Jherrod ThomasThe Lion of Functional Safety™

September 11, 2026 · 15 min read

14 CFR 25.785 / 25.561 / 25.562TSO-C127c / SAE AS8049 / AC 25.562-1BFAA-2026-8801 / EASA AD 2025-0200

When the Seat Was Certified as Structure and Failed as a Function: The Dassault Falcon Seat-Track Lock NPRM (91 FR 57521) Through a 14 CFR 25.785 / 25.562 and TSO-C127c Lens

A business-jet cabin seat is subjected to a 16g dynamic impact pulse, a 14g vertical pulse, a head injury criterion limit, a femur load limit and a lumbar compression limit before it is allowed on an airplane. Every one of those tests is run with the seat locked to the floor at a chosen track position. This proposed AD exists because the lock does not always hold.

I like this one because it has no software in it. No ECU, no CVE, no firmware revision, no partition. It is a pawl, a track and a spring, and it still produces the same shape of failure this blog keeps finding: a risk control with no monitor, a certification credit taken in a configuration the failure destroys, and a fix that existed for nearly three years before anyone was required to install it.

The reason it looks like the software cases is that the defect is not structural. It is functional. And cabin seats are not certified as functions.

1. The public record

On September 10, 2026, the FAA published NPRM 2026-18520 at 91 FR 57521 (Docket No. FAA-2026-8801; Project Identifier MCAI-2025-01495-T), proposing a new airworthiness directive for all Dassault Aviation Model FALCON 7X, MYSTERE-FALCON 900, FALCON 900EX, FALCON 2000 and FALCON 2000EX airplanes (Federal Register, September 10, 2026). It was signed September 8 and went on public inspection September 9. Comments close October 26, 2026. ATA chapter: 25, Equipment/Furnishings.

The unsafe condition, in the FAA's own words:

This AD was prompted by reported occurrences of seats sliding without passenger input. The cabin seat track locking mechanism was found to jam in isolated conditions during taxi, take-off, and landing. The unsafe condition, if not addressed, could lead to failure of the affected seat to remain in its position during critical phases of flight, resulting in possible injury to passengers.

Four things in that paragraph are worth slowing down on.

"Without passenger input." The seat moved on its own. This is not a passenger releasing the lock and forgetting to re-engage it. The commanded state was "locked" and the achieved state was "free to translate."

"Jam." The failure mode of the locking mechanism is not fracture or wear-through — it is a jam. A jam is a position-holding failure, and it has a direction. A pawl that jams in the engaged position gives you a seat that will not adjust, which is an annoyance. A pawl that jams out of engagement gives you a seat that reports locked to the person sitting in it and is not. The AD text does not tell us which, but the hazard it describes only follows from the second.

"During taxi, take-off, and landing." TTOL is precisely the window in which 14 CFR 25.561 and 25.562 load cases are assumed to apply. The regulation does not care about a seat sliding at cruise. It cares about a seat sliding in the phases where the emergency-landing inertia factors are credited.

"In isolated conditions." That is the phrase that tells you the root cause was never fully bounded. "Isolated conditions" is regulator language for we have occurrences and we do not have a deterministic trigger.

The proposed compliance action is to modify or replace each affected seat, per EASA AD 2025-0200, dated September 17, 2025, corrected September 30, 2025 — with EASA also prohibiting installation of affected seats going forward (EASA AD 2025-0200). Affected parts are identified at part-number and serial-number granularity: single seat assemblies P/N 3ABF0107( ) and double seat assemblies P/N 3ABF0207( ) listed in Tables 1 and 2 of Appendix 1 of the EASA AD. A "serviceable seat" is defined negatively — any seat of those part numbers that is not on the list.

The service information arc is the part of this record that should make a program manager uncomfortable:

| Date | Artifact | |---|---| | December 5, 2023 | Dassault SB 7X-556 and SB F2000EX-497, original issue | | July 3, 2024 | Both SBs, Revision 1 | | July 25, 2025 | Both SBs, Revision 2 | | September 17, 2025 | EASA AD 2025-0200 (corrected September 30, 2025) | | September 10, 2026 | FAA NPRM 2026-18520, comments open to October 26, 2026 |

Three issues of the same service bulletin before a mandate. Roughly 33 months from first SB to a proposed U.S. requirement, and 358 days from the EASA AD to the FAA's notice of proposed rulemaking. Today, the U.S. fleet is still flying on a voluntary SB.

