AMC 25.1435 Hydraulic Systems - Design, Test, Analysis and Certification

ED Decision 2016/010/R

1.       PURPOSE

This AMC (Acceptable Means of Compliance), which is similar to the FAA Advisory Circular AC 25.1435-1, provides advice and guidance on the interpretation of the requirements and on the acceptable means, but not the only means, of demonstrating compliance with the requirements of CS 25.1435. It also identifies other paragraphs of the Certification Specifications (CS) that contain related requirements and other related and complementary documents.

The advice and guidance provided does not in any way constitute additional requirements but reflects what is normally expected by the EASA.

2.       RELATED REGULATORY MATERIAL AND COMPLEMENTARY DOCUMENTS

(a)      Related Certification Specifications

CS-25 Paragraphs (and their associated AMC material where applicable) that prescribe requirements related to the design substantiation and certification of hydraulic systems and elements include:

Additional CS-25 paragraphs (and their associated AMC material where applicable) that prescribe requirements which can have a significant impact on the overall design and configuration of hydraulic systems are, but are not limited to:

(b)     Complementary Documents

Documents, which are considered to provide appropriate standards for the design substantiation and certification of hydraulic systems and system elements may include, but are not limited to:

(i)      CS-European Standard Orders (CS-ETSO's)

ETSO-C47 Pressure Instruments - Fuel, Oil and Hydraulic

ETSO-2C75 Hydraulic Hose Assemblies

(ii)     Society of Automotive Engineers (SAE) Documents

ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft Hydraulic Systems

Note: This document provides a wide range of Civil, Military and Industry document references and standards, which may be appropriate.

(iii)     International Organisation for Standardisation (ISO) Documents

ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment

(iv)     US Military Documents

MIL-STD-810 Environmental Test Methods and Engineering Guidelines

(v)      European Aviation Safety Agencies Publication

Certification Specification No. 20

AMC 20.6 Temporary Guidance Material for Extended Range Operation with Two-Engine Aeroplanes

ETOPS Certification and Operation

(vi)     The European Organisation for Civil Aviation Equipment Documents

ED-14G/RTCA DO-160G Environmental Conditions and Test Procedures for Airborne Equipment

3.       ADVICE AND GUIDANCE

(a)      Element Design

(1)     Ref. CS 25.1435(a)(1) The design operating pressure (DOP) is the normal maximum steady pressure. Excluded are reasonable tolerances, and transient pressure effects such as may arise from acceptable pump ripple or reactions to system functioning, or demands that may affect fatigue. Fatigue is addressed in sub-paragraph (a)(4) of this paragraph.

The DOP for low-pressure elements (e.g., return, case-drain, suction, reservoirs, etc.) is the maximum pressure expected to occur during normal user system operating modes. Included are transient pressures that may occur during separate or simultaneous operation of user systems such as slats, flaps, landing gears, thrust reverses, flight controls, power transfer units, etc. Short term transient pressures, commonly referred to as pressure spikes, that may occur during the selection and operation of user systems (e.g., those pressure transients due to the opening and closing of selector/control valves, etc.) may be excluded, provided the fatigue effect of such transients is addressed in accordance with sub-paragraph (a)(4) of this paragraph.

In local areas of systems and elements the DOP may be different from the above due to the range of normally anticipated aeroplane operational, dynamic and environmental conditions. Such differences should be taken into account.

At proof pressure, seal leakage not exceeding the allowed maximum in-service leak rate is permitted. Each element should be able to perform its intended functions when the DOP is restored.

For sub-paragraphs (a)(1), (a)(2) and (a)(3) of this paragraph, the pressure and structural loads, as applicable, should be sustained for sufficient time to enable adequate determination that compliance is demonstrated. Typically a time of 2 minutes for proof conditions and 1 minute for ultimate conditions will be considered acceptable.

The term "pressure vessels" is not intended to include small volume elements such as lines, fittings, gauges, etc. It may be necessary to use special factors for elements fabricated from non-metallic/composite materials.

(2)     Ref. CS 25.1435(a)(2) Limit structural loads are defined in CS 25.301(a). The loading conditions of CS-25, subpart C to be considered include, but are not limited to, flight and ground manoeuvres, and gust and turbulence conditions. The loads arising in these conditions should be combined with the maximum hydraulic pressures, including transients that could occur simultaneously. Where appropriate, thermal effects should also be accounted for in the strength justification. For hydraulic actuators equipped with hydraulic or mechanical locking features, such as flight control actuators and power steering actuators, the actuators and other loaded elements should be designed for the most severe combination of internal and external loads that may occur in use. For hydraulic actuators that are free to move with external loads, i.e. do not have locking features, the structural loads are the same as the loads produced by the hydraulic actuators. At limit load, seal leakage not exceeding the allowed maximum in-service leak rate is permitted.

(3)     Ref. CS 25.1435(a)(3) For compliance, the combined effects of the ultimate structural load(s) as defined in CS 25.301 and 25.303 and the DOP, which can reasonably occur simultaneously, should be taken into account with a factor of 1.5 applied to the DOP. In this case the overall structural integrity of the element should be maintained. However, it may be permissible for this element to suffer leakage, permanent deformation, operational/functional failure or any combination of these conditions. Where appropriate, thermal effects should also be accounted for in the strength justification.

(4)     Ref. CS 25.1435(a)(4) Fatigue, the repeated load cycles of an element, is a significant contributor to element failure. Hydraulic elements are mainly subjected to pressure loads, but may also see externally induced load cycles (e.g. structural, thermal, etc.). The applicant should define the load cycles for each element. The number of load cycles should be evaluated to produce equivalent fatigue damage encountered during the life of the aeroplane or to support the assumptions used in demonstrating compliance with CS 25.1309. For example, if the failure analysis of the system allows that an element failure may occur at 25% of aeroplane life, the element fatigue life should at least support this assumption.

