, compliance with the flight load requirements
of this Subpart must be shown
(1) At each critical altitude within the range of altitudes selected by the applicant;
(2) At each weight from the design minimum weight to the design maximum weight
appropriate to each particular flight load condition; and
(3) For each required altitude and weight, for any practicable distribution of disposable load
within the operating limitations recorded in the Aeroplane Flight Manual.
(c) Enough points on and within the boundaries of the design envelope must be investigated to
ensure that the maximum load for each part of the aeroplane structure is obtained.
(d) The significant forces acting on the aeroplane must be placed in equilibrium in a rational or
conservative manner. The linear inertia forces must be considered in equilibrium with the thrust
and all aerodynamic loads, while the angular (pitching) inertia forces must be considered in
equilibrium with thrust and all aerodynamic moments, including moments due to loads on
components such as tail surfaces and nacelles. Critical thrust values in the range from zero to
maximum continuous thrust must be considered.

Annex to ED Decision 2023/021/R Page 195 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

FLIGHT MANOEUVRE AND GUST CONDITIONS

CS 25.331 Symmetric manoeuvring conditions

(See AMC 25.331)
(a) Procedure. For the analysis of the manoeuvring flight conditions specified in sub-paragraphs (b)
and (c) of this paragraph, the following provisions apply:
(1) Where sudden displacement of a control is specified, the assumed rate of control surface
displacement may not be less than the rate that could be applied by the pilot through the
control system.
(2) In determining elevator angles and chordwise load distribution in the manoeuvring
conditions of sub-paragraphs (b) and (c) of this paragraph, the effect of corresponding
pitching velocities must be taken into account. The in-trim and out-of-trim flight
conditions specified in CS 25.255 must be considered.
(b) Manoeuvring balanced conditions. Assuming the aeroplane to be in equilibrium with zero
pitching acceleration, the manoeuvring conditions A through I on the manoeuvring envelope in
CS 25.333(b) must be investigated.
(c) Manoeuvring pitching conditions. The following conditions must be investigated:
(1) Maximum pitch control displacement at VA. The aeroplane is assumed to be flying in
steady level flight (point A1, CS 25.333(b)) and the cockpit pitch control is suddenly
moved to obtain extreme nose up pitching acceleration. In defining the tail load, the
response of the aeroplane must be taken into account. Aeroplane loads which occur
subsequent to the time when normal acceleration at the c.g. exceeds the positive limit
manoeuvring load factor (at point A2 in CS 25.333(b)), or the resulting tailplane normal
load reaches its maximum, whichever occurs first, need not be considered (See AMC
25.331(c)(1)).
(2) Checked manoeuvre between VA and VD. Nose up checked pitching manoeuvres must be
analysed in which the positive limit load factor prescribed in CS 25.337 is achieved. As a
separate condition, nose down checked pitching manoeuvres must be analysed in which
a limit load factor of 0 is achieved. In defining the aeroplane loads the cockpit pitch
control motions described in sub-paragraphs (i), (ii), (iii) and (iv) of this paragraph must
be used:
(See AMC 25.331(c)(2))
(i) The aeroplane is assumed to be flying in steady level flight at any speed between
VA and VD and the cockpit pitch control is moved in accordance with the following
formula:

where:
the maximum available displacement of the cockpit pitch control in the
initial direction, as limited by the control system stops, control surface stops,
or by pilot effort in accordance with CS 25.397(b);

Annex to ED Decision 2023/021/R Page 196 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

truncated at the maximum available displacement of the cockpit pitch

control as limited by the control system stops, control surface stops, or by
pilot effort in accordance with CS 25.397(b);
tmax
the circular frequency (radians/second) of the control deflection taken equal
to the undamped natural frequency of the short period rigid mode of the
aeroplane, with active control system effects included where appropriate;
but not less than:

where:
V= the speed of the aeroplane at entry to the manoeuvre.
VA = the design manoeuvring speed prescribed in CS 25.335(c)
(ii) For nose-up pitching manoeuvres the complete cockpit pitch control displacement
history may be scaled down in amplitude to the extent just necessary to ensure
that the positive limit load factor prescribed in CS 25.337 is not exceeded. For nose-
down pitching manoeuvres the complete cockpit control displacement history may
be scaled down in amplitude to the extent just necessary to ensure that the normal
acceleration at the c.g. does not go below 0g.
(iii) In addition, for cases where the aeroplane response to the specified cockpit pitch
control motion does not achieve the prescribed limit load factors then the
following cockpit pitch control motion must be used:

where:
t1 = /2
t2 = t 1
tmax = t2
the minimum period of time necessary to allow the prescribed limit load
factor to be achieved in the initial direction, but it need not exceed five
seconds (see figure below).

Annex to ED Decision 2023/021/R Page 197 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(iv) In cases where the cockpit pitch control motion may be affected by inputs from
systems (for example, by a stick pusher that can operate at high load factor as well
as at 1g) then the effects of those systems must be taken into account.
(v) Aeroplane loads that occur beyond the following times need not be considered:
(A) For the nose-up pitching manoeuvre, the time at which the normal
acceleration at the c.g. goes below 0g;
(B) For the nose-down pitching manoeuvre, the time at which the normal
acceleration at the c.g. goes above the positive limit load factor prescribed
in CS 25.337;
(C) tmax.
[Amdt 25/13]
[Amdt 25/18]

AMC 25.331(c)(1) Maximum pitch control displacement at VA

The physical limitations of the aircraft from the cockpit pitch control device to the control surface
deflection, such as control stops position, maximum power and displacement rate of the servo
controls, and control law limiters, may be taken into account.
[Amdt 25/13]

AMC 25.331(c)(2) Checked manoeuvre between VA and VD

The physical limitations of the aircraft from the cockpit pitch control device to the control surface
deflection, such as control stops position, maximum power and displacement rate of the servo
controls, and control law limiters, may be taken into account.
For aeroplanes equipped with electronic flight controls, where the motion of the control surfaces does
not bear a direct relationship to the motion of the cockpit control devices, the circular frequency of

Annex to ED Decision 2023/021/R Page 198 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

of the input period and amplitude on the resulting aeroplane loads. This variation is intended to verify
that there is no large and rapid increase in aeroplane loads.
[Amdt 25/13]

CS 25.333 Flight manoeuvring envelope

(See AMC 25.333)
(a) General. The strength requirements must be met at each combination of airspeed and load
factor on and within the boundaries of the representative manoeuvring envelope (V-n diagram)
of sub-paragraph (b) of this paragraph. This envelope must also be used in determining the
aeroplane structural operating limitations as specified in CS 25.1501.
(b) Manoeuvring envelope (See AMC 25.333(b))

[Amdt 25/11]
[Amdt 25/13]
[Amdt 25/18]

AMC 25.333(b) Manoeuvring envelope

For the calculation of structural design speeds, the stalling speeds Vs0 and Vs1 should be taken to be
the 1-g stalling speeds in the appropriate flap configuration. This structural interpretation of stalling
speed should be used in connection with the paragraphs CS 25.333(b), CS 25.335, CS 25.335(c)(d)(e),
CS 25.479(a), and CS 25.481(a)(1).
[Amdt 25/13]

Annex to ED Decision 2023/021/R Page 199 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

CS 25.335 Design airspeeds

(See AMC 25.335)
The selected design airspeeds are equivalent airspeeds (EAS). Estimated values of VS0 and VS1 must be
conservative.
(a) Design cruising speed, VC. For VC, the following apply:
(1) The minimum value of VC must be sufficiently greater than VB to provide for inadvertent
speed increases likely to occur as a result of severe atmospheric turbulence.
(2) Except as provided in sub-paragraph 25.335(d)(2), VC may not be less than VB + 1·32 Uref
(with Uref as specified in sub-paragraph 25.341(a)(5)(i). However, VC need not exceed the
maximum speed in level flight at maximum continuous power for the corresponding
altitude.
(3) At altitudes where VD is limited by Mach number, VC may be limited to a selected Mach
number. (See CS 25.1505.)
(b) Design dive speed, VD. VD must be selected so that VC/MC is not greater than 0·8 VD/MD, or so
that the minimum speed margin between VC/MC and VD/MD is the greater of the following
values:
(1) (i) For aeroplanes not equipped with a high speed protection function: From an initial
condition of stabilised flight at VC/MC, the aeroplane is upset, flown for 20 seconds
along a flight path 7·5° below the initial path, and then pulled up at a load factor of
1·5 g (0·5 g acceleration increment). The speed increase occurring in this
manoeuvre may be calculated if reliable or conservative aerodynamic data is used.
Power as specified in CS 25.175(b)(1)(iv) is assumed until the pullup is initiated, at
which time power reduction and the use of pilot controlled drag devices may be
assumed;
(ii) For aeroplanes equipped with a high speed protection function: In lieu of
subparagraph (b)(1)(i), the speed increase above VC/MC resulting from the greater
of the following manoeuvres must be established:
(A) From an initial condition of stabilised flight at VC/MC, the aeroplane is upset
so as to take up a new flight path 7.5° below the initial path. Control
application, up to full authority, is made to try and maintain this new flight
path. Twenty seconds after achieving the new flight path, manual recovery
is made at a load factor of 1.5 g (0.5 g acceleration increment), or such
greater load factor that is automatically applied by the system with the
oeuvre
may be calculated if reliable or conservative aerodynamic data is used.
Power as specified in CS 25.175(b)(1)(iv) is assumed until recovery is made,
at which time power reduction and the use of pilot controlled drag devices
may be assumed.
(B) From a speed below VC/MC, with power to maintain stabilised level flight at
this speed, the aeroplane is upset so as to accelerate through VC/MC at a
flight path 15° below the initial path (or at the steepest nose down attitude
that the system will permit with full control authority if less than 15°). Pilot
controls may be in neutral position after reaching VC/MC and before recovery
is initiated. Recovery may be initiated 3 seconds after operation of high
speed, attitude, or other alerting system by application of a load factor of

Annex to ED Decision 2023/021/R Page 200 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

1.5 g (0.5 g acceleration increment), or such greater load factor that is

automatically applied by the system with the
Power may be reduced simultaneously. All other means of decelerating the
aeroplane, the use of which is authorised up to the highest speed reached in
the manoeuvre, may be used. The interval between successive pilot actions
must not be less than 1 second (See AMC 25.335(b)(1)(ii)).
(2) The minimum speed margin must be enough to provide for atmospheric variations (such
as horizontal gusts, and penetration of jet streams and cold fronts) and for instrument
errors and airframe production variations. These factors may be considered on a
probability basis. The margin at altitude where MC is limited by compressibility effects
must not be less than 0.07M unless a lower margin is determined using a rational analysis
that includes the effects of any automatic systems. In any case, the margin may not be
reduced to less than 0.05M. (See AMC 25.335(b)(2))
(c) Design manoeuvring speed, VA. For VA, the following apply:
(1) VA may not be less than where
(i) n is the limit positive manoeuvring load factor at VC; and
(ii) VS1 is the stalling speed with wing-flaps retracted.
(2) VA and VS must be evaluated at the design weight and altitude under consideration.
(3) VA need not be more than VC or the speed at which the positive CNmax curve intersects the
positive manoeuvre load factor line, whichever is less.
(d) Design speed for maximum gust intensity, VB.
(1) VB may not be less than

where
Vsl = the 1-g stalling speed based on CNAmax with the flaps retracted at the particular
weight under consideration;
CNAmax = the maximum aeroplane normal force coefficient;
Vc = design cruise speed (knots equivalent airspeed);
Uref = the reference gust velocity (feet per second equivalent airspeed) from
CS 25.341(a)(5)(i);
w = average wing loading (pounds per square foot) at the particular weight under
consideration.

Kg =

µ =

= density of air (slugs/ft3);

c = mean geometric chord of the wing (feet);
g = acceleration due to gravity (ft/sec2);
a = slope of the aeroplane normal force coefficient curve, CNA per radian;

Annex to ED Decision 2023/021/R Page 201 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(2) At altitudes where Vc is limited by Mach number

(i) VB may be chosen to provide an optimum margin between low and high speed
buffet boundaries; and,
(ii) VB need not be greater than VC.
(e) Design wing-flap speeds, VF. For VF, the following apply:
(1) The design wing-flap speed for each wing-flap position (established in accordance with
CS 25.697(a)) must be sufficiently greater than the operating speed recommended for
the corresponding stage of flight (including balked landings) to allow for probable
variations in control of airspeed and for transition from one wing-flap position to another.
(2) If an automatic wing-flap positioning or load limiting device is used, the speeds and
corresponding wing-flap positions programmed or allowed by the device may be used.
(3) VF may not be less than
(i) 1·6 VS1 with the wing-flaps in take-off position at maximum take-off weight;
(ii) 1·8 VS1 with the wing-flaps in approach position at maximum landing weight; and
(iii) 1·8 VS0 with the wing-flaps in landing position at maximum landing weight.
(f) Design drag device speeds, VDD. The selected design speed for each drag device must be
sufficiently greater than the speed recommended for the operation of the device to allow for
probable variations in speed control. For drag devices intended for use in high speed descents,
VDD may not be less than VD. When an automatic drag device positioning or load limiting means
is used, the speeds and corresponding drag device positions programmed or allowed by the
automatic means must be used for design.
[Amdt 25/13]
[Amdt 25/18]
[Amdt 25/28]

AMC 25.335(b)(1)(ii) Design Dive Speed - High speed protection

function
In any failure condition affecting the high speed protection function, the conditions as defined in
CS 25.335(b)(1)(ii) still remain applicable.
It implies that a specific value, which may be different from the VD/MD value in normal configuration,
has to be associated with this failure condition for the definition of loads related to V D/MD as well as
for the justification to CS 25.629. However, the strength and speed margin required will depend on
the probability of this failure condition, according to the criteria of CS 25.302.
Alternatively, the operating speed VMO/MMO may be reduced to a value that maintains a speed margin
between VMO/MMO and VD/MD that is consistent with showing compliance with CS 25.335(b)(1)(ii)
without the benefit of the high speed protection system, provided that:
(a) Any failure of the high speed protection system that would affect the design dive speed
determination is shown to be Remote;
(b) Failures of the system must be announced to the pilots, and:

Annex to ED Decision 2023/021/R Page 202 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(c) Aeroplane flight manual instructions should be provided that reduce the maximum operating
speeds, VMO/MMO.
[Amdt 25/13]

AMC 25.335(b)(2) Design Dive Speed

1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating
compliance with the provisions of CS-25 related to the minimum speed margin between design
cruise speed and design dive speed.
2. RELATED CERTIFICATION SPECIFICATIONS. CS 25.335 "Design airspeeds".
3. BACKGROUND. CS 25.335(b) requires the design dive speed, VD, of the aeroplane to be
established so that the design cruise speed is no greater than 0.8 times the design dive speed,
or that it be based on an upset criterion initiated at the design cruise speed, VC. At altitudes
where the cruise speed is limited by compressibility effects, CS 25.335(b)(2) requires the margin
to be not less than 0.05 Mach. Furthermore, at any altitude, the margin must be great enough
to provide for atmospheric variations (such as horizontal gusts and the penetration of jet
streams), instrument errors, and production variations. This AMC provides a rational method
for considering the atmospheric variations.
4. DESIGN DIVE SPEED MARGIN DUE TO ATMOSPHERIC VARIATIONS.
a. In the absence of evidence supporting alternative criteria, compliance with
CS 25.335(b)(2) may be shown by providing a margin between VC/MC and VD/MD sufficient
to provide for the following atmospheric conditions:
(1) Encounter with a Horizontal Gust. The effect of encounters with a substantially
headon gust, assumed to act at the most adverse angle between 30 degrees above
and 30 degrees below the flight path, should be considered. The gust velocity
should be 15.2 m/s (50 fps) in equivalent airspeed (EAS) at altitudes up to 6096 m
(20,000 feet). At altitudes above 6096 m (20,000 feet) the gust velocity may be
reduced linearly from 15.2 m/s (50 fps) in EAS at 6096 m (20,000 feet) to 7.6 m/s
(25 fps) in EAS at 15240 m (50,000 feet), above which the gust velocity is
considered to be constant. The gust velocity should be assumed to build up in not
more than 2 seconds and last for 30 seconds.
(2) Entry into Jetstreams or Regions of High Windshear.
(i) Conditions of horizontal and vertical windshear should be investigated
taking into account the windshear data of this paragraph which are world-
wide extreme values.
(ii) Horizontal windshear is the rate of change of horizontal wind speed with
horizontal distance. Encounters with horizontal windshear change the
aeroplane apparent head wind in level flight as the aeroplane traverses into
regions of changing wind speed. The horizontal windshear region is assumed
to have no significant vertical gradient of wind speed.
(iii) Vertical windshear is the rate of change of horizontal wind speed with
altitude. Encounters with windshear change the aeroplane apparent head
wind as the aeroplane climbs or descends into regions of changing wind
speed. The vertical windshear region changes slowly so that temporal or

Annex to ED Decision 2023/021/R Page 203 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

spatial changes in the vertical windshear gradient are assumed to have no

significant affect on an aeroplane in level flight.
(iv) With the aeroplane at VC/MC within normal rates of climb and descent, the
most extreme condition of windshear that it might encounter, according to
available meteorological data, can be expressed as follows:
(A) Horizontal Windshear. The jet stream is assumed to consist of a linear
shear of 3.6 KTAS/NM over a distance of 25 NM or of 2.52 KTAS/NM
over a distance of 50 NM or of 1.8 KTAS/NM over a distance of 100
NM, whichever is most severe.
(B) Vertical Windshear. The windshear region is assumed to have the
most severe of the following characteristics and design values for
windshear intensity and height band. As shown in Figure 1, the total
vertical thickness of the windshear region is twice the height band so
that the windshear intensity specified in Table 1 applies to a vertical
distance equal to the height band above and below the reference
altitude. The variation of horizontal wind speed with altitude in the
windshear region is linear through the height band from zero at the
edge of the region to a strength at the reference altitude determined
by the windshear intensity multiplied by the height band. Windshear
intensity varies linearly between the reference altitudes in Table 1.
Figure 1 - Windshear Region

Note: The analysis should be conducted by separately descending

initially
increasing headwind.
Table 1 - Vertical Windshear Intensity Characteristics

Height Band - Ft.

1000 3000 5000 7000
Reference Vertical Windshear
Altitude - Ft. Units: ft./sec. per foot of height (KTAS per 1000 feet of height)
0 0.095 (56.3) 0.05 (29.6) 0.035 (20.7) 0.03 (17.8)
40,000 0.145 (85.9) 0.075 (44.4) 0.055 (32.6) 0.04 (23.7)

Annex to ED Decision 2023/021/R Page 204 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

45,000 0.265 (157.0) 0.135 (80.0) 0.10 (59.2) 0.075 (44.4)

Above 45,000 0.265 (157.0) 0.135 (80.0) 0.10 (59.2) 0.075 (44.4)
Windshear intensity varies linearly between specified altitudes.

(v) The entry of the aeroplane into horizontal and vertical windshear should be
treated as separate cases. Because the penetration of these large scale
phenomena is fairly slow, recovery action by the pilot is usually possible. In
the case of manual flight (i.e., when flight is being controlled by inputs made
by the pilot), the aeroplane is assumed to maintain constant attitude until at
least 3 seconds after the operation of the overspeed warning device, at
which time recovery action may be started by using the primary
aerodynamic controls and thrust at a normal acceleration of 1.5g, or the
maximum available, whichever is lower.
b. At altitudes where speed is limited by Mach number, a speed margin of .07 Mach
between MC and MD is considered sufficient without further investigation.
[Amdt 25/2]

CS 25.337 Limit manoeuvring load factors

(See AMC 25.337)
(a) Except where limited by maximum (static) lift coefficients, the aeroplane is assumed to be
subjected to symmetrical manoeuvres resulting in the limit manoeuvring load factors
prescribed in this paragraph. Pitching velocities appropriate to the corresponding pull-up and
steady turn manoeuvres must be taken into account.
(b) D may not be less than

-off weight (lb).

(c) The negative limit manoeuvring load factor
(1) May not be less than 1·0 at speeds up to VC; and
(2) Must vary linearly with speed from the value at VC to zero at VD.
(d) Manoeuvring load factors lower than those specified in this paragraph may be used if the
aeroplane has design features that make it impossible to exceed these values in flight.

AMC 25.337 Limit manoeuvring load factors

The load factor boundary of the manoeuvring envelope is defined by CS 25.337(b) and (c). It is

load factor boundary may be taken into account in the calculation of manoeuvring loads for each
unique mass and flight condition, provided that those constraints are adequately substantiated. This
substantiation should take account of critical combinations of vertical, rolling and yawing manoeuvres
that may be invoked either statically or dynamically within the manoeuvring envelope.
Examples of the aforementioned constraints include aircraft CN-max, mechanical and/or aerodynamic
limitations of the pitch control, and limitations defined within any flight control software.]

Annex to ED Decision 2023/021/R Page 205 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

CS 25.341 Gust and turbulence loads

(See AMC 25.341)
(a) Discrete Gust Design Criteria. The aeroplane is assumed to be subjected to symmetrical vertical
and lateral gusts in level flight. Limit gust loads must be determined in accordance with the
following provisions:
(1) Loads on each part of the structure must be determined by dynamic analysis. The analysis
must take into account unsteady aerodynamic characteristics and all significant structural
degrees of freedom including rigid body motions.
(2) The shape of the gust must be taken as follows:

for s > 2H
where
s = distance penetrated into the gust (metre);
Uds = the design gust velocity in equivalent airspeed specified in sub-paragraph (a) (4) of
this paragraph;
H =
path for the gust to reach its peak velocity.
(3) A sufficient number of gust gradient distances in the range 9 m (30 feet) to 107 m (350
feet) must be investigated to find the critical response for each load quantity.
(4) The design gust velocity must be:

where
Uref = the reference gust velocity in equivalent airspeed defined in sub-paragraph (a)(5)
of this paragraph;
Fg = the flight profile alleviation factor defined in sub-paragraph (a)(6) of this
paragraph.
(5) The following reference gust velocities apply:
(i) At aeroplane speeds between VB and VC: Positive and negative gusts with reference
gust velocities of 17.07 m/s (56.0 ft/s) EAS must be considered at sea level. The
reference gust velocity may be reduced linearly from 17.07 m/s (56.0 ft/s) EAS at
sea level to 13.41 m/s (44.0 ft/s) EAS at 4572 m (15 000 ft). The reference gust
velocity may be further reduced linearly from 13.41 m/s (44.0 ft/s) EAS at 4572 m
(15 000 ft) to 6.36 m/s (20.86 ft/sec) EAS at 18288 m (60 000 ft).
(ii) At the aeroplane design speed VD: The reference gust velocity must be 0·5 times
the value obtained under CS 25.341(a)(5)(i).
(6) The flight profile alleviation factor, Fg, must be increased linearly from the sea level value
to a value of 1.0 at the maximum operating altitude defined in CS 25.1527. At sea level,
the flight profile alleviation factor is determined by the following equation.

Annex to ED Decision 2023/021/R Page 206 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

where

Zmo maximum operating altitude (metres (feet)) defined in CS 25.1527.

(7) When a stability augmentation system is included in the analysis, the effect of any
significant system non-linearities should be accounted for when deriving limit loads from
limit gust conditions.
(b) Continuous Turbulence Design Criteria. The dynamic response of the aeroplane to vertical and
lateral continuous turbulence must be taken into account. The dynamic analysis must take into
account unsteady aerodynamic characteristics and all significant structural degrees of freedom
including rigid body motions. The limit loads must be determined for all critical altitudes,
weights, and weight distributions as specified in CS 25.321(b), and all critical speeds within the
ranges indicated in subparagraph (b)(3).
(1) Except as provided in subparagraphs (b)(4) and (b)(5) of this paragraph, the following
equation must be used:

Where:
PL = limit load;
PL-1g = steady 1-g load for the condition;
A = ratio of root-mean-square incremental load for the condition to root-mean-square
turbulence velocity; and
U = limit turbulence intensity in true airspeed, specified in subparagraph (b)(3) of this
paragraph.
(2) must be determined according to the following formula:

Where:
analysis, that relates the
loads in the aircraft structure to the atmospheric turbulence; and
I

Annex to ED Decision 2023/021/R Page 207 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

Where:
reduced frequency, rad/ft; and
L = scale of turbulence = 2,500 ft.
(3) The limit turbulence intensities, U , in m/s (ft/s) true airspeed required for compliance
with this paragraph are:
(i) At aeroplane speeds between VB and VC:

Where:
U is the reference turbulence intensity that varies linearly with altitude from
27.43 m/s (90 ft/s) (TAS) at sea level to 24.08 m/s (79 ft/s) (TAS) at 7315 m
(24000 ft) and is then constant at 24.08 m/s (79 ft/s) (TAS) up to the altitude of
18288 m (60000 ft); and
Fg is the flight profile alleviation factor defined in subparagraph (a)(6) of this
paragraph;
(ii) At speed VD: U is equal to 1/2 the values obtained under subparagraph (3)(i) of
this paragraph.
(iii) At speeds between VC and VD value obtained by linear
interpolation.
(iv) At all speeds both positive and negative incremental loads due to continuous
turbulence must be considered.
(4) When an automatic system affecting the dynamic response of the aeroplane is included
in the analysis, the effects of system non-linearities on loads at the limit load level must
be taken into account in a realistic or conservative manner.
(5) If necessary for the assessment of loads on aeroplanes with significant non-linearities, it
must be assumed that the turbulence field has a root-mean-square velocity equal to 40
percent of the U values specified in subparagraph (3). The value of limit load is that load
with the same probability of exceedance in the turbulence field as
quantity in a linear approximated model.
(c) Supplementary gust conditions for wing mounted engines. For aeroplanes equipped with wing
mounted engines, the engine mounts, pylons, and wing supporting structure must be designed
for the maximum response at the nacelle centre of gravity derived from the following dynamic
gust conditions applied to the aeroplane:
(1) A discrete gust determined in accordance with CS 25.341(a) at each angle normal to the
flight path, and separately,
(2) A pair of discrete gusts, one vertical and one lateral. The length of each of these gusts
must be independently tuned to the maximum response in accordance with CS 25.341(a).
The penetration of the aeroplane in the combined gust field and the phasing of the
vertical and lateral component gusts must be established to develop the maximum

Annex to ED Decision 2023/021/R Page 208 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

response to the gust pair. In the absence of a more rational analysis, the following
formula must be used for each of the maximum engine loads in all six degrees of freedom:

Where:
PL = limit load;
PL-1g = steady 1-g load for the condition;
LV = peak incremental response load due to a vertical gust according to CS 25.341(a);
and
LL = peak incremental response load due to a lateral gust according to CS 25.341(a).
[Amdt 25/1]
[Amdt 25/12]

AMC 25.341 Gust and Continuous Turbulence Design Criteria

(Acceptable Means of Compliance)
1. PURPOSE. This AMC sets forth an acceptable means of compliance with the provisions of CS-25
dealing with discrete gust and continuous turbulence dynamic loads.
2. RELATED CERTIFICATION SPECIFICATIONS. The contents of this AMC are considered by the
Agency in determining compliance with the discrete gust and continuous turbulence criteria
defined in CS 25.341. Related paragraphs are:
CS 25.343 Design fuel and oil loads
CS 25.345 High lift devices
CS 25.349 Rolling conditions
CS 25.371 Gyroscopic loads
CS 25.373 Speed control devices
CS 25.391 Control surface loads
CS 25.427 Unsymmetrical loads
CS 25 445 Auxiliary aerodynamic surfaces
CS 25.571 Damage-tolerance and fatigue evaluation of structure
Reference should also be made to the following CS paragraphs: CS 25.301, CS 25.302, CS 25.303,
CS 25.305, CS 25.321, CS 25.335, CS 25.1517.
3. OVERVIEW. This AMC addresses both discrete gust and continuous turbulence (or continuous
gust) requirements of CS-25. It provides some of the acceptable methods of modelling
aeroplanes, aeroplane components, and configurations, and the validation of those modelling
methods for the purpose of determining the response of the aeroplane to encounters with
gusts.
How the various aeroplane modelling parameters are treated in the dynamic analysis can have
a large influence on design load levels. The basic elements to be modelled in the analysis are
the elastic, inertial, aerodynamic and control system characteristics of the complete, coupled

Annex to ED Decision 2023/021/R Page 209 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

aeroplane (Figure 1). The degree of sophistication and detail required in the modelling depends
on the complexity of the aeroplane and its systems.

Figure 1 Basic Elements of the Gust Response Analysis

Design loads for encounters with gusts are a combination of the steady level 1-g flight loads,
and the gust incremental loads including the dynamic response of the aeroplane. The steady 1-
g flight loads can be realistically defined by the basic external parameters such as speed,
altitude, weight and fuel load. They can be determined using static aeroelastic methods.
The gust incremental loads result from the interaction of atmospheric turbulence and aeroplane
rigid body and elastic motions. They may be calculated using linear analysis methods when the
aeroplane and its flight control systems are reasonably or conservatively approximated by linear
analysis models.
Non-linear solution methods are necessary for aeroplane and flight control systems that are not
reasonably or conservatively represented by linear analysis models. Non-linear features
generally raise the level of complexity, particularly for the continuous turbulence analysis,
because they often require that the solutions be carried out in the time domain.
The modelling parameters discussed in the following paragraphs include:
Design conditions and associated steady, level 1-g flight conditions.
The discrete and continuous gust models of atmospheric turbulence.
Detailed representation of the aeroplane system including structural dynamics,
aerodynamics, and control system modelling.

Annex to ED Decision 2023/021/R Page 210 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

Solution of the equations of motion and the extraction of response loads.

Considerations for non-linear aeroplane systems.
Analytical model validation techniques.
4. DESIGN CONDITIONS.
a. General. Analyses should be conducted to determine gust response loads for the
aeroplane throughout its design envelope, where the design envelope is taken to include,
for example, all appropriate combinations of aeroplane configuration, weight, centre of
gravity, payload, fuel load, thrust, speed, and altitude.
b. Steady Level 1-g Flight Loads. The total design load is made up of static and dynamic load
components. In calculating the static component, the aeroplane is assumed to be in
trimmed steady level flight, either as the initial condition for the discrete gust evaluation
or as the mean flight condition for the continuous turbulence evaluation. Static
aeroelastic effects should be taken into account if significant.
To ensure that the maximum total load on each part of the aeroplane is obtained, the
associated steady-state conditions should be chosen in such a way as to reasonably
envelope the range of possible steady-state conditions that could be achieved in that
flight condition. Typically, this would include consideration of effects such as speed
brakes, power settings between zero thrust and the maximum for the flight condition,
etc.
c. Dynamic Response Loads. The incremental loads from the dynamic gust solution are
superimposed on the associated steady level flight 1-g loads. Load responses in both
positive and negative senses should be assumed in calculating total gust response loads.
Generally the effects of speed brakes, flaps, or other drag or high lift devices, while they
should be included in the steady-state condition, may be neglected in the calculation of
incremental loads.
d. Damage Tolerance Conditions. Limit gust loads, treated as ultimate, need to be
developed for the structural failure conditions considered under CS 25.571(b). Generally,
for redundant structures, significant changes in stiffness or geometry do not occur for the
types of damage under consideration. As a result, the limit gust load values obtained for
the undamaged aircraft may be used and applied to the failed structure. However, when
structural failures of the types considered under CS 25.571(b) cause significant changes
in stiffness or geometry, or both, these changes should be taken into account when
calculating limit gust loads for the damaged structure.
5. GUST MODEL CONSIDERATIONS.
a. General. The gust criteria presented in CS 25.341 consist of two models of atmospheric
turbulence, a discrete model and a continuous turbulence model. It is beyond the scope
of this AMC to review the historical development of these models and their associated
parameters. This AMC focuses on the application of those gust criteria to establish design
limit loads. The discrete gust model is used to represent single discrete extreme
turbulence events. The continuous turbulence model represents longer duration
turbulence encounters which excite lightly damped modes. Dynamic loads for both
atmospheric models must be considered in the structural design of the aeroplane.
b. Discrete Gust Model
(1) Atmosphere. The atmosphere is assumed to be one dimensional with the gust
velocity acting normal (either vertically or laterally) to the direction of aeroplane

Annex to ED Decision 2023/021/R Page 211 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

travel. The one-dimensional assumption constrains the instantaneous vertical or

lateral gust velocities to be the same at all points in planes normal to the direction
of aeroplane travel. Design level discrete gusts are assumed to have 1-cosine
velocity profiles. The maximum velocity for a discrete gust is calculated using a
reference gust velocity, Uref, a flight profile alleviation factor, Fg, and an expression
which modifies the maximum velocity as a function of the gust gradient distance,
H. These parameters are discussed further below.
(A) Reference Gust Velocity, Uref - Derived effective gust velocities representing
gusts occurring once in 70,000 flight hours are the basis for design gust
velocities. These reference velocities are specified as a function of altitude
in CS 25.341(a)(5) and are given in terms of feet per second equivalent
airspeed for a gust gradient distance, H, of 107 m (350 ft).
(B) Flight Profile Alleviation Factor, Fg - The reference gust velocity, Uref , is a
measure of turbulence intensity as a function of altitude. In defining the
value of Uref at each altitude, it is assumed that the aircraft is flown 100%
of the time at that altitude. The factor Fg is then applied to account for the
expected service experience in terms of the probability of the aeroplane
flying at any given altitude within its certification altitude range. Fg is a
minimum value at sea level, linearly increasing to 1.0 at the certified
maximum altitude. The expression for Fg is given in CS 25.341(a)(6).
(C) Gust Gradient Distance, H - The gust gradient distance is that distance over
which the gust velocity increases to a maximum value. Its value is specified
as ranging from 9.1 to 107 m (30 to 350 ft). (It should be noted that if 12.5

consideration should be given to covering increased maximum gust gradient

distances.)
(D) Design Gust Velocity, Uds - Maximum velocities for design gusts are
proportional to the sixth root of the gust gradient distance, H. The maximum
gust velocity for a given gust is then defined as:

The maximum design gust velocity envelope, Uds, and example design gust
velocity profiles are illustrated in Figure 2.

Annex to ED Decision 2023/021/R Page 212 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

Figure-2 Typical (1-cosine) Design Gust Velocity Profiles

(2) Discrete Gust Response. The solution for discrete gust response time histories can
be achieved by a number of techniques. These include the explicit integration of
the aeroplane equations of motion in the time domain, and frequency domain
solutions utilising Fourier transform techniques. These are discussed further in
Paragraph 7.0 of this AMC.
Maximum incremental loads, PIi, are identified by the peak values selected from
time histories arising from a series of separate, 1-cosine shaped gusts having
gradient distances ranging from 9.1 to 107 m (30 to 350 ft). Input gust profiles
should cover this gradient distance range in sufficiently small increments to
determine peak loads and responses. Historically 10 to 20 gradient distances have
been found to be acceptable. Both positive and negative gust velocities should be
assumed in calculating total gust response loads. It should be noted that in some
cases, the peak incremental loads can occur well after the prescribed gust velocity
has returned to zero. In such cases, the gust response calculation should be run
for sufficient additional time to ensure that the critical incremental loads are
achieved.
The design limit load, PLi , corresponding to the maximum incremental load, PIi for
a given load quantity is then defined as:

Where P(1-g)i is the 1-g steady load for the load quantity under consideration. The
set of time correlated design loads, PLj , corresponding to the peak value of the load
quantity, PLi, are calculated for the same instant in time using the expression:

Annex to ED Decision 2023/021/R Page 213 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

Note that in the case of a non-linear aircraft, maximum positive incremental loads
may differ from maximum negative incremental loads.
When calculating stresses which depend on a combination of external loads it may
be necessary to consider time correlated load sets at time instants other than those
which result in peaks for individual external load quantities.
(3) Round-The-Clock Gust. When the effect of combined vertical and lateral gusts on
aeroplane components is significant, then round-the-clock analysis should be
conducted on these components and supporting structures. The vertical and
lateral components of the gust are assumed to have the same gust gradient
distance, H and to start at the same time. Components that should be considered
include horizontal tail surfaces having appreciable dihedral or anhedral
(i.e., greater than 10º), or components supported by other lifting surfaces, for
example T-tails, outboard fins and winglets. Whilst the round-the-clock load
assessment may be limited to just the components under consideration, the loads
themselves should be calculated from a whole aeroplane dynamic analysis.
The round-the-clock gust model assumes that discrete gusts may act at any angle
normal to the flight path of the aeroplane. Lateral and vertical gust components
are correlated since the round-the-clock gust is a single discrete event. For a linear
aeroplane system, the loads due to a gust applied from a direction intermediate to
the vertical and lateral directions - the round-the-clock gust loads - can be obtained
using a linear combination of the load time histories induced from pure vertical
and pure lateral gusts. The resultant incremental design value for a particular load
of interest is obtained by determining the round-the-clock gust angle and gust
length giving the largest (tuned) response value for that load. The design limit load
is then obtained using the expression for PL given above in paragraph 5(b)(2).
(4) Supplementary Gust Conditions for Wing Mounted Engines.
(A) Atmosphere - For aircraft equipped with wing mounted engines,
CS 25.341(c) requires that engine mounts, pylons and wing supporting
structure be designed to meet a round-the-clock discrete gust requirement
and a multi-axis discrete gust requirement.
The model of the atmosphere and the method for calculating response loads
for the round-the-clock gust requirement is the same as that described in
Paragraph 5(b)(3) of this AMC.
For the multi-axis gust requirement, the model of the atmosphere consists
of two independent discrete gust components, one vertical and one lateral,
having amplitudes such that the overall probability of the combined gust pair
is the same as that of a single discrete gust as defined by CS 25.341(a) as
described in Paragraph 5(b)(1) of this AMC. To achieve this equal-probability
condition, in addition to the reductions in gust amplitudes that would be
applicable if the input were a multi-axis Gaussian process, a further factor of
0.85 is incorporated into the gust amplitudes to account for non-Gaussian
properties of severe discrete gusts. This factor was derived from severe gust
data obtained by a research aircraft specially instrumented to measure
vertical and lateral gust components. This information is contained in Stirling
Dynamics Laboratories Report No SDL 571-TR-2 dated May 1999.

Annex to ED Decision 2023/021/R Page 214 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(B) Multi-Axis Gust Response - For a particular aircraft flight condition, the
calculation of a specific response load requires that the amplitudes, and the
time phasing, of the two gust components be chosen, subject to the
condition on overall probability specified in (A) above, such that the resulting
combined load is maximised. For loads calculated using a linear aircraft
model, the response load may be based upon the separately tuned vertical
and lateral discrete gust responses for that load, each calculated as
described in Paragraph 5(b)(2) of this AMC. In general, the vertical and
lateral tuned gust lengths and the times to maximum response (measured
from the onset of each gust) will not be the same.
Denote the independently tuned vertical and lateral incremental responses
for a particular aircraft flight condition and load quantity i by LVi and LLi,
respectively. The associated multi-axis gust input is obtained by multiplying
the amplitudes of the independently-tuned vertical and lateral discrete
gusts, obtained as described in the previous paragraph, by 0.85*LVi
(LVi2+LLi2) and 0.85*LLi (LVi2+LLi2) respectively. The time-phasing of the two
scaled gust components is such that their associated peak loads occur at the
same instant.
The combined incremental response load is given by:

and the design limit load, PLi, corresponding to the maximum incremental
load, PIi, for the given load quantity is then given by:

where P(1-g)i is the 1-g steady load for the load quantity under consideration.
The incremental, time correlated loads corresponding to the specific flight
condition under consideration are obtained from the independently-tuned
vertical and lateral gust inputs for load quantity i. The vertical and lateral
gust amplitudes are factored by 0.85*LVi (LVi2+LLi2) and 0.85*LLi (LVi2+LLi2)
respectively. Loads LVj and LLj resulting from these reduced vertical and
lateral gust inputs, at the time when the amplitude of load quantity i is at a
maximum value, are added to yield the multi-axis incremental time-
correlated value PIj for load quantity j.
The set of time correlated design loads, PLj , corresponding to the peak value
of the load quantity, PLi, are obtained using the expression:

Note that with significant non-linearities, maximum positive incremental

loads may differ from maximum negative incremental loads.
c. Continuous Turbulence Model.
(1) Atmosphere. The atmosphere for the determination of continuous gust responses
is assumed to be one dimensional with the gust velocity acting normal (either
vertically or laterally) to the direction of aeroplane travel. The one-dimensional
assumption constrains the instantaneous vertical or lateral gust velocities to be the
same at all points in planes normal to the direction of aeroplane travel.

Annex to ED Decision 2023/021/R Page 215 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

The random atmosphere is assumed to have a Gaussian distribution of gust velocity

intensities and a Von Kármán power spectral density with a scale of turbulence, L,
equal to 2500 feet. The expression for the Von Kármán spectrum for unit, root-
mean- I( ), is given below. In this expression = /V,
where is the circular frequency in radians per second, and V is the aeroplane
velocity in feet per second true airspeed.

The Von Kármán power spectrum for unit RMS gust intensity is illustrated in
Figure 3.

Figure-3 The Von Kármán Power Spectral Density Function, I

w CS 25.341(b)(3) in meters per second (feet

per second) true airspeed and Fg is defined in CS 25.341(a)(6). The value of Fg is
based on aeroplane design parameters and is a minimum value at sea level, linearly
increasing to 1.0 at the certified maximum design altitude. It is identical to that
used in the discrete gust analysis.
As for the discrete gust analysis, the reference continuous turbulence gust
, defines the design value of the associated gust field at each
altitude. In defining the value of U ref at each altitude, it is assumed that the
aeroplane is flown 100% of the time at that altitude. The factor Fg is then applied

Annex to ED Decision 2023/021/R Page 216 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

to account for the probability of the aeroplane flying at any given altitude during
its service lifetime.
It should be noted that the reference gust velocity is comprised of two
components, a root-mean-square (RMS) gust intensity and a peak to RMS ratio.
The separation of these components is not defined and is not required for the
linear aeroplane analysis. Guidance is provided in Paragraph 8.d. of this AMC for
generating a RMS gust intensity for a non-linear simulation.
(2) Continuous Turbulence Response. For linear aeroplane systems, the solution for
the response to continuous turbulence may be performed entirely in the frequency
domain, using the RMS response. is defined in CS 25.341(b)(2) and is repeated here
in modified notation for load quantity i, where:

or

In the above expression I is the input Von Kármán power spectrum of the
turbulence and is defined in Paragraph 5.c.(1) of this AMC, hi is the transfer
function relating the output load quantity, i, to a unit, harmonically oscillating, one-
dimensional gust field, and the asterisk superscript denotes the complex
conjugate. When evaluating i, the integration should be continued until a
converged value is achieved since, realistically, the integration to infinity may be
impractical. The design limit load, PLi, is then defined as:

where U is defined in Paragraph 5.c.(1) of this AMC, and P(1-g)i is the 1-g steady
state value for the load quantity, i, under consideration. As indicated by the
formula, both positive and negative load responses should be considered when
calculating limit loads.
Correlated (or equiprobable) loads can be developed using cross-correlation
ij, computed as follows:

contained within
the brackets. In this equation, the lowercase subscripts, i and j, denote the
responses being correlated. A set of design loads, PLj, correlated to the design limit
load PLi, are then calculated as follows:

Annex to ED Decision 2023/021/R Page 217 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

The correlated load sets calculated in the foregoing manner provide balanced load
distributions corresponding to the maximum value of the response for each
external load quantity, i, calculated.
When calculating stresses, the foregoing load distributions may not yield critical
design values because critical stress values may depend on a combination of
external loads. In these cases, a more general application of the correlation
coefficient method is required. For example, when the value of stress depends on
two externally applied loads, such as torsion and shear, the equiprobable
relationship between the two parameters forms an ellipse as illustrated in Figure 4.

Figure-4 Equal Probability Design Ellipse

In this figure, the points of tangency, T, correspond to the expressions for

correlated load pairs given by the foregoing expressions. A practical additional set
of equiprobable load pairs that should be considered to establish critical design
stresses are given by the points of tangency to the ellipse by lines AB, CD, EF and
GH. These additional load pairs are given by the following expressions (where i =
torsion and j = shear):
For tangents to lines AB and EF

and

For tangents to lines CD and GH

Annex to ED Decision 2023/021/R Page 218 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

and

All correlated or equiprobable loads developed using correlation coefficients will

provide balanced load distributions.
A more comprehensive approach for calculating critical design stresses that
depend on a combination of external load quantities is to evaluate directly the
transfer function for the stress quantity of interest from which can be calculated
the gust response function, the value for RMS response, and the design stress
values P(1-g) ± U .
6. AEROPLANE MODELLING CONSIDERATIONS
a. General. The procedures presented in this paragraph generally apply for aeroplanes
having aerodynamic and structural properties and flight control systems that may be
reasonably or conservatively approximated using linear analysis methods for calculating
limit load. Additional guidance material is presented in Paragraph 8 of this AMC for
aeroplanes having properties and/or systems not reasonably or conservatively
approximated by linear analysis methods.
b. Structural Dynamic Model. The model should include both rigid body and flexible
aeroplane degrees of freedom. If a modal approach is used, the structural dynamic model
should include a sufficient number of flexible aeroplane modes to ensure both
convergence of the modal superposition procedure and that responses from high
frequency excitations are properly represented.
Most forms of structural modelling can be classified into two main categories: (1) the so-
d along their
lengths, and (2) finite element models in which all major structural components (frames,
ribs, stringers, skins) are represented with mass properties defined at grid points.
Regardless of the approach taken for the structural modelling, a minimum acceptable
level of sophistication, consistent with configuration complexity, is necessary to
represent satisfactorily the critical modes of deformation of the primary structure and
control surfaces. Results from the models should be compared to test data as outlined in
Paragraph 9.b. of this AMC in order to validate the accuracy of the model.
c. Structural Damping. Structural dynamic models may include damping properties in
addition to representations of mass and stiffness distributions. In the absence of better
information it will normally be acceptable to assume 0.03 (i.e. 1.5% equivalent critical
viscous damping) for all flexible modes. Structural damping may be increased over the
0.03 value to be consistent with the high structural response levels caused by extreme
gust intensity, provided justification is given.
d. Gust and Motion Response Aerodynamic Modelling. Aerodynamic forces included in the
analysis are produced by both the gust velocity directly, and by the aeroplane response.
Aerodynamic modelling for dynamic gust response analyses requires the use of unsteady
two-dimensional or three-dimensional panel theory methods for incompressible or
compressible flow. The choice of the appropriate technique depends on the complexity
of the aerodynamic configuration, the dynamic motion of the surfaces under
investigation and the flight speed envelope of the aeroplane. Generally, three-
dimensional panel methods achieve better modelling of the aerodynamic interference
between lifting surfaces. The model should have a sufficient number of aerodynamic

Annex to ED Decision 2023/021/R Page 219 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

degrees of freedom to properly represent the steady and unsteady aerodynamic

distributions under consideration.
The build-up of unsteady aerodynamic forces should be represented. In two-dimensional
unsteady analysis this may be achieved in either the frequency domain or the time
domain through the application of oscillatory or indicial lift functions, respectively. Where
three-dimensional panel aerodynamic theories are to be applied in the time domain (e.g.
for non-linear gu
method may be employed to transform frequency domain aerodynamics into the time
domain.
Oscillatory lift functions due to gust velocity or aeroplane response depend on the
reduced frequency parameter, k. The maximum reduced frequency used in the
generation of the unsteady aerodynamics should include the highest frequency of gust
excitation and the highest structural frequency under consideration. Time lags
representing the effect of the gradual penetration of the gust field by the aeroplane
should also be accounted for in the build-up of lift due to gust velocity.
The aerodynamic modelling should be supported by tests or previous experience as
indicated in Paragraph 9.d. of this AMC. Primary lifting and control surface distributed
aerodynamic data are commonly adjusted by weighting factors in the dynamic gust
response analyses. The weighting factors for steady flow (k = 0) may be obtained by
comparing wind tunnel test results with theoretical data. The correction of the
aerodynamic forces should also ensure that the rigid body motion of the aeroplane is
accurately represented in order to provide satisfactory short period and Dutch roll
frequencies and damping ratios. Corrections to primary surface aerodynamic loading due
to control surface deflection should be considered. Special attention should also be given
to control surface hinge moments and to fuselage and nacelle aerodynamics because
viscous and other effects may require more extensive adjustments to the theoretical
coefficients. Aerodynamic gust forces should reflect weighting factor adjustments
performed on the steady or unsteady motion response aerodynamics.
e. Gyroscopic Loads. As specified in CS 25.371, the structure supporting the engines and the
auxiliary power units should be designed for the gyroscopic loads induced by both
discrete gusts and continuous turbulence. The gyroscopic loads for turbopropellers and
turbofans may be calculated as an integral part of the solution process by including the
gyroscopic terms in the equations of motion or the gyroscopic loads can be superimposed
after the solution of the equations of motion. Propeller and fan gyroscopic coupling
forces (due to rotational direction) between symmetric and antisymmetric modes need
not be taken into account if the coupling forces are shown to be negligible.
The gyroscopic loads used in this analysis should be determined with the engine or
auxiliary power units at maximum continuous rpm. The mass polar moment of inertia
used in calculating gyroscopic inertia terms should include the mass polar moments of
inertia of all significant rotating parts taking into account their respective rotational
gearing ratios and directions of rotation.
f. Control Systems. Gust analyses of the basic configuration should include simulation of
any control system for which interaction may exist with the rigid body response,
structural dynamic response or external loads. If possible, these control systems should

lateral gust analysis.

Annex to ED Decision 2023/021/R Page 220 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

The control systems considered should include all relevant modes of operation. Failure
conditions should also be analysed for any control system which influences the design
loads in accordance with CS 25.302 and Appendix K.
The control systems included in the gust analysis may be assumed to be linear if the
impact of the non-linearity is negligible, or if it can be shown by analysis on a similar
aeroplane/control system that a linear control law representation is conservative. If the
control system is significantly non-linear, and a conservative linear approximation to the
control system cannot be developed, then the effect of the control system on the
aeroplane responses should be evaluated in accordance with Paragraph 8. of this AMC.
g. Stability. Solutions of the equations of motion for either discrete gusts or continuous
turbulence require the dynamic model be stable. This applies for all modes, except
possibly for very low frequency modes which do not affect load responses, such as the
phugoid mode. (Note that the short period and Dutch roll modes do affect load
responses). A stability check should be performed for the dynamic model using
conventional stability criteria appropriate for the linear or non-linear system in question,
and adjustments should be made to the dynamic model, as required, to achieve
appropriate frequency and damping characteristics.
If control system models are to be included in the gust analysis it is advisable to check
that the following characteristics are acceptable and are representative of the aeroplane:
static margin of the unaugmented aeroplane
dynamic stability of the unaugmented aeroplane
the static aeroelastic effectiveness of all control surfaces utilised by any feed-back
control system
gain and phase margins of any feedback control system coupled with the aeroplane
rigid body and flexible modes
the aeroelastic flutter and divergence margins of the unaugmented aeroplane, and
also for any feedback control system coupled with the aeroplane.
7. DYNAMIC LOADS
a. General. This paragraph describes methods for formulating and solving the aeroplane
equations of motion and extracting dynamic loads from the aeroplane response. The
aeroplane equations of motion are solved in either physical or modal co-ordinates and
include all terms important in the loads calculation including stiffness, damping, mass,
and aerodynamic forces due to both aeroplane motions and gust excitation. Generally
the aircraft equations are solved in modal co-ordinates. For the purposes of describing
the solution of these equations in the remainder of this AMC, modal co-ordinates will be
assumed. A sufficient number of modal co-ordinates should be included to ensure that
the loads extracted provide converged values.
b. Solution of the Equations of Motion. Solution of the equations of motion can be achieved
through a number of techniques. For the continuous turbulence analysis, the equations
of motion are generally solved in the frequency domain. Transfer functions which relate
the output response quantity to an input harmonically oscillating gust field are generated
and these transfer functions are used (in Paragraph 5.c. of this AMC) to generate the RMS
value of the output response quantity.
There are two primary approaches used to generate the output time histories for the
discrete gust analysis; (1) by explicit integration of the aeroplane equations of motion in

Annex to ED Decision 2023/021/R Page 221 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

the time domain, and (2) by frequency domain solutions which can utilise Fourier
transform techniques.
c. Extraction of Loads and Responses. The output quantities that may be extracted from a
gust response analysis include displacements, velocities and accelerations at structural
locations; load quantities such as shears, bending moments and torques on structural
components; and stresses and shear flows in structural components. The calculation of
the physical responses is given by a modal superposition of the displacements, velocities
and accelerations of the rigid and elastic modes of vibration of the aeroplane structure.
The number of modes carried in the summation should be sufficient to ensure converged
results.
A variety of methods may be used to obtain physical structural loads from a solution of
the modal equations of motion governing gust response. These include the Mode
Displacement method, the Mode Acceleration method, and the Force Summation
method. All three methods are capable of providing a balanced set of aeroplane loads. If
an infinite number of modes can be considered in the analysis, the three will lead to
essentially identical results.
The Mode Displacement method is the simplest. In this method, total dynamic loads are
calculated from the structural deformations produced by the gust using modal
superposition. Specifically, the contribution of a given mode is equal to the product of
the load associated with the normalised deformed shape of that mode and the value of
the displacement response given by the associated modal co-ordinate. For converged
results, the Mode Displacement method may need a significantly larger number of modal
co-ordinates than the other two methods.
In the Mode Acceleration method, the dynamic load response is composed of a static
part and a dynamic part. The static part is determined by conventional static analysis
externally applied gust loads treated as
static loads. The dynamic part is computed by the superposition of appropriate modal
quantities, and is a function of the number of modes carried in the solution. The
quantities to be superimposed involve both motion response forces and acceleration
responses (thus giving this method its name). Since the static part is determined
completely and independently of the number of normal modes carried, adequate
accuracy may be achieved with fewer modes than would be needed in the Mode
Displacement method.
The Force Summation method is the most laborious and the most intuitive. In this
method, physical displacements, velocities and accelerations are first computed by
superposition of the modal responses. These are then used to determine the physical
inertia forces and other motion dependent forces. Finally, these forces are added to the
externally applied forces to give the total dynamic loads acting on the structure.
If balanced aeroplane load distributions are needed from the discrete gust analysis, they
may be determined using time correlated solution results. Similarly, as explained in
Paragraph 5.c of this AMC, if balanced aeroplane load distributions are needed from the
continuous turbulence analysis, they may be determined from equiprobable solution
results obtained using cross-correlation coefficients.
8. NONLINEAR CONSIDERATIONS
a. General. Any structural, aerodynamic or automatic control system characteristic which
may cause aeroplane response to discrete gusts or continuous turbulence to become

Annex to ED Decision 2023/021/R Page 222 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

non-linear with respect to intensity or shape should be represented realistically or

conservatively in the calculation of loads. While many minor non-linearities are amenable
to a conservative linear solution, the effect of major non-linearities cannot usually be
quantified without explicit calculation.
The effect of non-linearities should be investigated above limit conditions to assure that
the system presents no anomaly compared to behaviour below limit conditions, in
accordance with Appendix K, K25.2(b)(2).
b. Structural and Aerodynamic Non-linearity. A linear elastic structural model, and a linear
(unstalled) aerodynamic model are normally recommended as conservative and
acceptable for the unaugmented aeroplane elements of a loads calculation. Aerodynamic
models may be refined to take account of minor non-linear variation of aerodynamic
distributions, due to local separation etc., through simple linear piecewise solution. Local
or complete stall of a lifting surface would constitute a major non-linearity and should
not be represented without account being taken of the influence of rate of change of
incidence, i.e., the so- which the range of linear incremental
aerodynamics may extend significantly beyond the static stall incidence.
c. Automatic Control System Non-linearity. Automatic flight control systems, autopilots,
stability control systems and load alleviation systems often constitute the primary source
of non-linear response. For example,
non-proportional feedback gains
rate and amplitude limiters
changes in the control laws, or control law switching
hysteresis
use of one-sided aerodynamic controls such as spoilers
hinge moment performance and saturation of aerodynamic control actuators
The resulting influences on response will be aeroplane design dependent, and the
manner in which they are to be considered will normally have to be assessed for each
design.
Minor influences such as occasional clipping of response due to rate or amplitude
limitations, where it is symmetric about the stabilised 1-g condition, can often be
represented through quasi-linear modelling techniques such as describing functions or
use of a linear equivalent gain.
Major, and unsymmetrical influences such as application of spoilers for load alleviation,
normally require explicit simulation, and therefore adoption of an appropriate solution
based in the time domain.
The influence of non-linearities on one load quantity often runs contrary to the influence
on other load quantities. For example, an aileron used for load alleviation may
simultaneously relieve wing bending moment whilst increasing wing torsion. Since it may
not be possible to represent such features conservatively with a single aeroplane model,
it may be conservatively acceptable to consider loads computed for two (possibly linear)
representations which bound the realistic condition. Another example of this approach
would be separate representation of continuous turbulence response for the two control
law states to cover a situation where the aeroplane may occasionally switch from one
state to another.

Annex to ED Decision 2023/021/R Page 223 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

d. Non-linear Solution Methodology. Where explicit simulation of non-linearities is

required, the loads response may be calculated through time domain integration of the
equations of motion.
For the tuned discrete gust conditions of CS 25.341(a), limit loads should be identified by
peak values in the non-linear time domain simulation response of the aeroplane model
excited by the discrete gust model described in Paragraph 5.b. of this AMC.
For time domain solution of the continuous turbulence conditions of CS 25.341(b), a
variety of approaches may be taken for the specification of the turbulence input time
history and the mechanism for identifying limit loads from the resulting responses.
It will normally be necessary to justify that the selected approach provides an equivalent
level of safety as a conventional linear analysis and is appropriate to handle the types of
non-linearity on the aircraft. This should include verification that the approach provides
adequate statistical significance in the loads results.
A methodology based upon stochastic simulation has been found to be acceptable for
load alleviation and flight control system non-linearities. In this simulation, the input is a
long, Gaussian, pseudo-random turbulence stream conforming to a Von Kármán
spectrum with a root-mean-square (RMS) amplitude of 0.4 times U (defined in Paragraph
5.c (1) of this AMC). The value of limit load is that load with the same probability of
U of the same load quantity in a linear model. This is illustrated
graphically in Figure 5. When using an analysis of this type, exceedance curves should be
constructed using incremental load values up to, or just beyond the limit load value.

Figure-5 Establishing Limit Load for a Non-linear Aeroplane

The non-linear simulation may also be performed in the frequency domain if the
frequency domain method is shown to produce conservative results. Frequency domain

Annex to ED Decision 2023/021/R Page 224 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

methods include, but are not limited to, Matched Filter Theory and Equivalent
Linearisation.
9. ANALYTICAL MODEL VALIDATION
a. General. The intent of analytical model validation is to establish that the analytical model
is adequate for the prediction of gust response loads. The following paragraphs discuss
acceptable but not the only methods of validating the analytical model. In general, it is
not intended that specific testing be required to validate the dynamic gust loads model.
b. Structural Dynamic Model Validation. The methods and test data used to validate the
flutter analysis models presented in AMC 25.629 should also be applied to validate the
gust analysis models. These procedures are addressed in AMC 25.629.
c. Damping Model Validation. In the absence of better information it will normally be
acceptable to assume 0.03 (i.e. 1.5% equivalent critical viscous damping) for all flexible
modes. Structural damping may be increased over the 0.03 value to be consistent with
the high structural response levels caused by extreme gust intensity, provided
justification is given.
d. Aerodynamic Model Validation. Aerodynamic modelling parameters fall into two
categories:
(i) steady or quasi-steady aerodynamics governing static aeroelastic and flight
dynamic airload distributions
(ii) unsteady aerodynamics which interact with the flexible modes of the aeroplane.
Flight stability aerodynamic distributions and derivatives may be validated by wind tunnel
tests, detailed aerodynamic modelling methods (such as CFD) or flight test data. If
detailed analysis or testing reveals that flight dynamic characteristics of the aeroplane
differ significantly from those to which the gust response model have been matched, then
the implications on gust loads should be investigated.
The analytical and experimental methods presented in AMC 25.629 for flutter analyses
provide acceptable means for establishing reliable unsteady aerodynamic characteristics
both for motion response and gust excitation aerodynamic force distributions. The
aeroelastic implications on aeroplane flight dynamic stability should also be assessed.
e. Control System Validation. If the aeroplane mathematical model used for gust analysis
contains a representation of any feedback control system, then this segment of the model
should be validated. The level of validation that should be performed depends on the
complexity of the system and the particular aeroplane response parameter being
controlled. Systems which control elastic modes of the aeroplane may require more
validation than those which control the aeroplane rigid body response. Validation of
elements of the control system (sensors, actuators, anti-aliasing filters, control laws, etc.)
which have a minimal effect on the output load and response quantities under
consideration can be neglected.
It will normally be more convenient to substantiate elements of the control system
independently, i.e. open loop, before undertaking the validation of the closed loop
system.
(1) System Rig or Aeroplane Ground Testing. Response of the system to artificial
stimuli can be measured to verify the following:

Annex to ED Decision 2023/021/R Page 225 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

The transfer functions of the sensors and any pre-control system anti-aliasing
or other filtering.
The sampling delays of acquiring data into the control system.
The behaviour of the control law itself.
Any control system output delay and filter transfer function.
The transfer functions of the actuators, and any features of actuation system
performance characteristics that may influence the actuator response to the
maximum demands that might arise in turbulence; e.g. maximum rate of
deployment, actuator hinge moment capability, etc.
If this testing is performed, it is recommended that following any adaptation of the
model to reflect this information, the complete feedback path be validated (open
loop) against measurements taken from the rig or ground tests.
(2) Flight Testing. The functionality and performance of any feedback control system
can also be validated by direct comparison of the analytical model and
measurement for input stimuli. If this testing is performed, input stimuli should be
selected such that they exercise the features of the control system and the
interaction with the aeroplane that are significant in the use of the mathematical
model for gust load analysis. These might include:
Aeroplane response to pitching and yawing manoeuvre demands.
Control system and aeroplane response to sudden artificially introduced
demands such as pulses and steps.
Gain and phase margins determined using data acquired within the flutter test
program. These gain and phase margins can be generated by passing known
signals through the open loop system during flight test.
[Amdt No: 25/1]
[Amdt No: 25/23]

CS 25.343 Design fuel and oil loads

(a) The disposable load combinations must include each fuel and oil load in the range from zero
fuel and oil to the selected maximum fuel and oil load. A structural reserve fuel condition, not
exceeding 45 minutes of fuel under operating conditions in CS 25.1001(f), may be selected.
(b) If a structural reserve fuel condition is selected, it must be used as the minimum fuel weight
condition for showing compliance with the flight load requirements as prescribed in this
Subpart. In addition
(1) The structure must be designed for a condition of zero fuel and oil in the wing at limit
loads corresponding to
(i) A manoeuvring load factor of +2·25; and
(ii) The gust and turbulence conditions of CS 25.341, but assuming 85% of the gust
velocities prescribed in CS 25.341(a)(4) and 85% of the turbulence intensities
prescribed in CS 25.341(b)(3).
(2) Fatigue evaluation of the structure must account for any increase in operating stresses
resulting from the design condition of sub-paragraph (b)(1) of this paragraph; and

Annex to ED Decision 2023/021/R Page 226 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(3) The flutter, deformation, and vibration requirements must also be met with zero fuel.
[Amdt 25/1]

CS 25.345 High lift devices

(See AMC 25.345)
(a) If wing-flaps are to be used during take-off, approach, or landing, at the design flap speeds
established for these stages of flight under CS 25.335(e) and with the wing-flaps in the
corresponding positions, the aeroplane is assumed to be subjected to symmetrical manoeuvres
and gusts. The resulting limit loads must correspond to the conditions determined as follows:
(1) Manoeuvring to a positive limit load factor of 2·0; and
(2) Positive and negative gusts of 7.62 m/sec (25 ft/sec) EAS acting normal to the flight path
in level flight. Gust loads resulting on each part of the structure must be determined by
rational analysis. The analysis must take into account the unsteady aerodynamic
characteristics and rigid body motions of the aircraft. (See AMC 25.345(a).) The shape of
the gust must be as described in CS 25.341(a)(2) except that
Uds = 7.62 m/sec (25 ft/sec) EAS;
H = 12.5 c; and
c = mean geometric chord of the wing (metres (feet)).
(b) The aeroplane must be designed for the conditions prescribed in sub-paragraph (a) of this
paragraph except that the aeroplane load factor need not exceed 1·0, taking into account, as
separate conditions, the effects of
(1) Propeller slipstream corresponding to maximum continuous power at the design flap
speeds VF, and with take-off power at not less than 1·4 times the stalling speed for the
particular flap position and associated maximum weight; and
(2) A head-on gust of 7.62m/sec (25 fps) velocity (EAS).
(c) If flaps or other high lift devices are to be used in en-route conditions, and with flaps in the
appropriate position at speeds up to the flap design speed chosen for these conditions, the
aeroplane is assumed to be subjected to symmetrical manoeuvres and gusts within the range
determined by
(1) Manoeuvring to a positive limit load factor as prescribed in CS 25.337(b) ; and
(2) The vertical gust and turbulence conditions prescribed in CS 25.341. (See AMC 25.345(c).)
(d) The aeroplane must be designed for a manoeuvring load factor of 1.5 g at the maximum take-
off weight with the wing-flaps and similar high lift devices in the landing configurations.
[Amdt 25/1]
[Amdt 25/18]

AMC 25.345(a) High lift devices (Gust conditions)

Compliance with CS 25.345(a) may be demonstrated by an analysis in which the solution of the vertical
response equations is made by assuming the aircraft to be rigid. If desired, the analysis may take
account of the effects of structural flexibility on a quasi-flexible basis (i.e. using aerodynamic
derivatives and load distributions corresponding to the distorted structure under maximum gust load).

Annex to ED Decision 2023/021/R Page 227 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

AMC 25.345(c) High lift devices (Procedure flight condition)

1 En-route conditions are flight segments other than take-off, approach and landing. As applied
to the use of high lift devices the following flight phases are to be included in en-route
conditions:
holding in designated areas outside the terminal area of the airport, and
flight with flaps extended from top of descent.
The following flight phases are not to be included in en-route conditions:
portion of the flight corresponding to standard arrival routes preceding the interception
of the final approach path, and
holding at relatively low altitude close to the airport.
2 To apply CS 25.341(a) gust conditions to CS 25.345(c), the speeds VFC and VFD should be
determined for the flap positions selected in en-route conditions.
These procedures should ensure proper speed margins for flap retraction in the case of severe
turbulence when the aeroplane is in a low speed en-route holding configuration.
3 The manoeuvre of CS 25.345(c)(1) is to be considered as a balanced condition. (See CS 25.331(b)
for definition.)

CS 25.349 Rolling conditions

(See AMC 25.349)
The aeroplane must be designed for loads resulting from the rolling conditions specified in sub-
paragraphs (a) and (b) of this paragraph. Unbalanced aerodynamic moments about the centre of
gravity must be reacted in a rational or conservative manner, considering the principal masses
furnishing the reacting inertia forces.
(a) Manoeuvring. The following conditions, speeds, aileron deflections and cockpit roll control
motions (except as the deflections and the motions may be limited by pilot effort) must be
considered in combination with an aeroplane load factor of zero and of two-thirds of the
positive manoeuvring factor used in design. For aeroplanes equipped with electronic flight
controls, where the motion of the control surfaces does not bear a direct relationship to the
motion of the cockpit control devices, these conditions must be considered in combination with
an aeroplane load factor ranging from zero to two thirds of the positive manoeuvring factor
used in design. In determining the required or resulting aileron deflections, the torsional
flexibility of the wing must be considered in accordance with CS 25.301(b):
(1) Conditions corresponding to steady rolling velocities must be investigated. In addition,
conditions corresponding to maximum angular acceleration must be investigated for
aeroplanes with engines or other weight concentrations outboard of the fuselage, and
for aeroplanes equipped with electronic flight controls, where the motion of the control
surfaces does not bear a direct relationship to the motion of the cockpit control devices.
For the angular acceleration conditions, zero rolling velocity may be assumed in the
absence of a rational time history investigation of the manoeuvre.
(2) At VA, a sudden deflection of the aileron to the stop is assumed.
(3) At VC, the aileron deflection must be that required to produce a rate of roll not less than
that obtained in sub-paragraph (a)(2) of this paragraph.

Annex to ED Decision 2023/021/R Page 228 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(4) At VD, the aileron deflection must be that required to produce a rate of roll not less than
one-third of that in sub-paragraph (a)(2) of this paragraph.
(5) For aeroplanes equipped with electronic flight controls, where the motion of the control
surfaces does not bear a direct relationship to the motion of the cockpit control devices,
in lieu of subparagraphs (a)(2), (a)(3), and (a)(4), the following apply:
(i) At VA, movement of the cockpit roll control up to the limit is assumed. The position
of the cockpit roll control must be maintained until a steady roll rate is achieved
and then it must be returned suddenly to the neutral position.
(ii) At VC, the cockpit roll control must be moved suddenly and maintained so as to
achieve a roll rate not less than that obtained in subparagraph (a)(5)(i) of this
paragraph. The return of cockpit control to neutral is initiated suddenly when
steady roll rate is reached.
(iii) At VD, the cockpit roll control must be moved suddenly and maintained so as to
achieve a roll rate not less than one third of that obtained in subparagraph (a)(5)(i)
of this paragraph.
The conditions specified in this subparagraph must be investigated without any corrective
yaw control action (pilot or system induced) to maximise sideslip, and, as a separate
condition, with corrective yaw control action (pilot or system induced) to reduce sideslip
as far as possible. The first condition (without any corrective yaw control action) may be
considered as a failure condition under CS 25.302.
(See AMC 25.349(a))
(b) Unsymmetrical gusts. The aeroplane is assumed to be subjected to unsymmetrical vertical gusts
in level flight. The resulting limit loads must be determined from either the wing maximum
airload derived directly from CS 25.341(a), or the wing maximum airload derived indirectly from
the vertical load factor calculated from CS 25.341(a). It must be assumed that 100 percent of
the wing airload acts on one side of the aeroplane and 80 percent of the wing airload acts on
the other side.
[Amdt 25/13]
[Amdt 25/18]

AMC 25.349(a) Rolling conditions

The physical limitations of the aircraft from the cockpit roll control device to the control surface
deflection, such as control stops position, maximum power and displacement rate of the servo
controls, and control law limiters, may be taken into account.
[Amdt 25/13]

CS 25.351 Yaw manoeuvre conditions

(see AMC 25.351)
The aeroplane must be designed for loads resulting from the yaw manoeuvre conditions specified in
subparagraphs (a) through (d) of this paragraph at speeds from VMC to VD. Unbalanced aerodynamic
moments about the centre of gravity must be reacted in a rational or conservative manner considering
the aeroplane inertia forces. In computing the tail loads the yawing velocity may be assumed to be
zero.

Annex to ED Decision 2023/021/R Page 229 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(a) With the aeroplane in unaccelerated flight at zero yaw, it is assumed that the cockpit rudder
control is suddenly displaced to achieve the resulting rudder deflection, as limited by:
(1) the control system or control surface stops; or
(2) a limit pilot force of 1335 N (300 lbf) from VMC to VA and 890 N (200 lbf) from VC/MC to
VD/MD, with a linear variation between VA and VC/MC.
(b) With the cockpit rudder control deflected so as always to maintain the maximum rudder
deflection available within the limitations specified in subparagraph (a) of this paragraph, it is
assumed that the aeroplane yaws to the overswing sideslip angle.
(c) With the aeroplane yawed to the static equilibrium sideslip angle, it is assumed that the cockpit
rudder control is held so as to achieve the maximum rudder deflection available within the
limitations specified in sub-paragraph (a) of this paragraph.
(d) With the aeroplane yawed to the static equilibrium sideslip angle of sub-paragraph (c) of this
paragraph, it is assumed that the cockpit rudder control is suddenly returned to neutral.
[Amdt 25/13]

AMC 25.351 Yaw manoeuvre conditions

The physical limitations of the aircraft from the cockpit yaw control device to the control surface
deflection, such as control stops position, maximum power and displacement rate of the servo
controls, and control law limiters, may be taken into account.
[Amdt 25/13]

CS 25.353 Rudder control reversal conditions

(See AMC 25.353)
The aeroplane must be designed for loads, considered to be ultimate, resulting from the yaw
manoeuvre conditions specified in sub-paragraphs (a) through (e) at speed from VMC to VC/MC. Any
permanent deformation resulting from these ultimate load conditions must not prevent continued
safe flight and landing. These conditions are to be considered with the landing gear retracted and
speed brakes (or spoilers when used as speed brakes) retracted. Flaps (or flaperons or any other
aerodynamic devices when used as flaps) and slats-extended configurations are also to be considered
if they are used in en-route conditions. Unbalanced aerodynamic moments about the centre of gravity
must be reacted in a rational or conservative manner considering the aeroplane inertia forces. In
computing the loads on the aeroplane, the yawing velocity may be assumed to be zero. The applicant
must assume a pilot force of 890 N (200 lbf) when evaluating each of the following conditions:
(a) With the aeroplane in un-accelerated flight at zero yaw, it is assumed that the cockpit rudder
control is suddenly and fully displaced to achieve the resulting rudder deflection, as limited by
the control system or the control surface stops.
(b) With the aeroplane yawed to the overswing sideslip angle, it is assumed that the cockpit rudder
control is suddenly and fully displaced in the opposite direction to achieve the resulting rudder
deflection, as limited by the control system or the control surface stops.
(c) With the aeroplane yawed to the opposite overswing sideslip angle, it is assumed that the
cockpit rudder control is suddenly and fully displaced in the opposite direction to achieve the
resulting rudder deflection, as limited by the control system or the control surface stops.

Annex to ED Decision 2023/021/R Page 230 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(d) With the aeroplane yawed to the subsequent overswing sideslip angle, it is assumed that the
cockpit rudder control is suddenly and fully displaced in the opposite direction to achieve the
resulting rudder deflection, as limited by the control system or the control surface stops.
(e) With the aeroplane yawed to the opposite overswing sideslip angle, it is assumed that the
cockpit rudder control is suddenly returned to neutral.
[Amdt No: 25/22]

AMC 25.353 Rudder control reversal conditions

1. Purpose.
This AMC describes acceptable means of compliance with the specifications of CS 25.353. These
specifications provide structural design load conditions that apply to the airframe, and that
occur as a result of multiple cockpit rudder control (e.g. pedal) inputs.
2. Related CS-25 specifications.
a. CS 25.351, Yaw manoeuvre conditions.
b. CS 25.353, Rudder control reversal conditions.
3. Background.
a. Specifications. CS 25.351 and CS 25.353 specify structural design load conditions that
occur as a result of cockpit rudder control inputs. These conditions are intended to
encompass all of the rudder manoeuvre loads expected to occur in service.
b. Yaw manoeuvre conditions. The design load conditions specified in CS 25.351 are
considered to be limit load conditions, and a safety factor of 1.5 is applied to obtain the
ultimate loads.
c. Rudder control reversal load conditions. The design load conditions specified in this CS
25.353 are more severe than those in CS 25.351, and include cockpit rudder control
reversals. These conditions are anticipated to occur very rarely, and therefore these are
considered to be ultimate load conditions, and no additional safety factor is applied.
d. Overswing sideslip angle definition: the maximum (peak) sideslip angle reached by the
aeroplane with the cockpit rudder control displaced as specified in paragraph 4.b below.
4. Application of the specifications.
a. General
(1) The aeroplane must be designed for the cockpit rudder control reversal load
conditions specified in CS 25.353. These are considered to be ultimate load
conditions and, therefore, no additional safety factor is applied. However, any
resulting permanent deformation must not prevent continued safe flight and
landing.
(2) Design loads must be determined as specified in CS 25.321. The load conditions are
considered from VMC to VC/MC. A pilot force of 890 N (200 lbf) is assumed to be
applied for all conditions. These conditions are to be considered with the landing
gear retracted and speed brakes (or spoilers when used as speed brakes) retracted.
Flaps (or flaperons or any other aerodynamic devices when used as flaps) and slats-
extended configurations are also to be considered if they are used in en-route
conditions.

Annex to ED Decision 2023/021/R Page 231 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

(3) System effects. System effects should be taken into account in the evaluation of
this manoeuvre. For example, fly-by-wire aeroplanes should be analysed assuming
that the aeroplane is in the normal control law mode. Any system function used to
demonstrate compliance with these requirements should meet the following
criteria:
(i) The system is normally operative during flight in accordance with the
aeroplane flight manual procedures, although limited dispatch with the
system inoperative could be allowed under applicable master minimum
equipment list (MMEL) provisions, provided that the MMEL requirements
are still complied with, taking into account the rudder reversal pedal inputs
as the next critical event under dispatch configuration; and
(ii) Appropriate crew procedures should be provided in the event of a loss of
function. If a loss of system function would not be detected by the flight
crew, the probability of a loss of function (i.e. the failure rate multiplied by
the maximum exposure period) should be less than 1/1000.
(4) Failure conditions. Assuming that the systems which are used to demonstrate
compliance with CS 25.353 meet the criteria in 4.a(3)(i) and (ii) above, considering
the very low probability of a full rudder control (e.g. pedal) doublet event, failure
scenarios do not need to be addressed in combination with the rudder control
reversal load conditions specified in CS 25.353.
b. Yaw manoeuvre conditions
Conditions (a) through (e) of CS 25.353 are intended to be a full displacement cockpit
rudder control input followed by three cockpit rudder control reversals and a return to
neutral.
The aeroplane airspeed should be kept reasonably constant throughout the manoeuvre
using pitch control.
These conditions should be investigated assuming rational or conservative roll control
input (pilot or system induced).
Refer to the illustration in Figure 1 below.
(1) Rudder control input. In the context of CS 25.353 fast as
possible within human and system limitations. In the absence of a rational analysis,
the initial rudder control displacement is achieved in no more than 0.2 seconds,
and full cockpit rudder control reversal displacement is achieved in 0.4 seconds.
Alternatively, the applicant may assume that the rudder control is displaced
instantaneously. The resulting rudder displacement should take into account any
additional displacement caused by sideslip build-up, and the effects of flexibility
should be considered when relevant.
(2) Rudder control reversals. As soon as the maximum overswing yaw angle is
achieved, full opposite rudder control input is applied. The achieved rudder
deflection may be limited by control laws, system architecture, or air loads, and
may not be of the same magnitude as the initial rudder deflection prior to the
rudder control reversal. For a critically damped aeroplane response, the maximum
overswing yaw angle may be assumed to occur when the sideslip angle is
substantially stabilised.

Annex to ED Decision 2023/021/R Page 232 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FLIGHT MANOEUVRE AND GUST
CONDITIONS

Two additional rudder control reversals are performed as defined in paragraph

4.b(1) above. After the second reversal, as soon as the aeroplane yaws to the
opposite overswing yaw angle, the rudder control is suddenly returned to neutral.

Figure 1: Illustration of the cockpit rudder control inputs

[Amdt No: 25/22]

Annex to ED Decision 2023/021/R Page 233 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

SUPPLEMENTARY CONDITIONS

CS 25.361 Engine and auxiliary power unit torque

(See AMC 25.361)
(a) For engine installations:
(1) Each engine mount, pylon and adjacent supporting airframe structures must be designed
for the effects of
(i) A limit engine torque corresponding to take-off power/thrust and, if applicable,
corresponding propeller speed, acting simultaneously with 75% of the limit loads
from flight condition A of CS 25.333(b);
(ii) A limit engine torque corresponding to the maximum continuous power/thrust
and, if applicable, corresponding propeller speed acting simultaneously with the
limit loads from flight condition A of CS 25.333(b); and
(iii) For turbo-propeller installations only, in addition to the conditions specified in
subparagraphs (a)(1)(i) and (ii), a limit engine torque corresponding to take-off
power and propeller speed, multiplied by a factor accounting for propeller control
system malfunction, including quick feathering, acting simultaneously with 1 g
level flight loads. In the absence of a rational analysis, a factor of 1·6 must be used.
(2) The limit engine torque to be considered under sub-paragraph (1) must be obtained by:
(i) for turbo-propeller installations, multiplying mean engine torque for the specified
power/thrust and speed by a factor of 1·25.
(ii) for other turbine engines, the limit engine torque must be equal to the maximum
accelerating torque for the case considered.
(3) The engine mounts, pylons, and adjacent supporting airframe structure must be designed
to withstand 1g level flight loads acting simultaneously with the limit engine torque loads
imposed by each of the following conditions to be considered separately:
(i) sudden maximum engine deceleration due to a malfunction or abnormal
condition; and
(ii) the maximum acceleration of the engine.
(b) For auxiliary power unit installations:
The power unit mounts and adjacent supporting airframe structure must be designed to
withstand 1g level flight loads acting simultaneously with the limit torque loads imposed by the
following conditions to be considered separately:
(1) sudden maximum auxiliary power unit deceleration due to malfunction or abnormal
condition or structural failure; and
(2) the maximum acceleration of the auxiliary power unit.
[Amdt 25/8]

Annex to ED Decision 2023/021/R Page 234 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

AMC 25.361 Engine and auxiliary power unit torque

CS 25.361(a)(1) is applicable to all engine installations, including turbo-fans, turbo-jets and turbo-
propellers, except CS 25.361(a)(1)(iii) which applies only to turbo-propeller installations.
CS 25.361(a)(2)(i) -
with any dynamic oscillations removed.
CS 25.361(a)(3)(i) - Examples are; high power compressor surges, blade tip rub during manoeuvres,
small and medium bird encounters, or combinations of these events.
CS 25.361(a)(3)(ii) and (b)(2) -
torque seen by the engine mounts under a runaway of the fuel metering unit up to its maximum flow
stop.
[Amdt 25/8]

CS 25.362 Engine failure loads

(See AMC 25.362.)
(a) For engine mounts, pylons and adjacent supporting airframe structure, an ultimate loading
condition must be considered that combines 1g flight loads with the most critical transient
dynamic loads and vibrations, as determined by dynamic analysis, resulting from failure of a
blade, shaft, bearing or bearing support, or bird strike event. Any permanent deformation from
these ultimate load conditions should not prevent continued safe flight and landing.
(b) The ultimate loads developed from the conditions specified in paragraph (a) are to be:
(1) multiplied by a factor of 1.0 when applied to engine mounts and pylons; and
(2) multiplied by a factor of 1.25 when applied to adjacent supporting airframe structure.
[Amdt 25/8]

AMC 25.362 Engine Failure Loads

1. PURPOSE. This AMC describes an acceptable means for showing compliance with the
requirements of CS 25.362
guidance to supplement the engineering and operational judgement that must form the basis
of any compliance findings relative to the design of engine mounts, pylons and adjacent
supporting airframe structure, for loads developed from the engine failure conditions described
in CS 25.362.
2. RELATED CS PARAGRAPHS.
a. CS-25:

b. CS-E:
CS-
CS-
CS-

Annex to ED Decision 2023/021/R Page 235 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

CS-
3. DEFINITIONS. Some new terms have been defined for the transient engine failure conditions in
order to present criteria in a precise and consistent manner in the following pages. In addition,
some terms are employed from other fields and may not necessarily be in general use. For the
purposes of this AMC, the following definitions should be used.
a. Adjacent supporting airframe structure: Those parts of the primary airframe that are
directly affected by loads arising within the engine.
b. Ground Vibration Test: Ground resonance tests of the aeroplane normally conducted for
compliance with CS 25.629
c. Transient failure loads: Those loads occurring from the time of the engine structural
failure, up to the time at which the engine stops rotating or achieves a steady windmilling
rotational speed.
d. Windmilling engine rotational speed: The speed at which the rotating shaft systems of an
unpowered engine will rotate due to the flow of air into the engine as a result of the
forward motion of the aeroplane.
4. BACKGROUND.
a. Requirements. CS 25.362
pylons, and adjacent supporting airframe structure be designed to withstand 1g flight
loads combined with the transient dynamic loads resulting from each engine structural
failure condition. The aim being to ensure that the aeroplane is capable of continued safe
flight and landing after sudden engine stoppage or engine structural failure, including
ensuing damage to other parts of the engine.
b. Engine failure loads. Turbine engines have experienced failure conditions that have
resulted in sudden engine deceleration and, in some cases, seizures. These failure
conditions are usually caused by internal structural failures or ingestion of foreign
objects, such as birds or ice. Whatever the source, these conditions may produce
significant structural loads on the engine, engine mounts, pylon, and adjacent supporting
airframe structure. With the development of larger high-bypass ratio turbine engines, it
became apparent that engine seizure torque loads alone did not adequately define the
full loading imposed on the engine mounts, pylons, and adjacent supporting airframe
structure. The progression to high-bypass ratio turbine engines of larger diameter and
fewer blades with larger chords has increased the magnitude of the transient loads that
can be produced during and following engine failures. Consequently, it is considered
necessary that the applicant performs a dynamic analysis to ensure that representative
loads are determined during and immediately following an engine failure event.
A dynamic model of the aircraft and engine configuration should be sufficiently detailed
to characterise the transient loads for the engine mounts, pylons, and adjacent
supporting airframe structure during the failure event and subsequent run down.
c. Engine structural failure conditions. Of all the applicable engine structural failure
conditions, design and test experience have shown that the loss of a fan blade is likely to
produce the most severe loads on the engine and airframe. Therefore, CS 25.362 requires
that the transient dynamic loads from these blade failure conditions be considered when
evaluating structural integrity of the engine mounts, pylons and adjacent supporting
airframe structure. However, service history shows examples of other severe engine
structural failures where the engine thrust-producing capability was lost, and the engine
experienced extensive internal damage. For each specific engine design, the applicant

Annex to ED Decision 2023/021/R Page 236 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

should consider whether these types of failures are applicable, and if they present a more
critical load condition than blade loss. In accordance with CS-E 520(c)(2), other structural
failure conditions that should be considered in this respect are:
failure of a shaft, or
failure or loss of any bearing/bearing support, or
a bird ingestion.
5. EVALUATION OF TRANSIENT FAILURE CONDITIONS
a.
structural failure and during spool-down to the time of windmilling engine rotational
speed, the engine-induced loads and vibrations will not cause failure of the engine
mounts, pylon, and adjacent supporting airframe structure. (Note: The effects of
continued rotation (windmilling) are described in AMC 25-24).
Major engine structural failure events are considered as ultimate load conditions, since
they occur at a sufficiently infrequent rate. For design of the engine mounts and pylon,
the ultimate loads may be taken without any additional multiplying factors. At the same
time, protection of the basic airframe is assured by using a multiplying factor of 1.25 on
those ultimate loads for the design of the adjacent supporting airframe structure.
b. Blade loss condition. The loads on the engine mounts, pylon, and adjacent supporting
airframe structure should be determined by dynamic analysis. The analysis should take
into account all significant structural degrees of freedom. The transient engine loads
should be determined for the blade failure condition and rotor speed approved per CS-E,
and over the full range of blade release angles to allow determination of the critical loads
for all affected components.
The loads to be applied to the pylon and airframe are normally determined by the
applicant based on the integrated model, which includes the validated engine model
supplied by the engine manufacturer.
The calculation of transient dynamic loads should consider:
the effects of the engine mounting station on the aeroplane (i.e., right side, left side,
inboard position, etc.); and
the most critical aeroplane mass distribution (i.e., fuel loading for wing-mounted
engines and payload distribution for fuselage-mounted engines).
For calculation of the combined ultimate airframe loads, the 1g component should be
associated with typical flight conditions.
c. Other failure conditions. As identified in paragraph 4(c) above, if any other engine
structural failure conditions, applicable to the specific engine design, could result in
higher loads being developed than the blade loss condition, they should be evaluated by
dynamic analysis to a similar standard and using similar considerations to those described
in paragraph 5.b., above.
6. ANALYSIS METHODOLOGY.
a. Objective of the methodology. The objective of the analysis methodology is to develop
acceptable analytical tools for conducting investigations of dynamic engine structural
failure events. The goal of the analysis is to produce loads and accelerations suitable for
evaluations of structural integrity. However, where required for compliance with

Annex to ED Decision 2023/021/R Page 237 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

CS 25.901
produced for evaluating the continued function of aircraft systems, including those
related to the engine installation that are essential for immediate flight safety (for
example, fire bottles and fuel shut off valves).
b. Scope of the analysis. The analysis of the aircraft and engine configuration should be
sufficiently detailed to determine the transient and steady-state loads for the engine
mounts, pylon, and adjacent supporting airframe structure during the engine failure
event and subsequent run-down.
7. MATHEMATICAL MODELLING AND VALIDATION
a. Components of the integrated dynamics model. The applicant should calculate airframe
dynamic responses with an integrated model of the engine, engine mounts, pylon, and
adjacent supporting airframe structure. The model should provide representative
connections at the engine-to-pylon interfaces, as well as all interfaces between
components (e.g., inlet-to-engine and engine-to-thrust reverser). The integrated dynamic
model used for engine structural failure analyses should be representative of the
aeroplane to the highest frequency needed to accurately represent the transient
response. The integrated dynamic model consists of the following components that must
be validated:
Airframe structural model.
Propulsion structural model (including the engine model representing the engine
type-design).
b. Airframe Structural Model and Validation
(1) An analytical model of the airframe is necessary in order to calculate the airframe
responses due to the transient forces produced by the engine failure event. The
airframe manufacturers currently use reduced lumped mass finite element
analytical models of the airframe for certification of aeroelastic stability (flutter)
and dynamic loads. A typical model consists of relatively few lumped masses
connected by weightless beams. A full aeroplane model is not usually necessary for
the engine failure analysis, and it is normally not necessary to consider the whole
aircraft response, the effects of automatic flight control systems, or unsteady
aerodynamics.
(2) A lumped mass beam model of the airframe, similar to that normally used for
flutter analysis, is acceptable for frequency response analyses due to engine
structural failure conditions. However, additional detail may be needed to ensure
adequate fidelity for the engine structural failure frequency range. In particular,
the engine structural failure analysis requires calculating the response of the
airframe at higher frequencies than are usually needed to obtain accurate results
for the other loads analyses, such as dynamic gust and landing impact. The
applicant should use finite element models as necessary. As far as possible, the
ground vibration tests normally conducted for compliance with CS 25.629

model.
(3) Structural dynamic models include damping properties, as well as representations
of mass and stiffness distributions. In the absence of better information, it will
normally be acceptable to assume a value of 0.03 (i.e., 1.5% equivalent critical
viscous damping) for all flexible modes. Structural damping may be increased over

Annex to ED Decision 2023/021/R Page 238 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

the 0.03 value to be consistent with the high structural response levels caused by
extreme failure loads, provided it is justified.
c. Propulsion Structural Model and Validation
For propulsion structural model and validation, see AMC 25-24.
[Amdt 25/8]

CS 25.363 Side load on engine and auxiliary power unit mounts

(a) Each engine and auxiliary power unit mount and its supporting structure must be designed for
a limit load factor in a lateral direction, for the side load on the engine and auxiliary power unit
mount, at least equal to the maximum load factor obtained in the yawing conditions but not
less than
(1) 1·33; or
(2) One-third of the limit load factor for flight condition A as prescribed in CS 25.333(b).
(b) The side load prescribed in sub-paragraph (a) of this paragraph may be assumed to be
independent of other flight conditions.

CS 25.365 Pressurised compartment loads

(See AMC 25.365)
For aeroplanes with one or more pressurised compartments the following apply:
(a) The aeroplane structure must be strong enough to withstand the flight loads combined with
pressure differential loads from zero up to the maximum relief valve setting.
(b) The external pressure distribution in flight, and stress concentrations and fatigue effects must
be accounted for.
(c) If landings may be made with the compartment pressurised, landing loads must be combined
with pressure differential loads from zero up to the maximum allowed during landing.
(d) The aeroplane structure must be strong enough to withstand the pressure differential loads
corresponding to the maximum relief valve setting multiplied by a factor of 1·33, omitting other
loads.
(e) Any structure, component or part, inside or outside a pressurised compartment, the failure of
which could interfere with continued safe flight and landing, must be designed to withstand the
effects of a sudden release of pressure through an opening in any compartment at any
operating altitude resulting from each of the following conditions:
(1) The penetration of the compartment by a portion of an engine following an engine
disintegration.
(2) Any opening in any pressurised compartment up to the size Ho in square feet; however,
small compartments may be combined with an adjacent pressurised compartment and
both considered as a single compartment for openings that cannot reasonably be
expected to be confined to the small compartment. The size Ho must be computed by
the following formula:

where,

Annex to ED Decision 2023/021/R Page 239 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

Ho = maximum opening in square feet, need not exceed 20 square feet.

P =
As = maximum cross sectional area of the pressurised shell normal to the longitudinal
axis, in square feet; and
(3) The maximum opening caused by aeroplane or equipment failures not shown to be
extremely improbable. (See AMC 25.365(e).)
(f) In complying with sub-paragraph (e) of this paragraph, the fail-safe features of the design may
be considered in determining the probability of failure or penetration and probable size of
openings, provided that possible improper operation of closure devices and inadvertent door
openings are also considered. Furthermore, the resulting differential pressure loads must be
combined in a rational and conservative manner with 1 g level flight loads and any loads arising
from emergency depressurisation conditions. These loads may be considered as ultimate
conditions; however, any deformation associated with these conditions must not interfere with
continued safe flight and landing. The pressure relief provided by the intercompartment venting
may also be considered.
(g) Bulkheads, floors, and partitions in pressurised compartments for occupants must be designed
to withstand conditions specified in sub-paragraph (e) of this paragraph. In addition, reasonable
design precautions must be taken to minimise the probability of parts becoming detached and
injuring occupants while in their seats.
[Amdt 25/18]

AMC 25.365(e) Pressurised compartment loads

The computed opening size from 25.365(e)(2) should be considered only as a mathematical means of
developing ultimate pressure design loads to prevent secondary structural failures. No consideration
need be given to the actual shape of the opening, nor to its exact location on the pressure barrier in
the compartment. The damage and loss of strength at the opening location should not be considered.
A hazard assessment should determine which structures should be required to withstand the resulting
differential pressure loads. The assessment of the secondary consequences of failures of these
structures should address those events that have a reasonable probability of interfering with safe
flight and landing, for example failures of structures supporting critical systems. For this assessment
the risk of impact on the main structure from non critical structures, such as fairings, detached from
the aircraft due to decompression need not be considered.

CS 25.367 Unsymmetrical loads due to engine failure

(a) The aeroplane must be designed for the unsymmetrical loads resulting from the failure of the
critical engine. Turbo-propeller aeroplanes must be designed for the following conditions in
combination with a single malfunction of the propeller drag limiting system, considering the
probable pilot corrective action on the flight controls:
(1) At speeds between VMC and VD, the loads resulting from power failure because of fuel
flow interruption are considered to be limit loads.
(2) At speeds between VMC and VC, the loads resulting from the disconnection of the engine
compressor from the turbine or from loss of the turbine blades are considered to be
ultimate loads.

Annex to ED Decision 2023/021/R Page 240 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
SUPPLEMENTARY CONDITIONS

(3) The time history of the thrust decay and drag build-up occurring as a result of the
prescribed engine failures must be substantiated by test or other data applicable to the
particular engine-propeller combination.
(4) The timing and magnitude of the probable pilot corrective action must be conservatively
estimated, considering the characteristics of the particular engine-propeller-aeroplane
combination.
(b) Pilot corrective action may be assumed to be initiated at the time maximum yawing velocity is
reached, but not earlier than two seconds after the engine failure. The magnitude of the
corrective action may be based on the control forces specified in CS 25.397(b) except that lower
forces may be assumed where it is shown by analysis or test that these forces can control the
yaw and roll resulting from the prescribed engine failure conditions.

CS 25.371 Gyroscopic loads

The structure supporting any engine or auxiliary power unit must be designed for the loads, including
gyroscopic loads, arising from the conditions specified in CS 25.331, CS 25.341, CS 25.349, CS 25.351,
CS 25.473, CS 25.479, and CS 25.481, with the engine or auxiliary power unit at the maximum rpm
appropriate to the condition. For the purposes of compliance with this paragraph, the pitch
manoeuvre in CS 25.331(c)(1) must be carried out until the positive limit manoeuvring load factor
(point A2 in CS 25.333(b)) is reached.
[Amdt 25/1]

CS 25.373 Speed control devices

If speed control devices (such as spoilers and drag flaps) are installed for use in en-route conditions:
(a) The aeroplane must be designed for the symmetrical manoeuvres and gusts prescribed in
CS 25.333, CS 25.337, the yawing manoeuvres in CS 25.351, and the vertical and lateral gust and
turbulence conditions prescribed in CS 25.341(a) and (b) at each setting and the maximum
speed associated with that setting; and
(b) If the device has automatic operating or load limiting features, the aeroplane must be designed
for the manoeuvre and gust conditions prescribed in sub-paragraph (a) of this paragraph, at the
speeds and corresponding device positions that the mechanism allows.
[Amdt 25/1]

Annex to ED Decision 2023/021/R Page 241 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

CONTROL SURFACE AND SYSTEM LOADS

CS 25.391 Control surface loads: general

The control surfaces must be designed for the limit loads resulting from the flight conditions in
CS 25.331, CS 25.341(a) and (b), CS 25.349 and CS 25.351, considering the requirements for:
(a) Loads parallel to hinge line, in CS 25.393;
(b) Pilot effort effects, in CS 25.397;
(c) Trim tab effects, in CS 25.407;
(d) Unsymmetrical loads, in CS 25.427; and
(e) Auxiliary aerodynamic surfaces, in CS 25.445.
[Amdt 25/1]

CS 25.393 Loads parallel to hinge line

(See AMC 25.393)
(a) Control surfaces and supporting hinge brackets must be designed for inertia loads acting parallel
to the hinge line. (See AMC 25.393(a).)
(b) In the absence of more rational data, the inertia loads may be assumed to be equal to KW,
where
(1) K = 24 for vertical surfaces;
(2) K = 12 for horizontal surfaces; and
(3) W = weight of the movable surfaces.
[Amdt 25/18]

AMC 25.393(a) Loads parallel to hinge line

The loads parallel to the hinge line on primary control surfaces and other movable surfaces, such as
tabs, spoilers, speedbrakes, flaps, slats and all-moving tailplanes, should take account of axial play
between the surface and its supporting structure in complying with CS 25.393(a). For the rational
analysis, the critical airframe acceleration time history in the direction of the hinge line from all flight
and ground design conditions (except the emergency landing conditions of CS 25.561) should be
considered. The play assumed in the control surface supporting structure, should include the
maximum tolerable nominal play and the effects of wear.

