b. Interface Description. The instruction manual should include installation interface descriptions, limitations, and requirements of the engine control system. For example, the instruction manual should clearly define the EEC power requirements and quality, including interrupt limitations, for the engine installer. The manual should also specify the impedance and buffering limitations for the signals provided by the EEC system for display and instrumentation, or signals used by the EEC, such as air data information, to ensure that the EEC system is adequately isolated and unaffected by other systems using these signals.
c. Operational Description.
(1) The instruction manual should:
(a) Describe the control system operating characteristics in both the normal and alternate control modes.
(b) Define restrictions in the flight envelope or unusual operating characteristics in these alternate modes.
(c) Identify any abnormal control characteristics in all operational or dispatchable configurations that could have an impact on crew procedures, training, workload, or any other aspect of aircraft performance or operating characteristics, for evaluation during aircraft certification.
(2) If dispatch of the control system with faults has been approved by a time-limited dispatch (TLD) analysis or other analyses, the instruction manual, or other appropriate documentation, should include the time limitations for this type of operation. If TLD or other appropriate analysis or documentation is not submitted to substantiate the acceptability of dispatching the engine control with faults present or portions of the control inoperative, the control may be restricted to “full-up” dispatch only.
(3) Faults that leave the control in a condition that cannot meet part 33 performance and operability requirements are generally considered non-dispatchable. The instruction manual should indicate how the EEC system would announce that condition to the flight crew. It should also describe how the control system provides output information for such a condition.
(4) The instruction manual should describe the availability of information about ECO- approved dispatchable fault conditions, and the time limits approved for such operations. ECO approval of a particular fault condition as dispatchable does not guarantee that the ACO or the operator’s certificate management office will approve that same condition as dispatchable for the aircraft or operator.
Page 2-2 Par 2-3
d. Substantiating Data. The instruction manual should include data from analyses conducted to comply with §§33.28(b) and (c), data from the environmental testing conducted to comply with §33.28(d), and data from the software level determinations conducted to comply with §33.28(e). This data will assist the installer in safely installing the engine. The applicant should have available and provide, as required, the following specific data:
(1) Data for all operating modes, to demonstrate that the control meets its design intent.
(2) Data to show that a progressive means of increasing power or thrust with throttle or load demand is provided for all control modes.
(3) Data for the following:
(a) The software level (for each function, if necessary).
(b) The estimated failure rates for:
1. Engine shut-down in-flight due to engine control causes.
2. Loss of engine or propeller control or significant change in power or thrust.
3. Failures to the back-up system.
4. Transmission of faulty parameters that affect cockpit located engine displays, or other safety critical functions.
5. Loss of any critical safeguards, such as overspeed or valves needed for fire protection.
6. Loss of any aircraft-supplied data or power required to assure proper engine operation.
7. Other safety significant failure conditions, such as the probability of an uncontrolled overspeed and the other control system associated events as determined from the system safety analysis (SSA). A control system event is one that the control system causes or is involved in preventing.
(4) The types and levels of environmental exposure for which the EEC system has been successfully qualified; for example, vibration, temperature, HIRF, and lightning. For new applications of a previously certified control system, substantiation of the environmental capability of the EEC system by similarity analyses, as well as tests, may be acceptable. The certification approach to be pursued should be indicated in the certification plan. For HIRF, lightning and electromagnetic interference (EMI) qualification tests, the interfacing aircraft cables used for the tests should be described.
Par 2-3 Page 2-3
e. Fault Accommodation Logic Data. The applicant should have available and provide, as required, the following:
(1) A tabulation of the fault accommodation logic for the critical parameters used by the control; and
(2) A tabulation of the “default” or “fail-safe” states of all EEC system outputs, and the rationale for their selection.
Page 2-4 Par 2-3
CHAPTER 3. SECTION 33.28(b)
3-1. Rule Text. Section 33.28(b) provides that each EEC system: “Be designed and constructed so that any failure of aircraft-supplied power or data will not result in an unacceptable change in power or thrust, or prevent continued safe operation of the engine.”
