CHAPTER 4. COMPLIANCE WITH SECTION 33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED DATA
4-1. Failure of Aircraft-Supplied Data. The following guidance provides a method, but not the only method, of compliance with §33.28(b) for failure of aircraft-supplied data. The applicant should define in the instruction manual the effect of the failure of aircraft-supplied data on the engine’s output power or thrust characteristic throughout the flight envelope. That data should be provided for all allowable engine control and aircraft dispatch configurations in which the loss of aircraft power or data in that dispatch configuration would result in a different engine control system response.
4-2. System Configurations. Examples of system configurations that have been found to be acceptable under §33.28(b) include the following:
a. Dual Sources. A system may use dual sources of aircraft-supplied data with local engine sensors provided as “voters” and alternate data sources. Sensors that act as “voters” provide a method for the EEC system to determine if one of the primary data sources is providing erroneous data, and to then eliminate that erroneous source from consideration. In the event of a failure in the aircraft-supplied data, the engine sensors act as the primary source of sensed data through the fault accommodation logic. In the event of the loss of this engine-sensed data, the system uses modeled or synthesized parameters.
b. Synthesized Engine Parameters. In some cases, a system may use synthesized engine parameters as voters. The applicant should provide data that gives the worst case percentage change of power or thrust over the declared operating envelope when inaccuracies of the synthesizing process are considered, as well as the environmental effects on the sensors used in the synthesis.
c. Third Source. A system may use a third source of aircraft-supplied data as the voter instead of engine sensors. In this case, when aircraft data is used exclusively, the applicant should address the following items, as applicable, in the SSA or other appropriate documents:
(1) Software in the data path to the EEC should be at a level consistent with that defined for the EEC. The data path may include other aircraft equipment, such as aircraft air data computers (ADC), thrust management computers, or other avionics equipment.
(2) The applicant should state in the instruction manual that the aircraft manufacturer must ensure that changes to aircraft equipment, including software, in the data path to the engine do not affect the integrity of the data provided to the engine as defined by the instruction manual.
(3) If dispatchability of the aircraft without the third source is anticipated, the applicant should provide analysis that demonstrates the acceptability of this dispatch configuration for the minimum maintenance equipment list (MMEL) or the TLD documents, as applicable.
Par 4-1 Page 4-1
(4) Since aircraft-supplied data has an effect on EEC system operation, the applicant should supply the effects of faulty and corrupted aircraft data on the EEC system in the engine instruction manual. In the three ADC configuration the EEC system could be significantly affected by erroneous or faulty air data information; the engine could experience a significant thrust or power change during such a condition. If this is the case, the applicant should indicate in the instruction manual that air data information, and any other aircraft information that could have a significant impact on engine thrust or power, is considered critical to EEC system operation. Therefore, the instruction manual should state that the installer should ensure that those sensors and equipment involved in delivering information to the EECs are capable of operating in the “severe” HIRF and lightning environments, as defined in the certification basis for the aircraft, without affecting their proper and continued operation.
(5) The applicant should state the reliability level for the aircraft-supplied data that was used as part of the SSA and LOTC analysis as an “assumed value” in the instruction manual.
4-3. Complete Loss of ADC Inputs. The applicant should provide fault accommodation logic for the complete loss of ADC inputs or other aircraft-supplied data, even though this loss may be extremely improbable. In this case, the applicant should conduct sufficient testing or analysis, or both, on the fault accommodated control mode to establish that the engine operating characteristics comply with all operability requirements of part 33.
4-4. Common Mode Faults. In the exchange of data with the aircraft, consideration should be given to elimination of unacceptable common mode faults affecting the operation of more than one engine or propeller. This AC describes limits for unacceptable common mode faults that affect power or thrust in the discussion of §33.28(c). Common faults that affect engine protection limit systems or could hazard the aircraft would generally be unacceptable. The applicant should demonstrate the logic included in the control system to accommodate common faults. Any precautions needed to address common effects should be taken either through the aircraft system architecture or by logic internal to the engine control system. This should be demonstrated as part of the software integration testing during the EEC software verification or EEC system validation test program. Specifically, the applicant should consider the following cases:
a. Erroneous data received from the aircraft by the engine or propeller control system, if the data source is common to more than one engine or propeller; for example, air data sources, autothrottle systems, and synchronizing controls.
b. Control system operating faults propagating through data links between engine or propeller; for example, maintenance recording, common bus, cross-talk, auto-feathering, and automatic power reserve system.
c. Loss or interruption of aircraft data or electrical power used by the engine control, when that loss or interruption is caused by the failure of another engine.