CS 25.395 Control system

(a) Longitudinal, lateral, directional and drag control systems and their supporting structures must
be designed for loads corresponding to 125% of the computed hinge moments of the movable
control surface in the conditions prescribed in CS 25.391.
(b) The system limit loads of paragraph (a) need not exceed the loads that can be produced by the
pilot (or pilots) and by automatic or power devices operating the controls.

Annex to ED Decision 2023/021/R Page 242 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

(c) The loads must not be less than those resulting from application of the minimum forces
prescribed in CS 25.397(c).

CS 25.397 Control system loads

(a) General. The maximum and minimum pilot forces, specified in sub-paragraph (c) of this
paragraph, are assumed to act at the appropriate control grips or pads (in a manner simulating
flight conditions) and to be reacted at the attachment of the control system to the control
surface horn.
(b) Pilot effort effects. In the control surface flight loading condition, the air loads on movable
surfaces and the corresponding deflections need not exceed those that would result in flight
from the application of any pilot force within the ranges specified in sub-paragraph (c) of this
paragraph. Two-thirds of the maximum values specified for the aileron and elevator may be
used if control surface hinge moments are based on reliable data. In applying this criterion, the
effects of servo mechanisms, tabs, and automatic pilot systems, must be considered.
(c) Limit pilot forces and torques. The limit pilot forces and torques are as follows:
Control Maximum forces or torques Minimum forces or torques
Aileron:
Stick 445 N (100 lbf) 178 N (40 lbf)
Wheel* 356 DNm (80 D in.lb)** 178 DNm (40 D in.lbf)
Elevator:
Stick 1112 N (250 lbf) 445 N (100 lbf)
Wheel (symmetrical) 1335N(300 lbf) 445 N(100 lbf)
445 N (100 lbf)
Rudder 1335 N (300 lbf) 578 N 130 lbf
*The critical parts of the aileron control system must be designed for a single tangential force with a limit
value equal to 1·25 times the couple force determined from these criteria.
**D = wheel diameter in m (inches)
applied at one of the normal handgrip points on the periphery of the
control wheel.
(d) For aeroplanes equipped with side stick controls, designed for forces to be applied by one wrist
and not by the arms, the limit pilot forces are as follows:
(1) For all components between and including the handle and its control stops:
PITCH ROLL
Nose Up 890 N (200 lbf) Roll Left 445 N (100lbf)
Nose Down 890 N (200 lbf) Roll Right 445 N (100 lbf)

(2) For all other components of the side stick control assembly, but excluding the internal
components of the electrical sensor assemblies, to avoid damage as a result of an in-flight
jam:
PITCH ROLL
Nose Up 556 N (125 lbf) Roll Left 222 N (50 lbf)
Nose Down 556 N (125 lbf) Roll Right 222 N (50 lbf)
[Amdt 25/13]
[Amdt 25/18]

Annex to ED Decision 2023/021/R Page 243 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

CS 25.399 Dual control system

(a) Each dual control system must be designed for the pilots operating in opposition, using
individual pilot forces not less than
(1) 0·75 times those obtained under CS 25.395; or
(2) The minimum forces specified in CS 25.397(c).
(b) The control system must be designed for pilot forces applied in the same direction, using
individual pilot forces not less than 0·75 times those obtained under CS 25.395.
[Amdt 25/2]

CS 25.405 Secondary control system

Secondary controls, such as wheel brake, spoiler, and tab controls, must be designed for the maximum
forces that a pilot is likely to apply to those controls. The following values may be used:
PILOT CONTROL FORCE LIMITS (SECONDARY CONTROLS).

Control Limit pilot forces

Miscellaneous:
*Crank, wheel, or lever.
but not less than 222 N (50 lbf) nor more than 667 N (150 lbf) (R = radius in
mm).
(Applicable to any angle within 20o of plane of control).
Twist 15 Nm (133 in.lbf)
Push-pull To be chosen by applicant.
*Limited to flap, tab, stabiliser, spoiler, and landing gear operation controls.
[Amdt. 25/3]

CS 25.407 Trim tab effects

The effects of trim tabs on the control surface design conditions must be accounted for only where
the surface loads are limited by maximum pilot effort. In these cases, the tabs are considered to be
deflected in the direction that would assist the pilot, and the deflections are
(a) For elevator trim tabs, those required to trim the aeroplane at any point within the positive
portion of the pertinent flight envelope in CS 25.333(b), except as limited by the stops; and
(b) For aileron and rudder trim tabs, those required to trim the aeroplane in the critical
unsymmetrical power and loading conditions, with appropriate allowance for rigging
tolerances.

CS 25.409 Tabs
(a) Trim tabs. Trim tabs must be designed to withstand loads arising from all likely combinations of
tab setting, primary control position, and aeroplane speed (obtainable without exceeding the
flight load conditions prescribed for the aeroplane as a whole), when the effect of the tab is
opposed by pilot effort forces up to those specified in CS 25.397(b).
(b) Balancing tabs. Balancing tabs must be designed for deflections consistent with the primary
control surface loading conditions.

Annex to ED Decision 2023/021/R Page 244 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

(c) Servo tabs. Servo tabs must be designed for deflections consistent with the primary control
surface loading conditions obtainable within the pilot manoeuvring effort, considering possible
opposition from the trim tabs.

CS 25.415 Ground gust conditions

(See AMC 25.415)
(a) The flight control systems and surfaces must be designed for the limit loads generated when
the aircraft is subjected to a horizontal 33.44 m/sec (65 knots) ground gust from any direction,
while taxying with the controls locked and unlocked and while parked with the controls locked.
(b) The control system and surface loads due to ground gust may be assumed to be static loads and
the hinge moments H, in Newton metres (foot pounds), must be computed from the formula:

where:
K = hinge moment factor for ground gusts derived in subparagraph (c) of this paragraph
o = density of air at sea level = 1.225 (kg/m3) (0.0023769 (slugs/ft3) = 0.0023769 (lb-sec2/ ft4))
V = 33.44 m/sec (65 knots = 109.71 fps) relative to the aircraft
S = area of the control surface aft of the hinge line (m2) (ft2)
c = mean aerodynamic chord of the control surface aft of the hinge line (m) (ft)
(c) The hinge moment factor K for ground gusts must be taken from the following table:
Surface K Position of controls
(a) Aileron 0.75 Control column locked or lashed in mid-position.
(b) Aileron *±0.50 Ailerons at full throw.
(c) Elevator *±0.75 Elevator full down.
(d) Elevator *±0.75 Elevator full up.
(e) Rudder 0.75 Rudder in neutral.
(f) Rudder 0.75 Rudder at full throw.
* A positive value of K indicates a moment tending to depress the surface, while a negative value of K
indicates a moment tending to raise the surface.
(d) The computed hinge moment of subparagraph (b) must be used to determine the limit loads
due to ground gust conditions for the control surface. A 1.25 factor on the computed hinge
moments must be used in calculating limit control system loads.
(e) Where control system flexibility is such that the rate of load application in the ground gust
conditions might produce transient stresses appreciably higher than those corresponding to
static loads, in the absence of a rational analysis an additional factor of 1.60 must be applied to
the control system loads of subparagraph (d) to obtain limit loads. If a rational analysis is used,
the additional factor must not be less than 1.20.
(f) For the condition of the control locks engaged, the control surfaces, the control system locks
and the parts of the control systems (if any) between the surfaces and the locks must be
designed to the respective resultant limit loads. Where control locks are not provided then the
control surfaces, the control system stops nearest the surfaces and the parts of the control
systems (if any) between the surfaces and the stops must be designed to the resultant limit
loads. If the control system design is such as to allow any part of the control system to impact

Annex to ED Decision 2023/021/R Page 245 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

with the stops due to flexibility, then the resultant impact loads must be taken into account in
deriving the limit loads due to ground gust.
(g) For the condition of taxying with the control locks disengaged, the following apply:
(1) The control surfaces, the control system stops nearest the surfaces and the parts of the
control systems (if any) between the surfaces and the stops must be designed to the
resultant limit loads.
(2) The parts of the control systems between the stops nearest the surfaces and the cockpit
controls must be designed to the resultant limit loads, except that the parts of the control
system where loads are eventually reacted by the pilot need not exceed:
(i) The loads corresponding to the maximum pilot loads in CS 25.397(c) for each pilot
alone; or
(ii) 0.75 times these maximum loads for each pilot when the pilot forces are applied
in the same direction
[Amdt 25/18]

AMC 25.415 Ground gust conditions

1. PURPOSE. This AMC sets forth acceptable methods of compliance with the provisions of CS-25
dealing with the certification requirements for ground gust conditions. Guidance information is
provided for showing compliance with CS 25.415, relating to structural design of the control
surfaces and systems while taxying with control locks engaged and disengaged and when
parked with control locks engaged. Other methods of compliance with the requirements may
be acceptable.
2. RELATED CERTIFICATION SPECIFICATIONS.
CS 25.415
CS 25.519 -
3. BACKGROUND.
a. The requirement to consider the effects of ground gusts has been applied to
large/transport aeroplanes since 1950. The purpose of the requirement was to protect
the flight control system from excessive peak ground wind loads while the aeroplane is
parked or while taxying downwind. For developing the original regulation, the control
surface load distribution was considered to be triangular with the peak at the trailing
edge representing reversed flow over the control surface. This assumption, along with
assumptions about the wind approach angle and typical control surface geometries were
developed into a table of hinge moment factors and set forth in the regulation. These
hinge moment factors have been carried forward to the existing table in CS 25.415. The
maximum design wind speed was originally set at 96 km/h (88 feet per second (52 knots))
under the presumption that higher speeds were predictable storm conditions and the
aircraft owner could take additional precautions beyond engaging the standard gust
locks.
b. The conditions of CS 25.519 require consideration of the aeroplane in a moored or jacked
condition in wind speeds up to 120 km/h (65 knots). In order to be consistent in the
treatment of ground winds, the wind speeds prescribed by CS 25.415, concerning ground
gust conditions on control surfaces, was increased to 120 km/h (65 knots) at Change 15
of JAR-25.

Annex to ED Decision 2023/021/R Page 246 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

c. There have been several incidents and accidents caused by hidden damage that had
previously occurred in ground gust conditions. Although many of these events were for
aeroplanes that had used the lower wind speeds from the earlier rules, analysis indicates
that the most significant contributor to the damage was the dynamic load effect. The
dynamic effects were most significant for control system designs in which the gust locks
were designed to engage the control system at locations far from the control surface
horn. Based on these events additional factors are defined for use in those portions of
the system and surface that could be affected by dynamic effects.
d. The flight control system and surface loads prescribed by CS 25.415 are limit loads based
on a peak wind speed of 120 km/h (65 knots) EAS. In operation, the peak wind speed
would most often be caused by an incremental fluctuation in velocity imposed on top of
a less rapidly changing mean wind speed. Therefore, an appropriate peak wind speed
limitation should be reflected in the applicable documents, when there is a potential risk
of structural damage.
4. COMPLIANCE.
a. The ground gust requirements take into account the conditions of the aeroplane parked
with controls locked, and taxying with controls either locked or unlocked. In either of the
locked conditions the control surface loads are assumed to be reacted at the control
system locks. In the unlocked condition the pilot is assumed to be at the controls and the
controls are assumed to be powered, if applicable. In the latter condition, the control
surface loads are assumed to be reacted, if necessary, at the cockpit controls by the
pilot(s) up to the limits of the maximum pilot forces and torques given in CS 25.397(c).
b. Where loads are eventually reacted at the cockpit controls, the loads in those parts of the
control system between the control system stops nearest the control surfaces and the
cockpit controls need not exceed those that would result from the application of the
specified maximum pilot effort effects. However, higher loads can be reacted by the
control system stops. Those parts of the control system from the control surfaces to the
control system stops nearest the surfaces should be designed to the resultant limit loads
including dynamic effects, if applicable, and regardless of pilot effort limitations.
Similarly, pilot effort limitations would not apply to parts of control systems where the
loads are not eventually reacted at the cockpit controls, for example an aileron control
system where the right hand side aileron loads are reacted by the left hand side aileron,
without participation by the pilot(s).
c. In either the taxying condition (controls locked or unlocked) or the parked condition
(controls locked), if the control system flexibility is such that the rate of load application
in the ground gust conditions might produce transient stresses appreciably higher than
those corresponding to static loads, the effects of this rate of application are required to
be considered. Manually powered control systems and control systems where the gust
lock is located remotely from the control surface are examples of designs that might fall
in this category. In such cases the control system loads are required by CS 25.415(e) to
be increased by an additional factor over the standard factor of 1.25.
[Amdt 25/2]

CS 25.427 Unsymmetrical loads

(a) In designing the aeroplane for lateral gust, yaw manoeuvre and roll manoeuvre conditions,
account must be taken of unsymmetrical loads on the empennage arising from effects such as

Annex to ED Decision 2023/021/R Page 247 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
CONTROL SURFACE AND SYSTEM LOADS

slipstream and aerodynamic interference with the wing, vertical fin and other aerodynamic
surfaces.
(b) The horizontal tail must be assumed to be subjected to unsymmetrical loading conditions
determined as follows:
(1) 100% of the maximum loading from the symmetrical manoeuvre conditions of CS 25.331
and the vertical gust conditions of CS 25.341(a) acting separately on the surface on one
side of the plane of symmetry; and
(2) 80% of these loadings acting on the other side.
(c) For empennage arrangements where the horizontal tail surfaces have dihedral angles greater
than plus or minus 10 degrees, or are supported by the vertical tail surfaces, the surfaces and
the supporting structure must be designed for gust velocities specified in CS 25.341(a) acting in
any orientation at right angles to the flight path.
(d) Unsymmetrical loading on the empennage arising from buffet conditions of CS 25.305(e) must
be taken into account.
[Amdt 25/1]

CS 25.445 Outboard fins

(a) When significant, the aerodynamic influence between auxiliary aerodynamic surfaces, such as
outboard fins and winglets, and their supporting aerodynamic surfaces must be taken into
account for all loading conditions including pitch, roll and yaw manoeuvres, and gusts as
specified in CS 25.341(a) acting at any orientation at right angles to the flight path.
(b) To provide for unsymmetrical loading when outboard fins extend above and below the
horizontal surface, the critical vertical surface loading (load per unit area) determined under
CS 25.391 must also be applied as follows:
(1) 100% to the area of the vertical surfaces above (or below) the horizontal surface.
(2) 80% to the area below (or above) the horizontal surface.

CS 25.457 Wing-flaps
Wing flaps, their operating mechanisms, and their supporting structures must be designed for critical
loads occurring in the conditions prescribed in CS 25.345, accounting for the loads occurring during
transition from one wing-flap position and airspeed to another.

CS 25.459 Special devices

The loading for special devices using aero-dynamic surfaces (such as slots, slats and spoilers) must be
determined from test data.

Annex to ED Decision 2023/021/R Page 248 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

GROUND LOADS

CS 25.471 General
(a) Loads and equilibrium. For limit ground loads
(1) Limit ground loads obtained under this Subpart are considered to be external forces
applied to the aeroplane structure; and
(2) In each specified ground load condition, the external loads must be placed in equilibrium
with the linear and angular inertia loads in a rational or conservative manner.
(b) Critical centres of gravity. The critical centres of gravity within the range for which certification
is requested must be selected so that the maximum design loads are obtained in each landing
gear element. Fore and aft, vertical, and lateral aeroplane centres of gravity must be considered.
Lateral displacements of the centre of gravity from the aeroplane centreline which would result
in main gear loads not greater than 103% of the critical design load for symmetrical loading
conditions may be selected without considering the effects of these lateral centre of gravity
displacements on the loading of the main gear elements, or on the aeroplane structure
provided
(1) The lateral displacement of the centre of gravity results from random passenger or cargo
disposition within the fuselage or from random unsymmetrical fuel loading or fuel usage;
and
(2) Appropriate loading instructions for random disposable loads are included under the
provisions of CS 25.1583(c)(1) to ensure that the lateral displacement of the centre of
gravity is maintained within these limits.
(c) Landing gear dimension data. Figure 1 of Appendix A contains the basic landing gear dimension
data.

CS 25.473 Landing load conditions and assumptions

(a)For the landing conditions specified in CS 25.479 to 25.485, the aeroplane is assumed to contact
the ground:
(1) In the attitudes defined in CS 25.479 and CS 25.481.
(2) With a limit descent velocity of 3·05 m/sec (10 fps) at the design landing weight (the
maximum weight for landing conditions at maximum descent velocity); and
(3) With a limit descent velocity of 1·83 m/sec (6 fps) at the design take-off weight (the
maximum weight for landing conditions at a reduced descent velocity).
(4) The prescribed descent velocities may be modified if it is shown that the aeroplane has
design features that make it impossible to develop these velocities.
(b) Aeroplane lift, not exceeding aeroplane weight, may be assumed, unless the presence of
systems or procedures significantly affects the lift.
(c) The method of analysis of aeroplane and landing gear loads must take into account at least the
following elements:
(1) Landing gear dynamic characteristics.
(2) Spin-up and spring back.

Annex to ED Decision 2023/021/R Page 249 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(3) Rigid body response.

(4) Structural dynamic response of the airframe, if significant.
(d) The landing gear dynamic characteristics must be validated by tests as defined in CS 25.723(a).
(e) The coefficient of friction between the tyres and the ground may be established by considering
the effects of skidding velocity and tyre pressure. However, this coefficient of friction need not
be more than 0·8.

CS 25.477 Landing gear arrangement

CS 25.479 to 25.485 apply to aeroplanes with conventional arrangements of main and nose gears, or
main and tail gears, when normal operating techniques are used.

CS 25.479 Level landing conditions

(a) In the level attitude, the aeroplane is assumed to contact the ground at forward velocity
components, ranging from VL1 to 1·25 VL2 parallel to the ground under the conditions prescribed
in CS 25.473 with:
(1) VL1 equal to VS0(TAS) at the appropriate landing weight and in standard sea-level
conditions; and
(2) VL2, equal to VS0(TAS) at the appropriate landing weight and altitudes in a hot day
temperature of 22.8°C (41°F) above standard.
(3) The effects of increased contact speed must be investigated if approval of downwind
landings exceeding 19 km/h (10 knots) is requested.
(b) For the level landing attitude for aeroplanes with tail wheels, the conditions specified in this
paragraph must be investigated with the aeroplane horizontal reference line horizontal in
accordance with Figure 2 of Appendix A of CS-25.
(c) For the level landing attitude for aeroplanes with nose wheels, shown in Figure 2 of Appendix A
of CS-25, the conditions specified in this paragraph must be investigated assuming the following
attitudes:
(1) An attitude in which the main wheels are assumed to contact the ground with the nose
wheel just clear of the ground; and
(2) If reasonably attainable at the specified descent and forward velocities an attitude in
which the nose and main wheels are assumed to contact the ground simultaneously.
(d) In addition to the loading conditions prescribed in sub-paragraph (a) of this paragraph, but with
maximum vertical ground reactions calculated from paragraph (a), the following apply:
(1) The landing gear and directly affected structure must be designed for the maximum
vertical ground reaction combined with an aft acting drag component of not less than
25% of this maximum vertical ground reaction.
(2) The most severe combination of loads that are likely to arise during a lateral drift landing
must be taken into account. In absence of a more rational analysis of this condition, the
following must be investigated:

Annex to ED Decision 2023/021/R Page 250 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(i) A vertical load equal to 75% of the maximum ground reaction of CS 25.473(a)(2)
must be considered in combination with a drag and side load of 40% and 25%,
respectively, of that vertical load.
(ii) The shock absorber and tyre deflections must be assumed to be 75% of the
deflection corresponding to the maximum ground reaction of CS 25.473(a)(2). This
load case need not be considered in combination with flat tyres.
(3) The combination of vertical and drag components is considered to be acting at the wheel
axle centreline.

CS 25.481 Tail-down landing conditions

(a) In the tail-down attitude, the aeroplane is assumed to contact the ground at forward velocity
components, ranging from VL1 to VL2, parallel to the ground under the conditions prescribed in
CS 25.473 with:
(1) VL1 equal to VS0 (TAS) at the appropriate landing weight and in standard sealevel
conditions; and
(2) VL2 equal to VS0 (TAS) at the appropriate landing weight and altitudes in a hot-day
temperature of 22.8°C (41°F) above standard.
The combination of vertical and drag components is considered to be acting at the main wheel
axle centreline.
(b) For the tail-down landing condition for aeroplanes with tail wheels, the main and tail wheels
are assumed to contact the ground simultaneously, in accordance with Figure 3 of Appendix A.
Ground reaction conditions on the tail wheel are assumed to act
(1) Vertically; and
(2) Up and aft through the axle at 45° to the ground line.
(c) For the tail-down landing condition for aeroplanes with nose wheels, the aeroplane is assumed
to be at an attitude corresponding to either the stalling angle or the maximum angle allowing
clearance with the ground by each part of the aeroplane other than the main wheels, in
accordance with Figure 3 of Appendix A, whichever is less.

CS 25.483 One-gear landing conditions

For the one-gear landing conditions, the aeroplane is assumed to be in the level attitude and to contact
the ground on one main landing gear, in accordance with Figure 4 of Appendix A of CS-25. In this
attitude
(a) The ground reactions must be the same as those obtained on that side under CS 25.479(d)(1),
and
(b) Each unbalanced external load must be reacted by aeroplane inertia in a rational or
conservative manner.

CS 25.485 Side load conditions

In addition to CS 25.479(d)(2) the following conditions must be considered:

Annex to ED Decision 2023/021/R Page 251 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(a) For the side load condition, the aeroplane is assumed to be in the level attitude with only the
main wheels contacting the ground, in accordance with Figure 5 of Appendix A.
(b) Side loads of 0·8 of the vertical reaction (on one side) acting inward and 0·6 of the vertical
reaction (on the other side) acting outward must be combined with one-half of the maximum
vertical ground reactions obtained in the level landing conditions. These loads are assumed to
be applied at the ground contact point and to be resisted by the inertia of the aeroplane. The
drag loads may be assumed to be zero.

CS 25.487 Rebound landing condition

(a) The landing gear and its supporting structure must be investigated for the loads occurring
during rebound of the aeroplane from the landing surface.
(b) With the landing gear fully extended and not in contact with the ground, a load factor of 20·0
must act on the unsprung weights of the landing gear. This load factor must act in the direction
of motion of the unsprung weights as they reach their limiting positions in extending with
relation to the sprung parts of the landing gear.

CS 25.489 Ground handling conditions

Unless otherwise prescribed, the landing gear and aeroplane structure must be investigated for the
conditions in CS 25.491 to 25.509 with the aeroplane at the design ramp weight (the maximum weight
for ground handling conditions). No wing lift may be considered. The shock absorbers and tyres may
be assumed to be in their static position.

CS 25.491 Taxi, take-off and landing roll

(See AMC 25.415)
Within the range of appropriate ground speeds and approved weights, the aeroplane structure and
landing gear are assumed to be subjected to loads not less than those obtained when the aircraft is
operating over the roughest ground that may reasonably be expected in normal operation.
[Amdt 25/18]

AMC 25.491 Taxy, take-off and landing roll

1. PURPOSE. This AMC sets forth acceptable methods of compliance with the provisions of CS-25
dealing with the certification requirements for taxy, take-off and landing roll design loads.
Guidance information is provided for showing compliance with CS 25.491, relating to structural
design for aeroplane operation on paved runways and taxy-ways normally used in commercial
operations. Other methods of compliance with the requirements may be acceptable.
2. RELATED CERTIFICATION SPECIFICATIONS. The contents of this AMC are considered by the
Agency in determining compliance with CS 25.491. Related paragraphs are CS 25.305(c) and
CS 25.235.
3. BACKGROUND.
a. All paved runways and taxy-ways have an inherent degree of surface unevenness, or
roughness. This is the result of the normal tolerances of engineering standards required
for construction, as well as the result of events such as uneven settlement and frost

Annex to ED Decision 2023/021/R Page 252 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

heave. In addition, repair of surfaces on an active runway or taxy-way can result in

temporary ramped surfaces. Many countries have developed criteria for runway surface
roughness. The Inter-national Civil Aviation Organisation (ICAO) standards are published
in ICAO Annex 14.
b. In the late 1940's, as aeroplanes became larger, more flexible, and operated at higher
ground speeds, consideration of dynamic loads during taxy, landing rollout, and take-off
became important in aeroplane design. CS 25.235, CS 25.491 and CS 25.305(c) apply.
c. Several approaches had been taken by different manufacturers in complying with the
noted regulations. If dynamic effects due to rigid body modes or airframe flexibility during
taxy were not considered critical, some manufacturers used a simplified static analysis
where a static inertia force was applied to the aeroplane using a load factor of 2.0 for
single axle gears or 1.7 for multiple axle gears. The lower 1.7 factor was justified based
on an assumption that there was a load alleviating effect resulting from rotation of the
beam, on which the forward and aft axles are attached, about the central pivot point on
the strut. The static load factor approach was believed to encompass any dynamic effects
and it had the benefit of a relatively simple analysis.
d. As computers became more powerful and dynamic analysis methods became more
sophisticated, it was found that dynamic effects sometimes resulted in loads greater than
those which were predicted by the static criterion. Some manufacturers performed
calculations using a series of harmonic bumps to represent a runway surface, tuning the
bumps to excite various portions of the structure at a given speed. U.S. Military Standard
8862 defines amplitude and wavelengths of 1-cosine bumps intended to excite low speed
plunge, pitch and wing first bending modes.
e. Some manufacturers used actual runway profile data to calculate loads. The runway
profiles of the San Francisco Runway 28R or Anchorage Runway 24, which were known
to cause high loads on aeroplanes and were the subject of pilot complaints until
resurfaced, have been used in a series of bi-directional constant speed analytical runs to
determine loads. In some cases, accelerated runs have been used, starting from several
points along the runway. The profiles of those runways are described in NASA Reports
CR-119 and TN D-5703. Such deterministic dynamic analyses have in general proved to
be satisfactory.
f. Some manufacturers have used a statistical power spectral density (PSD) approach,
especially to calculate fatigue loads. Extensive PSD runway roughness data exist for
numerous world runways. The PSD approach is not considered practical for calculation of
limit loads.
g. Because the various methods described above produce different results, the guidance
information given in paragraphs 4, 5, and 6 of this AMC should be used when
demonstrating compliance with CS 25.491.
4. RUNWAY PROFILE CONDITION.
a. Consideration of airframe flexibility and landing gear dynamic characteristics is necessary
in most cases. A deterministic dynamic analysis, based on the San Francisco Runway 28R
(before it was resurfaced), described in Table 1 of this AMC, is an acceptable method for
compliance. As an alternative means of compliance, the San Francisco Runway 28R
(before it was resurfaced) may be used with the severe bump from 1530 to 1538 feet
modified per Table 2. The modifications to the bump reflect the maximum slope change
permitted in ICAO Annex 14 for temporary ramps used to transition asphalt overlays to
existing pavement. The points affected by this modification are outlined in Table 1.

Annex to ED Decision 2023/021/R Page 253 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

b. Aeroplane design loads should be developed for the most critical conditions arising from
taxy, take-off, and landing run. The aeroplane analysis model should include significant
aeroplane rigid body and flexible modes, and the appropriate landing gear and tyre
characteristics. Unless the aeroplane has design features that would result in significant
asymmetric loads, only the symmetric cases need be investigated.
c. Aeroplane steady aerodynamic effects should normally be included. However, they may
be ignored if their deletion is shown to produce conservative loads. Unsteady
aerodynamic effects on dynamic response may be neglected.
d. Conditions should be run at the maximum take-off weight and the maximum landing
weight with critical combinations of wing fuel, payload, and extremes of centre of gravity
(c.g.) range. For aeroplanes with trimable stabilisers, the stabiliser should be set at the
appropriate setting for take-off cases and at the recommended final approach setting for
landing cases. The elevator should be assumed faired relative to the stabiliser throughout
the take-off or landing run, unless other normal procedures are specified in the flight
manual.
e. A series of constant speed runs should be made in both directions from 37 km/h (20
knots) up to the maximum ground speeds expected in normal operation (VR defined at
maximum altitude and temperature for take-off conditions, 1.25 VL2 for landing
conditions). Sufficiently small speed increments should be evaluated to assure that
maximum loads are achieved. Constant speed runs should be made because using
accelerated runs may not define the speed/roughness points which could produce peak
dynamic loads. For maximum take-off weight cases, the analysis should account for
normal take-off flap and control settings and consider both zero and maximum thrust.
For maximum landing weight cases, the analysis should account for normal flap and
spoiler positions following landing, and steady pitching moments equivalent to those
produced by braking with a coefficient of friction of 0.3 with and without reverse thrust.
The effects of automatic braking systems that reduce braking in the presence of reverse
thrust may be taken into account.
5. DISCRETE LOAD CONDITION. One of the following discrete limit load conditions should be
evaluated:
a. With all landing gears in contact with the ground, the condition of a vertical load equal to
1.7 times the static ground reaction should be investigated under the most adverse
aeroplane loading distribution at maximum take-off weight, with and without thrust from
the engines;
b. As an alternative to paragraph 5.a. above, it would be acceptable to undertake dynamic
analyses under the same conditions considered in paragraph 4 of this AMC considering
the aircraft response to each of the following pairs of identical and contiguous 1-cosine
upwards bumps on an otherwise smooth runway:
(i) Bump wavelengths equal to the mean longitudinal distance between nose and
main landing gears, or between the main and tail landing gears, as appropriate;
and separately:
(ii) Bump wavelengths equal to twice this distance.
The bump height in each case should be defined as:

Where:

Annex to ED Decision 2023/021/R Page 254 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

H = the bump height

L = the bump wavelength
A = 1.2, B = 0.023 if H and L are expressed in inches
A = 30.5, B = 0.116 if H and L are expressed in millimetres
6. COMBINED LOAD CONDITION. A condition of combined vertical, side and drag loads should be
investigated for the main landing gear. In the absence of a more rational analysis a vertical load
equal to 90% of the ground reaction from paragraph 5 above should be combined with a drag
load of 20% of the vertical load and a side load of 20% of the vertical load. Side loads acting
either direction should be considered.
7. TYRE CONDITIONS. The calculation of maximum gear loads in accordance with paragraphs 4, 5,
and 6, may be performed using fully inflated tyres. For multiple wheel units, the maximum gear
loads should be distributed between the wheels in accordance with the criteria of CS 25.511.
[Amdt 25/2]

Annex to ED Decision 2023/021/R Page 255 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

CS 25.493 Braked roll conditions

(a) An aeroplane with a tail wheel is assumed to be in the level attitude with the load on the main
wheels, in accordance with Figure 6 of Appendix A. The limit vertical load factor is 1·2 at the design
landing weight, and 1·0 at the design ramp weight. A drag reaction equal to the vertical reaction
multiplied by a coefficient of friction of 0·8, must be combined with the vertical ground reaction
and applied at the ground contact point.
(b) For an aeroplane with a nose wheel, the limit vertical load factor is 1·2 at the design landing weight,
and 1·0 at the design ramp weight. A drag reaction equal to the vertical reaction, multiplied by a
coefficient of friction of 0·8, must be combined with the vertical reaction and applied at the ground
contact point of each wheel with brakes. The following two attitudes, in accordance with Figure 6
of Appendix A, must be considered:
(1) The level attitude with the wheels contacting the ground and the loads distributed between
the main and nose gear. Zero pitching acceleration is assumed.
(2) The level attitude with only the main gear contacting the ground and with the pitching
moment resisted by angular acceleration.
(c) A drag reaction lower than that prescribed in this paragraph may be used if it is substantiated that
an effective drag force of 0·8 times the vertical reaction cannot be attained under any likely loading
condition.
(d) An aeroplane equipped with a nose gear must be designed to withstand the loads arising from the
dynamic pitching motion of the aeroplane due to sudden application of maximum braking force.
The aeroplane is considered to be at design takeoff weight with the nose and main gears in contact
with the ground, and with a steady state vertical load factor of 1·0. The steady state nose gear
reaction must be combined with the maximum incremental nose gear vertical reaction caused by
sudden application of maximum braking force as described in sub-paragraphs (b) and (c) of this
paragraph.
(e) In the absence of a more rational analysis, the nose gear vertical reaction prescribed in
subparagraph (d) of this paragraph must be calculated in accordance with the following formula:

Where:
VN = Nose gear vertical reaction
WT = Design take-off weight
A = Horizontal distance between the c.g. of the aeroplane and the nose wheel.
B = Horizontal distance between the c.g. of the aeroplane and the line joining the centres of the
main wheels.
E = Vertical height of the c.g. of the aeroplane above the ground in the 1·0 g static condition.
µ = Coefficient of friction of 0·8.
f = Dynamic response factor; 2·0 is to be used unless a lower factor is substantiated.

Annex to ED Decision 2023/021/R Page 267 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

In the absence of other information, the dynamic response factor f may be defined by the equation.

effective ground contact point.

CS 25.495 Turning
In the static position, in accordance with Figure 7 of Appendix A, the aeroplane is assumed to execute a
steady turn by nose gear steering, or by application of sufficient differential power, so that the limit load
factors applied at the centre of gravity are 1·0 vertically and 0·5 laterally. The side ground reaction of each
wheel must be 0·5 of the vertical reaction.

CS 25.497 Tail-wheel yawing

(a) A vertical ground reaction equal to the static load on the tail wheel, in combination with a side
component of equal magnitude, is assumed.
(b) If there is a swivel, the tail wheel is assumed to be swivelled 90° to the aeroplane longitudinal axis
with the resultant load passing through the axle.
(c) If there is a lock, steering device, or shimmy damper the tail wheel is also assumed to be in the
trailing position with the side load acting at the ground contact point.

CS 25.499 Nose-wheel yaw and steering

(a) A vertical load factor of 1·0 at the aeroplane centre of gravity, and a side component at the nose
wheel ground contact equal to 0·8 of the vertical ground reaction at that point are assumed.
(b) With the aeroplane assumed to be in static equilibrium with the loads resulting from the use of
brakes on one side of the main landing gear, the nose gear, its attaching structure, and the fuselage
structure forward of the centre of gravity must be designed for the following loads:
(1) A vertical load factor at the centre of gravity of 1·0.
(2) A forward acting load at the aeroplane centre of gravity of 0·8 times the vertical load on one
main gear.
(3) Side and vertical loads at the ground contact point on the nose gear that are required for
static equilibrium.
(4) A side load factor at the aeroplane centre of gravity of zero.
(c) If the loads prescribed in sub-paragraph (b) of this paragraph result in a nose gear side load higher
than 0·8 times the vertical nose gear load, the design nose gear side load may be limited to 0·8
times the vertical load, with unbalanced yawing moments assumed to be resisted by aeroplane
inertia forces.

Annex to ED Decision 2023/021/R Page 268 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(d) For other than the nose gear, its attaching structure, and the forward fuselage structure the loading
conditions are those prescribed in sub-paragraph (b) of this paragraph, except that
(1) A lower drag reaction may be used if an effective drag force of 0·8 times the vertical reaction
cannot be reached under any likely loading condition; and
(2) The forward acting load at the centre of gravity need not exceed the maximum drag reaction
on one main gear, determined in accordance with CS 25.493(b).
(e) With the aeroplane at design ramp weight, and the nose gear in any steerable position, the
combined application of full normal steering torque and vertical force equal to 1·33 times the
maximum static reaction on the nose gear must be considered in designing the nose gear, its
attaching structure and the forward fuselage structure.

CS 25.503 Pivoting
(a) The aeroplane is assumed to pivot about one side of the main gear with the brakes on that side
locked. The limit vertical load factor must be 1·0 and the coefficient of friction 0·8.
(b) The aeroplane is assumed to be in static equilibrium, with the loads being applied at the ground
contact points, in accordance with Figure 8 of Appendix A.

CS 25.507 Reversed braking

(a) The aeroplane must be in a three point static ground attitude. Horizontal reactions parallel to the
ground and directed forward must be applied at the ground contact point of each wheel with
brakes. The limit loads must be equal to 0·55 times the vertical load at each wheel or to the load
developed by 1·2 times the nominal maximum static brake torque, whichever is less.
(b) For aeroplanes with nose wheels, the pitching moment must be balanced by rotational inertia.
(c) For aeroplanes with tail wheels, the resultant of the ground reactions must pass through the centre
of gravity of the aeroplane.

CS 25.509 Towing Loads

(See AMC 25.509)
(a) The towing loads specified in sub-paragraph (d) of this paragraph must be considered separately.
These loads must be applied at the towing fittings and must act parallel to the ground. In addition

(1) A vertical load factor equal to 1·0 must be considered acting at the centre of gravity;
(2) The shock struts and tyres must be in their static positions; and
(3) With WT as the design ramp weight, the towing load, FTOW is
(i) 0.3 WT for WT less than 30 000 pounds;

(ii) for WT between 30 000 and 100 000 pounds; and

Annex to ED Decision 2023/021/R Page 269 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(iii) 0·15 WT for WT over 100 000 pounds.

(b) For towing points not on the landing gear but near the plane of symmetry of the aeroplane, the
drag and side tow load components specified for the auxiliary gear apply. For towing points located
outboard of the main gear, the drag and side tow load components specified for the main gear
apply. Where the specified angle of swivel cannot be reached, the maximum obtainable angle must
be used.
(c) The towing loads specified in sub-paragraph (d) of this paragraph must be reacted as follows:
(1) The side component of the towing load at the main gear must be reacted by a side force at
the static ground line of the wheel to which the load is applied.
(2) The towing loads at the auxiliary gear and the drag components of the towing loads at the
main gear must be reacted as follows:
(i) A reaction with a maximum value equal to the vertical reaction must be applied at the
axle of the wheel to which the load is applied. Enough aeroplane inertia to achieve
equilibrium must be applied.
(ii) The loads must be reacted by aeroplane inertia.
(d) The prescribed towing loads are as specified in the following Table:
Load
Tow Point Position
Magnitude No. Direction
1 Forward, parallel to drag axis
0·75 FTOW per 2 Forward, at 30° to drag axis
Main gear
main gear unit 3 Aft, parallel to drag axis
4 Aft, at 30° to drag axis
5 Forward
Swivelled forward
6 Aft
1·0 FTOW
7 Forward
Swivelled aft
8 Aft
Auxiliary gear
Swivelled 45° from 9 Forward, in plane of wheel
forward 10 Aft, in plane of wheel
0·5 FTOW
11 Forward, in plane of wheel
Swivelled 45° from aft
12 Aft, in plane of wheel
[Amdt 25/13]

AMC 25.509 Towbarless towing

(a) General
Towbarless towing vehicles are generally considered as ground equipment and are as such not
subject to direct approval by the (aircraft) certifying agencies. However, these vehicles should be
qualified in accordance with the applicable SAE ARP documents. It should be ensured that the nose
landing gear and supporting structure is not being overloaded (by static and dynamic (including
fatigue) loads) during towbarless towing operations with these vehicles. This should be ensured by
the aircraft manufacturer, either by specific investigations as described in subparagraphs (b) and
(c) below, or alternatively, by publishing aircraft load limitations in a towbarless towing vehicle

Annex to ED Decision 2023/021/R Page 270 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

assessment document, to allow towbarless towing vehicle manufacturers to demonstrate their

vehicles will not overload the aircraft.
(b) Limit static load cases
For the limit static load cases, the investigation may be conducted by rational analysis supported
by test evidence. The investigation should take into account the influence on the towing loads of
the tractive force of the towing vehicle including consideration of its weight and pavement
roughness.
Furthermore, the investigation should include, but may not be limited to, the following towbarless
towing operation scenarios:
(1) Pushback towing: Moving a fully loaded aircraft (up to Maximum Ramp Weight (MRW)) from
the parking position to the taxiway. Movement includes: pushback with turn, a stop, and
short tow forward to align aircraft and nose wheels. Engines may or may not be operating.
Aeroplane movement is similar to a conventional pushback operation with a towbar.
(2) Maintenance towing: The movement of an aeroplane for maintenance/remote parking
purposes (e.g. from the gate to a maintenance hangar). Aircraft is typically unloaded with
minimal fuel load.
(3) Dispatch (operational) towing: Towing a revenue aircraft (loaded with passengers, fuel, and
cargo up to Maximum Ramp Weight (MRW) from the terminal gate/remote parking area to
a location near the active runway. The movement may cover several kilometres with speeds
according to SAE ARP 5283 technical standards, with several starts, stops, and turns. It
replaces typical taxiing operations prior to take-off.
Operations that are explicitly prohibited need not to be addressed.
(c) Fatigue evaluation
Fatigue evaluation of the impact of towbarless towing on the airframe should be conducted under
the provision of CS 25.571 and CS 25.1529.
Specifically, the contribution of the towbarless towing operational loads to the fatigue load spectra
for the nose landing gear and its support structure needs to be evaluated. The impact of the
towbarless towing on the certified life limits of the landing gear and supporting structure needs to
be determined.
The fatigue spectra used in the evaluation should consist of typical service loads encountered during
towbarless towing operations, which cover the loading scenarios noted above for static
considerations. Furthermore, the spectra should be based on measured statistical data derived
from simulated service operation or from applicable industry studies.
(d) Other considerations
Specific combinations of towbarless towing vehicle(s) and aircraft that have been assessed as
described above and have been found to be acceptable, along with any applicable towing
instructions and/or limitations should be specified in the Instructions for Continued Airworthiness
as described in Appendix H, paragraph H25.3(a)(4) and in the Aeroplane Flight Manual as specified
in AMC 25.745(d).

Annex to ED Decision 2023/021/R Page 271 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

s design
load and may result in structural damage and/or nose gear collapse. For these reasons, the aircraft
manufacturer should ensure that the appropriate information is provided in the Aeroplane
Maintenance Manual and in the Aeroplane Flight Manual to preclude aircraft braking during normal
towbarless towing. Appropriate information should also be provided in the Instructions for
Continued Airworthiness to inspect the affected structure should aircraft braking occur, for
example in an emergency situation.
[Amdt 25/13]

CS 25.511 Ground load: unsymmetrical loads on multiple-wheel units

(a) General. Multiple-wheel landing gear units are assumed to be subjected to the limit ground loads
prescribed in this Subpart under sub-paragraphs (b) through (f) of this paragraph. In addition
(1) A tandem strut gear arrangement is a multiple-wheel unit; and
(2) In determining the total load on a gear unit with respect to the provisions of sub-paragraphs
(b) through (f) of this paragraph, the transverse shift in the load centroid, due to
unsymmetrical load distribution on the wheels, may be neglected.
(b) Distribution of limit loads to wheels; tyres inflated. The distribution of the limit loads among the
wheels of the landing gear must be established for each landing, taxying, and ground handling
condition, taking into account the effects of the following factors:
(1) The number of wheels and their physical arrangements. For truck type landing gear units, the
effects of any see-saw motion of the truck during the landing impact must be considered in
determining the maximum design loads for the fore and aft wheel pairs.
(2) Any differentials in tyre diameters resulting from a combination of manufacturing tolerances,
tyre growth, and tyre wear. A maximum tyre-diameter differential equal to two-thirds of the
most unfavourable combination of diameter variations that is obtained when taking into
account manufacturing tolerances, tyre growth and tyre wear, may be assumed.
(3) Any unequal tyre inflation pressure, assuming the maximum variation to be ±5% of the
nominal tyre inflation pressure.
(4) A runway crown of zero and a runway crown having a convex upward shape that may be
approximated by a slope of 1·5% with the horizontal. Runway crown effects must be
considered with the nose gear unit on either slope of the crown.
(5) The aeroplane attitude.
(6) Any structural deflections.
(c) Deflated tyres. The effect of deflated tyres on the structure must be considered with respect to the
loading conditions specified in sub-paragraphs (d) through (f) of this paragraph, taking into account
the physical arrangement of the gear components. In addition
(1) The deflation of any one tyre for each multiple wheel landing gear unit, and the deflation of
any two critical tyres for each landing gear unit using four or more wheels per unit, must be
considered; and

Annex to ED Decision 2023/021/R Page 272 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(2) The ground reactions must be applied to the wheels with inflated tyres except that, for
multiple-wheel gear units with more than one shock strut, a rational distribution of the
ground reactions between the deflated and inflated tyres, accounting for the differences in
shock strut extensions resulting from a deflated tyre, may be used.
(d) Landing conditions. For one and for two deflated tyres, the applied load to each gear unit is assumed
to be 60% and 50%, respectively, of the limit load applied to each gear for each of the prescribed
landing conditions. However, for the drift landing condition of CS 25.485, 100% of the vertical load
must be applied.
(e) Taxying and ground handling conditions. For one and for two deflated tyres
(1) The applied side or drag load factor, or both factors, at the centre of gravity must be the most
critical value up to 50% and 40%, respectively, of the limit side or drag load factors, or both
factors, corresponding to the most severe condition resulting from consideration of the
prescribed taxying and ground handling conditions.
(2) For the braked roll conditions of CS 25.493(a) and (b)(2), the drag loads on each inflated tyre
may not be less than those at each tyre for the symmetrical load distribution with no deflated
tyres;
(3) The vertical load factor at the centre of gravity must be 60% and 50% respectively, of the
factor with no deflated tyres, except that it may not be less than 1 g; and
(4) Pivoting need not be considered.
(f) Towing conditions. For one and for two deflated tyres, the towing load, FTOW, must be 60% and 50%
respectively, of the load prescribed.

CS 25.519 Jacking and tie-down provisions

(a) General. The aeroplane must be designed to withstand the limit load conditions resulting from the
static ground load conditions of sub-paragraph (b) of this paragraph and, if applicable, sub-
paragraph (c) of this paragraph at the most critical combinations of aeroplane weight and centre of
gravity. The maximum allowable load at each jack pad must be specified.
(b) Jacking. The aeroplane must have provisions for jacking and must withstand the following limit
loads when the aeroplane is supported on jacks:
(1) For jacking by the landing gear at the maximum ramp weight of the aeroplane, the aeroplane
structure must be designed for a vertical load of 1·33 times the vertical static reaction at each
jacking point acting singly and in combination with a horizontal load of 0·33 times the vertical
static reaction applied in any direction.
(2) For jacking by other aeroplane structure at maximum approved jacking weight:
(i) The aeroplane structure must be designed for a vertical load of 1·33 times the vertical
reaction at each jacking point acting singly and in combination with a horizontal load
of 0·33 times the vertical static reaction applied in any direction.
(ii) The jacking pads and local structure must be designed for a vertical load of 2·0 times
the vertical static reaction at each jacking point, acting singly and in combination with
a horizontal load of 0·33 times the vertical static reaction applied in any direction.

Annex to ED Decision 2023/021/R Page 273 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
GROUND LOADS

(c) Tie-down. If tie-down points are provided, the main tie-down points and local structure must
withstand the limit loads resulting from a 120 km/h (65-knot) horizontal wind from any direction.

Annex to ED Decision 2023/021/R Page 274 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

EMERGENCY LANDING CONDITIONS

CS 25.561 General
(See AMC 25.561.)
(a) The aeroplane, although it may be damaged in emergency landing conditions on land or water,
must be designed as prescribed in this paragraph to protect each occupant under those conditions.
(b) The structure must be designed to give each occupant every reasonable chance of escaping serious
injury in a minor crash landing when
(1) Proper use is made of seats, belts, and all other safety design provisions;
(2) The wheels are retracted (where applicable); and
(3) The occupant experiences the following ultimate inertia forces acting separately relative to
the surrounding structure:
(i) Upward, 3·0g
(ii) Forward, 9·0g
(iii) Sideward, 3·0g on the airframe and 4·0g on the seats and their attachments
(iv) Downward, 6·0g
(v) Rearward, 1·5g (See AMC 25.561(b)(3).)
(c) For equipment, cargo in the passenger compartments and any other large masses, the following
apply:
(1) These items must be positioned so that if they break loose they will be unlikely to:
(i) Cause direct injury to occupants;
(ii) Penetrate fuel tanks or lines or cause fire or explosion hazard by damage to adjacent
systems; or
(iii) Nullify any of the escape facilities provided for use after an emergency landing.
(2) When such positioning is not practical (e.g. fuselage mounted engines or auxiliary power
units) each such item of mass must be restrained under all loads up to those specified in sub-
paragraph (b)(3) of this paragraph. The local attachments for these items should be designed
to withstand 1·33 times the specified loads if these items are subject to severe wear and tear
through frequent removal (e.g. quick change interior items).
(d) Seats and items of mass (and their supporting structure) must not deform under any loads up to
those specified in sub-paragraph (b)(3) of this paragraph in any manner that would impede
subsequent rapid evacuation of occupants. (See AMC 25.561(d).)

AMC 25.561 General

In complying with the provisions of CS 25.561(b) & (c), the loads arising from the restraint of seats and
items of equipment etc. should be taken into the structure to a point where the stresses can be dissipated

Annex to ED Decision 2023/021/R Page 275 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

(e.g. for items attached to the fuselage floor, the load paths from the attachments through to the fuselage
primary structure should be taken into account).

AMC 25.561(b)(3) Commercial Accommodation Equipment

Commercial accommodation equipment complying only with FAR 25.561 pre-Amendment 25-91 need
additional substantiation by analysis, tests or combination thereof to cover the 1·33 factor for their
attachments as specified in CS 25.561(c).
[Amdt 25/11]

AMC 25.561(d) General

For the local attachments of seats and items of mass it should be shown by analysis and/or tests that
under the specified load conditions, the intended retaining function in each direction is still available.

CS 25.562 Emergency landing dynamic conditions

(See AMC 25.562)
(a) The seat and restraint system in the aeroplane must be designed as prescribed in this paragraph to
protect each occupant during an emergency landing condition when
(1) Proper use is made of seats, safety belts, and shoulder harnesses provided for in the design;
and
(2) The occupant is exposed to loads resulting from the conditions prescribed in this paragraph.
(b) Each seat type design approved for occupancy must successfully complete dynamic tests or be
demonstrated by rational analysis based on dynamic tests of a similar seat type, in accordance with
each of the following emergency landing conditions. The tests must be conducted with an occupant
simulated by a 77kg (170 lb) anthropomorphic, test dummy sitting in the normal upright position:
(1)
s canted downward 30 degrees with respect to the horizontal
plane and with the wings level. Peak floor deceleration must occur in not more than 0·08
seconds after impact and must reach a minimum of 14 g.
(2)

would cause the greatest likelihood of the upper torso restraint system (where installed)

occur in not more than 0·09 seconds after impact and must reach a minimum of 16 g. With
the exception of flight deck crew seats that are mounted in the forward conical area of the
fuselage, where floor rails or floor fittings are used to attach the seating devices to the test
fixture, the rails or fittings must be misaligned with respect to the adjacent set of rails or
fittings by at least 10 degrees vertically (i.e. out of parallel) with one rolled 10 degrees.
(c) The following performance measures must not be exceeded during the dynamic tests conducted in
accordance with sub-paragraph (b) of this paragraph:

Annex to ED Decision 2023/021/R Page 276 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

(1) Where upper torso straps are used tension loads in individual straps must not exceed 794 kg.
(1750lb) If dual straps are used for restraining the upper torso, the total strap tension loads
must not exceed 907kg (2000 lb)).
(2) The maximum compressive load measured between the pelvis and the lumbar column of the
anthropomorphic dummy must not exceed 680 kg. (1500lb)
(3)
during the impact.
(4) ring the impact.
(5) Each occupant must be protected from serious head injury under the conditions prescribed
in sub-paragraph (b) of this paragraph. Where head contact with seats or other structure can
occur, protection must be provided so that the head impact does not exceed a Head Injury
Criterion (HIC) of 1000 units. The level of HIC is defined by the equation

Where
t1 is the initial integration time,
t2 is the final integration time, and
a(t) is the total acceleration vs. time curve for the head strike, and where
(t) is in seconds, and (a) is in units of gravity (g).
(6) Where leg injuries may result from contact with seats or other structure, protection must be
provided to prevent axially compressive loads exceeding 1021 kg (2250 lb) in each femur.
(7) The seat must remain attached at all points of attachment, although the structure may have
yielded.
(8) Seats must not yield under the tests specified in sub-paragraphs (b)(1) and (b)(2) of this
paragraph to the extent they would impede rapid evacuation of the aeroplane occupants.
[Amdt 25/15]
[Amdt 25/17]
[Amdt 25/21]

AMC 25.562 Emergency landing dynamic conditions

FAA Advisory Circular (AC) 25.562-1B Change 1, Dynamic Evaluation of Seat Restraint Systems and
Occupant Protection on Transport Airplanes, dated 30.9.2015, and FAA AC 20-146A, Methodology for
Dynamic Seat Certification by Analysis for Use in Parts 23, 25, 27, and 29 Airplanes and Rotorcraft, dated
29.6.2018, are accepted by the Agency as providing acceptable means of compliance with CS 25.562.
[Amdt 25/17]
[Amdt 25/26]

Annex to ED Decision 2023/021/R Page 277 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

CS 25.563 Structural ditching provisions

(See AMC 25.563)
If certification with ditching provisions is requested, those parts of the airframe structure that are
necessary to maintain flotation of the aeroplane must withstand ditching loads, considered as ultimate,
associated with a planned emergency landing on water. Damages may occur provided that these are
accounted for in the assessments required by CS 25.801(b), and that the airframe structural integrity is
maintained. The airframe loads must account for reasonable variations in the flight parameters when the
aeroplane enters the water.
[Amdt 25/28]

AMC 25.563 Structural ditching provisions

1. Purpose
AMC 25.563 primarily provides guidance and acceptable means of compliance with the ditching
certification specifications of CS 25.563 (Structural ditching provisions).
It also includes guidance that may be used when showing compliance with the following
certification specifications that are applicable to ditching certification:
CS 25.801 (Ditching),
CS 25.809(g) (Emergency exit arrangement),
CS 25.1581 (Aeroplane flight manual General).
Note: The following certification specifications are also related to ditching certification: CS 25.807(i)
(Emergency exits), CS 25.1411 (Safety equipment General) and CS 25.1415 (Ditching equipment).
2. Definitions
2.1. Buoyancy. On aeroplanes, buoyancy features allow the aeroplane to float and include, but are not
limited to, the portion of the following features that displace water: fuel tanks, pressure vessels and
any other items that can be shown to remain intact after the ditching event and to displace water
(e.g. structure and systems of the aeroplane, landing gear, bell jar volume of the landing gear wheel
wells).
2.2. Ditching. An emergency landing on water, either planned or unplanned (see definitions below). In
principle, the phases of a ditching event are as follows:
(a)
(b)
water;
(c)
to rest in the water;
(d)
(e) the time it takes to fully evacuate the aeroplane.

Annex to ED Decision 2023/021/R Page 278 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

Note: some of these phases overlap.

2.3. Ditching exit. To qualify as a ditching exit, the exit sill must be initially above the waterline, and it
should remain above the waterline for the duration of the evacuation during a planned or
unplanned ditching.
Note: If it can be shown to still be conservative, an exit may qualify as a ditching exit even if it does
not remain above the waterline for the full duration of the evacuation. The substantiation of
conservatism should include an assessment of how long the ditching exit remains above the
waterline, the number of persons expected to remain in the aeroplane when the ditching exit sill(s)
go(es) below the waterline and the number of other ditching exits remaining above the waterline.
2.4. Evacuation time. The time it takes for all occupants to exit the aeroplane. The evacuation is assumed
to start when the aeroplane comes to rest in the water. In the case of a planned ditching, the
evacuation time ends when the last aeroplane occupant leaves the aeroplane and enters a raft. In
the case of an unplanned ditching, the evacuation time ends when the last aeroplane occupant
leaves the aeroplane and enters a slide/raft, enters the water or steps on the wing.
2.5. Flotation time. The time from when the aeroplane comes to rest in the water to when the aeroplane
condition is such that occupants can no longer safely evacuate.
Note: For certification purposes, the flotation time is generally considered to be the time from when
the aeroplane comes to rest in the water to when the first ditching exit sill goes below the waterline,
or when the attitude of the aeroplane is such that it would require extraordinary effort to move
through the cabin to reach available ditching exits. However, if it can be shown to still be
conservative, the flotation time may be extended. Evidence of conservatism should include an
assessment of the number of persons expected to remain in the aeroplane when the ditching exit
sill(s) go(es) below the waterline, the number of ditching exits remaining above the waterline and
the attitude of the aeroplane.
2.6. Inadvertent water entry. Runway overshoot (at take-off or landing) or runway undershoot (at
landing) that results in the aeroplane alighting on water. This type of event is considered to be a
minor crash, where the aeroplane inadvertently ends up in water where it is supported or partially
supported by land. It is possible that during the departure from land to water the aeroplane
encounters varying terrain such as berms, rocks etc. It is not uncommon for aeroplanes to be
severely damaged. However, these events rarely include scenario where the aeroplane is floating
after it comes to rest. It is more typical for the aeroplane to be resting on the lake or sea bed or
partially supported on land. This is not considered to be a ditching event, and it is not addressed by
the ditching requirements or this AMC. Rather, this type of event is addressed by other
crashworthiness specifications such as CS 25.561, CS 25.721 and CS 25.963.
2.7. Planned ditching. An event where the flight crew knowingly makes an emergency landing on water.
In ideal cases, the flight and cabin crews have sufficient time to fully prepare the aeroplane and the
passengers, and execute the ditching in accordance with the aeroplane flight manual (AFM)
procedures. It is recognised that some circumstances may degrade the ability of the flight crew to
execute the ditching exactly as per the AFM procedures. Therefore, an assessment should address
variations in the aeroplane assumptions (e.g. attitude (pitch) and descent velocity) to account for
potential degraded conditions.
All phases of ditching (defined above) should be evaluated when showing compliance with ditching
certification specifications.

Annex to ED Decision 2023/021/R Page 279 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

2.8. Reduced engine power or thrust / no engine power or thrust ditching conditions. An event where
the flight crew knowingly makes an emergency landing on water but with reduced engine power or
thrust, or no engine power or thrust available. The flight and cabin crews may or may not have
sufficient time or opportunity to fully prepare the aeroplane and passengers for ditching. The flight
crew is able to perform the emergency landing in accordance with the AFM procedures for a
reduced/no power or thrust landing on water. It has been shown that for this condition the amount
of control the flight crew has over the high-lift devices is the dominant factor in maintaining water
impact loads within the structural capability of the aeroplane. This condition is addressed by AFM
procedures (see Section 9). For such an event, the applicant may focus on the approach phase of
the ditching event (defined above) when showing compliance with ditching certification
specifications. Other ditching phases, as well as the definition of the structural impact loads and the
structural capability assessment, need not be considered.
2.9. Unplanned ditching. An emergency landing on water that is typically associated with a failed or
aborted take-off or landing overrun at an airport adjacent to a large body of water where the
aeroplane is in water deep enough to float (i.e. the aeroplane is not supported by land). The flight
and cabin crews do not have sufficient time or opportunity to prepare the aeroplane and
passengers for this type of ditching event. Typically no actions are taken before the ditching to
improve the flotation characteristics of the aeroplane (e.g. closing the Environmental Control
System (ECS) outflow valves). For such an event, the applicant may focus on the flotation and
evacuation phases of the ditching event (as defined above) when showing compliance with ditching
certification specifications.
3. General
Successful emergency landings on water depend on several crucial factors. The aeroplane should
possess good hydrodynamic characteristics, the ditching procedures should be attainable, and the
airframe should be intact enough for orderly evacuation. The natural variability of potential ditching
events and the inherent difficulties of an emergency water landing do not support a precise
definition of a design ditching condition. For these reasons, the following structural and aeroplane
features should be such as to ensure a level of structural performance that provides a reasonable
chance of a successful ditching. Therefore, structural substantiation of ditching capability as per
CS 25.563 necessitates consideration of the following aspects:
(a) hydrodynamic behaviour during a planned ditching event should be predictable and
consistent;
(b) the predicted hydrodynamic, aerodynamic and inertial loads experienced by the aeroplane
during the ditching should be based on methods shown to be reliable or conservative;
(c) reasonable variations of flight parameters should be considered to ensure that the execution
of a successful ditching does not require exceptional pilot skills or strength and that the
inherent uncertainties associated with a water impact do not jeopardise the ditching
structural performance;
(d) the airframe assessment of the ditching loads should demonstrate the requisite strength and
deformation to maintain the required flotation characteristics.
4. Accepted methods for evaluating hydrodynamic behaviour
To show acceptable hydrodynamic behaviour, testing and/or numerical simulation should be used.

Annex to ED Decision 2023/021/R Page 280 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

Testing need not be on the configuration under consideration if sufficient similarity can be shown,
and it need not be performed by the applicant if performed by a suitable organisation (e.g. the
applicant may use the content of document NACA-TN-2929, Experimental investigation of the effect
of rear-fuselage shape on ditching behavior, dated April 1953). Numerical simulation of water
impacts may be acceptable if validated and may be appropriate for unusual design features such as
large cut-outs, open bays, scoops and projections.
While the occurrence of emergency landing on water is rare, there have been instances of water
entry during approach, ditching due to fuel exhaustion or engine power or thrust loss from ingestion
damage etc. Hydrodynamic and structural performance in these incidents has generally been
satisfactory for large aeroplanes. Consequently, applicable fleet history may also be used by the
applicant to supplement test and simulation data if acceptable to EASA.
Note: These test or simulation methods, supplemented by applicable fleet history, may also be used
when showing compliance with CS 25.801(b)(1) and (2).
The following should be considered.
(a) Test methods
A model test should define the approach conditions and describe the hydrodynamic
behaviour until the aeroplane comes to rest after ditching.
For typical model tests, 1:10 or smaller-
models may be comparatively rigid or structurally similar (i.e. scaled strength parts such as
fuselage joints, flaps attachments and lower fuselage skins) to a full-scale aeroplane, with the
aim being to understand the dynamic behaviour after impact on water by examining a variety
of parameters. The models may be equipped with pressure transducers and linear and
angular accelerometers, to assess the pitch, roll and yaw of the model. The motion of the
aeroplane may be observed by high-speed imaging systems.
(b) Numerical methods
Numerical simulation techniques may be applied to determine the hydrodynamic behaviour
of the aeroplane when it is in contact with water. This may be achieved by using commercially
available software or in-house tools specifically developed and validated. Some of these tools
may be used for pressure (loads) generation during the impact phase only, but typically the
complete period between initial contact with water and the aeroplane coming to rest is
simulated.
5. Accepted methods for developing ditching pressures and loads
Ditching loads may be developed by analysis or by test. Analysis methods should be validated by
applicable testing. The guidance in this section concentrates on the approach conditions and the
impact analyses. Furthermore, CS 25.563 provides the relevant conditions:
a planned ditching is the water entry of a controlled aeroplane;
reasonable variations must be accounted for, as described in Section 6 of this AMC.
Ditching loads, considered as ultimate, are to be applied to the airframe taking into account the
hydrodynamic effects resulting from a water landing, with accompanying aerodynamic and inertia
loading. The hydrodynamic loads act directly on the lower skins of the fuselage and/or on the lower

Annex to ED Decision 2023/021/R Page 281 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

wing structure.
The methods that follow are acceptable methods for developing loads when showing compliance
with CS 25.563.
(a) Test methods
Water pressures, in terms of magnitude and (fore-aft, lateral) distribution, that occur during
the impact phase may be determined based on ditching model testing, with a model
equipped with a sufficient number of properly distributed pressure transducers. Typically,
accelerometers are also installed to measure accelerations.
Ditching model test results need to be properly scaled to aeroplane size. It would be
conservative to envelope the measured (scaled) peak water pressures and use these directly
to design the bottom structure of the aeroplane. If, on the other hand, the measured data is
modified (e.g. smoothing of peak pressures), this should be further substantiated.
Document NASA-TM-X-2445 (Ditching investigation of a 1/30-scale dynamic model of a heavy
jet transport airplane), dated February 1972, provides a table of scaling coefficients as
applied in published aeroplane model tests, as shown below.

Quantity Scale factor

Length
3
Force
5
Moment of
inertia
3
Mass
(1/2)
Time
(1/2)
Speed
Linear 1
acceleration
( 1)
Angular
acceleration
Pressure

(linear or non-linear) as a transfer function from measurement to the real aeroplane. The
-scale aeroplane dimension.
Quantity (model) = Quantity(full-scale aeroplane) x Scale factor
Example: Timemodel = Timeaeroplane x
(b) Analysis methods
(i) In order to quantify the structural capacity of aeroplane structures under
hydrodynamic loading, the prediction of global and local structural loads and resulting

Annex to ED Decision 2023/021/R Page 282 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

deformations is of fundamental importance. The analysis, however, is very challenging,

as ditching is a time-dependent, highly non-linear multiphysics problem with different
length and time scales resulting in complex loading conditions and coupled fluid
structure interaction. Hydrodynamic phenomena affect the fluid structure
interaction, and their occurrence may therefore influence the global aeroplane motion
during the landing phase.
To circumvent some of these complexities, an uncoupled analysis is often performed.
In uncoupled computational approaches, the fluid solution is obtained independent of
the structural solution, and the computations are run separately. The aeroplane
structure is typically represented by a Finite Element Model. This model represents the
global aeroplane structural stiffness and mass distribution, whereas the applied
hydrodynamic models are generally based on the momentum theory and the concept
of added mass developed by von Kármán and Wagner.
Whatever analysis technique is used, either coupled or uncoupled, validation of the
analysis by model ditching test results is necessary, as is an assessment of how each of
the hydrodynamic phenomena described above is addressed.
(ii) Suitable analytical methods may include a comparison with aeroplanes of a similar
configuration for which the characteristics during the ditching event (such as
aeroplane attitude, movement of centre of gravity and vertical and horizontal
speeds/accelerations) are known. This approach addresses generating loads and the
structural assessment. Reference data for this technique can, for example, be found in
document NACA-TN-2929 (Experimental investigation of the effect of rear-fuselage
shape on ditching behaviour), dated April 1953.
(iii) Analysis using seaplane float pressures per § 25.533 of the US Code of Federal
Regulations Title 14, Part 25. FAR Part 25 contains a set of regulations for water loads
for seaplane designs that can also be used for conventional large aeroplanes. These
methods, however, may not be applicable to large aeroplane configurations with flat
or essentially flat impact areas. Seaplane design methods may be used if these are
shown to be appropriate for the specific aeroplane configuration to be certified. This
involves the determination of seaplane design parameter equivalency based on
ditching model testing and establishing similarity of the product to the ditching
model(s) used. Design parameter equivalency should be established by analysis based
on test data, and product similarity should be established by consideration of
geometric (dimensions and shape) characteristics, number of engines and their
placement, wing configuration and mass properties.
Per FAR Part 25, § 25.533(b) local pressures are to be developed for use in the design
of local stringers and skins and their attachments to the supporting structure. These
pressures are intended to simulate pressures occurring during high localised impacts
on the hull but are not required to be extended over areas that would induce critical
loading in frames or the overall structure. Note that, for derivation of local pressures,
FAR Part 25, § 25.533(b)(1) for unflared bottoms, is considered to be more appropriate
for conventional large aeroplanes. With FAR Part 25, § 25.533(c), distributed pressures
are given with a distribution along the fuselage length, for the design of the frames.

Annex to ED Decision 2023/021/R Page 283 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

In addition, FAR Part 25, § 25.527, allows calculation of water reaction load factors
along the fuselage.
When applying these FAR Part 25 seaplane requirements to conventional large
aeroplanes, some of the seaplane design parameters cannot be applied directly and
may need some adjustment. For example, on a seaplane, the so-called step defines the
forebody and afterbody of the hull, but this design feature is not present on
conventional large aeroplanes. In addition, seaplanes have a flared or unflared bottom
structure, with a physical chine line, whereas conventional large aeroplanes are
(semi)circular in shape.
As a result, applicants typically do not apply the local and distributed pressure
distributions in the fore-aft and lateral (transverse) directions exactly as prescribed in
the FAR Part 25 seaplane requirements, but derive a more rational pressure
distribution based on ditching model testing data. Similarly, the definition of a chine
line (defining the wetted area where water pressures are applied) and an equivalent
deadrise angle as applicable to a (semi)circular-shaped fuselage need to be derived
from ditching model test data. When using the local or distributed pressure equations
contained in FAR Part 25, § 25.533, the aeroplane speed and weight at impact should
be as defined in FAR Part 25, § 25.125(b)(2)(i)), established for the aeroplane
assessment weight and corresponding to the flap setting established under the
preferred AFM ditching procedure.
6. Variation of flight parameters
Considering the inherent complexity of the ditching event, the following flight parameters and
characteristics should be used to define the structural loads with prescribed variations in certain
impact parameters and approach configurations. In general, the ditching condition should consider
the certified design ranges of aeroplane weight, centre of gravity and allowable configurations.
Variation in certain flight parameters may be reduced if the aeroplane has reliable design features
that control the variability.
Typically, the following flight parameters have to be considered and appropriately defined:
pitch attitude,
forward speed,
sink rate,
mass configuration (mass, centre of gravity, moments of inertia),
flap setting,
landing gear extended/retracted,
engine power or thrust setting,
rupture of engines, flaps or fairings.
This list of flight parameters may not be complete, depending on the aeroplane design.
Model tests or simulations may deliver time histories of all investigated flight parameters plus
pressure distributions, which can be integrated to obtain global loads. In this case, no further

Annex to ED Decision 2023/021/R Page 284 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

pressure calculation is necessary.

The objective is to find conditions that show:
smooth (hydro)dynamic behaviour (no nosedive or rebounce);
accelerations less than or equal to the inertia forces specified in CS 25.561(b) (higher load
factors may be acceptable provided the structural components are designed for the higher
loads and also provided it can be shown that the occupants are protected from serious injury
under these loads).
As an example, this assessment may result in the following:
sink rate of less than 5 feet/second,
forward speed of 100 knots at maximum landing weight and flaps fully extended, assuming
that the fuel is dumped or burned off,
pitch attitude between 7 degrees and 9 degrees,
landing gear retracted,
landing parallel to waves.
These conditions may be directly used for an AFM procedure and should be reviewed by pilots and
flight physics specialists in order to confirm that they are within the capability of the flight crew and
aeroplane. The AFM procedure is then completed by defining the preferred ditching technique from
level flight to the water surface.
The following criteria apply for the assessment of the variation of flight parameters:
(1) an aeroplane vertical descent rate not less than 1.52 m/s (5 feet/second) relative to the mean
water surface, unless a lower value is justified that fully accounts for likely variation over the
value established under the preferred AFM ditching procedure;
(2) a forward aeroplane speed along the flight path not less than VREF (as defined in
CS 25.125(b)(2)(i)) established for the aeroplane assessment weight and corresponding to
the flap setting established under the preferred AFM ditching procedure, unless a lower value
is justified that fully accounts for likely variation over the value established under the
preferred AFM ditching procedure;
(3) an increase in aeroplane attitude of at least 1 degree (nose up), as compared with the
attitude established under the preferred AFM ditching procedure, and, separately, a
decrease in aeroplane attitude of at least 1 degree (nose down) as compared with the
attitude established under the preferred planned AFM ditching procedure.
The following criteria apply for planned and unplanned ditching evaluation for all aeroplanes.
(1) For planned ditching, aeroplane weights may take into account fuel jettisoning provisions or
fuel burn-off but may not be less than the maximum design landing weight at the moment of
water impact.
Unplanned ditching flotation is to be based on maximum take-off weight. Structural damage
need not be considered for the unplanned ditching condition.
(2) Calm water states may be assumed.

Annex to ED Decision 2023/021/R Page 285 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

(3) Fresh water is assumed for flotation calculations.

(4) Any leakage should be accounted for in the flotation analysis.
(5) For planned ditching, withstanding ditching loads implies an airframe assessment that needs
to account for local loads (skin, stringers) and load factors for the fuselage and establish
distributed pressures. Local damage may occur, but the airframe structural integrity should
be maintained. Any leakage should be accounted for in the flotation analysis. Additionally,
breakaway or loss of large items (e.g. gear doors, belly fairing, flaps and engines) and its effect
on flotation and hydrodynamic behaviour should be considered.
(6) For planned ditching, only symmetrical conditions need to be considered, and the resulting
pressures can be considered ultimate loads. A rational distribution may be used to develop
the pressure distribution along the side of the fuselage.
7. Fidelity of loads analysis
The fidelity of the loads analysis depends on the process of structural substantiation, which follows
the loads generation.
The greatest fidelity achievable by analyses is when, for each calculation point on the airframe, a
pressure value is defined for each time step of the simulation. This can be used to develop a static
design case to be loaded on a Finite Element Model or to be used by any other method for
evaluating stresses. In addition, a pressure time history can be built, which can be used in a
structural substantiation.
For simplification, pressures can be averaged in time or space, or they may be integrated in local
forces for frame or skin stress evaluation. This depends on stress methods used by the applicant.
8. Airframe assessment
Fuselage structure should be assessed to verify that the frames can carry the distributed pressure
loads, that, consistent with flotation assumptions, the skins and stringers can withstand local
pressures and that items of mass are retained (load factors).
Global aeroplane integrity (i.e. not exceeding the certification strength envelopes) for the planned
ditching event should also be ensured.
In addition, as per CS 25.809(g), there must be provisions to minimise the probability of jamming of
the emergency exits resulting from fuselage deformation in a planned emergency landing on water.
9. Aeroplane flight manual procedures
AMC 25.1581 states that the AFM should include emergency procedures, including those for
ditching. For ditching, the AFM should include, as a minimum, procedures for a planned emergency
landing on water and procedures for a reduced/no engine power or thrust emergency landing on
water. The AFM ditching procedures should be consistent with the assumptions made in the
ditching analysis and in the definition of the ditching conditions. For example, if the ditching
conditions assume that the high-lift devices are to be extended during an emergency landing on
water, then the AFM procedures should include the necessary steps to extend the high-lift devices.
The AFM procedures should be verified for practicality and effectiveness, as required by
AMC 25.1309 Chapter 9, paragraph b(5).
10. Cabin crew training

Annex to ED Decision 2023/021/R Page 286 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
EMERGENCY LANDING CONDITIONS

The applicant should provide appropriate information to support cabin crew training for planned
and unplanned ditching scenarios in relation to the design precautions (e.g. ditching exits, lifelines,
raft portability, etc.).
[Amdt 25/28]

Annex to ED Decision 2023/021/R Page 287 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

FATIGUE EVALUATION

CS 25.571 Damage tolerance and fatigue evaluation of structure

(See AMC 25.571)
(a) General. An evaluation of the strength, detail design, and fabrication must show that catastrophic
failure due to fatigue, manufacturing defects, environmental deterioration, or accidental damage,
will be avoided throughout the operational life of the aeroplane. This evaluation must be conducted
in accordance with the provisions of subparagraphs (b) of this paragraph, except as specified in
subparagraph (a)(4) of this paragraph, for each part of the structure that could contribute to a
catastrophic failure. Additionally, a discrete source damage evaluation must be conducted in
accordance with subparagraph (e) of this paragraph, and those parts which could contribute to a
catastrophic failure must also be evaluated in accordance with subparagraph (d) of this paragraph.
In addition, the following apply:
(1) The evaluations of subparagraphs (b) and (c) must include:
(i) The typical loading spectra, temperatures, and humidities expected in service;
(ii) The identification of principal structural elements and detail design points, the failure
of which could contribute to a catastrophic failure of the aeroplane; and
(iii) An analysis, supported by test evidence, of the principal structural elements and detail
design points identified in sub-paragraph (a)(1)(ii) of this paragraph.
(2) The service history of aeroplanes of similar structural design, taking due account of
differences in operating conditions and procedures, may be used in the evaluations required
by this paragraph.
(3) Based on the evaluations required by this paragraph, inspections or other procedures must
be established as necessary to prevent catastrophic failure, and must be included in the
Airworthiness Limitations Section of the Instructions for Continued Airworthiness required
by CS 25.1529. The limit of validity of the engineering data that supports the structural
maintenance programme (hereafter referred to as LOV), stated as a number of total
accumulated flight cycles or flight hours or both, established by this paragraph, must also be
included in the Airworthiness Limitations Section of the Instructions for Continued
Airworthiness.
(4) If the results of the evaluation required by subparagraph (b) show that damage tolerance-
based inspections are impractical, then an evaluation must be performed in accordance with
the provisions of subparagraph (c).
If the results of the evaluation show that damage tolerance-based inspections are practical,
then inspection thresholds must be established for all principal structural elements and detail
design points. For the following types of structure, the threshold must be established based
on analyses and/or tests, assuming the structure contains an initial flaw representative of a
defect or damage of the maximum probable size that could exist as a result of manufacturing
processes or manufacturing or service-induced damage:
(i) single load path structure; and

Annex to ED Decision 2023/021/R Page 288 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(ii) fail- -
cannot be demonstrated that the resulting load path failure or partial failure (including
arrested cracks) will be detected and repaired during normal maintenance, inspection,
or operation of an aeroplane prior to failure of the remaining structure.
(5) Inspection programmes must be established to protect the structure evaluated under
subparagraph (b) and (c) against the effects of environmental deterioration and service-
induced accidental damage. In addition, a baseline corrosion and prevention control
programme (CPCP) must be established. The Airworthiness Limitations Section of the
Instructions for Continued Airworthiness must include a statement that requires the operator
to include a CPCP in their maintenance programme that will control corrosion to Level 1 or
better.
(b) Fatigue and damage tolerance evaluation. The evaluation must include a determination of the
probable locations and modes of damage due to fatigue, environmental deterioration (e.g.
corrosion), or accidental damage. Repeated load and static analyses, supported by test evidence
and (if available) service experience, must be incorporated in the evaluation. Damage at multiple
sites due to prior fatigue exposure (including special consideration of widespread fatigue damage)
must be included in the evaluation where the design is such that this type of damage could occur.
An LOV must be established that corresponds to the period of time, stated as a number of total
accumulated flight cycles or flight hours or both, for which it has been demonstrated by full-scale
fatigue test evidence that widespread fatigue damage will not occur in the aeroplane structure.
The type certificate may be issued prior to completion of the full-scale fatigue testing provided that
EASA has approved a plan for completing the required tests and analyses, and that at least one
calendar year of safe operation has been substantiated at the time of type certification. In addition,
the Airworthiness Limitations Section of the Instructions for Continued Airworthiness must specify
an interim limitation restricting aircraft operation to not more than half the number of the flight
cycles or flight hours accumulated on the fatigue test article, until such testing is completed,
freedom from widespread fatigue damage has been established and the LOV is approved.
The extent of damage for residual strength evaluation at any time within the operational life of the
aeroplane must be consistent with the initial detectability and subsequent growth under repeated
loads. The residual strength evaluation must show that the remaining structure is able to withstand
loads (considered as static ultimate loads) corresponding to the following conditions:
(1) The limit symmetrical manoeuvring conditions specified in CS 25.331 at all speeds up to VC
and in CS 25.345.
(2) The limit gust conditions specified in CS 25.341 at the specified speeds up to VC and in
CS 25.345.
(3) The limit rolling conditions specified in CS 25.349 and the limit unsymmetrical conditions
specified in CS 25.367 and CS 25.427(a) through (c), at speeds up to VC.
(4) The limit yaw manoeuvring conditions specified in CS 25.351 at the specified speeds up to VC.
(5) For pressurised cabins, the following conditions:
(i) The normal operating differential pressure combined with the expected external
aerodynamic pressures applied simultaneously with the flight loading conditions

Annex to ED Decision 2023/021/R Page 289 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

specified in sub-paragraphs (b)(1) to (b)(4) of this paragraph if they have a significant

effect.
(ii) The maximum value of normal operating differential pressure (including the expected
external aerodynamic pressures during 1 g level flight) multiplied by a factor of 1·15
omitting other loads.
(6) For landing gear and other affected airframe structure, the limit ground loading conditions
specified in CS 25.473, CS 25.491 and CS 25.493.
If significant changes in structural stiffness or geometry, or both, follow from a structural
failure, or partial failure, the effect on damage tolerance must be further evaluated.
(c) Fatigue (safe-life) evaluation. Compliance with the damage-tolerance requirements of sub-
paragraph (b) of this paragraph is not required if the applicant establishes that their application for
particular structure is impractical. This structure must be shown by analysis, supported by test
evidence, to be able to withstand the repeated loads of variable magnitude expected during its
service life without detectable cracks. Appropriate safe-life scatter factors must be applied. Until
such time as all testing that is required for compliance with this subparagraph is completed, the
replacement times provided in the Airworthiness Limitations Section of the Instructions for
Continued Airworthiness may not exceed the total accumulated flight cycles on the test article test
life divided by the applicable scatter factor.
(d) Sonic fatigue strength. It must be shown by analysis, supported by test evidence, or by the service
history of aeroplanes of similar structural design and sonic excitation environment, that:
(1) Sonic fatigue cracks are not probable in any part of the flight structure subject to sonic
excitation; or
(2) Catastrophic failure caused by sonic fatigue cracks is not probable assuming that the loads
prescribed in sub-paragraph (b) of this paragraph are applied to all areas affected by those
cracks.
(e) Discrete source damage tolerance evaluation. The aeroplane must be capable of successfully
completing a flight during which likely structural damage occurs as a result of bird impact as
specified in CS 25.631.
The damaged structure must be able to withstand the static loads (considered as ultimate loads)
which are reasonably expected to occur at the time of the occurrence and during the completion
of the flight. Dynamic effects on these static loads do not need to be considered. Corrective action
to be taken by the pilot following the incident, such as limiting manoeuvres, avoiding turbulence,
and reducing speed, may be considered. If significant changes in structural stiffness or geometry,
or both, follow from a structural failure or partial failure, the effect on damage tolerance must be
further investigated.
[Amdt 25/18]
[Amdt 25/19]

AMC 25.571 Damage tolerance and fatigue evaluation of structure

1. PURPOSE

Annex to ED Decision 2023/021/R Page 290 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

This AMC provides guidance for compliance with the provisions of CS 25.571 pertaining to the
damage tolerance and fatigue evaluation requirements for aeroplane metallic and non-metallic
structure. It also provides rational guidelines for the evaluation of scatter factors for the
determination of life limits for parts categorised as safe-life. Additional guidance material for
certification of non-metallic structures that must also comply with CS 25.571 is contained in
AMC 20-29.
2. (RESERVED)
3. REFERENCES
CS 25.571 Damage tolerance and fatigue evaluation of structure,
CS 25.1529 Instructions for Continued Airworthiness,
AMC 20-20 Continued Structural Integrity Programme,
AMC 20-29 Composite Structure.
4. DEFINITIONS OF TERMS USED IN THIS AMC

strength without detrimental structural deformation for a period of use after the structure has
sustained a given level of fatigue, environmental, accidental, or discrete source damage.

a catastrophic failure of an aircraft.

- hat number of events such as flights, landings, or flight hours, during
which there is a low probability that the strength will degrade below its design ultimate value due
to fatigue cracking.
ycles or flight hours, or both) established
at design and/or certification during which the aircraft structure is reasonably free from significant
cracking.
f
flight, ground, or pressurisation loads, and whose integrity is essential in maintaining the overall
structural integrity of the aeroplane.

structure to fatigue cracking or degradation such that the structure cannot maintain its load
carrying capability, which could lead to a catastrophic failure.

failure of which would result in the loss of the structural capability to carry the applied loads.

members so that the failure of a single structural member does not result in the loss of structural
capability to carry the applied loads.

of cracks at multiple structural details that are of sufficient size and density whereby the structure
will no longer meet the residual strength requirement of CS 25.571(b).

Annex to ED Decision 2023/021/R Page 291 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(1)
simultaneous presence of fatigue cracks in the same structural element.
(2)
the simultaneous presence of fatigue cracks in adjacent structural elements.
(3) e
modified to preclude WFD.
(4)
initiated due to a specific probability of having an MSD/MED condition.
terpretation of fatigue analysis and fatigue
test results.

programme is not more than the period of time, stated as a number of total accumulated flight
cycles or flight hours or both, during which it is demonstrated by test evidence, analysis and, if
available, service experience and teardown inspection results of high-time aeroplanes, that
widespread fatigue damage will not occur in the aeroplane structure

base maintenance inputs requiring general visual inspections and is normally associated with a
zonal programme. The zonal programme is a collective term comprising selected general visual
inspections and visual checks that are applied to each zone, defined by access and area, to check
system and power plant installations and structure for security and general condition. A general
visual inspection is a visual examination of an interior or exterior area, installation, or assembly to
detect obvious damage, failure, or irregularity. This level of inspection is made from within touching
distance unless otherwise specified. A mirror may be necessary to enhance visual access to all
exposed surfaces in the inspection area. This level of inspection is made under normally available
lighting conditions such as daylight, hangar lighting, flashlight, or droplight and may require removal
or opening of access panels or doors. Stands, ladders, or platforms may be required to gain access.

techniques or visual (magnified glass and dye penetrant) or other, and non-destructive inspection
methods (eddy current, ultrasonic) to identify the extent of damage, within a structure, caused by
fatigue, environmental and accidental damage.
-
a period of unrepaired use after the failure or partial failure of a principal structural element.
(average behaviour) % of the fleet is expected to
develop WFD for a particular structure.

damage occurring between successive inspections that is within allowable damage limits; or
damage occurring between successive inspections that does not require structural reinforcement,
replacement or new damage tolerance based inspections; or
corrosion occurring between successive inspections that exceeds allowable limits but can be
attributed to an event not typical of operator usage of other aircraft in the same fleet; or

Annex to ED Decision 2023/021/R Page 292 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

light corrosion occurring repeatedly between inspections that eventually requires structural
reinforcement, replacement, or new damage-tolerance-based inspections.
5. BACKGROUND
(a) Since the early 1970s, there have been significant state-of-the-art and industry-practice
developments in the area of structural fatigue and fail-safe strength evaluation of transport
category aeroplanes. Recognising that these developments could warrant some revision of
the existing fatigue requirements of § 25.571 and 25.573 of 14 CFR Part 25, the Federal
Aviation Administration (FAA), on 18 November 1976 (41 FR 50956), gave notice of the
Transport Category Aeroplane Fatigue Regulatory Review Programme and invited interested
persons to submit proposals to amend those requirements. The proposals and related
discussions formed the basis for the revision of the structural fatigue evaluation standards of
§ 25.571 and § 25.573 of 14 CFR Part 25 and the development of guidance material. To that
end, § 25.571 was revised, § 25.573 was deleted (the scope of § 25.571 was expanded to
cover the substance of the deleted section), and guidance material (FAA AC 25.571-1) was
provided which contained compliance provisions related to the proposed changes.
(b) Since the issuance of FAA AC 25.571-1 on 28 September 1978, additional guidance material,
including information regarding discrete source damage, was developed and incorporated in
revision 1A on 5 March 1986. The AC was further revised on 18.2.1997 (revision 1B) to add
guidance on the elements to be considered in developing safe-life scatter factors for
certification. Although FAR, JAR, and CS 25.571 have, since 1978, required consideration of
fatigue damage originating at multiple sites, the FAA AC was further revised on 29 April 1998
(revision 1C) to add guidance material whose objective was to preclude widespread fatigue
damage (resulting from MSD or MED) from occurring within the design service goal of the
aeroplane, and to aid in the determination of thresholds for fatigue inspection and/or other
special fleet actions. JAR/CS 25.571 were not harmonised with the 1998 amendment of 14
CFR 25.571. Under the auspices of the Aviation Rulemaking Advisory Committee (ARAC), the
General Structure Harmonization Working Group (GSHWG) drafted NPA 25C-292 proposing
the Limit of Validity (LOV), greater emphasis on testing, corrosion and manufacturing, and
accidental damage in the 25.571 requirements and corresponding AC material to support
this. EASA AMC 20- -
concept in 2007. AC 25.571-1D, issued on 13 January 2011, provides guidance in support of
14 CFR 25 Amdt 132 which introduced the LOV requirement. Thus, AMC 25.571 has been
revised to provide guidance for establishing an LOV for the structural maintenance
programme as will now be required by CS 25.571. In conclusion, this AMC revision based on
the GSHWG work and recently developed FAA guidance, now better harmonises with the
EASA guidance, AC 25.571-1D, and industry practice.
6. INTRODUCTION
(a) General
The content of this AMC is considered by EASA in determining compliance with the
requirements of CS 25.571. The objective is to prevent catastrophic structural failures caused
by fatigue damage (FD) (including e.g. widespread fatigue damage (WFD)), environmental
deterioration (ED) (e.g. corrosion damage), or accidental damage (AD).

Annex to ED Decision 2023/021/R Page 293 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

Compliance involves good design practice to ensure that damage tolerance can be achieved
and the establishment of maintenance actions developed in compliance with CS 25.1529.
Taken together, they result in a structure where the combination of design characteristics
and maintenance actions will serve to preclude any failure due to FD, ED, or AD.
CS 25.571(a)(3) requires the applicant to establish inspections or other procedures (herein
also referred to as maintenance actions) as necessary to avoid catastrophic failure during the
operational life of the aeroplane based on the results of the prescribed fatigue and damage
tolerance evaluations.
CS 25.571(a)(5) requires development of inspections for ED and AD. CS 25.571(b) requires
the applicant to establish an LOV. Furthermore, CS 25.571(b) and (c) require establishment
of inspections and replacement times respectively based on the damage tolerance and
fatigue characteristics of the structure. The LOV is, in effect, the operational life of the
aeroplane consistent with the evaluations accomplished and maintenance actions
established to prevent WFD. The LOV is established based on WFD considerations and it is
intended that all maintenance actions required to address fatigue damage, environmental
deterioration (e.g. corrosion damage for metallics, moisture for composites), and accidental
damage (e.g. impact, lightning), up to the LOV, are identified in the structural maintenance
programme. All inspections and other procedures (e.g. modification times, replacement
times) that are necessary to prevent a catastrophic failure due to fatigue, up to the LOV, must
be included in the Airworthiness Limitations Section (ALS) of the Instructions for Continued
Airworthiness (ICA), as required by CS 25.1529, along with the LOV.
CS 25.571(d) requires the structure to be designed such that sonic fatigue cracking is not
probable or, if it arises, it will not result in a catastrophic failure. CS 25.571(e) requires the
structure to be designed to withstand damage caused by specified threats such that the flight
during which the damage is sustained can be completed.
(1) CS 25.571(a)(5) Environmental and accidental damage inspections and associated
procedures
Inspections for ED and AD must be defined. Special consideration should be given to
those areas where past service experience indicates a particular susceptibility to attack
by the environment or vulnerability to impact and/or abuse. It is intended that these
inspections will be effective in discovering ED or AD before it interacts with fatigue
related phenomena, and that the ED or AD will, therefore, be removed/repaired
before it presents a significant risk. Typically these inspections are largely defined
based on past service experience using a qualitative or quantitative process in
combination with the Airline Transportation Association (ATA) Maintenance Steering
Group (MSG)-3 process. For new structure and materials, testing may be required to
evaluate likely AD and the subsequent tolerance of the design to it. For ED prevention,
an effective CPCP is necessary, which will contain tasks and procedures in addition to
inspections that will help prevent initiation and, when necessary, the recurrence of
corrosion (see AMC 20-20). Furthermore, CS 25.571 requires that the ALS must include
a statement that requires the operator to include a CPCP in their maintenance
programme that will control the corrosion to Level 1 or better.
Any special inspections required for AD and ED, i.e. ones in addition to those that
would be generated through the use of the MSG-3 process for AD and ED, or the

Annex to ED Decision 2023/021/R Page 294 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

baseline CPCP development, and which are necessary to prevent catastrophic failure
of the aeroplane, must be included in the ALS of the ICA required by CS 25.1529. If a
location is prone to accidental or environmental damage and the only means for
detection is one that relies on the subsequent development of a fatigue crack from the
original damage, then that inspection must be placed in the ALS of the ICA.
Note: The AD and ED inspection programme including the baseline CPCP are equally
applicable to structures showing compliance with CS 25.571(b) and (c) respectively.
(2) CS 25.571(b) and (c) Fatigue damage inspections or replacement times
Inspections for fatigue damage or replacement times must be established as
necessary. These actions must be based on quantitative evaluations of the fatigue
characteristics of the structure. In general, analysis and testing will be required to
generate the information needed. The applicant should perform crack growth and
residual strength testing to produce the design data needed to support crack growth
and residual strength analyses. Full-scale fatigue test evidence is required to support
the evaluation of structure that is susceptible to WFD. Test evidence is needed to
support analysis used to establish safe-life replacement times.
(i) Inspection or replacement
Compliance with CS 25.571(b) is required unless it can be demonstrated to the
satisfaction of the authority that compliance cannot be shown due to practical
constraints. Under these circumstances, compliance with CS 25.571(c) is
required. The only common example of structure where compliance with the
requirements of CS 25.571(c), in lieu of CS 25.571(b), might be accepted, would
be the landing gear and its local attachments.
(ii) ALS of the ICA
All inspections and replacement times necessary to detect or preclude fatigue
cracking scenarios, before they become critical, must be included in the ALS of
the ICA required by CS 25.1529.
(iii) Limit of Validity (LOV)
An LOV for the structural maintenance programme must also be determined and
included in the ALS of the ICA. See section 11 of this AMC for additional guidance
on the LOV.
(b) Typical loading spectrum expected in service
The loading spectrum should be based on measured statistical data of the type derived from
government and industry load history studies, and where insufficient data are available on a
conservative estimate of the anticipated use of the aeroplane. The development of the
loading spectrum includes the definition of the expected flight plan, which involves ground
manoeuvres, climb, cruise, descent, flight times, operating speeds, weights and altitudes, and
the approximate time to be spent in each of the operating regimes. The principal loads that
should be considered in establishing a loading spectrum are flight loads (gust and
manoeuvre), ground loads (taxiing, landing impact, turning, engine run-up, braking, thrust
reversing and towing), and pressurisation loads. Operations for crew training and other

Annex to ED Decision 2023/021/R Page 295 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

pertinent factors, such as the dynamic stress characteristics of any flexible structure excited
by turbulence or buffeting, should also be considered. For pressurised cabins, the loading
spectrum should include the repeated application of the normal operating differential
pressure and the superimposed effects of flight loads and aerodynamic pressures.
(c) Areas to be evaluated
When assessing the possibility of serious fatigue failures, the design should be examined to
determine probable points of failure in service. In this examination consideration should be
given, as necessary, to the results of stress analyses, static tests, fatigue tests, strain gauge
surveys, tests of similar structural configurations, and service experience. Service experience
has shown that special attention should be focused on the design details of important
discontinuities, main attach fittings, tension joints, splices, and cut-outs such as windows,
doors, and other openings. Locations prone to accidental damage (such as that due to the
impact with ground servicing equipment near aeroplane doors) or to corrosion should be
identified for analysis.
(d) Analyses and tests
Fatigue and damage tolerance analyses should be conducted unless it is determined that the
normal operating stresses are of such a low order that crack initiation and, where applicable,
significant damage growth is extremely improbable. Any method used in the analyses should
be supported by test or service experience. Typical (average) values of fatigue respectively
fracture mechanics material properties may be used in fatigue analysis respectively residual
strength and crack growth analyses. The effects of environment on these properties should
be accounted for if significant.
Generally, testing will also be necessary to support compliance with CS 25.571(b) or (c). The
nature and extent of testing of complete structures or portions will depend on applicable
previous design and structural tests and service experience with similar structures. Structural
areas such as attachment fittings, major joints, changes in section, cut-outs, and
discontinuities almost always require some level of testing in addition to analysis. When less
than the complete structure is tested, care should be taken to ensure that the internal loads
and boundary conditions are valid. When tests are conducted to support the identification of
areas susceptible to fatigue, the duration of the test should take into account factors such as
material and loading spectrum variability, together with the expected operational life. Refer
to Appendix 2 for specific guidance regarding testing required to establish the LOV.
(e) Discrete source damage
It must be shown that the aeroplane is capable of successfully completing a flight during
which specified incidents occur and result in immediately obvious damage. The maximum
extent of the damage must be quantified and the structure must be shown to be capable of
sustaining the maximum load (considered as ultimate) expected during the completion of the
flight. There are no maintenance actions that result from this evaluation.
7. DAMAGE TOLERANCE EVALUATION
(a) General
The damage tolerance requirements of CS 25.571(b) are intended to ensure that, should
fatigue, corrosion, or accidental damage occur within the LOV, the structure will be capable

Annex to ED Decision 2023/021/R Page 296 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

of withstanding the loading conditions specified in CS 25.571(b)(1) through (b)(6) without

failure or detrimental structural deformation until the damage is detected. The evaluation
should include identifying the PSEs, defining the loading conditions and conducting
sufficiently representative structural tests or analyses, or both, to provide sufficient data for
the establishment of the inspection programme. Although this process applies to either
single or multiple load path structure, the use of multiple load path structures should be
given priority in achieving a damage-tolerant design. The principle analytical tool used for
metallic materials to perform a damage tolerance evaluation is based on fracture mechanics.
A discussion of this approach is presented in Appendix 1 of this guidance material. The means
of establishing the LOV and maintenance actions specifically associated to WFD is addressed
in detail in Section 11 of this AMC.
(b) Damage-tolerant characteristics
A damage-tolerant structure has two notable attributes:
(1) The structure can tolerate a significant amount of damage, due to fatigue,
environmental or accidental deterioration without compromising the continued
airworthiness of the aeroplane (residual strength and rigidity).
(2) The structure can sustain that damage long enough to be found and repaired during
scheduled or unscheduled maintenance (inspectability).
(c) Design considerations
To achieve a damage-tolerant structure, criteria should be established to guide the design
process so that this design objective is achieved. The design process should include a damage
tolerance evaluation (test and analysis) to demonstrate that the damage-tolerant design
objectives are achieved, and to identify inspections or other procedures necessary to prevent
catastrophic failure. Reliance on special inspections should be minimised by designing
structure with easily detectable (e.g. visual) cracking modes. Since the occurrence of WFD
can complicate a damage-tolerant evaluation to the point that reliable inspections
programmes cannot be developed even with extremely intensive inspection methods, it must
be demonstrated, with sufficient full-scale fatigue test evidence, that adequate maintenance
procedures are contained in the ALS of the ICA, such that WFD will not occur within the LOV.
A discussion on several issues that an applicant might face in demonstrating freedom from
WFD is contained in Appendix 2 to this AMC.
(d) Design features
Design features which should be considered in attaining a damage-tolerant structure include
the following:
(1) multiple load path construction and/or the use of damage containment features to
arrest fast fracture or reduce the crack growth rate, and to provide adequate residual
strength;
(2) materials and stress levels that provide a slow rate of crack propagation combined with
high residual strength; and
(3) arrangement of design details to ensure a sufficiently high probability that a failure in
any critical structural element will be detected before the strength has been reduced

Annex to ED Decision 2023/021/R Page 297 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

below the level necessary to withstand the loading conditions specified in CS

25.571(b).
(e) Probabilistic evaluations
No guidance is provided in this AMC on probabilistic evaluation. Normally, damage tolerance
assessments consist of a deterministic evaluation of design features described in paragraphs
7(d)(1), (2) and (3). Paragraphs (f) to (i) below provide guidelines for this approach.
(f) PSEs, detail design points, and locations to be evaluated
In accordance with CS 25.571(a), a damage tolerance and fatigue evaluation should be
conducted for each part of the structure which could contribute to a catastrophic failure.
PSEs such as wing, empennage, control surfaces and their systems, the fuselage, engine
mountings, landing gears, and their related primary attachments, and all DDPs susceptible to
fatigue that could contribute to a catastrophic failure should be evaluated.
In accordance with CS 25.571(a)(1)(ii), this evaluation must include the identification of PSEs
and DDPs, the failure of which could contribute to catastrophic failure of the aeroplane. As
defined in this AMC, a principal structural element is an element of structure that contributes
significantly to the carrying of flight, ground, or pressurisation loads and whose integrity is
essential in maintaining the overall structural integrity of the aeroplane. When identifying
PSEs, consideration should be given to the effect caused by partial or complete loss or failure
of structure with respect to continued safe flight and landing, considering all flight phases
including stability, control and aeroelasticity.
A DDP is an area at higher risk of fatigue cracking than other areas, and may warrant specific
actions such as special inspections or other procedures to ensure continued airworthiness.
(1) Locations requiring evaluation can be determined by analysis or by fatigue tests on
complete structures or subcomponents. However, tests may be necessary when the
basis for analytical prediction is not reliable, such as for complex components. If less
than the complete structure is tested, care should be taken to ensure that the internal
loads and boundary conditions are valid.
The selection criteria for DDPs should also include the following considerations:
(a) any evidence of cracking encountered in service on a comparable structure;
(b) any evidence of cracking found during fatigue testing on a comparable structure;
(c) available strain gauge data;
(d) locations where permanent deformation occurred on static test articles;
(e) areas analytically shown to have a relatively low crack initiation life;
(f) susceptibility to corrosion or other environmental deterioration (e.g.
disbonding);
(g) potential for manufacturing anomalies (e.g. new or novel manufacturing
processes where the potential for damage may not be well understood);
(h) vulnerability to in-service induced accidental damage;
(i) areas whose failure would create high stresses in the remaining structure;

Annex to ED Decision 2023/021/R Page 298 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(j) elements in high tension or shear;

(k) low static margin;
(l) high stress concentrations;
(m) high load transfer;
(n) materials with high crack growth rates;
(o) some DDPs may exist outside of PSEs and may also have been classified as
fatigue critical structure, e.g. undercarriage door attachments (see Appendix 5
for discussion on PSEs, FCS and DDP);
(p) areas where detection of damage would be difficult;
(q) locations subject to vibrations or other mechanisms that may lead to premature
wear fastener holes; and
(r) locations vulnerable to moisture ingress or retention.
(2) Examples of principal structural elements (PSEs)
Typical examples of structure which are usually considered to be PSEs are:
(i) Wing and empennage
(a) control surfaces, slats, flaps, and their mechanical systems and
attachments (hinges, tracks, and fittings);
(b) primary fittings;
(c) principal splices;
(d) skin or reinforcement around cut-outs or discontinuities;
(e) skin-stringer combinations or integrally stiffened plates;
(f) spar caps;
(g) spar webs; and
(h) ribs and bulkheads.
(ii) Fuselage
(a) circumferential frames and adjacent skin;
(b) pilot window posts;
(c) pressure bulkheads;
(d) skin and any single frame or stiffener element around a cut-out;
(e) skin or skin splices, or both, under circumferential loads;
(f) skin or skin splices, or both, under fore and aft loads;
(g) skin and stiffener combinations under fore and aft loads;
(h) door skins, frames, stops and latches;

Annex to ED Decision 2023/021/R Page 299 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(i) window frames; and

(j) floor beams2.
(iii) Landing gear and their attachments
(iv) Engine mounts and struts
(v) Thrust reverser components, whose failure could result in inadvertent
deployment
(3) Extent of Damage.
Each particular design should be assessed to establish appropriate damage criteria in
relation to inspectability and damage-extension characteristics. In any damage
determination, including those involving multiple cracks, it is possible to establish the
extent of damage in terms of detectability with the inspection techniques to be used,
the associated initially detectable crack size, the residual strength capabilities of the
structure, and the likely damage-extension rate considering the expected stress
redistribution under the repeated loads expected in service and with the expected
inspection frequency. Thus, an obvious partial failure could be considered to be the
extent of the damage or residual strength assessment, provided a positive
determination is made that the fatigue cracks will be detectable by the available
inspection techniques at a sufficiently early stage of the crack development. The
following are typical examples of partial failures which should be considered in the
evaluation:
(i) Detectable skin cracks emanating from the edge of structural openings or
cutouts;
(ii) A detectable circumferential or longitudinal skin crack in the basic fuselage
structure;
(iii) Complete severance of interior frame elements or stiffeners in addition to a
detectable crack in the adjacent skin;
(iv) A detectable failure of one element where dual construction is utilised in
components such as spar caps, window posts, window or door frames, and skin
structure;
(v) The presence of a detectable fatigue failure in at least the tension portion of the
spar web or similar element; and
(vi) The detectable failure of a primary attachment, including a control surface hinge
and fitting.
(g) Inaccessible areas
Every reasonable effort should be made to ensure inspectability (reference CS 25.611) of all
structural parts. In those cases where inaccessible and uninspectable blind areas exist, the

2 Floor beams are not always critical but should be checked for criticality, particularly those located next to cut-outs or within non-circular
pressurised sections.

