AC 20-136C Appendix C
Example C-3 Engine Over-Speed Protection Function System Channel System Channel System Channel Provide engine over-speed protection.
Active (electronic engine control system) (normal speed control) Active or activebackup (electronic engine control system) (over-speed protection) Active (independent mechanical overspeed protection) Applicable paragraph in § 25.1316 (b) (b) None Discussion:
This example illustrates the function of engine over-speed protection performed by a combination of active electrical and electronic control and mechanical system control. The mechanical channel should provide over-speed protection during normal operations and be independent of the active electronic control channels. The mechanical channel should not rely on electrical or electronic components to assist, augment, or monitor the over-speed protection. If the mechanical channel is independent of the electronic engine control speed control and overspeed protection, and has no electrical or electronic components, then the engine over-speed protection function is not adversely affected when the aircraft is exposed to lightning. The system therefore is not subject to § 25.1316(a). The electronic engine control channels should comply with § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
This example only addresses the over-speed protection feature implemented by the system. Other functions whose failure may be classified as catastrophic, like the loss of thrust (or power) control where the function may be implemented by electronic control channels, must comply with § 25.1316(a).
C-5
AC 20-136C Appendix C Example C-4 Electrical Power Generation System including Ram Air Turbine (RAT) Function System Channel System Channel System Channel Provide electrical power for electrical and electronic systems including those with catastrophic failure conditions.
Active (left engine generator system) Active (right engine generator system) Passive-backup (emergency power supply system driven by ram air turbine) Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (b) Discussion:
This example illustrates a typical transport category airplane electrical system on a two-engine airplane where two or more independent sources of electrical power are required by § 25.1307(b) and a ram air turbine is necessary to comply with the requirements in §§ 25.1309 and 25.1351(d).
For this example, the electrical system consists of two active channels provided by a single main engine driven generator on each engine with the associated distribution and controls, and a third passive-backup channel provided by a ram air turbine electrical power system. The ram air turbine electrical power system is stowed during normal operation and deployed either automatically or manually when power from the two main engine driven generators is lost.
The active engine generator system channels must not be adversely affected when the aircraft is exposed to lightning and must comply with § 25.1316(a)(1) and (2). The passive-backup ram air turbine electrical power system does not mitigate adverse effects for compliance with § 25.1316(a). The ram air turbine electrical power system must comply with § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
C-6
AC 20-136C Appendix C Example C-5 Electrical Power Generation System including Auxiliary Power Unit (APU) and RAT Function System Channel System Channel System Channel System Channel Provide electrical power for electrical and electronic systems including those with catastrophic failure conditions.
Active (left engine generator system).
Active (right engine generator system).
Active-Backup (APU driven generator system required for extended operations (ETOPS) flight beyond 180 minutes).
Passive-Backup (emergency power supply system driven by ram air turbine).
Applicable paragraph in § 25.1316
(a)(1) and
(2)
(a)(1) and
(2) Based on specific aircraft safety assessment.
(b) Discussion:
This example illustrates a two-engine transport category airplane electrical system where two or more independent sources of electrical power are required by § 25.1307(b) and an alternate source (driven by ram air turbine) is necessary to comply with §§ 25.1309 and 25.1351(d). This configuration includes a third electrical power source driven by an APU. This third source (active-backup channel) is required for ETOPS beyond 180 minutes. As in example 4, the emergency power source is a passive-backup channel provided by a ram air turbine that remains stowed during normal flight and deployed either automatically or manually when power from all other channels is lost.
All active electrical power generation channels should comply with § 25.1316(a)(1) and (2). The active-backup electrical power generation channel LCL should be determined based on the specific aircraft safety assessment. The passive-backup electrical power generation channel does not mitigate adverse effects due to lightning exposure to meet the intent of § 25.1316. The passive backup channel must be evaluated under § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
Note: For airplanes without ETOPS type design approval or with ETOPS type design approval for up to 180 minutes, the APU LCL should be defined based on a specific aircraft safety assessment.
C-7
AC 20-136C Appendix C
Example C-6 Independent Systems Performing an Aircraft Function Function System Channel System Channel System Channel System Channel Reduce aircraft speed on ground in a controlled manner using thrust reverser control system, spoiler deployment system, wheel braking system.
Active main brake system (electromechanical) Active (electronic engine thrust reverse control with associated sensors) Active (electronic spoiler deployment control with associated sensors) Active (independent mechanical wheel braking) Applicable paragraph in § 25.1316
(a)(1) and (2) Based on specific aircraft safety assessment.