3-2. Intent of Rule. Section 33.28(b) requires that the engine and control system continue to function in a safe and reliable manner in the event of the failure of aircraft-supplied power or data, or both, while providing sufficient flexibility to accommodate the increasing engine and aircraft integration that accrues from the use of electronic control technology. For single engine installations, the effects should be reviewed as part of the overall safety and reliability objectives of §33.28(b).
a. Unacceptable Change in Power or Thrust. An “unacceptable change in power or thrust” is a change that has a significant impact on the performance margins of the intended application.
Although the complete or partial loss or change of thrust or power in a single engine installed on a multi-engine aircraft is not necessarily an unsafe condition, the ECO will evaluate both partial and complete loss of power or thrust. This evaluation includes the frequency, duration, and percentage of power or thrust change that results from the failure of aircraft-supplied data or power. This evaluation also considers location in the flight regime at the time of the event. The applicant should provide analytical or test data for this evaluation. The data may include worst case plots of percentage power or thrust change over the declared operating envelope for failure of aircraft-supplied data or power.
b. Continued Safe Operation of the Engine. In case of loss, corruption or failure of aircraftsupplied data or power, the engine should continue to function in a safe and acceptable manner, without unacceptable effects on thrust or power, hazardous engine effects, or loss of ability to comply with the operating requirements of §§33.51, 33.65 and 33.73.
Par 3-1 Page 3-1 (and 3-2)
CHAPTER 4. COMPLIANCE WITH SECTION 33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED DATA
4-1. Failure of Aircraft-Supplied Data. The following guidance provides a method, but not the only method, of compliance with §33.28(b) for failure of aircraft-supplied data. The applicant should define in the instruction manual the effect of the failure of aircraft-supplied data on the engine’s output power or thrust characteristic throughout the flight envelope. That data should be provided for all allowable engine control and aircraft dispatch configurations in which the loss of aircraft power or data in that dispatch configuration would result in a different engine control system response.
4-2. System Configurations. Examples of system configurations that have been found to be acceptable under §33.28(b) include the following:
a. Dual Sources. A system may use dual sources of aircraft-supplied data with local engine sensors provided as “voters” and alternate data sources. Sensors that act as “voters” provide a method for the EEC system to determine if one of the primary data sources is providing erroneous data, and to then eliminate that erroneous source from consideration. In the event of a failure in the aircraft-supplied data, the engine sensors act as the primary source of sensed data through the fault accommodation logic. In the event of the loss of this engine-sensed data, the system uses modeled or synthesized parameters.
b. Synthesized Engine Parameters. In some cases, a system may use synthesized engine parameters as voters. The applicant should provide data that gives the worst case percentage change of power or thrust over the declared operating envelope when inaccuracies of the synthesizing process are considered, as well as the environmental effects on the sensors used in the synthesis.
c. Third Source. A system may use a third source of aircraft-supplied data as the voter instead of engine sensors. In this case, when aircraft data is used exclusively, the applicant should address the following items, as applicable, in the SSA or other appropriate documents:
(1) Software in the data path to the EEC should be at a level consistent with that defined for the EEC. The data path may include other aircraft equipment, such as aircraft air data computers (ADC), thrust management computers, or other avionics equipment.
(2) The applicant should state in the instruction manual that the aircraft manufacturer must ensure that changes to aircraft equipment, including software, in the data path to the engine do not affect the integrity of the data provided to the engine as defined by the instruction manual.
(3) If dispatchability of the aircraft without the third source is anticipated, the applicant should provide analysis that demonstrates the acceptability of this dispatch configuration for the minimum maintenance equipment list (MMEL) or the TLD documents, as applicable.
Par 4-1 Page 4-1
(4) Since aircraft-supplied data has an effect on EEC system operation, the applicant should supply the effects of faulty and corrupted aircraft data on the EEC system in the engine instruction manual. In the three ADC configuration the EEC system could be significantly affected by erroneous or faulty air data information; the engine could experience a significant thrust or power change during such a condition. If this is the case, the applicant should indicate in the instruction manual that air data information, and any other aircraft information that could have a significant impact on engine thrust or power, is considered critical to EEC system operation. Therefore, the instruction manual should state that the installer should ensure that those sensors and equipment involved in delivering information to the EECs are capable of operating in the “severe” HIRF and lightning environments, as defined in the certification basis for the aircraft, without affecting their proper and continued operation.
