0 U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: COMPLIANCE CRITERIA FOR Date: 6/29/01 AC No: 33.28-1 14 CFR §33.28, AIRCRAFT ENGINES, Initiated By: ANE-110 Change:
ELECTRICAL AND ELECTRONIC ENGINE
CONTROL SYSTEMS
1. PURPOSE. This advisory circular (AC) provides guidance and acceptable methods, but not the only methods, that may be used to demonstrate compliance with §33.28 of Title 14 of the Code of Federal Regulations (14 CFR 33.28), Electrical and electronic engine control systems.
Like all AC material, this AC is not, in itself, mandatory and does not constitute a regulation.
While these guidelines are not mandatory, they are derived from extensive Federal Aviation Administration (FAA) and industry experience in determining compliance with the pertinent regulations.
2. RELATED REGULATIONS.
a. Part 21. Section 21.16.
b. Part 23. Sections 23.863, 23.901, 23.903, 23.1181, and 23.1309.
c. Part 25. Sections 25.863, 25.901, 25.903, 25.939, 25.1181, and 25.1309.
d. Part 27. Sections 27.863, 27.901, 27.903, and 27.1309.
e. Part 29. Sections 29.863, 29.901, 29.903, 29.1181, and 29.1309.
f. Part 33. Sections 33.4, 33.5, 33.17, 33.19, 33.27, 33.28, 33.49, 33.53, 33.75, 33.91(a), and Appendix A of part 33.
3. RELATED REFERENCE MATERIAL.
a. ACs, Notices, and Policy.
(1) AC 20-53A, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Due to Lightning, dated April 12, 1985.
(2) AC 20-115B, RTCA, Inc. Document RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certification, dated January 11, 1993.
(3) AC 20-136, Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning, dated March 5, 1990.
(4) AC 21-16D, RTCA/DO-160D, Environmental Conditions and Test Procedures for Airborne Equipment, dated July 21, 1998.
(5) AC 23.1309-1C, Equipment, Systems, and Installations in Part 23 Airplanes, dated March 12, 1999.
(6) AC 25.1309-1A, System Design Analysis, dated June 21, 1988.
(7) AC 33-2B, Aircraft Engine Type Certification Handbook, dated June 30, 1993.
(8) AIR-100 Policy, High Energy Radiated Electromagnetic Fields (HERF), Interim Policy Guidelines on Certification Issues, dated 5 December 1989.
(9) Notice N8110.71, Guidance for the Certification of Aircraft Operating in High Intensity Radiated Field (HIRF) Environments, issued April 2, 1998.
(10) Engine and Propeller Directorate Policy, Time Limited Dispatch (TLD) of Engines Fitted with Full Authority Digital Engine Controls (FADEC) Systems, dated June 29, 2001.
(11) Engine and Propeller Directorate Policy Regarding Integrated Full Authority Digital Engine Control (FADEC) and Electronic Propeller Control (EPC) Systems, dated January 30, 1995.
b. Industry Documents.
(1) RTCA Document No. DO-160D (EUROCAE ED14D), Environmental Conditions and Test Procedures for Airborne Equipment, dated July 29, 1997.
(2) RTCA Document No. DO-178B (EUROCAE ED12D), Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992.
(3) RTCA Document No. DO-254, Design Assurance Guidance for Airborne Electronic Hardware, dated April 19, 2000.
Page ii Par 3
(4) SAE ARP 926/B Fault/Failure Analysis Procedure, issued June 1997.
(5) SAE ARP 1834/A Fault/Failure Analysis for Digital Systems and Equipment, issued June 1997.
(6) SAE ARP 4754, Certification Considerations for Highly-Integrated or Complex Aircraft Systems, issued November 1996.
(7) SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, issued December 1996.
(8) SAE ARP 5107, Guidelines for Time-Limited-Dispatch Analysis for Electronic Engine Control Systems, issued June 1997.
(9) IEC/PAS 62239, Electronic Component Management Plans, edition 1.0, dated April 2001.
(10) IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001.
c. Military Specifications.
(1) MIL-STD-461E, Requirements for the Control of Electromagnetic Interference Characteristics of the Subsystems and Equipment, dated August 20, 1999.
(2) MIL-STD-462D, Measurement of Electromagnetic Interference Characteristics, Test Standard For, dated February 5, 1996.
(3) MIL-STD-810E, Environmental Test Methods and Engineering Guidelines, dated July 31, 1995.
(4) MIL-STD-5007D, Engines, Aircraft, Turbojet and Turbofan, General Specification For, dated October 15, 1973.
(5) MIL-HDBK-179A, Microcircuit Acquisition Handbook, dated July 20, 1995.