The fleet and cost numbers are small and specific: 22 airplanes of U.S. registry, 125 single seat assemblies and 36 double seat assemblies affected. Up to 2 work-hours at $85 per hour is $170 of labor; parts run up to $9,432; the FAA puts the total U.S. operator exposure at up to $945,797, some or all of which Dassault indicates may be covered under warranty. Note the arithmetic in the FAA's own footnote: singles at $4,801 and doubles at $9,602 — exactly double. The whole campaign costs less than one mode control panel from a 787.

One more data point for context, from the same regulator in the same window: EASA AD 2025-0205, now at Revision 3, requires a one-time detailed visual inspection and replacement of fuselage passenger seat tracks on ATR42 and ATR72 airplanes (EASA AD 2025-0205R3). Different type certificate, different manufacturer, different root cause — same interface. The seat-to-floor joint has been generating airworthiness directives on two unrelated fleets at once.

2. The standards lens

Here is the thing that makes this case structurally interesting: there is no clause that was violated. The certification basis for these seats was almost certainly met. The gap is in what that basis asks.

14 CFR 25.785(b) — the load path requirement. Each seat, berth, safety belt, harness and adjacent part of the airplane at each station designated as occupiable during takeoff and landing must be designed so that a person making proper use of these facilities will not suffer serious injury in an emergency landing as a result of the inertia forces specified in 25.561 and 25.562 (eCFR 14 CFR 25.785). Read as an engineer rather than a lawyer, that is a requirement on a configuration — a seat, at a position, with a belt at a geometry, carrying inertia loads into a floor attachment. It says nothing about whether that configuration is guaranteed to exist at the moment of the event.

14 CFR 25.561 — static ultimate inertia factors. The emergency-landing static case, including the 9.0g forward condition for seats and their attachments. Again: a load case applied to an assumed geometry.

14 CFR 25.562 — emergency landing dynamic conditions. This is where the money is spent. Two sled tests with a 170-pound anthropomorphic test dummy per 49 CFR Part 572 Subpart B, seated in the normal upright position (eCFR 14 CFR 25.562):

Pass/fail includes HIC at or below 1,000, femur axial compression at or below 2,250 lbf per leg, and lumbar spine compression at or below 1,500 lbf, with the restraint remaining on the occupant and the seat remaining attached at all points of attachment.

FAA AC 25.562-1B and SAE AS8049 / TSO-C127c are where the test configuration is pinned down — test facilities, fixtures, instrumentation, and the requirement to test the critical configuration of an adjustable seat (AC 25.562-1B; SAE AS8049C; ETSO-C127c). And this is the crux. "Critical configuration" is enumerated over the seat's intended adjustment range — recline, track position, leg-rest, swivel. It is a search over choices the occupant can make. It is not a search over states a failed mechanism can produce.

A seat translating along its track during a 0.09-second, 16g pulse is in none of the configurations that were tested. The restraint anchor geometry changes mid-pulse. The femur and lumbar load paths change mid-pulse. The energy that the seat structure was qualified to absorb by deforming in place is instead partly dissipated by the seat moving, and then delivered as a secondary impact when the seat reaches a hard stop or re-engages a track hole. Standard seat track hole pitch is one inch; a jammed pawl over a released track can give you several inches of free travel before anything catches. Nothing in the qualification file predicts the occupant response to that, because nothing in the qualification file contemplated it.

The missing artifact has a name in the adjacent discipline. In avionics, ARP4754B and ARP4761A would require a Functional Hazard Assessment on the function, then a fault tree or FMEA to show the failure condition classification is met with adequate independence, and a Certification Maintenance Requirement if a latent failure needs a periodic check. Under AC 25.1309-1, "serious or fatal injury to a small number of passengers or cabin crew" is Hazardous, which carries an average probability per flight hour target on the order of 1E-7 and a no-single-failure expectation. "Physical distress, possibly including injuries" is Major, around 1E-5.

Now classify honestly. A latent unlock alone, with no impact event, is Major — passengers are sliding around during taxi and takeoff, which is distressing and can injure. A latent unlock coincident with a survivable emergency landing is Hazardous. That second row is a two-element cut set, one element of which is dormant and unannunciated, which is exactly the configuration ARP4761A latent-failure analysis exists to flag and 25.1309 would push you to either monitor or make single-fault tolerant.