(5) The applicant should state the reliability level for the aircraft-supplied data that was used as part of the SSA and LOTC analysis as an “assumed value” in the instruction manual.
4-3. Complete Loss of ADC Inputs. The applicant should provide fault accommodation logic for the complete loss of ADC inputs or other aircraft-supplied data, even though this loss may be extremely improbable. In this case, the applicant should conduct sufficient testing or analysis, or both, on the fault accommodated control mode to establish that the engine operating characteristics comply with all operability requirements of part 33.
4-4. Common Mode Faults. In the exchange of data with the aircraft, consideration should be given to elimination of unacceptable common mode faults affecting the operation of more than one engine or propeller. This AC describes limits for unacceptable common mode faults that affect power or thrust in the discussion of §33.28(c). Common faults that affect engine protection limit systems or could hazard the aircraft would generally be unacceptable. The applicant should demonstrate the logic included in the control system to accommodate common faults. Any precautions needed to address common effects should be taken either through the aircraft system architecture or by logic internal to the engine control system. This should be demonstrated as part of the software integration testing during the EEC software verification or EEC system validation test program. Specifically, the applicant should consider the following cases:
a. Erroneous data received from the aircraft by the engine or propeller control system, if the data source is common to more than one engine or propeller; for example, air data sources, autothrottle systems, and synchronizing controls.
b. Control system operating faults propagating through data links between engine or propeller; for example, maintenance recording, common bus, cross-talk, auto-feathering, and automatic power reserve system.
c. Loss or interruption of aircraft data or electrical power used by the engine control, when that loss or interruption is caused by the failure of another engine.
Page 4-2 Par 4-2
d. Exchange of data between engines to implement control functions, (for example, load sharing and synchrophasing) should be shown to incorporate authority limits to prevent unacceptable common mode loss of power or thrust.
4-5. System Integration. The trend toward system integration may result in EEC systems that use resources distributed within the aircraft in addition to aircraft-supplied data. In these cases, the office responsible for certifying the engine would expect the engine manufacturer to specify the requirements for the EEC system and substantiate the adequacy of those requirements. The engine manufacturer should specify these requirements in the engine instruction manual to ensure that the engine certification basis is maintained.
a. Integration Activities.
(1) Aircraft Functions Integrated into the Engine Control System. This activity involves the integration of aircraft and propeller control functions (that is, those that have traditionally not been considered engine control functions) into the EEC system’s hardware and software.
(a) Examples of this integration include: thrust reverser controls; propeller speed governors, which govern speed by varying pitch; and ATTCS systems. When this type of integration activity is pursued, the EEC system becomes part of, and should be included in, the aircraft’s SSA. Although the aircraft functions incorporated into the EEC system may receive review at engine certification, the acceptability of the safety analysis involving these functions would be determined at aircraft certification.
(b) The EEC system may be configured to contain only part of the aircraft system’s functionality, or it may contain virtually all of it. Thrust reverser control systems are an example in which only part of the functionality is included in the EEC system. In such cases, the aircraft is configured to have separate switches and logic (independent from the EEC system) as part of the thrust reverser control system. This separation of reverser control system elements and logic provides an architectural means to limit the criticality of the functions provided by the EEC system.
(c) However, in some cases the EEC system may be configured to incorporate virtually all of a critical aircraft function. Examples of this “virtual completeness” in aircraft functionality are EEC systems that contain full authority to govern propeller speed in turboprop-powered aircraft and ATTCS systems in turbofan-powered aircraft.
1. The first of these is considered critical because, if an engine fails, the logic in the engine control must be configured to feather the propeller on that engine. Failure to rapidly feather the propeller following an engine failure results in excessive drag on the aircraft; such a condition could be critical to the aircraft.
Par 4-4 Page 4-3
2. The ATTCS system in turbofan-powered aircraft is considered critical because it is required to increase the thrust of the remaining engine(s) following an engine failure during take-off. The increased thrust on the remaining engines is necessary to achieve the required aircraft performance.
(d) All of these examples of integration involve aircraft functions that would receive significant review during aircraft certification.
(2) Engine Control Functions Integrated into Aircraft Systems. The trend toward systems integration may lead to aircraft systems performing functions traditionally considered part of the engine control.