(5)     Ref. CS 25.1435(a)(5) Aeroplane environmental conditions that an element should be designed for are those under which proper function is required. They may include, but are not limited to temperature, humidity, vibration, acceleration forces, icing, ambient pressure, electromagnetic effects, salt spray, cleaning agents, galvanic, sand, dust and fungus. They may be location specific (e.g., in pressurised cabin vs. in unpressurised area) or general (e.g. attitude). For further guidance on environmental testing, suitable references include, but are not limited to, Military Standard, MIL-STD-810 "Environmental Test Methods and Engineering Guidelines", The European Organisation for Civil Aviation Equipment Document ED-14G "Environmental Conditions and Test Procedures for Airborne Equipment" or International Organisation for Standardisation Document No. ISO 7137 "Environmental Conditions and Test Procedures for Airborne Equipment".

(b)     System Design

Ref. CS 25.1435(b) Design features that should be considered for the elimination of undesirable conditions and effects are:

(a)     Design and install hydraulic pumps such that loss of fluid to or from the pump cannot lead to events that create a hazard that might prevent continued safe operation. For example, engine driven pump shaft seal failure or leakage in combination with a blocked fluid drain, resulting in engine gearbox contamination with hydraulic fluid and subsequent engine failure.

(b)     Design the system to avoid hazards arising from the effects of abnormally high temperatures, which may occur in the system under fault conditions.

(1)     Ref. CS 25.1435(b)(1) Appropriate system parameters may include, but are not limited to, pump or system temperatures and pressures, system fluid quantities, and any other parameters which give the pilot indication of the functional level of the hydraulic systems.

(2)     Ref. CS 25.1435(b)(2) Compliance may be shown by designing the systems and elements to sustain the transients without damage or failure, or by providing dampers, pressure relief devices, etc.

(3)     Ref. CS 25.1435(b)(3) Harmful or hazardous fluid or vapour concentrations are those that can cause short term incapacitation of the flight crew or long term health effects to the passengers or crew.

Compliance may be shown by taking design precautions, to minimise the likelihood of releases and, in the event of a release, to minimise the concentrations. Suitable precautions, based on good engineering judgement, include separation of air conditioning and hydraulic systems, shut-off capability to hydraulic lines, reducing the number of joints and elements, shrouding, etc. In case of leakage, sufficient drainage should be provided.

(4)     Ref. CS 25.1435(b)(4) Unless it has been demonstrated that there are no circumstances which can exist (on the aeroplane) under which the hydraulic fluid can be ignited in any of its physical forms (liquid, atomised, etc.), the hydraulic fluid should be considered to be flammable.

(5)     Ref. CS 25.1435(b)(5) If more than one approved fluid is specified, the term “suitable hydraulic fluid” is intended to include acceptable mixtures. Typical nameplate marking locations for hydraulic fluid use, are all hydraulic components having elastomer seals such as cylinders, valves, reservoirs, etc.

(c)      Tests

Ref. CS 25.1435(c) Test conditions should be representative of the environment that the element, subsystem or system may be exposed to in the design flight envelope. This may include loads, temperature, altitude effects, humidity, and other influences (electrical, pneumatic, etc.). Testing may be conducted in simulators, or stand-alone rigs, integrated laboratory rigs, or on the aeroplane. The test plan should describe the objectives and test methods. All interfaces between the aeroplane elements and the test facilities should be adequately represented.

(1)     Ref. CS 25.1435(c)(1) Testing for performance should demonstrate rates and responses required for proper system operation. Testing for fatigue (the repeated load cycling of an element) and endurance (the ability of parts moving relative to each other to continue to perform their intended function) should be sufficient to show that the assumptions used in demonstrating compliance with CS 25.1309 are correct, but are not necessary to demonstrate aeroplane design life. As part of demonstrating that the element(s), sub-system(s), or system(s) perform their intended functions, the manufacturer (applicant) may select procedures and factors of safety identified in accepted manufacturing, national, military, or industry standards, provided that it can be established that they are suitable for the intended application. Minimum design factors specified in those standards or the requirements may be used unless more conservative factors have been agreed with the Agency.

An acceptable test approach for fatigue or endurance testing is to:

(a)     Define the intended element life;

(b)     Determine the anticipated element duty cycle;

(c)      Conduct testing using the anticipated or an equivalent duty cycle.

(2)     Ref. CS 25.1435(c)(2) The tests should include simulation of hydraulic system failure conditions in order to investigate the effect(s) of those failures, and to correlate with the failure conditions considered for demonstrating compliance with CS 25.1309. Relevant failure conditions to be tested are those, which cannot be shown to be extremely improbable, and have effects assessed to be major, hazardous, or have significant system interaction or operational implications.

(3)     Ref. CS 25.1435(c)(3) Compliance with CS 25.1435(c)(3) can be accomplished by applying a test pressure to the system using aeroplane pumps or an alternate pressure source (e.g. ground cart). The test pressure to be used should be just below the pressure required to initiate system pressure relief (cracking pressure). Return and suction pressures are allowed to be those, which result from application of the test pressure to the pressure side of the system.

Some parts of the system(s) may need to be separately pressurised to ensure the system is completely tested. Similarly, it may be permissible that certain parts of the system need not be tested if it can be shown that they do not constitute a significant part of the system with respect to the evaluation of adequate clearances or detrimental effects.

[Amdt 25/2]

[Amdt 25/12]

[Amst 25/18]