Except 25.1309 does not attach here. Seats live under 25.785 / 25.561 / 25.562 and a TSO, and that framework is a static and dynamic strength framework. It has no probability budget, no single-failure-tolerance criterion, and no concept of a latent failure of an adjustment mechanism. So no FHA was owed, none was run, and the only detection control the airplane ever had for a failed seat lock was a human being physically checking that the seat does not move.

3. A worked snippet

3.1 The FHA row that was never written

Classification per AC 25.1309-1 severity definitions; the point of the table is the last column.

| ID | Function | Failure condition | Phase | Effect | Classification | Monitor / detection | Independence | |---|---|---|---|---|---|---|---| | SEAT-FHA-01 | Retain seat at selected track position | Loss of position retention (lock jams disengaged) | Taxi, takeoff, landing | Seat translates under normal accel/decel; occupant physical distress, possible injury | Major | None on aircraft; cabin crew visual/manual check only | N/A | | SEAT-FHA-02 | Retain seat at selected track position | Loss of position retention, latent, coincident with survivable emergency landing (25.562 pulse) | Takeoff, landing | Restraint and load-path geometry outside qualified configuration; HIC / femur / lumbar limits unverified; secondary impact at track hard stop | Hazardous | None | Single mechanical element; no redundant pawl, no position sensing | | SEAT-FHA-03 | Indicate lock engaged | Erroneous indication of engagement (mechanism presents as locked) | All | Falsifies the only detection control in the system — the crew check | Major (latent, contributory) | None | Detection and function share the same pawl |

SEAT-FHA-03 is the row I would put in front of a design review board. The crew pre-departure check is a procedural risk control, and its detection means is a human applying force to the seat. If the mechanism can jam in a state that resists a hand-push but releases under a sustained inertial load, the check returns a pass on a failed part. That is not a monitor. That is the failure lying to the only person looking.

3.2 Fault tree for the Hazardous condition

TOP: Occupant not protected to 25.785(b) in a survivable
     emergency landing (target: 1E-7 per flight hour, Hazardous)
                          |
                        [AND]
                          |
        +-----------------+------------------+
        |                                    |
   IE-1: Seat not retained at a          IE-2: Survivable emergency
   qualified track position at the       landing / high-decel event
   moment of the pulse                   occurs during TTOL
        |                                    |
      [OR]                              (exposure term, not a
        |                                design-controllable event)
  +-----+----------+---------------+
  |                |               |
BE-1: Pawl      BE-2: Track     BE-3: Crew TTOL check
jams out of     hole / track    passes on an already
engagement      feature worn    failed lock
("isolated      or deformed     (procedural control,
conditions")                     human-force detection)
  |                |               |
  |          [see EASA AD          |
  |           2025-0205,           |
  |           ATR seat tracks]     |
  |                                |
  +----------------+---------------+
                   |
            NO MONITOR NODE
     There is no basic event on this tree
     for "lock disengagement detected and
     annunciated," because no such function
     was ever specified.

The tree has a structural tell. Every mature fault tree for a Hazardous condition has at least one branch that terminates in a detection element with its own failure rate. This one cannot, because the aircraft has no means of knowing the state of the lock. The only element that could serve as a monitor — BE-3, the crew check — sits inside the failure branch rather than under a separate AND gate, because it depends on the same pawl it is meant to check. That is a common-element dependency, and in any avionics review it would be written up on the spot.

3.3 The same defect as an AS9100 / 8D-style row

| Failure mode | Effect | Sev | Cause | Occ | Current detection control | Det | Action priority | |---|---|---|---|---|---|---|---| | Seat track locking pawl jams out of engagement; seat free to translate | Occupant outside qualified restraint geometry during TTOL and emergency-landing pulse | 9 | Mechanism jams under "isolated conditions" not deterministically characterized after three SB revisions | 3 | Manual seat-push check by cabin crew; no indication, no inspection task, no annunciation | 8 | High |

Severity 9 because the harm is serious injury to an occupant in a survivable event. Detection 8 because the only control on the record is a hand on a seat back, and the failure mode plausibly defeats it.

4. Derived requirements (excerpt)

Stable IDs, numeric where numeric is possible, each traceable to a row above.