(a) Some limited designs may have functions traditionally considered part of the engine control system provided by the aircraft, but the EEC system itself, which is part of the type design, provides all the functions required to safely operate the engine in accordance with parts 33, 35, and other applicable regulations. An example of such a “limited design” is an engine control that receives a torque output demand signal from the aircraft and responds by changing the engine’s fuel flow and other variables to meet that demand.
(b) Other designs may use aircraft systems to provide a significant number of the engine control system functions. An example of this design is the complex integration of flight and engine control systems (integrated in aircraft avionics units) that govern engine speed, rotor speed, rotor pitch angle, and rotor tilt angle in tilt-rotor aircraft.
(c) Functions provided by the engine system, which is part of the engine type design, would be certified with the engine; functions provided by the aircraft would be certified with the aircraft.
(d) In these designs, aircraft systems may be an integral part of engine regulatory compliance. In such cases, the engine applicant should specify the requirements for the EEC system and substantiate the adequacy of those requirements.
The applicant should define these requirements in the engine instructions for installation;
the requirements would then become part of the engine type design.
Page 4-4 Par 4-5
b. Certification Activities.
(1) Objective. To satisfy the aircraft requirements (§§ 901, 903, and 1309 of parts 23, 25, 27, and 29), the consequences of failures of the engine control system on the aircraft must be analyzed. The engine manufacturer and aircraft manufacturer should ensure that the software levels and safety and reliability objectives for the EEC system are consistent with the associated aircraft requirements. The use of electronic technology consistently results in greater integration of engine, propeller, and aircraft systems. For example, in some applications the EEC unit may integrate the control functions for the propeller, or the aircraft computers may integrate the engine control and the propeller control functions. The appropriate engine, propeller, and aircraft certificating offices should define the respective certification tasks of the engine, propeller, and aircraft manufacturers.
(2) Interface Definition and System Responsibilities. Interface definitions and system responsibilities should be identified in the appropriate documents for the functional and hardware and software aspects of the engine, propeller, and aircraft systems. The applicants should summarize these responsibilities in the respective engine, propeller, and aircraft certification plans. Specifically, the engine/propeller/aircraft documents should identify:
(a) Functional requirements and criticality (that may be based on engine, propeller and aircraft considerations).
(b) Fault accommodation strategies.
(c) Maintenance strategies.
(d) The software quality level (per function if necessary).
(e) The reliability objectives for:
1. LOTC events; and
2. Transmission of faulty parameters.
(f) The environmental requirements, including the degree of protection against lightning or other electromagnetic effects (for example, the level of induced voltages that can be supported at the interfaces).
(g) Engine, propeller, and aircraft interface data and characteristics.
(h) Aircraft electrical power supply requirements and characteristics (if relevant).
Par 4-5 Page 4-5
(3) Distribution of Compliance Tasks.
(a) The tasks for the certification of the aircraft propulsion system equipped with electronic controls should be shared between the engine, propeller, and aircraft manufacturers.
The manufacturers should identify the distribution of these tasks in their respective certification plans for the approval of the appropriate engine, propeller, and aircraft authorities.
1. The aircraft certification should address the overall integration of the engine and propeller in compliance with the applicable aircraft requirements.
2. The engine and propeller certification plans should address the functional aspects of the engine and propeller control systems for compliance with the applicable engine and propeller control system requirements.
(b) Evidence provided for engine certification could be used for aircraft certification, if appropriate. For example, if the applicant has demonstrated the quality of any aircraftimplemented software and aircraft/engine interface logic for engine or propeller certification, additional substantiation for aircraft certification should not be necessary.
(c) For example, if an EEC unit were performing the functions for the control of the engine and the functions for the control of the propeller:
1. The engine certification would address all general requirements such as software quality assurance procedures, EMI/lightning protection levels, and effects of loss of aircraft supplied power.
2. The engine certification would address the functional aspects for the engine functions such as safety analysis, rate for LOTC events, and effect of loss of aircraft supplied data. For example, the fault accommodation logic affecting the control of the engine would be reviewed at that time.
3. The propeller certification would similarly address the functional aspects for the propeller control functions. For example, the fault accommodation logic affecting the control of the propeller would be reviewed at that time.