Page 4-2 Par 4-2
d. Exchange of data between engines to implement control functions, (for example, load sharing and synchrophasing) should be shown to incorporate authority limits to prevent unacceptable common mode loss of power or thrust.
4-5. System Integration. The trend toward system integration may result in EEC systems that use resources distributed within the aircraft in addition to aircraft-supplied data. In these cases, the office responsible for certifying the engine would expect the engine manufacturer to specify the requirements for the EEC system and substantiate the adequacy of those requirements. The engine manufacturer should specify these requirements in the engine instruction manual to ensure that the engine certification basis is maintained.
a. Integration Activities.
(1) Aircraft Functions Integrated into the Engine Control System. This activity involves the integration of aircraft and propeller control functions (that is, those that have traditionally not been considered engine control functions) into the EEC system’s hardware and software.
(a) Examples of this integration include: thrust reverser controls; propeller speed governors, which govern speed by varying pitch; and ATTCS systems. When this type of integration activity is pursued, the EEC system becomes part of, and should be included in, the aircraft’s SSA. Although the aircraft functions incorporated into the EEC system may receive review at engine certification, the acceptability of the safety analysis involving these functions would be determined at aircraft certification.
(b) The EEC system may be configured to contain only part of the aircraft system’s functionality, or it may contain virtually all of it. Thrust reverser control systems are an example in which only part of the functionality is included in the EEC system. In such cases, the aircraft is configured to have separate switches and logic (independent from the EEC system) as part of the thrust reverser control system. This separation of reverser control system elements and logic provides an architectural means to limit the criticality of the functions provided by the EEC system.
(c) However, in some cases the EEC system may be configured to incorporate virtually all of a critical aircraft function. Examples of this “virtual completeness” in aircraft functionality are EEC systems that contain full authority to govern propeller speed in turboprop-powered aircraft and ATTCS systems in turbofan-powered aircraft.
1. The first of these is considered critical because, if an engine fails, the logic in the engine control must be configured to feather the propeller on that engine. Failure to rapidly feather the propeller following an engine failure results in excessive drag on the aircraft; such a condition could be critical to the aircraft.
Par 4-4 Page 4-3
2. The ATTCS system in turbofan-powered aircraft is considered critical because it is required to increase the thrust of the remaining engine(s) following an engine failure during take-off. The increased thrust on the remaining engines is necessary to achieve the required aircraft performance.
(d) All of these examples of integration involve aircraft functions that would receive significant review during aircraft certification.
(2) Engine Control Functions Integrated into Aircraft Systems. The trend toward systems integration may lead to aircraft systems performing functions traditionally considered part of the engine control.
(a) Some limited designs may have functions traditionally considered part of the engine control system provided by the aircraft, but the EEC system itself, which is part of the type design, provides all the functions required to safely operate the engine in accordance with parts 33, 35, and other applicable regulations. An example of such a “limited design” is an engine control that receives a torque output demand signal from the aircraft and responds by changing the engine’s fuel flow and other variables to meet that demand.
(b) Other designs may use aircraft systems to provide a significant number of the engine control system functions. An example of this design is the complex integration of flight and engine control systems (integrated in aircraft avionics units) that govern engine speed, rotor speed, rotor pitch angle, and rotor tilt angle in tilt-rotor aircraft.
(c) Functions provided by the engine system, which is part of the engine type design, would be certified with the engine; functions provided by the aircraft would be certified with the aircraft.
(d) In these designs, aircraft systems may be an integral part of engine regulatory compliance. In such cases, the engine applicant should specify the requirements for the EEC system and substantiate the adequacy of those requirements.
The applicant should define these requirements in the engine instructions for installation;
the requirements would then become part of the engine type design.
