DO-160 Section 17 is one of the environmental qualification tests in RTCA DO-160, and galley equipment rarely sits on a power bus by itself. It shares that bus with ovens, boilers, lighting, and entertainment loads switching on and off all flight, and every one of those switching events is a potential transient. That makes Section 17 less of a formality and more of a real protection question for galley gear.

What DO-160 Section 17 Covers, and Why It Exists

Section 17 determines whether equipment withstands voltage spikes arriving on its AC or DC power leads, guarding against permanent damage, component failure, insulation breakdown, and susceptibility degradation. Category A is for equipment needing a high degree of spike protection; Category B where a lower standard is acceptable. The procedure applies a minimum of 50 positive-polarity transients within one minute, then 50 negative-polarity transients within a separate one-minute period, to each primary power input, repeated for each operating mode the equipment has.

The Real Hazard This Addresses

The clearest public illustration of what an inadequately protected transient can do comes from the TWA Flight 800 investigation. The NTSB concluded that a short circuit elsewhere on the aircraft most likely transferred excess voltage onto fuel-quantity-indication wiring designed to carry only very low energy, orders of magnitude below what reached it, and that this most likely ignited vapor in the center wing fuel tank. The case is rarely framed around Section 17 specifically, and it’s fair to be precise that it’s a systems-level wiring and energy-transfer story rather than a Section 17 chamber-test failure, but the core hazard, a circuit receiving transient energy it wasn’t designed or protected for, is exactly what this section’s spike testing exists to rule out.

The Engineering Judgment Behind It

The first judgment is category selection by criticality, not convenience. Defaulting to Category B because it’s the easier standard to meet is a mistake for any equipment whose malfunction matters, or that sits on a noisy, heavily switched bus, which describes a lot of galley installations. The protection level should be chosen from the equipment’s actual transient environment and the consequence of its failure, not from what’s cheapest to pass.

The second is test scope across operating modes, which is easy to under-scope. The standard calls for repeating the spike application for each operating mode, and galley equipment is exactly the kind of gear with several, an oven with multiple heating stages, a beverage maker with distinct cycles. A test plan that exercises one representative mode and calls it done has left the other modes unproven, and that’s precisely the kind of gap that surfaces later as an unexplained in-service failure.

The third, drawn straight from the TWA 800 lesson, is to scrutinize any low-energy signal or sensor circuit that shares routing with higher-energy power circuits. The protection margin on those low-energy circuits is where transferred-transient hazards hide, and verifying isolation and protection there is worth more than it costs.

How to Mitigate This

• Choose the protection category from the equipment’s criticality and actual bus environment, don’t default to Category B for convenience
• Cover every distinct operating mode in the test plan, not just one representative mode
• For any low-energy signal or sensor circuit sharing routing with higher-energy power circuits, verify isolation and protection margin explicitly

Further reading: NTSB report AAR-00/03 on TWA Flight 800.

How Eminent Helps: Setting the right protection category for galley equipment on a noisy shared bus, and making sure the spike test actually covers every operating mode, is the kind of scoping that prevents an unexplained field failure later. That’s the work we do. See how we support galley insert programs, or reach out.