Annex to ED Decision 2023/021/R Page 300 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

damage tolerance evaluation should allow for extension of damage into detectable areas or
demonstrate sufficient residual strength up to the LOV without inspection.
(h) Residual strength testing of principal structural elements
Analytical prediction of the residual strength of structures can be very complex due to non-
linear behaviour, load redistribution and the potential for a multiplicity of failure modes. The
nature and extent of residual strength tests will depend on previous experience with similar
structures. Simulated cracks should be as representative as possible of actual fatigue
damage. Where it is not practical to produce actual fatigue cracks, damage can be simulated
by cuts made with a fine saw, sharp blade, guillotine, or other suitable means. Whatever
artificial means are used to simulate sharp fatigue cracks, sufficient evidence should be
available from tests to indicate equivalent residual strength. If equivalency cannot be shown,
every attempt should be made to apply enough cyclic loading to generate fatigue cracks from
the artificial damage prior to applying residual strength loads. Special consideration should
be given to the procedure for pre-cracking so that subsequent test results are representative.
This can be an issue when slow stable tearing in ductile sheet or plate material is part of the
failure mechanism. Inappropriate pre-cracking loads can lead to non-conservative results. In
those cases where bolt failure, or its equivalent, is to be simulated as part of a possible
damage configuration in joints or fittings, bolts can be removed to provide that part of the
simulation.
(i) Damage tolerance analysis and tests
(1) It should be determined by analysis, supported by test evidence, that:
(i) the structure, with the extent of damage established for residual strength
evaluation, can withstand the specified residual strength loads (considered as
ultimate loads); and
(ii) the crack growth life under the repeated loads expected in service (between the
time the damage becomes initially detectable and the time the extent of
damage reaches the value for residual strength evaluation) provides a practical
basis for development of the inspection programme and procedures described
in Section 8 of this AMC.
(2) The repeated loads should be as defined in the loading, temperature, and humidity
spectra. The loading conditions should take into account the effects of structural
flexibility and rate of loading where they are significant.
(3) The damage tolerance characteristics can be shown analytically by reliable or
conservative methods such as the following:
(i) By demonstrating quantitative relationships with structure already verified as
damage-tolerant; or
(ii) By demonstrating that the repeated loads and residual strength load stresses do
not exceed those of previously verified designs of similar configuration,
materials, and inspectability.
8. INSPECTION REQUIREMENTS
(a) Damage detection

Annex to ED Decision 2023/021/R Page 301 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

Detection and repair of damage before it becomes critical is the most important factor in
ensuring that the damage tolerance characteristics of the structure are maintained. For this
reason, CS 25.571 requires that the applicant establish inspections or other procedures, as
necessary, to prevent catastrophic failure from accidental, environmental, or fatigue
damage, and include those inspections and procedures in the ALS of the Instructions for
Continued Airworthiness required by CS 25.1529 (see also Appendix H to Part-25).
Due to the complex interactions of the many parameters that affect the damage tolerance
evaluation, such as operating practices, environmental effects, load sequence effects on
crack growth, and variations in inspection methods, operational experience should be taken
into account in establishing inspection thresholds, repeat intervals, and inspection
procedures.
(b) Environmental and accidental damage inspection programmes
The inspections developed under CS 25.571(b) are primarily for the detection of cracks
developing from fatigue, accidental damage, and corrosion. As required by CS 25.571(a)(5),
a separate programme needs to be implemented for the early detection of environmental
and accidental damage. This is intended to minimise the risk of:
(1) interaction between corrosion and fatigue cracking;
(2) accidental damage developing into fatigue cracks; or
(3) corrosion developing due to accidental damage.
In many cases this can be accomplished through the Maintenance Review Board (MRB)
activity or equivalent process agreed by EASA, for a new large aeroplane model using MSG-3
procedures. These procedures also require that a CPCP be developed.
For ED and AD programmes developed under the auspices of the MRB, the minimum ALS
content associated with AD and ED may generally be limited to:
a reference to the documents that contain the MRB report (MRBR) derived maintenance
tasks for AD and ED; and
t
and
a statement requiring operators to control corrosion to Level 1 or better.
It is also important to explain to operators the link between the AD and ED inspection
programmes and CS 25.571 and CS 25.1529 compliance.
Inspections that are designed to detect fatigue cracking resulting from AD or ED, where the
originating damage cannot otherwise be demonstrated to be detected prior to the
development of the fatigue cracks, must also be directly included in the ALS. For new
structure where there is limited supporting data from service experience, the MRB will
depend heavily on input from the analyses and test programmes conducted by the applicant
during certification, and for this reason significant cooperation is required between those
involved directly in certification and those participating in the MRBR development. Care
should also be taken to ensure that the damage assumptions made remain conservative after
entry into service. A check of the continued validity of the certification assumptions can be

Annex to ED Decision 2023/021/R Page 302 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

achieved through fleet leader programmes and robust reporting requirements. If there is any
doubt about the likely performance of a completely new structure with respect to AD and
ED, certain specific inspections in vulnerable areas may be better placed in the ALS.
The baseline CPCP may be established through the MRB Industry Steering Committee (ISC)
using existing procedures for MRBR development or developed by the applicant and
submitted directly to EASA. (Note: Provided the operator has an NAA-approved maintenance
programme that controls corrosion to Level 1 or better, it does not need to follow exactly the
baseline CPCP offered by the type certificate holder (TCH). However, all
programme for ED and AD must be considered by the operator for incorporation in the
operators MP under the Part-M requirements.)
Reporting requirements for these programmes should extend to overhaul procedures where
the condition of the part should be assessed and reported if outside of approved limits,
whether or not it is to remain on the component being overhauled.
Changes and supplemental type certificates (STC) must also be provided with inspection
programmes that address ED and AD.
(c) Inspection threshold for fatigue cracking
The inspection threshold is the point in time at which the first planned structural inspection
is performed following entry into service. The threshold may be as low as the repeat interval,
or may allow for a longer period of operation, provided certain conditions are met.
The concept of delaying an inspection threshold beyond the repeat interval is based on the
premise that it will take a certain amount of time before fatigue cracks would develop to a
size that would be detectable during a structural inspection. Consequently, it may be
acceptable to wait some period of time before starting to inspect for fatigue cracks.
CS 25.571(a)(4) requires inspection thresholds for certain structure to be derived assuming
that the structure contains an initial flaw of the maximum probable size that could exist as a
result of manufacturing processes or manufacturing or service-induced damage. For metallic
structure this would typically be achieved using crack growth analysis supported by tests.
This approach applies to:
(1) single load path structure, and
(2) - -
cannot be demonstrated that the resulting load path failure or partial failure (including
arrested cracks) will be detected and repaired during normal maintenance, inspection,
or operation of an aeroplane prior to failure of the remaining structure.
In this context, normal maintenance includes general visual structural inspections for
accidental and environmental damage derived from processes such as the MRB application
of MSG-3. Inspections should begin early enough to ensure that there is a high confidence of
detecting cracks before they could lead to a catastrophic structural failure.
For the locations addressed by CS 25.571(a)(4) that are also susceptible to accidental
(manufacturing or service induced) damage, the assumed initial flaw size for crack growth
determination of the threshold should not be less than that which can be supported by
service experience or test evidence. For example, if the type of damage expected is well

Annex to ED Decision 2023/021/R Page 303 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

defined, e.g. it is limited to dents, then there may be data that supports a longer threshold
than would be derived by the assumption of a crack that is similar in size to the dent.
However, in this case, the worst case manufacturing flaw should still be considered as a crack
and the most conservative resulting threshold adopted. If supporting data is not available
(e.g. for a completely new design where no specific investigation of the accidental damage
threats or their influence on fatigue has been made), then the fatigue cracking inspection
threshold should be set equal to the repeat interval derived for a crack detectable by general
visual inspection means, since the initial damage and its growth is not well defined and could
occur at any time.
The remaining areas of the structure evaluated under CS 25.571(b), i.e. multiple load path
- - e it can be demonstrated that
the resulting load path failure, partial failure, or crack arrest will be detected and repaired
during normal maintenance, inspection, or operation of an aeroplane prior to failure of the
remaining structure must also have thresholds established for fatigue cracking. For these
locations, methods that do not account for worst-case damage may be used in lieu of crack
growth analysis if desired. For example, fatigue SN analysis and tests with an appropriate
scatter factor or slow crack growth analysis based on appropriate initial manufacturing
damage, i.e. typical manufacturing flaws as opposed to the maximum probable flaw (e.g. a
0.127 mm corner crack representing a typical manufacturing flaw in a fastener hole versus a
1.27 mm crack representing the maximum probable flaw).
The means of establishing the LOV and maintenance actions (including inspections)
specifically associated to WFD is addressed in detail in Section 11 of this AMC.
All inspections necessary to detect fatigue cracking that have thresholds less than the
approved operating limitation (LOV or interim limitations) of the maintenance programme
must be included in the ALS.
Appendix 3 provides further details on threshold determination.
(d) Inspection
The basis for setting inspection intervals is the period of time during which damage is
detectable and the residual strength remains above the required levels. The reliability of the
repeat inspection programme (i.e. frequency of inspections and probability of detection)
should assure damage detection before the residual strength of the aircraft is compromised.
Inspection intervals must be established by applying appropriate reduction factors to this
period to ensure that the crack or other damage or failed load path will typically be found
well before the residual strength of the structure drops below the required level. Long
periods of exposure to residual strength levels only just above the load limit should be
avoided. This applies in particular to crack-arrest structure. It should be borne in mind that
CS 25.305 is the principle requirement for strength of the airframe, and that CS 25.571 is
primarily intended to provide an inspection programme that will ensure the timely detection
and repair of damage in order to restore the aircraft to the required (CS 25.305) strength

life.
Detectable crack sizes and shapes assumed to determine inspection intervals should be
consistent with the inspection method capabilities and the cracking characteristics of the

Annex to ED Decision 2023/021/R Page 304 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

structure being evaluated. If concurrent cracking in adjacent areas or surrounding structure

is expected within the operational life of the aeroplane, then this should be accounted for in
the cracking scenario assumed.
9. FATIGUE (SAFE-LIFE) EVALUATION
9.1. Reserved
9.2. Fatigue (safe-life) evaluation
9.2.1. General
The evaluation of structure under the following fatigue (safe-life) strength evaluation
methods is intended to ensure that catastrophic fatigue failure, as a result of the
repeated loads of variable magnitude expected in service, will be avoided throughout
he fatigue life of the structure
should be determined. The evaluation should include the following:
(a)
(b) conducting a structural analysis, including consideration of the stress
conce
(c) performing fatigue testing of structure which cannot be related to a test
background to establish response to the typical loading spectrum expected in

(d) determining reliable replacement times by interpreting the loading history,

variable load analyses, fatigue test data, service experience, and fatigue

(e) evaluating the possibility of fatigue initiation from sources such as corrosion,
stress corrosion, disbonding, accidental damage, and manufacturing defects
based
and
(f) providing necessary maintenance instructions including replacement times in
the ICA in accordance with CS 25.1529.
9.2.2. Scatter factor for safe-life determination
In the interpretation of fatigue analyses and test data the effect of variability should,
under CS 25.571(c), be accounted for by an appropriate scatter factor. In this process
it is appropriate that the applicant justifies the scatter factor chosen for any safe-life
part. The following guidance is provided (see Figure 1):
(a) The base scatter factors (BSF) applicable to test results are: BSF1 = 3.0, and BSF2
= (see paragraph 9.2.2(e) of this AMC). If the applicant can meet the
requirements of 9.2.2(c) of this AMC, he/she may use BSF1 or, at his/her option,
BSF2.
(b) The base scatter factor, BSF1, is associated with test results of one
representative test specimen.

Annex to ED Decision 2023/021/R Page 305 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(c) Justification for use of BSF1. BSF1 may only be used if the following criteria are
met:
(i) Understanding of load paths and failure modes
Service and test experience of similar in-service components that were
designed using similar design criteria and methods should demonstrate
that the load paths and potential failure modes of the components are
well understood.
(ii) Control of design, material, and manufacturing process quality
The applicant should demonstrate that his/her quality system (e.g. design,
process control, and material standards) ensures the scatter in fatigue
properties is controlled, and that the design of the fatigue-critical areas of
the part account for the material scatter.
(iii) Representativeness of the test specimen
(A) The test article should be full scale (component or subcomponent)
and represent that portion of the production aircraft requiring test.
All differences between the test article and the production article
should be accounted for either by analysis supported by test
evidence, or by testing itself.
(B) Construction details, such as bracket attachments, clips, etc.,
should be accounted for, even though the items themselves may
be non-loadbearing.
(C) Points of load application and reaction should accurately reflect
those of the aircraft, ensure correct behaviour of the test article,
and guard against uncharacteristic failures.
(D) Systems used to protect the structure against environmental
degradation can have a negative effect on fatigue life, and
therefore, should be included as part of the test article.
(d) Adjustments to base scatter factor BSF1. Having satisfied the criteria of
paragraph 9.2.2(c), justifying the use of BSF1, the base value of 3.0 should be
adjusted to account for the following considerations, as necessary, where not
wholly taken into account by design analysis. As a result of the adjustments, the
final scatter factor may be less than, equal to, or greater than 3.0.
(i) Material fatigue scatter. Material properties should be investigated up to
a 99 % probability of survival and a 95 % level of confidence.
(ii) Spectrum severity. Test load spectrum should be derived based on a
spectrum sensitive analysis accounting for variations in both utilisation
(i.e. aircraft weight, cg, etc.) and occurrences/size of loads. The test load
spectrum applied to the structure should be demonstrated to be
conservative when compared to the expected usage in-service.

Annex to ED Decision 2023/021/R Page 306 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(iii) Number of representative test specimens. Well established statistical

methods should be used that associate the number of items tested with
the distribution chosen to obtain an adjustment to the base scatter factor.
(e) If the applicant cannot satisfy the intent of all of paragraph 9.2.2(c) of this AMC,
BSF2 should be used.
(i) The applicant should propose scatter factor BSF2 based on careful
consideration of the following issues: the required level of safety, the
number of representative test specimens, how representative the test is,
expected fatigue scatter, type of repeated load test, the accuracy of the
test loads spectrum, spectrum severity, and the expected service
environmental conditions.
(ii) In no case should the value of BSF2 be less than 3.0.
(f) Resolution of test loadings to actual loadings. The applicant may use a number
of different approaches to reduce both the number of load cycles and the
number of test set-ups required.
These include the following:
spectrum blocking (i.e., a change in the spectrum load sequence to reduce
the total number of test set-ups);
high-load clipping (i.e., reduction of the highest spectrum loads to a level at
which the beneficial effects of compression yield are reduced or eliminated);
and
low-load truncation (i.e., the removal of non-damaging load cycles to
simplify the spectrum).
Due to the modifications to the flight-by-flight loading sequence, the applicant
should propose either analytical or empirical approaches to quantify an
adjustment to the number of test cycles which represents the difference
between the test spectrum and the assumed flight-by-flight spectrum. In
addition, an adjustment to the number of test cycles may be justified by raising
or lowering the test load levels as long as appropriate data supports the

locations, different response to fretting conditions, temperature effects, etc.

The analytical approach should use well-established methods or be supported
by test evidence.

Annex to ED Decision 2023/021/R Page 307 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

Annex to ED Decision 2023/021/R Page 308 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

9.3. Replacement times

Replacement times should be established for parts with established safe-lives and should,
under CS 25.571(a)(3), be included in the information prepared under CS 25.1529. These
replacement times can be extended if additional data indicates an extension is warranted.
Important factors which should be considered for such extensions include, but are not limited
to, the following:
9.3.1. Comparison of original evaluation with service experience
9.3.2. Recorded load and stress data
Recorded load and stress data entails instrumenting aeroplanes in service to obtain a
representative sampling of actual loads and stresses experienced.
The d

by instrumenting aeroplanes in service, provides a basis for correlating the estimated

loading spectrum with the actual service experience.
9.3.3. Additional analyses and tests
If additional test data and analyses based on repeated load tests of additional or
surviving specimens are obtained, a re-evaluation of the established safe-life can be
made.
9.3.4. Tests of parts removed from service
Repeated load tests of replaced parts can be utilised to re-evaluate the established
safe-life. The tests should closely simulate service loading conditions.
Repeated load testing of parts removed from service is especially useful where
recorded load data obtained in service are available since the actual loading
experienced by the part prior to replacement is known.
9.3.5. Repair or rework of the structure
In some cases, repair or rework of the structure can gain further life.
9.4. Type design developments and changes
For design developments, or design changes, involving structural configurations similar to
those of a design already shown to comply with the applicable provisions of CS 25.571(c), it
might be possible to evaluate the variations in critical portions of the structure on a
comparative basis. A typical example would be redesign of the landing gear structure for
increased loads. This evaluation should involve analysis of the predicted stresses of the
redesigned primary structure and correlation of the analysis with the analytical and test
results used in showing compliance of the original design with CS 25.571(c).
10. DISCRETE SOURCE DAMAGE
(a) General
The purpose of this section is to establish EASA guidelines for the consistent selection of load
conditions for residual strength substantiation in showing compliance with CS 25.571(e) and

Annex to ED Decision 2023/021/R Page 309 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

CS 25.903(d). The intent of these guidelines is to define, with a satisfactory level of

confidence, the load conditions that will not be exceeded on the flight during which the
specified incident of CS 25.571(e) or CS 25.903(d) occurs. In defining these load conditions,
consideration has been given to the expected damage to the aeroplane, the anticipated
response of the pilot at the time of the incident, and the actions of the pilot to avoid severe
load environments for the remainder of the flight consistent with his/her knowledge that the
aeroplane may be in a damaged state. Under CS 25.631 continued safe flight and landing is
required following the bird impact. Following the guidance of this paragraph for assessing
structural damage to any part whose failure or partial failure may prevent continued safe
flight and landing is an acceptable means of compliance to CS 25.631.
(b) The maximum extent of immediately obvious damage from discrete sources (CS 25.571(e))
should be determined and the remaining structure shown, with an acceptable level of
confidence, to have static strength for the maximum load (considered as ultimate load)
expected during completion of the flight. For uncontained rotor failure addressed under the
CS 25.903(d) requirements and for applicants following AMC 20-128A, likely structural
damage may be assumed to be equivalent to that obtained by using the rotor burst model
and associated trajectories defined in AMC 20-

in the event of damage to the flight control system.

(c) The loads considered as ultimate should not be less than those developed from the following:
(1) At the time of the occurrence:
(i) the maximum normal operating differential pressure including the external
aerodynamic pressures during 1.0 g level flight, multiplied by a 1.1 factor,
combined with 1.0 g flight loads;
(ii) starting from 1.0 g level flight at speeds up to Vc, any manoeuvre or any other
flight path deviation caused by the specified incident of CS 25.571(e), taking into
account any likely damage to the flight controls and pilot normal corrective
action.
(2) For the continuation of the flight, the maximum appropriate cabin differential pressure
(including the external aerodynamic pressure), combined with:
(i) 70 % of the limit flight manoeuvre loads as specified in CS 25.571(b) and,
separately;
(ii) at the maximum operational speed, taking into account any appropriate
reconfiguration and flight limitations, the 1.0 g loads plus incremental loads
arising from application of 40 % of the limit gust velocity and turbulence
intensities as specified in CS 25.341 at Vc.
(d) At any time, the aeroplane must be shown, by analysis, to be free from flutter and other
aeroelastic instabilities up to the boundary of the aeroelastic stability envelope described in
CS 25.629(b)(2) with any change in structural stiffness resulting from the incident, consistent
with CS 25.629(d)(8), CS 25.571(e), and CS 25.903(d).
11. ESTABLISHING THE LOV AND MAINTENANCE ACTIONS TO PREVENT WFD

Annex to ED Decision 2023/021/R Page 310 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(a) Structural maintenance programme

Theoretically, if an aircraft is properly maintained it could be operated indefinitely. However,
it should be noted that structural maintenance tasks for an aircraft are not constant with
time. Typically, tasks are added to the maintenance programme as the aircraft ages. It is
reasonable to expect then that confidence in the effectiveness of the current structural
maintenance tasks may not, at some future point, be sufficient for continued operation.
Maintenance tasks for a particular aircraft can only be determined based on what is known
about that aircraft model at any given time: from analyses, tests, service experience, and
teardown inspections. Widespread fatigue damage is of particular concern because
inspection methods cannot be relied on solely to ensure the continued airworthiness of
aircraft indefinitely. When inspections are focused on details in small areas and have a high
probability of detection, they may be used by themselves to ensure continued airworthiness,
unless or until there are in-service findings. Based on findings, these inspections may need to
be modified, and it may be necessary to modify or replace the structure rather than continue
with the inspection alone.
When inspections examine multiple details over large areas for relatively small cracks, they
should not be used by themselves. Instead, they should be used to supplement the
modification or replacement of the structure. This is because it would be difficult to achieve
the probability of detection required to allow inspection to be used indefinitely as a means
to ensure continued operational safety.
To prevent WFD from occurring, the structure must, therefore, occasionally be modified or
replaced. Establishing all the replacements and modifications required to operate the aircraft
indefinitely is an unbounded problem. This problem is solved by establishing an LOV of the
engineering data that supports the structural maintenance programme. All necessary
modifications and replacements are required to be established to ensure continued
airworthiness up to the LOV. See paragraph 11(f) for the steps to extend the LOV.
(b) Widespread fatigue damage
Structural fatigue damage is progressive. It begins as minute cracks, and those cracks grow
under the action of repeated stresses. It can be due to normal operational conditions and
design attributes, or to isolated incidents such as material defects, poor fabrication quality,
or corrosion pits, dings, or scratches. Fatigue damage can occur locally, in small areas or
structural design details, or globally. Global fatigue damage is general degradation of large
areas of structure with similar structural details and stress levels. Global damage may occur
within a single structural element, such as a single rivet line of a lap splice joining two large
skin panels (multiple site damage). Or it may be found in multiple elements, such as adjacent
frames or stringers (multiple element damage). Multiple site damage and multiple element
damage cracks are typically too small initially to be reliably detected with normal inspection
methods. Without intervention these cracks will grow, and eventually compromise the
structural integrity of the aircraft in a condition known as widespread fatigue damage.
Widespread fatigue damage is increasingly likely as the aircraft ages, and is certain to occur
if the aircraft is operated long enough without any intervention.
(c) Steps for establishing an LOV

Annex to ED Decision 2023/021/R Page 311 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

The LOV is established as an upper limit to aeroplane operation with the inspections and
other procedures provided under CS 25.1529 and Appendix H. The LOV is required by CS
25.571(a)(3) and is established because of increased uncertainties in fatigue and damage
tolerance assessment and the probable development of widespread fatigue damage
associated with aeroplane operation past the limit.
To support the establishment of the LOV, the applicant must demonstrate by test evidence
and analysis at a minimum, and, if available, service experience and teardown inspection
results of high-time aircraft, that WFD is unlikely to occur in that aircraft up to the LOV.
The process for establishing an LOV involves four steps:

identifying WFD-susceptible structure;

performing a WFD evaluation of all susceptible structure; and
finalising the LOV and establishing necessary maintenance actions.
Step 1 Candidate LOV
Any LOV can be valid as long as it has been demonstrated that the aircraft model will be free
from WFD up to the LOV based on the aircraft's inherent fatigue characteristics and that any
required maintenance actions are in place. Early in the certification process applicants
typically establish design service goals or their equivalent and set a design service objective
to have structure remain relatively free from cracking, up to the design service goal. A

LOV would
consideration of the economic impact of maintenance actions required to preclude WFD up
to the final LOV.
Step 2 Identify WFD-susceptible structure
The applicant should identify the structure that is susceptible to WFD to support post-fatigue
test teardown inspections or residual strength testing necessary to demonstrate that WFD
will not occur in the aircraft structure up to the LOV. Appendix 2 to AMC 20-20 provides
examples and illustrations of structure where multiple site damage or multiple element
damage has been documented. The list in Appendix 2 to AMC 20-20 is not meant to be
inclusive of all structure that might be susceptible to WFD on any given aircraft model and it
should only be used for general guidance. It should not be used to exclude any particular
structure.
The applicant should do the following when developing the list of structure susceptible to
WFD:
(1) Establish criteria that could be used for identifying what structure is susceptible to
WFD based on the definitions of multiple site damage, multiple element damage, and
WFD. For example, structural details and elements that are repeated over large areas
and operate at the same stress levels are obvious candidates. The criteria should be

Annex to ED Decision 2023/021/R Page 312 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(2) Provide supporting rationale for including and excluding specific structural areas. This

(3) Identify the structure to a level of detail required to support post-test activities that
the applicant will use to evaluate the residual strength capabilities of the structure.
Structure is free from WFD if the residual strength meets or exceeds that required by
CS 25.571(b). Therefore, post-test activities such as teardown inspections and residual
strength tests must provide data that support the determination of strength.
For teardown inspections, specific structural details (e.g. holes, radii, fillets, cut-
outs) need to be identified.
For residual strength testing, the identification at the component or
subcomponent level (e.g. longitudinal skin splices) may be sufficient.
Step 3 Evaluation of WFD-susceptible structure
Applicants must evaluate all susceptible structure identified in Step 2. Applicants must
demonstrate, by full-scale fatigue test, evidence that WFD will not occur in the aircraft
structure prior to the LOV. This demonstration typically entails full-scale fatigue testing,
followed by teardown inspections and a quantitative evaluation of any finding or residual
strength testing, or both. Additional guidance about full-scale fatigue test evidence is
included in Appendix 2 to this AMC.
Step 4 Finalise LOV
After all susceptible structure has been evaluated, finalise the LOV. The results of the
evaluations performed in Step 3 will either demonstrate that the strength at the candidate
LOV meets or exceeds the levels required by CS 25.571(b) or not. If it is demonstrated that
the strength is equal to or greater than that required, the final LOV could be set to the
candidate LOV without further evidence. If it is demonstrated that the strength is less than
the required level, at least two outcomes are possible:
(1) The final LOV may be equal with the candidate LOV. However, this would result in
maintenance actions, design changes, or both, maintenance actions and design
changes, to support operation of aircraft up to LOV. For MSD/MED, the applicant may
use damage tolerance-based inspections to supplement the replacement or
modification required to preclude WFD when those inspections have been shown to
be practical and reliable.
(2) The final LOV may be less than the candidate LOV. This could reduce the need for
maintenance actions or making design changes.
Maintenance actions
In some cases maintenance actions may be necessary for an aircraft to reach its LOV. These
maintenance actions could include inspections, modifications, replacements, or any
combination thereof.
For initial certification, these actions should be specified as airworthiness limitation items
and incorporated into the ALS of the ICA.

Annex to ED Decision 2023/021/R Page 313 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

For post-certified aircraft, these actions should be specified as service information by the
TCH or included in an updated ALS and may be mandated by Airworthiness Directives.
Design changes
The applicant may determine that developing design changes to prevent WFD in future
production aircraft is to their advantage. The applicant must substantiate the design changes
according to the guidance contained in this AMC
In addition to the technical considerations, the LOV may be influenced by several other
factors, including:
maintenance considerations;

economics.
(d) Airworthiness Limitations Section (ALS)
In accordance with Part-21 the TCH must provide the ICA (which includes the ALS) with the
aircraft. However, the TCH may or may not have completed the full-scale fatigue test
programme at the time of type certification.
Under CS 25.571, EASA may issue a type certificate for an aircraft model prior to the
app -scale fatigue testing, provided that EASA has agreed to the

Until the full-scale fatigue testing is completed and EASA has approved the LOV, the applicant
must establish a limitation that is equal to not more than one half of the number of cycles
accumulated on the test article supporting the WFD evaluation. Under Appendix H to CS-25,
the ALS must contain the limitation preventing operation of the aircraft beyond one half of
the number of cycles accumulated on the fatigue test article approved under CS 25.571. This
limitation is an airworthiness limitation. No aircraft may be operated beyond this limitation
until fatigue testing is completed and an LOV is approved. As additional cycles on the fatigue
test article are accumulated, this limitation may be adjusted accordingly. Upon completion
of the full-scale fatigue test, applicants should perform specific inspections and analyses to
determine whether WFD has occurred. Additional guidance on post-test WFD evaluations is
included in Appendix 2 to this AMC.
At the time of type certification, the applicant should also show that at least one calendar
year of safe operation has been substantiated by the fatigue test evidence agreed to be
necessary to support other elements of the damage tolerance and safe-life substantiations.
Some of these tests may require application of scatter factors greater than two resulting in
more restrictive operating limitations on some parts of the structure.
After the full-scale fatigue test and the WFD evaluation have been completed, the applicant
must include the following in the ALS:
Under Appendix H to CS 25, the ALS must contain the LOV stated as a number of total
accumulated flight cycles or flight hours approved under CS 25.571; and
Depending on the results of the evaluation under Step 3 above, the ALS may also include
requirements to inspect, modify or replace the structure.

Annex to ED Decision 2023/021/R Page 314 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(e) Repairs and type design changes

Any person applying for a change to a type certificate (TC) or a supplemental type certificate
(STC) must demonstrate that any affected structure is free from WFD up to the LOV. (Note:
It is possible that the STC applicant may generate a new LOV for the aeroplanes as part of the
STC limitations).
Applicants for a major repair to the original aircraft or to an aircraft modified under a major
change or an STC must demonstrate that any affected structure is free from WFD up to the
LOV.
The evaluation should assess the susceptibility of the structure to WFD and, if it is susceptible,
demonstrate that WFD will not occur prior to the LOV. If WFD is likely to occur before LOV is
reached, the applicant must either:
(1) redesign the proposed repair to preclude WFD from occurring before the aircraft
reaches the LOV; or
(2) develop maintenance actions to preclude WFD from occurring before the aircraft
reaches the LOV; or
(3) for significant major changes and STCs only, establish a new LOV.
For repairs, the applicant must identify and include these actions as part of the repair. For
major changes and STCs, the applicant must identify and include these actions as
airworthiness limitation items in the ALS of the ICA. WFD evaluation is considered part of the
fatigue and damage tolerance evaluation with respect to the three-stage repair approval
process.
(f) Extended LOV
To extend an LOV, an application for a major change is required.
Typically, the data necessary to extend an LOV includes additional full-scale fatigue test
evidence. The primary source of this test evidence should be full-scale fatigue testing. This
testing should follow the guidance contained in Appendix 2 to this AMC.
[Amdt 25/19]

Appendix 1 Crack growth analysis and tests

Crack growth characteristics should be determined for each detail design point identified in accordance
with 7(f) above. This information, when combined with the results from the residual strength analyses
and tests, will be the basis for establishing the inspection requirements as discussed in Section 8. Crack
growth characteristics can be determined by analysis or test. However, due to the large number of detail
design points that are typically evaluated, and the practical limitations involved with testing, analyses are
generally relied on to determine crack growth at the detail design point.
(a) Analyses. In order to perform a crack-growth analysis a number of key elements are needed. These
include:
(1) a load/stress spectrum applicable to the detail design point;
(2) an initial crack size and shape to be assumed;

Annex to ED Decision 2023/021/R Page 315 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(3) a cracking scenario to be followed;

(4) applicable stress intensity solution(s);
(5) a crack growth algorithm; and
(6) material crack growth rate properties.
A loading spectrum must be developed for each detail design point. It is derived from the overall
aircraft usage spectrum that is discussed in paragraph 6(b). The spectra at each detail design point
may be modified for various reasons. The most common modification for metallic structure involves
the deletion of high infrequent loads that may have an unrepresentative beneficial effect on crack
growth if retardation is considered. Also, local load events that are not part of the overall aircraft
spectrum should be included (e.g. flutter damper loads during pre-flight control surface checks).
The initial crack size and shape and subsequent cracking scenario to be followed are problem-
dependent.
Applicable stress intensity solutions may be available in the public domain or may need to be
developed. Many references exist which provide technical guidance for the application and
development of stress intensity solutions. Care should be taken to ensure that the reference stress
used for the spectrum load and stress intensity solution are compatible.
Crack-growth algorithms used in predicting crack extension range from simple linear models to
complex ones that can account for crack growth retardation and acceleration. It is generally
accepted that the use of a linear model will result in conservative results. A non-linear model, on
the other hand, can be conservative or non-conservative and generally requires a higher level of
validation and analysis/test correlation to adequately validate the accuracy of the algorithm.
Coupon testing should be performed using representative materials and spectra types (e.g. wing
lower cover, pylon support lug, horizontal-stabiliser upper cover) that will be encountered in the
course of the overall aircraft crack-growth evaluation.

materials is available in the public domain. Additionally, testing standards (e.g. ASTM) exist for
performing tests to gather this data. The generally accepted practice is to use typical or average
representation of this data for performing crack growth evaluations.
(b) Tests. Crack-growth testing using coupons is typically performed to generate crack growth rate data
and to validate crack growth algorithms used for analyses. Simple specimens are generally used
that have well-established stress intensity solutions for the characteristic cracking that can be
expected. The primary issue for these tests is the pre-cracking required to achieve a well-behaved
fatigue crack before data is collected. Effective pre-c
been established and are described in the public domain. Care must be taken to ensure that
subsequent crack growth is not affected by the prior pre-cracking.
In order to minimise the test time for actual structural components and/or full-scale test articles,
the test loading spectrum may be modified by eliminating small magnitude load events or by
replacing them with a fewer number of larger load events that give equivalent crack growth.
Crack-growth behaviour may be obtained from actual structural components and/or full-scale test
articles. However, inducing active fatigue cracks of the desired initial size and at the desired
locations can be extremely difficult. Past success in obtaining useful data has been achieved on an

Annex to ED Decision 2023/021/R Page 316 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

opportunistic basis when natural fatigue cracks have developed in the course of normal cyclic
testing. Naturally occurring and artificially induced fatigue cracks may be monitored and data
collected for at least a portion of the overall crack-growth period to be used for setting inspection
requirements. This data can be extremely useful in supplementing and validating the analytical
predictions, in some cases it may be the sole basis for the establishment of inspection requirements.
Where fatigue test crack growth data is used, the results should be corrected to address expected
operational conditions.
[Amdt 25/19]

Appendix 2 Full-scale fatigue test evidence

(a) Overview
CS 25.571(b) requires that special consideration for widespread fatigue damage (WFD) be included
where the design is such that this type of damage could occur. This Appendix focuses on the test
evidence in support of establishing the LOV and applicants will also need to consider and agree with
EASA the extent of testing required in support of compliance with CS 25.571 in general, in particular
for validation of hot spots, areas of complex loading exhibiting crack growth, single load path
components, and safe-life items. CS 25.571(b) requires the effectiveness of the provisions to
preclude the possibility of widespread fatigue damage occurring within the limits of validity of the
structural maintenance programme to be demonstrated with sufficient full-scale fatigue test
evidence. The determina -
considerable amount of engineering judgment and is a matter that should be discussed and agreed
to between the applicant and EASA early in the planning stage for a certification project. In general,
sufficient full-scale test evidence to support an LOV consists of full-scale fatigue testing to at least
two times the LOV, followed by specific inspections and analyses to determine that widespread
fatigue damage has not occurred. It may be appropriate to allow for three life times of testing,
especially if inspection may not be practical for areas subject to WFD and requiring SMPs to be
established. The following factors should be considered in determining the sufficiency of evidence:
Factor 1: The comparability of the load spectrum between the test and the projected usage of the
aeroplane.
Factor 2: The comparability of the airframe materials, design and build standards between the test
article and the certified aeroplane.
Factor 3: The extent of post-test teardown inspection, residual strength testing and analysis for
determining if widespread fatigue cracking has occurred.
Factor 4: The duration of the fatigue testing.
Factor 5: The size and complexity of a design or build standard change. This factor applies to design
changes made to a model that has already been certified and for which full-scale fatigue test
evidence for the original structure should have already been determined to be sufficient. Small,
simple design changes, comparable to the original structure, or changes that are derived from the
original design using the same basic design configuration and where very similar load paths and
similar operating stress levels are retained could be analytically determined to be equivalent to the
original structure in their propensity for WFD. In such cases, additional full-scale fatigue test
evidence should not be necessary.

Annex to ED Decision 2023/021/R Page 317 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

Factor 6: In the case of major changes and STCs, the age of an aeroplane being modified. This factor
applies to aeroplanes that have already accumulated a portion of their LOV prior to being modified.
An applicant should only be required to demonstrate freedom from WFD up to the LOV in place for
the original aeroplane.
(b) Elements of a full-scale fatigue test programme
The following guidance addresses elements of a test programme that is intended to generate the
data necessary to support compliance. It is generally applicable to all certification projects.
(1) Article. The test article should be representative of the structure of the aircraft to be certified
(i.e. ideally a production standard article). The attributes of the type design that could affect
MSD/MED initiation, growth and subsequent residual strength capability should be
replicated as closely as possible on the test article. Critical attributes include, but are not
limited to, the following:
material types and forms;
dimensions;
joining methods and details;
coating and plating;
use of faying surface sealant;
assembly processes and sequences; and
influence of secondary structure (e.g. loads induced due to proximity to the structure
under evaluation).
(2) Test set-up and loading. The test set-up and loading should result in a realistic simulation of
expected operational loads.
(i) Test set-up. The test set-up dictates how loads are introduced into the structure and
reacted. Every effort should be made to introduce and react loads as realistically as
possible. When a compromise is made (e.g. wing air loading), the resulting internal
loads should be evaluated (e.g. using finite element methods) to ensure that the
structure is not being unrealistically underloaded or overloaded locally or globally.
(ii) Test loading. The test loading spectrum should include loads from all damaging sources
(e.g. cabin pressurisation, manoeuvers, gusts, engine thrust, control surface
deflection, and landing impact) that are significant for the structure being evaluated.
Supporting rationale should be provided when a source is not represented in a
sequence. Additionally, differences between the test sequence and expected
operational sequence should be justified. For example, it is standard practice to
eliminate low loads that are considered to be non-damaging and clip high infrequent
loads that may non-conservatively bias the outcome, but care should be taken in both
cases so that the test results are representative. Paragraph 9.2.2(f) provides some
guidance on justifying the test loading sequence.
(3) Test duration. AMC 20-20 includes guidance on how to establish mandatory maintenance
actions for WFD-susceptible structure needed to preclude WFD occurrence in that structure.
For any WFD-susceptible area the average time in flight cycles and/or hours to develop WFD

Annex to ED Decision 2023/021/R Page 318 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

must first be determined. This is referred to as the WFD average behaviour for the subject
area. The AMC 20-20 guidance states that the area should be modified/replaced at one third
of this time unless inspection for MSD/MED is practical. If inspection is practical the guidance
states that inspection should start at one third of the WFD average behaviour with
modification/replacement at one half of that time. It is standard practice to interpret the
non-factored fatigue life of one specimen as the average life. It follows that if a full-scale
fatigue test article survives a test duration of X without WFD occurrence, it can be
conservatively assumed that the WFD average behaviour of all susceptible areas is equal to
X. Based on this, and assuming that the susceptible areas are impractical to inspect for
MSD/MED, the guidance of AMC 20-20 would require that replacement/modification would
have to be implemented at X/3. For areas where MSD/MED inspections were practical
replacement/modification could be deferred until X/2, but MSD/MED inspections would
have to start at X/3. The preceding should be kept in mind when deciding what the test
duration will be.
(4) Post-test evaluation. One of the primary objectives of the full-scale fatigue test is to generate
data needed to determine the absolute WFD average behaviour for each susceptible area, or
to establish a lower bound. Recall that the definition of WFD average behaviour is the average
time required for MSD/MED to initiate and grow to the point that the static strength
capability of the structure is reduced below the residual strength requirements of CS
25.571(b). Some work is required at the end of the test to determine the strength capability
of the structure either directly or indirectly.
(i) Residual strength tests. One acceptable way to demonstrate freedom from WFD at the
end of a full-scale fatigue test is to subject the article to the required residual strength
loads specified in CS 25.571(b). If the test article sustains the loads it can be concluded
that the point of WFD has yet to be reached for any areas. However, because fatigue
cracks that might exist at the end of the test are not quantified it is not possible to
determine how far beyond the test duration WFD would occur in any of the susceptible
areas without accomplishing additional work (e.g. teardown inspection). Additionally,
metallic test-articles may be non-conservatively compromised relative to their future
fatigue performance if static loads in excess of representative operational loads are
applied. Residual strength testing could preclude the possibility of using an article for
additional fatigue testing.
(ii) Teardown inspections. The residual strength capability may be evaluated indirectly by
performing teardown inspections to quantify the size of any MSD/MED cracks that
might be present or to establish an upper bound on crack size based on inspection
method capability. Once this is done the residual strength capability can be estimated
analytically. Depending on the results crack-growth analyses may also be required to
project backwards or forwards in time to estimate the WFD average behaviour for an
area. As a minimum, teardown inspection methods should be capable of detecting the
minimum size of MSD or MED cracking that would result in a WFD condition (i.e.
residual strength degraded below the level specified in CS 25.571(b)). Ideally it is
recommended that inspection methods be used that are capable of detecting
MSD/MED cracking before it degrades strength below the required level. Effective
teardown inspections required to demonstrate freedom from WFD typically require
significant resources. They typically require disassembly (e.g. fastener removal) and

Annex to ED Decision 2023/021/R Page 319 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

destruction of the test article. All areas that are or may be susceptible to WFD should
be identified and examined.
(c) Examples of fatigue test evidence for various types of certification projects.
The following examples offer some guidance on the types of data sets that might constitute

duration of the test are considered.

(1) New type certificates. Normally this type of project would necessitate its own full-scale
fatigue test of the complete airframe to represent the new structure and its loading
environment. Nevertheless, prior to full-scale fatigue test evidence from earlier tests
performed by the applicant, or others, may also be used and could supplement additional
tests on the new model. Ultimately, the evidence needs to be sufficient to conclude with
confidence that, within the LOV of the airframe, widespread fatigue damage will not occur.
Factors 1 through 4 should be considered in determining the sufficiency of the evidence.
A test duration of a minimum of twice the LOV for the aeroplane model would normally be
necessary if the loading spectrum is realistic, the design and construction for the test article
principal structure is the same as for the certified aeroplane, and the post-test teardown is
exhaustive. If the conformance to Factors 1 through 3 is less than ideal, a significantly longer
test duration would be needed to conclude with confidence that WFD will not occur within
the LOV. Moreover, no amount of fatigue testing will suffice if the conformance to Factors 1
through 3 above is not reasonable. Consideration should also be given to the possible future
need for life extension or product development, such as potential weight increases, etc.
(2) Derivative models. The default position would be to test the entire airframe. However, it may
be possible to reliably determine the occurrence of widespread fatigue damage for part or
all of the derivative models from the data that the applicant generated or assembled during
the original certification project. Nevertheless, the evidence needs to be sufficient to allow
confidence in the calculations that show that widespread fatigue damage will not occur
within the LOV of the aeroplane. Factors 1 through 5 should be considered in determining
the sufficiency of the evidence for derivative models. For example, a change in the structural
design concept, a change in the aerodynamic contour, or a modification of the structure that
has a complex internal load distribution might well make analytical extrapolation from the
existing full-scale fatigue test evidence very uncertain. Such changes might well necessitate
full-scale fatigue testing of the actual derivative principal structure. On the other hand, a

consist of a copy of the typical semi-monocoque construction for that model with slightly
modified material gauges. Normally this type of project would not necessitate its own full-
scale fatigue test, particularly if very similar load paths and operating stress levels are
retained.
(3) Type design changes Service bulletins. Normally this type of project would not necessitate
the default option of a full-scale fatigue test because the applicant would have generated, or
assembled, sufficient full-scale fatigue test evidence during the original certification project
that could be applied to the change. Nevertheless, as cited in the previous example, the
evidence needs to be sufficient to allow confidence in the calculations that show that
widespread fatigue damage will not occur within the LOV of the aeroplane. In addition, Factor

Annex to ED Decision 2023/021/R Page 320 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

otherwise justified, based on existing test data or a demonstration that the design change is
not susceptible to WFD, the applicant should perform full-scale tests for the types of design
changes listed in Appendix 4.
(4) Supplemental type certificates (STCs)
Unless otherwise justified according to the guidance below or based on existing test data or
a demonstration that the design change is not susceptible to WFD, the applicant for an STC
should perform full-scale tests for the types of design changes listed in Appendix 4.
(i) Sufficient full-scale test evidence for structure certified under an STC may necessitate
additional full-scale fatigue testing, although the extent of the design change may be
small enough to use Factor 5 to establish the sufficiency of the existing full-scale
fatigue test evidence. The applicant for an STC may not have access to the original
equipment ma -scale fatigue test data. For aircraft types where an LOV
has been published, the STC applicants may assume that the basic structure is free
from WFD up to the LOV, unless:
EASA has issued an airworthiness directive (AD), or intends to take such action
(proposed AD), to alleviate a WFD condition; or
inspections or modifications exist in the ALS relating to WFD conditions.

aeroplane to which the LOV is applicable has received at least two full LOV of fatigue
testing under realistic loads, and has received a thorough post-test inspection that
either did not detect any WFD or the ALS includes from the outset details of
modifications required to address WFD that will need specific consideration by the STC
applicant. With this knowledge, and considering the Factors 1 through 5, the STC
applicant may be able to demonstrate that WFD will not occur on its modification (or
the underlying original structure) within the LOV or a suitably revised value. If,
however, the modification significantly affects the distribution of stress in the
underlying structure, or significantly alters loads in other parts of the aeroplane, or
significantly alters the intended mission for the aeroplane, or, if the modification is
significantly different in structural concept from the certified aeroplane being
modified, additional representative fatigue test evidence would be necessary.
(ii)
modifications made to older aeroplanes. The STC applicant should demonstrate
freedom from WFD up to the LOV of the aeroplane being modified. For example, an
applicant for an STC to an aeroplane that has reached an age equivalent to 75 % of its
LOV should demonstrate that the modified aeroplane will be free from WFD for at least
the remaining 25 % of the LOV. Although an applicant could attempt to demonstrate
freedom from WFD for a longer period, this may not be possible unless the original
equipment manufacturer cooperates by providing data for the basic structure. A short
design service goal for the modification could simplify the demonstration of freedom
from WFD for the STC applicant.
(5) Repairs. New repairs that differ from the repairs contained in the original equipment

and that meet CS-25 in other respects, would not necessitate full-scale fatigue testing to

Annex to ED Decision 2023/021/R Page 321 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

support freedom from WFD up to the LOV. Concerning major repair solutions (that may be
susceptible to WFD) which utilise design concepts that are different from previous approved
repair data (e.g. new materials, other production processes, new design details), further
testing may be required.
(d) Use of existing full-scale fatigue test data
In some cases, especially for derivative models and type design changes accomplished by the type
certificate holder, there may be existing full-scale fatigue test data that may be used to support
compliance and mitigate the need to perform additional testing.
Any physical differences between the structure originally tested and the structure being considered
that could affect its fatigue behaviour must be identified and reconciled. Differences that should be
addressed include, but are not limited to, differences in any of the physical attributes listed under
section (b)(1) of this Appendix and differences in operational loading. Typical developments that
affect the applicability of the original LOV demonstration data are:
(1) gross weight (e.g. increases);
(2) cabin pressurisation (e.g. change in maximum cabin or operating altitude); and
(3) flight segment parameters.
The older the test data, the harder it may be to demonstrate that it is sufficient. Often test articles
were not conformed, nor were test plans or reports submitted to EASA as part of the compliance
data package. Loading sequence rigor varied significantly over the years and from applicant to
applicant. Additionally, testing philosophies and protocols were not standardised. For example,
post-test evaluations, if any, varied significantly and in some cases consisted of nothing more than
limited visual inspections. However, there may be acceptable data from early full-scale fatigue tests
that the applicant proposes to use to support compliance. In order to use such data the
configuration of the test article and loading must be verified and the issue of the residual strength
capability of the article (or teardown data) at the end of the test must be addressed.
(e) Use of in-service data. There may be in-service data that can be used to support WFD evaluations.
Examples of such data are as follows:
Documented positive findings of MSD/MED cracks that include location, size and the time
in service of the affected aircraft along with a credible record of how the aircraft had been
operated since original delivery.
Documented negative findings from in-service inspections for MSD/MED cracks on a
statistically significant number of aircraft with the time in service of each aircraft and a
credible record of how each aircraft had been operated since original delivery. For this data
to be useful, the inspections methods used should have been capable of detecting
MSD/MED crack sizes equal to or smaller than those sizes that could reduce the strength of
the structure below the residual strength levels specified in CS 25.571(b).
Documented findings from the destructive teardown inspection of structure from in-service
aircraft. This might be structure (e.g. fuselage splices) removed from aircraft that were
subsequently returned to service, or from retired aircraft. It would also be necessary to
have a credible record of the operational loading experienced by the subject structure up
to the time it was taken out of service.

Annex to ED Decision 2023/021/R Page 322 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

Prior to using in-service data any physical and usage/loading differences that exist between
the structure of the in-service or retired aircraft and the structure being certified should be
identified and reconciled as discussed above.
[Amdt 25/19]

Appendix 3 Methods for inspection threshold determination

Different approaches have been used to calculate inspection thresholds, although these are essentially
variants of one of two methods, being:
(a) the fatigue (stress-life or strain-life) method, which uses fatigue endurance data collected under
constant stress or constant strain conditions, and a linear damage accumulation model (Palmgren-
Miner rule);
(b) the crack growth method, which uses crack propagation and residual strength data to calculate the
growth from an assumed initial crack size to a critical crack length, according to fracture mechanics
principles.
CS 25.571(a)(4) requires certain types of structure to have thresholds based upon crack growth analyses
or test assuming the maximum probable flaw due to manufacturing or service-induced damage. This
approach applies to:
(a) single load path structure; and
(b) - -
demonstrated that the resulting load path failure or partial failure (including arrested cracks) will
be safely detected and repaired during normal maintenance, inspection, or operation of an
aeroplane prior to failure of the remaining structure.
Paragraph 8(c) of this AMC provides further details on identifying this structure.
In lieu of other data, an acceptable threshold for inspection for cracks emanating from the maximum
probable manufacturing flaw at a fastener hole may be obtained for aluminium alloy airframe structure if
d and the total crack growth life is divided by 2.
Whether this approach is also sufficient to conservatively address all probable forms of manufacturing
and service-induced damage needs careful consideration and is highly design dependent. Where specific
test or service data for service damage exists that can be used to reliably establish an appropriate
threshold for all likely types of service damage then crack growth analysis may only need to consider the
manufacturing flaw.
For structure susceptible to WFD specific methods for setting inspection thresholds are applicable when
agreed to be practical; see Section 11 and Appendix 2 to this AMC.
Regardless of the approach used, the calculated thresholds should be supported with appropriate fatigue
test evidence. The best sources of fatigue test evidence are from service experience and large component
or full-scale fatigue tests. Large component and full-scale fatigue test specimens are generally constructed
using the same manufacturing processes as on the actual aircraft. The results of such tests should provide
sufficient information to reliably establish the typical manufacturing quality and possibly its lower bound,
especially when those results are combined with service experience. Conversely, simple test specimens
used to generate fatigue endurance and crack growth data, which are typically assembled under
laboratory or workshop conditions, may not be representative of the actual range of manufacturing

Annex to ED Decision 2023/021/R Page 323 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

quality in the structure under consideration. Therefore, in the absence of information from the full-scale
fatigue tests and service experience, consideration should be given to generating fatigue endurance and
crack growth data on simple test specimens which include artificial damages that are introduced at the
beginning of the test, and are representative of the lower bound of manufacturing quality.
[Amdt 25/19]

Appendix 4 Examples of changes that may require full-scale fatigue

testing
The following are examples of types of modifications that may require full-scale fatigue testing:
(1) passenger-to-freighter conversions (including addition of cargo doors);
(2) gross weight increases (e.g. increased operating weights, increased zero-fuel weights, increased
landing weights, and increased maximum take-off weights);
(3) installation of fuselage cut-outs (e.g. passenger entry doors, emergency exit doors or crew escape
hatches, fuselage access doors, and cabin window relocations);
(4) complete re-engine or pylon change;
(5) engine hush kits;
(6) wing modifications (e.g. installation of winglets, changes in flight-control settings such as flap
droop, and change of wing trailing-edge structure);
(7) modified or replaced skin splice;
(8) any modification that affects three or more stiffening members (e.g. wing stringers and fuselage
frames);
(9) a modification that results in operational-mission change, which significantly changes the original

10 hours); and
(10) a modification that changes areas of the fuselage from being externally inspectable using visual
means to being non-inspectable (e.g. installation of a large, external fuselage doubler that results
in hiding details beneath it).
[Amdt 25/19]

Appendix 5 PSE, FCS, and WFD-susceptible structure

(a) Overview
Four key terms used when showing compliance to the damage tolerance and fatigue requirements
of CS-25 and EASA guidance for the continued structural integrity of ageing aircraft in AMC 20-20

damage (WFD)-
This Appendix provides clarification on the intended meanings of these terms and how they relate
to each other.
(b) Principal structural element (PSE)

Annex to ED Decision 2023/021/R Page 324 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

(1)
ficantly to the carrying
of flight, ground or pressurisation loads, and whose integrity is essential in maintaining the
overall structural integrity of the aeroplane.
(2) While this definition does not specifically address the fatigue susceptibility of the structure,
or environmental or accidental damage, it is intended to address the majority of the structure
that must be evaluated according to CS 25.571. CS 25.571(a) states the following:
e that could contribute to a

(3) Examples of PSEs are found in paragraph 7(f) of this AMC.

(4) The above reinforces the notion that the identification of PSEs should be based solely on the
importance of the structure to assure the overall aeroplane integrity.
(5) Paragraph 7(f) of this AMC provides guidance for identifying PSEs. Many manufacturers use
this list as a starting point for their list of Fatigue Critical Structure (FCS). CS 25.571(b) is
intended to address all structure that could contribute to a catastrophic failure resulting from
fatigue, environmental and accidental damage, and, therefore, may include some structure
that is not considered FCS. Nevertheless, all PSE should be considered when developing a list
of FCS.
(6) The definitions used by applicants to identify PSEs have not been consistent among
applicants and, in some cases, among models produced by the same applicant. The lack of
ting diversity

(c) Fatigue Critical Structure (FCS)

(1)
cracking, which could contribute to a catastrophic failure. Fatigue critical structure also
includes structure which, if repaired or modified, could be susceptible to fatigue cracking and
contribute to a catastrophic failure. Structure is most often susceptible to fatigue cracking
when subjected to tension-dominated repeated loads during operation. Such structure may
be part of the baseline structure or part of a modificatio
structure that is designed under the original type certificate or amended type certificate for
that aircraft model (i.e. the as-delivered-aeroplane model configuration).
(2) Fatigue critical structure is generally a subset of principal structural elements, specifically
those elements that are susceptible to fatigue damage. The exception may be a DDP that is
susceptible to fatigue and, although not part of a PSE, could result in catastrophic failure if it
were to fail (e.g. an undercarriage door hinge has been categorised by some TCHs as a DDP
and FCS, when its failure would lead to loss of the door and the door could impact the aircraft
with catastrophic results. In this case the door was not classified as a PSE because the TCH
had not considered the door to contribute significantly to carrying flight, ground or
pressurisation loads. Considering further aspects of the PSE definition now adopted, it might
be claimed that the door is not essential to maintain the overall integrity of the aircraft, i.e.
the aircraft may be safe without it. However, due to the need to identify all detail design

Annex to ED Decision 2023/021/R Page 325 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
FATIGUE EVALUATION

points and FCS whose failure could cause catastrophic failure of the aircraft it is in any case
subject to the fatigue and damage tolerance requirements.)
(d) Detail design points (DDP)

fatigue cracking or degradation such that the structure cannot maintain its load carrying capability,
which could lead to a catastrophic failure.
(e) Widespread fatigue damage (WFD)-susceptible structure
(1)
structural locations, which are of sufficient size and density such that the structure no longer
meets the residual strength requirements of CS 25.571(b).
(2)
-
structure that, under normal circumstances, could be expected to eventually develop MSD
and/or MED cracks, which could lead to WFD.
(3) Although not explicitly stated, structure susceptible to WFD cannot be inspected reliably to
preclude WFD. Unless a flight cycles and/or flight hours limit is placed on an aeroplane,
modifications may be needed to preclude WFD. Structure susceptible to WFD is a subset of
FCS.
[Amdt 25/19]

Annex to ED Decision 2023/021/R Page 326 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
LIGHTNING PROTECTION

LIGHTNING PROTECTION

CS 25.581 Lightning protection

(See AMC 25.581)
(a) The aeroplane must be protected against catastrophic effects from lightning. (See CS 25.899 and
AMC 25.581.)
(b) For metallic components, compliance with sub-paragraph (a) of this paragraph may be shown by
(1) Bonding the components properly to the airframe; or
(2) Designing the components so that a strike will not endanger the aeroplane.
(c) For non-metallic components, compliance with sub-paragraph (a) of this paragraph may be shown
by
(1) Designing the components to minimise the effect of a strike; or
(2) Incorporating acceptable means of diverting the resulting electrical current so as not to
endanger the aeroplane.
[Amdt 25/18]

AMC 25.581 Lightning protection

1 INDUSTRY STANDARDS
The following documents may be used when showing compliance with CS 25.581:
EUROCAE document ED-84A dated July 2013 (Aircraft Lightning Environment and Related
Test Waveforms) or the equivalent SAE ARP5412B.
EUROCAE document ED-91A (Aircraft Lightning Zoning) or the equivalent SAE ARP5414B.
EUROCAE document ED-105A (Aircraft Lightning Test Methods) or the equivalent SAE ARP
5416A.
EUROCAE document ED-113 (Aircraft Lightning Direct Effects Certification) or the
equivalent SAE ARP 5577.
2 EXTERNAL METAL PARTS
2.1 External metal parts should either be
a. Electrically bonded to the main earth system by primary bonding paths, or
b. So designed and/or protected that a lightning discharge to the part (e.g. a radio aerial)
will cause only local damage which will not endanger the aeroplane or its occupants.
2.2 In addition, where internal linkages are connected to external parts (e.g. control surfaces),
the linkages should be bonded to main earth or airframe by primary bonding paths as close
to the external part as possible.

Annex to ED Decision 2023/021/R Page 327 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
LIGHTNING PROTECTION

2.3 Where a primary conductor provides or supplements the primary bonding path across an
operating jack (e.g. on control surfaces or nose droop) it should be of such an impedance and
so designed as to limit to a safe value the passage of current through the jack.
2.4 In considering external metal parts, consideration should be given to all flight configurations
(e.g. lowering of landing gear and wing-flaps) and also the possibility of damage to the
aeroplane electrical system due to surges caused by strikes to protuberances (such as pitot
heads) which have connections into the electrical system.
3 EXTERNAL NON-METALLIC PARTS
3.1 External non-metallic parts should be so designed and installed that
a. They are provided with effective lightning diverters which will safely carry the lightning
discharges described in EUROCAE document ED-84A dated July 2013 titled: Aircraft
Lightning Environment and Related Test Waveforms, or the equivalent SAE ARP5412B
document.
b. Damage to them by lightning discharges will not endanger the aeroplane or its
occupants, or
c. A lightning strike on the insulated portion is improbable because of the shielding
afforded by other portions of the aeroplane.
Where lightning diverters are used the surge carrying capacity and mechanical robustness of
associated conductors should be at least equal to that required for primary conductors.
3.2 Where unprotected non-metallic parts are fitted externally to the aeroplane in situations
where they may be exposed to lightning discharges (e.g. radomes) the risks include the
following:
a. The disruption of the materials because of rapid expansion of gases within them (e.g.
water vapour),
b. The rapid build-up of pressure in the enclosures provided by the parts, resulting in
mechanical disruption of the parts themselves or of the structure enclosed by them,
c. Fire caused by the ignition of the materials themselves or of the materials contained
within the enclosures, and
d. Holes in the non-metallic part which may present a hazard at high speeds.
3.3 The materials used should not absorb water and should be of high dielectric strength in order
to encourage surface flash-over rather than puncture. Laminates made entirely from solid
material are preferable to those incorporating laminations of cellular material.
3.4 Those external non-metallic part which is not classified as primary structure should be
protected by primary conductors.
3.5 Where damage to an external non-metallic part which is not classified as primary structure
may endanger the aeroplane, the part should be protected by adequate lightning diverters.
3.6 Confirmatory tests may be required to check the adequacy of the lightning protection
provided (e.g. to confirm the adequacy of the location and size of bonding strips on a large
radome.)

Annex to ED Decision 2023/021/R Page 328 of 1515

 CS-25 Amendment 28 SUBPART C STRUCTURE
LIGHTNING PROTECTION

[Amdt 25/26]

Annex to ED Decision 2023/021/R Page 329 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

SUBPART D DESIGN AND CONSTRUCTION

GENERAL

CS 25.601 General
The aeroplane may not have design features or details that experience has shown to be hazardous or
unreliable. The suitability of each questionable design detail and part must be established by tests.

CS 25.603 Materials
(See AMC 25.603; for composite materials, see AMC 20-29; for use of glass in passenger cabins, see AMC
No 2 to CS 25.603(a))
The suitability and durability of materials used for parts, the failure of which could adversely affect safety,
must:
(a) be established on the basis of experience or tests; (see AMC No°1 to CS 25.603(a));
(b) conform to approved specifications that ensure their having the strength and other properties
assumed in the design data (see AMC 25.603(b)); and
(c) take into account the effects of environmental conditions, e.g. temperature and humidity, expected
in service.
[Amdt 25/9]
[Amdt 25/18]
[Amdt 25/19]
[Amdt 25/27]

AMC 25.603 Suitability and durability of materials

is differently interpreted, ranging from raw feedstock material to the material state
in a final complex part configuration that may have undergone various processes. CS 25.603, CS 25.605,
CS 25.613, and AMC 25.613 should therefore be considered together to ensure the coherent and safe
design and production of parts and thus maintain occupant and aeroplane safety throughout the

the design of complex part configurations for which the characteristics of the materials are defined close
to completion of the part production, e.g. castings, composite resin transfer methods, bonding, or additive
manufacturing methods. The applicants should therefore discuss with EASA, at an early stage of the
certification project, potential details supporting the means of compliance with CS 25.603, CS 25.605, and
CS 25.613.
Note: organisations engaged in the design and certification of modifications or repairs should also comply
with these CSs and consider the related AMC.
Appropriately defined tests and analysis pyramids (e.g. as outlined in AMC 20-29 for composite materials)
should support the certification of materials, processes, and/or fabrication methods, including the
development of the associated design values in more complex part configurations and assemblies.

Annex to ED Decision 2023/021/R Page 330 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

[Amdt No: 25/27]

AMC No 1 to CS 25.603(a) Suitability and durability of materials

Experience or tests
To show compliance with CS 25.603 and CS 25.605, applicants may use previous applicable experience
and/or tests together with material specifications and material process specifications. Applicants should
therefore carefully consider the controls on materials and material processing that are appropriate to the
design data to be used for any part (e.g. controls on additive manufacturing powder material handling
processes). However, as material strength and other properties may result from the process limitations
that are specific to the configuration of some complex parts, the applicability of previous experience to
new part configurations may be limited.
Shared databases: when the material strength and other properties that are used in the design data are
not only influenced by the constituent materials and/or material processes, but also by the manufacturing
and assembly processes, demonstrating controls on constituent materials and material processes may
assist applicants in developing the final design data. For example, if an applicant successfully
demonstrates data equivalence with established and accepted databases, this may create confidence in
es.
[Amdt No: 25/27]

AMC No 2 to CS 25.603(a) Suitability and durability of materials

Large glass items
1. General
This AMC defines acceptable minimum performance standards for the specific case of large glass
items used as an interior material in passenger cabin installations whereby the glass items carry no
other loads than those resulting from the mass of the glass itself, rapid depressurisation, or abuse
loading.
Large glass items should be shown not to be a hazard during events such as an emergency landing
and cabin depressurisation.
1.1. A large glass item is defined as:
(a) a glass item with a dimension that exceeds 51 cm (20 in.);
(b) a glass panel with a surface area on one side that exceeds 0.12 m² (200 in.²); or
(c) a glass item with a mass exceeding 4 kg.
In case of multiple items in close proximity, the accumulated surface area of glass as well as
the total mass should be considered (i.e. effects such as tiling should be considered).
1.2. A large glass item should meet the following requirements whenever installed in
compartments that may be occupied during taxiing, take-off, and landing, or may be
traversed during an emergency evacuation:

Annex to ED Decision 2023/021/R Page 331 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

(a) The glass item should be subjected to, and pass, ball impact testing (see paragraph 2
below).
(b) The glass item should be subjected to, and pass, abuse load testing (see paragraph 3
below).
(c) The glass item should meet the requirements outlined in CS 25.561(b)(3), (c) and (d).
A safety factor of 2.0 should be applied to glass items to account for variability in the
production of the material and for long-term degradation.
(d) Cracking of glass should not produce a condition where the material may become
hazardous to the occupants (e.g. sharp edges, splinters or separated pieces). This
requires destructive testing. If any of the test conditions defined below (see
paragraphs 2 and 3 below) do not result in a significant failure of the glass item, testing
at a higher impact energy (ball impact test) or load (abuse load test) should be
performed until destruction, or until an impact energy of 80 J or double the specified
abuse load is reached.
Tests should be performed for worst-case conditions (e.g. the largest glass item should be
tested with the maximum engraving). Similarity justification may then be used for other
items.
These tests do not need to be performed for glass items that have traditionally been installed
in large aeroplanes, provided that their installation method, location, etc. are not unusual
(e.g. standard lavatory mirrors, light bulbs, light tubes, galley equipment).
The instructions for continued airworthiness should reflect the fastening method used and
should ensure the reliability of all methods used (e.g. life limit of adhesives, or scheduled
check for security of a clamp connection). For example, inspection methods and intervals for
an adhesive-based design should be defined in accordance with adhesion data from the
manufacturer of the adhesive, or actual adhesion test data, as necessary.
2. Ball Impact Tests
The test procedure(s) and pass/fail criteria of the Underwriters Laboratories standard UL 61965,
Mechanical safety for cathode ray tubes, Edition 2, 27 July 2004, or former UL 1418, Standard for
safety cathode ray tubes, Edition 5, 31 December 1992, or other equivalent approved method are
the basis of the ball impact strength and no-hole tests described in this paragraph, combined with
the impact energy in Section 5.12.2 of ANSI/SAE Z26.1, Safety glazing materials for glazing motor
vehicles and motor vehicle equipment operating on land highways safety standard, 1 December
1997.
The glass samples should be installed in a test fixture representative of the actual installation in the
cabin.
2.1. Strength Test
The large glass item should be subjected to a single impact applied in accordance with the
test conditions of paragraph 2.3 below. The impact energy should be 21 J, caused by a 51-
mm diameter ball or, alternatively, by a 40-mm diameter ball, as specified in paragraph 2.3.2
below.

Annex to ED Decision 2023/021/R Page 332 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

The test is passed if the expulsion of glass within a 1-min period after the initial impact
satisfies the following criteria:
(a) there is no glass particle (a single piece of glass having a mass greater than 0.025 g)
between the 0.90 and 1.50-m barriers (see paragraph 2.3.1) on either side (if
appropriate);
(b) the total mass of all pieces of glass between the 0.90 and 1.50-m barriers (see
paragraph 2.3.1) does not exceed 0.1 g on either side (if appropriate); and
(c) there is no glass expelled beyond the 1.50-m barrier (see paragraph 2.3.1) on either
side (if appropriate).
2.2 No-Hole Test
The large glass item should be subjected to a single impact applied in accordance with the
test conditions of paragraph 2.3 below. The impact energy should be 3.5 J, caused by a 51-
mm diameter ball as specified in paragraph 2.3.2 below.
The test is passed if the large glass item does not develop any opening that may allow a 3
mm diameter rod to enter.
Note: If the large glass item does not develop any opening that would allow a 3 mm rod to
enter when subjected to the strength test defined in paragraph 2.1 above, the no-hole test
defined in this paragraph does not need to be performed.
2.3 Test Conditions
2.3.1 Test Apparatus and Setup
The large glass item should be mounted in a way representative of the aeroplane
installation.
The centre of the large glass item should be 1.00 ± 0.05 m above the floor.
For the strength test (see paragraph 2.1 above), two barriers, each one made of
material 10 20 mm thick, 250 mm high, and 2.00 m long, should be placed on the floor
in front of the test item (or on both sides in case of a glass partition) at the specified
location, measured horizontally from the front surface of the large glass item to the
near surface of the barrier. The barriers may be less than 2.00 m long, provided that
they extend to the walls of the test room. A non-skid surface such as a blanket or rug
may be placed on the floor.
A solid, smooth, steel ball of the size specified in paragraph 2.3.2 below should be
suspended by suitable means such as a fine wire or chain and allowed to fall freely as
a pendulum and strike the large glass item with the specified impact energy. The large
glass item should be placed in a way that its surface is vertical and in the same vertical
plane as the suspension point of the pendulum. A single impact should be applied to
any point on the surface of the large glass item at a distance of at least 25 mm from
the edge of the surface.
2.3.2 Impact Objects
The 51-mm diameter steel ball, used as an impact object, should have a mass of
approximately 0.5 kg and a minimum Scale C Rockwell Hardness of 60.

Annex to ED Decision 2023/021/R Page 333 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

The 40-mm diameter steel ball, used as an impact object, should have a mass of
approximately 0.23 kg and a minimum Scale C Rockwell Hardness of 60.
3. Abuse Loads Tests
The large glass item should withstand the abuse loads defined in paragraph 3.2 below when
subjected to the test conditions defined in paragraph 3.1. The panel should remain attached to the
fixture, and any failure should be shown to be non-hazardous (e.g. no sharp edges, no separation
of pieces).
3.1 Test conditions
Abuse loads should be applied:
(a) at the points that would create the most critical loading conditions; and
(b) at least at the geometrical centre, and at one point located along the perimeter.
For the above-mentioned load applications, it is acceptable to use any loading pad with a
shape and dimensions that fit into a 15.24-cm (6-in.) diameter circle.
For all tests, the glass item should be mounted in a test fixture representative of the actual
installation in the cabin.
3.2 Loads to be applied
Abuse loads should be considered as ultimate loads, therefore, no additional factors (e.g.
fitting factors, casting factors, etc.) need to be applied for abuse load analysis/testing.
Unless it is justified that one or more abuse load cases are not applicable due to the
shape/size/location of the glass item making it unlikely or impossible for persons to apply
loads in the direction(s) concerned, the following abuse loads should be considered (see also
Figure 1 below):
3.2.1 Pushing loads
Pushing loads are 133 daN (300 lbf) from 0 1.5 m (60 in.) above the floor, reducing
linearly to 44 daN (100 lbf) at 2 m (80 in.) above the floor level (see (1) in Figure 1
below).
3.2.2 Pulling loads
One-hand pull loads (where it is not possible to grab with two hands) are 66 daN (150
lbf) from 0 1.5 m (60 in.) above the floor, reducing linearly to 22 daN (50 lbf) at 2 m
(80 in.) above the floor level (see (3) in Figure 1 below).
Two-hands pull loads are 133 daN (300 lbf) from 0 1.5 m (60 in.) above the floor,
reducing linearly to 44 daN (100 lbf) at 2 m (80 in.) above the floor level (see (1) in
Figure 1 below).
3.2.3 Up loads
Up loads are 66 daN (150 lbf) from 0 1.5 m (60 in.) above the floor, reducing linearly
to 22 daN (50 lbf) at 2 m (80 in.) above the floor level (see (2) in Figure 1 below).
3.2.4 Downloads

Annex to ED Decision 2023/021/R Page 334 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

Downloads are 133 daN (300 lbf) from 0-1.5 m (60 in.) above the floor, reducing linearly
to 44 daN (100 lbf) at 2 m (80 in.) above the floor level (see (1) in Figure 1 below).
3.2.5 Stepping, Seating loads
In the case of large glass items which may be stepped or sat on, a load of 222 daN (500
lbf) should be used. This load is to be applied at the most critical point, and on any
relevant surface up to 1 m (38 in.) above the floor level (see (4) in Figure 1 below).

Figure 1

[Amdt No: 25/19]

[Amdt No: 25/27]

AMC 25.603(b) Suitability and durability of materials Approved

material specifications and material process specifications
The approved material specifications and material process specifications should:
be suitable for the application;
define material and material process controls;
include requirements to assist the applicant in managing raw/feedstock/unfinished materials, as
appropriate to the technology (e.g. the feedstock powder used in additive manufacturing, or matrix
systems used in pre-impregnated composites).

Annex to ED Decision 2023/021/R Page 335 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

The material strength and other properties that are used in design data (including fatigue and damage
tolerance characteristics, when applicable) are governed by, and can be significantly sensitive to, the
related variables of the material production process (including raw-material considerations).
Furthermore, these properties may also be influenced by other higher-level fabrication processes
(manufacturing and assembly), including other post-processing activities (e.g. adhesive material and
bonding properties produced in a bonded joint of a complex part may not be the same as those produced
in a test coupon).
The material specifications, material process specifications, and/or production drawings should identify
key characteristics and parameters to be monitored by in-process quality control, including the acceptable
limits to the characteristics of materials and processes (e.g. acceptable anomalies or flaws), and should
address anisotropy, when applicable. This information may also help applicants identify other defect types
and damage modes than the anomalies and flaws that are accepted under the specifications, including
those that may occur in service. Such data may be used to help applicants show compliance with other
specifications, e.g. CS 25.571. However, showing compliance with CS 25.571 does not relieve from the
requirement for material process controls.
Note: approved material specifications and approved material process specifications can be, for example,
industry or military specifications, or European Technical Standard Orders (ETSOs).
[Amdt No: 25/27]

CS 25.605 Fabrication methods

(See AMC 25.605)
(a) The fabrication methods used (i.e. the manufacturing and assembly methods, including
consideration of the materials and material processes) must produce the strength and other
properties necessary to ensure a consistently safe part. If a fabrication method includes processes
that require close control to reach this objective, then those processes must be performed under
representative approved fabrication process specifications, supported by appropriately approved
material specifications (including considering the raw/feedstock/unfinished material specifications)
with appropriate controls for the design data.
(b) Each new fabrication method must be substantiated by a test programme that is representative of
the application.
[Amdt No: 25/27]

AMC 25.605(a) Fabrication methods Approved process

specifications
Examples of fabrication method processes that may require close control to consistently produce safe
parts include the following:
castings,
composite resin transfer methods,
bonding,

Annex to ED Decision 2023/021/R Page 336 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

welding,
heat-treating, or
additive manufacturing methods.
Fabrication method process specifications should include all critical inspection steps and/or process
controlled steps, and should be substantiated (they may require re-evaluation and new substantiation, if
modified later). All the inherent part characteristics that result from the fabrication method and affect the
material strength and other properties should be closely correlated with non-destructive inspection (NDI)
and/or process control variables. Furthermore, the applicant should show that the equipment used to
support the process-critical manufacturing steps (particularly those steps that are not directly supported
and controlled through inspection) is under appropriate process control, to ensure the consistent
production of safe parts.
CS 25.603 and CS 25.605 to ensure safety by maintaining the

applicants are reminded that, beyond the consideration of airframe strength, these CSs are also applicable
to other applications for which safety relies on strength or stiffness, e.g. system structures. Furthermore,
t safety is also maintained for applications for

flammability properties).
Note 2: approved fabrication process specifications and approved material specifications can be, for
example, industry or military specifications, or European Technical Standard Orders (ETSOs).
[Amdt No: 25/27]

AMC 25.605(b) New fabrication methods Test programme

The test programme should initially consider the material strength and other properties resulting from

configuration). The scope of the test programme should include considering the potential for anisotropic
properties unless the applicant has already established an understanding of these properties.
The test programme that is required for the certification of new fabrication methods should be used to
evaluate the critical process variables. Based on that evaluation, the applicant should establish in the
fabrication specifications the relevant parameters that govern the final material strength and other
properties of the part at the time of its production and throughout its operational life. Furthermore, the
applicant should evaluate the sensitivity of the material strength and other properties to the critical
process variables to ensure that the established parameters are both robust and practical.
Note: the test programme may also be used to help applicants understand the defect types and damage
modes to be considered when showing compliance with other specifications, e.g. CS 25.571.
Understanding the potential defects and damage modes is particularly important for sensitive fabrication
processes, e.g. those used for structural bonding.
[Amdt No: 25/27]

Annex to ED Decision 2023/021/R Page 337 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

CS 25.607 Fasteners
(See AMC 25.607)
(a) Each removable bolt, screw, nut, pin or other removable fastener must incorporate two separate
locking devices if
(1) Its loss could preclude continued flight and landing within the design limitations of the
aeroplane using normal pilot skill and strength; or
(2) Its loss could result in reduction in pitch, roll or yaw control capability or response below that
required by Subpart B of this CS-25.
(b) The fasteners specified in sub-paragraph (a) of this paragraph and their locking devices may not be
adversely affected by the environmental conditions associated with the particular installation.
(c) No self-locking nut may be used on any bolt subject to rotation in operation unless a non-friction
locking device is used in addition to the self-locking device.

AMC 25.607 Fasteners

FAA Advisory Circular AC 20-71 Dual Locking Devices on Fasteners, date 12-8-70, is accepted by the Agency
as providing acceptable means of compliance with CS 25.607.

CS 25.609 Protection of structure

(See AMC 25.609)
Each part of the structure must-
(a) Be suitably protected against deterioration or loss of strength in service due to any cause, including

(1) Weathering;
(2) Corrosion; and
(3) Abrasion; and
(b) Have provisions for ventilation and drainage where necessary for protection.
[Amdt 25/18]

AMC 25.609 Protection of structure

The comprehensive and detailed material standards accepted in the member states will be accepted as
satisfying the requirement of CS 25.609.

CS 25.611 Accessibility provisions

(a) Means must be provided to allow inspection (including inspection of principal structural elements
and control systems), replacement of parts normally requiring replacement, adjustment, and

Annex to ED Decision 2023/021/R Page 338 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

lubrication as necessary for continued airworthiness. The inspection means for each item must be
practicable for the inspection interval for the item. Non-destructive inspection aids may be used to
inspect structural elements where it is impracticable to provide means for direct visual inspection
if it is shown that the inspection is effective and the inspection procedures are specified in the
maintenance manual required by CS 25.1529.
(b) Electrical wiring interconnection systems must meet the accessibility requirements of CS 25.1719.
[Amdt 25/5]

CS 25.613 Material strength properties and Material Design Values

(See AMC 25.613)
(a) Material strength properties must be based on enough tests of material meeting approved
specifications to establish design values on a statistical basis.
(b) Material design values must be chosen to minimise the probability of structural failures due to
material variability. Except as provided in sub-paragraphs (e) and (f) of this paragraph, compliance
must be shown by selecting material design values which assure material strength with the
following probability:
(1) Where applied loads are eventually distributed through a single member within an assembly,
the failure of which would result in loss of structural integrity of the component, 99%
probability with 95% confidence.
(2) For redundant structure, in which the failure of individual elements would result in applied
loads being safely distributed to other load carrying members, 90% probability with 95%
confidence.
(c) The effects of environmental conditions, such as temperature and moisture, on material design
values used in an essential component or structure must be considered where these effects are
significant within the aeroplane operating envelope.
(d) Reserved
(e) Greater material design values may be u
which a specimen of each individual item is tested before use to determine that the actual strength
properties of that particular item will equal or exceed those used in design.
(f) Other material design values may be used if approved by the Agency.
[Amdt 25/1]

AMC 25.613 Material strength properties and material design values

1. Purpose. This AMC sets forth an acceptable means, but not the only means, of demonstrating
compliance with the provisions of CS-25 related to material strength properties and material design
values.
2. Related Certification Specifications.
CS 25.571 -

Annex to ED Decision 2023/021/R Page 339 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

CS 25.603
CS 25.613
3. General. CS 25.613 contains the requirements for material strength properties and material design
values. Material properties used for fatigue and damage tolerance analysis are addressed by CS
25.571 and AMC 25.571(a).
When developing the material strength properties and material design values, the applicant should
also consider potential anisotropies and establish all properties and design values relevant to the
application of the material.
4. Material Strength Properties and Material Design Values.
4.1. Definitions.
Material strength properties. Material properties that define the strength related
characteristics of any given material. Typical examples of material strength properties are:
ultimate and yield values for compression, tension, bearing, shear, etc.
Material design values. Material strength properties that have been established based on the
requirements of CS 25.613(b) or other means as defined in this AMC. These values are
generally statistically determined based on enough data that when used for design, the
probability of structural failure due to material variability will be minimised. Typical values
for moduli can be used.
Aeroplane operating envelope. The operating limitations defined for the product under
Subpart G of CS-25.
4.2. Statistically Based Design Values. Design values required by CS 25.613(b) must be based on
sufficient testing to assure a high degree of confidence in the values. In all cases, a statistical
analysis of the test data must be performed.
The A and B properties published in the Metallic Materials Properties Development
and Standardization (MMPDS) Handbook or ESDU 00932 are acceptable, as are the statistical
methods specified in the applicable chapters/sections of these handbooks. Other methods
of developing material design values may be acceptable to EASA.
The test specimens used for material property certification testing should be made from
material produced using production processes. Test specimen design, test methods, and
testing should:
(i) conform to universally accepted standards such as those of the American Society for
Testing Materials (ASTM), European Aerospace Series Standards (EN), International
Standard Organisation (ISO), or other national standards acceptable to the Agency, or:
(ii) conform to those detailed in the applicable chapters/sections of the SAE MMPDS
Handbook, Composite Materials Handbook 17 (CMH-17), ESDU 00932 or other
accepted equivalent material data handbooks, or:
(iii) be accomplished in accordance with an approved test plan which includes definition
of test specimens and test methods. This provision would be used, for example, when
the material design values are to be based on tests that include effects of specific
geometry and design features as well as material.

Annex to ED Decision 2023/021/R Page 340 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

EASA may approve the use of other material test data after review of test specimen design,
test methods, and test procedures that were used to generate the data.
The use of some materials and processes may allow the applicant to design parts for which
the material strength and other properties are produced during production or repair.
Consequently, the use of simple material test coupons (as typically produced, independent
of the part) at the base of a typical test pyramid (e.g. as defined in AMC 20-
terial strength and other properties of the
final part. When a higher test pyramid is required, then the applicant may need to reduce
(for practical reasons) the number of specimens below what is normally expected for
generating statistically significant values, e.g. as those associated with A and B basis data (as
defined in the MMPDS Handbook). Therefore, other mitigating measures are likely necessary
(e.g. coupon testing of prolongations, testing of coupons from sections of production parts,
other sampling strategies, more intensive non-destructive inspection (NDIs), etc.). Until
industry establishes standards for such situations, the applicant should agree with EASA
whether and how to use test articles of a higher test pyramid, as well as associated small
datasets, to generate material and design data. In that agreement, EASA may give credit to
the applicant for applicable established practices.
4.3. Consideration of Environmental Conditions. The material strength properties of a number of
materials, such as non-metallic composites and adhesives, can be significantly affected by
temperature as well as moisture absorption. For these materials, the effects of temperature
and moisture should be accounted for in the determination and use of material design values.
This determination should include the extremes of conditions encountered within the
aeroplane operating envelope. For example, the maximum temperature of a control surface
may include effects of direct and reflected solar radiation, convection and radiation from a
black runway surface and the maximum ambient temperature. Environmental conditions
other than those mentioned may also have significant effects on material design values for
some materials and should be considered.
4.4. Use of Higher Design Values Based on Premium Selection. Design values greater than those
determined under CS 25.613(b) may be used if a premium selection process is employed in
accordance with CS 25.613(e). In that process, individual specimens are tested to determine
the actual strength properties of each part to be installed on the aircraft to assure that the
strength will not be less than that used for design.
The applicant should have data available to understand if a material is anisotropic and should
account for this condition during testing.
If premium selection is to be used, the test procedures and acceptance criteria must be
specified on the design drawing.
4.5. Other Material Design Values. Previously used material design values, with consideration of
the source, service experience and application, may be approved by the Agency on a case by
case basis (e.g. "S" values of "The Metallic Materials Properties Development and
Standardization (MMPDS) handbook" or ESDU 00932).
4.6. Material Specifications and Processes. Materials should be produced using production
specifications and processes accepted by the Agency.]
[Amdt 25/1]

Annex to ED Decision 2023/021/R Page 341 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

[Amdt 25/27]

CS 25.619 Special factors

The factor of safety prescribed in CS 25.303 must be multiplied by the highest pertinent special factor of
safety prescribed in CS 25.621 through CS 25.625 for each part of the structure whose strength is
(a) Uncertain.
(b) Likely to deteriorate in service before normal replacement; or
(c) Subject to appreciable variability because of uncertainties in manufacturing processes or inspection
methods.
Where the Agency is not satisfied in a specific case that a special factor is the correct approach to ensuring
the necessary integrity of the parts of the structure under service conditions, other appropriate measures
must be taken.

CS 25.621 Casting factors

(see AMC 25.621.)
(a) General. For castings used in structural applications, the factors, tests, and inspections specified in
sub-paragraphs (b) through (d) of this paragraph must be applied in addition to those necessary to
establish foundry quality control. The inspections must meet accepted specifications. Sub-
paragraphs (c) and (d) of this paragraph apply to any structural castings except castings that are
pressure tested as parts of hydraulic or other fluid systems and do not support structural loads.
(b) Bearing stresses and surfaces. The casting factors specified in sub-paragraphs (c) and (d) of this
paragraph:
(1) Need not exceed 1.25 with respect to bearing stresses regardless of the method of inspection
used; and
(2) Need not be used with respect to the bearing surfaces of a part whose bearing factor is larger
than the applicable casting factor.
(c) Critical castings. (See AMC 25.621(c)) Each casting whose failure could preclude continued safe
flight and landing of the aeroplane or could result in serious injury to occupants is considered a
critical casting. Each critical casting must have a factor associated with it for showing compliance
with strength and deformation requirements, and must comply with the following criteria
associated with that factor:
(1) A casting factor of 1.0 or greater may be used, provided that:
(i) It is demonstrated, in the form of process qualification, proof of product, and process
monitoring that, for each casting design and part number, the castings produced by
each foundry and process combination have coefficients of variation of the material
properties that are equivalent to those of wrought alloy products of similar
composition. Process monitoring must include testing of coupons cut from the
prolongations of each casting (or each set of castings, if produced from a single pour
into a single mould in a runner system) and, on a sampling basis, coupons cut from

Annex to ED Decision 2023/021/R Page 342 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

critical areas of production castings. The acceptance criteria for the process monitoring
inspections and tests must be established and included in the process specifications to
ensure the properties of the production castings are controlled to within levels used in
design.
(ii) Each casting receives:
(A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or
equivalent, inspection methods; and
(B) Inspection of structurally significant internal areas and areas where defects are
likely to occur, using radiographic, or equivalent, inspection methods.
(iii) One casting undergoes a static test and is shown to meet the strength and deformation
requirements of CS 25.305(a) and (b).
(see AMC 25.621(c)(1).)
(2) A casting factor of 1.25 or greater may be used, provided that:
(i) Each casting receives:
(A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or
equivalent inspection methods; and
(B) Inspection of structurally significant internal areas and areas where defects are
likely to occur, using radiographic, or equivalent, inspection methods.
(ii) Three castings undergo static tests and are shown to meet:
(A) The strength requirements of CS 25.305(b) at an ultimate load corresponding to
a casting factor of 1.25; and
(B) The deformation requirements of CS 25.305(a) at a load of 1.15 times the limit
load.
(3) A casting factor of 1.50 or greater may be used, provided that:
(i) Each casting receives:
(A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or
equivalent, inspection methods; and
(B) Inspection of structurally significant internal areas and areas where defects are
likely to occur, using radiographic, or equivalent, inspection methods.
(ii) One casting undergoes a static test and is shown to meet:
(A) The strength requirements of CS 25.305(b) at an ultimate load corresponding to
a casting factor of 1.50; and
(B) The deformation requirements of CS 25.305(a) at a load of 1.15 times the limit
load.
(d) Non-critical castings. For each casting other than critical castings, as specified in sub-paragraph (c)
of this paragraph, the following apply:

Annex to ED Decision 2023/021/R Page 343 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

(1) A casting factor of 1.0 or greater may be used, provided that compliance is shown with sub-
paragraph (c)(1) of this paragraph, or with the following three conditions:
(i) Castings are manufactured to accepted specifications that specify the minimum
mechanical properties of the material in the casting and provides for demonstration
of these properties by testing of coupons cut from the castings on a sampling basis.
(ii) Each casting receives:
(A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or
equivalent, inspection methods; and
(B) Inspection of structurally significant internal areas and areas where defects are
likely to occur, using radiographic, or equivalent, inspection methods.
(iii) Three sample castings undergo static tests and are shown to meet the strength and
deformation requirements of CS 25.305(a) and (b).
(2) A casting factor of 1.25 or greater may be used, provided that each casting receives:
(i) Inspection of 100 percent of its surface, using visual and liquid penetrant, or
equivalent, inspection methods; and
(ii) Inspection of structurally significant internal areas and areas where defects are likely
to occur, using radiographic, or equivalent, inspection methods.
(3) A casting factor of 1.5 or greater may be used, provided that each casting receives inspection
of 100 percent of its surface using visual and liquid penetrant, or equivalent, inspection
methods.
(4) A casting factor of 2.0 or greater may be used, provided that each casting receives inspection
of 100 percent of its surface using visual inspection methods.
(5) The number of castings per production batch to be inspected by non-visual methods in
accordance with sub-paragraphs (d)(2) and (d)(3) of this paragraph may be reduced from
100% when an accepted quality control procedure is established.
[Amdt 25/1]

AMC 25.621 Casting Factors

1. Purpose.
CS 25.621 is an additional rule/requirement for structural substantiation of cast parts and
components. It is used in combination with a number of other paragraphs, and does not replace or
negate compliance with any other paragraph of CS-25. The intent of this AMC is to provide general
guidance on the use and background of "Casting Factors" as required by CS 25.621.
2. General Guidance For Use Of Casting Factors.
2.1 For the analysis or testing required by CS 25.307, the ultimate load level must include limit
load multiplied by the required factor required by CS 25.619. The testing required in
accordance with CS 25.621 may be used in showing compliance with CS 25.305 and

Annex to ED Decision 2023/021/R Page 344 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

CS 25.307. These factors need not be considered in the fatigue and damage tolerance
evaluations required by CS 25.571.
2.2 The inspection methods prescribed by CS 25.621(c) and (d) for all production castings must
be such that 100% of the castings are inspected by visual and liquid penetrant techniques,
with total coverage of the surface of the casting. With regard to the required radiographic
inspection, each production casting must be inspected by this technique or equivalent
inspection methods; the inspection may be limited to the structurally significant internal
areas and areas where defects are likely to occur.
2.3 With the establishment of consistent production, it is possible to reduce the inspection
frequency of the non-visual inspections required by the rule for non-critical castings, with the
acceptance of the Agency. This is usually accomplished by an accepted quality control
procedure incorporating a sampling plan. (Refer to CS 25.621(d)(5).)
2.4 The static test specimen(s) should be selected on the basis of the foundry quality control
inspections, in conjunction with those inspections prescribed in CS 25.621(c) and (d). An
attempt should be made to select the worst casting(s) from the first batch produced to the
production standard.
2.5 If applicable, the effects on material properties due to weld rework should be addressed. The
extent and scope of weld rework should be detailed in the manufacturing specifications as
well as on the design drawings.
3. Background.
3.1 Regulatory Background. CS 25.621
-
specifies the accomplishment of certain inspections and tests, and the application of special
factors of safety for ultimate strength and deformation.
3.2 Application of Special Factors of Safety. The application of factors of safety applied to castings
is based on the fact that the casting process can be inconsistent. Casting is a method of
forming an object by pouring molten metal into a mould, allowing the material to solidify
inside the mould, and removing it when solidification is complete. Castings are subject to
variability in mechanical properties due to this casting process, which can result in
imperfections, such as voids, within the cast part. Using certain inspection techniques, for
example radiographic (X-ray), it is possible to detect such imperfections above a minimum
detectable size, but accurate detection depends on the dimensions of the part, the inspection
equipment used, and the skill of the inspector.
3.2.1 CS 25.619 ial factor to the
factor of safety prescribed in CS 25.303 for each part of the aeroplane structure whose
strength is subject to appreciable variability because of uncertainties in the
manufacturing processes or inspection methods. Since the mechanical properties of a
casting depend on the casting design, the design values established under CS 25.613

be applicable to another casting made to the same specification. Thus, casting factors
have been necessary for castings produced by normal techniques and methodologies
to ensure the structural integrity of castings in light of these uncertainties.