(6) MIL-HDBK-217F, Reliability Prediction of Electronic Equipment, dated February 28, 1995.
Par 3 Page iii
4. APPLICABILITY. This AC applies to electrical and electronic engine control (EEC) systems used on aircraft engines certificated under 14 CFR part 33 and intended for use in aircraft certificated under parts 23, 25, 27, and 29. This document also applies to any electrical or electronic systems that control an engine function, for example overspeed or temperature limiting systems. In some cases, controls for functions not normally covered under part 33 or required for engine control are integrated into the EEC (for example, propeller controls regulated under part 35). In these cases, this document also applies to those functions integrated into the EEC system, but only to the extent that those functions affect part 33 requirements. Although sections of this AC provide guidance for compliance with §33.28 for all EECs, the FAA is developing specific guidance for reciprocating engine controls.
Original Signed by JJP on 6/29/01 Jay J. Pardee Manager, Engine and Propeller Directorate, Aircraft Certification Service Page iv Par 4
CONTENTS Paragraph Page CHAPTER 1. GENERAL
1-1. Background1-1
1-2. Introduction1-1
1-3. Definitions.............................................................................................................. . 1 - 2
CHAPTER 2. SECTION 33.28(a)
2-1. Rule Text ................................................................................................................. 2 - 1
2-2. Intent of Rule2-1
2-3. Compliance with §33.28(a)2-1
a. Control System Description2-1
b. Interface Description2-2
c. Operational Description2-2
d. Substantiating Data2-3
e. Fault Accommodation Logic Data2-4
CHAPTER 3. SECTION 33.28(b)
3-1. Rule Text ................................................................................................................. 3 - 1
3-2. Intent of Rule3-1
a. Unacceptable Change in Power or Thrust3-1
b. Continued Safe Operation of the Engine3-1
CHAPTER 4. COMPLIANCE WITH §33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED DATA
4-1. Failure of Aircraft-Supplied Data4-1
4-2. System Configurations4-1
a. Dual Sources4-1
b. Synthesized Engine Parameters4-1
c. Third Source4-1
4-3. Complete Loss of ADC Inputs4-2
4-4. Common Mode Faults4-2
4-5. System Integration4-3
a. Integration Activities4-3
b. Certification Activities4-5
4-6. Fault Accommodation Logic4-7
4-7. Control System Elements Mounted in the Aircraft4-7
Page v
CHAPTER 5. COMPLIANCE WITH §33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED POWER
5-1. Failure of Aircraft-Supplied Power5-1
5-2. All Engine Out Restart Requirement5-1
5-3. Exceptions5-1
5-4. Aircraft-Supplied Power as Backup Power5-2
5-5. Control Systems Integrated with Avionics5-2
CHAPTER 6. SECTION 33.28(c)
6-1. Rule Text ................................................................................................................. 6 - 1
6-2. Intent of Rule6-1
6-3. Compliance with §33.28(c)6-1
a. Engine Controls for Different Aircraft and Rotorcraft Applications6-1
(1) Part 25 Aircraft Applications6-1
(2) Aircraft Applications Other Than Transport Category Aircraft6-2
b. Alternate Mode(s)6-2
c. Control System LOTC Analysis6-3
d. System Safety Analysis6-4
e. Control Mode Transitions6-7
f. Overspeed Protection System Requirements6-8
g. Guidance for Use of Commercial or Industrial Grade Electronic Parts6-10
h. Consideration of Local Events6-10
CHAPTER 7. SECTION 33.28(d)
7-1. Rule Text ................................................................................................................. 7 - 1
7-2. Intent of Rule7-1
7-3. Compliance with §33.28(d)7-1
a. General Test Requirements7-1
b. System Test Configuration Considerations7-1
(1) Open Loop Laboratory Tests7-2
(2) Pass/Fail Criteria7-2
c. HIRF Test Requirements7-2
d. Lightning Test Requirements7-3
e. Maintenance Requirements7-4
f. Environmental Testing7-5
g. Time Limited Dispatch Environmental Tests7-6
Page vi
CHAPTER 8. SECTION 33.28(e)
8-1. Rule Text ................................................................................................................. 8 - 1
8-2. Intent of Rule8-1
8-3. Compliance with §33.28(e)8-1
a. Software Level Requirements8-1
b. Software Partitioning8-1
c. Software Integrity8-1
d. Programmed Logic Devices8-1
APPENDIX 1. REGULATORY BASIS FOR REQUIRING AN EEC SSA AND LOTC ANALYSIS UNDER §33.28.................................. (2 pages) Page vii (and viii)
CHAPTER 1. GENERAL
1-1. Background.