FSL-SR-001 (from SEAT-FHA-02 / BE-1). The seat position retention function shall retain the seat within 0.25 in of the selected track position when subjected to the inertia load cases of 14 CFR 25.561 and the dynamic pulses of 25.562, with the locking mechanism in any single-failure state that the mechanism can physically achieve. Verification: 25.562 sled test repeated with the pawl mechanically constrained in the disengaged and partially engaged states; measured translation recorded for each.

FSL-SR-002 (from SEAT-FHA-03). The engagement state of the locking mechanism shall be observable by a means that is physically independent of the pawl whose state it reports — a separate position-sensing feature, a mechanical flag driven off the locking element's travel, or a visible witness mark. A mechanism that resists an applied hand load of 50 lbf shall not be reportable as engaged unless the independent means confirms engagement. Verification: bench test across the full jam envelope characterized in FSL-SR-005; zero false-pass results permitted across 100 trials per jam state.

FSL-SR-003 (from BE-3). The cabin pre-departure procedure shall not be credited as the sole detection control for any seat position-retention failure until FSL-SR-002 is implemented. Until then, the seat modification or replacement of EASA AD 2025-0200 is the risk control, and the procedural check shall be documented in the safety assessment as non-credited. Verification: traceability audit of the cabin interiors safety assessment; no risk reduction claimed against the crew check.

FSL-SR-004 (from BE-2, cross-fleet). A repetitive inspection task shall be established for the seat-to-floor interface — track, track hole condition, and locking element engagement depth — at an interval derived from the observed failure distribution, not from a convenient check letter. Where the failure distribution is not characterized, the initial interval shall be set at or below 2,000 flight hours and revised on the first ten findings. Verification: interval substantiation package; airworthiness limitation entry per 14 CFR 25.1529 and Appendix H.

FSL-SR-005 (from "isolated conditions"). The jam mechanism shall be characterized to the point that the trigger set is enumerable: contaminant type and quantity, actuation-cycle count, lateral load at actuation, temperature, and track wear state. A corrective action shall not be closed against a failure mode whose trigger conditions are still described as "isolated." Verification: designed experiment across the enumerated factors; the SB revision that closes the 8D shall reference the DOE, not field absence of recurrence.

FSL-SR-006 (process, from the timeline). Where a service bulletin addressing an occupant-protection failure condition reaches a third revision without the mandating authority acting, the program shall escalate the item to a formal change-impact assessment rather than issuing a fourth. Verification: configuration management audit; SB revision count is a tracked trigger, not a footnote.

FSL-SR-006 is the cheap one and the one that would have mattered most. Two revisions of a fix is normal engineering. Three is a signal that the mechanism is not understood, and the artifact that should fire on that signal is a re-opened root cause — not another revision letter.

5. What the headline really tells us

The headline, if anyone writes one, is "FAA proposes fix for sliding seats on business jets." It will read as a comfort item. Twenty-two airplanes, $945,797, warranty probably covers it.

The engineering content is that we have a whole category of parts certified under a framework that cannot express the failure they actually exhibit.

Cabin interiors are qualified as structure. You apply loads, you run pulses, you measure HIC and femur and lumbar, you show the seat stays attached, and you are done. That framework is excellent at answering "is this strong enough." It has no vocabulary at all for "what if the mechanism that establishes the tested configuration stops working." There is no FHA, no probability budget, no single-failure criterion, no latent-failure analysis, no monitor requirement, and — until an AD says so — no inspection task. The seat is treated as a fixed object that happens to be adjustable, when it is in fact a mechanism with a safety-critical state.

That is the missing artifact here. Not a sensor, not a redundant pawl, not a service bulletin. A functional hazard assessment on a part that nobody thought had functions. Once you write that one page, everything else on this list falls out of it: the Hazardous row, the two-element cut set, the common-element dependency between the lock and the check that verifies the lock, the inspection interval, and the observation that the only detection control in the entire system is a flight attendant pushing on a seat back and trusting what her hand tells her.

The seat did not fail a strength requirement. It failed a requirement nobody wrote, because the document that would have written it was never owed.

Sources

Jherrod Thomas — The Lion of Functional Safety™. Certified ISO 26262 Functional Safety Expert, ISO/SAE 21434 (TÜV SÜD), SOTIF Advanced, PMP.