Annex to ED Decision 2023/021/R Page 345 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

3.2.2 Another approach is to reduce the uncertainties in the casting manufacturing process
AMC 25.621(c)(1)), which provides
a means of using a casting factor of 1.0. CS 25.621
use of a casting factor of 1.0 for critical castings, provided that:
the manufacturer has established tight controls for the casting process, inspection,
and testing; and
the material strength properties of the casting have no more variability than
equivalent wrought alloys.
[Amdt 25/1]

AMC 25.621(c) Critical Castings

Examples of castings that may be critical are: structural attachment fittings; parts of flight control systems;
control surface hinges and balance weight attachments; seat, berth, safety belt and fuel and oil tank
supports and attachments; pressurised doors; and cabin pressure valves.
[Amdt 25/1]

AMC 25.621(c)(1) Premium Castings

1. Purpose.
This AMC details an acceptable means, but not the only means, for compliance with CS 25.621 for
ed in structural applications. A
premium casting process is capable of producing castings with predictable properties, thus allowing
a casting factor of 1.0 to be used for these components. Three major steps, required by CS
25.621(c)(1)(i), are essential in characterising a premium casting process:
qualification of the process,
proof of the product, and
monitoring of the process.
2. Definitions. For the purposes of this AMC, the following definitions apply:
2.1 Premium Casting Process: a casting process that produces castings characterised by a high
quality and reliability
2.2 Prolongation: an integrally cast test bar or test coupon.
2.3 Test Casting: a casting produced specifically for the purpose of qualifying the casting process.
3. General. The objective of a premium casting process is to consistently produce castings with high
quality and reliability. To this end, the casting process is one that is capable of consistently
producing castings that include the following characteristics:
Good dimensional tolerance
Minimal distortion
Good surface finish

Annex to ED Decision 2023/021/R Page 346 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

No cracks
No cold shuts
No laps
Minimal shrinkage cavities
No harmful entrapped oxide films
Minimal porosity
A high level of metallurgical cleanness
Good microstructural characteristics
Minimal residual internal stress
Consistent mechanical properties
The majority of these characteristics can be detected, evaluated, and quantified by standard non-
destructive testing methods, or from destructive methods on prolongation or casting cut-up tests.
However, a number of them cannot. Thus, to ensure an acceptable quality of product, the
significant and critical process variables must be identified and adequately controlled.
4. A Means of Qualification of Casting Process.
4.1 To prove a premium casting process, it should be submitted to a qualification program that
is specific to a foundry/material combination. The qualification program should establish the
following:
(a) The capability of the casting process of producing a consistent quality of product for
the specific material grade selected for the intended production component.
(b) The mechanical properties for the material produced by the process have population
coefficients of variation equivalent to that of wrought products of similar composition
(i.e., plate, extrusions, and bar). Usage of the population coefficient of variation from
forged products does not apply. In most cases, the coefficients of variation for tensile
ultimate strength and tensile yield strength less than or equal to 3.5% and 4.0%
respectively is adequate to demonstrate this equivalency of mechanical properties.
(c) The casting process is capable of producing a casting with uniform properties
throughout the casting or, if not uniform, with a distribution of material properties
that can be predicted to an acceptable level of accuracy.
(d) The (initial) material design data for the specified material are established.
(e) The material and process specifications are clearly defined.
4.2 For each material specification, a series of test castings from a number of melts, using the
appropriate production procedures of the foundry, should be manufactured. The test casting
produced should undergo a standardised inspection or investigation of non-destructive
inspection and cut-up testing, to determine the consistency of the casting process.
4.3 The test casting should be representative of the intended cast product(s) with regard to
section thicknesses and complexity, and should expose any limitations of the casting process.
In addition, the test casting should be large enough to provide mechanical test specimens

Annex to ED Decision 2023/021/R Page 347 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

from various areas, for tensile and, if applicable, compression, shear, bearing, fatigue,
fracture toughness, and crack propagation tests. If the production component complies with
these requirements, it may be used to qualify the process. The number of melts sampled
should be statistically significant. Typically, at least 10 melts are sampled, with no more than
10 castings produced from each melt. If the material specification requires the components
to be heat-treated, this should be done in no fewer than 10 heat treatment batches
consisting of castings from more than one melt. Reduction of qualification tests may be
considered if the casting process and the casting alloy is already well known for aerospace
applications and the relevant data are available.
4.4 Each test casting should receive a non-destructive inspection program which should include
as a minimum:
inspection of 100% of its surface, using visual and liquid penetrant, or equivalent,
inspection methods; and
inspection of structurally significant internal areas and areas where defects are likely to
occur, using radiographic methods or equivalent inspection methods. The specific
radiographic standard to be employed is to be determined, and the margin by which the
test castings exceed the minimum required standard should be recorded.
4.4.1 The program of inspection is intended to:
(a) confirm that the casting process is capable of producing a consistent quality of
product, and
(b) verify compliance with the stated objectives of a premium casting process with
regard to surface finish, cracks, cold shuts, laps, shrinkage cavities, and porosity,
(see paragraph 3), and
(c) ensure that the areas from which the mechanical property test samples were
taken were typical of the casting as a whole with respect to porosity and
cleanness.
4.4.2 Guidance on non-destructive inspection techniques and methods can be obtained
from national and international standards. The standard listing below is not a
comprehensive list but is given as an initial reference guide.
ASTM A802 Standard practice for steel castings, surface acceptance standards, visual
examination.
ASTM A903 Standard specification for steel castings, surface acceptance standards,
magnetic particle and liquid penetrant inspection.
ASTM E155 Standard Reference Radiographs for Inspection of Aluminum and
Magnesium Castings.
ASTM E192 Standard Reference Radiographs for Investment Steel Castings of
Aerospace Applications.
ASTM E433 Standard reference photographs for liquid penetrant inspection.
ASTM E1030 Standard test method for radiographic examination of metallic castings.
ASTM E1320 Standard Reference Radiographs for Titanium Castings.

Annex to ED Decision 2023/021/R Page 348 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

ISO 4986 Steel castings - Magnetic particle inspection

ISO 4987 Steel castings - Penetrant inspection
ISO 4993 Steel castings - Radiographic inspection
ISO 9915 Aluminium alloy castings - Radiography testing
ISO 9916 Aluminium alloy and magnesium alloy castings - Liquid penetrant inspection
ISO 10049 Aluminium alloy castings - Visual method for assessing the porosity
ISO 11971 Visual examination of surface quality of steel castings
The test castings must show that the Foundry/Process combination is capable of
producing product free of cracks, laps, and cold shuts. Ideally the test castings should
be free of detectable shrinkage cavities and porosity. With regard to dimensional
tolerance, distortion, and surface finish guidance for acceptance criteria can be gained
from the standards cited above. Consideration that these standards are for general
quality castings must be given when they are used.
4.5 All test castings should be cut up to a standardised methodology to produce the mechanical
test specimens as detailed by paragraph 4.3 above. Principally, the tests are to establish the
variability within the cast component, as well as to determine the variability between
components from the same melt and from melt to melt. The data gathered also may be used
during latter phases to identify deviations from the limits established in the process
qualification and product proving programs.
4.6 All the fracture surfaces generated during the qualification program should be inspected at
least visually for detrimental defects. Evidence of inclusions, oxide films, porosity or
shrinkage cavities would indicate inadequate control of the casting process.
4.7 As part of the cut-up investigation, it is usually necessary to take metallographic samples for
cleanness determination and microstructural characterisation.
4.8 When the process has been qualified, it should not be altered without completing
comparability studies and necessary testing of differences.
5. Proof of Product
5.1 Subsequent to the qualification of the process, the production castings should be subjected
to a production-proving program. Such castings should have at least one prolongation;
however, large and/or complex castings may require more than one. If a number of castings
are produced from a single mould with a single runner system, they may be treated as one
single casting. The production-proving program should establish the following:
(a) The design values developed during the process qualification program are valid (e.g.,
same statistical distribution) for the production casting.
(b) The production castings have the same or less than the level of internal defects as the
test castings produced during qualification.
(c) The cast components have a predictable distribution of tensile properties.
(d) The prolongation(s) is representative of the critical area(s) of the casting.

Annex to ED Decision 2023/021/R Page 349 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

(e) The prolongation(s) consistently reflects the quality process, and material properties
of the casting.
5.2 A number of (i.e., at least two) pre-production castings of each part number to be produced
should be selected for testing and inspection. All of the selected castings should be non-
destructively inspected in accordance with the qualification program.
(a) One of these castings should be used as a dimensional tolerance test article. The other
selected casting(s) should be cut up for mechanical property testing and
metallographic inspection.
(b) The casting(s) should be cut up to a standardised program to yield a number of tensile
test specimens and metallographic samples. There should be sufficient cut-up tensile
specimens to cove
service loading) areas of the casting.
(c) All prolongations should be machined to give tensile specimens, and subsequently
tested.
(d) The production castings should be produced to production procedures identical to
those used for these pre-production castings.
5.3 On initial production, a number of castings should undergo a cut-up for mechanical property
testing and metallographic inspection, similar to that performed for the pre-production
casting(s). The cut-up procedure used should be standardised, although it may differ from
that used for the pre-production casting(s). Tensile specimens should be obtained from the
most critical areas.
(a) For the first 30 castings produced, at least 1 casting in 10 should undergo this testing
program.
(b) The results from the mechanical property tests should be compared with the results
obtained from the prolongations to further substantiate the correlation between
prolongation(s) and the critical area(s) of the casting.
(c) In addition, if the distribution of mechanical properties derived from these tests is
acceptable, when compared to the property values determined in the qualification
program, the frequency of testing may be reduced. However, if the comparison is
found not to be acceptable, the test program may require extension.
5.4 At no point in the production should the castings contain shrinkage cavities, cracks, cold
shuts, laps, porosity, or entrapped oxide film, or have a poor surface finish, exceeding the
acceptance level defined in the technical specifications.
6. Monitoring the Process.
6.1 For the product quality techniques should be employed to establish the significant/critical
foundry process variables that have an impact on the quality of the product. For the product
it should be shown that these variables are controlled with positive corrective action
throughout production.
6.2 During production, every casting should be non-destructively inspected using the techniques
and the acceptance standards employed during the qualification program.

Annex to ED Decision 2023/021/R Page 350 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

(a) Rejections should be investigated and process corrections made as necessary.

(b) Alternative techniques may be employed if the equivalence in the acceptance levels
can be demonstrated.
(c) In addition, tensile tests should be taken from the prolongations on every component
produced, and the results should comply with limits developed in the process
qualification and product proving programs.
(d) Additionally, as previously mentioned, a periodic casting cut-up inspection should be
undertaken, with the inspection schedule as agreed upon during the proof of product
program.
(e) Deviations from the limits established in the process qualification and product proving
programs should be investigated and corrective action taken.
7. Modifications to the Casting Design, Material, and Process.
7.1 Additional testing may be required when alterations are made to the casting geometry,
material, significant/critical process variables, process, or production foundry to verify that
the alterations have not significantly cha The verification
testing recommended is detailed in Table 1, below:

Modifications Verification Testing

Case Geometry Material Process Foundry Qualification of Proof of Tests per CS
Process Product 25.621(c)(1)
1 yes none none none not necessary yes yes (b)
2 none yes none none yes (a) yes yes (b)
3 yes yes none none yes yes yes
4 none none yes None yes (a) yes yes (b)
5 none none none yes yes (a) yes yes (b)
(a) The program described in paragraph 4. of this AMC to qualify a new material, process, and foundry
combination may not be necessary if the following 3 conditions exist for the new combination:
(1) Sufficient data from relevant castings to show that the process is capable of producing a
consistent quality of product, and that the quality is comparable to or better than the old
combination.
(2) Sufficient data from relevant castings to establish that the mechanical properties of the castings
produced from the new combination have a similar or better statistical distribution than the old
combination.
(3) Clearly defined material and process specifications.
(b) The casting may be re-qualified by testing partial static test samples (with larger castings, re-
qualification could be undertaken by a static test of the casting's critical region only).

[Amdt 25/1]

Annex to ED Decision 2023/021/R Page 351 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

CS 25.623 Bearing factors

(a) Except as provided in sub-paragraph (b) of this paragraph, each part that has clearance (free fit),
and that is subject to pounding or vibration, must have a bearing factor large enough to provide for
the effects of normal relative motion.
(b) No bearing factor need be used for a part for which any larger special factor is prescribed.

CS 25.625 Fitting factors

For each fitting (a part or terminal used to join one structural member to another), the following apply:
(a) For each fitting whose strength is not proven by limit and ultimate load tests in which actual stress
conditions are simulated in the fitting and surrounding structures, a fitting factor of at least 1·15
must be applied to each part of
(1) The fitting;
(2) The means of attachment; and
(3) The bearing on the joined members.
(b) No fitting factor need be used
(1) For joints made under approved practices and based on comprehensive test data (such as
continuous joints in metal plating, welded joints, and scarf joints in wood); or
(2) With respect to any bearing surface for which a larger special factor is used.
(c) For each integral fitting, the part must be treated as a fitting up to the point at which the section
properties become typical of the member.
(d) For each seat, berth, safety belt, and harness, the fitting factor specified in CS 25.785(f)(3) applies.

CS 25.629 Aeroelastic stability requirements

(See AMC 25.629)
(a) General. The aeroelastic stability evaluations required under this paragraph include flutter,
divergence, control reversal and any undue loss of stability and control as a result of structural
deformation. The aeroelastic evaluation must include whirl modes associated with any propeller or
rotating device that contributes significant dynamic forces. Compliance with this paragraph must
be shown by analyses, tests, or some combination thereof as found necessary by the Agency.
(b) Aeroelastic stability envelopes. The aeroplane must be designed to be free from aeroelastic
instability for all configurations and design conditions within the aeroelastic stability envelopes as
follows:
(1) For normal conditions without failures, malfunctions, or adverse conditions, all combinations
of altitudes and speeds encompassed by the VD/MD versus altitude envelope enlarged at all
points by an increase of 15 percent in equivalent airspeed at constant Mach number and
constant altitude. In addition, a proper margin of stability must exist at all speeds up to VD/MD
and, there must be no large and rapid reduction in stability as VD/MD is approached. The

Annex to ED Decision 2023/021/R Page 352 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

enlarged envelope may be limited to Mach 1.0 when MD is less than 1.0 at all design altitudes;
and
(2) For the conditions described in CS 25.629(d) below, for all approved altitudes, any airspeed
up to the greater airspeed defined by:
(i) The VD/MD envelope determined by CS 25.335(b); or,
(ii) An altitude-airspeed envelope defined by a 15 percent increase in equivalent airspeed
above VC at constant altitude, from sea level to the altitude of the intersection of 1.15
VC with the extension of the constant cruise Mach number line, M C, then a linear
variation in equivalent airspeed to MC +.05 at the altitude of the lowest VC/MC
intersection; then, at higher altitudes, up to the maximum flight altitude, the boundary
defined by a .05 Mach increase in MC at constant altitude; and
(iii) Failure conditions of certain systems must be treated in accordance with CS 25.302.
(3) For failure conditions in those systems covered by CS 25.302, the margins defined in
Appendix K of CS-25 apply.
(c) Balance weights. If balance weights are used, their effectiveness and strength, including supporting
structure, must be substantiated.
(d) Failures, malfunctions, and adverse conditions. The failures, malfunctions, and adverse conditions
which must be considered in showing compliance with this paragraph are:
(1) Any critical fuel loading conditions, not shown to be extremely improbable, which may result
from mismanagement of fuel.
(2) Any single failure in any flutter damper or flutter control system.
(3) For aeroplanes not approved for operation in icing conditions, the maximum likely ice
accumulation expected as a result of an inadvertent encounter.
(4) Failure of any single element of the structure supporting any engine, independently mounted
propeller shaft, large auxiliary power unit, or large externally mounted aerodynamic body
(such as an external fuel tank).
(5) For aeroplanes with engines that have propellers or large rotating devices capable of
significant dynamic forces, any single failure of the engine structure that would reduce the
rigidity of the rotational axis.
(6) The absence of aerodynamic or gyroscopic forces resulting from the most adverse
combination of feathered propellers or other rotating devices capable of significant dynamic
forces. In addition, the effect of a single feathered propeller or rotating device must be
coupled with the failures of sub-paragraphs (d)(4) and (d)(5) of this paragraph.
(7) Any single propeller or rotating device capable of significant dynamic forces rotating at the
highest likely overspeed.
(8) Any damage or failure condition, required or selected for investigation by CS 25.571. The
single structural failures described in sub-paragraphs (d)(4) and(d)(5) of this paragraph need
not be considered in showing compliance with this paragraph if;

Annex to ED Decision 2023/021/R Page 353 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

(i) The structural element could not fail due to discrete source damage resulting from the
conditions described in CS 25.571(e) and CS 25.903(d); and
(ii) A damage tolerance investigation in accordance with CS 25.571(b) shows that the
maximum extent of damage assumed for the purpose of residual strength evaluation
does not involve complete failure of the structural element.
(9) The following flight control system failure combinations where aeroelastic stability relies on
flight control system stiffness and/or damping:
(i) any dual hydraulic system failure;
(ii) any dual electrical system failure; and
(iii) any single failure in combination with any probable hydraulic system or electrical
system failure.
(10) Any damage, failure or malfunction, considered under CS 25.631, CS 25.671, CS 25.672, and
CS 25.1309.
(11) Any other combination of failures, malfunctions, or adverse conditions not shown to be
extremely improbable.
(e) Flight flutter testing. Full scale flight flutter tests at speeds up to VDF/MDF must be conducted for
new type designs and for modifications to a type design unless the modifications have been shown
to have an insignificant effect on the aeroelastic stability. These tests must demonstrate that the
aeroplane has a proper margin of damping at all speeds up to VDF/MDF, and that there is no large
and rapid reduction in damping as VDF/MDF is approached. If a failure, malfunction, or adverse
condition is simulated during flight test in showing compliance with sub-paragraph (d) of' this
paragraph, the maximum speed investigated need not exceed VFC/MFC if it is shown, by correlation
of the flight test data with other test data or analyses, that the aeroplane is free from any
aeroelastic instability at all speeds within the altitude-airspeed envelope described in sub-
paragraph (b)(2) of this paragraph.
[Amdt No: 25/1]
[Amdt No: 25/18]
[Amdt No: 25/24]

AMC 25.629 Aeroelastic stability requirements

1. General.
The general requirement for demonstrating freedom from aeroelastic instability is contained in CS
25.629, which also sets forth specific requirements for the investigation of these aeroelastic
phenomena for various aeroplane configurations and flight conditions. Additionally, there are other
conditions defined by the CS-25 paragraphs listed below to be investigated for aeroelastic stability
to assure safe flight. Many of the conditions contained in this AMC pertain only to the current
amendment of CS-25. Type design changes to aeroplanes certified to an earlier CS-25 amendment
must meet the certification basis established for the modified aeroplane.
Related CS-25 paragraphs:
CS 25.251 - Vibration and buffeting

Annex to ED Decision 2023/021/R Page 354 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

CS 25.305 - Strength and deformation

CS 25.335 - Design airspeeds
CS 25.343 - Design fuel and oil loads
CS 25.571 - Damage-tolerance and fatigue evaluation of structure
CS 25.629 - Aeroelastic stability requirements
CS 25.631 - Bird strike damage
CS 25.671 - General (Control systems)
CS 25.672 - Stability augmentation and automatic and power operated systems
CS 25.1309 - Equipment, systems and installations
CS 25.1329 - Flight Guidance system
CS 25.1419 - Ice protection
CS 25.1420 Supercooled large drop icing conditions
2. Aeroelastic Stability Envelope
2.1. For nominal conditions without failures, malfunctions, or adverse conditions, freedom from
aeroelastic instability is required to be shown for all combinations of airspeed and altitude
encompassed by the design dive speed (VD) and design dive Mach number (MD) versus
altitude envelope enlarged at all points by an increase of 15 percent in equivalent airspeed
at both constant Mach number and constant altitude. Figure 1A represents a typical design
envelope expanded to the required aeroelastic stability envelope. Note that some required
Mach number and airspeed combinations correspond to altitudes below standard sea level.
2.2. The aeroelastic stability envelope may be limited to a maximum Mach number of 1.0 when
MD is less than 1.0 and there is no large and rapid reduction in damping as MD is approached.
2.3. Some configurations and conditions that are required to be investigated by CS 25.629 and
other CS-25 regulations consist of failures, malfunctions or adverse conditions. Aeroelastic
stability investigations of these conditions need to be carried out only within the design
airspeed versus altitude envelope defined by:
(i) the VD/MD envelope determined by CS 25.335(b); or,
(ii) an altitude-airspeed envelope defined by a 15 percent increase in equivalent airspeed
above VC at constant altitude, from sea level up to the altitude of the intersection of
1.15 VC with the extension of the constant cruise Mach number line, MC, then a linear
variation in equivalent airspeed to MC + 0.05 at the altitude of the lowest VC/MC
intersection; then at higher altitudes, up to the maximum flight altitude, the boundary
defined by a 0.05 Mach increase in MC at constant altitude.
Figure 1B shows the minimum aeroelastic stability envelope for fail-safe conditions, which is
a composite of the highest speed at each altitude from either the VD envelope or the
constructed altitude-airspeed envelope based on the defined VC and MC.

Annex to ED Decision 2023/021/R Page 355 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

Fail-safe design speeds, other than the ones defined above, may be used for certain system
failure conditions when specifically authorised by other rules or special conditions prescribed
in the certification basis of the aeroplane.
FIGURE 1A. MINIMUM REQUIRED AEROELASTIC STABILITY MARGIN

Annex to ED Decision 2023/021/R Page 356 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

FIGURE 1B MINIMUM FAIL-SAFE CLEARANCE ENVELOPE

3. Configurations and Conditions. The following paragraphs provide a summary of the configurations
and conditions to be investigated in demonstrating compliance with CS-25. Specific design
configurations may warrant additional considerations not discussed in this AMC.
3.1. Nominal Configurations and Conditions. Nominal configurations and conditions of the
aeroplane are those that are likely to exist in normal operation. Freedom from aeroelastic
instability should be shown throughout the expanded clearance envelope described in
paragraph 2.1 above for:
3.1.1. The range of fuel and payload combinations, including zero fuel in the wing, for which
certification is requested.
3.1.2. Configurations with ice mass accumulations on unprotected surfaces for aeroplanes
approved for operation in icing conditions. See paragraph 5.1.4.5 below.
3.1.3. All normal combinations of autopilot, yaw damper, or other automatic flight control
systems.
3.1.4. All possible engine settings and combinations of settings from idle power to maximum
available thrust including the conditions of one engine stopped and windmilling, in
order to address the influence of gyroscopic loads and thrust on aeroelastic stability.

Annex to ED Decision 2023/021/R Page 357 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

3.2. Failures, Malfunctions, and Adverse Conditions. The following conditions should be
investigated for aeroelastic instability within the fail-safe envelope defined in paragraph 2.3.
above.
3.2.1. Any critical fuel loading conditions, not shown to be extremely improbable, which may
result from mismanagement of fuel.
3.2.2. Any single failure in any flutter control system.
3.2.3. For aeroplanes not approved for operation in icing conditions, ice accumulation
expected as a result of an inadvertent encounter. For aeroplanes approved for
operation in icing conditions, ice accumulation expected as the result of any single
failure in the de-icing system, or any combination of failures not shown to be extremely
improbable. See paragraph 5.1.4.5 below.
3.2.4. Failure of any single element of the structure supporting any engine, independently
mounted propeller shaft, large auxiliary power unit, or large externally mounted
aerodynamic body (such as an external fuel tank).
3.2.5. For aeroplanes with engines that have propellers or large rotating devices capable of
significant dynamic forces, any single failure of the engine structure that would reduce
the rigidity of the rotational axis.
3.2.6. The absence of aerodynamic or gyroscopic forces resulting from the most adverse
combination of feathered propellers or other rotating devices capable of significant
dynamic forces. In addition, the effect of a single feathered propeller or rotating device
should be coupled with the failures of paragraphs 3.2.4 and 3.2.5 above.
3.2.7. Any single propeller or rotating device capable of significant dynamic forces rotating
at the highest likely overspeed.
3.2.8. Any damage or failure condition, required or selected for investigation by CS 25.571.
The single structural failures described in paragraphs 3.2.4 and 3.2.5 above need not
be considered in showing compliance with this paragraph if;
(A) The structural element could not fail due to discrete source damage resulting
from the conditions described in CS 25.571(e) and CS 25.903(d); and
(B) A damage tolerance investigation in accordance with CS 25.571(b) shows that
the maximum extent of damage assumed for the purpose of residual strength
evaluation does not involve complete failure of the structural element.
3.2.9. The following flight control system failure combinations where aeroelastic stability
relies on flight control system stiffness and/or damping:
(i) any dual hydraulic system failure;
(ii) any dual electrical system failure; and
(iii) any single failure in combination with any probable hydraulic system or
electrical system failure.
3.2.10. Any damage, failure or malfunction, considered under CS 25.631, CS 25.671,
CS 25.672, and CS 25.1309. This includes the condition of two or more engines stopped

Annex to ED Decision 2023/021/R Page 358 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

or wind milling for the design range of fuel and payload combinations, including zero
fuel.
3.2.11. Any other combination of failures, malfunctions, or adverse conditions not shown to
be extremely improbable.
4. Detail Design Requirements.
4.1. Main surfaces, such as wings and stabilisers, should be designed to meet the aeroelastic
stability criteria for nominal conditions and should be investigated for meeting fail-safe
criteria by considering stiffness changes due to discrete damage or by reasonable parametric
variations of design values.
4.2. Control surfaces, including tabs, should be investigated for nominal conditions and for failure
modes that include single structural failures (such as actuator disconnects, hinge failures, or,
in the case of aerodynamic balance panels, failed seals), single and dual hydraulic system
failures and any other combination of failures not shown to be extremely improbable. Where
other structural components contribute to the aeroelastic stability of the system, failures of
those components should be considered for possible adverse effects.
4.3. Where aeroelastic stability relies on flight control system stiffness and/or damping,
additional conditions should be considered. The actuation system should continuously
provide, at least, the minimum stiffness or damping required for showing aeroelastic stability
without regard to probability of occurrence for:
(i) more than one engine stopped or wind milling,
(ii) any discrete single failure resulting in a change of the structural modes of vibration (for
example; a disconnection or failure of a mechanical element, or a structural failure of
a hydraulic element, such as a hydraulic line, an actuator, a spool housing or a valve);
(iii) any damage or failure conditions considered under CS 25.571, CS 25.631 and
CS 25.671.
The actuation system minimum requirements should also be continuously met after any
combination of failures not shown to be extremely improbable (occurrence less than 10-9 per
flight hour). However, some combinations of failures, such as dual electrical system or dual
hydraulic system failures, or any single failure in combination with any probable electrical or
hydraulic system failure, are normally not demonstrated as being extremely improbable The
reliability assessment should be part of the substantiation documentation. In practice,
meeting the above conditions may involve design concepts such as the use of check valves
and accumulators, computerised pre-flight system checks and shortened inspection intervals
to protect against undetected failures.
4.4 Consideration of free play may be incorporated as a variation in stiffness to assure adequate
limits are established for wear of components such as control surface actuators, hinge
bearings, and engine mounts in order to maintain aeroelastic stability margins.
4.5. If balance weights are used on control surfaces, their effectiveness and strength, including
that of their support structure, should be substantiated.
4.6 The automatic flight control system should not interact with the airframe to produce an
aeroelastic instability. When analyses indicate possible adverse coupling, tests should be

Annex to ED Decision 2023/021/R Page 359 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

performed to determine the dynamic characteristics of actuation systems such as servo-

boost, fully powered servo-control systems, closed-loop aeroplane flight control systems,
stability augmentation systems, and other related powered-control systems.
5. Compliance. Demonstration of compliance with aeroelastic stability requirements for an aircraft
configuration may be shown by analyses, tests, or some combination thereof. In most instances,
analyses are required to determine aeroelastic stability margins for normal operations, as well as
for possible failure conditions. Wind tunnel flutter model tests, where applicable, may be used to
supplement flutter analyses. Ground testing may be used to collect stiffness or modal data for the
aircraft or components. Flight testing may be used to demonstrate compliance of the aircraft design
throughout the design speed envelope.
5.1. Analytical Investigations. Analyses should normally be used to investigate the aeroelastic
stability of the aircraft throughout its design flight envelope and as expanded by the required
speed margins. Analyses are used to evaluate aeroelastic stability sensitive parameters such
as aerodynamic coefficients, stiffness and mass distributions, control surface balance
requirements, fuel management schedules, engine/store locations, and control system
characteristics. The sensitivity of most critical parameters may be determined analytically by
varying the parameters from nominal. These investigations are an effective way to account
for the operating conditions and possible failure modes which may have an effect on
aeroelastic stability margins, and to account for uncertainties in the values of parameters and
expected variations due to in-service wear or failure conditions.
5.1.1. Analytical Modelling. The following paragraphs discuss acceptable, but not the only,
methods and forms of modelling aircraft configurations and/or components for
purposes of aeroelastic stability analysis. The types of investigations generally
encountered in the course of aircraft aeroelastic stability substantiation are also
discussed. The basic elements to be modelled in aeroelastic stability analyses are the
elastic, inertial, and aerodynamic characteristics of the system. The degree of
complexity required in the modelling, and the degree to which other characteristics
need to be included in the modelling, depend upon the system complexity.
5.1.1.1. Structural Modelling. Most forms of structural modelling can be classified into
two main categories: (1) modelling using a lumped mass beam, and (2) finite
element modelling. Regardless of the approach taken for structural modelling,
a minimum acceptable level of sophistication, consistent with configuration
complexity, is necessary to satisfactorily represent the critical modes of
deformation of the primary structure and control surfaces. The model should
reflect the support structure for the attachment of control surface actuators,
flutter dampers, and any other elements for which stiffness is important in
prevention of aeroelastic instability. Wing-pylon mounted engines are often
significant to aeroelastic stability and warrant particular attention in the
modelling of the pylon, and pylon-engine and pylon-wing interfaces. The model
should include the effects of cut-outs, doors, and other structural features which
may tend to affect the resulting structural effectiveness. Reduced stiffness
should be considered in the modelling of aircraft structural components which
may exhibit some change in stiffness under limit design flight conditions.
Structural models include mass distributions as well as representations of

Annex to ED Decision 2023/021/R Page 360 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

stiffness and possibly damping characteristics. Results from the models should
be compared to test data, such as that obtained from ground vibration tests, in
order to determine the accuracy of the model and its applicability to the
aeroelastic stability investigation.
5.1.1.2. Aerodynamic Modelling.
(a) Aerodynamic modelling for aeroelastic stability requires the use of
unsteady, two-dimensional strip or three-dimensional panel theory
methods for incompressible or compressible flow. The choice of the
appropriate technique depends on the complexity of the dynamic
structural motion of the surfaces under investigation and the flight speed
envelope of the aircraft. Aerodynamic modelling should be supported by
tests or previous experience with applications to similar configurations.
(b) Main and control surface aerodynamic data are commonly adjusted by
weighting factors in the aeroelastic stability solutions. The weighting
factors for steady flow (k=0) are usually obtained by comparing wind
tunnel test results with theoretical data. Special attention should be given
to control surface aerodynamics because viscous and other effects may
require more extensive adjustments to theoretical coefficients. Main
surface aerodynamic loading due to control surface deflection should be
considered.
5.1.2. Types of Analyses.
5.1.2.1. Oscillatory (flutter) and non-oscillatory (divergence and control reversal)
aeroelastic instabilities should be analysed to show compliance with CS 25.629.
5.1.2.2. The flutter analysis methods most extensively used involve modal analysis with
unsteady aerodynamic forces derived from various two- and three-dimensional
theories. These methods are generally for linear systems. Analyses involving
control system characteristics should include equations describing system
control laws in addition to the equations describing the structural modes.
5.1.2.3. Aeroplane lifting surface divergence analyses should include all appropriate
rigid body mode degrees-of-freedom since divergence may occur for a structural
mode or the short period mode.
5.1.2.4. Loss of control effectiveness (control reversal) due to the effects of elastic
deformations should be investigated. Analyses should include the inertial,
elastic, and aerodynamic forces resulting from a control surface deflection.
5.1.3 Damping Requirements.
5.1.3.1. There is no intent in this AMC to define a flight test level of acceptable
minimum damping.
5.1.3.2. Flutter analyses results are usually presented graphically in the form of
frequency versus velocity (V-f, Figure 2) and damping versus velocity (V-g,
Figures 3 and 4) curves for each root of the flutter solution.

Annex to ED Decision 2023/021/R Page 361 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

5.1.3.3. Figure 3 details one common method for showing compliance with the
requirement for a proper margin of damping. It is based on the assumption that
the structural damping available is 0.03 (1.5% critical viscous damping) and is
the same for all modes as depicted by the V-g curves shown in Figure 3. No
significant mode, such as curves (2) or (4), should cross the g=0 line below VD or
the g=0.03 line below 1.15 VD. An exception may be a mode exhibiting damping
characteristics similar to curve (1) in Figure 3, which is not critical for flutter. A
divergence mode, as illustrated by curve (3) where the frequency approaches
zero, should have a divergence velocity not less than 1.15 VD.
5.1.3.4. Figure 4 shows another common method of presenting the flutter analysis
results and defining the structural damping requirements. An appropriate
amount of structural damping for each mode is entered into the analysis prior
to the flutter solution. The amount of structural damping used should be
supported by measurements taken during full scale tests. This results in modes
offset from the g=0 line at zero airspeed and, in some cases, flutter solutions
different from those obtained with no structural damping. The similarity in the
curves of Figures 3 and 4 are only for simplifying this example. The minimum
acceptable damping line applied to the analytical results as shown in Figure 4
corresponds to 0.03 or the modal damping available at zero airspeed for the
particular mode of interest, whichever is less, but in no case less than 0.02. No
significant mode should cross this line below VD or the g=0 line below 1.15 VD.
5.1.3.5. For analysis of failures, malfunctions or adverse conditions being investigated,
the minimum acceptable damping level obtained analytically would be
determined by use of either method above, but with a substitution of VC for VD
and the fail-safe envelope speed at the analysis altitude as determined by
paragraph 2.3 above.

Annex to ED Decision 2023/021/R Page 362 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

FIGURE 2: FREQUENCY VERSUS VELOCITY

FIGURE 3: DAMPING VERSUS VELOCITY - Method 1

Annex to ED Decision 2023/021/R Page 363 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

FIGURE 4: DAMPING VERSUS VELOCITY - Method 2

5.1.4. Analysis Considerations. Airframe aeroelastic stability analyses may be used to verify
the design with respect to the structural stiffness, mass, fuel (including in-flight fuel
management), automatic flight control system characteristics, and altitude and Mach
number variations within the design flight envelope. The complete aeroplane should
be considered as composed of lifting surfaces and bodies, including all primary control
surfaces which can interact with the lifting surfaces to affect flutter stability. Control
surface flutter can occur in any speed regime and has historically been the most
common form of flutter. Lifting surface flutter is more likely to occur at high dynamic
pressure and at high subsonic and transonic Mach numbers. Analyses are necessary to
establish the mass balance and/or stiffness and redundancy requirements for the
control surfaces and supporting structure and to determine the basic surface flutter
trends. The analyses may be used to determine the sensitivity of the nominal aircraft
design to aerodynamic, mass, and stiffness variations. Sources of stiffness variation
may include the effects of skin buckling at limit load factor, air entrapment in hydraulic
actuators, expected levels of in-service free play, and control system components
which may include elements with non-linear stiffness. Mass variations include the
effects of fuel density and distribution, control surface repairs and painting, and water
and ice accumulation.
5.1.4.1. Control Surfaces. Control surface aeroelastic stability analyses should include
control surface rotation, tab rotation (if applicable), significant modes of the
aeroplane, control surface torsional degrees-of-freedom, and control surface
bending (if applicable). Analyses of aeroplanes with tabs should include tab

Annex to ED Decision 2023/021/R Page 364 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

rotation that is both independent and related to the parent control surface.
Control surface rotation frequencies should be varied about nominal values as
appropriate for the condition. The control surfaces should be analysed as
completely free in rotation unless it can be shown that this condition is
extremely improbable. All conditions between stick-free and stick-fixed should
be investigated. Free play effects should be incorporated to account for any
influence of in-service wear on flutter margins. The aerodynamic coefficients of
the control surface and tab used in the aeroelastic stability analysis should be
adjusted to match experimental values at zero frequency. Once the analysis has
been conducted with the nominal, experimentally adjusted values of hinge
moment coefficients, the analysis should be conducted with parametric
variations of these coefficients and other parameters subject to variability. If
aeroelastic stability margins are found to be sensitive to these parameters, then
additional verification in the form of model or flight tests may be required.
5.1.4.2. Mass Balance.
(a) The magnitude and spanwise location of control surface balance weights
may be evaluated by analysis and/or wind tunnel flutter model tests. If
the control surface torsional degrees of freedom are not included in the
analysis, then adequate separation needs to be maintained between the
frequency of the control surface first torsion mode and the flutter mode.
(b) Control surface unbalance tolerances should be specified to provide for
repair and painting. The accumulation of water, ice, and/or dirt in or near
the trailing edge of a control surface should be avoided. Free play
between the balance weight, the support arm, and the control surface
should not be allowed. Control surface mass properties (weight and static
unbalance) should be confirmed by measurement before ground
vibration testing.
(c) The balance weights and their supporting structure should be
substantiated for the extreme load factors expected throughout the
design flight envelope. If the absence of a rational investigation, the
following limit accelerations, applied through the balance weight centre
of gravity should be used.
100g normal to the plane of the surface
30g parallel to the hinge line
30g in the plane of the surface and perpendicular to the hinge line
5.1.4.3. Passive Flutter Dampers. Control surface passive flutter dampers may be used
to prevent flutter in the event of failure of some element of the control surface
actuation system or to prevent control surface buzz. Flutter analyses and/or
flutter model wind tunnel tests may be used to verify adequate damping.
Damper support structure flexibility should be included in the determination of
adequacy of damping at the flutter frequencies. Any single damper failure
should be considered. Combinations of multiple damper failures should be
examined when not shown to be extremely improbable. The combined free play

Annex to ED Decision 2023/021/R Page 365 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

of the damper and supporting elements between the control surface and fixed
surfaces should be considered. Provisions for in-service checks of damper
integrity should be considered. Refer to paragraph 4.3 above for conditions to
consider where a control surface actuator is switched to the role of an active or
passive damping element of the flight control system.
5.1.4.4. Intersecting Lifting Surfaces. Intersecting lifting surface aeroelastic stability
characteristics are more difficult to predict accurately than the characteristics of
planar surfaces such as wings. This is due to difficulties both in correctly
predicting vibration modal characteristics and in assessing those aerodynamic
effects which may be of second order importance on planar surfaces, but are
significant for intersecting surfaces. Proper representation of modal deflections
and unsteady aerodynamic coupling terms between surfaces is essential in
assessing the aeroelastic stability characteristics. The in-plane forces and
motions of one or the other of the intersecting surfaces may have a strong effect
on aeroelastic stability; therefore, the analysis should include the effects of
steady flight forces and elastic deformations on the in-plane effects.
5.1.4.5. Ice Accumulation. Aeroelastic stability analyses should use the mass
distributions derived from ice accumulations up to and including those that can
accrete in the applicable icing conditions in Appendices C and O to CS-25. This
includes any accretions that could develop on control surfaces. The analyses
need not consider the aerodynamic effects of ice shapes. For aeroplanes
approved for operation in icing conditions, all of the CS-25 Appendix C icing
conditions and the Appendix O icing conditions for which certification is sought
are applicable. For aeroplanes not approved for operation in icing conditions, all
of the Appendix C and O icing conditions are applicable since the inadvertent
encounter discussed in paragraph 3.2.3 of this AMC can occur in any icing
condition. For all aeroplanes, the ice accumulation determination should take
into account the ability to detect the ice and, if appropriate, the time required
to leave the icing condition.
For showing compliance with the CS-25 specifications relative to SLD icing
conditions represented by Appendix O, the applicant may use a comparative
analysis. AMC 25.1420(f) provides guidance for comparative analysis.
5.1.4.6. Whirl Flutter.
(a) The evaluation of the aeroelastic stability should include investigations of
any significant elastic, inertial, and aerodynamic forces, including those
associated with rotations and displacements in the plane of any turbofan
or propeller, including propeller or fan blade aerodynamics, powerplant
flexibilities, powerplant mounting characteristics, and gyroscopic
coupling.
(b) Failure conditions are usually significant for whirl instabilities. Engine
mount, engine gear box support, or shaft failures which result in a node
line shift for propeller hub pitching or yawing motion are especially
significant.

Annex to ED Decision 2023/021/R Page 366 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

(c) A wind tunnel test with a component flutter model, representing the
engine/propeller system and its support system along with correlative
vibration and flutter analyses of the flutter model, may be used to
demonstrate adequate stability of the nominal design and failed
conditions.
5.1.4.7. Automatic Control Systems. Aeroelastic stability analyses of the basic
configuration should include simulation of any control system for which
interaction may exist between the sensing elements and the structural modes.
Where structural/control system feedback is a potential problem the effects of
servo-actuator characteristics and the effects of local deformation of the servo
mount on the feedback sensor output should be included in the analysis. The
effect of control system failures on the aeroplane aeroelastic stability
characteristics should be investigated. Failures which significantly affect the
system gain and/or phase and are not shown to be extremely improbable should
be analysed.
5.2. Testing. The aeroelastic stability certification test programme may consist of ground tests,
flutter model tests, and flight flutter tests. Ground tests may be used for assessment of
component stiffness and for determining the vibration modal characteristics of aircraft
components and the complete airframe. Flutter model testing may be used to establish
flutter trends and validate aeroelastic stability boundaries in areas where unsteady
aerodynamic calculations require confirmation. Full scale flight flutter testing provides final
verification of aeroelastic stability. The results of any of these tests may be used to provide
substantiation data, to verify and improve analytical modelling procedures and data, and to
identify potential or previously undefined problem areas.
5.2.1. Structural Component Tests. Stiffness tests or ground vibration tests of structural
components are desirable to confirm analytically predicted characteristics and are
necessary where stiffness calculations cannot accurately predict these characteristics.
Components should be mounted so that the mounting characteristics are well defined
or readily measurable.
5.2.2. Control System Component Tests. When reliance is placed on stiffness or damping to
prevent aeroelastic instability, the following control system tests should be conducted.
If the tests are performed off the aeroplane the test fixtures should reflect local
attachment flexibility.
(i) Actuators for primary flight control surfaces and flutter dampers should be
tested with their supporting structure. These tests are to determine the
actuator/support structure stiffness for nominal design and failure conditions
considered in the fail-safe analysis.
(ii) Flutter damper tests should be conducted to verify the impedance of damper
and support structure. Satisfactory installed damper effectiveness at the
potential flutter frequencies should, however, be assured. The results of these
tests can be used to determine a suitable, in-service maintenance schedule and
replacement life of the damper. The effects of allowable in-service free play
should be measured.

Annex to ED Decision 2023/021/R Page 367 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

5.2.3. Ground vibration Tests.

5.2.3.1. Ground vibration tests (GVT) or modal response tests are normally conducted
on the complete conforming aeroplane. A GVT may be used to check the
mathematical structural model. Alternatively, the use of measured modal data
alone in aeroelastic stability analyses, instead of analytical modal data modified
to match test data, may be acceptable provided the accuracy and completeness
of the measured modal data is established. Whenever structural modifications
or inertia changes are made to a previously certified design or a GVT validated
model of the basic aeroplane, a GVT may not be necessary if these changes are
shown not to affect the aeroelastic stability characteristics.
5.2.3.2. The aeroplane is best supported such that the suspended aeroplane rigid body
modes are effectively uncoupled from the elastic modes of the aeroplane.
Alternatively, a suspension method may be used that couples with the elastic
aeroplane provided that the suspension can be analytically de-coupled from the
aeroplane structure in the vibration analysis. The former suspension criterion is
preferred for all ground vibration tests and is necessary in the absence of
vibration analysis.
5.2.3.3. The excitation method needs to have sufficient force output and frequency
range to adequately excite all significant resonant modes. The effective mass
and stiffness of the exciter and attachment hardware should not distort modal
response. More than one exciter or exciter location may be necessary to insure
that all significant modes are identified. Multiple exciter input may be necessary
on structures with significant internal damping to avoid low response levels and
phase shifts at points on the structure distant from the point of excitation.
Excitation may be sinusoidal, random, pseudo-random, transient, or other short
duration, non stationary means. For small surfaces the effect of test sensor
mass on response frequency should be taken into consideration when analysing
the test results.
5.2.3.4. The minimum modal response measurement should consist of acceleration (or
velocity) measurements and relative phasing at a sufficient number of points on
the aeroplane structure to accurately describe the response or mode shapes of
all significant structural modes. In addition, the structural damping of each
mode should be determined.
5.2.4. Flutter Model Tests.
5.2.4.1. Dynamically similar flutter models may be tested in the wind tunnel to
augment the flutter analysis. Flutter model testing can substantiate the flutter
margins directly or indirectly by validating analysis data or methods. Some
aspects of flutter analysis may require more extensive validation than others,
for example control surface aerodynamics, T-tails and other configurations with
aerodynamic interaction and compressibility effects. Flutter testing may
additionally be useful to test configurations that are impractical to verify in flight
test., such as fail-safe conditions or extensive store configurations. In any such
testing, the mounting of the model and the associated analysis should be
appropriate and consistent with the study being performed.

Annex to ED Decision 2023/021/R Page 368 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

5.2.4.2. Direct substantiation of the flutter margin (clearance testing) implies a high
degree of dynamic similitude. Such a test may be used to augment an analysis
and show a configuration flutter free throughout the expanded design envelope.
All the physical parameters which have been determined to be significant for
flutter response should be appropriately scaled. These will include elastic and
inertia properties, geometric properties and dynamic pressure. If transonic
effects are important, the Mach number should be maintained.
5.2.4.3. Validation of analysis methods is another appropriate use of wind tunnel
flutter testing. When the validity of a method is uncertain, correlation of wind
tunnel flutter testing results with a corresponding analysis may increase
confidence in the use of the analytical tool for certification analysis. A methods
validation test should simulate conditions, scaling and geometry appropriate for
the intended use of the analytical method.
5.2.4.4. Trend studies are an important use of wind tunnel flutter testing. Parametric
studies can be used to establish trends for control system balance and stiffness,
fuel and payload variations, structural compliances and configuration variations.
The set of physical parameters requiring similitude may not be as extensive to
study parametric trends as is required for clearance testing. For example, an
exact match of the Mach number may not be required to track the effects of
payload variations on a transonic aeroplane.
5.2.5. Flight Flutter Tests.
5.2.5.1. Full scale flight flutter testing of an aeroplane configuration to V DF/MDF is a
necessary part of the flutter substantiation. An exception may be made when
aerodynamic, mass, or stiffness changes to a certified aeroplane are minor, and
analysis or ground tests show a negligible effect on flutter or vibration
characteristics. If a failure, malfunction, or adverse condition is simulated during
a flight test, the maximum speed investigated need not exceed V FC/MFC if it is
shown, by correlation of the flight test data with other test data or analyses, that
the requirements of CS 25.629(b)(2) are met.
5.2.5.2. Aeroplane configurations and control system configurations should be
selected for flight test based on analyses and, when available, model test results.
Sufficient test conditions should be performed to demonstrate aeroelastic
stability throughout the entire flight envelope for the selected configurations.
5.2.5.3. Flight flutter testing requires excitation sufficient to excite the modes shown
by analysis to be the most likely to couple for flutter. Excitation methods may
include control surface motions or internal moving mass or external
aerodynamic exciters or flight turbulence. The method of excitation should be
appropriate for the modal response frequency being investigated. The effect of
the excitation system itself on the aeroplane flutter characteristics should be
determined prior to flight testing.
5.2.5.4. Measurement of the response at selected locations on the structure should be
made in order to determine the response amplitude, damping and frequency in
the critical modes at each test airspeed. It is desirable to monitor the response

Annex to ED Decision 2023/021/R Page 369 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
GENERAL

amplitude, frequency and damping change as VDF/MDF is approached. In

demonstrating that there is no large and rapid damping reduction as VDF/MDF is
approached, an endeavour should be made to identify a clear trend of damping
versus speed. If this is not possible, then sufficient test points should be
undertaken to achieve a satisfactory level of confidence that there is no
evidence of an adverse trend.
5.2.5.5. An evaluation of phenomena not presently amenable to analyses, such as
shock effects, buffet response levels, vibration levels, and control surface buzz,
should also be made during flight testing.
[Amdt 25/1]
[Amdt 25/6]
[Amdt 25/16]
[Amdt 25/18]
[Amdt 25/24]

CS 25.631 Bird strike damage

(See AMC 25.631)
The aeroplane must be designed to assure capability of continued safe flight and landing of the aeroplane

flight path) is equal to VC at sealevel or 0·85 VC at 2438 m (8000 ft), whichever is the more critical.
Compliance may be shown by analysis only when based on tests carried out on sufficiently representative
structures of similar design.
[Amdt 25/18]

AMC 25.631 Bird strike damage

Consideration should be given in the early stages of the design to the installation of items in essential
services, such as control system components, and items which, if damaged, could cause a hazard, such as
electrical equipment. As far as practicable, such items should not be installed immediately behind areas
liable to be struck by birds.

Annex to ED Decision 2023/021/R Page 370 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SURFACES

CONTROL SURFACES

CS 25.651 Proof of strength

(a) Limit load tests of control surfaces are required. These tests must include the horn or fitting to
which the control system is attached.
(b) Compliance with the special factors requirements of CS 25.619 to 25.625 and 25.657 for control
surface hinges must be shown by analysis or individual load tests.

CS 25.655 Installation
(a) Movable tail surfaces must be installed so that there is no interference between any surfaces when
one is held in its extreme position and the others are operated through their full angular movement.
(b) If an adjustable stabiliser is used, it must have stops that will limit its range of travel to the maximum
for which the aeroplane is shown to meet the trim requirements of CS 25.161.

CS 25.657 Hinges
(a) For control surface hinges, including ball, roller, and self-lubricated bearing hinges, the approved
rating of the bearing may not be exceeded. For non-standard bearing hinge configurations, the
rating must be established on the basis of experience or tests and, in the absence of a rational
investigation, a factor of safety of not less than 6·67 must be used with respect to the ultimate
bearing strength of the softest material used as a bearing.
(b) Hinges must have enough strength and rigidity for loads parallel to the hinge line.

Annex to ED Decision 2023/021/R Page 371 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

CONTROL SYSTEMS

CS 25.671 General
(See AMC 25.671)
(a) Each flight control system must operate with the ease, smoothness, and positiveness appropriate
to its function. In addition, the flight control system shall be designed to continue to operate,
respond appropriately to commands, and must not hinder aeroplane recovery, when the aeroplane
is in any attitude or experiencing any flight dynamics parameter that could occur due to operating
or environmental conditions.
(b) Each element of each flight control system must be designed to minimise the probability of
incorrect assembly that could result in the failure or malfunctioning of the system. Distinctive and
permanent marking may be used where design means are impractical, taking into consideration the
potential consequence of incorrect assembly.
(c) The aeroplane must be shown by analysis, test, or both, to be capable of continued safe flight and
landing after any of the following failures or jams in the flight control system within the normal
flight envelope. In addition, it must be shown that the pilot can readily counteract the effects of
any probable failure.
(1) Any single failure, excluding failures of the type defined in CS 25.671(c)(3);
(2) Any combination of failures not shown to be extremely improbable, excluding failures of the
type defined in CS 25.671(c)(3); and
(3) Any failure or event that results in a jam of a flight control surface or pilot control that is fixed
in position due to a physical interference. The jam must be evaluated as follows:
(i) The jam must be considered at any normally encountered position of the control
surface, or pilot controls;
(ii) The jam must be assumed to occur anywhere within the normal flight envelope and
during any flight phase from take-off to landing; and
In the presence of a jam considered under this sub-paragraph, any additional failure
conditions that could prevent continued safe flight and landing shall have a combined
probability of 1/1 000 or less.
(d) The aeroplane must be designed so that, if all engines fail at any time of the flight:
(1) it is controllable in flight;
(2) an approach can be made;
(3) a flare to a landing, and a flare to a ditching can be achieved; and
(4) during the ground phase, the aeroplane can be stopped.
(e) The aeroplane must be designed to indicate to the flight crew whenever the primary control means
is near the limit of control authority.

Annex to ED Decision 2023/021/R Page 372 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(f) If the flight control system has multiple modes of operation, appropriate flight crew alerting must
be provided whenever the aeroplane enters any mode that significantly changes or degrades the
normal handling or operational characteristics of the aeroplane.
[Amdt 25/18]
[Amdt 25/24]

AMC 25.671 Control Systems General

1. PURPOSE
This AMC provides an acceptable means, but not the only means, to demonstrate compliance with the
control system requirements of CS 25.671.
2. RELATED DOCUMENTS
a. Advisory Circulars, Acceptable Means of Compliance.
(1) FAA Advisory Circular (AC) 25-7D, dated 4 May 2018, Flight Test Guide for Certification of
Transport Category Airplanes.
(2) AMC 25.1309 System Design and Analysis.
b. Standards.
(1) EUROCAE document ED-79A, Guidelines for Development of Civil Aircraft and Systems,
issued in December 2010, or the equivalent SAE Aerospace Recommended Practice (ARP)
4754A.
(2) SAE Aerospace Recommended Practice (ARP) 4761, Guidelines and Methods for Conducting
the Safety Assessment Process on Civil Airborne Systems and Equipment, issued in December
1996.
3. APPLICABILITY OF CS 25.671
CS 25.671 applies to all flight control system installations (including primary, secondary, trim, lift, drag,
feel, and stability augmentation systems (refer to CS 25.672)) regardless of implementation technique
(manual, powered, fly-by-wire, or other means).
While CS 25.671 applies to flight control systems, CS 25.671(d) does apply to all control systems required
to provide control, including deceleration, for the phases specified.
4. DEFINITIONS
The following definitions apply to CS 25.671 and this AMC. Unless otherwise stated, they should not be
assumed to apply to the same or similar terms used in other rules or AMC.
a. At-Risk Time. The period of time during which an item must fail to cause the failure effect in
question. This is usually associated with the final fault in a fault sequence leading to a specific failure
condition. See also SAE ARP4761.
b. Catastrophic Failure Condition. Refer to AMC 25.1309 (Paragraph 7 FAILURE CONDITION
CLASSIFICATIONS AND PROBABILITY TERMS).
c. Continued Safe Flight and Landing. The capability for continued controlled flight and landing at an
aerodrome without requiring exceptional piloting skill or strength.

Annex to ED Decision 2023/021/R Page 373 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

d. Landing. The phase following final approach and starting with the landing flare. It includes the
ground phase on the runway and ends when the aeroplane comes to a complete stop on the
runway.
e. Latent Failure. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).
f. Error. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).
g. Event. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).
h. Exposure Time. The period of time between the time when an item was last known to be operating
properly and the time when it will be known to be operating properly again. See also SAE ARP4761.
i. Extremely Improbable. Refer to AMC 25.1309 (Paragraph 7 FAILURE CONDITION CLASSIFICATIONS
AND PROBABILITY TERMS).
j. Failure. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).
The following types of failures should be considered when demonstrating compliance with
CS 25.671(c). Since the type of failure and the effect of the failure depend on the system
architecture, this list is not exhaustive, but serves as a general guideline.
(1) Jam. Refer to the definition provided below.
(2) Loss of Control of Surface. A failure that results in a surface not responding to commands.
Failure sources can include mechanical disconnection, control cable disconnection, actuator
disconnection, loss of hydraulic power, or loss of control commands due to computers, data
path or actuator electronics failures. In these conditions, the position of the surface(s) or
controls can be determined by analysing the system architecture and aeroplane aerodynamic
characteristics; common positions include surface-centred (0°) or zero hinge-moment
position (surface float).
(3) Oscillatory Failure. A failure that results in undue surface oscillation. Failure sources include
control loop destabilisation, oscillatory sensor failure, oscillatory computer or actuator
electronics failure. The duration of the oscillation, its frequency, and amplitude depend on
the control loop, monitors, limiters, and other system features.
(4) Restricted Control. A failure that results in the achievable surface deflection being limited.
Failure sources include foreign object interference, malfunction of a travel limiter, and
malfunction of an envelope protection. This type of failure is considered under CS
25.671(c)(1) and CS 25.671(c)(2), as the system/surface can still be operated.
(5) Runaway or Hardover. A failure that results in uncommanded control surface movement.
Failure sources include servo valve jams, computer or actuator electronics malfunctioning.
The speed of the runaway, the duration of the runaway (permanent or transient), and the
resulting surface position (full or partial deflection) depend on the available monitoring,
limiters, and other system features. This type of failure is addressed under CS 25.671(c)(1)
and (c)(2).
Runaways that are caused by external events, such as loose or foreign objects, control system
icing, or any other environmental or external source are addressed in CS 25.671(c)(2).
(6) Stiff or Binding Controls. A failure that results in a significant increase in control forces. Failure
sources include failures of artificial feel systems, corroded bearings, jammed pulleys, and

Annex to ED Decision 2023/021/R Page 374 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

failures causing high friction. This type of failure is considered under CS 25.671(c)(1) and
CS 25.671(c)(2), as the system/surface can still be operated. In some architectures, higher
friction may result in reduced centring of the controls.
k. Failure Conditions. As used in CS 25.671(c), this term refers to the sum of all failures and failure
combinations contributing to a hazard, apart from the single failure (flight control system jam) being
considered.
l. Flight Control System. Flight control system refers to the following: primary flight controls from the

to the trim
lever to the brake/spoiler panels or other drag/lift-dumping devices, high-lift systems from the
-lift surfaces, feel systems, and stability augmentation systems.
Supporting systems (i.e. hydraulic systems, electrical power systems, avionics, etc.) should also be
included if failures in these systems have an impact on the function of the flight control system.
Examples of elements to be evaluated under CS 25.671 include, but are not limited to:
linkages,
hinges,
cables,
pulleys,
quadrants,
valves,
actuators (including actuator components),
flap/slat tracks (including track rollers and movable tracks),
bearings, axles and pins,
control surfaces (jam and runaway only),
attachment fittings.
m. In-flight is the time period from the time when the aeroplane is at 10 m (35 ft) above aerodrome
level (AAL) following a take-off, up to the time when the aeroplane reaches 15 m (50 ft) AAL prior
to landing, including climb, cruise, normal turns, descent, and approach.
n. Jam. A failure or event that results in either a control surface, a pilot control, or a component being
fixed in one position.
(i) Control surfaces and pilot controls fixed in one position due to a physical interference are
addressed under CS 25.671(c)(3). Causes may include corroded bearings, interference with a
foreign or loose object, control system icing, seizure of an actuator, or disconnection that
results in a jam by creating interference. Normally encountered positions are defined in
paragraph 7.b of this AMC.
(ii) All other failures or events that result in either a control surface, a pilot control, or a
component being fixed in one position are addressed under CS 25.671(c)(1) and 25.671(c)(2)
as appropriate. Depending on the system architecture and the location of the failure or the

Annex to ED Decision 2023/021/R Page 375 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

event, some failures or events that cause a jam may not always result in a fixed surface or
pilot control; for example, a jammed valve could result in a surface runaway.
o. Landing is the time period from the time when the aeroplane is at 15 m (50 ft) AAL prior to landing,
up to the complete stop of the aeroplane on the runway.
p. Probability versus Failure Rate. Failure rate is typically expressed in terms of average probability of
occurrence per flight hour. In cases where the failure condition is associated with a certain flight
condition that occurs only once per flight, the failure rate is typically expressed as average
probability of occurrence per flight (or per take-off, or per landing). Failure rates are usually the

at-risk time. Probability is non-dimensional and expresses the likelihood of encountering or being
in a failed state. Probability is obtained by multiplying a failure rate by the appropriate exposure
time.
q. Take-off is the time period from the brake release up to the time when the aeroplane reaches 10 m
(35 ft) AAL.
5. EVALUATION OF FLIGHT CONTROL SYSTEM OPERATION CS 25.671(a)
a. General.
Flight control systems should be designed such that when a movement to one position has been
selected, a different position can be selected without waiting for the completion of the initially
selected movement, and the system should arrive at the finally selected position without further
attention. The movements that follow and the time taken by the system to allow the required
sequence of selection should not adversely affect the controllability of the aeroplane.
b. Abnormal Attitude.
Compliance should be demonstrated by evaluation of the closed-loop flight control system. This
evaluation is intended to ensure that there are no features or unique characteristics (including

Open-loop flight control systems should also be evaluated, if applicable.

For aeroplanes that are equipped with a flight control envelope protection, the attitudes of the
aeroplane to be considered should include cases outside the protected envelope.
c. Parameters to be considered
The following relevant flight dynamic parameters should be considered by the applicant (non-
exhaustive list):
Pitch, Roll or Yaw rate
Vertical load factor
Airspeed
Angle of attack
d. Operating and Environmental Conditions

Annex to ED Decision 2023/021/R Page 376 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

The parameters in paragraph 5.c. above should be considered within the limit flight envelope, which
is the flight envelope that is associated with the aeroplane design limits or the flight control system
protection limits.
6. EVALUATION OF FLIGHT CONTROL SYSTEM ASSEMBLY CS 25.671(b)
The intent of CS 25.671(b) is to minimise the risk by design that the elements of the flight control system
are incorrectly assembled, such that this leads to significant safety effects. The intent is not to address
configuration control (refer to CS 25.1301(a)(2)).
The applicant should take adequate precautions during the design process and provide adequate
procedures in the instructions for continued airworthiness to minimise the risk of incorrect assembly (i.e.
installation, connection, or adjustment) of elements of the flight control system during production and
maintenance. The following steps should be used:
(1) assess the potential effects of potential incorrect assemblies of flight control systems elements and
determine a classification of the severity of the associated failure conditions;
(2) when a failure condition is classified as catastrophic, hazardous, or major, EASA normally only
accepts physical prevention means in the design of the elements to prevent an incorrect assembly.
If, exceptionally, the applicant considers that providing such design prevention means is
impractical, this should be presented to EASA. If agreed by EASA, the applicant may then use a
distinctive and permanent marking of the involved elements.
(3) failure conditions that are classified either as minor or with no safety effect are not considered to
have a significant safety effect.
Examples of significant safety effects:
(1) an out-of-phase action;
(2) reversal in the sense of the control;
(3) interconnection of the controls between two systems where this is not intended;
(4) loss of function.
7. EVALUATION OF FLIGHT CONTROL SYSTEM FAILURES CS 25.671(c)
Development errors (e.g. mistakes in requirements, design, or implementation) should be considered
when demonstrating compliance with CS 25.671(c). However, the guidance provided in this paragraph is
not intended to address the means of compliance related to development errors. Development errors are
managed through development assurance processes and system architecture. Some guidelines are
provided in AMC 25.1309.
CS 25.671(c) requires that the aeroplane be shown by analysis, test, or both, to be capable of continued
safe flight and landing following failures in the flight control system within the normal flight envelope.
CS 25.671(c)(1) requires the evaluation of any single failure, excluding the types of jams addressed in
subparagraph CS 25.671(c)(3). CS 25.671(c)(1) requires to consider any single failure, suggesting that an
alternative means of controlling the aeroplane or an alternative load path is provided in the case of a
single failure. All single failures must be considered, even if they are shown to be extremely improbable.
CS 25.671(c)(2) requires the evaluation of any combination of failures not shown to be extremely
improbable, excluding the types of jams addressed in CS 25.671(c)(3).

Annex to ED Decision 2023/021/R Page 377 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

Some combinations of failures, such as dual electrical system or dual hydraulic system failures, or any
single failure in combination with any probable electrical or hydraulic system failure, are normally not
demonstrated as being extremely improbable.
CS 25.671(c)(3) requires the evaluation of any failure or event that results in a jam of a flight control
surface or pilot control. This subparagraph addresses failure modes that would result in the surface or
pilot control being fixed in a position. It should be assumed that the fixed position is the position that is
commanded at the time of the failure due to some physical interference. The position at the time of the
jam should be at any control position normally encountered during take-off, climb, cruise, normal turn
manoeuvres, descent, approach, and landing. In some architectures, component jams within the system
may result in failure modes other than a fixed surface or pilot control; those types of jams (such as a
jammed valve) are considered under subparagraphs CS 25.671(c)(1) and (c)(2). All single jams must be
considered, even if they can be shown to be extremely improbable.
Alleviation means may be used to show compliance with CS 25.671(c)(3). For this purpose, alleviation
means include system reconfigurations or any other features that eliminate or reduce the consequences
of a jam or permit continued safe flight and landing.
Any runaway of a flight control to an adverse position must be accounted for, as per
CS 25.671(c)(1) and (c)(2), if such a runaway is due to:
a single failure; or
a combination of failures which are not shown to be extremely improbable.
Some means to alleviate the runaway may be used to demonstrate compliance, such as by reconfiguring
the control system, deactivating the system (or a failed portion of it), overriding the runaway by a
movement of the flight controls in the normal sense, eliminating the consequences of a runaway to ensure
continued safe flight and landing following a runaway. The consideration of a control runaway will be
specific to each application and a general interpretation of an adverse position cannot be provided. Where
applicable, the applicant is required to assess the resulting surface position after a runaway, if the failure
condition is not extremely improbable or can occur due to a single failure.
It is acknowledged that determining a consistent and reasonable definition of normally encountered flight
control positions can be difficult. Experience from in-service aeroplanes shows that the overall failure rate
for a flight control surface jam is of an order of magnitude between 10 -6 and 10-7 per flight hour. This

be used to support a probabilistic assessment. Considering this in-service aeroplane data, a reasonable
definition of normally encountered positions represents the range of flight control surface deflections
(from neutral to the largest deflection) expected to occur in 1 000 random operational flights, without
considering other failures, for each of the flight phases addressed in this AMC.
One method of establishing acceptable flight control surface deflections is to use the performance-based
criteria outlined in this AMC (see sub-paragraph 7.b. below) that were established to eliminate any
differences between aeroplane types. The performance-based criteria prescribe environmental and
operational manoeuvre conditions, and the resulting deflections may be considered as normally
encountered positions for demonstrating compliance with CS 25.671(c)(3).
All approved aeroplane gross weights and centre-of-gravity locations should be considered. However, only
critical combinations of gross weight and centre-of-gravity locations should be demonstrated.
a. Compliance with CS 25.671(c)(2)

Annex to ED Decision 2023/021/R Page 378 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

When demonstrating compliance with the failure requirements of CS 25.671(c)(2), the following
safety analysis/assessment should be considered.
A safety analysis/assessment according to AMC 25.1309 should be supplemented to demonstrate
that the aeroplane is capable of continued safe flight and landing following any combination of
failures not shown to be extremely improbable.
The aeroelastic stability (flutter) requirements of CS 25.629 should also be considered.
b. Determination of Flight Control System Jam Positions CS 25.671(c)(3)
The following flight phases should be co - -

DEFINITIONS of this AMC).

CS 25.671(c)(3) requires that the aeroplane be capable of landing with a flight control or pilot
control jam. The aeroplane should, therefore, be evaluated for jams in the landing configuration.
Only the aeroplane rigid body modes need to be considered when evaluating the aeroplane
response to manoeuvres and continued safe flight and landing.
It should be assumed that, if the jam is detected prior to V1, the take-off will be rejected.
Although 1 in 1 000 operational take-offs is expected to include crosswinds of 46 km/h (25 kt) or
greater, the short exposure time associated with a flight control surface jam occurring between V 1
and VLOF allows usage of a less conservative crosswind magnitude when determining normally
encountered lateral and directional control positions. Given that lateral and directional flight
controls are continuously used to maintain runway centre line in a crosswind take-off, and that
flight control inputs greater than those necessary at V1 occur at speeds below V1, any jam in these
flight control axes during a crosswind take-off is normally detected prior to V1. Considering the flight
control jam failure rate combined with the short exposure time between V1 and VLOF, a reasonable
crosswind level for the determination of jammed lateral or directional flight control positions during
take-off is 28 km/h (15 kt).
A similar reasoning applies for the approach and landing flight phases. It leads to consider that a
reasonable crosswind level for the determination of jammed lateral or directional control positions
during approach and landing is 28 km/h (15 kt).
The jam positions to be considered in demonstrating compliance should include any position up to
the maximum position determined by the following manoeuvres. The manoeuvres and conditions
described in this paragraph should only be used to determine the flight control surface and pilot
control deflections to evaluate the continued safe flight and landing capability, and should not be
used for the evaluation of flight test manoeuvres; see paragraph 7.e below.
(1) Jammed Lateral Control Positions
(i) Take-off: The lateral flight control position for wings level at V1 in a steady crosswind
of 28 km/h (15 kt) (at a height of 10 m (35 ft) above the take-off surface). Variations in
wind speed from a 10-m (35-ft) height can be obtained using the following
relationship:
Valt = V10metres * (Hdesired/10.0)1/7
where:

Annex to ED Decision 2023/021/R Page 379 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

V10metres = wind speed in knots at 10 m (35 ft) above ground level (AGL)
Valt = wind speed at desired altitude (kt)
Hdesired = desired altitude for which wind speed is sought (AGL), but not lower than
1.5 m (5 ft)
(ii) In-flight: The lateral flight control position to sustain a 12-degree/second steady roll
rate from 1.23VSR1 to VMO/MMO or VFE, as appropriate, but not greater than 50 % of the
control input.
(iii) Landing (including flare): The maximum lateral control position is the greater of:
(A) the peak lateral control position to maintain wings level in response to a steady
crosswind of 28 km/h (15 kt), in manual or autopilot mode; or
(B) the peak lateral control position to maintain wings level in response to an
atmospheric discrete lateral gust of 16 km/h (15 ft/s) from sea level to
6 096 m (20 000 ft).
the maximum
surface deflection to achieve the above manoeuvres should be considered.
(2) Jammed Longitudinal Control Positions
(i) Take-off: The following three longitudinal flight control positions should be
considered:
(A) Any flight control position from that which the flight controls naturally assume
without pilot input at the start of the take-off roll to that which occurs at V1 using
the procedures recommended by the aeroplane manufacturer.
Note: It may not be necessary to consider this case if it can be demonstrated
that the pilot is aware of the jam before reaching V1 (for example, through a
edure).
(B) The longitudinal flight control position at V1 based on the procedures
recommended by the aeroplane manufacturer including the consideration for
any runway condition for which the aeroplane is approved to operate.
(C) Using the procedures recommended by the aeroplane manufacturer, the peak
longitudinal flight control position to achieve a steady aeroplane pitch rate of
the lesser of 5°/s or the pitch rate necessary to achieve the speed used for all-
engines-operating initial climb procedures (V2+XX) at 35 ft.
(ii) In-flight: The maximum longitudinal flight control position is the greater of:
(A) the longitudinal flight control position required to achieve steady state normal
accelerations from 0.8 to 1.3 g at speeds from 1.23VSR1 to VMO/MMO or VFE, as
appropriate;
(B) the peak longitudinal flight control position commanded by the autopilot and/or
stability augmentation system in response to atmospheric discrete vertical gust
of
16 km/h (15 ft/s) from sea level to 6 096 m (20 000 ft).

Annex to ED Decision 2023/021/R Page 380 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(iii) Landing: Any longitudinal control position required, in manual or autopilot mode, for
performing a flare and landing, using the procedures recommended by the aeroplane
manufacturer.
(3) Jammed Directional Control Positions
(i) Take-off: The directional flight control position for take-off at V1 in a steady crosswind
of 28 km/h (15 kt) (at a height of 10 m (35 ft) above the take-off surface). Variations in
wind speed from a height of 10 m (35 ft) can be obtained using the following
relationship:
Valt = V10metres * (Hdesired/10.0)1/7
where:
V10metres = wind speed in knots at 10 m above ground level (AGL)
Valt = wind speed at desired altitude
Hdesired = desired altitude for which wind speed is sought (AGL), but not lower than 1.5
m (5 ft)
(ii) In-flight: The directional flight control position is the greater of:
(A) the peak directional flight control position commanded by the autopilot and/or
stability augmentation system in response to atmospheric discrete lateral gust
of 16 km/h (15 ft/s) from sea level to 6 096 m (20 000 ft);
(B) maximum rudder angle required for lateral/directional trim from 1.23VSR1 to the
maximum all-engines-operating airspeed in level flight with climb power, but
not to exceed VMO/MMO or VFE as appropriate. While more commonly a
characteristic of propeller aeroplane, this addresses any lateral/directional
asymmetry that can occur in flight with symmetric power; or
(C) for approach, the peak directional control position commanded by the pilot,
autopilot and/or stability augmentation system in response to a steady
crosswind of 28 km/h (15 kt).
(iii) Landing: The maximum directional control position is the greater of:
(A) the peak directional control position commanded by the pilot, autopilot and/or
stability augmentation system in response to a steady crosswind of 28 km/h
(15 kt); or
(B) the peak lateral control position to maintain wings level in response to an
atmospheric discrete lateral gust of 16 km/h (15 ft/s) from sea level to 6 096 m
(20 000 ft).
(4) Control Tabs, Trim Tabs, and Trimming Stabilisers
Any tabs installed on flight control surfaces are assumed jammed in the position that is
associated with the normal deflection of the flight control surface on which they are installed.
Trim tabs and trimming stabilisers are assumed jammed in the positions that are associated
with the procedures recommended by the aeroplane manufacturer for take-off and that are

Annex to ED Decision 2023/021/R Page 381 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

normally used throughout the flight to trim the aeroplane from 1.23VSR1 to VMO/MMO or VFE,
as appropriate.
(5) Speed Brakes
Speed brakes are assumed jammed in any position for which they are approved to operate
during flight at any speed from 1.23VSR1 to VMO/MMO or VFE, as appropriate. Asymmetric
extension and retraction of the speed brakes should be considered. Roll spoiler jam
(asymmetric spoiler panel) is addressed in paragraph 7.b(1).
(6) High-Lift Devices
Leading edge and trailing edge high-lift devices are assumed to jam in any position for take-
off, climb, cruise, approach, and landing. Skew of high-lift devices or asymmetric extension
and retraction should be considered. CS 25.701 requires a mechanical interconnection (or
equivalent means) between flaps or slats, unless the aeroplane has safe flight characteristics
with the asymmetric flaps or slats positions.
(7) Load Alleviation Systems
(i) Gust Load Alleviation Systems: At any airspeed between 1.23VSR1 to VMO/MMO or VFE,
as appropriate, the flight control surfaces are assumed to jam in the maximum position
commanded by the gust load alleviation system in response to an atmospheric discrete
gust with the following reference velocities:
(A) 16 km/h (15 ft/s) equivalent airspeed (EAS) from sea level to 6 096 m (20 000 ft)
(vertical gust);
(B) 16 km/h (15 ft/s) EAS from sea level to 6 096 m (20 000 ft) (lateral gust).
(ii) Manoeuvre Load Alleviation Systems: At any airspeed between 1.23V SR1 to VMO/MMO
or VFE, as appropriate, the flight control surfaces are assumed to jam in the maximum
position commanded by the manoeuvre load alleviation system during a pull-up
manoeuvre to 1.3 g or a push-over manoeuvre to 0.8 g.
c. Considerations for jams just before landing CS 25.671(c)(3)(i) and (ii)
CS 25.671(c)(3)(ii) requires that failures (leading to a jam) must be assumed to occur anywhere
within the normal flight envelope and during any flight phase from take-off to landing. This includes
the flight phase just before landing and the landing itself. For the determination of the jam position
per CS 25.671(c)(3)(i) and the assessment of continued safe flight and landing, guidance is provided
in this AMC. However, there might be exceptional cases where it is not possible to demonstrate
continued safe flight and landing. Even jam alleviation means (e.g., disconnection units) might not
be efficient because of the necessary time for the transfer of pilot controls.
For these exceptional cases, the compliance to CS 25.671(c)(3)(ii) may be shown by demonstrating
that the occurrence of a jam just before landing is extremely improbable.
Therefore, the overall compliance to CS 25.671(c)(3)(ii) for the flight phase just before landing may
be performed as follows:
(1) Demonstrate continued safe flight and landing after a jam has occurred just before landing.
Note: The assessment of continued safe flight and landing in paragraph 7.e. below also applies to
jams occurring just before landing;

Annex to ED Decision 2023/021/R Page 382 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(2) If continued safe flight and landing cannot be demonstrated, perform a qualitative
assessment of the design, relative to jam prevention features and jam alleviation means, to
show that all practical precautions have been taken; or
(3) As a last resort, after agreement by EASA, use data from in-service aeroplanes to support an
extremely improbable argument (without use of at-risk time).
The typical means of jam prevention/alleviation include low-friction materials, dual-rotation
bearings, clearances, jack catchers, priority switch on sidestick.
d. Jam Combinations Failures CS 25.671(c)(3)
CS
25.671(c)(3) should include an analysis that shows that a minimum level of safety exists when a jam
occurs. This additional analysis must show that in the presence of a jam considered under CS
25.671(c)(3), the failure conditions that could prevent continued safe flight and landing have a
combined probability of 1/1 000 or less.
As a minimum, this analysis should include elements such as a jam breakout or override,
disconnection means, alternate flight surface control, alternate electrical or hydraulic sources, or
alternate cable paths. This analysis should help to determine the intervals for scheduled
maintenance activity or the operational checks that ensure the availability of the alleviation or
compensation means.
e. Assessment of Continued Safe Flight and Landing CS 25.671(c)
Following a flight control system failure of the types discussed in paragraphs 7.a., 7.b., 7.c. and 7.d.
of this AMC, the manoeuvrability and structural strength criteria defined in the following
paragraphs should be considered to determine the capability of continued safe flight and landing
of the aeroplane. Additionally, a pilot assessment of the aeroplane handling qualities should be
performed, although this does not supersede the criteria provided below.
A local structural failure (e.g. via a mechanical fuse or shear-out) that could lead to a surface
departure from the aeroplane should not be used as a means of jam alleviation.
(1) Flight Characteristics
(i) General. Following a flight control system failure, appropriate procedures may be used
including system reconfiguration, flight limitations, and flight crew resource
management. The procedures for safe flight and landing should not require
exceptional piloting skills or strengths.
Additional means of control, such as a trim system, may be used if it can be shown that
the system is available and effective. Credit should not be given to the use of
differential engine thrust to manoeuvre the aeroplane. However, differential thrust
may be used after the recovery in order to maintain lateral/directional trim.
For the cases of longitudinal flight control surface and pilot control jams during take-
off prior to rotation, it is necessary to show that the aeroplane can be safely rotated
for lift-off without consideration of field length available.
(ii) Transient Response. There should be no unsafe conditions during the transient
condition following a flight control system failure. The evaluation of failures or

Annex to ED Decision 2023/021/R Page 383 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

manoeuvres that lead to a jam is intended to be initiated from 1-g wings level flight
conditions. For this purpose, continued safe flight and landing (within the transition
phase) is generally defined as not exceeding any one of the following criteria:
(A) a load on any part of the primary structure sufficient to cause a catastrophic
structural failure;
(B) catastrophic loss of flight path control;
(C) exceedance of VDF/MDF;
(D) catastrophic flutter;
(E) excessive vibration or excessive buffeting conditions;
(F) bank angle in excess of 90 degrees.
In connection with the transient response, compliance with the requirements of
CS 25.302 should be demonstrated. While VF is normally an appropriate airspeed limit
to be considered regarding continued safe flight and landing, temporary exceedance
of VF may be acceptable as long as the requirements of CS 25.302 are met.
Paragraph 7.b. of this AMC provides a means to determine flight control surface
deflections for the evaluation of flight control jams. In some cases, aeroplane roll, pitch
rate, or normal acceleration is used as a basis to determine these deflections. The roll
or pitch rate and/or normal acceleration that is used to determine the flight control
surface deflection need not be included in the evaluation of the transient condition.
For example, the in-flight lateral flight control position determined in paragraph
7.b.(1)(ii) is based on a steady roll rate of 12°/s. When evaluating this condition, either
by analysis, simulation, or in-flight demonstration, the resulting flight control surface
deflection is simply input while the aeroplane is in wings level flight, at the appropriate
speed, altitude, etc. During this evaluation, the actual roll or pitch rate of the aeroplane
may or may not be the same as the roll or pitch rate used to determine the jammed
flight control surface position.
(iii) Delay Times. Due consideration should be given to the delays involved in pilot
recognition, reaction, and operation of any disconnection systems, if applicable.
Delay = Recognition + Reaction + Operation of Disconnection
Recognition is defined as the time from the failure condition to the point at which a
pilot in service operation may be expected to recognise the need to take action.
Recognition of the malfunction may be through the behaviour of the aeroplane or a
reliable failure warning system, and the recognition point should be identified but
should not normally be less than
1 second. For flight control system failures, except the types of jams addressed in CS
25.671(c)(3), control column or wheel movements alone should not be used for
recognition.
The following reaction times should be used:

Annex to ED Decision 2023/021/R Page 384 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

Flight condition Reaction time

On ground 1 second*

In air (< 300 m (1 000 ft) above ground level 1 second*

(AGL))

Manual flight (> 300 m (1 000 ft) AGL) 1 second*

Automatic flight (> 300 m (1 000 ft) AGL) 3 seconds

*
3 seconds if the control must be transferred between the pilots.
The time required to operate any disconnection system should be measured either
through ground test or flight test. This value should be used during all analysis efforts.
However, flight test or manned simulation that requires the pilot to operate the
disconnection includes this extra time, therefore, no additional delay time would be
needed for these demonstrations.
(iv) Manoeuvre Capability for Continued Safe Flight and Landing. If, using the procedures
recommended by the aeroplane manufacturer, the following manoeuvres can be
performed following the failure, it will generally be considered that continued safe
flight and landing has been shown:
(A) A steady 30° banked turn to the left or right;
(B) A roll from a steady 30° banked turn through an angle of 60° so as to reverse the
direction of the turn in not more than 11 seconds (in this manoeuvre, the rudder
may be used to the extent necessary to minimise side-slip, and the manoeuvre
may be unchecked);
(C) A push-over manoeuvre to 0.8 g, and a pull-up manoeuvre to 1.3 g;
(D) A wings level landing flare in a 90° crosswind of up to 18.5 km/h (10 kt)
(measured at 10 m (33 ft) above the ground); and
(E) The aeroplane remains on the paved runway surface during the landing roll, until
reaching a complete stop.
Note: In the case of a lateral or directional flight control system jam during take-off as
described in paragraph 7.b(1) or 7.b(3) of this AMC, it should be shown that the
aeroplane can safely land on a suitable runway, without crosswind and with crosswind
in the same direction as during take-off and at speeds up to the value at which the jam
was established.
(v) Control Forces. The short- and long-term control forces should not be greater than
1.5 times the short- and long-term control forces allowed by CS 25.143(d) or CS
25.143(k) as applicable.
Short-term forces have typically been interpreted to mean the time required to
accomplish a configuration or trim change. However, taking into account the capability
of the crew to share the workload, the short-term forces provided in CS 25.143(d) or
CS 25.143(k), as applicable, may be appropriate for a longer duration, such as the
evaluation of a jam on take-off and return to landing.

Annex to ED Decision 2023/021/R Page 385 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

During the recovery following the failure, transient control forces may exceed these
criteria to a limited extent. Acceptability of any exceedance will be evaluated on a case-
by-case basis.
(2) Structural Strength for Flight Control System Failures.
(i) Failure Conditions per CS 25.671(c)(1) and (c)(2). It should be shown that the aeroplane
maintains structural integrity for continued safe flight and landing. This should be
accomplished by demonstrating compliance with CS 25.302, where applicable, unless
otherwise agreed with EASA.
(ii) Jam Conditions per CS 25.671(c)(3). It should be shown that the aeroplane maintains
structural integrity for continued safe flight and landing. Recognising that jams are
infrequent occurrences and that margins have been taken in the definition of normally
encountered positions in this AMC, an acceptable means of compliance for structural
substantiation of jam conditions is provided below in paragraph 7.e.(2)(iii).
(iii) Structural Substantiation. The loads considered as ultimate should be derived from the
following conditions at speeds up to the maximum speed allowed for the jammed
position or for the failure condition:
(A) Balanced manoeuvre of the aeroplane between 0.25 and 1.75 g with high-lift
devices fully retracted and in en-route configurations, and between 0.6 and
1.4 g with high-lift devices extended;
(B) Vertical and lateral discrete gusts corresponding to 40 % of the limit gust velocity
specified at Vc in CS 25.341(a) with high-lift devices fully retracted, and a 5.2-m/s
(17-ft/s) vertical and a 5.2-m/s (17-ft/s) head-on gust with high-lift devices
extended. The vertical and lateral gusts should be considered separately.
A flexible aeroplane model should be used for load calculations, where the use of a
flexible aeroplane model is significant for the loads being assessed.
8. EVALUATION OF ALL-ENGINES-FAILED CONDITION CS 25.671(d)
a. Explanation.
The intent of CS 25.671(d) is to assure that in the event of failure of all engines, the aeroplane will
be controllable, an approach and a flare to a landing and to a ditching is possible, and, assuming
that a suitable runway is available, the aeroplane is controllable on ground and can be stopped.
In this context:

-surface runway or equivalent for which the distance available

following touchdown is consistent with the available aeroplane ground deceleration
capability.

it is recognised that, with all engines inoperative, it may not be possible to reach a suitable runway
or landing surface. In this case, the aeroplane must still be able to make a flare to a landing attitude.
Compliance with CS 25.671(d) effectively requires that the aeroplane is equipped with a source(s)
of emergency power, such as an air-driven generator, windmilling engines, batteries, or other

Annex to ED Decision 2023/021/R Page 386 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

power source, capable of providing adequate power to the systems that are necessary to control
the aeroplane.
Analysis, simulation, or a combination of analysis and simulation may be used to demonstrate
compliance where the methods are shown to be reliable.
b. Procedures.
(1) The aeroplane should be evaluated to determine that it is possible, without requiring
exceptional piloting skill or strength, to maintain control following the failure of all engines
and attain the parameters provided in the operational procedure of the aeroplane flight
manual (AFM), taking into account the time necessary to activate any backup systems. The
aeroplane should also remain controllable during restart of the most critical engine, whilst
following the AFM recommended engine restart procedures.
(2) The most critical flight phases, especially for aeroplanes with emergency power systems
dependent on airspeed, are likely to be the take-off, the landing, and the ditching. Credit may
be taken from the hydraulic pressure and/or the electrical power produced while the engines
are spinning down and from any residual hydraulic pressure remaining in the system.
Sufficient power must be available to complete a wings level approach and flare to a landing,
and flare to a ditching.
Analyses or tests may be used to demonstrate the capability of the control systems to
maintain adequate hydraulic pressure and/or electrical power during the time between the
failure of the engines and the activation of any power backup systems. If any of the power
backup systems rely on aerodynamic means to generate the power, then a flight test should
be conducted to demonstrate that the power backup system can supply adequate electrical
and/or hydraulic power to the control systems. The flight test should be conducted at the
minimum practical airspeed required to perform an approach and flare to a safe landing and
ditching attitude.
(3) The manoeuvre capability following the failure of all engines should be sufficient to complete
an approach and flare to a landing, and flare to a ditching. Note that the aeroplane weight
could be extremely low (e.g. the engine failures could be due to fuel exhaustion). The
maximum speeds for approach and landing/ditching may be limited by other CS-25
specifications (e.g. tyre speeds, flap or landing gear speeds, etc.) or by an evaluation of the
average pilot ability to conduct a safe landing/ditching. At an operational weight determined
for this case and for any other critical weights and positions of the centre of gravity identified
by the applicant, at speeds down to the approach speeds appropriate to the aeroplane
configuration, if the following manoeuvres can be performed, it will generally be considered
that compliance has been shown:
(i) a steady 30° banked turn to the left or right;
(ii) a roll from a steady 30° banked turn through an angle of 60° so as to reverse the
direction of the turn in not more than 11 s (in this manoeuvre, the rudder may be used
to the extent necessary to minimise side-slip, and the manoeuvre may be unchecked);
(iii) a push-over manoeuvre to 0.8 g, and a pull-up manoeuvre to 1.3 g;
(iv) a wings level landing flare in a 90° crosswind of up to 18.5 km/h (10 kt) (measured at
10 m (33 ft) above the ground).

Annex to ED Decision 2023/021/R Page 387 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

Note: If the loss of all engines has no effect on the flight control authority of the aeroplane,
then the results of the flight tests of the basic handling qualities with all engines operating
may be used to demonstrate the satisfactory handling qualities of the aeroplane with all
engines failed.
(4) It should be possible to perform a flare to a safe landing and ditching attitude, in the most
critical configuration, from a stabilised approach using the recommended approach speeds,
pitch angles, and the appropriate AFM procedures, without requiring exceptional piloting
skills or strengths. For transient manoeuvres, forces are allowed up to 1.5 times those
specified in CS 25.143(d) or CS 25.143(k) as applicable for temporary application with two
hands available for control.
Similarly to paragraph 7.e.(1)(v) of this AMC, the acceptability of any exceedance will be
evaluated on a case-by-case basis.
(5) Finally, assuming that a suitable runway is available, it should be possible to control the
aeroplane until it comes to a complete stop on the runway. A means of positive deceleration
should be provided.
A suitable runway should have the lateral dimensions, length and load-bearing capability that
meets the requirements defined in the emergency procedures of the AFM.
It is not necessary to consider adverse environmental conditions (e.g. wet or contaminated
runway, tailwind) when demonstrating compliance for the on-ground phase.
9. EVALUATION OF CONTROL AUTHORITY AWARENESS CS 25.671(e)
CS 25.671(e) requires an indication to the flight crew when a flight condition exists in which near-full-
flight-control authority (whether or not it is pilot-commanded) is being used. Suitability of such an
annunciation should take into account that some pilot-commanded manoeuvres (e.g. rapid roll) are
necessarily associated with intended full performance, which may saturate the surface. Therefore, simple
alerting systems, which should function in both intended and unexpected flight control-limiting situations,
should be properly balanced between needed crew awareness and nuisance alerting. Nuisance alerting
must be minimised per CS 25.1322 by correct setting of the alerting threshold.
Depending on the application, suitable indications may include cockpit flight control position, annunciator
light, or surface position indicators. Furthermore, this requirement applies to the limits of flight control
authority, not necessarily to the limits of any individual surface travel.
When the aeroplane is equipped with an unpowered manual flight control system, the pilot may be
de facto aware of the limit of control authority. In this case, no other means of indication may be required.
10. EVALUATION OF FLIGHT CONTROL SYSTEM MODES OF OPERATION CS 25.671(f)
Some flight control systems, for instance, electronic flight control systems, may have multiple modes of
operation not restricted to being either on or off. The applicant should evaluate the different modes of
operation and the transition between them in order to establish if they are intuitive or not.
If these modes, or the transition between them, are not intuitive, an alert to the flight crew may be
required. Any alert must comply with CS 25.1322. This includes the indication to the flight crew of the loss
of protections.
11. DEMONSTRATION OF ACCEPTABLE MEANS OF COMPLIANCE

Annex to ED Decision 2023/021/R Page 388 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

It is recognised that it may be neither practical nor appropriate to demonstrate compliance by flight test
for all of the failure conditions noted herein. Compliance may be demonstrated by analysis, simulation, a
piloted engineering simulator, flight test, or a combination of these methods, as agreed with EASA.
Simulation methods should include an accurate representation of the aeroplane characteristics and of the
pilot response, including time delays as specified in paragraph 7.e(1)(iii) of this AMC.
Compliance with CS 25.671 may result in AFM non-normal and emergency procedures. Verification of
these procedures may be accomplished in flight, or, with the agreement of EASA, using a piloted simulator.
a. Acceptable Use of Simulations. It is generally difficult to define the types of simulations that might
be acceptable in lieu of flight test without identifying specific conditions or issues. However, the
following general principles can be used as guidance for making this kind of decision:
(1) In general, flight test is the preferred method to demonstrate compliance;
(2) Simulation may be an acceptable alternative to flight test, especially when:
(i) a flight test would be too risky even after attempts to mitigate these risks (e.g.
-offs/landings at high altitude);
(ii) the required environmental conditions, or the representation of the failure conditions,
are too difficult to attain (e.g. wind shear, high crosswinds, system failure
configurations);
(iii) the simulation is used to augment a reasonably broad flight test programme;
(iv) the simulation is used to demonstrate repeatability.
b. Simulation Requirements. In order to be acceptable for use in demonstrating compliance with the
requirements for performance and handling qualities, a simulation method should:
(1) be suitably validated by flight test data for the conditions of interest; furthermore,:
(i) this does not mean that there must be flight test data at the exact conditions of
interest; the reason why a simulation method is being used may be that it is too
difficult or risky to obtain flight test data at the conditions of interest;
(ii) the level of substantiation of the simulator to flight correlation should be
commensurate with the level of compliance (i.e. unless it is determined that the
simulation is conservative, the closer the case is to being non-compliant, the higher
the required quality of the simulation);
(2) be conducted in a manner appropriate to the case and conditions of interest:
(i) if closed-loop responses are important, the simulation should be piloted by a human
pilot;
(ii) for piloted simulations, the controls/displays/cues should be substantially equivalent
to what would be available in the real aeroplane (unless it is determined that not doing
so would provide added conservatism).
12. SPECIFICITIES OF AEROPLANES WITH FLY-BY-WIRE FLIGHT CONTROL SYSTEMS
a. Control Signal Integrity.

Annex to ED Decision 2023/021/R Page 389 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

If the aeroplane is equipped with a conventional flight control system, the transmission of
command signals to the primary and secondary flight control surfaces is made through conventional
mechanical and hydromechanical means.
The determination of the origin of perturbations to command transmissions is relatively
straightforward since failure cases can usually be classified in a limited number of categories that
include maintenance error, jamming, disconnection, runaway, failure of mechanical element, or
structural failure of hydraulic components. Therefore, it is almost always possible to identify the
most severe failure cases that would serve as an envelope to all other cases that have the same
consequences.
However, when the aeroplane is equipped with flight control systems using the fly-by-wire
technology, incorporating digital devices and software, experience from electronic digital
transmission lines shows that the perturbation of signals from internal and external sources is not
unlikely.
The perturbations are described as signals that result from any condition that is able to modify the
command signal from its intended characteristics. They can be classified in two categories:
(1) Internal causes that could modify the command and control signals include, but are not
limited to:
loss of data bits, frozen or erroneous values;
unwanted transients;
computer capacity saturation;
processing of signals by asynchronous microprocessors;
adverse effects caused by transport lag;
poor resolution of digital signals;
sensor noise;
corrupted sensor signals;
aliasing effects;
inappropriate sensor monitoring thresholds;
structural interactions (such as control surface compliance or coupling of structural
modes with control modes) that may adversely affect the system operation.
(2) External causes that could modify the command and control signals include but are not
limited to:
high-intensity radiated fields (HIRF);
lightning;

electrical power and power switching transients, smaller signals if they can affect flight
control, transients due to electrical failures.)

Annex to ED Decision 2023/021/R Page 390 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

Spurious signals and/or false data that are a consequence of perturbations in either of the two
above categories may result in malfunctions that produce unacceptable system responses
equivalent to those of conventional systems such as limit cycle/oscillatory failures,
runaway/hardover conditions, disconnection, lockups and false indication/warning that
consequently present a flight hazard. It is imperative that the command signals remain continuous
and free from internal and external perturbations and common-cause failures. Therefore, special
design measures should be employed to maintain system integrity at a level of safety at least
equivalent to that which is achieved with traditional hydromechanical designs. These special design
measures can be monitored through the system safety assessment (SSA) process, provided specific
care is directed to development methods and on quantitative and qualitative demonstrations of
compliance.
The following should be considered when evaluating compliance with CS 25.671(c)(2):
(1) The flight control system should continue to provide its intended function, regardless of any
malfunction from sources in the integrated systems environment of the aeroplane.
(2) Any malfunctioning system in the aerodynamic loop should not produce an unsafe level of
uncommanded motion and should automatically recover its ability to perform critical
functions upon removal of the effects of that malfunction.
(3) Systems in the aerodynamic loop should not be adversely affected during and/or after
exposure to any sources of a malfunction.
(4) Any disruption to an individual unit or component as a consequence of a malfunction, and
which requires annunciation and flight crew action, should be identified to and agreed by
EASA to assure that:
a) the failure can be recognised by the flight crew, and
b) the flight crew action can be expected to result in continued safe flight and landing.
(5) An automatic change from a normal to a degraded mode that is caused by spurious signal(s)
or malfunction(s) should meet the probability guidelines associated with the hazard
assessment established in AMC 25.1309
-5
per flight hour).
(6) Exposure to a spurious signal or malfunction should not result in a hazard with a probability
greater than that allowed by the criteria of AMC 25.1309. The impact on handling qualities
should be evaluated.
The complexity and criticality of the fly-by-wire flight control system necessitates the additional
laboratory testing beyond that required as part of individual equipment validation and software
verification.
It should be shown that either the fly-by-wire flight control system signals cannot be altered
unintentionally, or that altered signal characteristics would meet the following criteria:
(1) Stable gain and phase margins are maintained for all control surface closed-loop systems.
Pilot control inputs (pilot in the loop) are excluded from this requirement;

Annex to ED Decision 2023/021/R Page 391 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(2) Sufficient pitch, roll, and yaw control power is available to provide control for continued safe
flight and landing, considering all the fly-by-wire flight control system signal malfunctions
that are not extremely improbable; and
(3) The effect of spurious signals on the systems that are included in the aerodynamic loop
should not result in unacceptable transients or degradation of the performance of the
aeroplane. Specifically, in case of signals that would cause a significant uncommanded
motion of a control surface actuator, either the signal should be readily detected and
deactivated or the surface motion should be arrested by other means in a satisfactory
manner. Small amplitude residual system oscillations may be acceptable.
It should be demonstrated that the output from the control surface closed-loop system does not
result in uncommanded, sustained oscillations of flight control surfaces. The effects of minor
instabilities may be acceptable, provided that they are thoroughly investigated, documented, and
understood. An example of an acceptable condition would be one where a computer input is
perturbed by spurious signals, but the output signal remains within the design tolerances, and the
system is able to continue to operate in its selected mode of operation and is not affected by this
perturbation.
When demonstrating compliance with CS 25.671(c), these system characteristics should be
demonstrated using the following means:
(1) Systematic laboratory validation that includes a realistic representation of all relevant
interfacing systems, and associated software, including the control system components that
are part of the pitch, roll, and yaw axis control. Closed-loop aeroplane simulation/testing is
necessary in this laboratory validation;
(2) Laboratory or aeroplane testing to demonstrate unwanted coupling of electronic command
signals and their effects on the mechanical actuators and interfacing structure over the
spectrum of operating frequencies; and
(3) Analysis or inspection to substantiate that physical or mechanical separation and segregation
of equipment or components are utilised to minimise any potential hazards.
A successful demonstration of signal integrity should include all the elements that contribute to the
that actuates the aerodynamic

for example: digital or analogue flight control computers, power control

units, control feedback, major data busses, and the sensor signals including: air data, acceleration,
rate gyros, commands to the surface position, and respective power supply sources. Autopilot
systems (including feedback functions) should be included in this demonstration if they are
integrated with the fly-by-wire flight control system.
b. Formalisation of Compliance Demonstration for Electronic Flight Control Laws.
On fly-by-wire aeroplanes, flight controls are typically implemented according to complex control
laws and logics.
The handling qualities certification tests, usually performed on conventional aeroplanes to
demonstrate compliance with CS-25 Subpart B specifications, are not considered to be sufficient to

Annex to ED Decision 2023/021/R Page 392 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

demonstrate the behaviour of the flight control laws in all foreseeable situations that may be
encountered in service.
In order to demonstrate compliance with an adequate level of formalisation, the following should
be performed and captured within certification documents:
Determination of the flight control characteristics that require detailed and specific test
strategy; and
Substantiation of the proposed validation strategy (flight tests, simulator tests, analyses,
etc.) covering the characteristics and features determined above.
In particular, the following characteristics of flight control laws should be covered:
discontinuities;
robustness versus piloted manoeuvres and/or adverse weather conditions;
protection priorities (entry/exit logic conditions not symmetrical);
control law mode changes with and without failures; and
determination of critical scenarios for multiple failures.
The validation strategy should include, but should not be limited to, operational scenarios. The
determination that an adequate level of formalisation of validation strategy has been achieved
should be based on engineering judgement.
[Amdt No: 25/24]
[Amdt No: 25/27]

CS 25.672 Stability augmentation and automatic and power-operated

systems
If the functioning of stability augmentation or other automatic or power-operated systems is necessary
to show compliance with the flight characteristics requirements of this CS-25, such systems must comply
with CS 25.671 and the following:
(a) A warning, which is clearly distinguishable to the pilot under expected flight conditions without
requiring his attention, must be provided for any failure in the stability augmentation system or in
any other automatic or power-operated system, which could result in an unsafe condition if the
pilot were not aware of the failure. Warning systems must not activate the control systems.
(b) The design of the stability augmentation system or of any other automatic or power-operated
system must permit initial counteraction of failures of the type specified in CS 25.671(c) without
requiring exceptional pilot skill or strength, by either the deactivation of the system, or a failed
portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.
(c) It must be shown that after any single failure of the stability augmentation system or any other
automatic or power-operated system:
(1) The aeroplane is safely controllable when the failure or malfunction occurs at any speed or
altitude within the approved operating limitations that is critical for the type of failure being
considered.