a. Section 33.28 was added to part 33, Airworthiness Standards for Aircraft Engines, as Amendment 15 (58 FR 29095, 5/18/93) and became effective on August 16, 1993. An accompanying advisory circular (AC) was not issued at the time.
b. Initially, EEC technology was primarily applied to engines designed for large transport aircraft applications. The certification practice and implementation of §33.28 was oriented toward these applications. When the use of EEC technology was limited to a small group of manufacturers, the information and guidance provided in the rule itself was adequate. Since the use of EEC controls has spread, a need for an AC has become evident in several recent engine certification programs.
c. In addition, industry representatives from the engine community that design engines for applications other than large transport aircraft certificated under part 25 have questioned the criteria used to determine equivalence to the typical hydromechanical system. A basic criteria for FAA acceptance of the replacement of hydromechanical technology with electronic technology for engine controls is that the new technology must have an equivalent level of integrity and reliability as the technology being replaced. Because the data used to establish the criteria for equivalent reliability of a typical hydromechanical system was based on part 25 certification experience, other industry representatives have presented a valid argument that the equivalence criteria to a hydromechanical system should be based on data for hydromechanical control systems used in their respective part 23, 27, and 29 certifications.
1-2. Introduction. One of the objectives for the engine manufacturer in an engine certification program is to show that the certificated engine will be “installable” in a particular aircraft or aircraft type. If the aircraft application is unknown at the time of engine certification, the engine manufacturer should make reasonable installation and operational assumptions for the anticipated aircraft application.
a. To facilitate achieving this objective, the engine manufacturer should provide a document that describes the EEC system and its operation to both the engine certification office (ECO) and the aircraft certification office (ACO). Using this document, along with other documentation and test results, the ACO will determine if the EEC system has reasonable assurance of being in compliance with the applicable aircraft certification regulations (§§ 901, 903, and 1309 of parts 23, 25, 27, 29).
b. Providing the EEC documentation to the ACO is particularly important when the system is novel or unique and differs from previously certificated systems. The ECO will also coordinate with the appropriate FAA engine controls specialist(s) in this regard. If these reviews indicate that the engine may not be installable in the intended aircraft type, the ECO will inform the applicant and the appropriate ACO of any potential certification issues. The final determination for compliance with these aircraft regulations will be determined by the appropriate ACO at Par 1-1 Page 1-1
aircraft certification, when more complete test and analysis data is available. This coordination with the ACO is only necessary for the initial aircraft application of the engine. If an aircraft is not identified as the anticipated installation for the engine, a review may be conducted with the applicable Standards Staff. Any installation limitations or operational issues will be noted in the engine Installation or Operational Manuals and the engine Type Certification Data Sheet (TCDS). Applicants should also be aware that the ACO may require flight testing to fully evaluate engine performance and operability characteristics for all operating modes.
1-3. Definitions.
a. Aircraft-Supplied Data. Aircraft-supplied data is information that is generated in the aircraft systems and used by the engine control system, but whose source is not controlled under the design authority of the engine certification applicant. This does not include input from those sensors that are used by, and normally dedicated to, the engine control system but may be mounted in the airframe.
b. Aircraft-Supplied Power. Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
c. Alternate Control Mode(s). For the purposes of this AC, an alternate control mode is one in which the operating characteristics or capabilities of the engine control are sufficiently different from the “normal mode” that they may significantly impact or change the operating characteristics or capabilities of the aircraft, crew workload, or what constitutes appropriate crew procedures.
d. Commercial and Industrial Grade Electronic Parts. Commercial (consumer quality parts) and industrial grade electronic parts have typical operating ranges of 0 degrees to +70 degrees Celsius and -40 degrees to +85 degrees Celsius, respectively. Vendor parts catalogs typically define commercial and industrial grade electronic parts in these temperature ranges.
e. Electronic Engine Control (EEC) System. The EEC system is the generic family of electrical/electronic engine control systems, including full authority digital engine controls, supervisory controls, and derivatives of these.
f. Fault or Failure. This is an occurrence that affects the operation of a component, part, or element such that it can no longer function as intended, and includes both loss of function as well as a malfunction. Errors that may cause failures are not considered as failures.
g. Fault or Failure Accommodation. This term refers to the capability of the control system or crew to mitigate, either wholly or in part, the failure condition.