4. In this example, the propeller functions and characteristics that the propeller manufacturer defines as provided by the engine control system would normally need to be refined during flight test. However, the propeller manufacturer is responsible for ensuring that these requirements that would be certificated as part of the engine certification program, although not refined during flight test, define an airworthy configuration. The Engine and Propeller Directorate Policy Regarding Integrated Full Authority Digital Engine Control (FADEC) and Electronic Propeller Control (EPC) Systems, dated June 30, 1995, provides additional clarification.
Page 4-6 Par 4-5
5. All manufacturers involved should agree on the change control process, so that changes to the engine control system that affect the propeller system or changes to the propeller control system that affect the engine control system do not lead to an inadvertent change to the type design of either system.
(d) For example, if an aircraft computer were performing the functions for the control of the engine, the propeller, or both:
1. The aircraft certification would address all general requirements such as software quality assurance procedures and EMI/lightning protection levels.
2. The aircraft certification would address the functional aspects for the aircraft functions.
3. The engine certification would address the functional aspects for the engine functions (such as safety analysis, rate for LOTC events, and effect of loss of aircraft supplied data). For example, the fault accommodation logic affecting the control of the engine would be reviewed at that time.
4. The propeller certification would address the functional aspects for the propeller control functions (such as safety analysis, contribution to LOTC events, and effect of loss of aircraft supplied data). For example, the fault accommodation logic affecting the control of the propeller would be reviewed at that time.
4-6. Fault Accommodation Logic. The applicant should perform an SSA to determine the adequacy of the EEC fault accommodation logic. The applicant should also demonstrate the functionality of the fault accommodation logic; this demonstration may be conducted as part of the system integration testing.
4-7. Control System Elements Mounted in the Aircraft. Elements of the control system that are mounted in the aircraft may be powered by and dedicated to the EEC, such as a throttle position transducer. In this case, the element would be considered an integral component of the EEC system, and faults should be accommodated as part of the EEC, rather than accommodated as aircraft-supplied data. The applicant should document the method used for addressing single and dual failures of these signals and demonstrate the fault accommodation for these signals. The demonstration may be conducted as part of the software integration testing during the EEC software verification testing.
Par 4-5 Page 4-7 (and 4-8)
CHAPTER 5. COMPLIANCE WITH SECTION 33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED POWER
5-1. Failure of Aircraft-Supplied Power. The following guidance provides a method, but not the only method, of compliance with §33.28(b) for failure of aircraft-supplied power for engines intended for multiple engine installations.
a. The applicant should demonstrate that the EEC control system can continue to function normally with the failure or interruption of aircraft-supplied power at any point within the declared engine operating envelope.
b. The capacity of any engine dedicated power source required for compliance with §33.28(b) should provide sufficient margin to ensure that the engine control system would continue to function in all anticipated engine operating conditions in which the control system is designed and expected to recover engine operation in-flight. This margin should account for any other anticipated variations in the output of the dedicated power source, such as those due to temperature variations, manufacturing tolerances, and idle speed variations. The applicant should substantiate the design margin by test, analysis, or a combination of both. This substantiation should consider deterioration over the life of the engine.
5-2. All Engine Out Restart Requirement. If aircraft-supplied battery power is required to meet an “all engine out” restart requirement, an analysis should result in a definition of the requirements for this aircraft-supplied power. In any application in which aircraft electrical power is used to operate the engine control system (such as low engine speed in-flight re-starting conditions), the effects of any aircraft electrical bus-switching transients or power transients associated with application of electrical loads, which could cause an interruption in voltage or a decay in voltage below that level required for proper control functioning, should be considered.
5-3. Exceptions. Some engine control functions that have traditionally relied exclusively upon aircraft electrical power are excepted from compliance with this aspect of §33.28(b) because their good service history indicates they provide an equivalent level of safety. The loss of power requirement of §33.28(b) applies to the ability to control the functions exempted, for example, anti-icing and ignition. The exception applies only to the electrical power necessary to drive the function. The applicant should define in the instruction manual the impact of the failure of aircraft-supplied electrical power on the output power or thrust characteristics of the engine throughout the flight envelope. The following are examples of these excepted functions:
a. Non-critical functions;
b. Engine start;
c. Ignition;
d. Thrust reverser;
Par 5-1 Page 5-1