Page 4-4 Par 4-5
b. Certification Activities.
(1) Objective. To satisfy the aircraft requirements (§§ 901, 903, and 1309 of parts 23, 25, 27, and 29), the consequences of failures of the engine control system on the aircraft must be analyzed. The engine manufacturer and aircraft manufacturer should ensure that the software levels and safety and reliability objectives for the EEC system are consistent with the associated aircraft requirements. The use of electronic technology consistently results in greater integration of engine, propeller, and aircraft systems. For example, in some applications the EEC unit may integrate the control functions for the propeller, or the aircraft computers may integrate the engine control and the propeller control functions. The appropriate engine, propeller, and aircraft certificating offices should define the respective certification tasks of the engine, propeller, and aircraft manufacturers.
(2) Interface Definition and System Responsibilities. Interface definitions and system responsibilities should be identified in the appropriate documents for the functional and hardware and software aspects of the engine, propeller, and aircraft systems. The applicants should summarize these responsibilities in the respective engine, propeller, and aircraft certification plans. Specifically, the engine/propeller/aircraft documents should identify:
(a) Functional requirements and criticality (that may be based on engine, propeller and aircraft considerations).
(b) Fault accommodation strategies.
(c) Maintenance strategies.
(d) The software quality level (per function if necessary).
(e) The reliability objectives for:
1. LOTC events; and
2. Transmission of faulty parameters.
(f) The environmental requirements, including the degree of protection against lightning or other electromagnetic effects (for example, the level of induced voltages that can be supported at the interfaces).
(g) Engine, propeller, and aircraft interface data and characteristics.
(h) Aircraft electrical power supply requirements and characteristics (if relevant).
Par 4-5 Page 4-5
(3) Distribution of Compliance Tasks.
(a) The tasks for the certification of the aircraft propulsion system equipped with electronic controls should be shared between the engine, propeller, and aircraft manufacturers.
The manufacturers should identify the distribution of these tasks in their respective certification plans for the approval of the appropriate engine, propeller, and aircraft authorities.
1. The aircraft certification should address the overall integration of the engine and propeller in compliance with the applicable aircraft requirements.
2. The engine and propeller certification plans should address the functional aspects of the engine and propeller control systems for compliance with the applicable engine and propeller control system requirements.
(b) Evidence provided for engine certification could be used for aircraft certification, if appropriate. For example, if the applicant has demonstrated the quality of any aircraftimplemented software and aircraft/engine interface logic for engine or propeller certification, additional substantiation for aircraft certification should not be necessary.
(c) For example, if an EEC unit were performing the functions for the control of the engine and the functions for the control of the propeller:
1. The engine certification would address all general requirements such as software quality assurance procedures, EMI/lightning protection levels, and effects of loss of aircraft supplied power.
2. The engine certification would address the functional aspects for the engine functions such as safety analysis, rate for LOTC events, and effect of loss of aircraft supplied data. For example, the fault accommodation logic affecting the control of the engine would be reviewed at that time.
3. The propeller certification would similarly address the functional aspects for the propeller control functions. For example, the fault accommodation logic affecting the control of the propeller would be reviewed at that time.
4. In this example, the propeller functions and characteristics that the propeller manufacturer defines as provided by the engine control system would normally need to be refined during flight test. However, the propeller manufacturer is responsible for ensuring that these requirements that would be certificated as part of the engine certification program, although not refined during flight test, define an airworthy configuration. The Engine and Propeller Directorate Policy Regarding Integrated Full Authority Digital Engine Control (FADEC) and Electronic Propeller Control (EPC) Systems, dated June 30, 1995, provides additional clarification.
Page 4-6 Par 4-5
5. All manufacturers involved should agree on the change control process, so that changes to the engine control system that affect the propeller system or changes to the propeller control system that affect the engine control system do not lead to an inadvertent change to the type design of either system.
(d) For example, if an aircraft computer were performing the functions for the control of the engine, the propeller, or both:
1. The aircraft certification would address all general requirements such as software quality assurance procedures and EMI/lightning protection levels.