Page 1-2 Par 1-2
h. Fault or Failure Condition. This is a condition having an effect on the airplane or its occupants, either direct or consequential, that is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.
i. Fault or Failure Detection. This term refers to the discovery of a fault or failure condition and either announcement of that condition to the flight crew by instrumentation or storage of the detection of that condition, or its results, in a fault memory for later retrieval through a built-in test capability of that control.
j. Full Authority Digital Engine Control (FADEC). FADEC is a control system in which the primary functions are provided electronically and the electronic unit has full-range authority over the engine power or thrust. FADEC systems have been certificated that employ either two identical channels to provide full-operational capability after failure of one channel or a single channel with a simplified electronic or hydromechanical back-up to provide an alternate operating mode. The “FADEC system” includes all the control elements identified in the instruction manual, including: sensors, wiring, mechanical, pneumatic, or hydromechanical components and other limiter or protection devices. If the control requires data from aircraft computers to operate, this data is considered part of the EEC or FADEC system, and the interface requirements for this data should be specified in the engine instruction manual.
Mechanical components, such as the fuel pump, that do not interface with the EEC system are generally not included in the definition of FADEC system components.
k. Full-up System or Configuration. For the purposes of the system safety assessment (SSA) analyses described in this AC, the “full-up system” is one that does not have any faults or failures present, detected or undetected, that affect the control of engine power or thrust, engine protection systems, indication of critical engine operating parameters or other safety features of the control. In a “full-up system,” everything is operative.
l. Loss of Thrust Control (LOTC). For engines intended for use in airplanes certified under part 23 Commuter Category standards, or part 25 standards (Transport Category), and in rotorcraft certified under part 27 or part 29 standards, this term refers to the loss of capability to modulate and maintain thrust or power between flight idle and 90 percent of maximum rated power or thrust at all operating conditions. For engines intended for use in airplanes certified under part 23 Normal, Utility, or Acrobatic standards, this term refers to the loss of capability to modulate and maintain thrust or power between flight idle and 85 percent of maximum rated power or thrust, at all operating conditions. One engine inoperative (OEI) or automatic take-off thrust control system (ATTCS) ratings and implementations are exempted from an LOTC analysis, because the portion of time spent at these ratings is relatively small, and they are covered by aircraft level analyses.
m. Per Hour. When the term “per hour” or “per flight hour” is used in this AC, the definition is “per engine flight hour.”
Par 1-3 Page 1-3
n. Range of Control. This term refers to modulation of the engine from idle to 100 percent maximum rated thrust or power and includes any red line or higher rotor speed protection controls and any engine temperature, torque, and pressure limits set and implemented by the control.
o. Take-off Envelope. This term refers to the operation of the aircraft at or below 1500 feet above ground level (AGL) during take-off or landing approach. When distant obstacle clearance is involved, the take-off envelope may be increased to a higher altitude than 1500 feet AGL. For rotorcraft, the take-off envelope is 1000 feet AGL for Category A rotorcraft, and within the height-velocity envelope for all others.
p. Uncovered Fault. An uncovered fault is a fault or failure for which either a detection mechanism does not exist or, if there is a detection mechanism, an accommodation does not exist.
q. Unsafe Condition. For purposes of this AC only, an unsafe condition is a condition that, if not corrected, is reasonably expected to result in one or more serious injuries. In this definition, “reasonably expected” means a probability of occurrence unacceptable to both the long-term risk and the intent of the applicable Type Design Standards.
Page 1-4 Par 1-3
CHAPTER 2. SECTION 33.28(a)
2-1. Rule Text. Section 33.28(a) provides that each EEC must: “Have the control system description, the percent of available power or thrust controlled in both normal operation and failure conditions, and the range of control of other controlled functions, specified in the instruction manual required by §33.5 for the engine.”
2-2. Intent of Rule. Section 33.28(a) requires the applicant to provide the necessary information in the form of manuals to ensure safe engine installation and safe engine operation. The data underlying the information provided in the manuals should be created as part of the engine certification program. The manuals should include the following:
a. EEC system information that provides a clear understanding of the control system in the normal and any alternate control or operating modes;
b. Any differences in operation in other than the normal mode;
c. Any subtle interface requirements, such as power interrupt tolerance of the EEC;
d. Percent of available power or thrust in both normal operation and any alternate modes;
e. Range of control of other controlled functions; and
f. The environmental limitations of the engine installation.
2-3. Compliance with §33.28(a). The following is a method, but not the only method, of compliance with §33.28(a):
a. Control System Description. The applicant should include a brief control system description in the instruction manual and may incorporate a more detailed system description document by reference. The applicant should also consider other functions integrated into the EEC system. If functions other than those directly associated with the control of the engine are integrated into the EEC system, (such as thrust reverser control, propeller control, or automatic starting) the applicant should include descriptions of these functions in the instruction manual.
Even if the FADEC control is integrated wholly or in part within an aircraft avionics system, the engine manufacturer should provide an engine control system description that meets part 33 engine certification requirements and should include the relationship of the engine control system and the aircraft systems. Engine control systems that are embedded in aircraft avionics may require special conditions as prescribed under §21.16.
Par 2-1 Page 2-1