Annex to ED Decision 2023/021/R Page 393 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(2) The controllability and manoeuvrability requirements of this CS-25 are met within a practical
operational flight envelope (for example, speed, altitude, normal acceleration, and aeroplane
configurations) which is described in the Aeroplane Flight Manual; and
(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit
continued safe flight and landing.
[Amdt 25/18]
[Amdt 25/24]

CS 25.675 Stops
(a) Each control system must have stops that positively limit the range of motion of each movable
aerodynamic surface controlled by the system.
(b) Each stop must be located so that wear, slackness, or take-up adjustments will not adversely affect
the control characteristics of the aeroplane because of a change in the range of surface travel.
(c) Each stop must be able to withstand any loads corresponding to the design conditions for the
control system.

CS 25.677 Trim systems

(a) Trim controls must be designed to prevent inadvertent or abrupt operation and to operate in the
plane, and the sense of motion, of the aeroplane.
(b) There must be means adjacent to the trim control to indicate the direction of the control movement
relative to the aeroplane motion. In addition, there must be clearly visible means to indicate the
position of the trim device with respect to the range of adjustment. The indicator must be clearly
marked with the range within which it has been demonstrated that take-off is safe for all centre of
gravity positions approved for take-off.
(c) Trim control systems must be designed to prevent creeping in flight. Trim tab controls must be
irreversible unless the tab is appropriately balanced and shown to be free from flutter.
(d) If an irreversible tab control system is used, the part from the tab to the attachment of the
irreversible unit to the aeroplane structure must consist of a rigid connection.

CS 25.679 Control system gust locks

(See AMC 25.679)
(a) There must be a device to prevent damage to the control surfaces (including tabs), and to the
control system, from gusts striking the aeroplane while it is on the ground. If the device, when
engaged, prevents normal operation of the control surfaces by the pilot, it must
(1) Automatically disengage when the pilot operates the primary flight controls in a normal
manner; or
(2) Limit the operation of the aeroplane so that the pilot receives unmistakable warning at the
start of take-off. (See AMC 25.679(a)(2).)

Annex to ED Decision 2023/021/R Page 394 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(b) The device must have means to preclude the possibility of it becoming inadvertently engaged in
flight. (See AMC 25.679(b).)
[Amdt 25/18]

AMC 25.679(a)(2) Control system gust locks

If the device required by CS 25.679(a) limits the operation of the aeroplane by restricting the movement
of a control that must be set before take-off (e.g. throttle control levers), this device should be such that
it will perform the function for which it is designed even when subject to likely maladjustment or wear,
so that
a. The movement of that control is restricted as long as the device is engaged; and
b. The movement of that control is unrestricted when the device is disengaged.

AMC 25.679(b) Control system gust locks

For the purposes of meeting the design intent of this paragraph, flight means the time from the moment
the aircraft first moves under its own power for the purpose of flight until the moment it comes to rest
after landing.

CS 25.681 Limit load static tests

(a) Compliance with the limit load requirements of this CS-25 must be shown by tests in which
(1) The direction of the test loads produces the most severe loading in the control system; and
(2) Each fitting, pulley, and bracket used in attaching the system to the main structure is
included.
(b) Compliance must be shown (by analyses or individual load tests) with the special factor
requirements for control system joints subject to angular motion.

CS 25.683 Operation tests

(a) It must be shown by operation tests that when portions of the control system subject to pilot effort
loads are loaded to 80% of the limit load specified for the system and the powered portions of the
control system are loaded to the maximum load expected in normal operation, the system is free
from
(1) Jamming;
(2) Excessive friction; and
(3) Excessive deflection.
(b) It must be shown by analysis and, where necessary, by tests that in the presence of deflections of
the aeroplane structure due to the separate application of pitch, roll and yaw limit manoeuvre
loads, the control system, when loaded to obtain these limit loads and operated within its
operational range of deflections can be exercised about all control axes and remain free from-

Annex to ED Decision 2023/021/R Page 395 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(1) Jamming;
(2) Excessive friction;
(3) Disconnection, and
(4) Any form of permanent damage.
(c) It must be shown that under vibration loads in the normal flight and ground operating conditions,
no hazard can result from interference or contact with adjacent elements.

CS 25.685 Control system details

(See AMC 25.685)
(a) Each detail of each control system must be designed and installed to prevent jamming, chafing, and
interference from cargo, passengers, loose objects or the freezing of moisture. (See
AMC 25.685(a).)
(b) There must be means in the cockpit to prevent the entry of foreign objects into places where they
would jam the system.
(c) There must be means to prevent the slapping of cables or tubes against other parts.
(d) CS 25.689 and CS 25.693 apply to cable systems and joints.
[Amdt 25/18]

AMC 25.685(a) Control system details

In assessing compliance with CS 25.685(a) account should be taken of the jamming of control circuits by
the accumulation of water in or on any part which is likely to freeze. Particular attention should be paid
to the following:
a. The points where controls emerge from pressurised compartments.
b. Components in parts of the aeroplane which could be contaminated by the water systems of the
aeroplane in normal or fault conditions; if necessary such components should be shielded.
c. Components in parts of the aeroplane where rain and/or condensed water vapour can drip or
accumulate.
d. Components inside which water vapour can condense and water can accumulate.

CS 25.689 Cable systems

(a) Each cable, cable fitting, turnbuckle, splice, and pulley must be approved. In addition
(1) No cable smaller than 3.2 mm (0·125 inch) diameter may be used in the aileron, elevator, or
rudder systems; and
(2) Each cable system must be designed so that there will be no hazardous change in cable
tension throughout the range of travel under operating conditions and temperature
variations.

Annex to ED Decision 2023/021/R Page 396 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(b) Each kind and size of pulley must correspond to the cable with which it is used. Pulleys and sprockets
must have closely fitted guards to prevent the cables and chains from being displaced or fouled.
Each pulley must lie in the plane passing through the cable so that the cable does not rub against
the pulley flange.
(c) Fairleads must be installed so that they do not cause a change in cable direction of more than three
degrees.
(d) Clevis pins subject to load or motion and retained only by cotter pins may not be used in the control
system.
(e) Turnbuckles must be attached to parts having angular motion in a manner that will positively
prevent binding throughout the range of travel.
(f) There must be provisions for visual inspection of fairleads, pulleys, terminals, and turnbuckles.

CS 25.693 Joints
Control system joints (in push-pull systems) that are subject to angular motion, except those in ball and
roller bearing systems must have a special factor of safety of not less than 3·33 with respect to the ultimate
bearing strength of the softest material used as a bearing. This factor may be reduced to 2·0 for joints in
cable control systems. For ball or roller bearings, the approved ratings, may not be exceeded.

CS 25.697 Lift and drag devices, controls

(a) Each lift device control must be designed so that the pilots can place the device in any takeoff, en-
route, approach, or landing position established under CS 25.101(d). Lift and drag devices must
maintain the selected positions, except for movement produced by an automatic positioning or
load limiting device, without further attention by the pilots.
(b) Each lift and drag device control must be designed and located to make inadvertent operation
improbable. Lift and drag devices intended for ground operation only must have means to prevent
the inadvertent operation of their controls in flight if that operation could be hazardous.
(c) The rate of motion of the surfaces in response to the operation of the control and the characteristics
of the automatic positioning or load limiting device must give satisfactory flight and performance
characteristics under steady or changing conditions of airspeed, engine power, and aeroplane
attitude.
(d) The lift device control must be designed to retract the surfaces from the fully extended position,
during steady flight at maximum continuous engine power at any speed below VF + 17 km/hr (9·0
knots).

CS 25.699 Lift and drag device indicator

(a) There must be means to indicate to the pilots the position of each lift or drag device having a
separate control in the cockpit to adjust its position. In addition, an indication of unsymmetrical
operation or other malfunction in the lift or drag device systems must be provided when such

Annex to ED Decision 2023/021/R Page 397 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

indication is necessary to enable the pilots to prevent or counteract an unsafe flight or ground
condition, considering the effects on flight characteristics and performance.
(b) There must be means to indicate to the pilots the take-off, en-route, approach, and landing lift
device positions.
(c) If any extension of the lift and drag device beyond the landing position is possible, the control must
be clearly marked to identify this range of extension.

CS 25.701 Flap and slat interconnection

(See AMC 25.701)
(a) Unless the aeroplane has safe flight characteristics with the flaps or slats retracted on one side and
extended on the other, the motion of flaps or slats on opposite sides of the plane of symmetry must
be synchronised by a mechanical interconnection or approved equivalent means.
(b) If a wing-flap or slat interconnection or equivalent means is used, it must be designed to account
for the applicable unsymmetrical loads, including those resulting from flight with the engines on
one side of the plane of symmetry inoperative and the remaining engines at take-off power.
(c) For aeroplanes with flaps or slats that are not subjected to slipstream conditions, the structure must
be designed for the loads imposed when the wing-flaps or slats on one side are carrying the most
severe load occurring in the prescribed symmetrical conditions and those on the other side are
carrying not more than 80% of that load.
(d) The interconnection must be designed for the loads resulting when interconnected flap or slat
surfaces on one side of the plane of symmetry are jammed and immovable while the surfaces on
the other side are free to move and the full power of the surface actuating system is applied. (See
AMC 25.701(d).)
[Amdt 25/18]

AMC 25.701(d) Flap and slat interconnection

FAA Advisory Circular AC 25-14 High Lift and Drag Devices, dated 5-4-88, incorporated in FAA Advisory
Circular AC 25-22, Certification of Transport Airplane Mechanical Systems, dated 14 March 2000, is
accepted by EASA as providing acceptable means of compliance with CS 25.701(d).
[Amdt No: 25/23]

CS 25.703 Take-off warning system

(See AMC 25.703)
A take-off warning system must be installed and must meet the following requirements:
(a) The system must provide to the pilots an aural warning that is automatically activated during the
initial portion of the take-off roll if the aeroplane is in a configuration, including any of the following
that would not allow a safe take-off:

Annex to ED Decision 2023/021/R Page 398 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(1) The wing-flaps or leading edge devices are not within the approved range of take-off
positions.
(2) Wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671), speed
brakes, or longitudinal trim devices are in a position that would not allow a safe take-off.
(3) The parking brake is unreleased.
(b) The aural warning required by sub-paragraph (a) of this paragraph must continue until
(1) The take-off configuration is changed to allow a safe take-off;
(2) Action is taken by the pilot to terminate the take-off roll;
(3) The aeroplane is rotated for take-off; or
(4) The warning is manually silenced by the pilot. The means to silence the warning must not be
readily available to the flight crew such that it could be operated instinctively, inadvertently,
or by habitual reflexive action. Before each take-off, the warning must be rearmed
automatically, or manually if the absence of automatic rearming is clear and unmistakable.
(c) The means used to activate the system must function properly for all authorised take-off power
settings and procedures, and throughout the ranges of take-off weights, altitudes, and
temperatures for which certification is requested.

AMC 25.703 Take-off Configuration Warning Systems

1. PURPOSE. This AMC provides guidance for the certification of take-off configuration warning
systems installed in large aeroplanes. Like all AMC material, this AMC is not mandatory and does
not constitute a requirement. It is issued to provide guidance and to outline a method of compliance
with the rules.
2. RELATED CERTIFICATION SPECIFICATIONS.
CS 25.703, 25.1301, 25.1309, 25.1322, 25.1357, 25.1431, and 25.1529.
3. RELATED MATERIAL.
a. Federal Aviation Administration and EASA Documents.
(1) Advisory Circular 25.1309-( ), System Design and Analysis and AC 25-11 Transport
Category Airplane Electronic Display Systems. Advisory circulars can be obtained from
the U.S. Department of Transportation, M-443.2, Subsequent Distribution Unit,
Washington, D.C. 20590.
(2) Report DOT/FAA/RD-81/38, II, Aircraft Alerting Systems Standardization Study,
Volume II, Aircraft Alerting Systems Design Guidelines. This document can be obtained
from the National Technical Information Service, Springfield, Virginia 22161.
(3) FAA report, Review of Take-off Configuration Warning Systems on Large Jet
Transports, dated April 29, 1988. This document can be obtained from the Federal
Aviation Administration, Transport Airplane Directorate, 1601 Lind Avenue, S.W.,
Renton, Washington, 98055-4056.
(4) EASA AMC 25.1322 (Alerting Systems).

Annex to ED Decision 2023/021/R Page 399 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(5) EASA AMC 25-11 (Electronic Display Systems).

(6) EASA AMC 25.1309 (System Design and Analysis).
(7) EASA AMC 20-115 (Software Considerations for Airborne Systems and Equipment
Certification)
b. Industry Documents.
(1) Aerospace Recommended Practice (ARP) 450D, Flight Deck Visual, Audible and Tactile
Signals; ARP 4012/4, Flight Deck Alerting Systems (FAS). These documents can be
obtained from the Society of Automotive Engineers, Inc. (SAE), 400 Commonwealth
Drive, Warrendale, Pennsylvania 15096.
(2) EUROCAE ED-14G/RTCA DO-160G, Environmental Conditions and Test Procedures for
Airborne Equipment.
(3) ARINC 726, Flight Warning Computer System. This document can be obtained from the
ARINC, 2551 Riva Road, Annapolis, Maryland 21401.
4. BACKGROUND. A number of aeroplane accidents have occurred because the aeroplane was not
properly configured for take-off and a warning was not provided to the flight crew by the take-off
configuration warning system. Investigations of these accidents have indicated a need for guidance
material for design and approval of take-off configuration warning systems.
5. DISCUSSION.
a. Regulatory Basis.
(1) CS 25.703, "Take-off warning system," requires that a take-off configuration warning
system be installed in large aeroplanes. This requirement was introduced with JAR-25
Amendment 5 effective 1.1.79. On the FAR side, this was added to FAR Part 25 by
Amendment 25-42 effective on March 1, 1978. CS 25.703 requires that a take-off
warning system be installed and provide an aural warning to the flight crew during the
initial portion of the take off roll, whenever the aeroplane is not in a configuration
which would allow a safe take-off. The intent of this rule is to require that the take-off
configuration warning system cover (a) only those configurations of the required
systems which would be unsafe, and (b) the effects of system failures resulting in
wrong surface or system functions if there is not a separate and adequate warning
already provided. According to the preamble of FAR Part 25 Amendment 25-42, the
take-off warning system should serve as "back-up for the checklist, particularly in
unusual situations, e.g., where the checklist is interrupted or the take-off delayed."
Conditions for which warnings are required include wing flaps or leading edge devices
not within the approved range of take-off positions, and wing spoilers (except lateral
control spoilers meeting the requirements of CS 25.671), speed brakes, parking brakes,
or longitudinal trim devices in a position that would not allow a safe take-off.
Consideration should also be given to adding rudder trim and aileron (roll) trim if these
devices can be placed in a position that would not allow a safe take-off.
(2) Prior to JAR-25 Amendment 5 and FAR Part-25 Amendment 25-42, there was no
requirement for a take-off configuration warning system to be installed in large
aeroplanes. Since this amendment is not retroactive, some large aeroplane models in

Annex to ED Decision 2023/021/R Page 400 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

service today may not have take-off configuration warning systems; however, all large
turbojet transports currently in service, even those with a certification basis
established prior to 1978, include a take-off configuration warning system in the basic
design. These include the majority of large aeroplanes.
(3) Other general rules such as CS 25.1301, 25.1309, 25.1322, 25.1357 and 25.1431 for
electronic system installations also apply to take-off configuration warning systems.
b. System Criticality.
(1) It has been Aviation Authorities policy to categorise systems designed to alert the flight
crew of potentially hazardous operating conditions as being at a level of criticality
associated with a probable failure condition. (For a definition of this terminology
together with discussions and guidelines on the classification of failure conditions and
the probability of failures, see AMC 25.1309). This is because failures of these systems,
in themselves, are not considered to create an unsafe condition, reduce the capability
of the aeroplane, or reduce the ability of the crew to cope with adverse operating
conditions. Other systems which fall into this category include stall warning systems,
overspeed warning systems, ground proximity warning systems, and windshear
warning systems.
(2) Even though AMC 25.1309 does not define an upper probability limit for probable
failure conditions, generally, it can be shown by analysis that such systems have a
probability of failure (of the ability to adequately give a warning) which is
approximately 1.0 x 10E-3 or less per flight hour. This probability does not take into
account the likelihood that a warning will be needed. Systems which are designed to
meet this requirement are usually single channel systems with limited built-in
monitoring. Maintenance or pre-flight checks are relied on to limit the exposure time
to undetected failures which would prevent the system from operating adequately.
(3) Applying the practice given in sub-paragraphs b(1) and b(2) above to take-off
configuration warning systems is not considered to result in an adequate level of safety
when the consequence of the combination of failure of the system and a potentially
unsafe take-off configuration could result in a major/catastrophic failure condition.
Therefore, these systems should be shown to meet the criteria of AMC 25.1309
pertaining to a major failure condition, including design criteria and in-service
maintenance at specified intervals. This will ensure that the risk of the take-off
configuration warning system being unavailable when required to give a warning, if a
particular unsafe configuration occurs, will be minimised.
(4) If such systems use digital electronic technology, a software Development Assurance
Level (DAL) should be used, in accordance with AMC 20-115, which is compatible with
the system integrity determined by the AMC 25.1309 analysis.
(5) Since a false warning during the take-off run at speeds near V1 may result in an
unnecessary rejected take-off (RTO), which could lead to a mishap, the occurrence of
a false warning during the take-off should be remote in accordance with AMC 25.1309.
(6) If the take-off configuration warning system is integrated with other systems that
provide crew alerting functions, the level of criticality of common elements should be

Annex to ED Decision 2023/021/R Page 401 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

commensurate with that of the take-off configuration warning system unless a higher
level is dictated by one or more of the other systems.
c. Design Considerations.
(1) A review of existing take-off configuration warning systems has shown a trend towards
increased sophistication of design, partly due to the transition towards digital
electronic technology which is amenable to self-monitoring and simple testing. The net
result has been an improvement in reliability, fewer unwanted warnings and enhanced
safety.
(2) With the objective of continuing this trend, new systems should be designed using the
objectives and criteria of AMC 25.1309. Analysis should include all the remote sensors,
transducers and the elements they depend on, as well as any take-off configuration
warning system line replaceable unit (LRU) and the actual visual and aural warning
output devices.
(3) Unwanted warnings may be reduced by inhibiting the take-off configuration warning
system where it is safer to do so, e.g., between V1 and VR, so that a hazardous rejected
take-off is not attempted. Inhibition of the take-off configuration warning system at
high speeds will also avoid any confusion from the occurrence of a warning during a
touch-and-go landing. This is because the basic message of an alert is to stop because
it is unsafe to take off. It may or may not tell the flight crew which surface or system is
wrong. A warning may be more hazardous than reliance on the flight crew's skill and
training to cope with the situation.
(4) Even though CS 25.703 specifies those inputs common to most large aeroplanes that
must be included in the design, each aeroplane model should be carefully reviewed to
ascertain that any configuration or trim setting that could jeopardise a safe take-off
has an input to the take-off warning system unless a separate and adequate warning
is already provided by another system. There may be aeroplane configurations or
electronically positioned lateral or longitudinal trim unique to a particular model that
constitute this hazard. In the event that it is necessary to inhibit the warning from a
particular system during the entire take-off roll, an equivalent level of safety finding
would be required.
(5) Automatic volume adjustment should be provided to maintain the aural warning
volume at an appropriate level relative to cockpit ambient sound. According to Report
No. DOT/FAA/RD-81/38, II entitled "Aircraft Alerting Systems Standardisation Study,
Volume II - Aircraft Alerting System Design Guidelines," aural signals should exceed
masked threshold by 8 ± 3 dB.
(6) Of particular importance in the design of take-off configuration warning systems is the
elimination of nuisance warnings. These are warnings generated by a system which is
functioning as designed but which are inappropriate or unnecessary for the particular
phase of operation. Attempting to eliminate nuisance warnings cannot be
overemphasised because any indication which could cause the flight crew to perform
a high speed rejected take-off, or which distracts or adversely affects the flight crew's
performance of the take-off manoeuvre, creates a hazard which could lead to an
accident. In addition, any time there are nuisance warnings generated, there is a

Annex to ED Decision 2023/021/R Page 402 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

possibility that the flight crew will be tempted to eliminate them through system
deactivation, and by continually doing this, the flight crew may be conditioned to
ignore a valid warning.
(7) There are a number of operations that could produce nuisance warnings. Specifically,
single engine taxi for twin engine aeroplanes, or in the case of 3 and 4 engine
aeroplanes, taxi with fewer than all engines operating is a procedure used by some
operators for the purpose of saving fuel. Nuisance warnings have also been caused by
trim changes and speed brake handle adjustments.
(8) The means for silencing the aural warning should not be located such that it can be
operated instinctively, inadvertently, or by habitual reflexive action. Silencing is
defined as the interruption of the aural warning. When silenced, it is preferred that the
system will be capable of rearming itself automatically prior to take-off. However, if
there is a clear and unmistakable annunciation that the system is silenced, manual re-
arming is acceptable.
(9) Each aeroplane model has a different means of arming the take-off configuration
warning system, therefore the potential for nuisance warnings varies accordingly.
Some existing systems use only a single throttle position, some use position from
multiple throttles, some use EPR or N1, and some use a combination of these. When
logic from a single operating engine was used, nuisance warnings were common during
less than all engine taxi operations because of the higher power settings required to
move the aeroplane. These systems were not designed for that type of operation.
Because this procedure is used, inputs that arm the system should be judiciously
selected taking into account any likely combination of operating and shut-down
engines so that nuisance warnings will not occur if the aeroplane is not in take-off
configuration.
(10) CS 25.703 requires only an aural alert for the take-off warning system. CS 25.1322
currently specify requirements for visual alerts while related reading material
reference 3a(2), 3a(4) and 3b(1) provide guidance for integrated visual and aural
annunciations for warnings, cautions and advisory alerting conditions. It has been
common industry practice to incorporate the above mentioned references in their
aeroplane designs. FAR/CS 25.1322 are planned for revision to incorporate the
guidance of these references to reflect current industry practices. Manufacturers may
wish to incorporate these alerting concepts to the take-off warning system. If such is
the case, the following guidance is offered:
a) A master warning (red) attention getting alert may be provided in the pilot's
primary field of view simultaneously with the aural attention getting alert.
b) In addition to or instead of the aural attention getting alert (tone), voice may be
used to specify the general problem (Configuration), or the exact problem (slats,

c) The visual alert may also specify the general problem (Configuration), or the
exact problem (slats, fla
d) A visual cautionary alert associated with the failure of the Take-off warning
system may be provided e.g. "T/O WARN FAIL".

Annex to ED Decision 2023/021/R Page 403 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

(11) The EASA Agency approved Master Minimum Equipment List (MMEL) includes those
items of equipment related to airworthiness and operating regulations and other items
of equipment which the Agency finds may be inoperative and yet maintain an
acceptable level of safety by appropriate conditions and limitations. No MMEL relief is
provided for an inoperative take-off configuration warning. Therefore, design of these
systems should include proper system monitoring including immediate annunciation
to the flight crew should a failure be identified or if power to the system is interrupted.
d. System Tests and Test Intervals.
(1) When manual tests or checks are required to show compliance with CS 25.1309, by
detecting the presence of and limiting the exposure time to a latent failure that would
render the warning inoperative, they should be adequate, simple and straight forward
in function and interval to allow a quick and proper check by the flight crew and
maintenance personnel. Flight crew checks may be specified in the approved
Aeroplane Flight Manual (AFM) and, depending on the complexity of the take-off
configuration warning system and the aeroplane, maintenance tasks may be
conventional Maintenance Review Board (MRB) designed tasks or listed as
Certification Check Requirements (CCR) where appropriate, as defined in
AMC 25.1309, and determined as part of the approval process between the
manufacturer and the certification office.
(2) The specified tests/checks established in accordance with sub-paragraph 5d(1) above
should be demonstrated as part of the approval process and should show that each
input sensor as well as the control and logic system and its emitters, including the
indication system, are individually verified as required to meet sub-paragraph 5b(3). It
should also be demonstrated that the warning self cancels when required to do so, for
example by retarding the throttles or correcting the wrong configuration.
e. Test Considerations.
(1) During flight testing it should be shown that the take-off configuration warning system
does not issue nuisance alerts or interfere with other systems. Specific testing should
be conducted to ensure that the take-off configuration warning system works
satisfactorily for all sensor inputs to the system. Flight testing should include
reconfiguration of the aeroplane during touch and go manoeuvres.
(2) It should be shown by test or analysis that for all requested power settings, feasible
weights, taxiway slopes, temperatures and altitudes, there will be no nuisance
warnings, nor failure to give a warning when necessary (e.g., cold conditions, derated
take-off), for any reasonable configuration of engines operating or shut down. This is
to test or simulate all expected operational configurations. Reasonable pilot technique
for applying power should be presumed.
(3) The means for silencing the aural warning by the flight crew will be evaluated to assure
that the device is not accessible instinctively and it is properly protected from
inadvertent activation. Automatic or manual re-arming of the warning system will be
evaluated.
[Amdt 25/2]
[Amdt 25/8]

Annex to ED Decision 2023/021/R Page 404 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
CONTROL SYSTEMS

[Amdt 25/12]
[Amdt 25/28]

CS 25.705 Runway overrun awareness and alerting systems

(See AMC 25.705)
A runway overrun awareness and alerting system (ROAAS) must be installed. The ROAAS shall reduce the
risk of a longitudinal runway excursion during landing by providing alert, in flight and on ground, to the
flight crew when the aeroplane is at risk of not being able to stop within the available distance to the end
of the runway.
(a) During approach (from a given height above the selected runway) and landing, the ROAAS shall
perform real-time energy-based calculations of the predicted landing stopping point, compare that
point with the location of the end of the runway, and provide the flight crew with:
(1) in-flight, timely, and unambiguous predictive alert(s) of a runway overrun risk, and
(2) on-ground, timely, and unambiguous predictive alert(s) of a runway overrun risk. At the
option of the applicant, the ROAAS may also provide an automated means of deceleration
control that prevents or minimises runway overrun during landing.
(b) The ROAAS shall at least accommodate dry and wet runway conditions for normal landing
configurations.
[Amdt 25/24]

AMC 25.705 Runway overrun awareness and alerting systems

1. When demonstrating compliance with CS 25.705, the applicant should take account of EUROCAE
Document ED-

2. When demonstrating compliance with CS 25.1581 and CS 25.1585, the applicant should include in
the aeroplane flight manual the following elements:
(1) A description of the runway overrun awareness and alerting system (ROAAS) operational
domain, including all conditions for which the ROAAS is expected to perform its intended
function,
(2) Any operational limitations applicable to the ROAAS, and
(3) Operational procedures to be used by the flight crew when ROAAS alerts are triggered.
[Amdt 25/24]

Annex to ED Decision 2023/021/R Page 405 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

LANDING GEAR

CS 25.721 General
(See AMC 25.963(d))
(a) The landing gear system must be designed so that when it fails due to overloads during take-off and
landing, the failure mode is not likely to cause spillage of enough fuel to constitute a fire hazard.
The overloads must be assumed to act in the upward and aft directions in combination with side
loads acting inboard and outboard. In the absence of a more rational analysis, the side loads must
be assumed to be up to 20% of the vertical load or 20% of the drag load, whichever is greater.
(b) The aeroplane must be designed to avoid any rupture leading to the spillage of enough fuel to
constitute a fire hazard as a result of a wheels-up landing on a paved runway, under the following
minor crash landing conditions:
(1) Impact at 1.52 m/s (5 fps) vertical velocity, with the aeroplane under control, at Maximum
Design Landing Weight,
(i) with the landing gear fully retracted and, as separate conditions,
(ii) with any other combination of landing gear legs not extended.
(2) Sliding on the ground, with -
(i) the landing gear fully retracted and with up to a 20° yaw angle and, as separate
conditions,
(ii) any other combination of landing gear legs not extended and with 0° yaw angle.
(c) For configurations where the engine nacelle is likely to come into contact with the ground, the
engine pylon or engine mounting must be designed so that when it fails due to overloads (assuming
the overloads to act predominantly in the upward direction and separately predominantly in the
aft direction), the failure mode is not likely to cause the spillage of enough fuel to constitute a fire
hazard.
[Amdt 25/3]

CS 25.723 Shock absorption tests

(See AMC 25.723)
(a) The analytical representation of the landing gear dynamic characteristics that is used in determining
the landing loads must be validated by energy absorption tests. A range of tests must be conducted
to ensure that the analytical representation is valid for the design conditions specified in CS 25.473.
(1) The configurations subjected to energy absorption tests at limit design conditions must
include at least the design landing weight or the design takeoff weight, whichever produces
the greater value of landing impact energy.

Annex to ED Decision 2023/021/R Page 406 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(2) The test attitude of the landing gear unit and the application of appropriate drag loads during
the test must simulate the aeroplane landing conditions in a manner consistent with the
development of rational or conservative limit loads.
(b) The landing gear may not fail in a test, demonstrating its reserve energy absorption capacity,
simulating a descent velocity of 3.7 m/s (12 fps) at design landing weight, assuming aeroplane lift
not greater than the aeroplane weight acting during the landing impact.
(c) In lieu of the tests prescribed in this paragraph, changes in previously approved design weights and
minor changes in design may be substantiated by analyses based on previous tests conducted on
the same basic landing gear system that has similar energy absorption characteristics.

AMC 25.723 Shock absorption tests

1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating
compliance with the provisions of CS-25 related to the use of landing gear shock absorption tests
and analyses to determine landing loads for large aeroplanes.
2. RELATED CERTIFICATION SPECIFICATIONS. CS 25.723 "Shock absorption tests" and CS 25.473
"Landing load conditions and assumptions."
3. SHOCK ABSORPTION TESTS.
a. Validation of the landing gear characteristics. Shock absorption tests are necessary to
validate the analytical representation of the dynamic characteristics of the landing gear unit
that will be used to determine the landing loads. A range of tests should be conducted to
ensure that the analytical model is valid for all design conditions. In addition, consideration
should be given to ensuring that the range of test configurations is sufficient for justifying the
use of the analytical model for foreseeable future growth versions of the aeroplane.
b. Recommended test conditions for new landing gear units. The design takeoff weight and the
design landing weight conditions should both be included as configurations subjected to
energy absorption tests. However, in cases where the manufacturer has supporting data
from previous experience in validating the analytical model using landing gear units of similar
design concept, it may be sufficient to conduct tests of the new landing gear at only the
condition associated with maximum energy. The landing gear used to provide the supporting
data may be from another model aircraft but should be of approximately the same size with
similar components.
c. Changes to type designs. CS 25.723(c) allows changes in previously approved design weights
and minor changes in design to be substantiated by analyses based on tests of the same basic
landing gear unit with similar energy absorption characteristics.
A landing gear unit would be considered to

that the changes to the landing gear unit, either taken individually or as a whole, would not
have a significant effect on the validation of the analytical results for the modified aeroplane.
Changes that may be acceptable without further energy absorption tests include minor
changes and adjustments incorporated in the landing gear unit to maintain similar energy
absorption characteristics with changes in design weight and landing speeds.

Annex to ED Decision 2023/021/R Page 407 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

For example, the following changes may be acceptable without further tests:
(1) Minor changes in shock absorber details including pre-load, compression ratio, orifice
sizes, metering pin profiles.
(2) Minor changes in tyre characteristics.
(3) Minor changes in unsprung mass (e.g. brakes).
(4) Local strengthening or minor sizing changes to the landing gear.
To allow justification by analysis for the reserve energy requirement, neither the shock strut
nor the tyres should bottom during the reserve energy analysis or the tests upon which the
analysis is correlated.
4. LIMIT FREE DROP TESTS.
a. Compliance with CS 25.723(a) may be shown by free drop tests, provided they are made on
the complete aeroplane, or on units consisting of a wheel, tyre, and shock absorber, in their
proper positions, from free drop heights not less than--
(1) 475 mm (18.7 inches) for the design landing weight conditions; and
(2) 170 mm (6.7 inches) for the design takeoff weight conditions.
b. If aeroplane lift is simulated by air cylinders or by other mechanical means, the weight used
for the drop must be equal to W. If the effect of aeroplane lift is represented in free drop
tests by a reduced weight, the landing gear must be dropped with an effective weight equal
to

where:
We = the effective weight to be used in the drop test (kg);
h = specified free drop height (mm);
d = deflection under impact of the tyre (at the approved inflation pressure) plus the
vertical component of the axle travel relative to the drop weight (mm);
W = WM for main gear units (kg), equal to the static weight on that unit with the aeroplane
in the level attitude (with the nose wheel clear in the case of nose wheel type
aeroplanes);
W = WT for tail gear units (kg), equal to the static weight on the tail unit with the aeroplane
in the tail-down attitude;
W = WN for nose wheel units (kg), equal to the vertical component of the static reaction
that would exist at the nose wheel, assuming that the mass of the aeroplane acts at
the centre of gravity and exerts a force of 1.0 g downward and 0.25 g forward; and
L = ratio of the assumed aeroplane lift to the aeroplane weight, but not more than 1.0.

Annex to ED Decision 2023/021/R Page 408 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

c. The drop test attitude of the landing gear unit and the application of appropriate drag loads
during the test must simulate the aeroplane landing conditions in a manner consistent with
the development of rational or conservative limit loads.
d. The value of d used in the computation of We in paragraph 4.(b) of this AMC may not exceed
the value actually obtained in the drop test.
5. RESERVE ENERGY FREE DROP TESTS.
a. Compliance with the reserve energy absorption condition specified in CS 25.723(b) may be
shown by free drop tests provided the drop height is not less than 69 cm (27 inches).
b. If aeroplane lift is simulated by air cylinders or by other mechanical means, the weight used
for the drop must be equal to W. If the effect of aeroplane lift is represented in free drop
tests by an equivalent reduced weight, the landing gear must be dropped with an effective
weight:

where the symbols and other details are the same as in paragraph 4 above.
[Amdt 25/2]

CS 25.729 Extending and retracting mechanisms

(See AMC 25.729)
(a) General. For aeroplanes with retractable landing gear, the following apply:
(1) The landing gear extending and retracting mechanisms, wheel well doors, and supporting
structure, must be designed for :
(i) the loads occurring in the flight conditions when the gear is in the retracted position;
(ii) the combination of friction loads, inertia loads, brake torque loads, air loads, and
gyroscopic loads resulting from the wheels rotating at a peripheral speed equal to 1·23
VSR (with the flaps in takeoff position at design take-off weight), occurring during
retraction and extension at any airspeed up to 1·5 VSR1 with the wing-flaps in the
approach position at design landing weight, and
(iii) any load factor up to those specified in CS 25.345(a) for the wing-flaps extended
condition.
(2) Unless there are other means to decelerate the aeroplane in flight at this speed, the landing
gear, the extending and retracting mechanisms, and the aeroplane structure (including wheel
well doors) must be designed to withstand the flight loads occurring with the landing gear in
the extended position at any speed up to 0·67 VC.
(3) Landing gear doors, their operating mechanism, and their supporting structures must be
designed for the yawing manoeuvres prescribed for the aeroplane in addition to the
conditions of airspeed and load factor prescribed in sub-paragraphs (a)(1) and (2) of this
paragraph.

Annex to ED Decision 2023/021/R Page 409 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(b) Landing gear lock. There must be positive means to keep the landing gear extended in flight and on
the ground. There must be positive means to keep the landing gear and doors in the correct
retracted position in flight, unless it can be shown that lowering of the landing gear or doors, or
flight with the landing gear or doors extended, at any speed, is not hazardous.
(c) Emergency operation. There must be an emergency means for extending the landing gear in the
event of
(1) any reasonably probable failure in the normal extension and retraction systems; or
(2) the failure of any single source of hydraulic, electric, or equivalent energy supply.
(d) Operation test. The proper functioning of the extending and retracting mechanisms must be shown
by operation tests.
(e) Position indicator and warning device. If a retractable landing gear is used, there must be a landing
gear position indicator easily visible to the pilot or to the appropriate crew members (as well as
necessary devices to actuate the indicator) to indicate without ambiguity that the retractable units
and their associated doors are secured in the extended (or retracted) position. The means must be
designed as follows:
(1) If switches are used, they must be located and coupled to the landing gear mechanical

fully retracted position. The switches may be located where they are operated by the actual
landing gear locking latch or device.
(2) The flight crew must be given an aural warning that functions continuously, or is periodically
repeated, if a landing is attempted when the landing gear is not locked down.
(3) The warning must be given in sufficient time to allow the landing gear to be locked down or
a go-around to be made.
(4) There must not be a manual shut-off means readily available to the flight crew for the
warning required by sub-paragraph (e)(2) of this paragraph such that it could be operated
instinctively, inadvertently or by habitual reflexive action.
(5) The system used to generate the aural warning must be designed to minimise false or
inappropriate alerts.
(6) Failures of systems used to inhibit the landing gear aural warning, that would prevent the
warning system from operating, must be improbable.
(7) A clear indication or warning must be provided whenever the landing gear position is not
consistent with the landing gear selector lever position.
[Amdt 25/4]
[Amdt 25/14]
[Amdt 25/18]

Annex to ED Decision 2023/021/R Page 410 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

AMC 25.729 Extending retracting mechanisms

1. PURPOSE. This Acceptable Means of Compliance (AMC) provides guidance material for use as an
acceptable means of demonstrating compliance with the landing gear retracting mechanism
requirements of the Certification Specification (CS) for large aeroplanes.
2. RELATED DOCUMENTS.
a. Related Certification Specifications. CS 25.729 and other paragraphs relating to landing gear
extending and retracting mechanisms installations together with their applicable AMCs, if
any. Paragraphs which prescribe requirements for the design, substantiation, and
certification of landing gear extending and retracting mechanisms include:
CS 25.111 Take-off path
CS 25.301 Loads
CS25.303 Factor of safety
CS 25.305 Strength and deformation
CS 25.307 Proof of structure
CS 25.333 Flight envelope
CS 25.471 General [Ground loads]
CS 25.561 General [Emergency Landing Conditions]
CS 25.601 General [Design and Construction]
CS 25.603 Materials
CS 25.605 Fabrication methods
CS 25.607 Fasteners
CS 25.609 Protection of structure
CS 25.613 Material strength properties
CS 25.619 Special factors
CS 25.621 Casting factors
CS 25.623 Bearing factors
CS 25.625 Fitting factors
CS 25.729 Extending and retracting mechanisms
CS 25.777 Cockpit controls
CS 25.779 Motion and effect of cockpit controls
CS 25.781 Cockpit control knob shape
CS 25.863 Flammable fluid fire protection
CS 25.869 Fire protection: systems

Annex to ED Decision 2023/021/R Page 411 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

CS 25.899 Electrical bonding, etc.

CS 25.1301 Function and installation
CS 25.1309 Equipment, systems and installations
CS 25.1315 Negative acceleration
CS 25.1316 System lightning protection
CS 25.1322 Warning, caution and advisory lights
CS 25.1353 Electrical equipment and installations
CS 25.1357 Circuit protective devices
CS 25.1360 Precautions against injury
CS 25.1435 Hydraulic systems
CS 25.1515 Landing gear speeds
CS 25.1555 Control markings
CS 25.1583 Operating limitations
CS 25.1585 Operating procedures
b. FAA Advisory Circulars (AC's).
AC 20-34D Prevention of Retractable Landing Gear Failures
AC 23-17B Systems and Equipment Guide for Certification of Part 23 Airplanes and
Airships
AC 25.1309-1A System Design and Analysis
AC 25-7C Flight Test Guide for Certification of Transport Category Airplanes
AC 25-22 Certification of Transport Airplane Mechanical Systems
AC 43.13-1B Acceptable Methods, Techniques and Practices - Aircraft Inspection and
Repair.
c. Federal Aviation Administration Orders.
Order 8110.4C Type Certification Process
Advisory Circulars and FAA Orders can be obtained from the U.S. Department of
Transportation, Subsequent Distribution Office, SVC-121.23, Ardmore East Business Center,
3341 Q 75th Avenue, Landover, MD 20785.
d. Society of Automotive Engineers (SAE) Documents.
SAE AIR-4566 Crashworthiness Landing Gear Design
SAE ARP-1311A Landing Gear - Aircraft
ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment
(not an SAE document but is available from the SAE)

Annex to ED Decision 2023/021/R Page 412 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

These documents can be obtained from the Society of Automotive Engineers, Inc., 400
Commonwealth Drive, Warrendale, Pennsylvania, 15096.
e. Industry Documents.
(1) EUROCAE ED-14G/RTCA, Inc., Document No. DO-160G,
Environmental Conditions and Test Procedures for Airborne Equipment.
(2) AMC 20-115, Software Considerations in Airborne Systems and Equipment
Certification.
These documents can be obtained from EUROCAE, 17 rue Hamelin, 75783 Paris Cedex
15, France
f. Military Documents.
MIL-STD-810 Environmental Test Methods and Engineering Guidelines
This document can be obtained from the Department of Defence, DODSSP, Standardisation
Document Order Desk, 700 Robbins Avenue, Building 4D, Philadelphia, PA 19111-5094.
4. DISCUSSION.
a. Intent of rule. (Reference CS 25.729 Extending and retracting mechanisms)
This rule provides minimum design and certification requirements for landing gear actuation
systems to address:
(1) Structural integrity for the nose and main landing gear, extending and retracting
mechanism(s), doors, gear supporting structure for loads imposed during flight;
(2) Positive locking of the kinematic mechanisms;
(3) Redundant means of extending the landing gear;
(4) Demonstration of proper operation by test;
(5) Gear up-and-locked and down-and-locked position indications and aural warning;
(6) Equipment damage from tyre burst, loose tread, and wheel brake temperatures.
b. Demonstration of extending and retracting mechanisms proper functioning. (Reference CS
25.729(d) Operation test)
Guidance addressing flight testing used to demonstrate compliance with this paragraph may
be found in FAA Advisory Circular (AC) 25-7C, Flight Test Guide for Transport Category
Aeroplanes, Chapter 4, Section 4, paragraph 52, dated 16 October 2012.
c. Extending and retracting mechanisms indication. (Reference CS 25.729(e) Position indicator
and warning device)
(1) When light indicators are used, they should be arranged so that-
(i) A green light for each unit is illuminated only when the unit is secured in the
correct landing position.

Annex to ED Decision 2023/021/R Page 413 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(ii) A warning light consistent with CS 25.1322 is illuminated at all times except
when the landing gear and its doors are secured in the landing or retracted
position.
(2) The warning required by CS 25.729(e)(2) should preferably operate whatever the
position of wing leading- or trailing-edge devices or the number of engines operating.
(3) The design should be such that nuisance activation of the warning is minimised, for
example-
(i) When the landing gear is retracted after a take-off following an engine failure,
or during a take-off when a common flap setting is used for take-off and landing;
(ii) When the throttles are closed in a normal descent; or
(iii) When flying at low altitude in clean or low speed configuration (special
operation).
(4) Inhibition of the warning above a safe altitude out of final approach phase either
automatically or by some other means to prevent these situations is acceptable, but it
should automatically reset for a further approach.
(5) Means to de-activate the warning required by CS 25.729(e) may be installed for use in
abnormal or emergency conditions provided that it is not readily available to the flight
crew, i.e. the control device is protected against inadvertent actuation by the flight
crew and its de-activated state is obvious to the flight crew.
d. Definitions. For definitions of VSR and VC, see CS-Definitions Chapter 2, entitled 'Abbreviations
and symbols'.
[Amdt 25/4]
[Amdt 25/12]
[Amdt 25/14]
[Amdt 25/18]

CS 25.731 Wheels
(a) Each main and nose wheel must be approved.
(b) The maximum static load rating of each wheel may not be less than the corresponding static ground
reaction with
(1) Design maximum weight; and
(2) Critical centre of gravity.
(c) The maximum limit load rating of each wheel must equal or exceed the maximum radial limit load
determined under the applicable ground load requirements of this CS-25.
(d) Overpressure burst prevention. Means must be provided in each wheel to prevent wheel failure and
tyre burst that may result from excessive pressurisation of the wheel and tyre assembly.
(e) Braked wheels. Each braked wheel must meet the applicable requirements of CS 25.735.

Annex to ED Decision 2023/021/R Page 414 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

CS 25.733 Tyres
(a) When a landing gear axle is fitted with a single wheel and tyre assembly, the wheel must be fitted
with a suitable tyre of proper fit with a speed rating approved by the Agency that is not exceeded
under critical conditions, and with a load rating approved by the Agency that is not exceeded under

(1) The loads on the main wheel tyre, corresponding to the most critical combination of
aeroplane weight (up to the maximum weight) and centre of gravity position; and
(2) The loads corresponding to the ground reactions in sub-paragraph (b) of this paragraph, on
the nose-wheel tyre, except as provided in sub-paragraphs (b)(2) and (b)(3) of this paragraph.
(b) The applicable ground reactions for nosewheel tyres are as follows:
(1) The static ground reaction for the tyre corresponding to the most critical combination of
aeroplane weight (up to maximum ramp weight) and centre of gravity position with a force
of 1·0 g acting downward at the centre of gravity. This load may not exceed the load rating
of the tyre.
(2) The ground reaction of the tyre corresponding to the most critical combination of aeroplane
weight (up to maximum landing weight) and centre of gravity position combined with forces
of 1·0 g downward and 0·31 g forward acting at the centre of gravity. The reactions in this

reaction equal to 0·31 times the vertical load at each wheel with brakes capable of producing
this ground reaction. This nose tyre load may not exceed 1·5 times the load rating of the tyre.
(3) The ground reaction of the tyre corresponding to the most critical combination of aeroplane
weight (up to maximum ramp weight) and centre of gravity position combined with forces of
1·0 g downward and 0·20 g forward acting at the centre of gravity. The reactions in this case
must be distributed to the nose and main wheels by the pr
reaction equal to 0·20 times the vertical load at each wheel with brakes capable of producing
this ground reaction. This nose tyre load may not exceed 1·5 times the load rating of the tyre.
(c) When a landing gear axle is fitted with more than one wheel and tyre assembly, such as dual or
dual-tandem, each wheel must be fitted with a suitable tyre of proper fit with a speed rating
approved by the Agency that is not exceeded under critical conditions, and with a load rating
approved by the Agency that is not exceeded by
(1) The loads on each main wheel tyre, corresponding to the most critical combination of
aeroplane weight (up to maximum weight) and centre of gravity position, when multiplied
by a factor of 1·07; and
(2) Loads specified in sub-paragraphs (a)(2), (b)(1), (b)(2) and (b)(3) of this paragraph on each
nose-wheel tyre.
(d) Each tyre installed on a retractable landing gear system must, at the maximum size of the tyre type
expected in service, have a clearance to surrounding structure and systems that is adequate to
prevent unintended contact between the tyre and any part of the structure or systems.
(e) For an aeroplane with a maximum certificated take-off weight of more than 34019 kg
(75 000 pounds), tyres mounted on braked wheels must be inflated with dry nitrogen or other gases

Annex to ED Decision 2023/021/R Page 415 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

shown to be inert so that the gas mixture in the tyre does not contain oxygen in excess of 5% by
volume, unless it can be shown that the tyre liner material will not produce a volatile gas when
heated, or that means are provided to prevent tyre temperatures from reaching unsafe levels.
(f) A means shall be provided to minimise the risk that a tyre is below its minimum serviceable inflation
pressure during operation. (See AMC 25.733(f))
[Amdt 25/26]

AMC 25.733(f) Tyre inflation pressure check

1. General
sure specified by the aeroplane
type certificate holder below which damage to the tyre, potentially leading to a tyre failure, may
occur.
In order to demonstrate compliance with CS 25.733(f), the applicant should use one, or a
combination, of the following means:
(a) Provide a task in the Instructions for Continued Airworthiness (ICA) that requires tyres
inflation pressure checks to be performed at a suitable time interval,
(b) Install a system that monitors the tyres inflation pressures and:
(1) provides an alert to the flight crew, in compliance with CS 25.1322, whenever a tyre
inflation pressure is below the minimum serviceable inflation pressure, or
(2) allows the tyres inflation pressures to be checked prior to the dispatch of the
aeroplane, and a tyre inflation pressure check task is included in the Aeroplane Flight
Manual (AFM) pre-flight procedures.
2. ICA Tyre inflation pressure check

pressure checks.
Checks should be conducted daily in order to ensure that the elapsed clock time between two
consecutive tyre inflation pressure checks does not exceed 48 hours.
Time intervals longer than 48 hours may be used if they are substantiated and agreed by EASA. This
substantiation should at least include an analysis of the expected loss of tyre pressure during
operation, taking into account the environmental and operational factors, including the potential
for pressure loss at a rate that exceeds the normal diffusion resulting from damage to or
degradation of the tyre/wheel assembly. If available, statistical data related to pressure losses
gathered from the service experience of aeroplanes equipped with equivalent wheel designs should
also be used. The substantiation should be made in cooperation with the tyre manufacturer(s). In
addition, the applicant may take credit from an installed system monitoring the tyre inflation
pressures.
3. Tyre inflation pressure monitoring systems
If a system is installed, its development assurance level should be commensurate with the potential
consequences of an alert not being provided, as well as with the consequences of false alerts. If the

Annex to ED Decision 2023/021/R Page 416 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

system includes the indication of tyre pressure levels, the consequence of a false indication should
also be taken into account. The assessment of these consequences should include the effects of the
failure of one or more tyres (including simultaneous tyre failures) that may be caused by the
operation of the aeroplane with under-inflated tyres.
Instructions for Continued Airworthiness should be provided to ensure that the calibration of the
tyre pressure monitoring system is maintained.
[Amdt 25/26]

CS 25.734 Protection against wheel and tyre failures

(see AMC 25.734)
The safe operation of the aeroplane must be preserved in case of damaging effects on systems or
structures from:
tyre debris;
tyre burst pressure;
flailing tyre strip; and
wheel flange debris.
[Amdt 25/14]

AMC 25.734 Protection against wheel and tyre failures

1. Purpose
This AMC provides a set of models defining the threats originating from failures of tyres and wheels.
Furthermore, protecting the aircraft against the threats defined in these models would also protect
against threats originating from foreign objects projected from the runway.
These models should be used for protection of aeroplane structure and systems.
2. Related Certification Specifications and Acceptable Means of Compliance
CS 25.571 Damage tolerance and fatigue evaluation of structure
CS 25.734 Protection against wheel and tyre failures
CS 25.963(e) Fuel tanks: general
AMC 25.963(e) Fuel Tank Protection
CS 25.1309 Equipment, systems and installations
AMC 20-29 Composite Aircraft Structure
3. General
3.1. Threat models
The models provided below encompass the threats applicable to landing gear in the
extended, retracting and retracted positions. The threats to be considered are tyre debris,

Annex to ED Decision 2023/021/R Page 417 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

flailing tyre strips, tyre burst pressure effect and wheel flange debris. The models defined
below are applicable to brand-new tyres.
With the landing gear in the extended position, the following models are applicable:
Model 1 Tyre Debris Threat Model
Model 2 Wheel Flange Debris Threat Model
Model 3E Flailing Tyre Strip Threat Model
With the landing gear retracting or in the retracted position, the following models are
applicable:
Model 3R Flailing Tyre Strip Threat Model
Model 4 Tyre Burst Pressure Effect Threat Model
3.2. Structural residual strength and damage tolerance
In-service experience shows that traditional large transport aeroplane configurations,
featuring high aspect ratio wings built around a single torsion box manufactured of light
metal alloy, have demonstrated inherent structural robustness with regard to wheel and tyre
debris threats. This results from the intrinsic properties of the structure, including thick wing
skin gauges, as well as the general geometric arrangement (relative position of the landing
gear to the wing). Residual strength and damage tolerance evaluations might therefore not
be required for aeroplanes featuring such design features. For aeroplanes with novel or
unusual design features (configuration, material, fuel tank arrangement, etc.), for principal
structural elements and primary structures, the debris models are threats to be considered
with respect to the related residual strength and damage tolerance rules and advisory
materials, unless otherwise stated in this AMC or addressed by other means.
3.3. Fuel tank penetration
In-service experience shows a good safety record for the fuel tanks located within the torsion
box of high aspect ratio wings manufactured of light metal alloy, owing to the intrinsic
characteristics of the structure, including the wing skin gauge and typical arrangement of the
stringers and ribs. Therefore, for tanks located within similar structures, in the absence of
any unusual design feature(s), fuel tank penetration evaluation needs only to consider small
tyre debris.
3.4. Definitions
Carcass of a tyre: This comprises the entire main body of a tyre (also named the casing)
including the materials under the tread, the sidewall, and steel belts if any.
Full tread: The thickness of the tread rubber measured from the outer tread surface to the
top of the outermost fabric or steel layer, including the rubber thickness above and below
the tread groove bottom. Refer to the figure below (section of a tyre):

Annex to ED Decision 2023/021/R Page 418 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

Hazardous fuel leak: a definition is provided in AMC 25.963(e).

Maximum unloaded operational pressure: Unloaded rated tyre pressure (available from the
TRA Year Book) divided by the 1.07 factor from CS 25.733(c)(1).
Minimum tyre speed rating: The lowest tyre speed rating certified for the aeroplane in
compliance with CS 25.733(a) or (c). The aeroplane manufacturer may decide to certify
several tyre speed ratings; in this case, the lowest certified speed rating value should be taken
e models of this AMC.
Total tread area: G.WSG

Terms used in accordance with the Tire and Rim Association (TRA) Aircraft Year Book3:
D = TRA Rim Diameter
DG = TRA Grown Tyre Diameter
WSG = TRA Maximum Grown Shoulder Width
Tyre speed rating: The maximum ground speed at which the tyre has been tested in
accordance with (E)TSO C62e.
4. Threat models
Model 1 Tyre Debris Threat Model
Applicability: landing gear extended
(1) Threats occurring when the tyre is in contact with the ground release tyre debris.
Two tyre debris sizes are considered.
These debris are assumed to be released from the tread area of the tyre and projected
towards the aircraft within the zones of vulnerability identified in Figure 1:

3
The Tire and Rim Association, Inc. (TRA) is the standardizing body for the tire, rim, valve and allied parts industry for the United States. TRA
was founded in 1903 and its primary purpose is to establish and promulgate interchangeability standards for tires, rims, valves and allied
parts. TRA standards are published in the Tire and Rim Year Book, Aircraft Year Book and supplemental publications. More information
available at: http://www.us-tra.org/index.html.

Annex to ED Decision 2023/021/R Page 419 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(i) ensions WSG × WSG at DG and a thickness of the full tread plus

15°.
(ii)
distributed over an area equal to 1.5 per cent of the total tread area. The angle of

The debris have a speed equivalent to the minimum tyre speed rating certified for the aircraft
(the additional velocity component due to the release of carcass pressure need not be taken
into account).
Figure 1 Tyre Debris Threats

(2) Protection of the fuel tank structure and pass-fail criteria on effects of penetration
(2.1) The large tyre debris size as defined in (i) above is assumed to penetrate and open the
fuel tank or fuel system structure located in the zone of vulnerability defined in (i). It
is used to define the opening size of the structural damage. A fuel leakage is assumed
to occur whenever either the fuel tank structure or any structural element of fuel
system components is struck by this large debris. It need not be used as a sizing case
for structural design.
The fuel leakage should not result in hazardous quantities of fuel entering areas of the
aeroplane that could present a hazard such as, but not limited to:
1. an engine air intake,
2. an APU air intake, or

Annex to ED Decision 2023/021/R Page 420 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

3. a cabin air intake.

All practical measures should be taken to avoid fuel coming into contact with an
ignition source (which may also result from the tyre failure event, e.g. electrical wire
damage).
This should be shown by test or analysis, or a combination of both, for each engine
forward thrust condition and each approved reverse thrust condition.
Alternatively, it is acceptable to demonstrate that the large tyre debris as defined in (i)
above will not cause damage sufficient to allow a hazardous fuel leak whenever fuel
tank deformation or rupture has been induced (including through propagation of
pressure waves or cracking sufficient to allow a hazardous fuel leak).
(2.2) The small tyre debris as defined in (ii) should not create damage sufficient to allow a
hazardous fuel leak in the zone of vulnerability defined in (ii).
(3) Protection of systems and pass-fail criteria
The two tyre debris sizes (defined in (i) and (ii) above) are considered. The sizes of debris are to be
considered for the separation of systems.
When shielding is required (to protect a component or system), or when an energy analysis is
required (for instance, for the validation of the structural parts of systems), the small debris defined
in (ii) should be used.
An initial tyre failure can also result in failure of, and debris from, the companion tyre. This can
occur even when the tyres have been designed to have double dynamic overload capability.
The analysis for the segregation of systems installation and routing should take this companion tyre
= 15° (either side of the tyre
centre line) and only considering both tyres releasing large debris. Inside zones defined by
15° <
tyre needs to be considered.

To demonstrate compliance with the applicable Certification Specifications, the following approach
should be used:
(a) Identify all hazards associated with the possible impact areas defined by Figure 1, including
simultaneous/cascade failure of companion tyres.
(b) All practicable design precautions should be taken to eliminate all Catastrophic failure
situations by means of system separation and/or impact resistant shielding and/or redesign.
Impact resistance should be assessed for small debris (type (ii)) impacts only. Consideration
should also be given to Hazardous failure situations when showing compliance in accordance
with CS 25.1309.
(c) Any Catastrophic failure situation that remains after accomplishment of step (b) above will
be submitted to the Agency for consideration in accordance with step (d) below.
(d) If the Agency concludes that the applicant has taken all practicable precautions to prevent a
Catastrophic failure situation and the probability of the occurrence is consistent with the

Annex to ED Decision 2023/021/R Page 421 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

hazard classification (assuming a probability of companion tyre failure, if applicable, equal to

10 per cent), the design would be considered as compliant with the intent of CS 25.734.
Model 2 Wheel Flange Debris Threat Model
Applicability: gear extended
(1) It is considered that a 60° arc segment of the wheel flange can be released laterally, in the
zones identified in Figure 2. The speed of release is 100 m/s (328 ft/s).
Where multiple wheels are installed on a landing gear leg, the lateral release of only the
flange on the outer wheel halves needs to be considered.
If only a single wheel is installed on a landing gear leg, then the lateral release of either flange
shall be considered.
(2) Vertically released debris are covered by Model 1 tyre debris.
(3) The debris should be considered to impact in the most critical condition.
Figure 2 Wheel Flange Release Threat

Model 3 Flailing Tyre Strip Threat Model

(1) Model 3E: Landing Gear Extended
A flailing tyre strip with a length of 2.5 WSG and a width of WSG/2 will remain attached to
the outside diameter of the rotating tyre at take-off speeds.

Annex to ED Decision 2023/021/R Page 422 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

The thickness (t) of the loose strip of tyre is the full tread plus the carcass of the tyre. If the
applicant demonstrates that the carcass will not fail, then the thickness may be reduced to
full tread plus outermost ply (i.e. the reinforcement or protector ply).
The strip has a speed equivalent to the minimum tyre speed rating certified for the aircraft.
For this threat the zone of vulnerability is 30°, as shown in Figure 3.
(2) Model 3R: Landing Gear Retracting or Retracted
The loose tyre strip and the conditions remain unchanged from that considered for the Gear
Extended case. However, due to the wheel spin down after take-off, the rotational speed of
the wheel may be lower or even zero as it enters the wheel bay.
If the aeroplane is equipped with a system braking the wheel during landing gear retraction

(i) the retraction braking system is reliable and its failure is not latent;
(ii) the failure of the retraction brake is independent from a flailing tyre strip event;
(iii) the retraction braking stops the rotation of the tyre before the trajectory of the flailing
tyre strip can cause a hazard to the aircraft; and
(iv) the effect of a zero velocity retraction with the loose strip of tyre is assessed.
The strip has an initial speed equivalent to the minimum tyre speed rating certified for the
aircraft. Allowance for rotation speed reduction during retraction may be substantiated by
the applicant. For this threat the zone of vulnerability is 30°, as shown in Figure 3.
Figure 3 Flailing Tyre Strip Threat

Model 4 Tyre Burst Pressure Effect Threat Model

Applicability: landing gear retracting or landing gear retracted

Annex to ED Decision 2023/021/R Page 423 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

1) In-flight tyre bursts with the landing gear retracted are considered to result from previous
damage to the tyre, which could occur at any point on the exposed surface. A review of the
known incidents shows that all cases of retracted tyre burst have occurred to main gear with
braked wheels. This hazard is therefore considered to be applicable only to tyres mounted
on braked wheels.
2) It is assumed that tyres do not release debris and consequential damage is considered to be
caused
been shown to differ between radial and bias tyres.
3) The tyre burst pressure is assumed to be 130 % of the maximum unloaded operational
pressure, which is the unloaded tyre rated pressure reduced by a factor of 1.07 (safety factor
required by CS 25.733(c)(1)).
Example: For an H44.5 × 16.5 21 26PR Tyre The unloaded tyre rated pressure is 1 365 kPa
(198 psig), so the maximum unloaded operational pressure is 1 365 / 1.07 = 1 276 kPa
(185 psig), i.e. 1 377 kPa absolute pressure (199.7 psia); therefore the tyre burst pressure is
1 377 × 1.3 = 1 790 kPa absolute pressure (259.7 psia).
4) For bias tyres, the burst plume model shown in Figures 4a and 4b should be used, with the
blast cone axis rotated over the tread surface of the tyre (± 100° as shown in
Figure 4a). The pressure distribution is provided in Figures 4b and 4c.
5) . The
pressure decay formula provided in Figure 4e below should be used. It provides the level of
pressure as a function of the distance from the tyre burst surface.
6) The effect of the burst should be evaluated on structure and system items located inside the
defined burst plume. In addition, there should be no effect detrimental to continued safe
flight and landing due to the increase in pressure of the wheel well as a result of a retracted
tyre burst.
Figure 4a Tyre Burst Pressure Effect Bias Tyre

Annex to ED Decision 2023/021/R Page 424 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

Figure 4b Tyre Burst Pressure Effect Bias Tyre

Annex to ED Decision 2023/021/R Page 425 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

Figure 4c Tyre Burst Pressure Effect Bias Tyre

Air jet pressure distribution

Figure 4d Tyre Burst Pressure Effect Radial Tyre

Annex to ED Decision 2023/021/R Page 426 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

Figure 4e Tyre Burst Pressure Effect Radial Tyre

Radial Tyre Burst Pressure Decay Formula

Where:

Or:

and:
C1 = 12.478,
C2 = 1.222,
C3 = 0.024

Annex to ED Decision 2023/021/R Page 427 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

WG = the Maximum Grown Section Width of the tyre [in or mm] as specified in the Tyre & Rim
Association (TRA) designation for the tyre
Pt = Total or burst pressure [psia or bar]
P0 = Ambient pressure [psia or bar]
x = Distance from object to grown tyre surface [in or mm]
If P(x) > Pt then P(x) = Pt; otherwise P(x) = P(x).
[Amdt 25/14]

CS 25.735 Brakes and braking systems

(See AMC 25.735)
(a) Approval. Each assembly consisting of a wheel(s) and brake(s) must be approved.
(b) Brake system capability. The brake system, associated systems and components must be designed
and constructed so that:
(1) If any electrical, pneumatic, hydraulic, or mechanical connecting or transmitting element
fails, or if any single source of hydraulic or other brake operating energy supply is lost, it is
possible to bring the aeroplane to rest with a braked roll stopping distance of not more than
two times that obtained in determining the landing distance as prescribed in CS 25.125.
(2) Fluid lost from a brake hydraulic system following a failure in, or in the vicinity of, the brakes
is insufficient to cause or support a hazardous fire on the ground or in flight.
(c) Brake controls. The brake controls must be designed and constructed so that:
(1) Excessive control force is not required for their operation.
(2) If an automatic braking system is installed, means are provided to:
(i) Arm and disarm the system, and
(ii) Allow the pilot(s) to override the system by use of manual braking.
(d) Parking brake. The aeroplane must have a parking brake control that, when selected on, will,
without further attention, prevent the aeroplane from rolling on a dry and level paved runway when
the most adverse combination of maximum thrust on one engine and up to maximum ground idle
thrust on any, or all, other engine(s) is applied. The control must be suitably located or be
adequately protected to prevent inadvertent operation. There must be indication in the cockpit
when the parking brake is not fully released.
(e) Anti-skid system. If an anti-skid system is installed:
(1) It must operate satisfactorily over the range of expected runway conditions, without external
adjustment.
(2) It must, at all times, have priority over the automatic braking system, if installed.
(f) Kinetic energy capacity

Annex to ED Decision 2023/021/R Page 428 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(1) Design landing stop. The design-landing stop is an operational landing stop at maximum
landing weight. The design landing stop brake kinetic energy absorption requirement of each
wheel, brake, and tyre assembly must be determined. It must be substantiated by
dynamometer testing that the wheel, brake and tyre assembly is capable of absorbing not
less than this level of kinetic energy throughout the defined wear range of the brake. The

must be achieved. The mean deceleration must not be less than 3.1 m/s2 (10 fps2).
(2) Maximum kinetic energy accelerate-stop. The maximum kinetic energy accelerate-stop is a
rejected take-off for the most critical combination of aeroplane take-off weight and speed.
The accelerate-stop brake kinetic energy absorption requirement of each wheel, brake, and
tyre assembly must be determined. It must be substantiated by dynamometer testing that
the wheel brake and tyre assembly is capable of absorbing not less than this level of kinetic
energy throughout the defined wear range of the brake. The energy absorption rate derived
from the aeroplane's braking requirements must be achieved. The mean deceleration must
not be less than 1.8 m/s2 (6 fps2).
(3) Most severe landing stop. The most severe landing stop is a stop at the most critical
combination of aeroplane landing weight and speed. The most severe landing stop brake
kinetic energy absorption requirement of each wheel, brake, and tyre assembly must be
determined. It must be substantiated by dynamometer testing that, at the declared fully
worn limit(s) of the brake heat sink, the wheel, brake and tyre assembly is capable of
absorbing not less than this level of kinetic energy. The most severe landing stop need not
be considered for extremely improbable failure conditions or if the maximum kinetic energy
accelerate-stop energy is more severe.
(g) Brake condition after high kinetic energy dynamometer stop(s). Following the high kinetic energy
stop demonstration(s) required by sub-paragraph (f) of this paragraph, with the parking brake
promptly and fully applied for at least 3 minutes, it must be demonstrated that for at least 5 minutes
from application of the parking brake, no condition occurs (or has occurred during the stop),
including fire associated with the tyre or wheel and brake assembly, that could prejudice the safe
and complete evacuation of the aeroplane.
(h) Stored energy systems. An indication to the flight crew of the usable stored energy must be
provided if a stored energy system is used to show compliance with sub-paragraph (b)(1) of this
paragraph. The available stored energy must be sufficient for:
(1) At least 6 full applications of the brakes when an anti-skid system is not operating; and
(2) Bringing the aeroplane to a complete stop when an anti-skid system is operating, under all
runway surface conditions for which the aeroplane is certificated.
(i) Brake wear indicators. Means must be provided for each brake assembly to indicate when the heat
sink is worn to the permissible limit. The means must be reliable and readily visible.
(j) Over-temperature burst prevention. Means must be provided in each braked wheel to prevent a
wheel failure, a tyre burst, or both, that may result from elevated brake temperatures. Additionally,
all wheels must meet the requirements of CS 25.731(d).
(k) Compatibility. Compatibility of the wheel and brake assemblies with the aeroplane and its systems
must be substantiated.

Annex to ED Decision 2023/021/R Page 429 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(l) Wheel brake temperature. Equipment and structure that are essential to the safe operation of the
aeroplane and that are located on the landing gear and in wheel wells must be protected from the
damaging effects of possible wheel brake temperatures.
[Amdt 25/2]
[Amdt 25/14]

AMC 25.735 Brakes and Braking Systems Certification Tests and

Analysis
1. PURPOSE
This AMC (Acceptable Means of Compliance) which is similar to the FAA Advisory Circular AC
25.735-1 provides guidance material for use as an acceptable means, although not the only means,
of demonstrating compliance with the requirements of CS 25.731 and CS 25.735. It also identifies
other paragraphs of the EASA Certification Specifications (CS) that contain related requirements
and other related and complementary documents.
2. RELATED REGULATORY MATERIAL AND COMPLEMENTARY DOCUMENTS
a. Related EASA Certification Specifications
PART-21 and CS-25 paragraphs (and their associated AMC where applicable) that prescribe
requirements related to the design substantiation and certification of brakes and braking
systems include:
21A.303 Compliance with applicable Requirements
CS 25.101 General
CS 25.109 Accelerate-stop distance
CS 25.125 Landing
CS 25.301 Loads
CS 25.303 Factor of safety
CS 25.729 Extending and retracting mechanisms
CS 25.733 Tyres
CS 25.1301 Function and installation
CS 25.1309 Equipment, systems and installations
CS 25.1322 Flight crew alerting
CS 25.1501 General: Operating limitations and information
CS 25.1541 Markings and Placards: General
CS 25.1591 Take-off performance information for operations on slippery wet and
contaminated runways

Additional Part-21 and CS-25 paragraphs (and their associated AMC where applicable) that
prescribe requirements which can have a significant impact on the overall design and
configuration of brakes and braking systems are, but are not limited to:

Annex to ED Decision 2023/021/R Page 430 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

21.A.101 Type-certification basis, operational suitability data certification basis

and environmental protection requirements for a major change to a
type-certificate
CS 25.671 General: Control Systems
CS 25.863 Flammable fluid fire protection
CS 25.1001 Fuel jettisoning system
CS 25.1183 Flammable fluid-carrying components
CS 25.1185 Flammable fluids
CS 25.1315 Negative acceleration (FAR 25.943)

b. Complementary Documents
Documents that provide appropriate standards for the design substantiation and certification
of Brakes and Braking Systems are, but are not limited to:
(i) European Technical Standard Orders (ETSO)
ETSO-C47 Pressure Instruments - Fuel, Oil and Hydraulic
ETSO-C26c Aircraft Wheels and Wheel-Brake Assemblies with Addendum I
ETSO-2C75 Hydraulic Hose Assemblies
ETSO-C62d Aircraft Tyres
ETSO-C135 Transport Aeroplane Wheels and Wheel and Brake Assemblies

(ii) Advisory Circulars/Acceptable Means of Compliance

AC 25.1309-1A System Design and Analysis
AC 25-7C Flight Test Guide for Certification of Transport Category Airplanes
AC 21-29A Detecting and Reporting Suspected Unapproved Parts
AC 91-6A Water, Slush, and Snow on the Runway AMC 25.1591 The derivation
and methodology of performance information for use when taking-
off and landing with contaminated runway surface conditions.
AMC 20-115 Software Considerations for Airborne Systems and Equipment
Certification

(iii) Society of Automotive Engineers (SAE) Documents

ARP 597C Wheels and Brakes, Supplementary Criteria for Design Endurance -
Civil Transport Aircraft
ARP 813A Maintainability Recommendations for Aircraft Wheels and Brakes
AIR 1064B Brake Dynamics
ARP 1070B Design and Testing of Anti-skid Brake Control Systems for Total
Aircraft Compatibility
AS 1145A Aircraft Brake Temperature Monitor System (BTMS)
ARP 1619 Replacement and Modified Brakes and Wheels
AIR 1739 Information on Anti-skid Systems
ARP 1907 Automatic Braking Systems Requirements
AIR 1934 Use of Carbon Heat Sink Brakes on Aircraft

Annex to ED Decision 2023/021/R Page 431 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

ARP 4102/2 Automatic Braking System (ABS)

ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft
Hydraulic Systems
(Note: This document provides a wide range of Civil, Military and
Industry document references and standards which may be
appropriate.)

(iv) International Organisation for Standardisation (ISO) Documents

ISO 7137 Environmental Conditions and Test Procedures for Airborne
Equipment.

(v) US Military Documents

MIL-STD-810 Environmental Test Methods and Engineering Guidelines.

(vi) The European Organisation for Civil Aviation Equipment Documents

ED-14G/RTCA DO-160G Environmental Conditions and Test Procedures for Airborne
Equipment.
AMC 20-115 Software Considerations for Airborne Systems and
Equipment Certification.

3. RESERVED
4. DISCUSSION
a. Ref. CS 25.735(a) Approval
(1) CS 25.735(a) states that each assembly consisting of a wheel(s) and brake(s) must be
approved. Each wheel and brake assembly fitted with each designated and approved
tyre type and size, where appropriate, should be shown to be capable of meeting the
minimum standards and capabilities detailed in the applicable European Technical
Standard Order (E)TSO, in conjunction with the type certification procedure for the
aeroplane, or by any other means approved by the Agency. This applies equally to
replacement, modified, and refurbished wheel and brake assemblies or components,
whether the changes are made by the Original Equipment Manufacturer (OEM) or
others. Following initial aeroplane certification, any additional wheel and brake
assemblies should meet the applicable airworthiness requirements specified in point
21.A.101(a) and (b) of Part-21, to eliminate situations that may have adverse
consequences on aeroplane braking control and performance. This includes the
possibility of the use of modified brakes either alone (i.e. as a ship set) or alongside the

The components of the wheels, brakes, and braking systems should be designed to:
(a) Withstand all pressures and loads, applied separately and in conjunction, to
which they may be subjected in all operating conditions for which the aeroplane
is certificated.

Annex to ED Decision 2023/021/R Page 432 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(b) Withstand simultaneous applications of normal and emergency braking

functions, unless adequate design measures have been taken to prevent such a
contingency.
(c) Meet the energy absorption requirements without auxiliary cooling devices
(such as cooling fans).
(d) Not induce unacceptable vibrations at any likely ground speed and condition or
any operating condition (such as retraction or extension).
(e) Protect against the ingress or effects of foreign bodies or materials (water, mud,
oil, and other products) that may adversely affect their satisfactory
performance.
(2) Respecting brake energy qualification limits
The ETSO standard for wheels and wheel and -

kinetic energy (KE) absorption capability of the brake assembly. The ETSO tests
demonstrate the KE absorption capability of the brake with that brake at a
predetermined (threshold) start temperature. Both of these tests are required to be

closely as practicable, be representative of a typical in-service con

Two methods are permitted and accepted by the Agency to calculate the energy
required to bring the heat pack to this representative thermal condition:
(a) by a rational analysis; or
(b) by the addition of a percentage of the KERT Wheel/Brake Rated Accelerate-Stop
-

A brake with an initial temperature higher than the threshold temperature has less KE
absorption capability than it has at the threshold temperature. This could lead to the
brake being unable to generate the required torque to stop the aeroplane in the
available distance, or being unable to safely dissipate the additional thermal energy
generated during the stop (hence, a risk of fire). Therefore, the applicant should ensure
that the demonstrated brake KE absorption capability is not exceeded when the brake
is installed on the aeroplane.
It should be demonstrated how the temperature thresholds, determined for the brake
qualification testing, will not be exceeded.
Acceptable methods of demonstrating this include, but are not limited to, the
following:
(a) use of brake temperature monitoring: by allowing the crew to check the brake
temperature prior to a take-off, it can be ensured that the brake temperature
does not exceed the temperature threshold of the demonstrated brake
qualification testing, or

Annex to ED Decision 2023/021/R Page 433 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(b) use of brake cool-down charts: by establishing the cool-down rate of the brake
heat sink, an estimate can be made that relates the energy absorbed by the
brake to its temperature and also to the appropriate cool-down time.
Appropriate limitations have to be specified in the Aeroplane Flight Manual (AFM)
(3) Refurbished and Overhauled Equipment. Refurbished and overhauled equipment is
equipment overhauled and maintained by the applicable OEM or its designee in
Manual (CMM) and associated
documents. It is necessary to demonstrate compliance of all refurbished

specifications. It is also necessary to verify that performances are compatible for any
combination of mixed brake configurations, including refurbished/overhauled and
new brakes. It is essential to assure that Aeroplane Flight Manual braking performance
and landing gear and aeroplane structural integrity are not adversely altered.
(4) Replacement and Modified Equipment. Replacement and modified equipment
includes changes to any approved wheel and brake assemblies not addressed under
paragraph 4a(3) of this AMC. Consultation with the aeroplane manufacturer on the
extent of testing is recommended. Particular attention should be paid to potential
differences in the primary brake system parameters (e.g., brake torque, energy
capacity, vibration, brake sensitivity, dynamic response, structural strength, and wear
state). If comparisons are made to previously approved equipment, the test articles
(other than the proposed parts to be changed) and conditions should be comparable,
as well as the test procedures and equipment on which comparative tests are to be
conducted. For wheel and brake assembly tests, the tyre size, manufacturer, and ply
rating used for the test should be the same and the tyre condition should be
comparable. For changes of any heat sink component parts, structural parts (including
the wheel), and friction elements, it is necessary to provide evidence of acceptable
performance and compatibility with the aeroplane and its systems.
(5) The following apply to both refurbished and overhauled equipment as well as to
replacement and modified equipment:
(a) Minor Changes. Changes to a brake might be considered as a minor change, as
long as the changes are not to the friction elements. The proposed change
cannot affect the aeroplane stopping performance, brake energy absorption
characteristics, and/or continued airworthiness of the aeroplane or wheel and
brake assembly (e.g., vibration and/or thermal control, and brake retraction
integrity). Technical evidence justifying a minor change should be provided.
(b) Major Changes. Changes to a wheel or brake assembly outside the limits allowed
b
airworthiness issues.
(c) Past history with friction elements has indicated the necessity of ongoing
monitoring (by dynamometer test) of frictional and energy absorption
capabilities to assure that they are maintained over the life of the aeroplane
program. These monitoring plans have complemented the detection and
correction of unacceptable deviations. A monitoring plan should be submitted

Annex to ED Decision 2023/021/R Page 434 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

to the cognisant Certification Office to ensure continued airworthiness of the

product.
(d) Intermixing of wheel and brake assemblies from different suppliers is generally
not acceptable due to complexities experienced with different friction elements,
specific brake control tuning, and other factors.
b. Ref. CS 25.735(b) Brake System Capability
(1) The system should be designed so that no single failure of the system degrades the
aeroplane stopping performance beyond doubling the braked roll stopping distance
(refer to CS 25.735(b)(1)). Failures are considered to be fracture, leakage, or jamming
of a component in the system, or loss of an energy source. Components of the system
include all parts that contribute to transmitting the pilot's braking command to the
actual generation of braking force. Multiple failures resulting from a single cause
should be considered a single failure (e.g., fracture of two or more hydraulic lines as a
result of a single tyre failure). Sub-components within the brake assembly, such as
brake discs and actuators (or their equivalents), should be considered as connecting or
transmitting elements, unless it is shown that leakage of hydraulic fluid resulting from
failure of the sealing elements in these sub-components within the brake assembly
would not reduce the braking effectiveness below that specified in CS 25.735(b)(1).
(a) In order to meet the stopping distance requirements of CS 25.735(b)(1) in the
event of failure of the normal brake system, it is common practice to provide an
alternate brake system. The normal and alternate braking systems should be
independent, being supplied by separate power sources. Following a failure of
the normal system, the changeover to a second system (whether manually or by
automatic means) and the functioning of a secondary power source should be
effected rapidly and safely. The changeover should not involve risk of wheel
locking, whether the brakes are applied or not at the time of changeover.
(b) The brake systems and components should be separated or appropriately
shielded so that complete failure of the braking system(s) as a result of a single
cause is minimised.
(2) Compliance with CS 25.735(b)(2) may be achieved by:
(a) Showing that fluid released would not impinge on the brake, or any part of the
assembly that might cause the fluid to ignite;
(b) Showing that the fluid will not ignite; or
(c) Showing that the maximum amount of fluid released is not sufficient to sustain
a fire.
(3) Additionally, in the case of a fire, it may be shown that the fire is not hazardous, taking
into consideration such factors as landing gear geometry, location of fire sensitive
(susceptibility) equipment and installations, system status, flight mode, etc.
If more than one fluid is allowed for the hydraulic system, compliance should be
addressed for all fluids.
c. Ref. CS 25.735(c) Brake Controls

Annex to ED Decision 2023/021/R Page 435 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(1) The braking force should increase or decrease progressively as the force or movement
applied to the brake control is increased or decreased (refer to CS 25.735(c)(1)). The
braking force should respond to the control as quickly as is necessary for safe and
satisfactory operation. A brake control intended only for parking need not operate

order to achieve a higher braking force with manual braking.

(2) When an automatic braking system is installed (refer to CS 25.735(c)(2)) such that
various levels of braking (e.g., low, medium, high) may be preselected to occur
automatically following a touchdown, the pilot(s) should be provided with a means
that is separate from other brake controls to arm and/or disarm the system prior to
the touchdown.
(3) The automatic braking system design should be evaluated for integrity and non-
hazard, including the probability and consequence of insidious failure of critical
components, and non interference with the non-automatic braking system. Single
failures in the automatic braking system should not compromise non-automatic
braking of the aeroplane. Automatic braking systems that are to be approved for use
in the event of a rejected take-off should have a single selector position, set prior to
take-off, enabling this operating mode.
d. Ref. CS 25.735(d) Parking Brake
It should be demonstrated that the parking brake has sufficient capability in all allowable
operating conditions (Master Minimum Equipment List (MMEL) to be able to prevent the
rotation of braked wheels. This demonstration is to be accomplished with the stated engine
power settings, and with the aeroplane configuration (i.e., ground weight, c.g., position and
nose-wheel (or tail-wheel) angle) least likely to result in skidding on a dry, level runway
surface (refer to CS 25.735(d)
mandatory, higher thrust levels may be used to prevent aeroplane motion due to the
asymmetric engine thrust. Where reliable test data are available, substantiation by means
other than aeroplane testing may be acceptable.
(1) For compliance with the requirement for indication that the parking brake is not fully
released, the indication means should be associated, as closely as is practical, with
actual application of the brake rather than the selector (control). The intent is to
minimise the possibility of false indication due to failures between the brake and the
point at which the parking brake state is sensed. This requirement is separate from,
and in addition, to the parking brake requirements associated with CS 25.703(a)(3),
Take-off warning systems.
(2) The parking brake control, whether or not it is independent of the emergency brake
control, should be marked with the words "Parking Brake" and should be constructed
in such a way that, once operated, it can remain in the selected position without
further flight crew attention. It should be located where inadvertent operation is
unlikely, or be protected by suitable means against inadvertent operation.
e. Ref. CS 25.735(e) Anti-skid System
(1) If an anti-skid system is installed (refer to CS 25.735(e)), then no single failure in the
antiskid system should result in the brakes being applied, unless braking is being

Annex to ED Decision 2023/021/R Page 436 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

commanded by the pilot. In the event of an anti-skid system failure, means should be
available to allow continued braking without anti-skid. These means may be automatic,
pilot controlled, or both.
(2) Compliance with CS 25.735(e)(1) and (e)(2) may be achieved by:
(a) Failures that render the system ineffective should not prevent manual braking
control by the pilot(s) and should normally be indicated. Failure of wheels,
brakes, or tyres should not inhibit the function of the anti-skid system for
unaffected wheel, brake, and tyre assemblies.
(b) The anti-skid system should be capable of giving a satisfactory braking
performance over the full range of tyre to runway friction coefficients and
surface conditions, without the need for preflight or pre-landing adjustments or
selections. The range of friction coefficients should encompass those
appropriate to dry, wet, and contaminated surfaces and for both grooved and
ungrooved runways.
(c) t
once the antiskid system has been optimised for operation over the full range
of expected conditions for which the aeroplane is to be type certificated, pre-
flight or pre-landing adjustments made to the equipment to enable the expected
capabilities to be achieved are not acceptable. For example, a specific
prelanding selection for a landing on a contaminated low µ (friction level)
runway, following a take-off from a dry high µ runway, should not be necessary
for satisfactory braking performance to be achieved.
(d) It should be shown that the brake cycling frequency imposed by the anti-skid
installation will not result in excessive loads on the landing gear. Anti-skid
installations should not cause surge pressures in the brake hydraulic system that
would be detrimental to either the normal or emergency brake system and
components.
(e) The system should be compatible with all tyre sizes and type combinations
permitted and for all allowable wear states of the brakes and tyres. Where
brakes of different types or manufacture are permitted, compatibility should be
demonstrated or appropriate means should be employed to ensure that
undesirable combinations are precluded.
(f) The anti-skid function must be able to reduce braking for a wheel/tyre that is
going into a skid, whether the braking level is commanded by the pilot or an
auto-brake system if installed.
f. Ref. CS 25.735(f) Kinetic Energy Capacity
The kinetic energy capacity of each tyre, wheel, and brake assembly should be at least equal
to that part of the total aeroplane energy that the assembly will absorb during a stop, with
the heat sink at a defined condition at the commencement of the stop (Refer to CS 25.735(f)).
(1) Calculation of Stop Kinetic Energy.

Annex to ED Decision 2023/021/R Page 437 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(a) The design landing stop, the maximum kinetic energy accelerate-stop, and the
most severe landing stop brake kinetic energy absorption requirements of each
wheel and brake assembly should be determined using either of the following
methods:
(i) A conservative rational analysis of the sequence of events expected
during the braking manoeuvre; or
(ii) A direct calculation based on the aeroplane kinetic energy at the
commencement of the braking manoeuvre.
(b) When determining the tyre, wheel, and brake assembly kinetic energy
absorption requirement using the rational analysis method, the analysis should
use conservative values of the aeroplane speed at which the brakes are first
applied, the range of the expected coefficient of friction between the tyres and
runway, aerodynamic and propeller drag, powerplant forward thrust, and, if
more critical, the most adverse single engine or propeller malfunction.
(c) When determining the tyre, wheel, and brake assembly energy absorption
requirement using the direct calculation method, the following formula, which
needs to be modified in cases of designed unequal braking distribution, should
be used:
KE = 0.0443 WV2/N (ft-lb.)
where KE = Kinetic Energy per wheel (ft-lb.)
N = Number of main wheels with brakes
W = Aeroplane Weight (lb.)
V = Aeroplane Speed (knots)
or if SI (Metric) units are used:
KE = 1/2 mV2/N (Joule)
where KE = Kinetic Energy per wheel (J)
N = Number of main wheels with brakes
m = Aeroplane Mass (kg.)
V = Aeroplane Speed (m/s)
(d) For all cases, V is the ground speed and takes into account the prevailing
operational conditions. All approved landing flap conditions should be
considered when determining the design landing stop energy.
(e) These calculations should account for cases of designed unequal braking

loads between wheels that result directly from the design of the aeroplane. An
example would be the use of both main-wheel and nosewheel brakes, or the use
of brakes on a centreline landing gear supporting lower vertical loads per braked
wheel than the main landing gear braked wheels. It is intended that this term

Annex to ED Decision 2023/021/R Page 438 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

should account for effects such as runway crown. Crosswind effects need not be
considered.
(f) For the design landing case, the aeroplane speed should not be less than
VREF/1.3, where VREF is the aeroplane steady landing approach speed at the
maximum design landing weight and in the landing configuration at sea level.
Alternatively, the aeroplane speed should not be less than VSO, the power-off
stall speed of the aeroplane at sea level, at the design landing weight, and in the
landing configuration.
(g) For the most severe landing case, the effects and consequences of typical single
and multiple failure conditions that are foreseeable events and can necessitate
landings at abnormal speeds and weights should be addressed. The critical
landing weight for this condition is the maximum take-off weight, less fuel
burned and jettisoned during a return to the departure airfield. A 30-minute
flight should be assumed, with 15 minutes of active fuel jettisoning if equipped
with a fuel jettisoning system.
(2) Heat Sink Condition at Commencement of the Stop.
(a) For the maximum kinetic energy accelerate-stop case, the calculation should
account for:
(i) The brake temperature following a previous typical landing,
(ii) The effects of braking during taxi-in, the temperature change while
parked,
(iii) The effects of braking during taxi-out, and
(iv) The additional temperature change during the take-off acceleration
phase, up to the time of brake application.
(b) The analysis may not take account of auxiliary cooling devices. Assessment of
ambient conditions within the operational limits established by the applicant
and the typical time the aeroplane will be on the ground should be used.
(c) For the most severe landing stop case, the same temperature conditions and
changes used for the maximum kinetic energy accelerate-stop case should be
assumed, except that further temperature change during the additional flight
phase may be considered.
(d) The brake temperature at the commencement of the braking manoeuvre should
be determined using the rational analysis method. However, in the absence of
such analysis, an arbitrary heat sink temperature should be used equal to the
normal ambient temperature, increased by the amount that would result from
a 10 percent maximum kinetic energy accelerate-stop for the acceleratestop
case and from a 5 percent maximum kinetic energy accelerate-stop for landing
cases. The temperature determined for the beginning of the test becomes the
highest allowable temperature at commencement of the take-off run unless
another test is performed at a higher temperature.
(3) Substantiation.

Annex to ED Decision 2023/021/R Page 439 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(a) Substantiation is required to show that the wheel and brake assembly is capable
of absorbing the determined levels of kinetic energy at all permitted wear states

to clarify that consideration should be given to possible inconsistencies or

irregularities in brake wear in some circumstances, such as greater wear at one
end of the heat sink than the other end. Qualification related to equally
distributed heat sink wear may not be considered adequate. If in-service wear
distribution is significantly different from wear distribution used during
qualification testing, additional substantiation and/or corrective action may be
necessary.
(b) The minimum initial brakes-on speed used in the dynamometer tests should not
be more than the velocity (V) used in the determination of the kinetic energy
requirements of CS 25.735(f). This assumes that the test procedure involved a
specific rate of deceleration and, therefore, for the same amount of kinetic
energy, a higher initial brakes-on speed would result in a lower rate of energy
absorption. Such a situation is recognised and is similarly stated in (E)TSO-C135,
which provides an acceptable means for brake approval under CS 25.735(a).
(c) For certification purposes, a brake having a higher initial brakes-on speed is
acceptable if the dynamometer test showed that both the energy absorbed and
the energy absorption rates required by CS 25.735(f) had been achieved.
(d) Brake qualification tests are not intended as a means of determining expected
aeroplane stopping performance, but may be used as an indicator for the most
critical brake wear state for aeroplane braking performance measurements.
g. Ref. CS 25.735(g) Brake Condition after High Kinetic Energy Dynamometer Stop(s)
(1) Following the high kinetic energy stop(s), the parking brake should be capable of
restraining further movement of the aeroplane and should maintain this capability for
the period during which the need for an evacuation of the aeroplane can be
determined and then fully accomplished. It should be demonstrated that, with a
parking brake application within a period not exceeding 20 seconds of achieving a full
stop, or within 20 seconds from the time that the speed is retarded to 37 km/h (20
knots) (or lower), in the event that the brakes are released prior to achieving a full stop
(as permitted by (E)TSO-C135), the parking brake can be applied normally and that it
remains functional for at least 3 minutes.
(2) Practical difficulties associated with dynamometer design may preclude directly
demonstrating the effectiveness of the parking brake in the period immediately
following the high energy dynamometer stop(s). Where such difficulties prevail, it
should be shown that, for the 3-minute period, no structural failure or other condition
of the brake components occurs that would significantly impair the parking brake
function.
(3) Regarding the initiation of a fire, it should be demonstrated that no continuous or
sustained fire, extending above the level of the highest point of the tyre, occurs before
the 5-minute period has elapsed. Neither should any other condition arise during this
same period or during the stop, either separately or in conjunction with a fire, that

Annex to ED Decision 2023/021/R Page 440 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

could be reasonably judged to prejudice the safe and complete aeroplane evacuation.
Fire of a limited extent and of a temporary nature (e.g., those involving wheel bearing
lubricant or minor oil spillage) is acceptable. For this demonstration, neither fire-
fighting means nor coolants may be applied.
h. Ref. CS 25.735(h) Stored energy systems
(1) Stored energy systems use a self-contained source of power, such as a pressurised
hydraulic accumulator or a charged battery (refer to CS 25.735(h)). This requirement
is not applicable for those aeroplanes that provide a number of independent braking
systems, including a stored energy system, but are not "reliant" on the stored energy
system for the demonstration of compliance with CS 25.735(b).
(2) The indication of usable stored energy should show:
(a) The minimum energy level necessary to meet the requirements of CS
25.735(b)(1) and (h) (i.e., the acceptable level for dispatch of the aeroplane);
(b) The remaining energy level; and
(c) The energy level below which further brake application may not be possible.
(3) If a gas pressurised hydraulic accumulator is to be used as the energy storage means,
indication of accumulator pressure alone is not considered adequate means to indicate
available stored energy, unless verification can be made of the correct pre-charge
pressure with the hydraulic system pressure off and the correct fluid volume with the
hydraulic system pressure on. Furthermore, additional safeguards may be necessary
to ensure that sufficient energy will be available at the end of the flight. Similar
considerations should be made if other stored energy systems are used.
(4) A full brake application cycle is defined as an application from brakes fully released to
brakes fully applied, and back to fully released.
i. Ref. CS 25.735(i) Brake wear indicators
The indication means should be located such that no special tool or illumination (except in
darkness) is required. Expert interpretation of the indication should not be necessary (refer
to CS 25.735(i)).
j. Ref. CS 25.731(d) and CS 25.735(j) Over-temperature and Over-pressure Burst Prevention
Over-temperature and over-pressure burst prevention. Generally, two separate types of
protection should be provided: one specifically to release the tyre pressure should the wheel
temperature increase to an unacceptable level, and the other to release the tyre pressure
should the pressure become unacceptably high, particularly during the inflation process. The
temperature sensitive devices are required in braked wheels only, but the pressure sensitive
devices are required in all wheels (refer to CS 25.735(j) and 25.731(d)).
(1) The temperature sensitive devices (e.g., fuse or fusible plugs) should be sufficient in
number and appropriately located to reduce the tyre pressure to a safe level before
any part of the wheel becomes unacceptably hot, irrespective of the wheel orientation.
The devices should be designed and installed so that once operated (or triggered) their
continued operation is not impaired by the releasing gas. The effectiveness of these

Annex to ED Decision 2023/021/R Page 441 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

devices in preventing hazardous tyre blow-out or wheel failure should be

demonstrated. It should also be demonstrated that the devices will not release the
tyre pressure prematurely during take-
tu
(2) It should be shown that the over-pressurisation devices, or the devices in conjunction
with the tyre inflation means permanently installed in the wheel, would not permit the
tyre pressure to reach an unsafe level regardless of the capacity of the inflation source.
(3) Both types of devices should normally be located within the structure of the wheel in
positions that minimise the risk of damage or tampering during normal maintenance.
k. Ref. CS 25.735(k) Compatibility
Compliance with CS 25.735(k) may be achieved by the following:
(1) As part of the overall substantiation of safe and anomaly free operation, it is necessary
to show that no unsafe conditions arise from incompatibilities between the brakes and
brake system with other aeroplane systems and structures. Areas that should be
explored include anti-skid tuning, landing gear dynamics, tyre type and size, brake
combinations, brake characteristics, brake and landing gear vibrations, etc. Similarly,
wheel and tyre compatibility should be addressed. These issues should be readdressed
when the equipment is modified.
(2) During brake qualification testing, sufficient dynamometer testing over the ranges of
permissible brake wear states, energy levels, brake pressures, brake temperatures,
and speeds should be undertaken to provide information necessary for systems
integration.
l. Ref. CS 25.735(l) Wheel brake temperature.
The use of fusible plugs in the wheels is not a complete safeguard against damage due to tyre
burst. Where brake overheating could be damaging to the structure of, or equipment in, the
wheel wells, an indication of brake temperature should be provided to warn the pilot.
[Amdt No: 25/2]
[Amdt No: 25/8]
[Amdt No: 25/12]
[Amdt No: 25/14]
[Amdt No: 25/18]
[Amdt 25/28]

AMC 25.735(f) Brakes

For determination of the design landing brake kinetic energy capacity rating, the initial condition of the
brakes may be selected and can be any condition representative of service use, including new, and which
satisfies the applicable ETSO or other acceptable brake qualification test standard.