Based on specific aircraft safety assessment.
None Discussion:
This example illustrates an aircraft level function that is performed by a combination of independent systems, each contributing to the function in part during a specific phase of flight.
Each system implements a very distinct aircraft level function that serves in a complementary manner to decelerate the aircraft during the landing roll. The mechanical wheel braking system is assumed to be independent of the other channels, with no associated electrical or electronic equipment to assist, augment, or monitor the mechanical wheel braking system.
In this example, it is assumed that the main brake system includes failure conditions that are catastrophic. For the electronic engine thrust reverser control and the electronic spoiler control systems, the applicable paragraphs in § 25.1316 would depend on the specific failure conditions.
The effectiveness, authority, and malfunctions associated with each system should be addressed.
Additionally, the interaction between the systems should be addressed. Issues such as unsymmetrical thrust reverser activation or spoiler deployment could adversely affect the main brake and mechanical wheel braking functions and could affect the safety classification for the thrust reverser and spoiler controls.
An aircraft safety assessment should be conducted for each of these systems performing a specific aircraft level function to identify and classify their failure conditions. The failure hazard classifications and the decomposition of each system into the constituent channels would then dictate which paragraphs of § 25.1316 must be complied with.
C-8
AC 20-136C Appendix C
Examp le C-7 Altitude Information from Multiple Sources Function System Channel System Channel System Channel Provide altitude information to display in IFR using air data computer connected to the primary flight display, and pneumatic standby instrument with alternate static port.
Active (air data computer 1 with static port) Active (air data computer 2 with static port) Active-backup (pneumatic standby altimeter with alternate static port) Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) None Discussion:
This example illustrates the function of providing altitude information. The main sources are obtained from two air data computers coupled to static ports and a backup source from a standby pneumatic altimeter coupled to an alternate static port independent from the main static ports.
The pneumatic standby altimeter (active-backup channel) has no associated electrical or electronic equipment to assist, augment, or monitor the pneumatic standby altimeter system.
In this example, the standby altimeter does not mitigate the hazardously misleading altitude information from the active air data computer channels to comply with § 25.1316(a).
C-9
AC 20-136C Appendix C Example C-8 LCL Comparison to Development Assurance Level (DAL) Function Function System Channel System Channel System Channel Control and protection of the aircraft pneumatic (bleed) system (top-level failure condition classification: catastrophic).
Active (pneumatic system controller #1) Functional DAL (FDAL) B Active (pneumatic system controller #2) FDAL B Passive Back-up (high pressure switch + valve) FDAL C Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (b) Discussion:
This is a generic example to show that the LCL of a given system may be different from the FDAL and item development assurance level (IDAL), as defined in SAE ARP4754A. Therefore, it is important to use the proper nomenclature and avoid using ARP4754A “DAL” or similar terms when referring to the LCL.
In this example, the pneumatic control system is composed of two main active controllers and a simpler passive back-up channel that can perform the function, preventing a catastrophic event should both controllers fail.
The FDAL for each channel or member (ARP4754A nomenclature) in this example was determined for a catastrophic top-level failure condition based on the “Option 2” column of Table 3 “DEVELOPMENT ASSURANCE LEVEL ASSIGNMENT TO MEMBERS OF A FUNCTIONAL FAILURE SET” in ARP4754A, which allows the combination of FDAL B+B+C for independent channels. In contrast, the respective LCLs would be A+A+B.
Considering that lightning can simultaneously affect all channels, the considerations used for FDAL assignment are not sufficient. Compliance with § 25.1316(a) is required for both active channels performing a function with a catastrophic top-level failure condition.
The FDAL for the passive back-up channel may be C in this example. However, for lightning, the applicable paragraph in § 25.1316 is (b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
C-10
OMB Control Number: 2120-0746 Expiration Date: 12/31/2027 FAA 1320-73 (01/25) SUPERSEDES PREVIOUS EDITIONS Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering, and maintaining the data needed, completing, and reviewing the collection of information.
All responses to this collection of information are voluntary. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.
If you find an error in this Advisory Circular, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by emailing this form to 9-avs-air-directivesmanagement-officer@faa.gov or faxing it to the attention of at .
Subject: Date:
Mark all appropriate line items:
on page . An error (procedural or typographical) has been noted in paragraph Recommend paragraph on page be changed as fo llows:
In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Other comments:
I would like to discuss the above. Please contact me using the information below.
Submitted by: Date:
Advisory Circular Feedback Form