2. The aircraft certification would address the functional aspects for the aircraft functions.
3. The engine certification would address the functional aspects for the engine functions (such as safety analysis, rate for LOTC events, and effect of loss of aircraft supplied data). For example, the fault accommodation logic affecting the control of the engine would be reviewed at that time.
4. The propeller certification would address the functional aspects for the propeller control functions (such as safety analysis, contribution to LOTC events, and effect of loss of aircraft supplied data). For example, the fault accommodation logic affecting the control of the propeller would be reviewed at that time.
4-6. Fault Accommodation Logic. The applicant should perform an SSA to determine the adequacy of the EEC fault accommodation logic. The applicant should also demonstrate the functionality of the fault accommodation logic; this demonstration may be conducted as part of the system integration testing.
4-7. Control System Elements Mounted in the Aircraft. Elements of the control system that are mounted in the aircraft may be powered by and dedicated to the EEC, such as a throttle position transducer. In this case, the element would be considered an integral component of the EEC system, and faults should be accommodated as part of the EEC, rather than accommodated as aircraft-supplied data. The applicant should document the method used for addressing single and dual failures of these signals and demonstrate the fault accommodation for these signals. The demonstration may be conducted as part of the software integration testing during the EEC software verification testing.
Par 4-5 Page 4-7 (and 4-8)
CHAPTER 5. COMPLIANCE WITH SECTION 33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED POWER
5-1. Failure of Aircraft-Supplied Power. The following guidance provides a method, but not the only method, of compliance with §33.28(b) for failure of aircraft-supplied power for engines intended for multiple engine installations.
a. The applicant should demonstrate that the EEC control system can continue to function normally with the failure or interruption of aircraft-supplied power at any point within the declared engine operating envelope.
b. The capacity of any engine dedicated power source required for compliance with §33.28(b) should provide sufficient margin to ensure that the engine control system would continue to function in all anticipated engine operating conditions in which the control system is designed and expected to recover engine operation in-flight. This margin should account for any other anticipated variations in the output of the dedicated power source, such as those due to temperature variations, manufacturing tolerances, and idle speed variations. The applicant should substantiate the design margin by test, analysis, or a combination of both. This substantiation should consider deterioration over the life of the engine.
5-2. All Engine Out Restart Requirement. If aircraft-supplied battery power is required to meet an “all engine out” restart requirement, an analysis should result in a definition of the requirements for this aircraft-supplied power. In any application in which aircraft electrical power is used to operate the engine control system (such as low engine speed in-flight re-starting conditions), the effects of any aircraft electrical bus-switching transients or power transients associated with application of electrical loads, which could cause an interruption in voltage or a decay in voltage below that level required for proper control functioning, should be considered.
5-3. Exceptions. Some engine control functions that have traditionally relied exclusively upon aircraft electrical power are excepted from compliance with this aspect of §33.28(b) because their good service history indicates they provide an equivalent level of safety. The loss of power requirement of §33.28(b) applies to the ability to control the functions exempted, for example, anti-icing and ignition. The exception applies only to the electrical power necessary to drive the function. The applicant should define in the instruction manual the impact of the failure of aircraft-supplied electrical power on the output power or thrust characteristics of the engine throughout the flight envelope. The following are examples of these excepted functions:
a. Non-critical functions;
b. Engine start;
c. Ignition;
d. Thrust reverser;
Par 5-1 Page 5-1
e. Anti-icing; and
f. Fuel shut-off.
5-4. Aircraft-Supplied Power as Backup Power. In the event of an alternator failure, aircraftsupplied power may be used as a source of backup power for the dedicated engine-mounted alternator. If the control is not required to have a dedicated power source and uses aircraft power as its normal power supply (such as a system with a full hydromechanical back-up), and the transition from the electronic to the hydromechanical control is acceptable, then this does not apply.
5-5. Control Systems Integrated with Avionics. For control systems integrated with avionics, aircraft-supplied power may be used as primary power for the EEC. The power should be able to meet the EEC quality and reliability requirements for operating the engine under all normal electrical load conditions (such as no dropout during engine/APU start and bus switching). The EEC should also have backup power from a battery capable of allowing a safe landing after loss of all generators and alternators, without loss of engine control. The required amount of battery backup power should be determined from the maximum certificated altitude of the aircraft and should include at least one missed approach and go-around.