Annex to ED Decision 2023/021/R Page 442 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

CS 25.745 Nose-wheel steering

(See AMC 25.745)
(a) The nose-wheel steering system, unless it is restricted in use to low-speed manoeuvring, must be
so designed that exceptional skill is not required for its use during take-off and landing, including
the case of cross-wind, and in the event of sudden power-unit failure at any stage during the take-
off run. This must be shown by tests. (See AMC 25.745(a).)
(b)
(including movement during retraction or extension or after retraction of the landing gear) cannot
interfere with the correct retraction or extension of the landing gear.
(c) Under failure conditions the system must comply with CS 25.1309(b) and (c). The arrangement of
the system must be such that no single failure will result in a nose-wheel position, which will lead
to a Hazardous Effect. Where reliance is placed on nose-wheel steering in showing compliance with
CS 25.233, the nose-wheel steering system must be shown to comply with CS 25.1309. (See AMC
25.745(c).)
(d) The nose-wheel steering system, towing attachment(s), and associated elements must be designed
or protected by appropriate means such that during ground manoeuvring operations effected by
means independent of the aeroplane:
(1) Damage affecting the safe operation of the nose-wheel steering system is precluded, or
(2) A flight crew alert is provided, before the start of taxiing, if damage may have occurred (see
AMC 25.1322).
(See AMC 25.745(d))
(e) Unless the nose-wheel, when lowered, is automatically in the fore-and-aft attitude successful
landings must be demonstrated with the nose-wheel initially in all possible off-centre positions.
[Amdt 25/2]
[Amdt 25/13]
[Amdt 25/18]

AMC 25.745(a) Nose-wheel steering

In a powered nose-wheel steering system the normal supply for steering should continue without
interruption in the event of failure of any one power-unit. With the remaining power-units operating at
ground idling condition, the power supply should be adequate
a. To complete an accelerate-stop manoeuvre following a power-unit failure which occurs during
take-off, and
b. To complete a landing manoeuvre following a power-unit failure which occurs during take-off or at
any later stage of flight.

Annex to ED Decision 2023/021/R Page 443 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

AMC 25.745(c) Nose-wheel steering

1 No failure or disconnection need be assumed in respect of parts of proven integrity e.g. a simple
jack or manual selector valve, but slow leakage from pipe joints and fracture of pipes should be
considered as probable failures.
2 In assessing where the inadvertent application of steering torque as a result of a single failure would

However, dependent on the urgency and rapidity of warning of the failure given to the pilot,
allowance should be made for a reaction time before it is assumed that the pilot takes any
corrective action.

AMC 25.745(d) Nose-wheel steering

CS 25.745(d) provides for the two following options:
1.
2. Damage can occur, but indication to the flight crew is provided.
(a) General consideration to CS 25.745(d)(1) and (2)
Some damage may occur during ground manoeuvring activities that can be considered
acceptable and judged to be normal wear and tear. It is not intended that such damage needs
necessarily to be precluded or that it should initiate a flight crew alert.
(b) To comply with CS 25.745(d)(1) the following applies:
The aeroplane may be designed in such a way that under all ground manoeuvring operations
by any towing means, no damage affecting the steering system can occur.
Examples are:
The steering system is designed sufficiently strong to resist any applied towing input.
The steering system is designed to allow 360 degrees rotation.
The steering system is disconnected either automatically or by operational procedure.
The steering system is protected by shear sections installed on the nose landing gear.
(c) To comply with CS 25.745(d)(2), the following applies:
When protection is afforded by the flight crew alerting system, the damage detection means
should be independent of the availability of aeroplane power supplies and should be active
during ground manoeuvring operations effected by means independent of the aeroplane. If
damage may have occurred, a latched signal should be provided to the flight crew alerting
system.
(d) Alternative Acceptable Means of Compliance to CS 25.745(d)(1) and (2):
In the case where the aeroplane design does not comply with CS 25.745(d)(1) and (d)(2), the
following apply:

Annex to ED Decision 2023/021/R Page 444 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
LANDING GEAR

(1) The Aeroplane Flight Manual, in the Section Limitations, should include a statement

(2) The Aeroplane Flight Manual, in the Section Limitations, should include a statement
that:

performed in compliance with the appropriate operational regulation using towbarless

towing vehicles that are designed and operated to preclude damage to the aeroplane
nose wheel steering system, or which provide a reliable and unmistakable warning
when damage to the steering system has occurred.
Towbarless towing vehicles that are specifically accepted for this type of aeroplane are
listed in the [appropriate maintenance documentation] provided by the aeroplane

ns Instructions for Continued

Airworthiness as described in Appendix H, paragraph H25.3(a)(4) of CS-25.
(3) The acceptance by the aeroplane manufacturer of the applicable towbarless towing
vehicles and its reliability of the oversteer protection and/or indication system as
referred to in subparagraph ((d)(2)) above should be based on the following:
(i) The aeroplane Nose Wheel Steering Failure Analysis should include the effects
of possible damage caused by towbarless towing operations.
(ii) If the Nose Wheel Steering Failure Analysis shows that damage to the steering
system by the use of towbarless towing may result in a Failure Condition that
can be classified as Hazardous or Catastrophic (refer to CS 25.1309), the
acceptance of a towing vehicle oversteer protection and/or indication system
should be based on an aeroplane safety analysis, encompassing the reliability of
that vehicle system in order to meet the aeroplane safety objectives.
(iii) If the Nose Wheel Steering Failure Analysis shows that damage to the steering
system by the use of towbarless towing may result in a Failure Condition that
can be classified as Major or less severe, the aeroplane manufacturer can accept
the design of the towing vehicle oversteer indication and/or protection system

manufacturer. This declaration will state that the vehicle design complies with
the applicable standards (SAE ARPs, Aeroplane Towing Assessment Criteria
Document) and that it is designed and built under ISO 9001 quality standards or
equivalent.
Such a declaration must be made regarding all Towbarless Towing Vehicles to
be used for ground manoeuvring of CS-25 certificated aeroplanes.
[Amdt 25/13]

Annex to ED Decision 2023/021/R Page 445 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.771 Pilot compartment

(a) Each pilot compartment and its equipment must allow the minimum flight crew (established under
CS 25.1523) to perform their duties without unreasonable concentration or fatigue.
(b) The primary controls listed in CS 25.779(a), excluding cables and control rods, must be located with
respect to the propellers so that no member of the minimum flight crew (established under CS
25.1523), or part of the controls, lies in the region between the plane of rotation of any inboard
propeller and the surface generated by a line passing through the centre of the propeller hub
making an angle of 5° forward or aft of the plane of rotation of the propeller.
(c) If provision is made for a second pilot, the aeroplane must be controllable with equal safety from
either pilot seat.
(d) The pilot compartment must be constructed so that, when flying in rain or snow, it will not leak in
a manner that will distract the crew or harm the structure.
(e) Vibration and noise characteristics of cockpit equipment may not interfere with safe operation of
the aeroplane.

CS 25.772 Pilot compartment doors

For an aeroplane that has a lockable door installed between the pilot compartment and the passenger
compartment: -
(a) For aeroplanes with passenger seating configuration of 20 seats or more, the emergency exit
configuration must be designed so that neither crewmembers nor passengers require use of the
flight deck door in order to reach the emergency exits provided for them; and
(b) Means must be provided to enable flight-crew members to directly enter the passenger
compartment from the pilot compartment if the cockpit door becomes jammed.
(c) There must be an emergency means to enable a crewmember to enter the pilot compartment in
the event that the flight crew becomes incapacitated.

CS 25.773 Pilot compartment view

(See AMC 25.773)
(a) Non-precipitation conditions. For non-precipitation conditions, the following apply:
(1) Each pilot compartment must be arranged to give the pilots a sufficiently extensive, clear,
and undistorted view, to enable them to safely perform any manoeuvres within the operating
limitations of the aeroplane, including taxiing, take-off, approach and landing.
(2) Each pilot compartment must be free of glare and reflection that could interfere with the
normal duties of the minimum flight crew (established under CS 25.1523). This must be
shown in day and night flight tests under non-precipitation conditions.

Annex to ED Decision 2023/021/R Page 446 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(b) Precipitation conditions. For precipitation conditions, the following apply:

(1) The aeroplane must have a means to maintain a clear portion of the windshield during
precipitation conditions, sufficient for both pilots to have a sufficiently extensive view along
the flight path in normal flight attitudes of the aeroplane. This means must be designed to
function, without continuous attention on the part of the crew, in
(i) Heavy rain at speeds up to 1·5 VSR1, with lift and drag devices retracted; and
(ii) The icing conditions specified in Appendix C and the following icing conditions specified
in Appendix O, if certification for flight in icing conditions is sought (See AMC
25.773(b)(1)(ii)):
(A) For aeroplanes certificated in accordance with CS 25.1420(a)(1), the icing
conditions that the aeroplane is certified to safely exit following detection.
(B) For aeroplanes certificated in accordance with CS 25.1420(a)(2), the icing
conditions that the aeroplane is certified to safely operate in and the icing
conditions that the aeroplane is certified to safely exit following detection.
(C) For aeroplanes certificated in accordance with CS 25.1420(a)(3), all icing
conditions.
(2) No single failure of the systems used to provide the view required by sub-paragraph (b)(1) of
this paragraph must cause the loss of that view by both pilots in the specified precipitation
conditions.
(3) The first pilot must have a window that:
(i) is openable under the conditions prescribed in sub-paragraph (b)(1) of this paragraph
when the cabin is not pressurised;
(ii) provides the view specified in (b)(1); and
(ii)
(4) The openable window specified in sub-paragraph (b)(3) of this paragraph need not be
provided if it is shown that an area of the transparent surface will remain clear sufficient for
at least one pilot to land the aeroplane safely in the event of -
(i) Any system failure or combination of failures, which is not, Extremely Improbable in
accordance with CS 25.1309, under the precipitation conditions specified in sub-
paragraph (b)(1) of this paragraph.
(ii) An encounter with severe hail, birds, or insects. (See AMC 25.773(b)(4))
(c) Internal windshield and window fogging. The aeroplane must have a means to prevent fogging to
the internal portions of the windshield and window panels over an area which would provide the
visibility specified in sub-paragraph (a) of this paragraph under all internal and external ambient
conditions, including precipitation conditions, in which the aeroplane is intended to be operated.
(See AMC 25.773(c))
(d) Fixed markers or other guides must be installed at each pilot station to enable the pilots to position
themselves in their seats for an optimum combination of outside visibility and instrument scan. If
lighted markers or guides are used they must comply with the requirements specified in CS 25.1381.

Annex to ED Decision 2023/021/R Page 447 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

[Amdt No: 25/3]

[Amdt No: 25/4]
[Amdt No: 25/16]
[Amdt No: 25/18]

AMC 25.773 Pilot compartment view

The FAA Advisory Circular AC 25.7731: Pilot Compartment View Design Considerations (January 8, 1993),
may be used to support the demonstration of compliance with CS 25.773.
[Amdt 25/4]
[Amdt 25/16]

AMC 25.773(b)(1)(ii) Pilot compartment view in icing conditions

CS 25.773(b)(1)(ii) requires that the aeroplane have a means of maintaining a clear portion of windshield
in the icing conditions defined in Appendix C and in certain Appendix O icing conditions (corresponding to
the CS 25.1420 certification option selected).
The effectiveness of all cockpit windows and windshield ice and precipitation protective systems should
be established within relevant icing environment. Sufficient tests, including flight test in natural or
simulated Appendix C icing conditions, should be performed to validate the performance prediction done
by analysis.
When thermal ice protection systems are used (e.g. electrical heating system), a thermal analysis should
be conducted to substantiate the selected nominal heated capacity. Past certification experience has
shown that a nominal heating capacity of 70 W/dm2 provide adequate protection in icing conditions; such
value, if selected, should anyway be substantiated by the thermal analysis. The applicant should conduct
dry air flight tests to verify the thermal analysis. Measurements of both the inner and outer surface
temperature of the protected windshield area may be needed to verify the thermal analysis. The thermal
analysis should show that the windshield surface temperature is sufficient to maintain anti-icing capability
without causing structural damage to the windshield.
When anti-icing fluid systems are used, tests shall be performed to demonstrate that the fluid does not
become opaque at low temperatures. The AFM should include information advising the flight crew how
long it will take to deplete the amount of fluid remaining in the reservoir.
An evaluation of visibility, including distortion effects through the protected area, should be made for
both day and night operations. In addition, the size and location of the protected area should be reviewed
to confirm that it provides adequate visibility for the flight crew, especially during the approach and
landing phases of flight.
For showing compliance with the CS-25 certification specifications relative to SLD icing conditions
represented by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides
guidance for comparative analysis.
[Amdt 25/16]
[Amdt 25/18]

Annex to ED Decision 2023/021/R Page 448 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.773(b)(4) Pilot compartment non openable windows

Total loss of external visibility is considered catastrophic. A sufficient field of view must exist to allow the
pilot to safely operate the aeroplane during all operations, including taxi.
This field of view must remain clear in all operating conditions. Precipitation conditions such as outside
ice, heavy rain, severe hail, as well as encounter with birds and insects must be considered.
This AMC material applies to conventional, multiple pane window systems, i.e. those which are composed
of a main windshield and separate side panels assembled with structural posts. In the event a one piece
-
even though there are no separate side windows.
1. Ice and heavy rain
Unless system failures leading to loss of a sufficient field of view for safe operation are
shown to be extremely improbable, the following provides acceptable means to show
compliance with CS 25.773(b)(4):
Each main windshield should be equipped with an independent protection system. The
systems should be designed so that no malfunction or failure of one system will adversely
affect the other.
For each forward side window it should be shown that any ice accumulations (Appendix C
icing conditions and any applicable Appendix O icing conditions) will not degrade visibility,
or the applicant should provide individual window ice protection system capability.
The icing accretion limits should be determined by analysis and verified by test. The extent
of icing of side windows should be verified during natural or simulated icing flight tests with
window ice protection systems unpowered. A limited number of test points, sufficient to
validate the analysis, are required within Appendix C or Appendix O.
For the demonstration of compliance under Appendix O icing conditions, the applicant may
use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.
2. Hail, birds and insects
It should be shown by flight tests that exceptional pilot skill is not required to land the aeroplane
using the normal aeroplane instruments and the view provided through the main or side windows
having the degree of impairment to vision resulting from the encounter of severe hail, birds or
insects. Appropriate test data should substantiate the estimated damage or contamination to the
main or forward side windows during such an encounter.
It is unlikely that hail damage can be avoided. Rather than avoidance, the approach to ensure vision
assuming hail strike has been to use damage assessment criteria contained in the ASTM
International "Standard Test Method for Hail Impact Resistance of Aerospace Transparent
Enclosures," ANSI/ASTM F 320-10 or equivalent. For the test set up to determine hail damage or
windshield resistance to hail, reference can be made to ANSI/ASTM F 320-10, and "Global Climatic
Data for Developing Military Products" MIL HDBK 310 (dated 23 June 1997).
For each impacted window, ANSI/ASTM 320-10 is used to characterize a damage pattern on a
limited area of the window. For test purpose, the simulated damage patterns should be applied to

Annex to ED Decision 2023/021/R Page 449 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

the full impacted window surfaces in order to simulate in a conservative manner the visibility
degradation through the windows.
The applicant should propose and substantiate the aircraft conditions when hail strike occurs. In
the absence of such substantiation, the conservative assumptions will be to consider the maximum
aircraft nominal speed combined with the hailstone falling speed.
When the damages are such that there is no remaining visibility through the windshield after hail
encounter, or when the ice protection system is no longer operating after the hail encounter, a
typical test configuration would be to block visibility out of the forward main windows for the pilot
flying, and use simulated damage (if any) and ice accretions (if applicable) on the side window(s).
When conducting flight tests, adequate forward vision should be maintained for a safety pilot while
providing appropriate forward view degradation for the test pilot.
Means of compliance to address birds and insects should be proposed by the applicant. The Agency
is not aware of any in-service occurrence involving a total loss of visibility through the windshield
after birds or insects encounter.
[Amdt 25/16]
[Amdt 25/18]

AMC 25.773(c) Internal windshield and window fogging

In absence of pilot compartment openable windows, if the failures of the means to prevent fogging cannot
be shown to be extremely improbable, the applicant should show that a sufficient field of view is
maintained to allow the pilot to safely operate the aeroplane during all operations, including taxi. This
should be accomplished by the following:
The extent of fogging should be established and verified during flight tests with the means to prevent
fogging inoperative,
If it is proposed that the flight crew must take action to remove inside fogging, the effectiveness of
the associated operational procedure should be demonstrated by flight test.
[Amdt 25/16]

CS 25.775 Windshields and windows

(See AMC 25.775)
(a) Internal panes must be made of non-splintering material.
(b) Windshield panes directly in front of the pilots in the normal conduct of their duties, and the
supporting structures for these panes, must withstand, without penetration, the bird impact
conditions specified in CS 25.631.
(c) Unless it can be shown by analysis or tests that the probability of occurrence of a critical windshield
fragmentation condition is of a low order, the aeroplane must have a means to minimise the danger
to the pilots from flying windshield fragments due to bird impact. This must be shown for each
transparent pane in the cockpit that
(1) Appears in the front view of the aeroplane;

Annex to ED Decision 2023/021/R Page 450 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(2) Is inclined 15° or more to the longitudinal axis of the aeroplane; and
(3) Has any part of the pane located where its fragmentation will constitute a hazard to the
pilots.
(d) The design of windshields and windows in pressurised aeroplanes must be based on factors peculiar
to high altitude operation, including the effects of continuous and cyclic pressurisation loadings,
the inherent characteristics of the material used, and the effects of temperatures and temperature
differentials. The windshield and window panels must be capable of withstanding the maximum
cabin pressure differential loads combined with critical aerodynamic pressure and temperature
effects after any single failure in the installation or associated systems. It may be assumed that,
after a single failure that is obvious to the flight crew (established under CS 25.1523), the cabin
pressure differential is reduced from the maximum, in accordance with appropriate operating
limitations, to allow continued safe flight of the aeroplane with a cabin pressure altitude of not
more than 4572m (15 000 ft) (see AMC 25.775(d)).
(e) The windshield panels in front of the pilots must be arranged so that, assuming the loss of vision
through any one panel, one or more panels remain available for use by a pilot seated at a pilot
station to permit continued safe flight and landing.
[Amdt 25/18]

AMC 25.775(d) Windshields and windows

1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating
compliance with the provisions of CS-25 pertaining to the certification requirements for
windshields, windows, and mounting structure. Guidance information is provided for showing
compliance with CS 25.775(d), relating to structural design of windshields and windows for
aeroplanes with pressurised cabins.
2. RELATED CS PARAGRAPHS.
CS 25.775 Windshields and windows.
CS 25.365 Pressurised compartment loads.
CS 25.773(b)(3)(ii) Pilot compartment view.
CS 25.571 Damage-tolerance and fatigue evaluation of structure
3. DEFINITIONS.
a. Annealed glass. Glass that has had the internal stresses reduced to low values by heat
treatment to a suitable temperature and controlled cooling.
b. Chemically toughened glass. Annealed glass immersed in a bath of molten salt resulting in an
ion exchange between the salt and the glass. The composition of the salt is such that this ion
exchange causes the surface of the glass to be distorted (expansion), thus putting the surface
in a state of compression.
c. Creep. The change in dimension of a material under load over a period of time, not including
the initial instantaneous elastic deformation. The time dependent part of strain resulting
from an applied stress.

Annex to ED Decision 2023/021/R Page 451 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

d. Cross-linking. The setting up of chemical links between molecular chains.

e. Modulus of Rupture (MOR). The maximum tensile or compressive longitudinal stress in a
surface fibre of a beam loaded to failure in bending calculated from elastic theory.
f. Mounting. The structure that attaches the panel to the aircraft structure.
g. Notch sensitive. The extent to which the sensitivity of a material to fracture is increased by
the presence of a surface non-homogeneity, such as a notch, a sudden change in cross
section, a crack, or a scratch. Low notch sensitivity is usually associated with ductile materials,
and high notch sensitivity is usually associated with brittle materials.
h. Pane/Ply. The pane/ply is a single sheet of transparent material.
i. Panel. The panel is the complete windshield or window excluding the mounting.
j. Thermally toughened glass. Annealed glass heated to its softening temperature after which
the outer surfaces are rapidly cooled in a quenching medium resulting in the outer surface
being put into a state of compression with the core material in tension to maintain
equilibrium.
k. Toughened glass. Annealed glass placed into a state of compressive residual stress, with the
internal bulk in a compensating tensile stress. Toughening may be achieved by either thermal
or chemical processes.
4. BACKGROUND. Fail-safe designs have prevented depressurisations in a considerable number of
windshield failure incidents. There are few transparent materials for aircraft windshield and
window applications, and due to their inherent material characteristics, they are not as structurally
versatile as metallic materials. Transparent materials commonly used in the construction of
windshields and windows are glass, polymethyl-methacrylate (acrylic), polycarbonate, and
interlayer materials. The characteristics of these materials require special engineering solutions for
aircraft windshield and window panel designs.
a. Glass. In general, glass has good resistance to scratching and chemical attack, such as wiper
action, solvents, and de-icing fluid. Windshield and window panel designs, however, should
take into account its other unique properties, which are considerably different from metals.
(1) Glass exhibits no sharp change in physical properties when heated or cooled and has
no definite melting point.
(2) Unlike metals, glass is a hard brittle material that does not exhibit plastic deformation.
(3) Glass is much stronger in compression than in tension. Fracture will occur, under any
form of loading, when the induced deformation causes the tensile stress to exceed the
Modulus of Rupture (MOR).
(4) The strength of glass varies with the rate of loading; the faster the rate of loading the
higher the strength, as is the case for bird impact loading. In addition, glass fracture
stress for a load of short duration will substantially exceed that for a sustained load.
(5) The strength of glass, whether annealed or toughened, can be reduced by edge and
surface damage such as scratches, chips, and gouges. Failure is usually initiated at
some point of mechanical damage on the surface. However, thermal or chemical
toughening can considerably increase the fracture strength of annealed glass.

Annex to ED Decision 2023/021/R Page 452 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(6) Safety factors necessary on glass components. The safety factors necessary for glass
components are significantly higher than for other materials used in aircraft
construction because of: the loss of strength with duration of load, the variability in
strength inherent in glass, and the thickness tolerances and high notch sensitivity.
(7) There are generally two types of toughened glass:
(a) Thermally toughened glass. The surface of annealed glass may be placed in a
state of compression by heating the glass to its softening temperature after
which the outer surfaces are rapidly cooled in a quenching medium. As
mentioned, this results in the outer surface being put into a state of compression
with the core material in tension to maintain equilibrium. The surface
compressive layer in thermally toughened glass is approximately 18 percent of
the total thickness of the glass. There are limitations on the minimum thickness
of glass that can be effectively toughened by thermal processing. Very thin glass
can not be effectively toughened by these methods. In general, toughening can
increase the MOR of a piece of glass by approximately 3.5 to 20 times. Thermally
toughened glass has significant stored energy within it. This energy is released
to a certain extent when the glass fractures. Generally, the higher the stored
energy the smaller particles are on fracture. Since thermal toughening leaves
the glass with high compressive stresses in its surfaces, all cutting, grinding, or
shaping must be done before toughening.
(b) Chemically toughened glass. Chemically toughening glass is achieved by
immersion in a bath of molten salt of controlled composition. During the
immersion process larger alkali ions in the salt replace smaller alkali ions in the
surface of the glass. As a consequence of this unequal alkali ion exchange
process, the structure of the surface of the glass is distorted by putting the
surface in a state of compression similar to that of thermally toughened glass.
Depending on the original glass composition and the bath processing, chemically
toughened glass may have a compressive layer from 0.050 mm (0.002 inches) to
over 0.50 mm (0.020 inches) regardless of the total glass thickness. The
compression stress of chemically toughened glass can be made much higher
than it can using thermal toughening. As the compressive layer in chemically
toughened glass is much smaller than in thermally toughened glass, the stored
energy within the glass does not cause the same visibility problems after failure.
However, as with thermally toughened glass all cutting, grinding, and shaping
must be done prior to toughening.
b. Polymethyl-methacrylate (acrylic). The acrylic materials used for aircraft transparent
structural panels are unplasticised methyl-methacrylate based polymers. There are two basic
forms of acrylic materials used in aircraft windshield and window panels, as-cast and biaxially
stretched (stretched from a cross-linked base material).
(1) As-cast acrylic material: Forming acrylic material to a certain shape by pouring it into a
mould and letting it harden without applying external pressure. Although not as notch
sensitive as glass, unstretched acrylics have a notch sensitivity. This unplasticised
methyl-methacrylate base polymer has good forming characteristics, optical
characteristics and outdoor weathering properties.

Annex to ED Decision 2023/021/R Page 453 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(2) Biaxially stretched acrylic material: Stretching acrylic material aligns the polymer
chains to give a laminar structure parallel to the axis of stretch, which enhances
resistance to crazing, reduces crack propagation rates, and improves tensile
properties. Stretching acrylic material reduces the materials formability. In addition,
stretched acrylics have less notch sensitivity than unstretched acrylics.
(3) Properties. Compared with glass, these acrylics are soft and tough. In general,
increasing the temperature causes a decrease in the mechanical properties of the
material, increased temperature does not affect acrylic elongation and impact
properties.
(4) Crazing. Both basic forms of acrylics used in aircraft transparencies are affected by
crazing. Crazing is a network of fine cracks that extend over the surface of the plastic
sheet (it is not confined to acrylic materials) and are often difficult to discern. These
fine cracks tend to be perpendicular to the surface, very narrow, and are usually less
than 0.025mm (.0010 inches) in depth. Crazing is induced by prolonged exposure to
surface tensile stresses above a critical level or by exposure to organic fluids and
vapours.
(a) Stress crazing may be derived from: residual stresses caused by poor forming
practice; residual surface stresses induced by machining, polishing, or gouging;
and prolonged loading inducing relatively high tensile stresses at a surface.
(b) Stress crazing has a severe effect on the mechanical properties of acrylics;
however, the effects are reduced in stretched materials.
(c) Stress crazing affects the transparency of acrylics. Generally, stretched acrylic
panels will be replaced due to loss of transparency from stress crazing before
significant structural degradation occurs.
(5) Chemical resistance of acrylic materials. Typically, acrylic materials are resistant to
inorganic chemicals and to some organic compounds, such as aliphatic (paraffin)
hydrocarbons, hydrogenated aromatic compounds, fats, and oils.
(a) Acrylic materials are attacked and weakened by some organic compounds such
as aromatic hydrocarbons (benzene), esters (generally in the form of solvents,
and some de-icing fluids), ketones (acetone), and chlorinated hydrocarbons.
Some hydraulic fluids are very detrimental to acrylic materials.
(b) Some detrimental compounds can induce crazing; others may dissolve the
acrylic or be absorbed in the material. Crazing induced by solvent and other
organic compounds has more severe effects on the mechanical properties than
stress crazing. Dissolution of the acrylic and chemical absorption into the acrylic
degrades the mechanical properties.
c. Polycarbonate. Polycarbonate is an amorphous thermoplastic with a glass transition
temperature about 150°C, which shows large strain-to-break and high impact strength
properties throughout the normal temperature range experienced by transport aircraft.
Polycarbonate not only has significantly greater impact strength properties but also higher
static strength properties when compared to acrylic materials.

Annex to ED Decision 2023/021/R Page 454 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(1) Polycarbonate exhibits very high deflections under impact conditions, which can result
in higher loading into the aircraft structure, compared to glass or acrylic windshield
and window panels.
(2) Polycarbonate polymer is very susceptible to degradation by the environment, due to
moisture absorption and solvent stress cracking, as well as UV degradation. It is
possible to prevent degradation by using good design and production practices and
incorporating coatings and other forms of encapsulation. Polycarbonate also suffers
from phenomena known as physical aging. This results in the change from ductile
properties to brittle properties that occur when polycarbonate is exposed to
temperatures between 80°C and 130°C.
(3) Polycarbonate and stretched acrylic fatigue properties are similar to metals when
working (design) stresses are used for operating pressure loading design.
d. Interlayer Materials. Interlayer materials are transparent adhesive materials used to laminate
glass and plastic structural plies for aircraft applications. Current choices are limited to
plasticised polyvinyl butyral (incompatible with polycarbonate), polyurethane, and silicone.
The most commonly used are true thermoplastics, but some polyurethanes and all silicones
contain some cross-linking.
(1) Interlayer materials are considered to be non-structural because they do not directly
support aircraft loads. However, glass windshields are often attached to the airframe
structure through metal inserts bonded to the interlayer. For such designs the residual
strength of the windshield in a condition where all glass plies have failed may be
dependent upon the strength of the interlayer. In addition, the shear coupling
effectiveness of the interlayer has a great influence on the stiffness of the laminate.
(2) Most interlayer materials are susceptible to moisture ingress into the laminate and are
protected by compatible sealants in aircraft service.
(3) Interlayer materials, like structural plies, have a useful service life that is controlled by
the surface degradation and removal of the transparency for optical reasons.
5. INTRODUCTION. The recommended methods for showing compliance with CS 25.775(d) for typical
designs of windshields and windows are given in paragraph 7, Test and Analysis. Typical designs of
windshields and cockpit side windows are laminated multi-plied constructions, consisting of at least
two structural plies, facing plies, adhesive interlayers, protective coatings, embedded
electroconductive heater films or wires, and mounting structure. Typically the structural plies are
made from thermally or chemically toughened glass, or transparent polymeric materials such as
polymethylmethacrylate (acrylic) and polycarbonate. These plies may be protected from abrasion,
mechanical, and environmental damage by use of facing plies and/or protective coatings. The facing
and structural plies are laminated together with adhesive interlayer material of poly-vinyl butyral
(PVB), polyurethane, or silicone. Cabin window designs are typically multi-paned construction
consisting of two structural panes (a main load bearing pane and a fail-safe pane), inner facing
panes, protective coatings, and mounting structure. Generally, the two structural panes are made
from polymethyl-methacrylate and separated by an air gap. However, there are some cabin window
designs that have laminated structural panes. The designs with the structural panes separated by
an air gap usually are such that the fail-safe pane is not loaded unless the main pane has failed.
6. GENERAL CONSIDERATIONS FOR DESIGN.

Annex to ED Decision 2023/021/R Page 455 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

a. Items to be considered in designing the mounting for suitability over the ranges of loading
and climatic conditions include but are not limited to:
(1) Deflection of the panes and mounting under pressure,
(2) Deflection of the mounting structure as a result of fuselage deflection,
(3) Differential contraction and expansion between the panes and the mounting,
(4) Deflection of the panel resulting from temperature gradient across the thickness of the
panel, and
(5) Long term deformation (creep) particularly of non-metallic parts.
b. Fatigue and stress crazing should be evaluated for assemblies using polymeric structural
plies. One way to reduce the occurrence of fatigue and stress crazing is by limiting the
maximum working stress level over the complete panel assembly, making due allowance for
expected in service deterioration resulting from weathering, minor damage, environmental
attack, and the use of chemicals/cleaning fluids. This analysis should be based on:
(1) The appropriate strength of the polymer as declared by the material manufacturer
under sustained loading,
(2) The panel assembly maintained at its normal working temperature as given by the
windshield/window heating system, if installed, and
(3) The ambient temperature on the outside and the cabin temperature on the inside. The
most adverse likely ambient temperature should be covered.
7. TESTS AND ANALYSIS. The windshield and window panels must be capable of withstanding the
maximum cabin pressure differential loads combined with critical aerodynamic pressure and
temperature effects for intact and single failure conditions in the installation of associated systems.
When substantiation is shown by test evidence, the test apparatus should closely simulate the
structural behaviour (e.g., deformation under pressure loads) of the aircraft mounting structure up
to the ultimate load conditions. Analysis may be used if previous testing can validate it. The effects
of the following material characteristics should be evaluated and accounted for in the design and
test results: notch sensitivity, fatigue, crazing, aging effects, corrosion (degradation by fluids),
temperature, UV degradation, material stability, creep, and the function and working life of the
interlayer. An acceptable route for the strength substantiation of a windshield or window panel is
set out below.
a. Ultimate Static Strength.
(1) Conduct a detailed structural analysis using an appropriate structural analysis method
to identify the highest stressed areas of the windshield or window panel. Subsequently
confirm the structural analysis by subjecting a representatively mounted and
instrumented windshield or window panel to ultimate load conditions. The panel
should be subjected to the most adverse combinations of pressure loading, including
the maximum internal pressure, external aerodynamic pressure, temperature effects,
and where appropriate, flight loads.
(2) Establish allowable strength values including allowance for material production
variability, material characteristics, long term degradation, and environmental effects

Annex to ED Decision 2023/021/R Page 456 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

for each structural ply from relevant coupon or sub-component test evidence. Check
the critical design case to ensure that the allowables are not exceeded by the design
ultimate stresses.
(3) In lieu of 7.a.(2) above, perform a test above ultimate pressure load to account for
material production variability, material characteristics, long term degradation, and
environmental effects. In lieu of a rational analysis substantiating the degree of
increased loading above ultimate, a factor of 2.0 may be used (ultimate is defined as
1.5 times the pressure load defined in CS 25.365(d)). A separate test fixture may be
needed to preclude loading the airframe above ultimate capability.
b. Fatigue. Conventional windshield and window panel materials exhibit good intrinsic fatigue
resistance properties, but the variability in fatigue life is greater than that in aircraft quality
metals. Thus a conventional cyclic fatigue test, but of extended duration, may be used to
cover this variability. Testing at an elevated stress level for one aircraft lifetime could also
give the necessary assurance of reliability. These approaches require consideration of the
endurance of the metal parts of the mounting structure. Another approach that may be used
in lieu of testing is to maintain the maximum working stresses in the windshield and window
panel below values at which fatigue will occur. The maximum working stress level over the
complete panel assembly should be shown by supporting evidence not to exceed values
consistent with the avoidance of fatigue and stress crazing, considering deterioration
resulting from weathering, minor damage and scratching in service, and use of cleaner fluids,
etc. Fatigue resistance of the mounting structure should be covered separately as part of the
fuselage fatigue substantiation.
c. Fail-Safe. Fail-safe strength capability of the windshield and window panels should be
demonstrated after any single failure in the installation or associated systems. The
demonstration should account for material characteristics and variability in service material
degradation, critical temperature effects, maximum cabin differential pressure, and critical
external aerodynamic pressure. The requirements of CS 25.571 for the windshield or window
panels may be met by showing compliance with the fail-safe criteria in this AMC. Other single
failures (besides the windshield and window panels) in the installation or associated systems
should also be considered. An acceptable approach for demonstrating compliance is defined
by the following method:
(1) Conduct an analysis to establish the critical main pressure bearing ply.
(2) To account for the dynamic effects of a ply failure, test the representatively mounted
windshield and window panel by suddenly failing the critical ply under the maximum
cabin differential pressure (maximum relief valve setting) combined with the critical
external aerodynamic pressure with critical temperature effects included.
(a) For windshield and window panel failures obvious to the flightcrew, the test
pressure may be reduced after initial critical pane failure to account for crew
action defined in the flight manual procedures. The failed windshield or window
panel should withstand this reduced pressure for the period of time that would
be required to complete the flight.
(b) For windshield and window panel failures, which would not be obvious to a
flightcrew, the test pressure should be held for a time sufficient to account for

Annex to ED Decision 2023/021/R Page 457 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

the remaining period of flight. During the period of time when the test pressure
is held, the effects of creep (if creep could occur) should be considered.
(3) Check the fail-safe stresses in all intact structural plies determined in 7c(2) to ensure
that they do not exceed the material allowables developed to account for material
production variability, material characteristics, long term degradation, and
environmental effects.
(4) In lieu of 7c(3) above, to account for material production variability, material
characteristics, long term degradation, and environmental effects, additional fail-safe
testing of the windshield and window panel to loads above the fail-safe loads following
the procedures defined in 7c(2) above should be conducted. In lieu of a rational
analysis substantiating the degree of increased loading, a factor may be used, as shown
in the table below. The factored loads should be applied after the failure of the critical
ply. A separate test fixture may be needed to preclude loading the airframe above
ultimate capability. The panel tested in 7c(2) may be used for this test.
(5) Load Factors (applied after the failure of the critical ply):
Material Factor
Glass 2.0
Stretched Acrylic 2.0
Cast Acrylic 4.0
Polycarbonate 4.0

(6) Other single failures in the installation or the associated systems as they affect the
transparency should also be addressed. Such failures include broken fasteners, cracked
mounting components, and malfunctions in windshield heat systems.
8. OTHER FAILURE CONDITIONS THAT MAY HAVE STRUCTURAL EFFECTS
AMC 25.1309
applicant should evaluate the severity of failure conditions, considering the effects that potential or
consequential effects on structural integrity may have on the aeroplane.
Therefore, the applicant should carefully consider the potential effects on the windshield structural
integrity when assessing any failure condition in windshield-related systems (e.g. windshield heating
systems).
Unless otherwise shown, the applicant should classify as at least hazardous a system failure condition that
leads to a structural failure that could result in partial or complete loss of a windshield.
In addition, it is reminded that CS 25.365(e)(3) requires the applicant to consider the maximum
compartment opening, caused by aeroplane or equipment failures (e.g. windshield failures), that is not
shown to be extremely improbable.
Service experience has shown that failure or deterioration of windshield installation components (e.g. a
degraded seal), combined with environmental conditions (e.g. water accumulation or moisture ingress)
or with manufacturing/installation issues, may lead to failure of other components of windshield-related
systems (e.g. degradation of, or damage to, the insulation of a heating-system wire). The combination of
such failures may lead to a malfunction or failure of the related system, which may cause a structural

Annex to ED Decision 2023/021/R Page 458 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

failure that could result in the partial or complete loss of the windshield or the loss of transparency of the
windshield.
Therefore, the applicant should pay attention to common causes of failures when installing windshields
and related systems or components, and to the contribution of such common causes to cascading failures.
The applicant should identify through common cause analysis appropriate design, manufacturing,
installation, and maintenance precautions to mitigate the risk of any failure condition adversely affecting
systems or components, which may directly or indirectly lead to a structural failure that could result in
the partial or complete loss of the windshield or the loss of transparency of the windshield (refer to
AMC 25.1309, Appendix 1).
[Amdt No: 25/27]

CS 25.777 Cockpit controls

(a) Each cockpit control must be located to provide convenient operation and to prevent confusion
and inadvertent operation.
(b) The direction of movement of cockpit controls must meet the requirements of CS 25.779. Wherever
practicable, the sense of motion involved in the operation of other controls must correspond to the
sense of the effect of the operation upon the aeroplane or upon the part operated. Controls of a
variable nature using a rotary motion must move clockwise from the off position, through an
increasing range, to the full on position.
(c) The controls must be located and arranged, with respect to the pilots' seats, so that there is full and
unrestricted movement of each control without interference from the cockpit structure or the
clothing of the minimum flight crew (established under CS 25.1523) when any member of this flight
crew from 1.58 m (5ft 2 inches) to 1·91 m (6ft 3 inches) in height, is seated with the seat belt and
shoulder harness (if provided) fastened.
(d) Identical powerplant controls for each engine must be located to prevent confusion as to the
engines they control.
(e) Wing-flap controls and other auxiliary lift device controls must be located on top of the pedestal,
aft of the throttles, centrally or to the right of the pedestal centre line, and not less than 25 cm (10
inches) aft of the landing gear control.
(f) The landing gear control must be located forward of the throttles and must be operable by each
pilot when seated with seat belt and shoulder harness (if provided) fastened.
(g) Control knobs must be shaped in accordance with CS 25.781. In addition, the knobs must be of the
same colour and this colour must contrast with the colour of control knobs for other purposes and
the surrounding cockpit.
(h) If a flight engineer is required as part of the minimum flight crew (established under CS 25.1523),
the aeroplane must have a flight engineer station located and arranged so that the flight-crew
members can perform their functions efficiently and without interfering with each other.
(i) Pitch and roll control forces and displacement sensitivity shall be compatible so that normal inputs
on one control axis will not cause significant unintentional inputs on the other.
[Amdt 25/13]

Annex to ED Decision 2023/021/R Page 459 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.777(c) Full and unrestricted movement of cockpit controls

1. General
CS 25.777(c) requires cockpit controls to be located and arranged so that full and unrestricted
movement of each control can be made by the minimum flight crew. The use of the controls shall
be evaluated for pilots across the range of statures required by CS 25.777(c). This evaluation should
take into account foreseeable normal and failure conditions.
2. Rudder and brake controls
Particular attention should be paid to rudder and brake controls. The control movement of the
rudder pedals and brake pedals should be evaluated in order to ensure that full use can be made
of all the available controls in the event of an engine failure, including on take-off and including
engine failure at low speeds below VMCG.
The evaluation should ensure that each member of the flight crew is always able to apply full rudder
and maximum brake pressure on the same side simultaneously (e.g. full right rudder with maximum
right brake pressure, and vice versa). Furthermore, the ergonomics of the design should be such
that:
a) the flight crew members can, in each condition, continue to apply brake pressure on the
opposite side; and
b) inadvertent brake application on the opposite side is precluded.
This evaluation should ideally be performed in a representative simulator, but it may also be
performed statically in a representative cockpit.
[Amdt No: 25/23]

CS 25.779 Motion and effect of cockpit controls

Cockpit controls must be designed so that they operate in accordance with the following movement and
actuation:
(a) Aerodynamic controls
(1) Primary.
Controls Motion and effect
Aileron Right (clockwise) for right wing down
Elevator Rearward for nose up
Rudder Right pedal forward for nose right

(2) Secondary.
Controls Motion and effect
Flaps (or auxiliary lift devices) Forward for wing-flaps up; rearward for flaps down
Trim tabs (or equivalent) Rotate to produce similar rotation of the aeroplane about an
axis parallel to the axis of the control

Annex to ED Decision 2023/021/R Page 460 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(b) Powerplant and auxiliary controls

(1) Powerplant.
Controls Motion and effect
Power or thrust Forward to increase forward thrust and rearward to increase
rearward thrust
Propellers Forward to increase rpm

(2) Auxiliary.
Controls Motion and effect
Landing gear Down to extend

CS 25.781 Cockpit control knob shape

Cockpit control knobs must conform to the general shapes (but not necessarily the exact sizes or specific
proportions) in the following figure:

CS 25.783 Fuselage Doors

(See AMC 25.783)

Annex to ED Decision 2023/021/R Page 461 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(a) General. This paragraph applies to fuselage doors, which includes all doors, hatches, openable
windows, access panels, covers, etc., on the exterior of the fuselage that do not require the use of
tools to open or close. This also applies to each door or hatch through a pressure bulkhead,
including any bulkhead that is specifically designed to function as a secondary bulkhead under the
prescribed failure conditions of CS-25. These doors must meet the requirements of this paragraph,
taking into account both pressurised and unpressurised flight, and must be designed as follows:
(1) Each door must have means to safeguard against opening in flight as a result of mechanical
failure, or failure of any single structural element.
(2) Each door that could be a hazard if it unlatches must be designed so that unlatching during
pressurised and unpressurised flight from the fully closed, latched, and locked condition is
extremely improbable. This must be shown by safety analysis.
(3) Each element of each door operating system must be designed or, where impracticable,
distinctively and permanently marked, to minimise the probability of incorrect assembly and
adjustment that could result in a malfunction.
(4) All sources of power that could initiate unlocking or unlatching of any door must be
automatically isolated from the latching and locking systems prior to flight and it must not be
possible to restore power to the door during flight.
(5) Each removable bolt, screw, nut, pin, or other removable fastener must meet the locking
requirements of CS 25.607.
(6) Certain doors, as specified by CS 25.807(h), must also meet the applicable requirements of
CS 25.809 through CS 25.812 for emergency exits.
(b) Opening by persons. There must be a means to safeguard each door against opening during flight
due to inadvertent action by persons. In addition, for each door that could be a hazard, design
precautions must be taken to minimise the possibility for a person to open the door intentionally
during flight. If these precautions include the use of auxiliary devices, those devices and their
controlling systems must be designed so that:
(1) no single failure will prevent more than one exit from being opened, and
(2) failures that would prevent opening of any exit after landing must not be more probable than
remote.
(c) Pressurisation prevention means. There must be a provision to prevent pressurisation of the
aeroplane to an unsafe level if any door subject to pressurisation is not fully closed, latched, and
locked.
(1) The provision must be designed to function after any single failure, or after any combination
of failures not shown to be extremely improbable.
(2) Doors that meet the conditions described in sub-paragraph (h) of this paragraph are not
required to have a dedicated pressurisation prevention means if, from every possible position
of the door, it will remain open to the extent that it prevents pressurisation or safely close
and latch as pressurisation takes place. This must also be shown with any single failure and
malfunction except that:

Annex to ED Decision 2023/021/R Page 462 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(i) with failures or malfunctions in the latching mechanism, it need not latch after closing,
and
(ii) with jamming as a result of mechanical failure or blocking debris, the door need not
close and latch if it can be shown that the pressurisation loads on the jammed door or
mechanism would not result in an unsafe condition.
(d) Latching and locking. The latching and locking mechanisms must be designed as follows:
(1) There must be a provision to latch each door.
(2) The latches and their operating mechanism must be designed so that, under all aeroplane
flight and ground loading conditions, with the door latched, there is no force or torque
tending to unlatch the latches. In addition, the latching system must include a means to
secure the latches in the latched position. This means must be independent of the locking
system.
(3) Each door subject to pressurisation, and for which the initial opening movement is not
inward, must:
(i) have an individual lock for each latch;
(ii) have the lock located as close as practicable to the latch; and
(iii) be designed so that, during pressurised flight, no single failure in the locking system
would prevent the locks from restraining the latches necessary to secure the door.
(4) Each door for which the initial opening movement is inward, and unlatching of the door could
result in a hazard, must have a locking means to prevent the latches from becoming
disengaged. The locking means must ensure sufficient latching to prevent opening of the
door even with a single failure of the latching mechanism.
(5) It must not be possible to position the lock in the locked position if the latch and the latching
mechanism are not in the latched position.
(6) It must not be possible to unlatch the latches with the locks in the locked position. Locks
must be designed to withstand the limit loads resulting from:
(i) the maximum operator effort when the latches are operated manually;
(ii) the powered latch actuators, if installed; and
(iii) the relative motion between the latch and the structural counterpart.
(7) Each door for which unlatching would not result in a hazard is not required to have a locking
mechanism meeting the requirements of sub-paragraphs (d)(3) through (d)(6) of this
paragraph.
(8) A door that could result in a hazard if not closed, must have means to prevent the latches
from being moved to the latched position unless it can be shown that a door that is not closed
would be clearly evident before flight.
(e) Warning, caution, and advisory indications. Doors must be provided with the following indications:
(1)
operations to close, latch, and lock the door(s) have been completed.

Annex to ED Decision 2023/021/R Page 463 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(2) There must be a positive means, clearly visible from each operator station for each door that
could be a hazard if unlatched, to indicate if the door is not fully closed, latched, and locked.
(3) There must be a visual means on the flight deck to signal the pilots if any door is not fully
closed, latched, and locked. The means must be designed such that any failure or
combination of failures that would result in an erroneous closed, latched, and locked
indication is remote for:
(i) each door that is subject to pressurisation and for which the initial opening movement
is not inward; or
(ii) each door that could be a hazard if unlatched.
(4) There must be an aural warning to the pilots prior to or during the initial portion of take-off
roll if any door is not fully closed, latched, and locked, and its opening would prevent a safe
take-off and return to landing.
(f) Visual inspection provision. Each door for which unlatching could be a hazard must have a provision
for direct visual inspection to determine, without ambiguity, if the door is fully closed, latched, and
locked. The provision must be permanent and discernible under operational lighting conditions, or
by means of a flashlight or equivalent light source.
(g) Certain maintenance doors, removable emergency exits, and access panels. Some doors not
normally opened except for maintenance purposes or emergency evacuation and some access
panels need not comply with certain sub-paragraphs of this paragraph as follows:
(1) Access panels that are not subject to cabin pressurisation and would not be a hazard if open
during flight need not comply with sub-paragraphs (a) through (f) of this paragraph, but must
have a means to prevent inadvertent opening during flight.
(2) Inward-opening removable emergency exits that are not normally removed, except for
maintenance purposes or emergency evacuation, and flight deck-openable windows need
not comply with sub-paragraphs (c) and (f) of this paragraph.
(3) Maintenance doors that meet the conditions of sub-paragraph (h) of this paragraph, and for
which a placard is provided limiting use to maintenance access, need not comply with sub-
paragraphs (c) and (f) of this paragraph.
(h) Doors that are not a hazard. For the purposes of this paragraph, a door is considered not to be a
hazard in the unlatched condition during flight, provided it can be shown to meet all of the following
conditions:
(1) Doors in pressurised compartments would remain in the fully closed position if not restrained
by the latches when subject to a pressure greater than 3.447 kPa (0.5 psi). Opening by
persons, either inadvertently or intentionally, need not be considered in making this
determination.
(2) The door would remain inside the aeroplane or remain attached to the aeroplane if it opens
either in pressurised or unpressurised portions of the flight. This determination must include
the consideration of inadvertent and intentional opening by persons during either
pressurised or unpressurised portions of the flight.

Annex to ED Decision 2023/021/R Page 464 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(3) The disengagement of the latches during flight would not allow depressurisation of the cabin
to an unsafe level. This safety assessment must include the physiological effects on the
occupants.
(4) The open door during flight would not create aerodynamic interference that could preclude
safe flight and landing.
(5) The aeroplane would meet the structural design requirements with the door open. This
assessment must include the aeroelastic stability requirements of CS 25.629, as well as the
strength requirements of Subpart C.
(6) The unlatching or opening of the door must not preclude safe flight and landing as a result of
interaction with other systems or structures.
[Amdt 25/4]
[Amdt 25/18]

AMC 25.783 Fuselage Doors

1. PURPOSE.
This Acceptable Means of Compliance, which is similar to the FAA Advisory Circular AC 25.783-1A
describes an acceptable means for showing compliance with the requirements of CS-25 dealing
with the certification of fuselage external doors and hatches.
The means of compliance described in this document is intended to provide guidance to
supplement the engineering and operational judgement that must form the basis of any compliance
findings relative to the structural and functional safety standards for doors and their operating
systems
This document describes an acceptable means, but not the only means, for demonstrating

ensuring applicability of this particular method of compliance when the acceptable method of
compliance described in this document is used.
2. RELATED CS PARAGRAPHS.
The contents of this AMC are considered by the EASA in determining compliance of doors with the
safety requirements of CS 25.783. Other related paragraphs are:
CS 25.571 -tolerance and fatig
CS 25.607
CS 25.703 -
CS 25.809
3. DEFINITIONS OF TERMS.
Inconsistent or inaccurate use of terms may lead to the installation of doors and hatches that do
not fully meet the safety objectives of the regulations. To ensure that such installations fully comply

Annex to ED Decision 2023/021/R Page 465 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

with the regulations, the following definitions should be used when showing compliance with CS
25.783:
a.

placed within the door frame in the position it will occupy when the latches are in the latched
condition.
b.
exterior of the fuselage which do not require the use of tools to open or close. This also
includes each door or hatch through a pressure bulkhead including any bulkhead that is
specifically designed to function as a secondary bulkhead under the prescribed failure
conditions of CS-25.
c. the door closing, latching and locking
operations are performed.
d.
e.
f. rom start of the take-off roll until the aeroplane comes
to rest after landing.
g.
consideration or consultation.
h. to be classified as having
inward initial opening movement the design of its stops, guides and rollers and associated
mechanism, should be such that positive pressurisation of the fuselage acting on the mean
pressure plane of the fully closed door must always ensure a positive door closure force. (See
AMC 25.783 Paragraph 5, (d) (4)).
i.
or other door control mechanism, which is required to place the door in a position free of
structure that would interfere with continued opening of the door.
j.
to the mean (pressure) plane of the body cut-out.
k. aged with their structural counterparts and held in
position by the latch operating mechanism.
l.
opening.
m. tches.
n.
o.
p. onitor
the latch positions, and when engaged, prevent latches from becoming disengaged.

Annex to ED Decision 2023/021/R Page 466 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

q.
each other, limit the directions in which the door is free to move.
4. BACKGROUND.
4.1 History of incidents and accidents.
There is a history of incidents and accidents in which doors, fitted in pressurised aeroplanes,
have opened during pressurised and unpressurised flight. Some of these inadvertent
openings have resulted in fatal crashes. After one fatal accident that occurred in 1974, the
FAA and industry representatives formed a design review team to examine the current
regulatory requirements for doors to determine if those regulations were adequate to ensure
safety.
25-54 to 14 CFR part 25 in 1980, that was adopted by the JAA in JAR-25 Change 10 in 1983,
which significantly improved the safety standards for doors installed on large aeroplanes.
Included as part of JAR-25 Change 10 (Amendment 25-
provides the airworthiness standards for doors installed on large aeroplanes.
Although there have been additional minor revisions to JAR 25.783 subsequent to the
issuance of Change 10 (Amendment 25-54), the safety standards for doors have remained
essentially the same since 1980.
4.2 Continuing safety problems.
In spite of the improved standards brought about in 1980, there have continued to be safety
problems, especially with regard to cargo doors. Cargo doors are often operated by persons
having little formal instruction in their operation. Sometimes the operator is required to
carry out several actions in sequence to complete the door opening and closing operations.
Failure to complete all sequences during closure can have serious consequences. Service
history shows that several incidents of doors opening during flight have been attributed to
the failure of the operator to complete the door closure and locking sequence. Other
incidents have been attributable to incorrect adjustment of the door mechanism, or failure
of a vital part.
4.3 Indication to the flight crew.
Experience also has shown that, in some cases, the flight deck indication system has not been
reliable. In other instances, the door indication system was verified to be indicating correctly,
but the flight crew, for unknown reasons, was not alerted to the unsafe condition. A reliable
indication of door status on the flight deck is particularly important on aeroplanes used in
operations where the flight crew does not have an independent means readily available to
verify that the doors are properly secured.
4.4 Large cargo doors as basic airframe structure.
On some aeroplanes, large cargo doors form part of the basic fuselage structure, so that,
unless the door is properly closed and latched, the basic airframe structure is unable to carry
the design aerodynamic and inertial loads. Large cargo doors also have the potential for
creating control problems when an open door acts as an aerodynamic surface. In such cases,
failure to secure the door properly could have catastrophic results, even when the aeroplane
is unpressurised.

Annex to ED Decision 2023/021/R Page 467 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

4.5 NTSB (USA) recommendations.

After two accidents occurred in 1989 due to the failure of cargo doors on transport category
aeroplanes, the FAA chartered the Air Transport Association (ATA) of America to study the
door design and operational issues again for the purpose of recommending improvements.
The ATA concluded its study in 1991 and made recommendations to the FAA for improving
the design standards of doors. Those recommendations together with additional
recommendations from the National Transportation Safety Board (NTSB) were considered in
the development of improved standards for doors adopted by Amendment 25-114.
5. DISCUSSION OF THE CURRENT REQUIREMENTS.
Service history has shown that to prevent doors from becoming a hazard by opening in flight, it is
necessary to provide multiple layers of protection against failures, malfunctions, and human error.
Paragraph 25.783 addresses these multiple layers of protection by requiring:
a latching system;
a locking system;
indication systems;
a pressure prevention means.
These features provide a high degree of tolerance to failures, malfunctions, and human error.
Paragraph CS 25.783 intends that the latching system be designed so that it is inherently or
specifically restrained from being back-driven from the latches; but even so, the latches are
designed to eliminate, as much as possible, all forces from the latch side that would tend to unlatch
the latches. In addition to these features that prevent the latches from inadvertently opening, a
separate locking system is required for doors that could be a hazard if they become unlatched.
Notwithstanding these safety features, it could still be possible for the door operator to make errors
in closing the door, or for mechanical failures to occur during or after closing; therefore, an
indicating system is required that will signal to the flight crew if the door is not fully closed, latched,
and locked. However, since it is still possible for the indication to be missed or unheeded, a separate
system is required that prevents pressurisation of the aeroplane to an unsafe level if the door is not
fully closed, latched, and locked.
The following material restates the requirements of CS 25.783 in italicised text and, immediately
following, provides a discussion of acceptable compliance criteria.
CS 25.783(a) General Design Considerations
This paragraph applies to fuselage doors, which includes all doors, hatches, openable windows,
access panels, covers, etc., on the exterior of the fuselage that do not require the use of tools to
open or close. This also applies to each door or hatch through a pressure bulkhead, including any
bulkhead that is specifically designed to function as a secondary bulkhead under the prescribed
failure conditions of CS-25. These doors must meet the requirements of this paragraph, taking into
account both pressurised and unpressurised flight, and must be designed as follows:
(a)(1) Each door must have means to safeguard against opening in flight as a result of mechanical
failure, or failure of any single structural element.

Annex to ED Decision 2023/021/R Page 468 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Failures that should be considered when safeguarding the door against opening as a result of
mechanical failure or failure of any single structural element include those caused by:
wear;
excessive backlash;
excessive friction;
jamming;
incorrect assembly;
incorrect adjustment;
parts becoming loose, disconnected, or unfastened;
parts breaking, fracturing, bending or flexing beyond the extent intended.
(a)(2) Each door that could be a hazard if it unlatches must be designed so that unlatching during
pressurised and unpressurised flight from the fully closed, latched, and locked condition is
extremely improbable. This must be shown by safety analysis.
All doors should incorporate features in the latching mechanism that provide a positive
means to prevent the door from opening as a result of such things as:
vibrations;
structural loads and deflections;

aerodynamic loads etc.

The means should be effective throughout the approved operating envelope of the
aeroplane including the unpressurised portions of flight.
The safety assessment required by this regulation may be a qualitative or quantitative
analysis, or a combination as appropriate to the design. In evaluating a failure condition that
results in total failure or inadvertent opening of the door, all contributing events should be
considered, including:
failure of the door and door supporting structure;
flexibility in structures and linkages;
failure of the operating system;
erroneous signals from the door indication systems;
likely errors in operating and maintaining the door.
(a)(3) Each element of each door operating system must be designed or, where impracticable,
distinctively and permanently marked, to minimise the probability of incorrect assembly and
adjustment that could result in a malfunction.
Experience has shown that the level of protection against mechanical failure can be
significantly improved by careful attention to detail design. The following points should
therefore be taken into account:

Annex to ED Decision 2023/021/R Page 469 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(a) To minimise the risk of incorrect assembly and adjustment, parts should be designed
to prevent incorrect assembly if, as a result of such incorrect assembly, door

preventing or impeding the opening of the door during an emergency, or reducing the
capability of the door to remain closed. If such designs are impracticable and marking
is used instead, the marking should remain clearly identifiable during service. In this
respect, markings could be made using material such as permanent ink, provided it is
resistant to typical solvents, lubricants, and other materials used in normal
maintenance operations.
(b) To minimise the risk of the door operating mechanism being incorrectly adjusted in
-
identified, and limited to a minimum number consistent with adequate adjustment
capability. Any points provided solely to facilitate adjustment at the initial build and
not intended for subsequent use, should be made non-adjustable after initial build, or
should be highlighted in the maintenance manual as a part of the door mechanism that
is not intended to be adjusted.
(a)(4) All sources of power that could initiate unlocking or unlatching of each door must be
automatically isolated from the latching and locking systems prior to flight and it must not be
possible to restore power to them during flight.
For doors that use electrical, hydraulic, or pneumatic power to initiate unlocking or
unlatching, those power sources must be automatically isolated from the latching and locking
systems before flight, and it should not be possible to restore power to them during flight. It
is particularly important for doors with powered latches or locks to have all power removed
that could power these systems or that could energise control circuits to these systems in
the event of electrical short circuits. This does not include power to the door indicating
system, auxiliary securing devices if installed, or other systems not related to door operation.
Power to those systems should not be sufficient to cause unlocking or unlatching unless each
failure condition that could result in energising the latching and locking systems is extremely
improbable.
(a)(5) Each removable bolt, screw, nut, pin, or other removable fastener must meet the locking
requirements of CS 25.607. [Fasteners]
Refer to AMC 25.607 for guidance on complying with CS 25.607.
(a)(6) Certain fuselage doors, as specified by 25.807(h), must also meet the applicable
requirements of CS 25.809 through 25.812 for emergency exits.
CS 25.783(b) Opening by persons
There must be means to safeguard each door against opening during flight due to inadvertent
action by persons.
The door should have inherent design features that achieve this objective. It is not
considered acceptable to rely solely on cabin pressure to prevent inadvertent opening of
doors during flight, because there have been instances where doors have opened during
unpressurised flight, such as during landing. Therefore all doors should incorporate features
to prevent the door from being opened inadvertently by persons on board.

Annex to ED Decision 2023/021/R Page 470 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

In addition, for each door that could be a hazard, design precautions must be taken to
minimise the possibility for a person to open a door intentionally during flight. If these
precautions include the use of auxiliary devices, those devices and their controlling systems
must be designed so that:
(1) no single failure will prevent more than one exit from being opened, and
(2) failures that would prevent opening of any exit after landing must not be more
probable than remote.
The intentional opening of a door by persons on board while the aeroplane is in flight should
be considered. This rule is intended to protect the aircraft and passengers but not necessarily
the person who intentionally tries to open the door. Suitable design precautions should
therefore be taken; however, the precautions should not compromise the ability to open an
emergency exit in an emergency evacuation. The following precautions should be
considered:
(a) For doors in pressurised compartments: it should not normally be possible to open the
door when the compartment differential pressure is above 13.8 kPa (2 psi). The ability
to open the door will depend on the door operating mechanism and the handle design,
location and operating force. Operating forces in excess of 136 kg (300 pounds) should
be considered sufficient to prevent the door from being opened. During approach,
take-off and landing when the compartment differential pressure is lower, it is
recognised that intentional opening may be possible; however, these phases are brief
and all passengers are expected to be seated with seat belts fastened. Nevertheless
flight experience has shown that cabin staff may cycle door handles during take-off in
an attempt to ensure that the door is closed, resulting in door openings in flight. For
hazardous doors CS 25.783(e)(2) intends to provide a positive means to indicate to the
door operator after closure of the door on the ground, that the door is not properly
closed, latched and locked. CS 25.783(e)(2) will minimise, but can not prevent the
deliberate cycling of the door handle by the cabin staff during take-off.
(b) For doors that cannot meet the guidance of (a) above, and for doors in non-pressurised
aeroplanes: The use of auxiliary devices (for example, a speed-activated or
barometrically-activated means) to safeguard the door from opening in flight should
be considered. The need for such auxiliary devices should depend upon the
consequences to the aeroplane and other occupants if the door is opened in flight.
(c) Auxiliary devices installed on emergency exits: The failure of an auxiliary device should
normally result in an unsecured position of the device. Failures of an auxiliary device
that would prevent opening of the exit after landing should not be more probable than
Remote (1x10-5/flight hour). Where auxiliary devices are controlled by a central
system or other more complex systems, a single failure criterion for opening may not
be sufficient. The criteria for failure of the auxiliary device to open after landing should
include consideration of single failures and all failure conditions that are more
probable than remote. In the assessment of single failures, no credit should be given
to dormant functions.
The opening of exits on the ground should also be considered in the design, relative to the
effects of differential pressure. While it is desirable and required to be able to open exits

Annex to ED Decision 2023/021/R Page 471 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

under normal residual differential pressure, opening of the exit with significant differential
pressure can be a hazard to the person opening the exit. Clearly, emergency conditions may
dictate that the exit be opened regardless of the differential pressure. Devices that restrict
opening of the door, or affect the pressurization system, can have failure modes that create
other safety concerns. However, the manufacturer should consider this issue in the design of
the door and provide warnings where necessary, if it is possible to open a door under
differential pressure that may be hazardous to the exit operator.
CS 25.783(c) Pressurisation prevention means
There must be a provision to prevent pressurisation of the aeroplane to an unsafe level if any
door subject to pressurisation is not fully closed, latched, and locked.
(c)(1) The provision must be designed to function after any single failure, or after any combination
of failures not shown to be extremely improbable.
(a) The provisions for preventing pressurisation must monitor the closed, latched and
locked condition of the door. If more than one lock system is used, each lock system
must be monitored. Examples of such provisions are vent panels and pressurisation
inhibiting circuits. Pressurisation to an unsafe level is considered to be prevented
when the pressure is kept below 3.447 kPa (1/2 psi). These systems are not intended
to function to depressurise the aeroplane once the fully closed latched and locked
condition is established and pressurisation is initiated.
(b) If a vent panel is used, it should be designed so that, in normal operation or with a
single failure in the operating linkage, the vent panel cannot be closed until the door
is latched and locked. The vent panel linkage should monitor the locked condition of
each door lock system.
(c) If automatic control of the cabin pressurisation system is used as a means to prevent
pressurisation, the control system should monitor each lock. Because inadvertent
depressurisation at altitude can be hazardous to the occupants, this control system
should be considered in showing compliance with the applicable pressurisation system
reliability requirements. Normally, such systems should be automatically
di
airborne, provided no prior unsafe condition was detected.
(d) It should not be possible to override the pressurisation prevention system unless a
procedure is defined in the Master Minimum Equipment List (MMEL) that confirms a
fully closed, latched and locked condition. In order to prevent the override procedure
from becoming routine, the override condition should not be achievable by actions
solely on the flight deck and should be automatically reset at each door operational
cycle.
(c)(2) Doors that meet the conditions described in sub-paragraph (h) of this paragraph are not
required to have a dedicated pressurisation prevention means if, from every possible position
of the door, it will remain open to the extent that it prevents pressurisation or safely close
and latch as pressurisation takes place. This must also be shown with any single failure and
malfunction except that:

Annex to ED Decision 2023/021/R Page 472 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(i) with failures or malfunctions in the latching mechanism, it need not latch after closing,
and
(ii) with jamming as a result of mechanical failure or blocking debris, the door need not
close and latch if it can be shown that the pressurisation loads on the jammed door or
mechanism would not result in an unsafe condition.
As specified in CS 25.783(d)(7), each door for which unlatching would not result in a hazard
is not required to have a locking mechanism; those doors also may not be required to have a
dedicated pressurisation prevention means. However, this should be determined by
demonstrating that an unsafe level of pressurisation cannot be achieved for each position
that the door may take during closure, including those positions that may result from single
failures or jams.
Excluding jamming and excluding failures and malfunctions in the latching system, for
every possible position of the door, it must either remain open to the extent that it
prevents pressurisation, or safely close and latch as pressurisation takes place;
With single failures of the latching system or malfunctions in the latching system the door
may not necessarily be capable of latching, but it should either remain open to the extent
that it prevents pressurisation, or safely move to the closed position as pressurisation
takes place; and
With jamming as a result of mechanical failure in the latching system or blocking debris,
the pressurisation loads on the jammed door or mechanism may not result in damage to
the door or airframe that could be detrimental to safe flight (both the immediate flight
or future flights). In this regard, consideration should be given to jams or non-frangible
debris that could hold the door open just enough to still allow pressurisation, and then
break loose in flight after full pressurisation is reached.
CS 25.783(d) Latching and locking
The latching and locking mechanisms must be designed as follows:
(d)(1) There must be a provision to latch each door.
(a) The definitions of latches and locks are redefined in Chapter 3 [Definitions of Terms],
particularly in regard to mechanical and structural elements of inward-opening plug
doors. In this regard, fixed stops are not considered latches. The movable elements
that hold the door in position relative to the fixed stops are considered latches. These
movable elements prevent the door from opening and will support some loads in
certain flight conditions, particularly when the aeroplane is unpressurised.
(b) For all doors, sub-paragraph CS 25.783(d)(2) requires that the latching system employ
a securing means other than the locking system. The separate locking system may not
be necessary for certain doors with an initial inward movement (see CS 25.783(d)(4)).
(d)(2) The latches and their operating mechanism must be designed so that, under all aeroplane
flight and ground loading conditions, with the door latched, there is no force or torque
tending to unlatch the latches. In addition, the latching system must include a means to
secure the latches in the latched position. This means must be independent of the locking
system.

Annex to ED Decision 2023/021/R Page 473 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

The latches of doors for which the initial opening movement is outward are typically subject
to vibrations; structural loads and deflections; positive and negative pressure loads; positive

opening movement is inward typically share some of these same types of loads with fixed
stops. Doors for which the initial opening movement is inward tend to be resistant to opening
when the aircraft is pressurised since a component of the pressure load tends to hold the
door closed.
(a) Latch design. The design of the latch should be such that with the latch disconnected
from its operating mechanism, the net reaction forces on the latch should not tend to
unlatch the latch during both pressurised and unpressurised flight throughout the
approved flight envelope. The effects of possible friction in resisting the forces on the
latch should be ignored when considering reaction forces tending to unlatch the door.
The effects of distortion of the latch and corresponding structural attachments should
be taken into account i
could result in an unlatching force should be designed to minimise such forces.
(b) Latch securing means. Even though the principal back-driving forces should be
eliminated by design, it is recognised that there may still be ratcheting forces that
could progressively move the latches to the unlatched position. Therefore, each latch
should be positively secured in the latched position by its operating mechanism, which
should be effective throughout the approved flight envelope. The location of the
operating system securing means will depend on the rigidity of the system and the
tendency for any forces (such as ratcheting, etc.) at one latch to unlatch other latches.
(c) Over-centre features in the latching mechanism are considered to be an acceptable
securing means, provided that an effective retaining feature that functions
automatically to prevent back-driving is incorporated. If the design of the latch is such
that it could be subject to ratcheting loads which might tend to unlatch it, the securing
means should be adequate to resist such loads.
(d) Back-driving effect of switches. In those designs that use the latch to operate an
electrical switch, any back-driving effect of the switch on the latch is permissible,
provided that the extent of any possible movement of the switch
is insufficient to unlatch it; and
will not result in the latch being subjected to any other force or torque tending to
unlatch it.
(e) The latch securing means must be independent of the locking means. However, the
latching and locking functions may be fulfilled by a single operating means, provided
that it is not possible to back-drive the locks via the latch mechanism when the door
locks are engaged with the latch mechanism.
(d)(3) Each door subject to pressurisation, and for which the initial opening movement is not inward
must:
(i) have an individual lock for each latch;
(ii) have the lock located as close as practicable to the latch; and

Annex to ED Decision 2023/021/R Page 474 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(iii) be designed so that during pressurised flight, no single failure in the locking system
would prevent the locks from restraining the latches necessary to secure the door.
(a) To safeguard doors subject to pressurisation and for which the initial opening
movement is not inward, each latch must have an individual lock. The lock
should directly lock the latch. In this regard, the lock should be located directly
at the latch to ensure that, in the event of a single failure in the latch operating
mechanism, the lock would continue to restrain the latch in the latched position.
Even in those cases where the lock cannot be located directly at the latch, the
same objective should be achieved. In some cases, a pair of integrally-
connected latches may be treated as a single latch with respect to the
requirement for a lock provided that:
1) the lock reliably monitors the position of at least one of the load carrying
elements of the latch, and
2) with any one latch element missing, the aeroplane can meet the full
requirements of CS-25 as they apply to the unfailed aeroplane, and
3) with the pair disengaged, the aeroplane can achieve safe flight and
landing, and meet the damage tolerance requirements of CS 25.571
[Damage-tolerance and fatigue evaluation of structure].
(b) In some designs more latches are provided than necessary to meet the minimum
design requirements. The single failure requirement for the locking system is
intended to ensure that the number and combination of latches necessary to
secure the door will remain restrained by the locking mechanism. Only those
latches needed to meet the minimum design requirements need to remain
restrained after the single failure.
(c) In meeting this requirement, the indirect locking provided through the latch
system by the locks at other latches may be considered. In this case, the locking
system and the latching system between the locked latch and the unlocked latch
should be designed to withstand the maximum design loads discussed in sub-
paragraph d.(6) of this AMC, below, as appropriate to pressurised flight.
(d)(4) Each door for which the initial opening movement is inward, and unlatching of the door could
result in a hazard, must have a locking means to prevent the latches from becoming
disengaged. The locking means must ensure sufficient latching to prevent opening of the
door even with a single failure of the latching mechanism.
For a door to be classified as having Initial Inward Opening Movement before opening
outwards, and thus be eligible for some relief regarding the locks compared with other
outward opening doors, the following conditions should be fulfilled:
a) Loads on the door resulting from positive pressure differential of the fuselage should
be reacted by fixed (non moveable) structural stops on the door and fuselage
doorframe.
b) The stops must be designed so that, under all 1g aeroplane level flight conditions, the
door to fuselage stop interfaces produce no net force tending to move the door in the
opening direction.

Annex to ED Decision 2023/021/R Page 475 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

c) If the stops are used to provide the initial inward opening movement, the stops should
be designed such that they cause the door to move inwards, typically at a minimum
angle of 3° relative to the mean pressure plane, opposing any positive fuselage
pressure differential:
1) until the door is in a position where it is clear of the fixed stops and is free to
open, or
2) until the loads required to overcome friction between the door and fuselage
stops are sufficient to prevent the door moving in an opening direction when
the door is subjected to loads of +/- 0.5g, or
3) if neither of the above options are appropriate, based on justified engineering
judgement and agreed with the Agency.
d) If guides or other mechanisms are used to position the door such that it can move clear
of the fixed stops in an opening direction, the means used should, be designed such
that it causes the door to move inwards, typically at a minimum angle of 3° relative to
the mean pressure plane, opposing any positive fuselage pressure differential and be
sufficiently robust to function without significant loss of effectiveness when the door
is subject to a differential pressure of 13.8 kPa (2 psi):
1) until the door is in a position where it is clear of the fixed stops and is free to
open, or
2) until the loads required to overcome friction are sufficient to prevent the door
moving in an opening direction when the door is subjected to loads of +/-
0.5g,or
3) if neither of the above options are appropriate, based on justified engineering
judgement and agreed with the Agency.
On these doors, the locking means should monitor the latch securing means, but need not
directly monitor and lock each latch. Additionally, the locking means could be located such
that all latches are locked by locking the latching mechanism. With any single failure in the
latching mechanism, the means must still lock a sufficient number of latches to ensure that
the door remains safely latched.
(d)(5) It must not be possible to position the lock in the locked position if the latch and the latching
mechanism are not in the latched position.
The lock should be an effective monitor of the position of the latch such that, if any latch is
unlatched, the complete locking system cannot be moved to the locked position. Although
an over-centre feature may be an adequate means of securing the latching mechanism, it is
not considered to be the locking means for the latches.
(d)(6) It must not be possible to unlatch the latches with the locks in the locked position. Locks
must be designed to withstand the limit loads resulting from:
(i) the maximum operator effort when the latches are operated manually;
(ii) the powered latch actuators, if installed; and
(iii) the relative motion between the latch and the structural counterpart.

Annex to ED Decision 2023/021/R Page 476 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Although the locks are not the primary means of keeping the latches engaged, they must
have sufficient strength to withstand any loads likely to be imposed during all approved
modes of door operation. The operating handle loads on manually-operated doors should
be based on a rational human factors evaluation. However, the application of forces on the
handle in excess of 136 kg (300 pounds) need not be considered. The loads imposed by the
normal powered latch actuators are generally predictable; however, loads imposed by
alternate drive systems are not. For this reason the locks should have sufficient strength to
react the stall forces of the latch drive system. Load-limiting devices should be installed in
any alternate drive system for the latches in order to protect the latches and the locks from
overload conditions. If the design of the latch is such that it could be subject to ratcheting
loads which might tend to unlatch it, the locks should be adequate to resist such loads with
the latch operating system disconnected from the latch.
(d)(7) Each door for which unlatching would not result in a hazard is not required to have a locking
mechanism meeting the requirements of sub-paragraph (d)(3) through (d)(6) of this
paragraph.
See sub-paragraph CS 25.783(h) of this AMC, below, for a description of doors for which
unlatching is considered not to result in a safety hazard.
(d)(8) A door that could result in a hazard if not closed, must have means to prevent the latches
from being moved to the latched position unless it can be shown that a door that is not closed
would be clearly evident before flight.
For door security, it is good basic design philosophy to provide independent integrity in the
closing, latching, locking and indication functions. The integrity of the closing function in
particular is vulnerable to human factors and experience has shown that human error can
occur resulting in an unsafe condition.
Door designs should incorporate a feature that prevents the latches from moving to the
latched position if the door is not closed. The importance of such a feature is that it prevents
the latched and locked functions from being completed when the door is not closed.
If the feature is provided by electronic means, the probability of failure to prevent the
initiation of the latching sequence should be no greater than remote (1x10-5/flight hour).
To avoid the potential for an unsafe condition, the means provided to indicate the closed
position of the door under sub-paragraph (e) should be totally independent of the feature
preventing initiation of the latching sequence.
As an alternative to providing the feature described above, reliance can be placed on trained
cabin crew or flight crew members to determine that certain doors are not fully closed. This
alternative is applicable only to doors that are normally operated by these crew members,
and where it is visually clearly evident from within the aircraft without detailed inspection
under all operational lighting conditions that the door is not fully closed.
CS 25.783(e) Warning, caution and advisory indications
Doors must be provided with the following indications:
(e)(1)
operations to close, latch, and lock the door(s) have been completed.

Annex to ED Decision 2023/021/R Page 477 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

In order to minimise the probability of incomplete door operations, it should be possible to

station for a single door, appropriate indications should be provided at each station. The
ired operations have
been completed are such things as final handle positions or indicating lights. This
requirement is not intended to preclude or require a single station for multiple doors.
(e)(2) There must be a positive means, clearly visible from each operator station for each door that
could be a hazard if unlatched, to indicate if the door is not fully closed, latched, and locked.
A single indication that directly monitors the door in the closed, latched and locked
conditions should be provided unless the door operator has a visual indication that the door
is fully closed latched and locked. This indication should be obvious to the door operator. For
example, a vent door or indicator light that monitors the door locks and is located at the
operator
than the visual means in the cockpit as required per CS 25.783(e)(3). The same sensors could
be used for both indications in order to prevent any discrepancy between the indications.
(e)(3) There must be a visual means on the flight deck to signal the pilots if any door is not fully
closed, latched, and locked. The means must be designed such that any failure or
combination of failures that would result in an erroneous closed, latched, and locked
indication is remote for:
(i) each door that is subject to pressurisation and for which the initial opening movement
is not inward, or
(ii) each door that could be a hazard if unlatched.
The visual means may be a simple amber light or it may need to be a red warning light tied
to the master warning system depending on the criticality of the door. The door closed,
latched and locked functions must be monitored, but only one indicator is needed to signal
that the door is in the closed, latched and locked condition. Indications should be reliable to
ensure they remain credible. The probability of erroneous closed, latched, and locked
indication should be no greater than remote (1x10-5/flight hour) for:
each door subject to pressurisation and for which the initial opening movement is not
inward; and for
each door that could be a hazard if unlatched.
(e)(4) There must be an aural warning to the pilots prior to or during the initial portion of take-off
roll if any door is not fully closed, latched, and locked and its opening would prevent a safe
take-off and return to landing.
Where an unlatched door could open and prevent a safe take-off and return to landing, a
more conspicuous aural warning is needed. It is intended that this system should function in
a manner similar to the take-off configuration warning systems of CS 25.703 [Take-off
Warning system]. The visual display for these doors may be either a red light or a display on
the master warning system. Examples of doors requiring these aural warnings are:
doors for which the structural integrity of the fuselage would be compromised if the door
is not fully closed, latched and locked, or

Annex to ED Decision 2023/021/R Page 478 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

doors that, if open, would prevent rotation or interfere with controllability to an

unacceptable level.
CS 25.783(f) Visual inspection provision
Each door for which unlatching could be a hazard, must have provisions for direct visual inspection
to determine, without ambiguity, if the door is fully closed, latched, and locked. The provision must
be permanent and discernible under operational lighting conditions or by means of a flashlight or
equivalent light source.
A provision is necessary for direct visual inspection of the closed position of the door and the status
of each of the latches and locks, because dispatch of an aeroplane may be permitted in some
circumstances when a flight deck or other remote indication of an unsafe door remains after all
door closing, latching and locking operations have been completed. Because the visual indication
is used in these circumstances to determine whether to permit flight with a remote indication of an
unsafe door, the visual indication should have a higher level of integrity than, and be independent
of, the remote indication.
(a) The provisions should:
1) allow direct viewing of the position of the locking mechanism to show, without
ambiguity, whether or not each latch is latched and each lock is locked. For doors
which do not have a lock for each latch, direct viewing of the position of the latches
and restraining mechanism may be necessary for determining that all the latches are
latched. Indirect viewing, such as by optical devices or indicator flags, may be
acceptable provided that there is no failure mode that could allow a false latched or
locked indication.
2) preclude false indication of the status of the latches and locks as a result of changes in
the viewing angle. The status should be obvious without the need for any deductive
processes by the person making the assessment.
3) be of a robust design so that, following correct rigging, no unscheduled adjustment is
required. Furthermore, the design should be resistant to unauthorised adjustment.
4) preclude mis-assembly that could result in a false latched and locked indication.
(b) If markings are used to assist the identification of the status of the latches and locks, such
markings must include permanent physical features to ensure that the markings will remain
accurately positioned.
(c) Although the visual means should be unambiguous in itself, placards and instructions may be
necessary to interpret the status of the latches and locks.
(d) If optical devices or windows are used to view the latches and locks, it should be
demonstrated that they provide a clear view and are not subject to fogging, obstruction from
dislodged material or giving a false indication of the position of each latch and lock. Such
optical devices and window materials should be resistant to scratching, crazing and any other
damage from all materials and fluids commonly used in the operation and cleaning of
aeroplanes.
CS 25.783(g) Certain maintenance doors, removable emergency exits, and access panels

Annex to ED Decision 2023/021/R Page 479 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Some doors not normally opened except for maintenance purposes or emergency evacuation and
some access panels need not comply with certain sub-paragraphs of this paragraph as follows:
(1) Access panels that are not subject to cabin pressurisation and would not be a hazard if open
during flight need not comply with sub-paragraphs (a) through (f) of this paragraph, but must
have a means to prevent inadvertent opening during flight.
(2) Inward-opening removable emergency exits that are not normally removed, except for
maintenance purposes or emergency evacuation, and flight deck-openable windows need
not comply with sub-paragraphs (c) and (f) of this paragraph.
(3) Maintenance doors that meet the conditions of sub-paragraph (h) of this paragraph, and for
which a placard is provided limiting use to maintenance access, need not comply with sub-
paragraphs (c) and (f) of this paragraph.
Some doors not normally opened except for maintenance purposes or emergency evacuation and
some access panels are not required to comply with certain sub-paragraphs of CS 25.783 as
described in CS 25.783(g). This generally pertains to access panels outside pressurised
compartments whose opening is of little or no consequence to safety and doors that are not used
in normal operation and so are less subject to human errors or operational damage.
CS 25.783(h) Doors that are not a hazard
For the purpose of this paragraph, a door is considered not to be a hazard in the unlatched condition
during flight, provided it can be shown to meet all of the conditions as mentioned in CS 25.783(h).
CS 25.783 recognises four categories of doors:
Doors for which the initial opening is not inward, and are presumed to be hazardous if they
become unlatched.
Doors for which the initial opening is inward, and could be a hazard if they become
unlatched.
Doors for which the initial opening is inward, and would not be a hazard if they become
unlatched.
Small access panels outside pressurised compartments for which opening is of little or no
consequence to safety.
CS 25.783(h) describes those attributes that are essential before a door in the normal
(unfailed) condition can be considered not to be a hazard during flight.
6. STRUCTURAL REQUIREMENTS.
In accordance with CS 25.571, the door structure, including its mechanical features (such as hinges,
stops, and latches), that can be subjected to airframe loading conditions, should be designed to be
damage tolerant. In assessing the extent of damage under CS 25.571 and CS 25.783 consideration
should be given to single element failures in the primary door structure, such as frames, stringers,
intercostals, latches, hinges, stops and stop supports.
The skin panels on doors should be designed to be damage tolerant with a high probability of
detecting any crack before the crack causes door failure or cabin decompression.

Annex to ED Decision 2023/021/R Page 480 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Note: This paragraph applies only to aircraft with a certification basis including CS 25.571 or
equivalent requirements for damage tolerance.
[Amdt 25/4]
[Amdt 25/6]
[Amdt 25/8]
[Amdt 25/11]

CS 25.785 Seats, berths, safety belts and harnesses

(See AMC 25.785)
(a) A seat (or berth for a non-ambulant person) must be provided for each occupant who has reached
his or her second birthday.
(b) Each seat, berth, safety belt, harness, and adjacent part of the aeroplane at each station designated
as occupiable during take-off and landing must be designed so that a person making proper use of
these facilities will not suffer serious injury in an emergency landing as a result of the inertia forces
specified in CS 25.561 and CS 25.562. However, berths intended only for the carriage of medical
patients (e.g. stretchers) need not comply with the requirements of CS 25.562.
(c) Each seat or berth must be approved.
(d) Each occupant of a seat that makes more than an 18-degree angle with the vertical plane containing
the aeroplane centre line must be protected from head injury by a safety belt and an energy
absorbing rest that will support the arms, shoulders, head and spine, or by a safety belt and
shoulder harness that will prevent the head from contacting any injurious object. Each occupant of
any other seat must be protected from head injury by a safety belt and, as appropriate to the type,
location, and angle of facing of each seat, by one or more of the following:
(1) A shoulder harness that will prevent the head from contacting any injurious object.
(2) The elimination of any injurious object within striking radius of the head.
(3) An energy absorbing rest that will support the arms, shoulders, head and spine.
(e) Each berth must be designed so that the forward part has a padded end board, canvas diaphragm,
or equivalent means, that can withstand the static load reaction of the occupant when subjected
to the forward inertia force specified in CS 25.561. Berths must be free from corners and
protuberances likely to cause injury to a person occupying the berth during emergency conditions.
(f) Each seat or berth, and its supporting structure, and each safety belt or harness and its anchorage
must be designed for an occupant weight of 77 kg (170 pounds), considering the maximum load
factors, inertia forces, and reactions among the occupant, seat, safety belt, and harness for each
relevant flight and ground load condition (including the emergency landing conditions prescribed
in CS 25.561). In addition
(1) The structural analysis and testing of the seats, berths, and their supporting structures may
be determined by assuming that the critical load in the forward, sideward, downward,
upward, and rearward directions (as determined from the prescribed flight, ground, and
emergency landing conditions) acts separately or using selected combinations of loads if the

Annex to ED Decision 2023/021/R Page 481 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

required strength in each specified direction is substantiated. The forward load factor need
not be applied to safety belts for berths.
(2) Each pilot seat must be designed for the reactions resulting from the application of the pilot
forces prescribed in CS 25.395.
(3) For the determination of the strength of the local attachments of
(i) Each seat to the structure; and
(ii) Each belt or harness to the seat or structure; a multiplication factor of 1·33 instead of
the fitting factor as defined in CS 25.625 should be used for the inertia forces specified
in CS 25.561. (For the lateral forces according to CS 25.561(b)(3) 1·33 times 3·0 g should
be used.)
(g) Each crewmember seat at a flight-deck station must have a shoulder harness. These seats must
meet the strength requirements of sub-paragraph (f) of this paragraph, except that where a seat
forms part of the load path, the safety belt or shoulder harness attachments need only be proved
to be not less strong than the actual strength of the seat. (See AMC 25.785(g).)
(h) Each seat located in the passenger compartment and designated for use during take-off and landing
by a cabin crewmember required by the Operating Rules must be:
(1) Near a required floor level emergency exit, except that another location is acceptable if the
emergency egress of passengers would be enhanced with that location. A cabin crewmember
seat must be located adjacent to each Type A or B emergency exit. Other cabin crewmember
seats must be evenly distributed among the required floor level emergency exits to the
extent feasible.
(2) To the extent possible, without compromising proximity to a required floor level emergency
exit, located to provide a direct view of the cabin area for which the cabin crewmember is
responsible. (See AMC 25.785(h)(2))
(3) Positioned so that the seat will not interfere with the use of a passageway or exit when the
seat is not in use.
(4) Located to minimise the probability that occupants would suffer injury by being struck by
items dislodged from service areas, stowage compartments, or service equipment.
(5) Either forward or rearward facing with an energy absorbing rest that is designed to support
the arms, shoulders, head and spine.
(6) Equipped with a restraint system consisting of a combined safety belt and shoulder harness
unit with a single point release. There must be means to secure each restraint system when
not in use to prevent interference with rapid egress in an emergency.
(i) Each safety belt must be equipped with a metal-to-metal latching device.
(j) If the seat backs do not provide a firm handhold, there must be a handgrip or rail along each aisle
to enable persons to steady themselves while using the aisles in moderately rough air.
(k) Each projecting object that would injure persons seated or moving about the aeroplane in normal
flight must be padded.

Annex to ED Decision 2023/021/R Page 482 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(l)
in conducting the necessary en-route inspections.
[Amdt 25/11]
[Amdt 25/12]
[Amdt 25/13]
[Amdt 25/17]
[Amdt 25/19]

AMC 25.785 Seats, Berths, Safety Belts and Harnesses

FAA Advisory Circular (AC) 25.785-1B, Flight Attendant Seat and Torso Restraint System Installations,
dated 11.5.2010, and the relevant parts of FAA AC 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing an acceptable
means of compliance with CS 25.785.
-17A Change 1 that address the applicable FAR/CS-25

Beds, berths, or divans convertible into a bed should be equipped with a restraint device (e.g. a belt) for
use by the occupant(s) when sleeping. Beds, berths, etc. that may be occupied by more than one occupant
may be equipped with a single belt.
[Amdt 25/17]
[Amdt 25/19]
[Amdt 25/26]

AMC 25.785(g) Seats, berths, safety belts and harnesses

Where there is a risk that a safety belt or harness might, when not in use, foul the controls or impede the
crew, suitable stowage should be provided, unless it can be shown that the risk can be avoided by the
application of suitable crew drills.

AMC 25.785(h)(2) Cabin Attendant Direct View

If the total number of passenger seats approved for occupancy during taxiing, take-off, and landing is
greater than the approved passenger seating configuration, the demonstration of compliance with the
direct-view requirements should consider the most adverse combination of occupied seats, assuming the
full passenger load on board.
[Amdt 25/19]

CS 25.787 Stowage compartments

(See AMC 25.787)
(a) Each compartment for the stowage of cargo, baggage, carry-on articles and equipment (such as life
rafts) and any other stowage compartment must be designed for its placarded maximum weight of
contents and for the critical load distribution at the appropriate maximum load factors

Annex to ED Decision 2023/021/R Page 483 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

corresponding to the specified flight and ground load conditions and, where the breaking loose of
the contents of such compartments could
(1) Cause direct injury to occupants;
(2) Penetrate fuel tanks or lines or cause fire or explosion hazard by damage to adjacent systems;
or
(3) Nullify any of the escape facilities provided for use after an emergency landing, to the
emergency landing conditions of CS 25.561(b)(3).
If the aeroplane has a passenger-seating configuration, excluding pilot seats, of 10 seats or more,
each stowage compartment in the passenger cabin, except for under seat and overhead
compartments for passenger convenience, must be completely enclosed.
(b) There must be a means to prevent the contents in the compartments from becoming a hazard by
shifting, under the loads specified in sub-paragraph (a) of this paragraph. (See AMC 25.787(b))
(c) If cargo compartment lamps are installed, each lamp must be installed so as to prevent contact
between lamp bulb and cargo.
[Amdt 25/18]

AMC 25.787(b) Stowage compartments

For stowage compartments in the passenger and crew compartments it must be shown by analysis and/or
tests that under the load conditions as specified in CS 25.561(b)(3), the retention items such as doors,
swivels, latches etc., are still performing their retention function. In the analysis and/or tests the expected
wear and deterioration should be taken into account.
Stowage Compartment Latching Mechanisms:
(1) The following areas shall be considered in a special cabin interior for the purpose of designing
latching mechanisms:
Cabin crew member areas:
Cabin crew member areas are those areas in the passenger cabin where cabin crew members
may be seated during taxiing, take-off, and landing (these are typically zones in proximity to
floor level emergency exits, although other areas may exist).
To protect flight attendants from being struck by items dislodged from galley stowage
compartments, it is common practice to install additional restraint devices (dual latching) to
each stowage compartment located within a longitudinal distance equal to three rows of
seats fore and aft of the cabin attendant seats. However, the following additional
considerations may be used:

criterion is difficult to assess due to widely spaced seating,

Underseat and overhead stowage bins do not need to be considered, and

Annex to ED Decision 2023/021/R Page 484 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

A stowage compartment located in a closed unoccupied area during taxiing, take-

off, and landing or behind a partition in the passenger cabin does not need to be
considered.
Passenger Areas:
Passengers Areas are zones in which passenger seats designed for occupancy during taxiing,
take-off, and landing are installed. In such cabin areas, if the means used to prevent the
contents of the compartments from becoming a hazard by shifting is a latched door, the
design should take into consideration the wear and deterioration expected in service.
Non TTOL Areas:
Non-TTOL areas are zones, separated from the remainder of the cabin by means of a door
during taxiing, take-off, and landing (TTOL), in which no seat is installed (passenger or crew
member) that may be occupied during taxiing, take-off, and landing, and which do not
include any part of any possible egress route from the aeroplane (such areas may be for
example lavatories, washrooms, bedrooms, closed galleys, etc.).
In such areas, a single latch mechanism for stowage compartments is acceptable, provided
that the door separating this area from the rest of the cabin is shown to be capable of staying
securely closed under the applicable emergency landing conditions of CS 25.561 with an
additional inertia load, uniformly distributed on the door, equating to the highest placarded
allowable single compartment contents mass inside that area. Such single latch mechanisms
do not need to be designed to account for the wear and deterioration expected in service.
(2) The following is provided as a clarification of the considerations to be followed when
designing latching mechanisms, as well as of the means by which wear and deterioration
expected in service may be substantiated:
Single latch:
A single latch is a latching mechanism capable of retaining a load derived from the specified
maximum flight, ground and emergency landing load conditions.
Dual latch:
A dual latch is a latching mechanism composed of two independent single latching
mechanisms each of which is capable of retaining a load determined by the specified
maximum flight, ground and emergency landing load conditions. It is acceptable that a single
operating mechanism (e.g. handle) operates with two independent latching mechanisms at
the same time.
Latch fail indication
Latch fail indication is any means that permits clear visual confirmation that a latch is not
properly engaged. In the case of a dual latching system, a single indication may serve for the
two latches if it is ensured that the failure of either latch to properly engage will result in
latch fail indication. All latches, whether single or dual, should include a latch fail indication.
Wear and Deterioration

Annex to ED Decision 2023/021/R Page 485 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Dual latching is a means of compliance to the wear and deterioration requirement.

Where dual latches are installed there is no need to further demonstrate wear and
tear.
Consideration of wear and deterioration for single latches should be substantiated
by test evidence, or analysis based on test evidence, showing that latch operation
as intended by the design will be maintained following a simulation of full service
life, with an appropriate scatter factor. A design life of 20 000 latch cycles may be
used except if EASA finds the expected use of the aeroplane justifies more
endurance substantiation. Demonstration of a 20 000 cycle design life can be
accomplished by submitting the latch to a 100 000 cycle test representative of
operational use, and verifying after the test that the latch is still able to operate as
intended and is capable of withstanding ultimate load without failure.
(3) The above considerations regarding latching mechanisms, do not apply to compartments not
accessible in flight for which a special tool is needed to gain access to (e.g. maintenance
panel, access panels, etc.).
[Amdt 25/19]

CS 25.788 Passenger amenities

(See AMC 25.788)
(a) Showers: If a shower cubicle is installed (See AMC 25.788(a) and AMC 25.1447(c)(3)):
(1) -cubicle
occupant, and activated at the same time as the signs required by CS 25.791(b), must be
provided;
(2) audio and visual indications of the need for oxygen use, readily audible and visible to a
shower-cubicle occupant, and activated in the case of cabin depressurisation or deployment
of the oxygen-dispensing units in the cabin, must be provided;
(3) placards must be installed to indicate that the shower cubicle must not be used for the
stowage of cargo or passenger baggage;
(4) there must be means in the cubicle to steady oneself in moderately rough air; and
(5) the shower cubicle must be designed in a way to preclude anyone from being trapped inside.
If a locking mechanism is installed, it must be capable of being unlocked from the inside and
the outside without the aid of any tool.
(b) Large display panels: Any large display panel installed in the passenger compartment must not be
a source of danger to occupants when submitted to any of the following conditions (See AMC
25.788(b)):
(1) each relevant flight and ground load conditions (including the emergency landing conditions
prescribed in CS 25.561);
(2) any load to be expected in service; and

Annex to ED Decision 2023/021/R Page 486 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(3) a cabin depressurisation.

[Amdt 25/19]

AMC 25.788(a) Installation of Showers

The following should be considered in the design of a shower installation:
(a) An analysis should be performed to identify possible failures leading to water leakage, and
to show that appropriate mitigation features have been included in the design.
(b) The shower cubicle should be considered as a passenger compartment in terms of the need
for ventilation. The applicant should justify that adequate ventilation is provided within the

shower.
(c) The shower cubicle air outflow should be directed into aeroplane areas that will not be
adversely affected by the high water content of this air flow.
(d) A means to steady oneself could be either (a) firm handhold(s) specifically designed and
provided for the purpose or an intrinsic design feature of the cubicle. For instance, if one or
more of the cubicle wall-to-wall dimensions does not exceed 1 metre (3.3 feet), it may be
assumed that an occupant can steady himself/herself by placing his/her hands on opposite
wall surfaces.
(e) If electrical power outlets are installed in the room or area where the shower is present, all
the following requirements should be fulfilled:
(i) the shower cubicle should be enclosed up to the ceiling;
(ii) there should be no electrical power outlet inside the shower cubicle; and
(iii) no power outlet should be placed closer than 0,6m from any point on the surface of
the closed shower door.
[Amdt 25/19]

AMC 25.788(b) Large Display Panels

1. General
This AMC does not apply to flight deck display panels. A display panel should be considered large if
its diagonal is greater than 51 cm (20 in.).
Any large display panel should be shown not to be a hazard during events such as emergency
landing and cabin depressurisation. It should meet the following requirements:
(a) the large display panel should withstand the differential pressures caused by a worst-case
cabin depressurisation event without having any adverse effect (for instance no substances
should be released through cracks or openings, no sharp edges should be created);
(b) the large display panel should be subjected to, and pass, abuse load testing (see paragraph 3
below);

Annex to ED Decision 2023/021/R Page 487 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(c) the installation should withstand the inertia loads outlined in CS 25.561(b)(3) without any
adverse effect; and
(d) if the large display panel incorporates glass, it should be subjected to, and pass, ball impact
testing (see paragraph 2 below).
With the exception of the ball impact testing, large display panels incorporating any glass element
should withstand the above-defined loads with no more than minor cracks (i.e. no parts released
nor the surface becoming a hazard) and without becoming dislodged from their mounts.
Alternatively, the installation may still be found acceptable if some means, such as a protective
cover, are provided to shield the passenger cabin from the glass monitor. The installation including
its protective cover should meet all the relevant criteria identified in this AMC. Furthermore, the
cover should not introduce additional hazardous characteristics of its own and should comply with
all pertinent aeroplane certification requirements, e.g. flammability.
Unless it has been shown that the display panel withstands all the mechanical tests in paragraphs
1.(a) to (d) above without any damage that would result in the release of chemical substances into
the cabin, documentation should be provided from medical authorities which substantiates that
the type and amount of chemical substances released into the cabin in case of failure would not
result in adverse health effects on cabin occupants. The specific cabin volume may be considered.
Alternatively, it is acceptable to show that each installed glass screen complies with A 4(1) of
the restriction of the use of certain hazardous substances in electrical and

2. Ball Impact Testing (only for display panels containing glass)

The test procedure and pass/fail criteria of the Underwriters Laboratories standard UL 61965,
Mechanical safety for cathode ray tubes, Edition 2, 27 July 2004 or former UL 1418, Standard for
safety cathode ray tubes, Edition 5, 31 December 1992, or other equivalent approved method, are
the basis of the ball impact strength and no-hole tests described in this paragraph.
The large display panel should be installed in a test fixture representative of the actual installation
in the cabin.
2.1. Strength Test
The large display panel should be subjected to a single impact applied in accordance with the
test conditions of paragraph 2.3 below. The impact energy should be 7 J, caused by a 51-mm
diameter ball or, alternatively, 5.5 J, caused by a 40-mm diameter ball, as specified in
paragraph 2.3.2 below.
The test is passed if the expulsion of glass within a 1-min period after the initial impact
satisfies the following criteria:
(a) there is no glass particle (a single piece of glass having a mass greater than 0.025 g)
between the 0.90 and 1.50-m barriers (see paragraph 2.3.1);
(b) the total mass of all pieces of glass between the 0.90 and 1.50-m barriers (see
paragraph 2.3.1) does not exceed 0.1 g; and
(c) there is no glass expelled beyond the 1.50-m barrier (see paragraph 2.3.1).
2.2 No-Hole Test

Annex to ED Decision 2023/021/R Page 488 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

The large display panel should be subjected to a single impact applied in accordance with the
test conditions of paragraph 2.3 below. The impact energy should be 3.5 J, caused by a 51-
mm diameter ball as specified in P 2.3.2 below.
The test is passed if the large display panel does not develop any opening that may allow a
3-mm diameter rod to enter. Cracking of the panel is permitted.
Note: If the large display panel does not develop any opening that would allow a 3-mm rod
to enter when subjected to the strength test defined in paragraph 2.1 above, the no-hole test
defined in this paragraph does not need to be performed.
2.3 Test Conditions
2.3.1 Test Apparatus and Setup
The centre of the large glass item should be 1.00 ± 0.05 m above the floor.
For the strength test (see paragraph 2.1 above), two barriers, each one made of
material 10 20 mm thick, 250 mm high, and 2.00 m long, should be placed on the floor
in front of the test item (or on both sides in case of a glass partition) at the specified
location, measured horizontally from the front surface of the large glass item to the
near surface of the barrier. The barriers may be less than 2.00 m long, provided that
they extend to the walls of the test room. A non-skid surface such as a blanket or rug
may be placed on the floor.
A solid, smooth, steel ball of the size specified in paragraph 2.3.2 below should be
suspended by suitable means such as a fine wire or chain and allowed to fall freely as
a pendulum and strike the large glass item with the specified impact energy. The large
glass item should be placed in a way that its surface is vertical and in the same vertical
plane as the suspension point of the pendulum. A single impact should be applied to
any point on the surface of the large glass item at a distance of at least 25 mm from
the edge of the surface.
2.3.2 Impact Objects
The 51-mm diameter steel ball used as an impact object should have a mass of
approximately 0.5 kg and a minimum Scale C Rockwell Hardness of 60.
The 40-mm diameter steel ball used as an impact object should have a mass of
approximately 0.23 kg and a minimum Scale C Rockwell Hardness of 60.
3. Abuse Load Tests (all large display panels)
Large display panels should withstand a 133 daN (300 lbf) static abuse load applied, in separate
tests, in 5 different locations: in the centre, at the opposite corners (two separate tests), along the
perimeter, at the midpoints of the short and long sides (two separate tests), or at an equivalent set
of locations acceptable to EASA (see Figure 2 below).
For all the tests to be performed, the display panels should be mounted in a test fixture
representative of the actual installation in the cabin.
For the above-mentioned load applications, it is acceptable to use any loading pad with a shape and
dimensions that fit into a 15.24-cm (6-in.) diameter circle.

Annex to ED Decision 2023/021/R Page 489 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

The display panels should withstand the applied loads without any adverse effect (e.g. glass
elements, if present, cracking or breaking, the unit becoming dislodged from its mounts, substances
released through cracks or openings, or sharp edges created).
During the test, it is acceptable for the display to suffer minor failures, such as minor cracks,
provided that no parts are detached and the surface does not become a hazard to occupants.

Area of load application Large display panel

2 5

4 1

Figure 2 Load Cases

1) centre loading;
2) corner loading;
3) opposite-corner loading;
4) short-side-midpoint perimeter loading; and
5) long-side-midpoint perimeter loading.
[Amdt 25/19]

CS 25.789 Retention of items of mass in passenger and crew

compartments and galleys
(a) Means must be provided to prevent each item of mass (that is part of the aeroplane type design)
in a passenger or crew compartment or galley from becoming a hazard by shifting under the
appropriate maximum load factors corresponding to the specified flight and ground load
conditions, and to the emergency landing conditions of CS 25.561(b).
(b) Each interphone restraint system must be designed so that when subjected to the load factors
specified in CS 25.561(b)(3), the interphone will remain in its stowed position.

CS 25.791 Passenger information signs and placards

(See AMC 25.791)
(a) If smoking is to be prohibited, there must be at least one placard so stating that is legible to each
person seated in the cabin. If smoking is to be allowed, and if the crew compartment is separated
from the passenger compartment, there must be at least one sign notifying when smoking is

Annex to ED Decision 2023/021/R Page 490 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

prohibited. Signs, which notify when smoking is prohibited, must be installed so as to be operable

cabin illumination to each person seated in the cabin.

(b) Signs that notify when seat belts should be fastened and that are installed to comply with the

illuminated, must be legible under all probable conditions of cabin illumination to each person
seated in the cabin.
(c) A placard must be located on or adjacent to the door of each receptacle used for the disposal of
flammable waste materials to indicate that use of the receptacle for disposal of cigarettes, etc., is
prohibited.
(d) conspicuously located on
or adjacent to each side of the entry door.
(e) Symbols that clearly express the intent of the sign or placard may be used in lieu of letters.
[Amdt No: 25/23]

AMC 25.791 Passenger information signs and placards

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing acceptable means
of compliance with CS 25.791.
-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/11]
[Amdt 25/26]

CS 25.793 Floor surfaces

(See AMC to CS 25.793 and 25.810(c))
The floor surface of all areas, which are likely to become wet in service, must have slip resistant properties.
[Amdt 25/17]

AMC 25.793 and 25.810(c) Floor surfaces

The slip-resistant properties of floor surface material should be tested wet with the type of slippery liquid
expected during operation. In addition, dry testing should also be conducted to provide reference friction
values. In all the test conditions, the dynamic coefficient of friction (DCOF) should be at least 0.45.
The following standard methods, using rubber and leather test devices, are acceptable (within their
limitations) to conduct the testing:
Military Specifications MIL-W-5044B (dated 24 February 1964) and MIL-W-5044C (dated 25 August

Annex to ED Decision 2023/021/R Page 491 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

DIN 51131:2014- - Determination of the anti-slip property -

- Film and sheeting -

- Measurement of dynamic

ANSI/NFSI B101.3- F of Common Hard-Surface Floor

[Amdt 25/17]
[Amdt 25/26]

CS 25.795 Security considerations

(see AMC 25.795)
(a) Protection of flightdeck. If a secure flightdeck door is required by operating rules, the bulkhead,
door, and any other accessible boundary separating the flight crew compartment from occupied
areas must be designed to:
(1) Resist forcible intrusion by unauthorised persons and be capable of withstanding impacts of
300 Joules (221.3 footpounds) as well as a 1113 Newton (250 pound) tensile load on
accessible handholds, including the doorknob or handle (See AMC 25.795(a)(1)); and
(2) Resist penetration by small arms fire and fragmentation devices by meeting the following
projectile definitions and projectile speeds.
(i) Demonstration Projectile #1. A 9 mm full metal jacket, round nose (FMJ RN) bullet with
nominal mass of 8.0 g (124 grain) and reference velocity 436 m/s (1,430 ft/s).
(ii) Demonstration Projectile #2. A .44 Magnum, jacketed hollow point (JHP) bullet with
nominal mass of 15.6 g (240 grain) and reference velocity 436 m/s (1,430 ft/s). (See
AMC 25.795(a)(2))
(b) Aeroplanes with a certificated passenger seating capacity of more than 60 persons or a maximum
take-off weight of over 45 500 Kg (100 000 lb) must be designed to limit the effects of an explosive
or incendiary device as follows:
(1) Flight deck smoke protection. Means must be provided to limit entry of smoke, fumes, and
noxious gases into the flight deck. (See AMC 25.795(b)(1))
(2) Passenger cabin smoke protection. Except for aeroplanes intended to be used solely for the
transport of cargo, means must be provided to prevent passenger incapacitation in the cabin
resulting from smoke, fumes, and noxious gases as represented by the initial combined
volumetric concentrations of 0.59% carbon monoxide and 1.23% carbon dioxide. (See AMC
25.795(b)(2))
(3) Cargo compartment fire suppression. An extinguishing agent must be capable of suppressing
a fire. All cargo-compartment fire suppression-system components must be designed to
withstand the following effects, including support structure displacements or adjacent
materials displacing against the distribution system:

Annex to ED Decision 2023/021/R Page 492 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(i) Impact or damage from a 13 mm (0.5-inch) -diameter aluminium sphere travelling at

131 m/s (430 feet per second);
(ii) A 103 kPa (15 psi) pressure load if the projected surface area of the component is
greater than 0,4 square meter (4 square feet). Any single dimension greater than 1,2
meters (4 feet) may be assumed to be 1,2 meters (4 feet) in length; and
(iii) A 15 cm (6-inch) displacement, except where limited by the fuselage contour, from a
single point force applied anywhere along the distribution system where relative
movement between the system and its attachment can occur.
(iv) Paragraphs (b)(3)(i) through (iii) of this paragraph do not apply to components that are
redundant and separated in accordance with paragraph (c)(2) of this paragraph or are
installed remotely from the cargo compartment. (See AMC 25.795(b)(3))
(c) An aeroplane with a certificated passenger seating capacity of more than 60 persons or a maximum
take-off weight of over 45 500 Kg (100,000 lbs) must comply with the following:
(1) Least risk bomb location. Except for aeroplanes intended to be used solely for the transport
of cargo, an aeroplane must be designed with a designated location where a bomb or other
explosive device could be placed to best protect integrity of the structure and flight-critical
systems from damage in the case of detonation. (See AMC 25.795(c)(1))
(2) Survivability of systems.
(i) Except where impracticable, redundant aeroplane systems necessary for continued
safe flight and landing must be physically separated, at a minimum, by an amount
equal to a sphere of diameter

(where H0 is defined under paragraph 25.365(e)(2) and D need not exceed 1,54 meters
(5.05 feet).
The sphere is applied everywhere within the fuselage-limited by the forward bulkhead
and the aft bulkhead of the passenger cabin and cargo compartment beyond which
only one-half the sphere is applied.
(ii) Where compliance with sub-paragraph (c)(2)(i) of this paragraph is impracticable,
other design precautions must be taken to maximise the survivability of those systems.
(See AMC 25.795(c)(2))
(3) Interior design to facilitate searches. Except for aeroplanes intended to be used solely for the
transport of cargo, design features must be incorporated that will deter concealment or
promote discovery of weapons, explosives, or other objects from a simple inspection in the
following areas of the aeroplane cabin:
(i) Areas above the overhead bins must be designed to prevent objects from being hidden
from view in a simple search from the aisle. Designs that prevent concealment of
objects with volumes 0.33 cubic decimetre (20 cubic inches) and greater satisfy this
requirement.
(ii) Toilets must be designed to prevent the passage of solid objects greater than 5 cm (2.0
inches) in diameter.

Annex to ED Decision 2023/021/R Page 493 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

(iii) Life preservers or their storage locations must be designed so that tampering is
evident. (See AMC 25.795(c)(3))
(d) Each chemical oxygen generator or its installation must be designed to be secure from deliberate
manipulation by one of the following:
(1) By providing effective resistance to tampering;
(2) By providing an effective combination of resistance to tampering and active tamper-evident
features;
(3) By installation in a location or manner whereby any attempt to access the generator would
be immediately obvious; or
(4) By a combination of approaches specified in subparagraphs (d)(1), (d)(2) and (d)(3) of this
paragraph. (See AMC 25.795(d))
[Amdt 25/9]
[Amdt 25/17]
[Amdt 25/18]

AMC 25.795 Security considerations

Referenced Documentation:
FAA memorandum, Subject Information: Certification of strengthened Flight Deck Doors on Transport
Category Airplanes, Original release 6 November 2001.

AMC 25.795(a)(1) Flightdeck intrusion resistance

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-1A, Flightdeck Intrusion Resistance,
issue date 24 October 2008.
[Amdt 25/9]

AMC 25.795(a)(2) Flightdeck penetration resistance

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-2A, Flightdeck Penetration Resistance,
issue date 24 October 2008.
Level IIIA of the (US) National Institute of Justice, Ballistic Resistance of Personal Body Armor, NIJ
Standard 0101.04, Office of Science and Technology, Washington, D.C. 20531, September 2000.
[Amdt 25/9]

AMC 25.795(b)(1) Flight deck smoke protection

Referenced Documentation:

Annex to ED Decision 2023/021/R Page 494 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Federal Aviation Administration Advisory Circular (AC) 25.795-3, Flight deck Protection (smoke and
fumes), issue date 24 October 2008.
[Amdt 25/9]

AMC 25.795(b)(2) Passenger cabin smoke protection

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-4, Passenger Cabin SmokeProtection,
issue date 24 October 2008.
[Amdt 25/9]

AMC 25.795(b)(3) Cargo compartment fire suppression

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-5, Cargo Compartment Fire
Suppression, issue date 24 October 2008.
[Amdt 25/9]

AMC 25.795(c)(1) Least risk bomb location

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-6, Least Risk Bomb Location, issue date
24 October 2008.
[Amdt 25/9]

AMC 25.795(c)(2) Survivability of systems

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-7, Survivability of Systems, issue date
24 October 2008.
[Amdt 25/9]

AMC 25.795(c)(3) Interior design to facilitate searches

Referenced Documentation:
Federal Aviation Administration Advisory Circular (AC) 25.795-8, Interior design to facilitate searches,
issue date 24 October 2008.
[Amdt 25/9]

Annex to ED Decision 2023/021/R Page 495 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.795(d) Security of chemical oxygen generators

1. Purpose
CS 25.795(d) requires each Chemical Oxygen Generator (COG) or its installation to be designed so
that it meets one of several criteria. The means of compliance described in this AMC provides
guidance to supplement the engineering and operational judgment that should form the basis of
any compliance findings related to a COG installed on an aeroplane.
2. Definition of terms
For this AMC, the following definitions apply:
(a) Access: The ability to manipulate the COG with the intent of making alterations for a purpose
for which the COG was not originally designed. This includes gaining access to the area
surrounding the COG.
(b) Activation: Release of the firing mechanism of the COG for the purpose of initiating the
chemical reaction inside.
(c) Alteration: A change
purpose of using the COG for a function other than the one it is intended for.
(d) Chemical Oxygen Generator (COG): A device that releases oxygen that is created from a
chemical reaction.
(e) Immediately obvious:

(f) Intervention: The actions crew members must take to prevent damage to the aeroplane once
an alert is activated indicating that the COG is being tampered with. The time it takes to
intervene when the lavatory is occupied has not been determined; however, it can be
assumed that it will take several minutes to resolve the issue.
(g) Observable

(h) Tamper-evident feature: A unique feature that provides an active and obvious

(i) Tamper-resistance:
(j) Unrestricted access: An area of the cabin passengers can enter without overcoming locks or
other mechanical closure means.
3. Related Certification Specifications (CSs)
CS 25.795 Security considerations
CS 25.1301 Equipment Function and installation
CS 25.1309 Equipment, systems, and installations
CS 25.1322 Flight crew alerting

Annex to ED Decision 2023/021/R Page 496 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.1450 Chemical oxygen generators

4. Compliance with CS 25.795(d)
(a) Acceptable means of determining if a COG or its installation is designed to be secure
Several criteria may be used for determining if a COG installation is secure or has a security
vulnerability. COG installations with a security vulnerability must include design features to
prevent potential misuse of the COG. Figure 1, Criteria for Assessing an Installation, includes
assessment criteria that can be used for determining if a COG installation has a security
vulnerability. Table 1 includes guidance to assist in answering the questions in Figure 1. For
installations identified as having security vulnerabilities, such as those for which the answers
to the assessment statements in Figure 1 result in the answer to question number 4 being
yes, the design should be changed. Alternatively, the COG can be replaced with an acceptable
oxygen source that is not a security threat.

Annex to ED Decision 2023/021/R Page 497 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Figure 1: Criteria for assessing an installation

Annex to ED Decision 2023/021/R Page 498 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

Table 1: Assessment statement analysis

Question Notes and questions to assist with the assessment statement analysis
number
1. Review the instructions for continued airworthiness.
Review the drawing system.

2. Can crew members observe the COG installation? Check the area where the COG is installed.
Isolated areas such as galleys, lavatories, crew rests, enclosed occupied compartments, and lower
lobe lavatory complexes are potential areas of concern and require further evaluation.
Are crew members close to the COG installation during their normal duties?
Are there physical barriers between the crew members and the area being evaluated?
Is there significant distance between the crew members and the area being observed?
How accessible is the COG?
Is the COG installation surrounded by curtains? Curtained areas are also considered potential
areas of concern and may require further evaluation.
3. Are there locks on doors/access panels to prevent access?
Are there tamper-resistant fasteners on panels?
Are alarms or some
design?
4. Check if the COG can be compromised in place.
Assess the vulnerability of the adjacent materials to contain the compromised device.
Assess the ability of the compartment to contain the event.
Check if the COG can be removed.

(b) Installation of tamper-resistant features

Tamper-resistant design features can be used, in whole or in part, to make a COG installation
secure. There are different types of tamper-resistant design features, and their functionality
largely depends on the installation. The principal benefit of tamper-resistance is to delay
exploitation of the COG as a weapon. However, it is not likely that an existing COG installation
that can be accessed from within the lavatory could be modified with tamper-resistant design
features sufficient to prevent a successful attack. This is because typical measures of tamper-
resistance, such as special tools and fasteners, could likely be overcome given enough time.
These measures are normally used as one of several layers of security. Thus, the reliance on
such measures is only one element of the security system.
(1) A tamper-resistant installation employs multiple elements, which may include:
(i)
(ii) the method of mounting;
(iii) physical protection (through shielding or mechanical isolation of key
components); and
(iv) internal design.
(2) Eliminating access to the COG is the most straightforward way to make the COG
tamper-resistant. Typically, this can be done by placing the COG in a location where
significant disassembly of the cabin interior would be required to gain access. For

Annex to ED Decision 2023/021/R Page 499 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

example, the COG for a lavatory could be located so that the entire lavatory module
would have to be removed to access the COG. However, the installer should also
consider the ramifications on maintenance when this approach is used.
(c) Installation of tamper-evident features
(1) For COGs that can be accessed from isolated compartments, such as lavatories, some
form of active tamper-evidence (for example, an alert) would be needed in addition to
the installation of tamper-resistant features. This is necessary so that the time to
intervene and stop the attack is less than the time required to carry out the attack. In
this case, passive tamper-evident features, such as a tamper-evident seal, are not
effective because they provide an after-the-fact notification of tampering. The
effectiveness of a tamper-evident system depends on intervention; it cannot be
assumed that the alarm by itself would inhibit the attack.
(2) Once an alert is activated indicating that the COG is being tampered with, actions by
crew members and other available, authorised responders are necessary to prevent
catastrophic damage to the aeroplane. Therefore, there is a critical relationship
between the tamper-evidence system and the training and capability of the crew to
respond. To be most effective, crew training should be accomplished prior to the alarm
feature being deployed into the fleet. The time needed to successfully respond to the
alarm may be several minutes and depends on several factors. The time available to
respond to a threat and intervention times are functions of not only the design
features but also of many complex and human factor-dependent variables that are
difficult to define. These variables include but are not limited to the individual
capabilities and numbers of flight attendants/authorised responders relative to the
terrorists/accomplices, as well as the extensiveness of the training received.
(3) In order to be effective, the alerting system must itself be resistant to tampering.
Otherwise, the entire concept of using the early notification to crew could be nullified
and the COG accessed without impediment.
(d) System safety considerations
The applicant should consult AMC 25.1309 for guidance on compliance with CS 25.1309.
(e) Hazard classification. Failure of tamper-resistant or tamper-evident features should be
considered major.
(f) System performance when installed
A tamper-evidence system installed for compliance with CS 25.795(d) is intended to notify
crew members that someone is trying to gain access to a COG. The system should provide
aural and visual warnings to immediately notify crew members so that they can provide
direct response in a timely manner. For example, visual indication should be provided so that
crew members can identify which COG location is being tampered with while performing
their normal duties. Aural alerts should be distinct from other alerts and clearly audible to
the crew members expected to respond to the alert. If an alert is provided to the flight crew,
the alert should be presented in accordance with CS 25.1322.
5. Areas that are immediately obvious

Annex to ED Decision 2023/021/R Page 500 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PERSONNEL AND CARGO ACCOMMODATIONS

For COG installations located where any attempt to access would be immediately obvious,
additional safety measures are not required. Immediately obvious areas include the main passenger
cabin and other areas where occupants are always present. While some measure of tamper-
resistance is encouraged for these locations, none is required to meet CS 25.795(d). Private
compartments (such as a lavatory) or visually divided sections of larger cabin areas are assessed

installation, not simply the general area in which it is located. In addition, the installation should be
evaluated under all conditions that may exist during a flight. So, for example, if tampering would be
immediately obvious except when a curtain is pulled to provide privacy, the installation should be
evaluated based on the curtain being arranged in a way that most conceals the installation. As with
tamper-evident designs, crews should be made aware that tampering with any COG is a safety risk,
and any necessary information should be incorporated into the training programmes.
[Amdt 25/17]

Annex to ED Decision 2023/021/R Page 501 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

EMERGENCY PROVISIONS

CS 25.801 Ditching
(See AMC 25.801)
(a) Whether or not ditching certification is requested, it must be shown that, following an unplanned
ditching, the flotation time and trim of the aeroplane will allow the occupants to leave the
aeroplane.
(b) If certification with ditching provisions is requested, the aeroplane must comply with CS 25.563, CS
25.807(i), CS 25.1411, CS 25.1415 and the following:
(1) Each practicable design measure, compatible with the general characteristics of the
aeroplane, must be taken to minimise the probability that in a planned emergency landing
on water, the behaviour of the aeroplane would cause immediate injury to the occupants or
would make it impossible for them to escape.
(2) The probable behaviour of the aeroplane in a planned emergency landing on water must be
investigated by model tests or by analytical methods supported by tests. Features likely to
affect the hydrodynamic characteristics of the aeroplane must be considered.
(3) It must be shown that, following a planned emergency landing on water, the flotation time
and trim of the aeroplane will allow the occupants to leave the aeroplane and enter the rafts.
The flotation and evacuation assessment must account for all sources of water leakage that
may be present after the planned emergency landing.
[Amdt 25/15]
[Amdt 25/28]

AMC 25.801 Ditching

AMC 25.801 primarily provides guidance and acceptable means of compliance with the ditching
certification specifications of CS 25.801 (Ditching).
Definitions and guidance material provided in AMC 25.563 can also be used when showing compliance
with CS 25.801.
1. CS 25.801(a) Evacuation after an unplanned ditching
Although there are many possible scenarios that could result in an unplanned ditching, the following
assumptions may be used for addressing compliance with the unplanned ditching specifications in
CS 25.801(a).
(1) To simplify compliance determinations for an unplanned ditching scenario, no aeroplane damage
should be considered and calm water states may be assumed. For this reason, the dynamics of entry
into the water should not be considered, including analysis of dynamic pressures resulting from the
aeroplane coming to rest; it may be assumed that the aeroplane has come to rest in the water
immediately after an unplanned ditching.

Annex to ED Decision 2023/021/R Page 502 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(2) Because an unplanned ditching immediately after a failed or aborted take-off could occur at high
aeroplane weights, for the purpose of developing a flotation analysis, the worst-case combination
of aeroplane weight and centre of gravity should be considered (typically expected to be maximum
take-off weight with the centre of gravity at the aft limit).
(3) All sources of water leakage into the aeroplane should be considered.
(4) Since not all aeroplanes are required to carry ditching equipment associated with overwater flights,
it is not necessary to account for the time to retrieve and launch rafts.
(5) For the purpose of developing a flotation and evacuation analysis, an exit should be conservatively
considered unusable when water comes in over the top of the door sill.
(6) Aeroplane flotation should be assumed to end when the first ditching exit goes below the waterline
or the attitude of the aeroplane is such that it would require extraordinary effort to move through
the cabin (e.g. 20 degrees). However, if it can be shown to be conservative, the flotation time may
be extended. Evidence of conservatism should include an assessment of the number of persons
expected to remain in the aeroplane when the ditching exit sill(s) go(es) below the waterline, the
number of ditching exits remaining above the waterline and the attitude of the aeroplane.
Note regarding points (5) and (6) above: If it can be shown to still be conservative, an exit may
qualify as a ditching exit even if it does not remain above the waterline for the full duration of the
evacuation. The substantiation of conservatism should include an assessment of how long the
ditching exit remains above the waterline, the number of persons expected to remain in the
aeroplane when the ditching exit sill(s) go(es) below the waterline and the number of other ditching
exits remaining above the waterline.
(7) In order to be credited with a full passenger seat-to-exit ratio, each ditching exit should either
remain above the waterline during the entire evacuation or be available for use long enough to
allow the number of evacuees equal to its seat-to-ditching exit ratio to use the exit (e.g. a ditching
exit with a 35-passenger seat-to-exit ratio should either remain usable for the entire evacuation or
long enough to allow at least 35 evacuees to exit the aeroplane through that exit in order to receive
the full 35 passenger ratio). A lower passenger seat-to-exit ratio may be sought provided the exit
remains above the waterline for the majority (greater than 50 %) of the total aeroplane evacuation
time. No passenger seat credit should be allowed for a ditching exit that does not remain above the
waterline for the majority of the total aeroplane evacuation time.
(8) In the case of non-overwing ditching exits, it is acceptable to assume that passengers will exit the
aeroplane by entering the slide/raft (if provided) or by jumping into the water and swimming away
from the exit. In the case of overwing exits, it is acceptable to assume that passengers will exit onto
the wing and, depending on the circumstances, either remain on the wing or jump into the water.
No credit should be taken for aeroplane weight reduction resulting from evacuees exiting the
aeroplane through overwing exits.
(9) For the purpose of preparing an evacuation timeline, the longest full-scale evacuation
demonstration (FSED) exit preparation time for an exit of that type, for that aeroplane, or
15 seconds, whichever is greater, should be assumed prior to the initial occupant evacuation from
the aeroplane.
(10) For the purpose of preparing an evacuation timeline, evacuation rates obtained from the aeroplane
FSED are acceptable for preparing a ditching evacuation analysis if the evacuees exit in the same or

Annex to ED Decision 2023/021/R Page 503 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

a similar manner as during the FSED and the assisting means (if deployed) do not block the
emergency exit opening. Alternatively, data developed by testing and analysis for demonstrating
compliance with CS 25.803 land evacuation specifications are also acceptable. However, the aisle
flow rate may determine the evacuation rate at a pair of exits if it is fed by passengers from only
one direction and the combined exit pair flow rate is greater than the available aisle rate.
Note: The evacuation rate for slides/rafts deployed from representative sill heights should not
exceed 60 persons per minute per lane for a duration of 70 seconds.
(11) For the purpose of preparing an evacuation timeline, it is acceptable to assume that the flow of
evacuees to the emergency exits is not diminished by the retrieval or the donning of life vests.
2. CS 25.801(b) Certification with ditching provisions
CS 25.801(b) requires an evaluation of the probable behaviour of the aeroplane at ditching and the
hydrodynamic characteristics. This evaluation can be performed in conjunction with the variation of
parameters or the loads development if using numerical techniques and simulations.
Section 4 of AMC 25.563 provides accepted methods for evaluating hydrodynamic behaviour, which can
be used for showing compliance with CS 25.801(b)(1) and (2).
CS 25.801(b)(3): since ditching events can occur with varying degrees of aeroplane and passenger
preparedness, the following assumptions are appropriate for assessing the flotation of the aeroplane and
evacuation of the occupants following a planned ditching.
(1) It should be assumed, in accordance with AFM ditching procedures, that the aeroplane enters the
water at the maximum design landing weight, with the most adverse aeroplane centre of gravity.
For the flotation analysis, the aeroplane weight may be reduced to account for items of mass in
non-pressurised sections of the aeroplane that are shown to separate from the aeroplane as a result
of the planned landing on water.
(2) All sources of water leakage into the aeroplane should be considered, including leakage from
damage resulting from the conditions prescribed in CS 25.563.
(3) For the purpose of developing a flotation and evacuation analysis, an exit should be conservatively
considered unusable when water comes in over the top of the door sill.
(4) Aeroplane flotation should be assumed to end when the first ditching exit goes below the waterline
or the attitude of the aeroplane is such that it would require extraordinary effort to move through
the cabin (e.g. 20 degrees). However, if it can be shown to be conservative, the flotation time may
be extended. Evidence of conservatism should include an assessment of the number of persons
expected to remain in the aeroplane when the ditching exit sill(s) go(es) below the waterline, the
number of ditching exits remaining above the waterline and the attitude of the aeroplane.
Note regarding points 3 and 4 above: If an exit can be shown to still be conservative, it may qualify
as a ditching exit even if it does not remain above the waterline for the full duration of the
evacuation. The substantiation of conservatism should include an assessment of how long the
ditching exit remains above the waterline, the number of persons expected to remain in the
aeroplane when the ditching exit sill(s) go(es) below the waterline and the number of other ditching
exits remaining above the waterline.
(5) To receive its full passenger seat-to-exit ratio, each ditching exit should either remain above the
waterline during the entire evacuation or be available for use long enough to allow the number of

Annex to ED Decision 2023/021/R Page 504 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

evacuees as per the seat-to-ditching exit ratio to use the exit (e.g. a ditching exit with a 35-
passenger seat-to-exit ratio should either remain usable during the entire evacuation or be
available long enough to allow at least 35 evacuees to exit the aeroplane through that exit in order
to achieve the full 35 passenger ratio). A lower passenger seat-to-exit ratio may be sought provided
that the exit remains above the waterline for the majority (greater than 50 %) of the total aeroplane
evacuation time. No passenger seat credit should be allowed for a ditching exit that does not remain
above the waterline for the majority of the total aeroplane evacuation time.
(6) For the purpose of preparing an evacuation timeline, the longest FSED exit preparation time for an
exit of that type, for that aeroplane, or 15 seconds, whichever is greater, should be assumed prior
to the initial occupant evacuation from the aeroplane.
(7) For the purpose of preparing the evacuation timeline, it should be assumed that the aeroplane has
ditching equipment required for overwater flights. Therefore, it is necessary to account for the time
to retrieve and launch life rafts and board the rafts.
(8) For the purpose of preparing an evacuation timeline, evacuation rates obtained from the aeroplane
FSED are acceptable for preparing a ditching evacuation analysis if the evacuees exit in the same or
a similar manner as the FSED and the assisting means (if deployed) do not block the emergency exit
opening. Alternatively, data developed by testing and analysis for demonstrating compliance with
CS 25.803 emergency evacuation requirements are also acceptable. However, the aisle flow rate
may determine the evacuation rate at a pair of exits if it is fed with passengers from only one
direction and the combined exit pair flow rate is greater than the available aisle rate.
Note: The evacuation rate for slides/rafts deployed from representative sill heights should not
exceed 60 persons per minute per lane for a duration of 70 seconds.
(9) For the purpose of preparing an evacuation timeline, it is acceptable to assume that the flow of
evacuees to the emergency exits is not diminished by the retrieval or the donning of life vests.
[Amdt 25/27]
[Amdt 25/28]

CS 25.803 Emergency evacuation

(See AMC 25.803)
(a) Each crew and passenger area must have emergency means to allow rapid evacuation in crash
landings, with the landing gear extended as well as with the landing gear retracted, considering the
possibility of the aeroplane being on fire.
(b) Reserved.
(c) For aeroplanes having a seating capacity of more than 44 passengers, it must be shown that the
maximum seating capacity, including the number of crew members required by the operating rules
for which certification is requested, can be evacuated from the aeroplane to the ground under
simulated emergency conditions within 90 seconds. Compliance with this requirement must be
shown by actual demonstration using the test criteria outlined in Appendix J of this CS-25 unless
the Agency find that a combination of analysis and testing will provide data equivalent to that which
would be obtained by actual demonstration.

Annex to ED Decision 2023/021/R Page 505 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

AMC 25.803 Emergency evacuation

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016 and AC 25.803-1A Emergency Evacuation Demonstrations,
dated 3.12.2012 are accepted by the Agency as providing acceptable means of compliance with CS 25.803.
-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/11]
[Amdt 25/12]
[Amdt 25/26]

CS 25.807 Emergency exits

(See AMC 25.807)
(a) Type. For the purpose of this CS-25, the types of exits are defined as follows:
(1) Type I. This type is a floor level exit with a rectangular opening of not less than 61 cm (24
inches) wide by 121.9 cm (48 inches) high, with corner radii not greater than 20.3 cm (8
inches).
(2) Type II. This type is a rectangular opening of not less than 50.8 cm (20 inches) wide by
111.8 cm (44 inches) high, with corner radii not greater than 17.8 cm (7 inches). Type II exits
must be floor-level exits unless located over the wing, in which case they must not have a
step-up inside the aeroplane of more than 25.4 cm (10 inches) nor a step-down outside the
aeroplane of more than 43.2 cm (17 inches).
(3) Type III. This type is a rectangular opening of not less than 50.8 cm (20 inches) wide by
91.4 cm (36 inches) high, with corner radii not greater than 17.8 cm (7 inches), and with a
step-up inside the aeroplane of not more than 50.8 cm (20 inches). If the exit is located over
the wing, the step-down outside the aeroplane may not exceed 68.6 cm (27 inches).
(4) Type IV. This type is a rectangular opening of not less than 48.3 cm (19 inches) wide by
66.0 cm (26 inches) high, with corner radii not greater than 16.0 cm (6.3 inches), located over
the wing, with a step-up inside the aeroplane of not more than 73.7 cm (29 inches) and a
step-down outside the aeroplane of not more than 91.4 cm (36 inches).
(5) Ventral. This type is an exit from the passenger compartment through the pressure shell and
the bottom fuselage skin. The dimensions and physical configuration of this type of exit must
allow at least the same rate of egress as a Type I exit with the aeroplane in the normal ground
attitude, with landing gear extended.
(6) Tail cone. This type is an aft exit from the passenger compartment through the pressure shell
and through an openable cone of the fuselage aft of the pressure shell. The means of opening
the tail cone must be simple and obvious and must employ a single operation.
(7) Type A. This type is a floor-level exit with a rectangular opening of not less than 106.7 cm (42
inches) wide by 182.9 cm (72 inches) high, with corner radii not greater than 17.8 cm (7
inches).

Annex to ED Decision 2023/021/R Page 506 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(8) Type B. This type is a floor-level exit with a rectangular opening of not less than 81.3 cm (32
inches) wide by 182.9 cm (72 inches) high, with corner radii not greater than 15.3 cm (6
inches).
(9) Type C. This type is a floor-level exit with a rectangular opening of not less than 76.2 cm (30
inches) wide by 121.9 cm (48 inches) high, with corner radii not greater than 25.4 cm (10
inches).
(b) Step down distance. Step down distance, as used in this paragraph, means the actual distance
between the bottom of the required opening and a usable foot hold, extending out from the
fuselage, that is large enough to be effective without searching by sight or feel.
(c) Over-sized exits. Openings larger than those specified in this paragraph, whether or not of
rectangular shape, may be used if the specified rectangular opening can be inscribed within the
opening and the base of the inscribed rectangular opening meets the specified step-up and step-
down heights.
(d) Asymmetry. Exits of a
however, the number of passenger seats permitted under subparagraph (g) of this paragraph is
based on the smaller of the two exits.
(e) Uniformity. Exits must be distributed as uniformly as practical, taking into account passenger seat
distribution. (See AMC 25.807(e))
(f) Location. (See AMC 25.807(f))
(1) Each required passenger emergency exit must be accessible to the passengers and located
where it will afford the most effective means of passenger evacuation.
(2) If only one floor-level exit per side is prescribed, and the aeroplane does not have a tail cone
or ventral emergency exit, the floor-level exits must be in the rearward part of the passenger
compartment unless another location affords a more effective means of passenger
evacuation.
(3) If more than one floor-level exit per side is prescribed, and the aeroplane does not have a
combination cargo and passenger configuration, at least one floor-level exit must be located
on each side near each end of the cabin.
(4) For an aeroplane that is required to have more than one passenger emergency exits for each
side of the fuselage, no passenger emergency exit shall be more than 18.3 m (60 feet) from
any adjacent passenger emergency exit on the same side of the same deck of the fuselage,

(g) Type and number required. The maximum number of passenger seats permitted depends on the
type and number of exits installed on each side of the fuselage. Except as further restricted in
subparagraphs (g)(1) through (g)(9) of this paragraph, the maximum number of passenger seats
permitted for each exit of a specific type installed on each side of the fuselage is as follows:
Type A 110
Type B 75
Type C 55
Type I 45

Annex to ED Decision 2023/021/R Page 507 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

Type II 40
Type III 35
Type IV 9
(1) For a passenger seating configuration of 1 to 9 seats, there must be at least one Type IV or
larger over-wing exit on each side of the fuselage or, if over-wing exits are not provided, at
least one exit on each side that meets the minimum dimensions of a Type III exit.
(2) For a passenger seating configuration of more than 9 seats, each exit must be a Type III or
larger exit.
(3) For a passenger seating configuration of 10 to 19 seats, there must be at least one Type III or
larger exit on each side of the fuselage.
(4) For a passenger seating configuration of 20 to 40 seats, there must be at least two exits, one
of which must be a Type II or larger exit, on each side of the fuselage.
(5) For a passenger seating configuration of 41 to 110 seats, there must be at least two exits,
one of which must be a Type I or larger exit, on each side of the fuselage.
(6) For a passenger seating configuration of more than 110 seats, the emergency exits on each
side of the fuselage must include at least two Type I or larger exits.
(7) The combined maximum number of passenger seats permitted for all Type III exits is 70, and
the combined maximum number of passenger seats permitted for two Type III exits on each
side of the fuselage that are separated by fewer than three passenger seat rows is 65.
(8) If a Type A, Type B, or Type C exit is installed, there must be at least two Type C or larger exits
on each side of the fuselage.
(9) If a passenger ventral or tail cone exit is installed and that exit provides at least the same rate
of egress as a Type III exit with the aeroplane in the most adverse exit opening condition that
would result from the collapse of one or more legs of the landing gear, an increase in the
passenger seating configuration is permitted as follows:
(i) For a ventral exit, 12 additional passenger seats.
(ii) For a tail cone exit incorporating a floor-level opening of not less than 50.8 cm (20
inches) wide by 152.4 cm (60 inches) high, with corner radii not greater than 17.8 cm
(7 inches), in the pressure shell and incorporating an approved assisting means in
accordance with CS 25.810(a), 25 additional passenger seats.
(iii) For a tail cone exit incorporating an opening in the pressure shell which is at least
equivalent to a Type III emergency exit with respect to dimensions, step-up and step-
down distance, and with the top of the opening not less than 142.2 cm (56 inches)
from the passenger compartment floor, 15 additional passenger seats.
(h) Other exits. The following exits must also meet the applicable emergency exit requirements of CS
25.809 through 25.812, and must be readily accessible:
(1) Each emergency exit in the passenger compartment in excess of the minimum number of
required emergency exits.
(2) Any other floor-level door or exit that is accessible from the passenger compartment and is
as large or larger than a Type II exit, but less than 116.8 cm (46 inches) wide.

Annex to ED Decision 2023/021/R Page 508 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(3) Any other ventral or tail cone passenger exit.

(i) Ditching emergency exits for passengers. Whether or not ditching certification is requested,
ditching emergency exits must be provided in accordance with the following conditions, unless the
emergency exits required by subparagraph (g) of this paragraph already meet them:
(1) For aeroplanes that have a passenger seating configuration of nine seats or less, excluding
pilot seats, one exit above the waterline in each side of the aeroplane, meeting at least the
dimensions of a Type IV exit.
(2) For aeroplanes that have a passenger seating configuration of 10 seats or more, excluding
pilot seats, one exit above the waterline in a side of the aeroplane, meeting at least the
dimensions of a Type III exit for each unit (or part of a unit) of 35 passenger seats, but no less
than two such exits in the passenger cabin, with one on each side of the aeroplane. The
passenger seat/exit ratio may be increased through the use of larger exits, or other means,
provided it is shown that the evacuation capability during ditching has been improved
accordingly.
(3) If it is impractical to locate side exits above the waterline, the side exits must be replaced by
an equal number of readily accessible overhead hatches of not less than the dimensions of a
Type III exit, except that for aeroplanes with a passenger configuration of 35 seats or less,
excluding pilot seats, the two required Type III side exits need to be replaced by only one
overhead hatch.
(j) Flight crew emergency exits. For aeroplanes in which the proximity of passenger emergency exits
to the flight crew area does not offer a convenient and readily accessible means of evacuation of
the flight crew, and for all aeroplanes having a passenger seating capacity greater than 20, flight
crew exits must be located in the flight crew area. Such exits must be of sufficient size and so located
as to permit rapid evacuation by the crew. One exit must be provided on each side of the aeroplane;
or, alternatively, a top hatch must be provided. Each exit must encompass an unobstructed
rectangular opening of at least 48.3 cm by 50.8 cm (19 by 20 inches) unless satisfactory exit utility
can be demonstrated by a typical crew member.
[Amdt 25/4]
[Amdt 25/5]
[Amdt 25/6]
[Amdt 25/12]
[Amdt 25/18]
[Amdt 25/19]
[Amdt 25/26]

AMC 25.807 Emergency exits

and/or seat(s), the seatback(s) being in the most adverse position, in vertical projection from floor -level
to at least the prescribed minimum height of the exit.
The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016 are accepted by the Agency as providing acceptable means
of compliance with CS 25.807.

Annex to ED Decision 2023/021/R Page 509 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

-17A Change 1 that address the applicable FAR/CS-

[Amdt 25/12]
[Amdt 25/19]
[Amdt 25/26]

AMC 25.807(f) Passenger emergency exits

The optimum fore and aft location of Types I, II and III exits should be agreed between the applicant and
the Agency bearing in mind the relevant considerations, including
a. The varying likelihood of damage to different parts of the fuselage in emergency landing conditions,
and
b. The need to avoid the passengers having to evacuate the aeroplane where dangerous conditions
(spilt fuel, hot engine parts, etc.) may exist.
[Amdt 25/11]
[Amdt 25/12]

AMC 25.807(e) Emergency Exits Uniformity

FAA Advisory Circular 25.807-
providing acceptable means of compliance with CS 25.807(e).
However, this Advisory Circular does not provide any guidance for those aeroplanes required to have no
more than one pair of emergency exits. For those aeroplanes, ensuring that the seat-to-exit distance
remains within acceptable limits as per the following criteria provides an acceptable means of compliance
with CS 25.807(e).
Each passenger seat approved for use during taxiing, take-off or landing should be located such that:
(i) it is within 9.14 m (30 ft) from the nearest emergency exit on one side of the fuselage, and
within 13.72 m (45 ft) from the nearest emergency exit on the other side of the fuselage; and
(ii) the occupant of that seat has the possibility to move to an emergency exit, on the left side,
or the right side of the fuselage, whilst at all points along the way remaining within 9.14 m
(30 ft) from an emergency exit on one side of the fuselage and within 13.72 m (45 ft) from an
emergency exit on the other side of the fuselage.
When calculating the distance from a passenger seat, or from any point in the egress path of an occupant,
to an emergency exit, this distance should be taken as the total longitudinal distance (i.e. as measured

emergency exit in question (i.e. the distance calculated should take into account all required changes in
direction of movement but measured only longitudinally). For the distance from a passenger seat, as the
starting point, the front edge of the seat bottom cushion at the centreline, with the seat in the taxiing,
take off, and landing position is to be taken for seats installed at any orientation. The end point in each
case is to be taken as the nearest edge of the emergency exit opening in the fuselage.
For aeroplanes with a passenger seating configuration of 19 or less, only one pair of emergency exits is
required. However, such aeroplanes may have additional exits installed, which must then comply with CS

Annex to ED Decision 2023/021/R Page 510 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

25.807(h) but not with the 18.3-m (60-feet) rule of CS 25.807(f)(4). The distance between each passenger
seat and the nearest available emergency exit may be determined considering all available emergency
exits, including the ones addressed by CS 25.807(h).
[Amdt 25/19]

CS 25.809 Emergency exit arrangement

(See AMC 25.809)
(a) (1) Each emergency exit, including a flight crew emergency exit, must be a movable door or hatch
in the external walls of the fuselage, allowing unobstructed opening to the outside.
(2) Each emergency exit, including a flight crew emergency exit, must have means to permit
viewing of the conditions outside the exit when the exit is closed, in all ambient lighting
conditions with the landing gears extended or in any condition of collapse. The viewing
means may be on or adjacent to the exit provided no obstructions exist between the exit and
the viewing means. (See AMC 25.809(a))
(3) For non-over-wing passenger emergency exits, a means must also be provided to permit
viewing of the likely areas of evacuee ground contact when the exit is closed with the landing
gears extended or in any condition of collapse. Furthermore, the likely areas of evacuee
ground contact must be viewable with the exit closed during all ambient lighting conditions
when all landing gears are extended.
(b) Each emergency exit must be openable from the inside and the outside except that sliding window
emergency exits in the flight crew area need not be openable from the outside if other approved
exits are convenient and readily accessible to the flight crew area. Inward opening doors may be
used if there are means to prevent occupants from crowding against the door to an extent that
would interfere with the opening of the door. Each emergency exit must be capable of being
opened, when there is no fuselage deformation
(1) With the aeroplane in the normal ground attitude and in each of the attitudes corresponding
to collapse of one or more legs of the landing gear; and
(2) Within 10 seconds measured from the time when the opening means is actuated to the time
when the exit is fully opened.
(3) Even though persons may be crowded against the door on the inside of the aeroplane.
(c) The means of opening emergency exits must be simple and obvious and may not require
exceptional effort; and must be arranged and marked so that it can be readily located and operated,
even in darkness. Internal exit opening means involving sequence operations (such as operation of
two handles or latches or the release of safety catches) may be used for flight crew emergency exits
if it can be reasonably established that these means are simple and obvious to crewmembers
trained in their use.
(d) If a single power-boost or single power-operated system is the primary system for operating more
than one exit in an emergency, each exit must be capable of meeting the requirements of sub-
paragraph (b) of this paragraph in the event of failure of the primary system. Manual operation of
the exit (after failure of the primary system) is acceptable.

Annex to ED Decision 2023/021/R Page 511 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(e) Each emergency exit must be shown by tests, or by a combination of analysis and tests, to meet the
requirements of sub-paragraphs (b) and (c) of this paragraph.
(f) Each door must be located where persons using them will not be endangered by the propellers
when appropriate operating procedures are used.
(g) There must be provisions to minimise the probability of jamming of the emergency exits resulting
from fuselage deformation in a minor crash landing.
(h) [Reserved]
(i) Each emergency exit must have a means to retain the exit in the open position, once the exit is
opened in an emergency. The means must not require separate action to engage when the exit is
opened, and must require positive action to disengage.
[Amdt 25/4]
[Amdt 25/12]
[Amdt 25/14]
[Amdt 25/17]

AMC 25.809 Emergency exit arrangement

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing an acceptable
means of compliance with CS 25.809.
-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/12]
[Amdt 25/17]
[Amdt 25/26]

AMC 25.809(a) Emergency exit outside viewing

The requirement to provide a view of the outside in all ambient lighting conditions suggests the use of
externally mounted lighting (although other means may be acceptable). In the landing-gear-collapsed
cases, the rolling and pitching effects o
area illuminated in the all-landing-gears-extended condition. Furthermore, in the case of inflatable escape
slides, the toe-end ground contact point will probably move in the opposite direction to that of the lamp
beam.
In recognition of these effects, and in order to maintain reasonable demands on the complexity and power
of external lighting equipment, the rule does not require the entire viewable area to be visible in all
ambient lighting conditions. The only specific illumination requirement is for the likely areas of evacuee
ground contact, with all landing gears extended, for passenger exits.
However, it is recommended that as large a field of view as is practicable should be provided, taking into
account aspects such as fuselage curvature and door/window/hatch location, in order to provide the best
chance to identify external evacuation hazards before exits are opened.

Annex to ED Decision 2023/021/R Page 512 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

In the case of a flight crew emergency exit, a flight deck window as conventionally configured, used in
conjunction with a suitably accessible and powerful portable illumination device (e.g. flashlight) will
provide an acceptable means for viewing the outside conditions.
Flight deck seats, consoles, etc., as conventionally configured, are not considered to be obstructions in
the meaning of this term in CS 25.809(a)(2) in the case where flight deck windows are the viewing means
and the exit is an overhead hatch. Furthermore, it is considered that the distance between flight deck
windows, as conventionally configured, and an overhead hatch is such that the criterion for the viewing
means to be adjacent to the exit is satisfied.
[Amdt 25/17]

AMC 25.809(a)(3) Emergency exit arrangement

A subjective outside viewing test can be conducted to determine if the exterior viewing means and lighting
system provide an adequate view/illumination to allow identification of possible hazards in the evacuee
ground contact area. For this test, the viewing/lighting system will be deemed acceptable if an object
(e.g., a traffic cone) placed in the viewing area is visible to the test witness looking through the emergency
exit viewing means that is provided.
When a separate lighting system is installed that is only used to meet the requirements of CS 25.809(a),
that system should be designed to meet the requirements of CS 25.812(k), for operation after having been
subjected to the inertia forces listed in CS 25.561(b), and CS 25.812(l)(3), such that at least one exterior
light on each side of the airplane remains operative after a single transverse separation.
[Amdt 25/12]

AMC 25.809(c) and (e) Testing of the opening of passenger-operated

exits
For emergency exits intended to be operated by passengers, such as non-floor-level overwing exits (e.g.
Type III and IV exits), testing with naïve subjects should be performed in order to demonstrate that
opening the emergency exits is simple and obvious and does not require exceptional effort.
The demonstration may be conducted either on the aeroplane or on a representative mock-up, and it
should include all the relevant safety markings and exit opening instructions.
The opening of the emergency exit should be demonstrated by a sufficient number of naïve test subjects
selected to be representative of the passenger population with respect to gender, age, size and
handedness. Meeting the criteria of paragraph (h) of Appendix J to CS-25 is an acceptable means to
achieve a representative age and gender distribution of the participants in the test.
[Amdt 25/26]

CS 25.810 Emergency egress assisting means and escape routes

(See AMC 25.810)
(a) Each non-over-wing Type A, Type B or Type C exit, and any other non-over-wing landplane
emergency exit more than 1.8 m (6 feet) from the ground with the aeroplane on the ground and

Annex to ED Decision 2023/021/R Page 513 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

the landing gear extended must have an approved means to assist the occupants in descending to
the ground.
(1) The assisting means for each passenger emergency exit must be a selfsupporting slide or
equivalent; and, in the case of a Type A or Type B exits, it must be capable of carrying
simultaneously two parallel lines of evacuees. In addition, the assisting means must be
designed to meet the following requirements.
(i) It must be automatically deployed and deployment must begin during the interval
between the time the exit opening means is actuated from inside the aeroplane and
the time the exit is fully opened. However, each passenger emergency exit which is
also a passenger entrance door or a service door must be provided with means to
prevent deployment of the assisting means when it is opened from either the inside or
the outside under non-emergency conditions for normal use.
(ii) Except for assisting means installed at Type C exits, it must be automatically erected
within 6 seconds after deployment is begun or within 10 seconds from the time the
opening means of the exit is actuated. Assisting means installed at Type C exits must
be automatically erected within 10 seconds from the time the opening means of the
exit is actuated.
(iii) It must be of such length after full deployment that the lower end is selfsupporting on
the ground and provides safe evacuation of occupants to the ground after collapse of
one or more legs of the landing gear.
(iv) It must have the capability, in 46 km/hr (25-knot) winds directed from the most critical
angle, simultaneously with any engine(s) running at ground idle, to deploy and, with
the assistance of only one person, to remain usable after full deployment to evacuate
occupants safely to the ground. (See AMC 25.810(a)(1)(iv))
(v) For each system installation (mock-up or aeroplane installed), five consecutive
deployment and inflation tests must be conducted (per exit) without failure, and at
least three tests of each such five-test series must be conducted using a single
representative sample of the device. The sample devices must be deployed and

specified in CS 25.561(b). If any part of the system fails or does not function properly
during the required tests, the cause of the failure or malfunction must be corrected by
positive means and after that, the full series of five consecutive deployment and
inflation tests must be conducted without failure.
(2) The assisting means for flight crew emergency exits may be a rope or any other means
demonstrated to be suitable for the purpose. If the assisting means is a rope, or an approved
device equivalent to a rope, it must be
(i) Attached to the fuselage structure at or above the top of the emergency exit opening,

(ii) Able (with its attachment) to withstand a 1779 N (400-lbf) static load.
(b) Assisting means from the cabin to the wing are required for each Type A or Type B exit located
above the wing and having a step-down unless the exit without an assisting means can be shown

Annex to ED Decision 2023/021/R Page 514 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

to have a rate of passenger egress at least equal to that of the same type of non-over-wing exit. If
an assisting means is required, it must be automatically deployed and automatically erected,
concurrent with the opening of the exit. In the case of assisting means installed at Type C exits, it
must be self-supporting within 10 seconds from the time the opening means of the exits is actuated.
For all other exit types, it must be self-supporting 6 seconds after deployment has begun.
(c) An escape route must be established from each over-wing emergency exit, and (except for flap
surfaces suitable as slides) covered with a slip resistant surface (See AMC to CS 25.793 and CS
25.810(c)). Except where a means for channelling the flow of evacuees is provided
(1) The escape route from each Type A or Type B emergency exit, or any common escape route
from two Type III emergency exits, must be at least 1·07 m (42 inches) wide; that from any
other passenger emergency exit must be at least 61 cm (24 inches) wide; and
(2) The escape route surface must have a reflectance of at least 80%, and must be defined by
markings with a surface-to-marking contrast ratio of at least 5:1. (See AMC 25.810(c)(2))
(d) Assisting means must be provided to enable evacuees to reach the ground for all Type C exits
located over the wing and, if the place on the aeroplane structure at which the escape route
required in subparagraph (c) of this paragraph terminates, is more than 1.8 m (6 feet) from the
ground with the aeroplane on the ground and the landing gear extended, for all other exit types.
(1) If the escape route is over a flap, the height of the terminal edge must be measured with the
flap in the take-off or landing position, whichever is higher from the ground.
(2) The assisting means must be usable and self-supporting with one or more landing gear legs
collapsed and under a 46 km/hr (25-knot) wind directed from the most critical angle.
(3) The assisting means provided for each escape route leading from a Type A or B emergency
exit must be capable of carrying simultaneously two parallel lines of evacuees; and, the
assisting means leading from any other exit type must be capable of carrying simultaneously
as many parallel lines of evacuees as there are required escape routes.
(4) The assisting means provided for each escape route leading from a Type C exit must be
automatically erected within 10 seconds from the time the opening means of the exit is
actuated, and that provided for the escape route leading from any other exit type must be
automatically erected within 10 seconds after actuation of the erection system.
(e) If an integral stair is installed in a passenger entry door that is qualified as a passenger emergency
exit, the stair must be designed so that, under the following conditions, the effectiveness of
passenger emergency egress will not be impaired:
(1) The door, integral stair, and operating mechanism have been subjected to the inertia forces
specified in CS 25.561(b)(3), acting separately relative to the surrounding structure.
(2) The aeroplane is in the normal ground attitude and in each of the attitudes corresponding to
collapse of one or more legs of the landing gear.
[Amdt 25/4]
[Amdt 25/12]
[Amdt 25/13]
[Amdt 25/17]
[Amdt 25/18]

Annex to ED Decision 2023/021/R Page 515 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

AMC 25.810 Emergency egress assisting means and escape routes

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing an acceptable
means of compliance with CS 25.810.
-17A Change 1 that address the applicable FAR/CS-25

For emergency assisting means that are installed in non-pressurised compartments, the applicant should
take into account the effects of exposure to very low temperature conditions during flight on the
performance of the assisting means. The applicant should demonstrate that the assisting means functions
properly when the cold soak effects associated with the expected flight durations and altitudes are
combined with a 46 km/h (25 kt) wind directed from the most critical angle.
[Amdt 25/17]
[Amdt 25/26]

AMC 25.810(a)(1)(iv) Capability of assisting means in wind conditions

The applicability of the combined effect of a 46 km/hr (25-knot) wind and the engine(s) running at ground
idle should be only to escape slides positioned forward of the engine(s) and in such proximity to the engine
air intake(s) that the deployment of the escape slide could be influenced.
[Amdt 25/18]

AMC 25.810(a)(1)(v) Deployment and inflation tests

For each exit, at least one of the (minimum) five consecutive deployment and inflation tests should be
performed with an assisting means installed on the aeroplane.
[Amdt 25/26]

AMC 25.810(c)(2) Emergency Evacuation

Acceptable methods of measurement of reflectance are given in AC 20-47, published by the Federal
Aviation Administration.
[Amdt 25/26]

CS 25.811 Emergency exit marking

(See AMC 25.811)
(a) Each passenger emergency exit, its means of access, and its means of opening must be
conspicuously marked.
(b) The identity and location of each passenger emergency exit must be recognisable from a distance
equal to the width of the cabin.
(c) Means must be provided to assist the occupants in locating the exits in conditions of dense smoke.

Annex to ED Decision 2023/021/R Page 516 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(d) The location of each passenger emergency exit must be indicated by a sign visible to occupants
approaching along the main passenger aisle (or aisles). There must be See AMC 25.811(d)):
(1) A passenger emergency exit locator sign above the aisle (or aisles) near each passenger
emergency exit, or at another overhead location if it is more practical because of low
headroom, except that one sign may serve more than one exit if each exit can be seen readily
from the sign;
(2) A passenger emergency exit marking sign next to each passenger emergency exit, except that
one sign may serve two such exits if they both can be seen readily from the sign; and
(3) A sign on each bulkhead or divider that prevents fore and aft vision along the passenger cabin
to indicate emergency exits beyond and obscured by the bulkhead or divider, except that if
this is not possible the sign may be placed at another appropriate location.
(e) The location of the operating handle and instructions for opening exits from the inside of the
aeroplane must be shown in the following manner:
(1) Each passenger emergency exit must have, on or near the exit, a marking that is readable
from a distance of 76 cm (30 inches).
(2) Each passenger emergency exit operating handle and the cover removal instructions, if the
operating handle is covered, must
(i) Be self-illuminated with an initial brightness of at least 0.51 candela/m2
(160 microlamberts), or
(ii) Be conspicuously located and well illuminated by the emergency lighting even in
conditions of occupant crowding at the exit.
(3) Reserved
(4) All Type II and larger passenger emergency exits with a locking mechanism released by
motion of a handle, must be marked so as to its operation by an arrow with a shaft at least
19 mm (0.75 inches) wide, adjacent to the handle, that indicates the full extent and direction
of the unlocking motion required. The word OPEN must be horizontally situated adjacent to
the arrowhead and must be in red capital letters at least 25 mm (1 inch) high. The arrow and
word OPEN must be located on a background, which provides adequate contrast. (See AMC
25.811(e)(4).)
(f) Each emergency exit that is required to be openable from the outside, and its means of opening,
must be marked on the outside of the aeroplane. In addition, the following apply:
(1) The outside marking for each passenger emergency exit in the side of the fuselage must
include a 51 mm (2 inch) coloured band outlining the exit.
(2) Each outside marking including the band must have colour contrast to be readily
distinguishable from the surrounding fuselage surface. The contrast must be such that if the
reflectance of the darker colour is 15% or less, the reflectance of the lighter colour must be

flux it receives. When the reflectance of the darker colour is greater than 15%, at least a 30%
difference between its reflectance and the reflectance of the lighter colour must be provided.

Annex to ED Decision 2023/021/R Page 517 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(3) In the case of exits other than those in the side of the fuselage, such as ventral or tail cone
exits, the external means of opening, including instructions if applicable, must be
conspicuously marked in red, or bright chrome yellow if the background colour is such that
red is inconspicuous. When the opening means is located on only one side of the fuselage, a
conspicuous marking to that effect must be provided on the other side.
(g) Each sign required by sub-
or a universal symbolic exit sign (See AMC 25.812(b)(1), AMC
25.812(b)(2) and AMC 25.812(e)(2)). The design of exit signs must be chosen to provide a consistent
set throughout the cabin.
[Amdt 25/3]
[Amdt 25/17]
[Amdt 25/19]

AMC 25.811 Emergency exit marking

The relevant parts of FAA Advisory Circular (AC) AC 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing an acceptable
means of compliance with CS 25.811.
-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/17]
[Amdt 25/26]

AMC 25.811(d) Sign Combination

The signs required by CS 25.811(d)(1), (d)(2) and (d)(3) may be combined according to the applicable parts
of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 24.5.2016.
[Amdt 25/19]
[Amdt 25/26]

AMC 25.811(e)(4) Emergency exit marking

The indicating markings for all Type II and larger passenger emergency exit unlocking handle motions
should conform to the general shapes and dimensions indicated by Figures 1 and 2.
The indicating markings (arrow and word OPEN) should be consistent with the emergency exit signs
chosen, i.e. red if letter emergency exit signs are installed, and green if symbolic emergency exit signs are
installed.
NOTE: As far as is practicable the markings should be located to avoid obscuring viewing windows located
on or alongside the exits, or coincidence with any other required marking or safety feature.

EXAMPLE MARKING FOR INDICATION OF LINEAR OPENING MOTION

Annex to ED Decision 2023/021/R Page 518 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

Where practical and unambiguous arrow point and base of arrow shaft to be within ±25 mm (1 inch) of
fully unlocked and fully locked positions respectively
DIMENSIONS
A = 19 mm (0·75") minimum
B = 2xA
C = B (recommended)
D = Indicative of the full extent of handle travel (each installation to be individually assessed)

FIGURE 1

EXAMPLE MARKING FOR INDICATION OF ROTARY OPENING MOTION

Arrow point and base of arrow shaft to be within 25 mm (1 inch) of fully unlocked and fully locked positions
respectively
DIMENSIONS
A = 19 mm (0·75") minimum
B = 2xA
C = B (recommended)
D = Full extent of handle centreline travel
E = Three quarters of handle length (where practicable)

Annex to ED Decision 2023/021/R Page 519 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

FIGURE 2
[Amdt 25/19]

CS 25.812 Emergency lighting

(See AMC 25.812)
(a) An emergency lighting system, independent of the main lighting system, must be installed.
However, the sources of general cabin illumination may be common to both the emergency and
the main lighting systems if the power supply to the emergency lighting system is independent of
the power supply to the main lighting system. The emergency lighting system must include -
(1) Illuminated emergency exit marking and locating signs, sources of general cabin illumination,
interior lighting in emergency exit areas, and floor proximity escape path marking.
(2) Exterior emergency lighting.
(b) Emergency exit signs
(1) For aeroplanes that have a passenger-seating configuration, excluding pilot seats, of 10 seats
or more must meet the following requirements:
(i) Each passenger emergency exit locator sign required by CS 25.811(d)(1) and each
passenger emergency exit marking sign required by CS 25.811(d)(2) must have red
letters on an illuminated white background or a universal symbol, of adequate size
(See AMC 25.812(b)(1)). These signs must be internally electrically illuminated with the

Annex to ED Decision 2023/021/R Page 520 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

brighter area having a brightness of at least 86 candela/m2 (25 foot lamberts) and a
high-to-low contrast within the white background of a letter-based sign or green area
of a universal symbol no greater than 3:1. These signs must also have a contrast
between the brightest and darkest elements of at least 10:1.
(ii) Each passenger emergency exit sign required by CS 25.811(d)(3) must have red letters
on a white background or a universal symbol, of adequate size (See AMC 25.812(b)(1)).
These signs must be internally electrically illuminated or selfilluminated by other than
electrical means and must have an initial brightness of at least 1.27 candela/m 2 (400
microlamberts). The colours may be reversed in the case of a sign that is self-
illuminated by other than electrical means.
(2) For aeroplanes that have a passenger seating configuration, excluding pilot seats, of 9 seats
or less, each sign required by CS 25.811(d)(1), (2), and (3) must have red letters on a white
background or a universal symbol, of adequate size (See AMC 25.812(b)(2)). These signs may
be internally electrically illuminated, or self-illuminated by other than electrical means, with
an initial brightness of at least 0.51 candela/m 2 (160 microlamberts). The colours may be
reversed in the case of a sign that is self-illuminated by other than electrical means.
(c) General illumination in the passenger cabin must be provided so that when measured along the
centreline of main passenger aisle(s), and cross aisle(s) between main aisles, at seat armrest height
and at 1.02 m (40-inch) intervals, the average illumination is not less than 0.5 lux (0.05 foot candle)
and the illumination at each 1.02 m (40-inch) interval is not less than 0.1 lux (0.01 foot candle). A
main passenger aisle(s) is considered to extend along the fuselage from the most forward passenger
emergency exit or cabin occupant seat, whichever is farther forward, to the most rearward
passenger emergency exit or cabin occupant seat, whichever is farther aft.
(d) The floor of the passageway leading to each floor-level passenger emergency exit, between the
main aisles and the exit openings, must be provided with illumination that is not less than 0.2 lux
(0.02 foot candle) measured along a line that is within 15 cm (6 inches) of and parallel to the floor
and is centred on the passenger evacuation path.
(e) Floor proximity emergency escape path marking must provide emergency evacuation guidance for
passengers when all sources of illumination more than 1.2 m (4 ft) above the cabin aisle floor are
totally obscured. In the dark of the night, the floor proximity emergency escape path marking must
enable each passenger to:
(1) After leaving the passenger seat, visually identify the emergency escape path along the cabin
aisle floor to the first exits or pair of exits forward and aft of the seat;
(2) Readily identify each exit from the emergency escape path by reference only to markings and
visual features not more than 1.2 m (4 ft) above the cabin floor. (See AMC 25.812(e)(2)); and
(3) In the case of passengers seated in seats authorised for occupancy during taxiing, take-off,
and landing, in a compartment that does not incorporate any part of the main cabin aisle, in
lieu of CS 25.812(e)(1), egress this compartment and enter the main cabin aisle using only
markings and visual features not more than 1.2 m (4 ft) above the cabin floor, and proceed
to the exits using the marking system necessary to complete the actions as described in CS
25.812(e)(1) and (e)(2) above.

Annex to ED Decision 2023/021/R Page 521 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(f) Except for sub-systems provided in accordance with sub-paragraph (h) of this paragraph that serve
no more than one assisting means, are independent
system, and are automatically activated when the assisting means is erected, the emergency
lighting system must be designed as follows:
(1) The lights must be operable manually from the flight crew station and from a point in the
passenger compartment that is readily accessible to a normal cabin crewmember seat.
(2) There must be a flight crew warning light, which illuminates when power is on in the
aeroplane and the emergency lighting control device is not armed.
(3)
in the cockpit or turned on at either the cockpit or cabin crew member station the lights will
either light or remain lighted upon interruption (except an interruption caused by a

electric power. There must be a means to safeguard against inadvertent operation of the

(g) Exterior emergency lighting must be provided as follows:

(1) At each overwing emergency exit the illumination must be
(i) Not less than 0.3 lux (0.03 foot candle) (measured normal to the direction of the
incident light) on a 0.186 m2 (two-square-foot) area where an evacuee is likely to make
his first step outside the cabin;
(ii) Not less than 0.5 lux (0.05 foot-candle) (measured normal to the direction of the
incident light) for a minimum width of 1.07 m (42 inches) for a Type A over-wing exit
and 61 cm (24 inches) for all other over-wing emergency exits along the 30 % of the
slip-resistant portion of the escape route required in CS 25.810(c) that is farthest from
the exit; and
(iii) Not less than 0.3 lux (0.03 foot candle) on the ground surface with the landing gear
extended (measured normal to the direction of the incident light) where an evacuee
using the established escape route would normally make first contact with the ground.
(2) At each non-overwing emergency exit not required by CS 25.810(a) to have descent assisting
means the illumination must be not less than 0.3 lux (0.03 foot candle) (measured normal to
the direction of the incident light) on the ground surface with the landing gear extended
where an evacuee is likely to make his first contact with the ground outside the cabin.
(h) The means required in CS 25.810(a)(1) and (d) to assist the occupants in descending to the ground
must be illuminated so that the erected assisting means is visible from the aeroplane. In addition
(1) If the assisting means is illuminated by exterior emergency lighting, it must provide
illumination of not less than 0.3 lux (0.03 foot candle) (measured normal to the direction of
the incident light) at the ground end of the erected assisting means where an evacuee using
the established escape route would normally make first contact with the ground, with the
aeroplane in each of the attitudes corresponding to the collapse of one or more legs of the
landing gear.

Annex to ED Decision 2023/021/R Page 522 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(2) If the emergency lighting sub-system illuminating the assisting means serves no other assist
emergency lighting system, and is
automatically activated when the assisting means is erected, the lighting provisions
(i) May not be adversely affected by stowage; and
(ii) Must provide illumination of not less than 0.3 lux (0.03 foot candle) (measured normal
to the direction of the incident light) at the ground end of the erected assisting means
where an evacuee would normally make first contact with the ground, with the
aeroplane in each of the attitudes corresponding to the collapse of one or more legs
of the landing gear.
(i) The energy supply to each emergency lighting unit must provide the required level of illumination
for at least 10 minutes at the critical ambient conditions after emergency landing.
(j) If storage batteries are used as the energy supply for the emergency lighting system, they may be
Provided, that the charging circuit is
designed to preclude inadvertent battery discharge into charging circuit faults.
(k) Components of the emergency lighting system, including batteries, wiring relays, lamps, and
switches must be capable of normal operation after having been subjected to the inertia forces
listed in CS 25.561(b).
(l) The emergency lighting system must be designed so that after any single transverse vertical
separation of the fuselage during crash landing:
(1) the percentage of electrically illuminated emergency lights required by this paragraph which
are rendered inoperative, in addition to the lights that are directly damaged by the
separation, does not exceed the values set in the following table (See AMC 25.812(l)(1)):
Maximum approved seating capacity of the type-certified aeroplane Percentage

More than 19 25 %
10 to 19 33.33 % (i.e. one third)
Less than 10 50 %

(2) Each electrically illuminated exit sign required under CS 25.811(d)(2) remains operative
exclusive of those that are directly damaged by the separation; and
(3) At least one required exterior emergency light for each side of the aeroplane remains
operative exclusive of those that are directly damaged by the separation.
[Amdt 25/3]
[Amdt 25/5]
[Amdt 25/12]
[Amdt 25/19]

AMC 25.812 Emergency lighting

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016 and AC 25.812-2 Floor Proximity Emergency Escape Path

Annex to ED Decision 2023/021/R Page 523 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

Marking Systems Incorporating Photoluminescent Elements, dated 24/7/97 are accepted by the Agency
as providing acceptable means of compliance with CS 25.812.
-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/11]
[Amdt 25/26]

AMC 25.812(b)(1) Emergency lighting

General Requirements
Emergency exit signs should consist of a consistent type throughout the aeroplane. They may be letter
based or symbolic, as outlined below.
Letter based emergency exit signs should use letters with a height to stroke width ratio of not more than
7:1 nor less than 6:1.
Symbolic emergency exit signs should be white and green in compliance with European Standard (EN) ISO
7010:2012, Graphical symbols, safety colours and safety signs, registered safety signs. The green area of
the sign should constitute at least half of the total area of the sign.
In determining the area of an emergency exit sign, no part of the sign outside of the white background
(text signs) or green element (symbolic signs), for instance a surrounding contrasting border, should be
included.
Minimum size - emergency exit signs required by CS 25.811(d)(1) or (d)(3)
For each emergency exit sign required by CS 25.811(d)(1), and for each emergency exit sign required on
each bulkhead or divider by CS 25.811(d)(3), at each point along any possible aeroplane egress path, the
next closest required emergency exit sign visible at each point along the egress path should be sized and
located such that it is no farther away from the escapee than its maximum allowable viewing distance
calculated as below.
Egress paths to be assessed should be:
(1) any possible path from a passenger seat that can be occupied during taxiing, take-off, and landing
to any passenger emergency exit; and
(2) any possible path from a point adjacent to any passenger emergency exit to any other passenger
emergency exit.
Calculation of maximum viewing distance
For an emergency exit sign required by CS 25.811(d)(1) and for an emergency exit sign required on each
bulkhead or divider by CS 25.811(d)(3), the following formulae, as modified by the notes below, apply for
calculating a maximum viewing distance. The maximum allowable viewing distance for a sign is in each
case the lower of the two values D1 and D2:
Text based signs Symbolic signs
D1 = 2. Z . hletter. D1 = 1.25 . Z . hsymbol.
D2 = Z . sign/2.5) D2 = Z . sign/2.5)
where:

Annex to ED Decision 2023/021/R Page 524 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

1. Z is the distance factor obtained from Table 1 below;

2. hletter is the overall height of each letter which should be at least of 25 mm (1 inch) high;
3. hsymbol
which should be at least 40 mm (1.6 inches) high;
4. xsign is the overall area of the sign; and
5. D1, D2, hletter and hsymbol have the same units, and xsign is in the same squared units as D1, D2, hletter and
hsymbol.
Note 1: In the case of dual-language text based emergency exit signs, only the English text is to be
considered when selecting hletter for use in the above formula. However, in determining the area of the
sign (xsign) for use in the above formula, the actual area may be used

Examples of acceptable designs of symbolic exit signs

CS 25.811(d)(1)
(emergency exit locator sign)

CS 25.811(d)(2)
(emergency exit marking sign)

CS 25.811(d)(3)
(emergency exit sign on bulkhead or divider)

Table 1: Z factor to be used for text based and symbolic emergency exit signs

Mean luminance of white contrast Distance factor Z

colour candela/m2 (ft-L)
1.27 candela/m2 (0.37 ft-L) 100
10 candela/m2 (2.92 ft-L) 150
30 candela/m2 (8.76 ft-L) 175
80 candela/m2 (23.35 ft-L) 200
200 candela/m2 (58.37 ft-L) 215
2
500 candela/m (145.93 ft-L) 230

Minimum size - emergency exit signs required by CS 25.811(d)(2)

For an emergency exit sign required by CS 25.811(d)(2), any sign using English letters of at least 25 mm (1
inch) height, or a white symbolic element (i.e. that part incor
40 mm (1.6 inches), with an overall area of at least 64.5 cm2 (10 square inches) will be acceptable.
Supplementary directional arrows

Annex to ED Decision 2023/021/R Page 525 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

The inclusion of an arrow or arrows in any of the signs discussed above, in order to increase the
comprehension of the sign, is encouraged. The possibility to improve comprehension and the appropriate
orientation of the arrows will depend on the particular installation. If arrows indicate a movement other
than straight a
(to the right/to the left) should be chosen to be compatible with the orientation of the arrow(s). There
may be other reasons to choose a particular movement directi
a sign required by CS 25.811(d)(2) is placed to the left or right of the emergency exit. In this case, the

In the case of symbolic signs, the arrows should be in accordance with the style defined in European
Standard (EN) ISO 7010:2012, i.e. type D of ISO 3864-3. The ratio of overall length of an arrow to the width
of its tail should be not more than 7:1 nor less than 5.5:1.
[Amdt 25/3]
[Amdt 25/19]

AMC 25.812(b)(2) Emergency lighting

For an emergency exit sign required by CS 25.811(d)(1), (2) or (3), any sign meeting the overall appearance
requirements of AMC 25.812(b)(1), using English letters of at least 25 mm (1 inch) height, or a white

at least 64.5 cm2 (10 square inches), will be acceptable.

The guidance of AMC 25.812(b)(1) regarding supplemental direction arrows is also applicable.
[Amdt 25/3]
[Amdt 25/19]

AMC 25.812(e)(2) Emergency lighting

If it is desired to identify each emergency exit by means of a symbolic sign, this sign should be white and
green in compliance with European Standard (EN) ISO 7010:2012, Graphical symbols, safety colours and
safety signs, registered safety signs.
Example of an acceptable design of symbolic sign to identify an exit

CS 25.812(e)
(exit identifier)

emergency exit.
The type of signs used to identify an emergency exit (letter based, symbolic) should be chosen to be
consistent with the emergency exit signs throughout the cabin.
[Amdt 25/3]
[Amdt 25/19]

Annex to ED Decision 2023/021/R Page 526 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

AMC 25.812(l)(1) Transverse Separation of the Fuselage

means that when calculating the percentage of electrically illuminated emergency lights rendered
inoperative by the fuselage separation, the number of lights whose function is lost due to loss of power
or loss of control input to the lights should be divided by the total number of electrically illuminated
emergency lights installed. The lights that are directly damaged by the fuselage separation should not be
included in the numerator of the calculation, but only those whose function is lost due to loss of power
and/or control. The denominator should be the total of all electrically illuminated emergency lights
installed.
Applicable parts of FAA AC 25.812-1A, Floor proximity emergency escape path marking, 22 May 1989 may
be used.
[Amdt 25/19]

CS 25.813 Emergency exit access and ease of operation

(See AMC 25.813)
(a) There must be a passageway leading from the nearest main aisle to each Type A, Type B, Type C,
Type I, or Type II emergency exit and between individual passenger areas. Each passageway leading
to a Type A or Type B exit must be unobstructed and at least 91 cm (36 inches) wide. Passageways
between individual passenger areas and those leading to Type I, Type II, or Type C emergency exits
must be unobstructed and at least 51 cm (20 inches) wide. Unless there are two or more main aisles,
each Type A or B exit must be located so that there is passenger flow along the main aisle to that
exit from both the forward and aft directions. If two or more main aisles are provided, there must
be unobstructed cross-aisles at least 51 cm (20 inches) wide between main aisles. There must be:
(1) A cross-aisle which leads directly to each passageway between the nearest main aisle and a
Type A or B exit; and
(2) A cross-aisle which leads to the immediate vicinity of each passageway between the nearest
main aisle and a Type C, Type I, Type II, or Type III exit; except that when two Type III exits
are located within three passenger rows of each other, a single cross-aisle may be used if it
leads to the vicinity between the passageways from the nearest main aisle to each exit.
(b) Adequate space to allow crew-member(s) to assist in the evacuation of passengers must be
provided as follows:
(1) Each assist space must be a rectangle on the floor, of sufficient size to enable a crew member,
standing erect, to effectively assist evacuees. The assist space must not reduce the
unobstructed width of the passageway below that required for the exit.
(2) For each Type A or Type B exit, assist space must be provided at each side of the exit
regardless of whether an assisting means is required by CS 25.810(a).
(3) For each Type C, I or II exit installed in an aeroplane with seating for more than 80 passengers,
an assist space must be provided at one side of the passageway regardless of whether an
assisting means is required by CS 25.810(a).

Annex to ED Decision 2023/021/R Page 527 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(4) For each Type C, I or II exit, an assist space must be provided at one side of the passageway
if an assisting means is required by CS 25.810(a).
(5) For any tail cone exit that qualifies for 25 additional passenger seats under the provisions of
CS 25.807(g)(9)(ii), an assist space must be provided, if an assisting means is required by CS
25.810(a).
(6) There must be a handle, or handles, at each assist space, located to enable the crew member
to steady himself or herself:
(i) While manually activating the assisting means (where applicable), and
(ii) While assisting passengers during an evacuation.
(c) The following must be provided for each Type III or Type IV exit (See AMC 25.813(c))
(1) There must be access from the nearest aisle to each exit.
(2) In addition, for each Type III exit in an aeroplane that has a passenger-seating configuration
of 20 or more and which has only seats installed immediately to the forward and aft of the
access route(s)-
(i) Except as provided in sub-paragraph (c)(2)(ii) of this paragraph, the access must be
provided by an unobstructed passageway that is at least 25.4 cm (10 inches) in width
for interior arrangements in which the adjacent seat rows on the exit side of the aisle
contain two seats, or 33 cm (13 inches) in width for interior arrangements in which
those rows contain three seats. The width of the passageway must be measured with
adjacent seats adjusted to their most adverse positions. At least 25.4 cm (10 inches) of
the required passageway width must be within the required projected opening width
of the exit.
(ii) In lieu of one 25.4 or 33 cm (10 or 13 inches) passageway, there may be two
unobstructed passageways, that must be at least 15.2 cm (6 inches) in width and lead
to an unobstructed space adjacent to each exit. Adjacent exits must not share a
common passageway. The width of the passageways must be measured with adjacent
seats adjusted to their most adverse positions. The unobstructed space adjacent to the
exit must extend vertically from the floor to the ceiling (or to the bottom of upper side
wall stowage bins), inboard from the exit for a distance not less than the width of the
narrowest passenger seat installed on the aeroplane and from the forward edge of the
forward passageway to the aft edge of the aft passageway. The exit opening must be
totally within the fore and aft bounds of the unobstructed space.
(3) Each Type III exit in an aeroplane that has a passenger seating configuration of 20 or more
and which has an access route bounded by any item(s) other than only seats (e.g.
bulkhead/wall, class divider, curtain) to its forward and/or aft side, must be provided with an
unobstructed passageway that is at least 50.8 cm (20 inches) in width. The width of the
passageway must be measured with any adjacent seats, or other movable features, adjusted
to their most adverse positions.
(4) In addition to the access -
(i) For aeroplanes that have a passenger seating configuration of 20 or more, the
projected opening of the exit provided may not be obstructed and there must be no

Annex to ED Decision 2023/021/R Page 528 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

interference in opening the exit by seats, berths, or other protrusions (including

adjacent seats adjusted to their most adverse positions) for a distance from that exit
not less than the width of the narrowest passenger seat installed on the aeroplane or
40 cm (15.75 inches), whichever is the least.
(ii) For aeroplanes that have a passenger seating configuration of 19 or less, there may be
minor obstructions in this region, if there are compensating factors to maintain the
effectiveness of the exit.
(5) For each Type III and Type IV exit there must be placards that
(i) are readable by each person seated adjacent to and facing a passageway to the exit,
one in their normal field of view; and one adjacent to or on the exit;
(ii) accurately state or illustrate the proper method of opening the exit, including the
correct use of controls, handles, handholds etc.;
(iii) if the exit is a removable hatch, state the weight of the hatch and indicate an
appropriate location to place the hatch after removal.
(6) For aeroplanes with a passenger seating configuration of 41 or more, each Type III exit must
be designed such that when operated to the fully open position, the hatch/door is
automatically disposed so that it can neither reduce the size of the exit opening, the
passageway(s) leading to the exit, nor the unobstructed space specified in sub-paragraph
(c)(2)(ii) of this paragraph, to below the required minimum dimensions. In the fully open
position it must also not obstruct egress from the exit via the escape route specified in CS
25.810(c).
(7) The design of each seat, bulkhead/partition or other feature, bounding the passageway
leading to each Type III or Type IV exit must be such that -
(i) evacuees are hindered from climbing over in the course of evacuating.
(ii) any baggage stowage provisions (such as under seat stowage) would prevent baggage
items entering the passageway under the inertia forces of CS 25.561(b)(3) unless
placards are installed to indicate that no baggage shall be stowed under the seats
bounding the passageway.
(iii) no protrusions (such as coat hooks) could impede evacuation.
(8) The design and arrangement of all seats bordering and facing a passageway to each Type III
or Type IV exit, both with and without the bottom cushion in place, must be free from any
gap, which might entrap a foot or other part of a person standing or kneeling on a seat or
moving on or along the seat row.
(9) The latch design of deployable features (such as tables, video monitors, telephones, leg/foot
rest) mounted on seats or bulkheads/partitions bordering and facing a passageway to a Type
III or Type IV exit, must be such that inadvertent release by evacuating passengers will not
occur. The latch design of deployable features must also be such that cabin crew can easily
check that the items are fully latched in the stowed position. Placards indicating that each
such item must be stowed for taxi, take-off and landing must be installed in the normal field
of view of, and be readable by each person seated in each seat bordering and facing a
passageway to a Type III or Type IV exit.

Annex to ED Decision 2023/021/R Page 529 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(d) If it is necessary to pass through a passageway between passenger compartments to reach any
required emergency exit from any seat in the passenger cabin, the passageway must be
unobstructed. However, curtains may be used if they allow free entry through the passageway.
(e) No door may be installed between any passenger seat that is occupiable for take-off and landing
and any passenger emergency exit, such that the door crosses any egress path (including aisles,
cross-aisles and passageways). (See AMC 25.813(e))
(f) If it is necessary to pass through a doorway separating any crew member seat (except those seats
on the flight deck), occupiable for take-off and landing, from any emergency exit, the door must
have a means to latch it in the open position. The latching means must be able to withstand the
loads imposed upon it when the door is subjected to the ultimate inertia forces, relative to the
surrounding structure, listed in CS 25.561(b).
[Amdt 25/9]
[Amdt 25/12]
[Amdt 25/18]
[Amdt 25/19]

AMC 25.813 Emergency exit access

adjacent wall(s)
and/or seat(s), the seatback(s) being in the most adverse position, in vertical projection from floor -level
to at least the prescribed minimum height of the exit.
The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing an acceptable
means of compliance with CS 25.813.
-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/12]
[Amdt 25/17]
[Amdt 25/26]

AMC 25.813(c) Emergency Exit Access and Ease of Operation

1 Post crash seat deformation

of seat structure into the required minimum passageway dimension due to emergency landing
dynamic loading.
Seat permanent deformation of up to 3 inches (as recorded in the tests required by CS 25.562) into
the minimum passageway dimensions defined in CS 25.813(c) is acceptable, provided no part of the
seat intrudes into the minimum required projected opening of the exit and provided the exit
operating characteristics are not compromised. Relevant parts of FAA Advisory Circular 25.562-1B
provide further details.
2 Deployable features

Annex to ED Decision 2023/021/R Page 530 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

Features mounted on seats, bulkheads or other cabin features, under passenger control and which
deploy into the required minimum passageway, may be accepted as not contravening the
equirements of CS 25.813(c) provided they are easily and instinctively
pushed out of the passageway by escapees in the event that they remain deployed prior to, or
become deployed during, an evacuation. This may include, but not be limited to, items such as
handsets, tray tables, in-armrest video monitors. Items such as footrests which would not be within

as being easily and instinctively re-stowed.

Such designs will be assessed on their individual merits.
It must be noted that none of the above reduces the requirement to design latching means that will

as part of a means of compliance to the

items into an access passageway during taxi, take-off and landing.

Features (e.g. seat recline, footrests, video screens, tables) may still be unsafe, even if they do not
deploy into a defined minimum 15.2, 25.4 or 33 cm (6, 10 or 13 inches) passageway (as applicable).
Deployable items may create snagging/tripping hazards and in the case where a wider passageway
than the minimum is provided, it cannot be assumed that escaping passengers will constrain
themselves to passing along one side or the centre. Features which deploy into the actual
passageway provided (in vertical projection from floor level to the upper ceiling/over head bin
constraint) will be assessed in the same way as if they deployed into the minimum passageway, i.e.
they can be accepted if they can be easily and instinctively pushed out of the passageway as
described above.
3 Automatic disposal of hatch/door
The intent, in CS 25.813(c)(6)
aeroplanes with passenger seating configurations of 41 or more is to remove the risk of passenger
confusion, difficulty or error once the opening handle movement has been initiated.
III exit
should be by its design as simple, instinctive and easy to operate as any other type of exit.
Markings, controls and kinematics of the design should be so that with minimal instruction (i.e.
from a study of the placards required by CS 25.813(c)(5) a naïve subject, with the ranges of size and
strength found in the 5th percentile female to the 95th percentile male, would be expected to be
able to swiftly and correctly operate the exit to its fully open and secured position.
In this regard, the exit hatch/door should move from its closed to fully open position in one simple
and continuous operator motion, e.g. avoiding discontinuities in required force/direction on the
handle(s). The traditional practice of providing a removable hatch will not be accepted as meeting
the requirements of CS 25.813(c)(6).
It is to be noted that the requirements of CS 25.809, which defines emergency exit operating
characteristics, testing requirements, etc. are applicable to all exit types, including Type III and IV.
4 Very large exit access provision

Annex to ED Decision 2023/021/R Page 531 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

In most cases it is expected that the cabin arrangement adjacent to a Type III or IV exit will be such
that access provision and unobstructed space for operation will be towards the minimum
dimensions required. However, this might not always be the case.
Some of the testing performed to substantiate the required dimensions has revealed that
competition between escaping
cases where a large unobstructed passageway or adjacent area is provided.
Dependent on the details of a specific cabin layout, additional substantiation may therefore be
necessary for a design providing a substantially larger passageway and/or clear area adjacent to the
exit than the minimum required. This will also apply to Type IV exits.
5 -
Two cases can be identified where some additional considerations may be needed when
considering the provisions of CS 25.813(c)(4)(i), namely:
a. A larger exit type (e.g. Type II, I) which is declared as a Type III in order to, for instance, place
-
b.

In such cases it may be acceptable that the exit opening provided is partially obstructed, at all times
or perhaps when certain features are deployed, if the remaining exit aperture still provides the
intended egress performance.
Each such case will be assessed on its own individual merits and, if accepted, would be so on the
basis of Equivalent Safety.
6 Provisions to prevent escapees bypassing the intended evacuation route
CS 25.813(c)(7)(i) is intended to prevent cabin installations which would permit escaping passengers
bypassing the intended evacuation route to the exit by climbing over seat backs or any other feature
that may bound the required access passageway.
In the case of seat backs, the surface over which an escapee may attempt to climb should remain
essentially upright, i.e. not exceeding 20 degrees rearward and 10 degrees forward relative to a
plane normal to the cabin floor, when a load of up to 668 N (150 lbf) is applied horizontally in a
fore/aft direction at the structurally most critical point.
In the case of features other than seat backs, the obstacle to climbing over should be assessed with
the aim that it be comparable to the seat back example above, i.e. the angle and height of the
item/surface in question.
7 Placards
The placards required by CS 25.813(c)(5) must accurately illustrate the proper method of opening

the cabin. Precautions should be taken to minimise the risk of a placard being installed on the
incorrect side of the cabin.
The particular method illustrated on a placard, e.g. placement of body, hands etc. should be
substantiated as being that most likely to result in successful operation.

Annex to ED Decision 2023/021/R Page 532 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

8. Entrapment
The seat design should be free of any gaps into which it would be possible to place a foot, hand or
arm in such a way as to delay or hamper free movement of passengers to the exit. Any opening/gap
that is assessed as being positioned such that it poses a risk and which is more than 2.54 cm (one
inch) in width will need to be the subject of particular scrutiny before being found acceptable.
9 Minor obstructions
An item may be acceptable as meeting the intent of a minor obstruction in accordance with CS
25.813(c)(4)(ii) provided that, as soon as an occupant begins to open the emergency exit using only
the required and visible operating handle, the obstruction moves such that the occupant
instinctively understands how to complete removal of the obstructive item. Examples of such items
are unattached (or loosely attached) soft seat back cushions on side-facing divans, provided that
the cushion may be readily moved away and the emergency exit then easily fully opened. Ease of
opening from the outside should also be assessed with the minor obstruction in place. Neither the
emergency exit sign nor the operating handle should be obscured at any point.
[Amdt 25/9]
[Amdt 25/19]

AMC 25.813(e) Interior Doors

Doors separating occupiable areas of the aeroplane cabin that do not obstruct a possible passenger egress
path when closed are not prohibited by CS 25 813(e).
Any such door should be openable from both sides without the use of any tool, which means without the
need to use any item; it is not acceptable to require the use of even common items such as coins, credit
cards, pens etc. (note: lavatory doors must comply with CS 25.820).
It is acceptable to have a door between a passenger compartment and a passenger emergency exit in
contradiction with the prohibition of CS 25.813(e), provided that this door is secured in the open position
by means acceptable to EASA that cannot be overridden except by a maintenance action (i.e. the
necessary actions should be such that aeroplane occupants are unlikely to be equipped to perform them).
[Amdt 25/19]

CS 25.815 Width of aisle

(See AMC 25.815)
The passenger aisle width at any point between seats must equal or exceed the values in the following
table:
Passenger seating Minimum passenger aisle width (cm (inches))
capacity Less than 64 cm (25 inches) from floor 64 cm (25 inches) and more from floor
10 or less 30 (12)* 38 (15)
11 to 19 30 (12) 51 (20)
20 or more 38 (15) 51 (20)

Annex to ED Decision 2023/021/R Page 533 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

* A narrower width not less than 23 cm (9 inches) may be approved when substantiated by tests found
necessary by the Agency.

AMC 25.815 Width of aisle

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing acceptable means
of compliance with CS 25.815.
25-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/11]
[Amdt 25/26]

CS 25.817 Maximum number of seats abreast

On aeroplanes having only one passenger aisle, no more than 3 seats abreast may be placed on each side
of the aisle in any one row.

CS 25.819 Lower deck service compartments (including galleys)

(See AMC 25.819)
For aeroplanes with a service compartment located below the main deck, which may be occupied during
the taxi or flight but not during take-off or landing, the following apply:
(a) There must be at least two emergency evacuation routes, one at each end of each lower deck
service compartment or two having sufficient separation within each compartment, which could be
used by each occupant of the lower deck service compartment to rapidly evacuate to the main deck
under normal and emergency lighting conditions. The routes must provide for the evacuation of
incapacitated persons, with assistance. The use of the evacuation routes may not be dependent on
any powered device. The routes must be designed to minimise the possibility of blockage, which
might result from fire, mechanical or structural failure, or persons standing on top of or against the

system should fail, emergency illumination for each lower deck service compartment must be
automatically provided.
(b) There must be a means for two-way voice communication between the flight deck and each lower
deck service compartment, which remains available following loss of normal electrical power
generating system.
(c) There must be an aural emergency alarm system, audible during normal and emergency conditions,
to enable crew members on the flight deck and at each required floor level emergency exit to alert
occupants of each lower deck service compartment of an emergency situation.
(d) There must be a means, readily detectable by occupants of each lower deck service compartment
that indicates when seat belts should be fastened.

Annex to ED Decision 2023/021/R Page 534 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
EMERGENCY PROVISIONS

(e) If a public address system is installed in the aeroplane, speakers must be provided in each lower
deck service compartment.
(f) For each occupant permitted in a lower deck service compartment, there must be a forward or aft
facing seat, which meets the requirements of CS 25.785(d) and must be able to withstand maximum
flight loads when occupied.
(g) For each powered lift system installed between a lower deck service compartment and the main
deck for the carriage of persons or equipment, or both, the system must meet the following
requirements:
(1) Each lift control switch outside the lift, except emergency stop buttons, must be designed to
prevent the activation of the lift if the lift door, or the hatch required by sub-paragraph (g)(3)
of this paragraph, or both are open.
(2) An emergency stop button, that when activated will immediately stop the lift, must be
installed within the lift and at each entrance to the lift.
(3) There must be a hatch capable of being used for evacuating persons from the lift that is
openable from inside and outside the lift without tools, with the lift in any position.
[Amdt 25/17]

AMC 25.819 Lower deck service compartments (including galleys)

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, are accepted by the Agency as providing an acceptable
means of compliance with CS 25.819.
25-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/17]
[Amdt 25/26]

CS 25.820 Lavatory doors

All lavatory doors must be designed to preclude anyone from becoming trapped inside the lavatory. If a
locking mechanism is installed, it must be capable of being unlocked from the outside without the aid of
special tools.
[Amdt 25/4]

Annex to ED Decision 2023/021/R Page 535 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
VENTILATION AND HEATING

VENTILATION AND HEATING

CS 25.831 Ventilation
(See AMC 25.831)
(a) Under normal operating conditions and in the event of any probable failure conditions of any
system that would adversely affect the ventilating air, the ventilation system must be designed to
provide a sufficient amount of uncontaminated air to enable the crew members to perform their
duties without undue discomfort or fatigue, and to provide reasonable passenger comfort. For
normal operating conditions, the ventilation system must be designed to provide each occupant
with an airflow that contains at least 0.25 Kg (0.55 lb) of fresh air per minute. (See AMC 25.831(a).)
(b) Crew and passenger compartment air must be free from harmful or hazardous concentrations of
gases or vapours. In meeting this requirement, the following apply:
(1) Carbon monoxide concentrations in excess of one part in 20 000 parts of air are considered
hazardous. For test purposes, any acceptable carbon monoxide detection method may be
used.
(2) Carbon dioxide concentration during flight must be shown not to exceed 0·5% by volume (sea
level equivalent) in compartments normally occupied by passengers or crewmembers. For
the purpose of this
and 1 013·2 hPa (760 millimetres of mercury) pressure.
(c) There must be provisions made to ensure that the conditions prescribed in sub-paragraph (b) of
this paragraph are met after reasonably probable failures or malfunctioning of the ventilating,
heating, pressurisation or other systems and equipment. (See AMC 25.831(c).)
(d) If accumulation of hazardous quantities of smoke in the cockpit area is reasonably probable, smoke
evacuation must be readily accomplished, starting with full pressurisation and without
depressurising beyond safe limits.
(e) Except as provided in sub-paragraph (f) of this paragraph, means must be provided to enable the
occupants of the following compartments and areas to control the temperature and quantity of
ventilating air supplied to their compartment or area independently of the temperature and
quantity of air supplied to other compartments and areas:
(1) The flight-crew compartment.
(2) Crew-member compartments and areas other than the flight-crew compartment unless the
crewmember compartment or area is ventilated by air interchange with other compartments
or areas under all operating conditions.
(f) Means to enable the flight crew to control the temperature and quantity of ventilating air supplied
to the flight-crew compartment independently of the temperature and quantity of ventilating air
supplied to other compartments are not required if all of the following conditions are met:
(1) The total volume of the flight-crew and passenger compartments is 22.65m3 (800 cubic ft) or
less.

Annex to ED Decision 2023/021/R Page 536 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
VENTILATION AND HEATING

(2) The air inlets and passages for air to flow between flight-crew and passenger compartments
are arrange to provide compartment temperatures within 2.8°C (5°F) of each other and
adequate ventilation to occupants in both compartments.
(3) The temperature and ventilation controls are accessible to the flight crew.
[Amdt No: 25/18]
[Amdt No: 25/23]

AMC 25.831(a) Ventilation

1. General
CS 25.831(a) specifies that the ventilation system must be designed to provide a minimum of
0.25 kg (0.55 lb) of fresh air per minute per person (i.e. 10 cubic feet per minute of air at 8 000 feet
pressure altitude and at a cabin temperature of 24°C (75°F)) for normal operations.
The applicant may demonstrate compliance with this specification by analysis, ground tests, and/or
flight tests.

supplied per minute per occupant may be determined by averaging the total cabin fresh air supply
and cockpit fresh air supply for the number of occupants that each area can accommodate,
assuming a uniform ventilation distribution in each area.
2. Low airflow capability during some flight phases
If an applicant proposes not to provide the minimum required fresh airflow during the phases of
flight that use low power levels, the applicant must show that the cabin air quality is not
compromised during those flight phases.
3.
The following provisions should be considered for the limited time periods, such as during take-off,

a. There should be a means to annunciate to the flight crew that the air conditioning system is
When, in flight, after the end of the maximum allowed time period (e.g.
typically after the take-
should be triggered to inform the flight crew of the status of the air conditioning system.
b. It should be demonstrated that the ventilation system continues to provide an acceptable
environment in the passenger cabin and the cockpit for the brief period when the air
conditioning system is not operating.
c. Furthermore, the equipment environment should be evaluated during those periods to
ensure that the reliability and performance of the equipment are not impaired. This
evaluation should cover the extremes of ambient hot and cold air temperatures in which the
aeroplane is expected to operate.
d. In addition, it should be demonstrated that no unsafe condition will result from operation for

Annex to ED Decision 2023/021/R Page 537 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
VENTILATION AND HEATING

compliance with CS 25.831(d) (cockpit smoke removal), CS 25.857 (occupied areas smoke
penetration), and CS 25.858 (smoke detection), the following should be considered:
i. During the operation of the aeroplane for any limited period of time with the air

ii. It should be possible for the air conditioning system

quantities of smoke.
e. Finally, the period during which the aeroplane is operated with the air conditioning system
f short duration. Therefore, the maximum period allowed in this
configuration should be defined by the applicant and specified in the appropriate operating
manuals, along with any related operating procedures that are necessary to ensure that the
above items are addressed.
4. Probable failure conditions
For probable failure conditions, the ventilation system should be designed to provide enough fresh
air to prevent the accumulation of odours and pollutants such as carbon dioxide. Under these
conditions, the supply of fresh air should not be less than 0.18 kg/min (0·4 lb/min) per person for
any period exceeding five minutes. However, temporary reductions below this flow rate may be
accepted provided that the compartment environment can be maintained at a level which is not
hazardous to the occupant; for this purpose, the applicant may refer to international cabin air
quality standards.
[Amdt 25/23]
[Amdt 25/26]
[Amdt 25/28]

AMC 25.831(c) Ventilation

1 To avoid contamination the fresh air supply should be suitably ducted where it passes through any
compartment inaccessible in flight.
2 Where the air supply is supplemented by a recirculating system, it should be possible to stop the
recirculating system and
a. Still maintain the fresh air supply prescribed, and
b. Still achieve 1.

CS 25.832 Cabin ozone concentration

(a) The aeroplane cabin ozone concentration during flight must be shown not to exceed
(1) 0·25 parts per million by volume, sea level equivalent, at any time above flight level 320; and
(2) 0·1 parts per million by volume, sea level equivalent, time-weighted average during any 3-
hour interval above flight level 270.

Annex to ED Decision 2023/021/R Page 538 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
VENTILATION AND HEATING

(b)
013·2 hPa (760 millimetres of mercury) pressure.
(c) Compliance with this paragraph must be shown by analysis or tests based on aeroplane operational
procedures and performance limitations, that demonstrated that either
(1) The aeroplane cannot be operated at an altitude which would result in cabin ozone
concentrations exceeding the limits prescribed by sub-paragraph (a) of this paragraph; or
(2) The aeroplane ventilation system, including any ozone control equipment, will maintain cabin
ozone concentrations at or below the limits prescribed by sub-paragraph (a) of this
paragraph.

CS 25.833 Combustion heating systems

Combustion heaters must be approved.

Annex to ED Decision 2023/021/R Page 539 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PRESSURISATION

PRESSURISATION

CS 25.841 Pressurised cabins

(a) Pressurised cabins and compartments to be occupied must be equipped to provide a cabin pressure
altitude of not more than 2438 m (8000 ft) at the maximum operating altitude of the aeroplane
under normal operating conditions. If certification for operation over 7620 m (25 000 ft) is
requested, the aeroplane must be able to maintain a cabin pressure altitude of not more than 4572
m (15 000 ft) in the event of any reasonably probable failure or malfunction in the pressurisation
system.
(b) Pressurised cabins must have at least the following valves, controls, and indicators for controlling
cabin pressure:
(1) Two pressure relief valves to automatically limit the positive pressure differential to a
predetermined value at the maximum rate of flow delivered by the pressure source. The
combined capacity of the relief valves must be large enough so that the failure of any one
valve would not cause an appreciable rise in the pressure differential. The pressure
differential is positive when the internal pressure is greater than the external.
(2) Two reverse pressure differential relief valves (or their equivalents) to automatically prevent
a negative pressure differential that would damage the structure. One valve is enough,

(3) A means by which the pressure differential can be rapidly equalised.

(4) An automatic or manual regulator for controlling the intake or exhaust airflow, or both, for
maintaining the required internal pressures and airflow rates.
(5) Instruments at the pilot or flight engineer station to show the pressure differential, the cabin
pressure altitude, and the rate of change of the cabin pressure altitude.
(6) Warning indication at the pilot or flight engineer station to indicate when the safe or pre-set
pressure differential and cabin pressure altitude limits are exceeded. Appropriate warning
markings on the cabin pressure differential indicator meet the warning requirement for
pressure differential limits and an aural or visual signal (in addition to cabin altitude indicating
means) meets the warning requirement for cabin pressure altitude limits if it warns the flight
crew when the cabin pressure altitude exceeds 3048 m (10 000 ft).
(7) A warning placard at the pilot or flight engineer station if the structure is not designed for
pressure differentials up to the maximum relief valve setting in combination with landing
loads.
(8) The pressure sensors necessary to meet the requirements of sub-paragraphs (b)(5) and (b)(6)
of this paragraph and CS 25.1447(c), must be located and the sensing system designed so
that, in the event of loss of cabin pressure in any passenger or crew compartment (including
upper and lower lobe galleys), the warning and automatic presentation devices, required by
those provisions, will be actuated without any delay that would significantly increase the
hazards resulting from decompression.
[Amdt 25/15]

Annex to ED Decision 2023/021/R Page 540 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
PRESSURISATION

CS 25.843 Tests for pressurised cabins

(a) Strength test. The complete pressurised cabin, including doors, windows, and valves, must be
tested as a pressure vessel for the pressure differential specified in CS 25.365(d).
(b) Functional tests. The following functional tests must be performed:
(1) Tests of the functioning and capacity of the positive and negative pressure differential valves,
and of the emergency release valve, to simulate the effects of closed regulator valves.
(2) Tests of the pressurisation system to show proper functioning under each possible condition
of pressure, temperature, and moisture, up to the maximum altitude for which certification
is requested.
(3) Flight tests, to show the performance of the pressure supply, pressure and flow regulators,
indicators, and warning signals, in steady and stepped climbs and descents at rates
corresponding to the maximum attainable within the operating limitations of the aeroplane,
up to the maximum altitude for which certification is requested.
(4) Tests of each door and emergency exit, to show that they operate properly after being
subjected to the flight tests prescribed in sub-paragraph (b)(3) of this paragraph.

Annex to ED Decision 2023/021/R Page 541 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

FIRE PROTECTION

CS 25.851 Fire extinguishers

(See AMC 25.851)
(a) Hand fire extinguishers. (See AMC 25.851(a).)
(1) The following minimum number of hand fire extinguishers must be conveniently located and
evenly distributed in passenger compartments. (See AMC 25.851(a)(1).):
Passenger capacity Number of extinguishers
7 to 30 1
31 to 60 2
61 to 200 3
201 to 300 4
301 to 400 5
401 to 500 6
501 to 600 7
601 to 700 8

(2) At least one hand fire extinguisher must be conveniently located in the pilot compartment
(see AMC 25.851(a)(2)).
(3) At least one readily accessible hand fire extinguisher must be available for use in each Class
A or Class B cargo or baggage compartment and in each Class E or Class F cargo or baggage
compartment that is accessible to crewmembers in flight.
(4) At least one hand fire extinguisher must be located in, or readily accessible for use in, each
galley located above or below the passenger compartment.
(5) Each hand fire extinguisher must be approved.
(6) The required fire extinguishers located in the passenger compartment must contain an
accepted extinguishing agent that is appropriate for the kinds and classes of fires likely to
occur where used.
(7) The quantity of extinguishing agent used in each extinguisher required by this paragraph
must be appropriate for the kinds of fires likely to occur where used.
(8) Each extinguisher intended for use in a personnel compartment must be designed to
minimise the hazard of toxic gas concentration.
(b) Built-in fire extinguishers. If a built-in fire extinguisher is provided
(1) Each built-in fire extinguishing system must be installed so that
(i) No extinguishing agent likely to enter personnel compartments will be hazardous to
the occupants; and
(ii) No discharge of the extinguisher can cause structural damage.

Annex to ED Decision 2023/021/R Page 542 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(2) The capacity of each required built-in fire extinguishing system must be adequate for any fire
likely to occur anywhere in the compartment where used, considering the volume of the
compartment and the ventilation rate. (see AMC 25.851(b)).
(c) Fire-extinguishing agents
(See AMC 25.851(c))
(1) Fire classes against which fire-extinguishing agents may be employed are:
Class A: Fires involving ordinary combustible materials, such as wood, cloth, paper,
rubber and plastics;
Class B: Fires involving flammable liquids, petroleum oils, greases, tars, oil base paints,
lacquers, solvents, alcohols and flammable gases;
Class C: Fires involving energised electrical equipment where the use of an extinguishing
agent that is electrically non-conductive is important.
[Amdt 25/4]
[Amdt 25/8]
[Amdt 25/12]
[Amdt 25/18]

AMC 25.851(a) Hand fire extinguishers

1 Each extinguisher should be readily accessible and mounted so as to facilitate quick removal from
its mounting bracket.
2 Unless an extinguisher is clearly visible, its location should be indicated by a placard or sign having
letters of at least 9.5 mm (0·375) inches in height on a contrasting background. Appropriate symbols
may be used to supplement such a placard or sign.
[Amdt 25/12]

AMC 25.851(a)(1) Hand fire extinguishers

1 The number and location of hand fire extinguishers should be such as to provide adequate
availability for use, account being taken of the number and size of the passenger compartments
and the location of toilets, galleys, etc. These considerations may result in the number being greater
than the minimum prescribed.
2 Where only one hand extinguisher is required it should be located at the cabin crew member
station, where provided, otherwise near the main entrance door.
3 Where two or more hand extinguishers are required and their location is not otherwise dictated by
consideration of paragraph 1 above, an extinguisher should be located at each end of the cabin and
the remainder distributed throughout the cabin as evenly as is practicable.
[Amdt 25/12]

Annex to ED Decision 2023/021/R Page 543 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

AMC 25.851(a)(2) Hand fire extinguishers

compartment. Additional extinguishers may be required for the protection of other compartments
accessible to the crew in flight (e.g. electrical equipment bays) or from consideration of CS 25.851(a)(2).
Based on EU legislation4, for new installations of hand fire extinguishers for which the certification
application is submitted after 31 December 2014, Halon 1211, 1301 and Halon 2402 are unacceptable
extinguishing agents.
The hand fire extinguishers and related agents listed in the FAA Advisory Circular AC 20-42D are
considered acceptable by the Agency. See AMC 25.851(c) for more information on Halon alternatives.
NOTE: Dry chemical fire extinguishers should not be used in pilot compartments because of the adverse effects on
vision during discharge and, if non-conductive, interference with electrical contacts by the chemical residues.
[Amdt 25/12]

AMC 25.851(b) Built-in Fire Extinguishers for Cargo Compartments

1. PURPOSE.
This AMC sets forth acceptable means, but not the only means, of demonstrating compliance with
the provisions of CS-25 related to the built-in fire suppression systems when required for cargo
compartments of large aeroplanes. The guidance provided within this AMC has been found
acceptable for showing compliance with the provisions of CS 25.855 and 25.857 for built-in fire-
extinguishing systems. As with all AMC material, it is not mandatory and does not constitute a
regulation. For application to the product, alternate methods may be elected to be followed,
provided that these methods are also found by the EASA to be an acceptable means of complying
with the requirements of CS-25.
2. RELATED CS PARAGRAPHS.
CS 25.851 "Fire extinguishers"
CS 25.855 "Cargo or baggage compartments"
CS 25.857
CS 25.858
3. BAN ON HALON 1301.
Halon 1301 is no longer an acceptable extinguishing agent, based on EU Legislation5, for cargo
compartment fire extinction systems to be installed on aircraft types, for which type certification is
requested after 31 December 2018. See AMC 25.851(c) for more information on Halon alternatives.
4. BACKGROUND ON CONCENTRATION OF HALON 1301.

4 Commission Regulation (EU) No 744/2010 of 18 August 2010 amending Regulation (EC) No 1005/2009 of the European Parliament and of
the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).
5 Commission Regulation (EU) No 744/2010 of 18 August 2010 amending Regulation (EC) No 1005/2009 of the European Parliament and of
the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).

Annex to ED Decision 2023/021/R Page 544 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

Minimal written guidance is available for use in certifying cargo compartment fire-extinguishing or
suppression systems. Testing at the FAA Technical Center and other data from standardised fire-
extinguishing evaluation tests indicates that the use of averaging techniques may not substantiate
that there are adequate concentration levels of fire-extinguishing agent throughout the
compartment to effectively suppress a cargo fire.
Cargo fire-extinguishing systems installed in aeroplanes have primarily used Halon 1301 as the fire
suppression agent. One widely used method to certify Halon 1301 cargo fire suppression systems
requires an initial concentration of five percent by volume in order to knock down a cargo fire.
Subsequent concentration levels should not drop below three percent by volume for the remainder
of the flight in order to suppress a cargo fire until it can be completely extinguished by ground
personnel following a safe landing.
Since Halon 1301 is approximately five times heavier than air, it tends to stratify and settle after it
is released into the cargo compartment. Also, due to temperature differences and ventilation
patterns, in a ventilated compartment, Halon 1301 will start to stratify shortly after discharge and
the concentration level will decay faster in the upper locations of the compartment than in the
lower locations. Halon 1301 will also have a tendency to move aft due to any upward pitch or
forward in any downward pitch of the aeroplane in flight. For some products the concentration
levels of Halon 1301 have been measured at various locations throughout the cargo compartment
and used an arithmetic average of the individual sampling locations to determine an overall
concentration level for the cargo compartment. This averaging technique may allow the
concentration level to drop below three percent by volume at individual sampling locations near
the top of the cargo compartment.
Testing at the FAA Technical Center and other data from standardised fire-extinguishing evaluation
tests indicates that the use of averaging techniques may not substantiate that there are adequate
concentration levels of fire-extinguishing agent throughout the compartment to effectively
suppress a cargo fire. If a cargo fire occurred, and was subsequently suppressed by Halon 1301, the
core of the fire could remain hot for a period of time. If the local concentration of Halon 1301 in the
vicinity of the fire core dropped below three percent by volume and sufficient oxygen is available,
re-ignition could occur. The FAA tests have shown that when the Halon 1301 concentration level
drops below three percent by volume and the cargo fire re-ignites, the convective stirring caused
by the heat of the fire may be insufficient to raise the local concentration of Halon in the vicinity of
the fire. Therefore, compliance testing will require the use of point-concentration data from each
sensor and that the probes closest to the cargo compartment ceiling must be at least at the highest
level that cargo and baggage can be loaded as specified by the manufacturer and certified by the
appropriate airworthiness authority. In addition, certification test data acquisition must include
analysis and/or data taken after landing at a time increment which represents the completion of an
evacuation.
5. COMPARTMENT CLASSIFICATION.
All cargo compartments must be properly classified in accordance with CS 25.857 and meet the
requirements of CS 25.857 pertaining to the particular class involved. In order to establish
appropriate requirements for fire protection, a system for classification of cargo or baggage
compartments was developed and adopted for large aeroplanes. Classes A, B, and C were initially
established; Classes D and E were added later.

Annex to ED Decision 2023/021/R Page 545 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

a. A Class A compartment is one that is located so close to the station of a crewmember that
the crewmember would discover the presence of a fire immediately. In addition, each part
of the compartment is easily accessible so that the crewmember could quickly extinguish a
fire with a portable fire extinguisher. A Class A compartment is not required to have a liner.
(1) Typically, a Class A compartment is a small open compartment in the cockpit area used
for storage of crew luggage. A Class A compartment is not, however, limited to such
use; it may be located in the passenger cabin and used for other purposes provided it
is located adjacent to a crewmember's station and crewmember remains present
during all times when it is used for storage.
(2) Because a Class A compartment does not have a liner, it is absolutely essential that the
compartment be small and located close enough to a crewmember that any fire that
might occur could be discovered and extinguished immediately. Without a liner to
contain it, an undetected or uncontrolled fire could quickly become catastrophic by
burning out of the compartment and spreading throughout the aeroplane. All portions
of the compartment must be within arms length of the crewmember in order for any
fire to be detected immediately and extinguished in a timely manner. Although there
may be some exceptions, such as a 'U-Shaped' compartment for example, a Class A
compartment greater than 1.42 cubic metres (50 cubic feet) in volume would not
typically have the accessibility required by CS 25.857(a)(2) for fighting a fire.
b. A Class B compartment is one that is more remote than a Class A compartment and must,
therefore, incorporate a fire or smoke detection system to give warning at the pilot or flight
engineer station. Because a fire could not be detected and extinguished as quickly, a Class B
compartment must have a liner in accordance with CS 25.855. A Class B cargo or baggage
compartment has sufficient access in flight to enable a crewmember to reach all parts of the
compartment with the contents of a hand fire extinguisher. There are means to ensure that,
while the access provisions are being used, no hazardous quantity of smoke, flames, or
extinguishing agent will enter areas occupied by the crew or passengers.
c. A Class C compartment differs from a Class B compartment in that it is not required to be
accessible in flight and must, therefore, have a built-in fire-extinguishing system to suppress
or control any fire occurring therein. A Class C compartment must have a liner and a fire or
smoke detection system in accordance with CS 25.855 and 25.857. There must also be a
means to control ventilation and drafts within the compartment and a means to exclude
hazardous quantities of smoke, flames, or extinguishing agent from occupied areas.
d. FAR Amendment 25-93 removed the Class D cargo compartment classification for new
aeroplanes effective March 19, 1998.
e. A Class E compartment is particular to an all-cargo aeroplane. Typically, a Class E
compartment is the entire cabin of an all-cargo aeroplane; however, other compartments of
such aeroplanes may be classified as Class E compartments. A fire in a Class E compartment
is controlled by shutting off the ventilating airflow to or within the compartment.
Additionally, most cargo aeroplanes have smoke/fire procedures that recommend that the
crew turn off the ventilating air, don their oxygen equipment, and gradually raise the cabin
altitude, between 6096 m (20,000 feet) and 7620 m (25,000 feet), to limit the oxygen supply
and help control a fire until the aeroplane can descend to land. A Class E compartment must

Annex to ED Decision 2023/021/R Page 546 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

have a liner and a fire or smoke detection system installed in accordance with CS 25.855;
however, it is not required to have a built-in fire suppression system.
6. FIRE EXTINGUISHING OR SUPPRESSION SYSTEMS.

AMC. The system is not required to extinguish a fire in its entirety. The system is intended, instead,
to suppress a fire until it can be completely extinguished by ground personnel following a safe
landing.
7. TESTING VOLUMETRIC CONCENTRATION LEVELS.
For the product it should be demonstrated that the cargo fire extinguishing system provides
adequate concentration levels of extinguishing agent to combat a fire anywhere where baggage
and cargo is placed within the cargo compartment for the time duration required to land and
evacuate the aeroplane. A combination of flight-testing and analysis may be used to comply with
this requirement. If Halon 1301 is used, an initial minimum concentration of five percent by volume
is required to knock down a cargo fire. Subsequent gaseous extinguishing agent should, if required
for the duration of the flight, be introduced via a metering or other appropriate system to ensure
that point concentration levels do not drop below three percent by volume for the remainder of
the flight. The duration of agent application should be determined from route analysis (i.e. the time
to travel from the farthest distance expected in route to the nearest adequate airport for landing
per applicable operational rules. For Extended Operation with Two-Engine Aeroplanes (ETOPS)
AMC 20-6 specify that an analysis or tests should be conducted to show, considering approved
maximum diversion in still air (including an allowance for 15-minute holding and/or approach and
land), that the ability of the system to suppress or extinguish fires is adequate to ensure safe flight
and landing at a suitable airport. The minimum extinguishing agent concentration levels are to be
maintained for the required duration throughout the cargo compartment where cargo will be
carried, including side to side, end to end, and top to bottom. However, flight test measurements
do not have to be made in compartment areas that are designated empty and will not contain
cargo.
The fire extinguishing agent concentration levels should be measured at sufficient vertical,
horizontal, and longitudinal locations to ensure that sufficient resolution exists to define the
variations in fire extinguishing agent concentration levels throughout the cargo compartment in
these planes. No averaging techniques are permitted in compliance demonstrations for
CS 25.851(b)(2). The only exception to this will be in the event of a sensor failure where
interpolation of sensor data from other nearby probes to yield an estimate of missing agent
concentration data may be allowed by the Agency. In the event such interpolation is necessary,
then a linear interpolation of the data will provide an acceptable means of approximating the
missing data.
Sampling locations should also be placed as close as practical to potential leakage or ventilation
flow areas (e.g., door seals, vents, etc.) which can disrupt the local concentration levels.
The concentration levels should not be less than the minimum established for that fire extinguishing
agent at any point within the compartment. Arithmetic averaging of individual sampling locations
to determine the concentration levels is not acceptable. The use of averaged concentration data
will no longer be accepted, except in well-defined cases (i.e., during certification tests) where a
sensor probe failure occurs and the use of interpolation from adjacent sensor probes is warranted.

Annex to ED Decision 2023/021/R Page 547 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

Compliance with CS 25.851(b) will require the use of point-concentration data from each sensor
and that the probes closest to the cargo compartment ceiling must be at least at the highest level
that cargo and baggage can be loaded as specified by the manufacturer and certified by the Agency.
Other placement of concentration sensor probes within the cargo compartment should be
sufficient to substantiate that there are adequate concentration levels of fire extinguishing agent
throughout the compartment to effectively control a cargo compartment fire. The sampling rate
should be sufficient to establish a concentration level versus time decay curve. In the event that a
single sensor displays a suspect time history, the use of an interpolated time averaged value may
be acceptable to the Agency. If fire extinguishing agent concentration levels at a probe drop below
the minimum requirement, it should be a temporary anomaly of short duration and not observed
in adjacent probes. If it could be demonstrated that the temporary anomaly is associated with
aeroplane manoeuvres, then the data may be acceptable to the Agency.
Typically there are two type of extinguishing agent dispensing systems, a flood or dump (high rate
discharge) system and a metered system. The flood or dump system dispenses the agent with the
activation of the system and a selected amount of agent is injected into the compartment to
suppress the fire. Once the agent concentration level approaches the minimum sustaining level,
i.e., 3%, a second and subsequent discharge of agent takes place to assure the 3% concentration
level is maintained for the time necessary to divert to a safe landing. The metered systems usually
discharge agent into the compartment for fire suppression (5%) and then adds agent in a prescribed
amount to the compartment to maintain the 3% concentration level.
he
intended diversion profile.
demonstrated through a limited flight test, in which a portion of the system is actually tested, and
the full capability of the system is demonstrated via analysis. It is recognised that issues such as
what compartment size should be tested (smallest or largest), the test duration in flight, and
whether reliable analytical methods are available to predict concentration levels for various
locations and heights in a given cargo compartment will have an impact on certification tests. EASA
concurrence must be obtained for this type of testing and analysis of the product. A sufficient
portion of the metering system capability should be demonstrated to provide enough data to
establish fire extinguishing agent concentration and behaviour for the remaining flight. It is
recognised that aeroplane climb flight phase and the descent flight phase represent dynamic
environments and no data need be acquired during these transient flight phases were cabin altitude
changes would preclude accurate data acquisition. However, certification data must include
analysis and/or data taken after landing at a time increment representative of the completion of an
evacuation of all occupants.
Acceptable extinguishing agents, alternative to Halon and based on internationally recognised
Minimum Performance Standards (MPS), like e.g. Report No. DOT/FAA/AR-00-28, Development of
a Minimum Performance Standard for Aircraft Cargo Compartment Gaseous Fire Suppression
Systems, dated September 2000, may be accepted by the Agency. In the absence of internationally
accepted concentration levels, the Agency will initiate a Certification Review Item addressing the
use of an alternate fire-extinguishing agent.
8. AEROPLANE TEST CONDITIONS FOR USE OF HALON 1301 IN CARGO COMPARTMENTS.

Annex to ED Decision 2023/021/R Page 548 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

Flight tests are required to demonstrate function and dissipation of the fire extinguishing agent or
simulant in a cargo compartment. For certification tests, the aeroplane and relevant systems should
be in the type design configuration.
The cargo compartment should be empty for the above test. However, as shown in Figure 8-1, a
compartment with cargo may be more time critical than an empty compartment for minimum fire
extinguishing agent concentration levels. The time critical nature depends on several factors. Even
ving cargo does not necessarily mean a marginally performing

metering systems, if designed properly, are relatively insensitive to the cargo load factor.
Figure 8-1. Effect of Cargo Load on Halon 1301 Concentration Levels

A specific example of the effect of cargo compartment loading is shown in Figure 8-2, using the
Appendix 1 simulation. If the volume of the compartment is decreased to represent increasing
cargo load percentages and the leakage rate and initial Halon quantity are kept constant, then the
initial Halon concentrations increase and the concentration decay rates also increase. Using this
approach, the concentration in an empty compartment will decay to 3% faster than a loaded
compartment up to a load percentage of about 65.6%. With compartments loaded to a higher
percentage than 65.6%, the concentration will fall below 3% faster than an empty compartment.
This simulation of cargo loading assumes that the Halon concentration is homogeneous throughout
the compartment and that the volume taken up by the loaded cargo is uniformly distributed
throughout the compartment. Note: Both of these assumptions are not true in an actual loaded

Annex to ED Decision 2023/021/R Page 549 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

compartment so caution should be exercised to relate the measurements taken in an actual loaded
compartment in flight.

Figure 8-2

Analysis should be provided to ensure that the suppression agent concentration levels will not fall
below the minimum requirement with a cargo load factor as follows:
a. For cargo compartments using only standard cargo containers, the maximum possible
volume occupied by containerised cargo should be determined for the product and this value
be used as the cargo load factor. This maximum volume becomes an aeroplane limitation.
b. For all other configurations, a minimum cargo load factor of 75% by volume should be used

Appendix 1 to this AMC provides guidance on analysing Halon 1301 concentration levels.
The suppression system certification test should be conducted, as a minimum, during steady-state
cruise with a maximum cabin-to-ambient pressure differential. The ventilation system should be
configured per the aeroplane flight manual (AFM) procedures for a cargo compartment fire. The
system should also be demonstrated acceptable for unpressurised flight conditions unless there is
a restriction on unpressurised flight for the aeroplane.
It should be noted that cargo compartment leakage rates would vary between aeroplanes. This is
especially significant for changes introduced by supplemental type certificate (STC) modifying
aeroplanes that have been in service. Some preliminary testing should be done to determine the

Annex to ED Decision 2023/021/R Page 550 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

maximum leakage rates seen/expected in service. For new type designs the issue of wear and tear
on the compartment should also be addressed when establishing the decay rate in a brand new
aircraft at the factory.
9. USE OF SIMULANTS FOR CERTIFICATION TESTING
The aviation industry may continue to use Halon in cargo fire suppression applications in relation
to new application for type certificate, until the end of 2018..
The EPA/EU are allowing the aviation industry to use Halon to demonstrate system functionality as
long as a simulant or alternate extinguishing agent or alternate fire-extinguishing system cannot be
used in place of the Halon during system or equipment testing for technical reasons. It should be
noted, however, that certain states continue to ban the release of Halon for testing. The FAA
Technical Center and the International Aircraft Systems Fire Protection Working Group are
concentrating efforts on evaluating alternative fire-extinguishing agents and the use of simulants
during certification testing. The EASA plans to approve a simulant which can be used in place of
Halon 1301 during certification tests of aircraft fire-extinguishing systems to predict actual Halon
1301 volumetric concentration levels. When approved, the use of a simulant will be the preferred
method for demonstrating compliance.
As of the date of this AMC, no suitable simulant for cargo compartment gaseous fire extinguishing
systems has been identified. However, should the EASA be approached with the intent of utilise for
the product a simulant in lieu of a Halon 1301 system or other gaseous fire extinguishing system
then the recommended approach would be to perform testing which meets the Minimum
Performance Standards for that application as developed by the International Aircraft Systems Fire
Protection Working Group. To ensure acceptable successful means of compliance the same
information as outlined above in paragraph 7 should be provided.
A simulant is defined in this AMC as a chemical agent that adequately imitates the discharge and
distribution characteristics of a given extinguishing agent. It need not be an actual fire suppressant.
For certain cases due to cost of the extinguishing agent, problems with supply of the extinguishing
agent, etc; it may be more appropriate for the application to utilise a simulant. The Agency would
require adequate analysis and testing be accomplished to establish the validity of the simulant. As
a minimum, corroborating information would need to be provided as to the detailed chemical
analysis of the simulant and evaluation testing of the fire extinguishing system operated with the
simulant which demonstrates the equivalent behaviour. To ensure acceptable means of
compliance, the following must be provided:
(1) The test data and distribution profiles using the simulant which meet the certification criteria
as expressed below and in the Minimum Performance Standards as developed by FAA
Technical Center as part of the International Aircraft Systems Fire Protection Working Group.
(See Paragraph 15 for the listing of the references.)
(2) A system description document that includes a description of the distribution of the simulant
under the test conditions in the cargo compartment.
(3) A detailed test plan.
(4) Chemical data which describes the simulant and any toxicity data.
For the application the distribution of the simulant must be described as compared with Halon 1301
under the following conditions:

Annex to ED Decision 2023/021/R Page 551 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

a. Given the same filling conditions, the simulant is loaded into the fire extinguisher bottle
based on an equivalent liquid fraction to the Halon 1301 charge weight required. This is an
equivalent statement to the mass of the simulant being a specific percentage of the Halon
1301 charge weight required.
b. The fire extinguisher bottle containing the simulant is pressurised with nitrogen in an
identical manner required by the Halon 1301 charge weight.
c. The simulant is discharged into the test environment, i.e. cargo compartment.
9.1 Pre-Test Considerations:
a. An EASA accepted analyser (for example, Statham-derivative analyser) capable of
measuring the simulant distribution profile in the form of volumetric concentration is
required.
b. An EASA accepted analyser (for example, Statham-derivative analyser) and associated
hardware are configured for the particular application.
c. The fire suppression system should be completely conformed for Halon 1301.
d. The fire extinguisher bottle(s) should be serviced and prepared for the prescribed
test(s).
9.2 Test Procedures:
a. Perform the prescribed distribution test in accordance with the EASA approved test
plan. See Paragraph 7 for guidance on probe placement.
b. An EASA accepted analyser (for example, Statham-derivative analyser) should record
the distribution profile as volumetric concentration for the simulant.
9.3 Test Result Evaluation:
a. Produce the data from the EASA accepted analyser (for example, Statham-derivative
analyser) in graphical format. This format should be the volumetric concentration of
the simulant versus time. A specific percent volumetric initial concentration and a
specific percent volumetric metered concentration for the length of the test duration
as determined by previous testing conducted per the established minimum
performance standards is required for airworthiness approval of cargo compartment
systems.
b. Using the Halon 1301 certification criteria, evaluate the distribution profile of the
simulant for acceptable performance. The acceptability of the test data would be
dependent upon the distribution profile and duration exhibited by each probe (See
above and Paragraph 7 for cargo compartment fire extinguishing systems).
10. ESTABLISHING DURATION FOR THE SUPPRESSION SYSTEM.
- erstood to mean, that there is sufficient
quantity of agent to combat the fire anywhere where baggage and cargo is placed within the cargo
compartment for the time duration required to land and evacuate the aeroplane. Current built-in
cargo fire extinguishing systems utilise Halon 1301 as the fire extinguishing agent. Protection is
afforded as long as the minimum concentration levels in the cargo compartment do not drop below

Annex to ED Decision 2023/021/R Page 552 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

three percent by volume. The time for which a suppression system will maintain the minimum
required concentration levels should be identified as a certificate limitation.
The designer of the product should work with the aircraft owner and the competent authority
providing operational approval to ensure that the cargo fire extinguishing system provides the
required protection time (i.e., proper sizing of the cargo fire extinguishing system) for the specific
route structure. The competent authority may insist on some holding time to allow for weather
and other possible delays, and may specify the speeds and altitudes used to calculate aeroplane
diversion times based on one-engine-out considerations.
The competent authority providing operational approval for the aeroplane determines the
maximum allowable time, following the discovery of a fire or other emergency situation, required
to divert the aeroplane to an alternate landing site. In the past, for some cases, the maximum
allowable time was calculated by adding a 15 minute allowance for holding and/or approach and
landing to the actual time required to reach the alternate landing site under specific operating
conditions. With the issuance of this AMC, an allowance of 15 minute for approach and landing
must be considered and certification data must include analysis and/or data taken after landing at
a time increment which represents the completion of an evacuation of all occupants.
AMC 20- -
means for obtaining approval under applicable operational rules for two-engine aeroplanes

one-engine inoperative cruise speed (in still air) from an adequate airport. It includes specific
criteria for deviations of 75 minutes, 120 minutes, and 180 minutes from an adequate airport plus
an allowance for 15-minute holding and/or approach and land.
Certification flight tests, supplemented by analysis for cargo load factors and additional metering
system bottles as applicable, determines the maximum protection time provided by the cargo fire
extinguishing system. This maximum protection time may not be the same as the maximum
allowable time required to divert the aeroplane. The certificate limitation for total time, including
the 15 minute allowance for holding and/or approach and landing as applicable, should never be
greater than the maximum protection time provided by the cargo fire extinguishing system.
The following examples illustrate these issues:
Example 1
Maximum protection time provided
By cargo fire extinguishing system = 127 minutes
Maximum diversion time = 112 minutes + 15 minutes
(Note - in this example, the civil aviation authority required an allowance of 15 minutes for holding
and/or approach and landing)
Certificate limitation for total time = 127 minutes
Example 2
Maximum protection time provided
By cargo fire extinguishing system = 68 minutes
Maximum diversion time = 60 minutes

Annex to ED Decision 2023/021/R Page 553 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(Note - in this example, the civil aviation authority did not require the 15 minutes allowance for
holding and/or approach and landing. With the issuance of this AMC, the approach indicated in
example 2 above is no longer considered an acceptable means of compliance.)
Certificate limitation for total time
11. MANUAL CONSIDERATIONS.
To ensure fire protection/fire suppression system effectiveness and safe continuation of flight and
landing, the applicable aeroplane manuals should contain appropriate directives, for example:
a. Any procedures related to fighting a cargo compartment fire should be clearly defined in the
Aeroplane Flight Manual (AFM).
b. Aeroplane Flight Manuals should contain instructions to land at the nearest adequate airport
(or suitable airport for ETOPS ) following detection of a cargo fire.
c. Cargo loading restrictions (certified type of loading per compartment, limits for loading
heights and width, etc.) should be clearly described in the Weight & Balance Manual or any
other appropriate aeroplane manual.
d. Where the use of aeroplane manuals is considered to be impractical during cargo loading
activities, all necessary information may be introduced into crew operating manuals or part
of dedicated instructions for cargo loading personnel.
12. PLACARDS AND MARKINGS IN CARGO COMPARTMENTS
Experience has shown that under certain circumstances and despite clear instructions in the
applicable aircraft documentation, cargo loading personnel may not obey loading restrictions.
Especially pallets may be loaded higher than certified or bulk cargo may be stowed up to the ceiling,
adversely affecting smoke detection and fire protection/fire suppression system effectiveness.
To visually indicate the applicable loading restrictions to each person being responsible for cargo
loading activities in a compartment, placards and markings for certified type of cargo, maximum
loading height and widths may need to be installed in that compartment.
For the design of these indications (i.e., for shape, size, colour and brightness), illumination
conditions in the compartment should be considered. Markings and placards should not be easily
erased, disfigured or obscured. Further guidance may be derived from compliance demonstrations
for CS paragraphs regulating other internal markings and placards, for example in the cockpit or
passenger compartment.
[Amdt 25/4]
[Amdt 25/12]

Appendix 1: Analytical methods for determining Halon 1301

concentration levels
1. PURPOSE. This appendix contains analytical methods for determining Halon 1301 fire extinguishing
agent concentration levels in empty or loaded cargo compartments as a function of time.
2. EXPLANATION OF TERMS AND SYMBOLS.

Annex to ED Decision 2023/021/R Page 554 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

TABLE 2-1. TERMS AND SYMBOLS

SYMBOL DESCRIPTION UNITS CONSISTENT WITH EQUATIONS

C(t) Halon 1301 concentration by Dimensionless
= VHalon 1301 / V
VHalon 1301 Volume of Halon 1301 in cargo compartment. Cubic metre - m3
(Cubic feet - ft3)
V Cargo compartment free volume (i.e., volume not Cubic metre - m3
occupied by cargo). (Cubic feet - ft3)
= 1 - ( Vcargo / Vempty )
Vcargo Cargo volume. Cubic metre - m3
(Cubic feet - ft3)
Vempty Empty cargo compartment volume. Cubic metre - m3
(Cubic feet - ft3)
T Time. Minutes Min
E Cargo compartment leakage rate. Cubic metre per minute - m3/min
(Cubic feet per minute - ft3/min)
S Specific volume of Halon 1301. Cubic metre per kilogram m3/kg
(cubic feet per pounds(mass) ft3/lbm)
R Halon 1301 flow rate. Kilogram per minute kg/min
(pounds(mass) per minute lbm/min)

3. HALON 1301 CONCENTRATION LEVEL MODEL.

Cargo compartment fire extinguishing systems generally use a combination of one or two types of
Halon 1301 discharge methods. One type rapidly releases all of the fire extinguishing agent from
one or more pressurised bottles into the cargo compartment. This type of discharge method is

Annex to ED Decision 2023/021/R Page 555 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

FIGURE 3-1. EXAMPLE - HALON 1301 MODEL

The second type of Halon 1301 discharge method slowly releases the fire extinguishing agent from
one or more pressurised bottles into the cargo compartment. This type of discharge method is
commonly known as a metering system.
The following list provides some examples, not all-inclusive, of different combinations of these
Halon 1301 discharge methods.
a. One high rate discharge.
b. One high rate discharge followed by a second high rate discharge at a specified later time.
c. One high rate discharge followed by a metered discharge at a specified later time.
d. Simultaneous high rate and metered discharges.
The Halon 1301 fire extinguishing system described in paragraph 3.c. above utilises both types of
discharge methods and is illustrated in Figure 3-1.
Prior to Phase I - Initial High Rate Discharge of Halon 1301
This portion of the extinguishing process illustrates the high rate discharge method of releasing all
of the fire extinguishing agent from one or more pressurised bottles into the cargo compartment.
Phase I -

Annex to ED Decision 2023/021/R Page 556 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

The beginning of Phase I represents the initial concentration of Halon 1301 used to knock down a
cargo fire. Since no more Halon 1301 is introduced into the cargo compartment during Phase I, the

The governing equation for expone

C(t) = C(0) e -E t /V
NOTE - C(0) is the initial concentration of Halon 1301 used to knock down a cargo fire at the
beginning of Phase I and t is the time elapsed since the beginning of Phase I.
Phase II - Metered Discharge of Halon 1301
The metered discharge of Halon 1301 starts at the beginning of Phase II. The example in Figure 3-
1 shows that the metering rate is set to release Halon 1301 into the cargo compartment at a rate
which is slightly greater than the rate Halon 1301 is lost through cargo compartment leakage.
The governing equation for metering during Phase II is the following:
C(t) = [ C(0) - { R S / E } ] e -E t / V + { R S / E }
NOTE - C(0) is the concentration of Halon 1301 at the end of Phase I and t is the time elapsed since
the end of Phase I.
Phase III -
The beginning of Phase III marks the end of Halon 1301 metering. As in Phase I, since no more
Halon 1301 is introduced into the cargo compartment, the concentration of Halon 1301 undergoes

I with
one exception; C(0) is the concentration of Halon 1301 at the end of Phase II and t is the time since

[Amdt 25/4]

AMC 25.851(c) Alternative fire-extinguishing agents

1. General
The Montreal Protocol, in existence since 1987, is an international agreement to phase out
production and use of ozone-depleting substances, including halogenated hydrocarbons also
known as Halon. The Montreal Protocol prohibits the manufacture or import of new Halon in all
developed countries as of 1 January, 1994. The US Environmental Protection Agency (EPA) has
released a regulation banning the intentional release of Halons during repair, testing, and disposal
of equipment containing Halons and during technician training. However, the EPA has provided the
aviation industry an exemption from their ban on the intentional release of Halon in determining
compliance with airworthiness standards. A European regulation6 governing substances that
deplete the ozone layer was also published, containing initial provisions for Halon phase-out, but
also exemptions for critical uses of Halon, including fire-extinguishing in aviation. It should be noted

6 Regulation (EC) No 2037/2000 of the European Parliament and of the Council of 29 June 2000 on substances that deplete the ozone layer.

Annex to ED Decision 2023/021/R Page 557 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

that the exemptions were predicated on the basis that there were, at that time, no suitable
alternate agents or systems available for use on commercial transport category aeroplanes.
-
dates (i.e. Halon no longer acceptable for use in aircraft) have been subsequently established by a
new regulation in 20107, as presented in Table 4.1 below:
-

Type of Dates
Aircraft compartment Type of Halon
extinguisher Cut-off End
Inerting of fuel tanks Fixed 1301 31 December 31 December
2402 2011 2040
Lavatory waste Built-in 1301 31 December 31 December
receptacles 1211 2011 2020
2402
Dry bays Fixed 1301 31 December 31 December
1211 2011 2040
2402
Cabins and crew Hand 1211 31 December 31 December
compartments (portable) 2402 2014 2025
Propulsion systems Built-in 1301 31 December 31 December
and Auxiliary Power 1211 2014 2040
Units 2402
Normally unoccupied Built-in 1301 31 December 31 December
cargo compartments 1211 2018 2040
2402

2 Lavatory extinguishing systems and agents

Historically, Halon 1301 has been the most widespread agent used in lavatory extinguishing (lavex)
systems, to be used in the event of a Class A fire. Any alternative acceptable fire-extinguishing agent
meeting the Minimum Performance Standards (MPS) laid down in Appendix D to Report
DOT/FAA/AR-96/122 of February 1997, which includes the ability to extinguish a Class A fire and, in

there are suitable alternatives to Halon for built-in fire extinguishers in aircraft lavatories meeting
the MPS for effectiveness, volume, weight and toxicology. Currently HFC-227ea or HFC-236fa are
widely used on large aeroplanes and usually considered acceptable by EASA.
3 Hand fire extinguishers and agents
Historically, Halon 1211 has been the most widespread agent in handheld (portable) fire
extinguishers to be used in aircraft compartments and cabins. Minimum Performance Standards
(MPS) for the agents are laid down in Appendix A to Report DOT/FAA/AR-01/37 of August 2002,
while acceptable criteria to select the fire extinguishers containing said agents are laid down in the
FAA Advisory Circular AC 20-42C. Version D of the same AC (published in 2011) would be preferred

7 Commission Regulation (EU) No 744/2010 of 18 August 2010 amending Regulation (EC) No 1005/2009 of the European Parliament and of
the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).

Annex to ED Decision 2023/021/R Page 558 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

when the needed supporting guidance material has been released. Three agent alternatives to
Halon are presently known meeting the MPS: HFC-227ea, HFC-236fa and HFC Blend B. However,
these agents are significantly heavier and occupy a greater volume than Halon 1211. This may
indirectly (i.e. additional weight of the fire extinguisher and additional weight of the structures
supporting it) increase CO2 emissions. Furthermore, some of these agents have also been identified
as having a global warming potential much higher than Halon. Therefore, further research is
underway to develop additional alternatives to Halon 1211 for hand fire extinguishers.
Should an applicant wish to propose, even before the end of 2014, any alternative agent for hand
fire extinguishers meeting the mentioned MPS, the EASA will initiate a Certification Review Item
addressing the use of such an alternate fire-extinguishing agent.
4 Fire protection of propulsion systems and APU
Historically, Halon 1301 has been the most widespread agent used in engine nacelles and APU
installations to protect against Class B fires. The MPS for agents to be used in these compartments
are particularly demanding because of the presence of fuel and other volatile fluids in close
proximity to high temperature surfaces, not to mention the complex air flows and the extremely
low temperatures and pressures surrounding the nacelles. Various alternatives are being developed
(e.g. FK-5-1-
replacement in fire-extinguishing agents/systems of civil aircraft engine and APU compartments

Should an applicant wish to propose, even before the end of 2014, any alternative agent for Class
B fire extinction in engine or APU compartments, even in the absence of a published MPS, the EASA
will initiate a Certification Review Item addressing the use of such an alternate fire-extinguishing
agent.
5 Fire protection of cargo compartments Gaseous agents
MPS for cargo compartment fire suppression systems have already been published in the Report
DOT/FAA/AR-00/28 of September 2000. However, to date there are no known and sufficiently
developed alternatives to Halon 1301.
Should the EASA be approached with the intent to utilise for the product an alternate agent or
alternate gaseous fire-extinguishing system in lieu of a Halon 1301 system, then the recommended
approach would be to perform testing on the product which meets the Minimum Performance
Standards for that application as developed by the International Halon Replacement Working
Group. The International Halon Replacement Working Group was established in October 1993. This
group was tasked to work towards the development of minimum performance standards and test
methodologies for non-Halon aircraft fire suppression agents/systems in cargo compartments,
engine nacelles, handheld extinguishers, and lavatory waste receptacles. The International Halon
Replacement Working Group has been expanded to include all system fire protection R&D for

To ensure acceptable means of compliance, the following must be provided:

a. The test data and gaseous agent distribution profiles which meet the certification criteria as
expressed below and in the Minimum Performance Standards as developed by the FAA
Technical Center as part of the International Halon Replacement programme. (See paragraph
7 for the listing of the references.)

Annex to ED Decision 2023/021/R Page 559 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

b. A system description document that includes a description of the distribution of the gaseous
agent under test conditions in the cargo compartment.
c. A detailed test plan.
d. Chemical data which describes the agent and any toxicity data.
5.1 Pre-test considerations:
a. An EASA accepted analyser (for example, Statham-derivative analyser) capable of
measuring the agent distribution profile in the form of volumetric concentration is
required.
b. An EASA accepted analyser (for example, Statham-derivative analyser) and associated
hardware are configured for the particular application.
c. The fire suppression system should be completely conformed prior to the test.
d. The fire extinguisher bottle(s) should be serviced and prepared for the prescribed
test(s).
5.2 Test procedures:
a. Perform the prescribed distribution test in accordance with the test plan approved by
the Agency. (See Paragraph 7 in AMC 25.851(b) for guidance on probe placement.)
b. An EASA accepted analyser (for example, Statham-derivative analyser) should record
the distribution profile as volumetric concentration for the agent.
5.3 Test result evaluation:
a. Produce the data from the EASA accepted analyser (for example, Statham-derivative
analyser) in graphical format. This format should be the volumetric concentration of
the agent versus time. A specific percentage of volumetric initial concentration and a
specific percentage of volumetric metered concentration for the length of the test
duration as determined by previous testing conducted per the established Minimum
Performance Standards are required for airworthiness approval of cargo compartment
systems.
b. Using the appropriate MPS evaluation criteria, evaluate the distribution profile of the
agent for acceptable performance. The acceptability of the test data would be
dependent upon the distribution profile and duration exhibited by each probe per (1)
above and Paragraph 7 for cargo compartment fire-extinguishing systems.
6. EVALUATION OF ALTERNATE LIQUID AGENT AND FIRE EXTINGUISHING/SUPPRESSION SYSTEMS
The FAA Technical Center has released a Technical Note (ref. f in paragraph 7 below) that represents
the latest Minimum Performance Standards (MPS) for a water spray system. However, as
mentioned within the body of the report, additional developmental testing would be needed for
the product and the FAA to be approached regarding certification of such a system. Additional
testing would be required to demonstrate compliance with an aerosol spray. The Technical Center
continues to perform research towards identifying alternate liquid and other fire-
extinguishing/suppression systems. Acceptable means of compliance for these immature systems
are beyond the scope of this AMC. Future revisions of this AMC will be accomplished as soon as
suitable standards are developed for these systems.

Annex to ED Decision 2023/021/R Page 560 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

If it is proposed to use a liquid fire-extinguishing agent or system for the product, the EASA should
be contacted. The EASA will initiate a Certification Review Item addressing the use of an alternate
fire-extinguishing agent or system.
7. REFERENCES
a. Report No FAA-RD-71-68, Fire Extinguishing Methods for New Passenger Cargo Aircraft,
dated November 1971.
b. UK Civil Aviation Authority (CAA) Paper 91003, Cargo Bay Fire Suppression, dated March
1991.
c. Report No DOT/FAA/AR-
Protection, dated June 1996.
d. Report No DOT/FAA/AR-96/122, Development of a Minimum Performance Standard for
Lavatory Trash Receptacle Automatic Fire Extinguishers, dated February 1997.
e. Report No DOT/FAA/AR-00-28, Development of a Minimum Performance Standard for
Aircraft Cargo Compartment Gaseous Fire Suppression Systems, dated September 2000.
f. Report No DOT/FAA/AR-TN01/1, Water Spray as a Fire Suppression Agent for Aircraft Cargo
Compartment Fires, dated March 2001.
g. Report No DOT/FAA/AR-01/37, Development of a Minimum Performance Standard for Hand-
Held Fire Extinguishers as a Replacement for Halon 1211 on Civilian Transport Category
Aircraft, dated August 2002.
h. 2010 Report of the UN Halons Technical Options Committee 2010 Assessment
i. FAA Advisory Circular AC 20-42C, Hand Fire Extinguishers for use in Aircraft, dated 07 March
1984.
j. FAA Advisory Circular AC 20-42D, Hand Fire Extinguishers for use in Aircraft, dated 14 January
2011.
[Amdt 25/12]

CS 25.853 Compartment interiors

(See AMC 25.853)
For each compartment occupied by the crew or passengers, the following apply:
(a) Materials (including finishes or decorative surfaces applied to the materials) must meet the
applicable test criteria prescribed in Part I of Appendix F or other approved equivalent methods,
regardless of the passenger capacity of the aeroplane.
(b) Reserved
(c) In addition to meeting the requirements of sub-paragraph (a) of this paragraph, seat cushions,
except those on flight crewmember seats, must meet the test requirements of part II of appendix
F, or other equivalent methods, regardless of the passenger capacity of the aeroplane.

Annex to ED Decision 2023/021/R Page 561 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(d) Except as provided in sub-paragraph (e) of this paragraph, the following interior components of
aeroplanes with passenger capacities of 20 or more must also meet the test requirements of parts
IV and V of appendix F, or other approved equivalent method, in addition to the flammability
requirements prescribed in sub-paragraph (a) of this paragraph:
(1) Interior ceiling and wall panels, other than lighting lenses and windows;
(2) Partitions, other than transparent panels needed to enhance cabin safety;
(3) Galley structure, including exposed surfaces of stowed carts and standard containers and the
cavity walls that are exposed when a full complement of such carts or containers is not
carried; and
(4) Large cabinets and cabin stowage compartments, other than underseat stowage
compartments for stowing small items such as magazines and maps.
(e) The interiors of compartments, such as pilot compartments, galleys, lavatories, crew rest quarters,
cabinets and stowage compartments, need not meet the standards of sub-paragraph (d) of this
paragraph, provided the interiors of such compartments are isolated from the main passenger cabin
by doors or equivalent means that would normally be closed during an emergency landing
condition.
(f) Smoking is not allowed in lavatories. If smoking is allowed in any area occupied by the crew or
passengers, an adequate number of self-contained, removable ashtrays must be provided in
designated smoking sections for all seated occupants.
(g) Regardless of whether smoking is allowed in any other part of the aeroplane, lavatories must have
self-contained removable ashtrays located conspicuously on or near the entry side of each lavatory
door, except that one ashtray may serve more than one lavatory door if the ashtray can be seen
readily from the cabin side of each lavatory served.
(h) Each receptacle used for the disposal of flammable waste material must be fully enclosed,
constructed of at least fire resistant materials, and must contain fires likely to occur in it under
normal use. The ability of the receptacle to contain those fires under all probable conditions of
wear, misalignment, and ventilation expected in service must be demonstrated by test.
[Amdt No: 25/12]
[Amdt No: 25/23]

AMC 25.853 Compartment interiors

The relevant parts of FAA Advisory Circular (AC) 25-17A Change 1, Transport Airplane Cabin Interiors
Crashworthiness Handbook, dated 24.5.2016, AC 25.853-1 Flammability Requirements for Aircraft Seat
Cushions, dated 17.9.1986, and AC 25-18, Transport Category Airplanes Modified for Cargo Service, dated
6.1.1994, and AC 20-178, Flammability Testing of Aircraft Cabin Interior Panels After Alterations, dated
4.6.2012, are accepted by the Agency as providing the acceptable means of compliance with CS 25.853.
25-17A Change 1 that address the applicable FAR/CS-25

[Amdt 25/11]
[Amdt 25/17]
[Amdt 25/26]

Annex to ED Decision 2023/021/R Page 562 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

CS 25.854 Lavatory fire protection

(See AMC 25.854)
For aeroplanes with a passenger capacity of 20 or more, or with a cabin length of 18.29 m (60 ft) or more:
(a) Each lavatory must be equipped with a smoke detector system or equivalent that provides a
warning light in the cockpit, or provides a warning light or audible warning in the passenger cabin
that would be readily detected by a cabin crew member; and
(b) Each lavatory must be equipped with a built-in fire extinguisher for each disposal receptacle for
towels, paper, or waste, located within the lavatory. The extinguisher must be designed to
discharge automatically into each disposal receptacle upon occurrence of a fire in that receptacle.
[Amdt 25/19]

AMC 25.854 Lavatory Fire Protection

The cabin length should be measured parallel to the aeroplane centre line from the most forward to the
most aft point accessible to passengers or crew.
However, points within in-flight accessible cargo compartments, approved as meeting one of the
classifications of CS 25.857, do not need to be considered.

to the most forward possible positions) should be used as the most forward point.
[Amdt 25/19]

CS 25.855 Cargo or baggage compartments

(See AMC 25.855 and 25.857)
For each cargo or baggage compartment, the following apply:
(a) The compartment must meet one of the class requirements of CS 25.857.
(b) The following cargo or baggage compartments, as defined in CS 25.857, must have a liner that is
separate from, but may be attached to, the aeroplane structure:
(1) Class B through Class E cargo or baggage compartments; and
(2) Class F cargo or baggage compartments, unless other means of containing the fire and
protecting critical systems and structure are provided.
(c) (1) Ceiling and sidewall liner panels of Class C cargo or baggage compartments, and ceiling and
sidewall liner panels in Class F cargo or baggage compartments, if installed to meet the
requirements of sub-paragraph (b)(2) of this paragraph, must meet the test requirements of
Part III of Appendix F or other approved equivalent methods.
(2) Cockpit voice and flight data recorder systems, windows and systems or equipment within,
or in the vicinity of, Class E cargo compartments shown to be essential for continued safe
flight and landing according to CS 25.1309 must be adequately protected against fire. If
protective covers are used, they must meet the requirements of Appendix F, Part III

Annex to ED Decision 2023/021/R Page 563 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(d) All other materials used in the construction of the cargo or baggage compartment must meet the
applicable test criteria prescribed in Part I of Appendix F, or other approved equivalent methods.
(e) No compartment may contain any controls, lines, equipment, or accessories whose damage or
failure would affect safe operation, unless those items are protected so that
(1) They cannot be damaged by the movement of cargo in the compartment; and
(2) Their breakage or failure will not create a fire hazard.
(f) There must be means to prevent cargo or baggage from interfering with the functioning of the fire
protective features of the compartment.
(g) Sources of heat within the compartment must be shielded and insulated to prevent igniting the
cargo or baggage.
(h) Flight tests must be conducted to show compliance with the provisions of CS 25.857 concerning
(1) Compartment accessibility;
(2) The entry of hazardous quantities of smoke or extinguishing agent into compartments
occupied by the crew or passengers; and
(3) The dissipation of the extinguishing agent in Class C compartment or, if applicable, in Class F
compartment.
(i) During the above tests, it must be shown that no inadvertent operation of smoke or fire detectors
in any compartment would occur as a result of fire contained in any other compartment, either
during or after extinguishment, unless the extinguishing system floods each such compartment
simultaneously.
(j) Cargo or baggage compartment electrical wiring interconnection system components must meet
the requirements of CS 25.1721.
[Amdt 25/3]
[Amdt 25/5]
[Amdt 25/8]
[Amdt 25/12]
[Amdt 25/13]

CS 25.856 Thermal/acoustic insulation materials

(See AMC 25.856(a))
(a) Thermal/acoustic insulation material installed in the fuselage must meet the flame propagation test
requirements of Part VI of Appendix F to CS-25, or other approved equivalent test requirements.
Part I of Appendix F to CS-25. (See
AMC 25.856(a))
(b) For aeroplanes with a passenger capacity of 20 or greater, thermal/acoustic insulation materials
(including the means of fastening the materials to the fuselage) installed in the lower half of the
aeroplane fuselage must meet the flame penetration resistance test requirements of Part VII of
Appendix F to CS-25, or other approved equivalent test requirements. This requirement does not

Annex to ED Decision 2023/021/R Page 564 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

apply to thermal/acoustic insulation installations that the Agency finds would not contribute to fire
penetration resistance. (See AMC 25.856(b))
[Amdt 25/6]
[Amdt 25/18]

AMC 25.856(a) Thermal/acoustic insulation materials: Flame

propagation resistance
FAA Advisory Circular 25.856-1 Thermal/Acoustic Insulation Flame Propagation Test Method Details,
dated 24/06/2005, is accepted by the Agency as providing acceptable means of compliance with
CS 25.856(a) and Part VI of Appendix F to CS-25.
[Amdt 25/6]

AMC 25.856(b) Thermal/acoustic insulation materials: Flame

penetration (Burnthrough) resistance
FAA Advisory Circular 25.856-2A Installation of Thermal/Acoustic Insulation for Burnthrough Protection,
dated 29/07/2008, is accepted by the Agency as providing acceptable means of compliance with CS
25.856(b) and Part VII of Appendix F to CS-25.
[Amdt 25/6]

CS 25.857 Cargo compartment classification

(See AMC 25.855 and 25.857)
(a) Class A. A Class A cargo or baggage compartment is one in which
(1) The presence of a fire would be easily discovered by a crew member while at his station; and
(2) Each part of the compartment is easily accessible in flight.
(b) Class B. A Class B cargo or baggage compartment is one in which
(1) There is sufficient access in flight to enable a crewmember standing at any one access point
and without stepping into the compartment, to extinguish a fire occurring in any part of the
compartment using a hand fire extinguisher;
(2) When the access provisions are being used no hazardous quantity of smoke, flames or
extinguishing agent will enter any compartment occupied by the crew or passengers; and
(3) There is a separate approved smoke detector or fire detector system to give warning to the
pilot or flight engineer station.
(c) Class C. A Class C cargo or baggage compartment is one not meeting the requirements for either a
Class A or B compartment but in which
(1) There is a separate approved smoke detector or fire detector system to give warning at the
pilot or flight engineer station;

Annex to ED Decision 2023/021/R Page 565 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(2) There is an approved built-in fire-extinguishing or suppression system controllable from the
cockpit.
(3) There are means to exclude hazardous quantities of smoke, flames, or extinguishing agent,
from any compartment occupied by the crew or passengers; and
(4) There are means to control ventilation and draughts within the compartment so that the
extinguishing agent used can control any fire that may start within the compartment.
(d) Reserved.
(e) Class E. A Class E cargo compartment is one on aeroplanes used only for the carriage of cargo and
in which
(1) Reserved.
(2) There is a separate approved smoke or fire detector system to give warning at the pilot or
flight engineer station;
(3) There are means to shut off the ventilating airflow to, or within, the compartment, and the
controls for these means are accessible to the flight crew in the crew compartment;
(4) There are means to exclude hazardous quantities of smoke, flames, or noxious gases, from
the flight-crew compartment; and
(5) The required crew emergency exits are accessible under any cargo loading condition.
(f) Class F. A Class F cargo or baggage compartment is one in which -
(1) There is a separate approved smoke detector or fire detector system to give warning at the
pilot or flight engineer station;
(2) There are means to extinguish or control a fire without requiring a crewmember to enter the
compartment; and
(3) There are means to exclude hazardous quantities of smoke, flames, or extinguishing agent
from any compartment occupied by the crew or passengers.
[Amdt 25/3]
[Amdt 25/8]

AMC 25.855 and 25.857 Cargo or baggage compartments

1. PURPOSE
This Acceptable Means of Compliance (AMC) sets forth an acceptable means, but not the only
means, of demonstrating compliance with the provisions of the airworthiness standards for Class B
and Class F cargo compartments for large aeroplanes. This AMC provides a rational method for
demonstrating that the requirements of the related paragraphs of CS-25 are met and that fires
occurring in the compartments can be controlled to ensure that they do not present a hazard to
the aeroplane or its occupants. Like all AMC material, this AMC is not, in itself, mandatory and does

the sense of ensuring applicability of this particular method of compliance when the acceptable
method of compliance described herein is used.

Annex to ED Decision 2023/021/R Page 566 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

2. RELATED DOCUMENTS
a. Certification Specifications.
CS 25.851 Fire extinguishers
CS 25.855 Cargo or baggage compartments
CS 25.857 Cargo compartment classification
CS 25.858 Cargo compartment fire detection systems
b. FAA Advisory Circulars (AC).
The following FAA Advisory Circulars are accepted by the Agency as providing acceptable
means of compliance with CS 25.857:
AC 25-17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook (the
relevant parts addressing the applicable FAR Part 25/CS-25 paragraphs)
AC 25-9A Smoke Detection, Penetration, and Evacuation Tests and Related Flight Manual
Emergency Procedures,
AC 25-18 Transport Category Airplanes Modified for Cargo Service
AC 20-42D, Hand Fire Extinguishers for use in Aircraft
AC 25-22, Certification of Transport Airplane Mechanical Systems
FAA Order 8150.4, Certification of Cargo Containers with Self-Contained Temperature
Control Systems (Active ULDs)
3. BACKGROUND
CS 25.857(b) and 25.857(f) provide standards for certification of two classes of cargo
compartments, Class B and Class F.
A Class B cargo compartment is configured in a manner that allows a crewmember to extinguish or
control any fire likely to occur in the compartment using a hand fire extinguisher. While the person
combating the fire must have access to the compartment, it must not be necessary for that person
to physically enter the compartment to extinguish the fire (see CS 25.857(b)(1)). The contents of
the compartment may be reached by hand or with the contents of a hand extinguisher while
standing in the entry door.
A Class F cargo compartment is similar to a Class C compartment in that there are means to
extinguish or control the fire without any requirement to enter the compartment.
Both Class B and Class F cargo compartments have fire or smoke detection systems to alert the crew
to the presence of the fire.
4. COMPARTMENT CLASSIFICATION
All cargo compartments must be properly classified in accordance with CS 25.857 and meet the
requirements of CS 25.857 pertaining to the particular class involved (see CS 25.855 (a)).
In order to establish appropriate requirements for fire protection, a system for classification of
cargo or baggage compartments was developed and adopted for large aeroplanes.

Annex to ED Decision 2023/021/R Page 567 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

Classes A, B, and C were initially established; Classes D, E, and F were added later. Class D has been
eliminated from the CS-25 specifications (by Amdt 3). The classification is based on the means by
which a fire can be detected and the means available to control the fire.
a. A Class A compartment (see CS 25.857(a)) is one that is located so close to the station of a
crewmember that the crewmember would discover the presence of a fire immediately. In
addition, each part of the compartment is easily accessible so that the crewmember could
quickly extinguish a fire with a portable fire extinguisher. A Class A compartment is not
required to have a liner.
b. A Class B compartment (see CS 25.857(b)) is one that is more remote than a Class A
compartment and must, therefore, incorporate a fire or smoke detection system to give
warning at the pilot or flight engineer station. Because a fire would not be detected and
extinguished as quickly as in a Class A compartment, a Class B compartment must have a liner
in accordance with CS 25.855(b). In flight, a crewmember must have sufficient access to a
Class B compartment to reach any part of the compartment by hand or with the contents of
a hand extinguisher when standing at any one access point, without stepping into the
compartment. There are means to ensure that, while the access provisions are being used,
no hazardous quantity of smoke, flames, or extinguishing agent will enter areas occupied by
the crew or passengers.
c. A Class C compartment (see CS 25.857(c)) differs from a Class B compartment in that it is not
required to be accessible in flight and must, therefore, have a built-in fire extinguishing
system to suppress or control any fire. A Class C compartment must have a liner and a fire or
smoke detection system in accordance with CS 25.855(b) and CS 25.857(c)(1). There must
also be means to exclude hazardous quantities of extinguishant and products of combustion
from occupied areas (see CS 25.857(c)(3)).
d. A Class E compartment (see CS 25.857(e)) is found on an all-cargo aeroplane. Typically, a Class
E compartment is the entire cabin of an all-cargo aeroplane; however, other compartments
of such aeroplanes may be also classified as Class E compartments. Shutting off the
ventilating airflow to or within the compartment controls a fire in a Class E compartment. A
Class E compartment must have a liner (see CS 25.855(b)) and a fire or smoke detection
system installed in accordance with CS 25.857(e)(2). It is not required to have a built-in fire
suppression system.
e. A Class F compartment (see CS 25.857(f)) is one in which there are means to control or
extinguish a fire without requiring a crewmember to enter the compartment. Allowing access
by a crewmember in the presence of a fire warning is not envisioned. Class F compartments
that include a built-in fire extinguisher/suppression system or require the use of acceptable
fire containment covers (FCCs) would meet these requirements. The Class F compartment
must have a fire or smoke detection system installed in accordance with CS 25.857(f)(1).
Unless there are other means of containing the fire and protecting critical systems and
structure, a Class F compartment must have a liner meeting the requirements of part III of
Appendix F, or other approved equivalent methods (see CS 25.855(b)).
It is not envisaged that lower deck cargo compartments be approved as Class F cargo
compartments. The Class F cargo compartment was introduced as a practicable and safe
alternative to the previous practice of providing large Class B cargo compartments. These
latter compartments were limited to the main deck for accessibility reasons. Lower deck

Annex to ED Decision 2023/021/R Page 568 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

cargo compartments in aircraft carrying passengers need to comply with the Class C cargo
compartment requirements of CS25.857(c).
5. FIRE PROTECTION FEATURES
Based on the class of the compartment, fire protection features must be provided. The fire
protection features must be shown to meet the standards established by the original type
certification basis for the aeroplane or later CS-25 standards. These features may include liners, fire
or smoke detection systems, hand fire extinguishers, and built-in fire suppression systems.
a. Liners
The primary purpose of a liner is to prevent a fire originating in a cargo compartment from
spreading to other parts of the aeroplane before it can be brought under control. For Class
B compartments, it is assumed that the fire will be quickly extinguished. Therefore, the liner
does not need to be qualified to the requirements of Part III of Appendix F. For Class F cargo
compartments, the fire might have grown larger prior to being suppressed, and therefore,
better protection is needed to prevent damage to surrounding systems and structure.
However, the liner does not need to serve as the compartment seal. It should be noted,
however, that the liner is frequently used to perform the secondary functions of containing
discharged extinguishing agent and controlling the flow of oxygen into the compartment. If
other means, such as compartment walls, are not capable of performing those functions, the
liner must be sufficiently airtight to perform them.
The liner must have sufficient fire integrity to prevent flames from burning through the liner
before the fire can be brought under control and the heat from the fire is sufficiently
dissipated. As stated in Part III of Appendix F, in addition to the basic liner material, the term
"liner" includes any design feature, such as a joint or fastener that would affect the capability
of the liner to safely contain a fire.
b. Access
(1) Class B. Class B compartments must provide sufficient accessibility to enable a
crewmember to reach any part of the compartment by hand or with the contents of a
hand extinguisher without physically entering the compartment. This requirement, by
its nature, tends to limit the size and shape of the compartment. Additionally, the
access provisions should be sufficiently large to enable the crewmember to determine
visually that a fire has been extinguished. Access is also a function of how the
compartment is configured rather than just dimension and/or volume. In determining
access, it would not be acceptable for there to be a need to pull baggage or cargo on
to the floor of the passenger compartment to gain access to the seat of the fire. Such
action may introduce a safety hazard to the passengers.
"To reach any part of the compartment" means that the crewmember should be able
to open the door or hatch and, standing in the opening, reach by hand anywhere in
the compartment where cargo or baggage can be located. The extension of the
crewmember's reach through the use of fire extinguisher wands, etc., should not be
considered in determining reach.
Based on the estimated reach of a 95 percentile male, the outline of any compartment,
viewed from above, should fit within a vertical cylinder of radius 132 cm (52 inches)

Annex to ED Decision 2023/021/R Page 569 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

measured from the centreline of the access door or hatch (see Figure 1). This
dimension assumes the above male can reach a one foot square box located anywhere
within the compartment. Access by a smaller crewmember to reach the same area
within the compartment could require that the crewmember move laterally within the
access door or hatch opening, while not physically entering the compartment.

Figure 1
Example of possible cargo compartment shapes within 132 cm (52 inches) reach from access point centreline.

(2) Class F. In the case of a Class F compartment, a means should be provided to control
or extinguish a fire without a crewmember entering the compartment.
One means is to design the compartment to Class C requirements but not include a
built-in fire suppression system. One suppression method might be to utilize a
plumbing and nozzle distribution system within the compartment that would provide
acceptable suppression capability throughout the volume of the compartment. The
source for such a system could be hand fire extinguishers, which interface with the
distribution system through a suitable interface nozzle. This reduces the complexity
and costs associated with a built-in suppression system and could be suitable for
smaller compartments. For certification purposes, the extinguishing agent
concentration should be measured in flight, following aeroplane flight manual (AFM)
procedures, and the length of protection time afforded by the system should be
recorded. This time of protection should be used to establish AFM limitations for cargo
or baggage compartment fire protection times. The operator, for route planning, could
then use these times. For Halon 1301 fire extinguishing agent, a minimum five percent
concentration by volume at all points in the compartment is considered adequate for
initial knock-down of a fire, and a three percent concentration by volume at all points
in the compartment is considered the minimum for controlling a fire after it is knocked
down. This option requires the use of a liner as stated in CS 25.855(b).
Another means of providing fire protection in a Class F compartment might be the use
of cargo containers or fire containment covers (FCCs) shown to be capable of
containing a fire. Some FCCs have already been developed and are typically
constructed of woven fibreglass-based materials that will pass the oil burner test
requirements of Part III of Appendix F.

Annex to ED Decision 2023/021/R Page 570 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

This is in line with the revised CS 25.855 which for a Class F cargo or baggage
compartment not using FCCs requires a ceiling and sidewall liner constructed of
materials that meet the requirements of Part III of Appendix F and be separated from
the aeroplane structure (except for attachments), while the floor panels must comply
with Part I of Appendix F.
Similarly, if FCCs are proposed as a means of compliance for the new Class F
compartment, it is likely that in order to meet the intent they must also meet these
standards (i.e. Part III of Appendix F for the sides and top and Part I of Appendix F for
the bottom). However, based on full scale qualification testing there is evidence that
alternative materials, not fully in compliance with Part III of Appendix F, might also be
acceptable for FCC side and top portions, as long as they are successfully tested and
meet the intent of the rule.
It is recommended that the Agency be contacted for concurrence when FCC or
Container qualification is envisaged in order to address the relevant test method.
Unless evidence can be presented to support a different design, if FCCs are used as a
means of compliance, they should completely surround all cargo, including underneath
the cargo, except for obviously non-flammable items, such as metal stock, machinery,
and non flammable fluids without flammable packaging. Because the fire is controlled
or extinguished within the isolated compartment, but is separated from the actual
cargo compartment boundaries, the cargo compartment liner requirements of CS
25.855(c) would not apply. However, the effects of the heat generated by the
contained/covered fire should be evaluated to ensure that adjacent systems and
structure are not adversely affected. For certification purposes, test data with the
actual design configuration and possible fire sources would have to be provided. The
temperature and heat load time history measurements at various locations above,
around and below the FCC are needed to ensure the continued safe function of
adjacent systems and structure. The time history data should be used to establish the
length of protection time afforded by the system and subsequent AFM limitations for
cargo or baggage compartment fire protection times. The operator would then use
these times for route planning purposes.
Class F cargo compartment designs which rely on fire containment, e.g. fire hardened
containers/pallets and/or FCCs (placed over palletised loads or non-fire hardened
containers) should be considered in regards to the possibility of incorrect usage.
All practicable means to prevent the carriage of cargo in standard containers or pallets
(if special pallets are required) and/or the omission of FCCs should be incorporated.
Means may include, but not be limited to, physical features at the container/pallet to
cargo compartment floor interface or operational procedures such as requiring aircraft
crew verification of cargo loading before every flight or a suitable detection system
that would warn the crew in the event a non authorized cargo configuration has been
loaded.
c. Extinguishing Agent.
In order to effectively extinguish or control a fire in a Class B or F cargo or baggage
compartment, sufficient fire extinguishing agent must be allocated. Guidance on this topic

Annex to ED Decision 2023/021/R Page 571 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

is contained in FAA AC 20-42D. This guidance material is accepted by the Agency as

addressing how to implement the provisions of CS 25.851(a) that require that at least one
hand fire extinguisher be located in the pilot compartment, at least one readily accessible
hand fire extinguisher be available for use in each Class A or Class B cargo/baggage
compartment and in each accessible Class E or Class F cargo/baggage compartment, and one
or more hand fire extinguishers be located in the passenger compartment for aeroplanes
with a passenger seating capacity of 7 or more.
d. Fire Control.
"To control a fire" (CS 25.857(f)(2)) implies that the fire does not grow to a state where
damage to the aeroplane or harm to the passengers or crew occurs during the time for which
the fire protection system is demonstrated to be effective (ie, from the time a fire is detected
to the time when an emergency evacuation from the aeroplane can be completed). This in
turn implies that critical aeroplane systems and structure are not adversely affected and the
temperature and air contaminants in areas occupied by passengers and crew do not reach
hazardous levels.
(1) Adequate protection should be provided for cockpit voice and flight data recorder and
wiring, windows, primary flight controls (unless it can be shown that a fire cannot
cause jamming or loss of control), and other systems and equipment within the
compartment that are required for safe flight and landing.
(2) R
quantities of smoke, flames, extinguishing agent, or noxious gases do not enter any
compartment occupied by passengers or crewmembers. FAA Advisory Circular 25-9A,
Smoke Detection, Penetration, and Evacuation Tests and Related Flight Manual
Emergency Procedures, provides guidance concerning smoke penetration testing.
(3) If an aeroplane has one or more Class B cargo compartments, portable protective
breathing equipment must be provided for the appropriate crewmembers in
accordance with CS 25.1439.
(4) Additional protective breathing equipment or breathing gas supply, and additional fire
extinguishers, may be required for Class B cargo compartment operation to ensure
that the fire can be controlled for the time the aeroplane is expected to be in the air
after onset of a fire.
6. PROCEDURES AND LIMITATIONS
a. To ensure that the contents of Class B and F compartments are either accessible or located
such as to allow firefighting, any cargo or baggage loading limitations and any operational
limitations or procedures provided must be identified with placards in the compartment. The
loading and operational limitations must also be addressed in the appropriate weight and
balance or loading document.
b. Any operational limitations or procedures necessary to ensure the effectiveness of the fire
protection system for Class B and Class F cargo and baggage compartments should be clearly
defined in the AFM. This should include such items as any changes to the ventilation system
to prevent the entrance of smoke or gases into occupied areas, use of hand fire extinguishers,
use of protective breathing equipment, use of protective clothing, and use of the FCCs. The

Annex to ED Decision 2023/021/R Page 572 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

certification engineers should work closely with the Agency to ensure that additional training
necessary for crewmembers assigned to combat fires is adequately addressed.
c. Any time limit for a cargo or baggage compartment fire protection system, or other
conditions or procedures related to combating a fire in a compartment, should be clearly
defined in the AFM.
7. AFM CONSIDERATIONS.
a. Crewmember(s) designated to combat a fire in a Class B compartment will need special
training. Fires occurring in luggage are difficult to extinguish completely and rekindling may
occur. Crewmembers designated to combat fires in Class B compartments should be trained
to check periodically to ensure that a fire has not grown back to hazardous proportions.
b. Aeroplane flight manuals should contain instructions to land at the nearest suitable airport
following smoke/fire detection, unless it can be positively determined that the fire is
extinguished.
c. Any limitations regarding occupancy of Class B and Class F compartments during flight, or
during takeoff and landing, should be defined in the AFM.
d. Any loading restrictions associated with access to cargo or baggage or special containers
should be clearly identified in the AFM. This would include, but not be limited to, placement
of luggage in a Class B compartment or identification of special containers or covers
associated with fire protection in a Class F compartment. If covers are used in conjunction
with a Class F cargo compartment, they should be easy to install and sufficiently durable to
withstand in-service conditions.
[Amdt 25/8]
[Amdt 25/11]
[Amdt 25/12]
[Amdt 25/26]

CS 25.858 Cargo or baggage compartment smoke or fire detection

systems
If certification with cargo or baggage compartment smoke or fire detection provisions is requested, the
following must be met for each cargo or baggage compartment with those provisions:
(a) The detection system must provide a visual indication to the flight crew within one minute after the
start of a fire.
(b) The system must be capable of detecting a fire at a temperature significantly below that at which
the structural integrity of the aeroplane is substantially decreased.
(c) There must be means to allow the crew to check in flight, the functioning of each smoke or fire
detector circuit.
(d) The effectiveness of the detection system must be shown for all approved operating configurations
and conditions.
[Amdt 25/3]

Annex to ED Decision 2023/021/R Page 573 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

CS 25.859 Combustion heater fire protection

(a) Combustion heater fire zones. The following combustion heater fire zones must be protected from
fire in accordance with the applicable provisions of CS 25.1181 to 25.1191 and 25.1195 to 25.1203:
(1) The region surrounding the heater, if this region contains any flammable fluid system
components (excluding the heater fuel system) that could
(i) Be damaged by heater malfunctioning; or
(ii) Allow flammable fluids or vapours to reach the heater in case of leakage.
(2) The region surrounding the heater, if the heater fuel system has fittings that, if they leaked,
would allow fuel or vapours to enter this region.
(3) The part of the ventilating air passage that surrounds the combustion chamber. However, no
fire extinguishment is required in cabin ventilating air passages.
(b) Ventilating air ducts. Each ventilating air duct passing through any fire zone must be fireproof. In
addition
(1) Unless isolation is provided by fireproof valves or by equally effective means, the ventilating
air duct downstream of each heater must be fireproof for a distance great enough to ensure
that any fire originating in the heater can be contained in the duct; and
(2) Each part of any ventilating duct passing through any region having a flammable fluid system
must be constructed or isolated from that system so that the malfunctioning of any
component of that system cannot introduce flammable fluids or vapours into the ventilating
airstream.
(c) Combustion air ducts. Each combustion air duct must be fireproof for a distance great enough to
prevent damage from backfiring or reverse flame propagation. In addition
(1) No combustion air duct may have a common opening with the ventilating airstream unless
flames from backfires or reverse burning cannot enter the ventilating airstream under any
operating condition, including reverse flow or malfunctioning of the heater or its associated
components; and
(2) No combustion air duct may restrict the prompt relief of any backfire that, if so restricted,
could cause heater failure.
(d) Heater controls; general. Provision must be made to prevent the hazardous accumulation of water
or ice on or in any heater control component, control system tubing, or safety control.
(e) Heater safety controls. For each combustion heater there must be the following safety control
means:
(1) Means independent of the components provided for the normal continuous control of air
temperature, airflow, and fuel flow must be provided, for each heater, to automatically shut
off the ignition and fuel supply to that heater at a point remote from that heater when any
of the following occurs:
(i) The heat exchanger temperature exceeds safe limits.
(ii) The ventilating air temperature exceeds safe limits.

Annex to ED Decision 2023/021/R Page 574 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(iii) The combustion airflow becomes inadequate for safe operation.

(iv) The ventilating airflow becomes inadequate for safe operation.
(2) The means of complying with sub-paragraph (e)(1) of this paragraph for any individual heater
must
(i) Be independent of components serving any other heater whose heat output is
essential for safe operation; and
(ii) Keep the heater off until restarted by the crew.
(3) There must be means to warn the crew when any heater whose heat output is essential for
safe operation has been shut off by the automatic means prescribed in sub-paragraph (e)(1)
of this paragraph.
(f) Air intakes. Each combustion and ventilating air intake must be located so that no flammable fluids
or vapours can enter the heater system under any operating condition
(1) During normal operation; or
(2) As a result of the malfunctioning of any other component.
(g) Heater exhaust. Heater exhaust systems must meet the provisions of CS 25.1121 and 25.1123. In
addition, there must be provisions in the design of the heater exhaust system to safely expel the
products of combustion to prevent the occurrence of
(1) Fuel leakage from the exhaust to surrounding compartments;
(2) Exhaust gas impingement on surrounding equipment or structure;
(3) Ignition of flammable fluids by the exhaust, if the exhaust is in a compartment containing
flammable fluid lines; and
(4) Restriction by the exhaust of the prompt relief of backfires that, if so restricted, could cause
heater failure.
(h) Heater fuel systems. Each heater fuel system must meet each powerplant fuel system requirement
affecting safe heater operation. Each heater fuel system component within the ventilating
airstream must be protected by shrouds so that no leakage from those components can enter the
ventilating airstream.
(i) Drains. There must be means to safely drain fuel that might accumulate within the combustion
chamber or the heater exchanger. In addition
(1) Each part of any drain that operates at high temperatures must be protected in the same
manner as heater exhausts; and
(2) Each drain must be protected from hazardous ice accumulation under any operating
conditions.

CS 25.863 Flammable fluid fire protection

(See AMC 25.863)

Annex to ED Decision 2023/021/R Page 575 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

(a) In each area where flammable fluids or vapours might escape by leakage of a fluid system, there
must be means to minimise the probability of ignition of the fluids and vapours, and the resultant
hazards if ignition does occur. (See AMC 25.863(a).)
(b) Compliance with sub-paragraph (a) of this paragraph must be shown by analysis or tests, and the
following factors must be considered.
(1) Possible sources and paths of fluid leakage, and means of detecting leakage.
(2) Flammability characteristics of fluids, including effects of any combustible or absorbing
materials.
(3) Possible ignition sources, including electrical faults, overheating of equipment, and
malfunctioning of protective devices.
(4) Means available for controlling or extinguishing a fire, such as stopping flow of fluids, shutting
down equipment, fireproof containment, or use of extinguishing agents.
(5) Ability of aeroplane components that are critical to safety of flight to withstand fire and heat.
(c) If action by the flight crew is required to prevent or counteract a fluid fire (e.g. equipment shutdown
or actuation of a fire extinguisher) quick acting means must be provided to alert the crew.
(d) Each area where flammable fluids or vapours might escape by leakage of a fluid system must be
identified and defined.
[Amdt 25/18]

AMC 25.863(a) Flammable fluid fire protection

The cooling air supply for any electrical or electronic equipment should be conveyed and discharged so as
not to create a hazard following failure of the equipment.
NOTE: Where necessary the cooling duct should be fireproof.
Zones with surfaces which may be exposed to flammable fluids or vapours should be ventilated if the
temperature of the surfaces may exceed (under normal or failure conditions) a dangerous value with
regard to these fluids or vapours. Unless a higher value can be substantiated, a temperature exceeding
200°C is considered dangerous.

CS 25.865 Fire protection of flight controls, engine mounts, and other

flight structure
Essential flight controls, engine mounts, and other flight structures located in designated fire zones or in
adjacent areas which would be subjected to the effects of fire in the fire zone must be constructed of
fireproof material or shielded so that they are capable of withstanding the effects of fire.

Annex to ED Decision 2023/021/R Page 576 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

CS 25.867 Fire protection: other components

(a) Surfaces to the rear of the nacelles, within one nacelle diameter of the nacelle centreline, must be
constructed of materials at least equivalent in resistance to fire as aluminium alloy in dimensions
appropriate for the purpose for which they are used.
(b) Sub-paragraph (a) of this paragraph does not apply to tail surfaces to the rear of the nacelles that
could not be readily affected by heat, flames, or sparks coming from a designated fire zone or
engine compartment of any nacelle.

CS 25.869 Fire protection: systems

(See AMC 25.869)
(a) Electrical system components:
(1) Components of the electrical system must meet the applicable fire and smoke protection
requirements of CS 25.831(c) and CS 25.863. (See AMC 25.863(a).)
(2) Equipment in designated fire zones, that is used during emergency procedures, must be at
least fire resistant.
(3) Electrical Wiring Interconnection System components must meet the requirements of
CS 25.1713.
(b) Each vacuum air system line and fitting on the discharge side of the pump that might contain
flammable vapours or fluids must meet the requirements of CS 25.1183 if the line or fitting is in a
designated fire zone. Other vacuum air systems components in designated fire zones must be at
least fire resistant.
(c) (See AMC 25.869(c).) Oxygen equipment and lines must
(1) Not be located in any designated fire zone.
(2) Be protected from heat that may be generated in, or escape from, any designated fire zone,
and
(3) Be installed so that escaping oxygen cannot cause ignition of grease, fluid, or vapour
accumulations that are present in normal operation or as a result of failure or malfunction of
any system.
[Amdt 25/5]
[Amdt 25/18]

AMC 25.869(a)(1) Electrical System Fire and Smoke Protection

These requirements, and those of CS 25.863 applicable to electrical equipment, may be satisfied by the
following:
1 Electrical components in regions immediately behind firewalls and in engine pod attachment
structures should be of such materials and at such a distance from the firewall that they will not
suffer damage that could hazard the aeroplane if the surface of the firewall adjacent to the fire is
heated to 1100°C for 15 minutes.

Annex to ED Decision 2023/021/R Page 577 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
FIRE PROTECTION

2 Electrical equipment should be so constructed and/or installed that in the event of failure, no
hazardous quantities of toxic or noxious (e.g. smoke) products will be distributed in the crew or
passenger compartments.
3 Electrical equipment, which may come into contact with flammable vapours should be so designed
and installed as to minimise the risk of the vapours exploding under both normal and fault
conditions. This can be satisfied by meeting the Explosion Proofness Standards of RTCA DO-
160G/EUROCAE ED-14G.
[Amdt 25/28]

AMC 25.869(c) Fire Protection for Oxygen Equipment

1 High-pressure shut-off valves should be designed to provide effective slow opening and closing, so
as to avoid the possible risk of fire or explosion.
2 Re-charging systems, if installed, should be provided with means to prevent excessive rates of
charging which could result in dangerously high temperatures within the system. The charging
system should also provide protection from contamination.
3 The compartments in which high-pressure system components, including source(s) are located
should have adequate ventilation to ensure the rapid dilution of leaked oxygen. Such compartments
should also provide adequate protection against contamination by liquids and other products which
could result in the risk of fire.
4 Where in-situ charging facilities are provided, the compartments in which they are located should
be accessible from outside the aircraft and as remote as possible from other service points and
equipment. Placards should be provided, located adjacent to the servicing point, with adequate
instructions covering the precautions to be observed when the system is being charged.
5 The installation of the system should be such that components and pipe lines
a. Are adequately separated from electrical and fluid systems,
b. Are routed so as to minimise joints and sharp bends,
c. Are clear of moving controls and other mechanisms,
d. Are protected against grease or other lubricants, and are protected against the effects of
vibration.
In addition, joints should where possible, be assembled dry, but where compounds are used for
sealing they should be approved for that purpose.
6 Where the oxygen is supplied from chemical generators, the effects of heat emission, during both
normal and inadvertent operation, on both the installation and other adjacent equipment, should
be taken into account.

Annex to ED Decision 2023/021/R Page 578 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
MISCELLANEOUS

MISCELLANEOUS

CS 25.871 Levelling means

There must be means for determining when the aeroplane is in a level position on the ground.

CS 25.875 Reinforcement near propellers

(a) Each part of the aeroplane near the propeller tips must be strong and stiff enough to withstand the
effects of the induced vibration and of ice thrown from the propeller.
(b) No window may be near the propeller tips unless it can withstand the most severe ice impact likely
to occur.

CS 25.899 Electrical bonding and protection against static electricity

(See AMC 25.899)
(a) Electrical bonding and protection against static electricity must be designed to minimise
accumulation of electrostatic charge, which would cause:
(1) Human injury from electrical shock,
(2) Ignition of flammable vapours, or
(3) Interference with installed electrical / electronic equipment.
(b) Compliance with sub-paragraph (a) of this paragraph may be shown by
(1) Bonding the components properly to the airframe or
(2) Incorporating other acceptable means to dissipate the static charge so as not to endanger
the aeroplane, personnel or operation of the installed electrical/electronic systems.

AMC 25.899 Electrical bonding and protection against static electricity

1 Protection against Lightning Discharges.
Refer to CS 25.581; 25.954; 25.1316 and associated Acceptable Means of Compliance.
2 Characteristics of Lightning Discharges.
Industry standards.
Refer to EUROCAE document ED-84 (including Amendment N°1 dated 06/09/99) titled: Aircraft
Lightning Environment and Related Test Waveforms; or the equivalent SAE ARP5412 document.
The following documents may be used when showing compliance with CS 25.899:
EUROCAE document ED-84A dated July 2013 (Aircraft Lightning Environment and Related
Test Waveforms) or the equivalent SAE ARP5412B.

Annex to ED Decision 2023/021/R Page 579 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
MISCELLANEOUS

EUROCAE document ED-91A (Aircraft Lightning Zoning) or the equivalent SAE ARP5414B.
EUROCAE document ED-105A (Aircraft Lightning Test Methods) or the equivalent SAE ARP
5416A.
EUROCAE document ED-113 (Aircraft Lightning Direct Effects Certification) or the
equivalent SAE ARP 5577.
3 Protection against the Accumulation of Static Charges
3.1 General. All items, which by the accumulation and discharge of static charges may cause a
danger of electrical shock, ignition of flammable vapours or interference with essential
equipment (e.g. radio communications and navigational aids) should be adequately bonded
to the main earth systems.
3.2 Intermittent Contact. The design should be such as to ensure that no fortuitous intermittent
contact can occur between metallic and/or metallized parts.
3.3 High Pressure Refuelling and Fuel Transfer. Where provision is made for high pressure
refuelling and/or for high rates of fuel transfer it should be established, by test, or by
consultation with the appropriate fuel manufacturers, that dangerously high voltages will not
be induced within the fuel system. If compliance with this requirement involves any
restriction on the types of fuel to be used or on the use of additives, this should be
established.
3.3.1 With standard refuelling equipment and standard aircraft turbine fuels, voltages high
enough to cause sparking may be induced between the surface of the fuel and the
metal parts of the tank at refuelling flow velocities above approximately
7 meters/second (23 feet/second). These induced voltages may be increased by the
presence of additives and contaminants (e.g. anti-corrosion inhibitors, lubricating oil,
free water), and by splashing or spraying of the fuel in the tank.
3.3.2 The static charge can be reduced as follows:
a. By means taken in the refuelling equipment such as increasing the diameter of
refuelling lines and designing filters to give the minimum of electrostatic
charging, or
b. By changing the electrical properties of the fuel by the use of anti-static additives
and thus reducing the accumulation of static charge in the tank to negligible
amount.
3.3.3 The critical refuelling rates are related to the aeroplane refuelling installations, and the
designer should seek the advice of fuel suppliers on this problem.
4 Primary and Secondary Bonding Paths.
(Reference : CS 25.581; 25.899, 25.954; 25.1316; 25.1353; 25.1360.)
4.1 Primary bonding paths are those paths which are required to carry lightning discharge
currents. These paths should be of as low an electrical impedance as is practicable. Secondary
bonding paths are those paths provided for other forms of bonding.
4.2 Where additional conductors are required to provide or supplement the inherent primary
bonding paths provided by the structure or equipment, then the cross-sectional area of such

Annex to ED Decision 2023/021/R Page 580 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
MISCELLANEOUS

primary conductors made from copper should be not less than 3 mm2 except that, where a
single conductor is likely to carry the whole discharge from an isolated section, the cross-
sectional area would be not less than 6 mm2. Aluminium primary conductors should have a
cross-sectional area giving an equivalent surge carrying capacity.
4.3 Primary bonding paths should be used for
a. Connecting together the main earths of separable major components which may carry
lightning discharges,
b. Connecting engines to the main earth,
c. Connecting to the main earth all metal parts presenting a surface on or outside of the
external surface of the aeroplane, and
d. Conductors on external non-metallic parts.
4.4 Where additional conductors are required to provide or supplement the inherent secondary
bonding paths provided by the structure or equipment then the cross-sectional area of such
secondary conductors made from copper should be not less than 1 mm2. Where a single wire
is used its size should be not less than 1·2 mm diameter.
5 Resistance and Continuity Measurements. Measurements should be made to determine the efficacy
of the bonding and connection between at least the following:
5.1 Primary Bonding Paths
5.1.1 The extremities of the fixed portions of the aeroplane and such fixed external panels
and components where the method of construction and/or assembly leads to doubt
as to the repeatability of the bond, e.g. removable panels.
5.1.2 The engines and the main aeroplane earth.
5.1.3 External movable metal surfaces or components and the main aeroplane earth.
5.1.4 The bonding conductors of external non-metallic parts and the main aeroplane earth.
5.1.5 Internal components for which a primary bond is specified and the main aeroplane
earth.
5.2 Secondary Bonding Paths
5.2.1 Metallic parts, normally in contact with flammable fluids, and the main aeroplane
earth.
5.2.2 Isolated conducting parts subject to appreciable electrostatic charging and the main
aeroplane earth.
5.2.3 Electrical panels and other equipment accessible to the occupants of the aeroplane
and the main aeroplane earth.
5.2.4 Earth connections, which normally carry the main electrical supply and the main
aeroplane earth. The test on these connections should be such as to ensure that the
connections can carry, without risk of fire or damage to the bond, or excessive volt
drop, such continuous normal currents and intermittent fault currents as are
applicable.

Annex to ED Decision 2023/021/R Page 581 of 1515

 CS-25 Amendment 28 SUBPART D DESIGN AND CONSTRUCTION
MISCELLANEOUS

5.2.5 Electrical and electronic equipment and the aeroplane main earth, where applicable,
and as specified by the aeroplane constructor.
5.2.6 Static discharger wicks and the main aeroplane structure.
6 Electrical Properties of Composite Structure
6.1 In the case of lightning protection, for the partial conductors the method of surface
protection will vary with the criticality of the structure in question. Deterioration of the
means of protection or possible hidden damage to the material which may affect its
structural integrity, need to be considered. While such materials provide a measure of
electro-magnetic screening, the need for additional measures will be a function of the
location of the material in relation to critical equipment and wiring in the aircraft. Particular
attention will also have to be given to the protection required near fuel systems e.g. fuel
tanks.
For non-conducting materials which have no intrinsic lightning protection or screening
properties, the measures taken will again depend on the relative locations of the material
and critical systems or fuel and the possible loss of the components due to internal air
pressures in the event of a strike.
6.2 The partial conducting materials should present no problem in dissipating P-static but
problems can arise with the non-conductors. Depending upon the location of the material,
protection may be required.
6.3 Electrical currents, other than lightning, can flow in some partial conducting materials and
means may be required to limit this by provision of alternative current paths if the effect of
large voltage drop is important or if such currents can damage the material.
6.4 Particular care has to be taken that all joints, permanent and temporary, are capable of
carrying any currents which may flow particularly those resulting from lightning strikes.
Structural damage and loss of screening capabilities may occur if these are not adequately
controlled.
6.5 The adequacy of the material in supplying a ground plane for antenna may have to be
considered. Again it will vary with the material and the radio frequency of the system.
[Amdt 25/26]

Annex to ED Decision 2023/021/R Page 582 of 1515

 CS-25 Amendment 28 SUBPART E POWERPLANT
GENERAL

SUBPART E POWERPLANT
GENERAL

CS 25.901 Installation
(a) For the purpose of this CS-25 the aeroplane powerplant installation includes each component that

(1) Is necessary for propulsion;

(2) Affects the control of the major propulsive units; or
(3) Affects the safety of the major propulsive units between normal inspections or overhauls.
(b) For each powerplant
(1) The installation must comply with
(i) The installation instructions provided under CS-E 20(d) and (e); and
(ii) The applicable provisions of this Subpart (see also AMC 20-1).
(2) The components of the installation must be constructed, arranged, and installed so as to
ensure their continued safe operation between normal inspections or overhauls. (See AMC
25.901(b)(2).)
(3) The installation must be accessible for necessary inspections and maintenance; and
(4) The major components of the installation must be electrically bonded to the other parts of
the aeroplane. (See AMC 25.901(b)(4).)
(c) The powerplant installation must comply with CS 25.1309, except that the effects of the following
need not comply with CS 25.1309(b):
(1) Engine case burn through or rupture;
(2) Uncontained engine rotor failure; and
(3) Propeller debris release.
(See AMC 25.901(c) Safety Assessment of Powerplant Installations and AMC 25-24: Sustained
Engine Imbalance)
[Amdt 25/1]
[Amdt 25/3]
[Amdt 25/8]
[Amdt 25/18]

AMC 25.901(b)(2) Assembly of Components

The objectives of CS 25.671(b) should be satisfied with respect to powerplant systems, where the safety
of the aeroplane could otherwise be jeopardised.

Annex to ED Decision 2023/021/R Page 583 of 1515