Page 5-2 Par 5-3
CHAPTER 6. SECTION 33.28(c)
6-1. Rule Text. Section 33.28(c) provides that each EEC must: “Be designed and constructed so that no single failure or malfunction, or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.”
6-2. Intent of Rule. Section 33.28(c) ensures that the complete engine control system, including the electrical and electronic parts, provides a system that is considered equivalent in safety and reliability to engine control systems that are based on hydromechanical technology.
a. Current regulations (based on hydromechanical technology) rely on testing and mechanical inspection intervals to ensure control system reliability and airworthy operation. Electronic technology does not lend itself to mechanical inspection. Therefore, to ensure safe operation after an electrical or electronic component failure, redundancy techniques and self-monitoring have been required in EEC systems to achieve equivalent control system integrity. The predicted reliability of the control system should be determined by completing a loss-of-thrust-control (LOTC) analysis of the system.
b. Previous EEC systems have used the design approach of showing that the EEC system is essentially single fault tolerant with respect to electrical or electronic failures when establishing safety and reliability equivalence to conventional hydromechanical systems. The word “essentially” is used because it may not be practical to accommodate all failures. In the TLD analysis a two to five percent default value is assigned in some cases to these uncovered faults for a full dual channel redundant system. The value used should be substantiated by tests, analysis, or both.
6-3. Compliance with §33.28(c). The objective in accepting the transition from hydromechanical control (HMC) technology to electronic control technology is to maintain at least an equivalent level of system reliability and safety. The following guidance provides a method, but not the only method, of compliance with §33.28(c).
a. Engine Controls for Different Aircraft and Rotorcraft Applications.
(1) Part 25 Aircraft Applications (and Part 23 Aircraft Applications Certifying to Part 25 Rules). For engines intended for use in transport aircraft, the criteria used in early certification programs to establish that an EEC had an equivalent level of safety and reliability to an HMC was that an EEC system should not cause more than one LOTC event per 100,000 engine operating hours. In addition, compliance with an LOTC criteria of 100,000 hours per event would generally meet the aircraft level requirement of §25.1309(b)(1). This section requires that any aircraft system failures that would prevent continued safe flight and landing of the airplane must be extremely improbable. EECs that comply with the LOTC criteria should comply with this aircraft rule (that is, have a failure probability of 10-5 for a flight duration of one hour that would yield the probability (10-5)2 for the failure of both EECs. This is less than the 10-9 failure limitation described in AC 25.1309-1A for catastrophic failures. Redundancy techniques may be Par 6-1 Page 6-1
provided in the system by electronic, HMC, or other means. Generally, engines designed for installation on transport category airplanes use a fully capable dual channel FADEC or a single channel FADEC with a fully capable HMC.
(2) Aircraft Applications Other Than Transport Category Aircraft. For applications other than transport category airplanes, such as general aviation aircraft certified under part 23 and both normal and transport category rotorcraft, certified under parts 27 and 29, the LOTC rate should be one event per 100,000 engine hours. However, criteria other than this rate may be appropriate, depending on the reliability demonstrated by the previous control systems used on those engines and provided that in-service experience has proven the reliability of those previous systems to be satisfactory. In this case, a rate equivalent to that of the HMC systems of more than one event per 100,000 engine hours may be acceptable. An LOTC rate of 40,000 hours has been shown to be acceptable for airplanes certified in the Normal, Utility, or Acrobatic categories under part 23. In addition, it may be acceptable to modify the upper limit of the LOTC criteria from the 90% defined for part 25 applications to 85%. This modification would be acceptable because the loss of one magneto in a dual magneto system for reciprocating engines has usually resulted in a maximum power loss of 15% and has historically been determined to be acceptable by the FAA in general aviation applications. Applicants proposing alternate LOTC rates should comply with guidance for hazard levels for system failures applicable to EEC system installation (see AC23.1309-1C). Turbine engine powered rotorcraft certificated under parts 27 and 29 have demonstrated a need for controls systems with a higher degree of integrity. The 100,000 hours integrity level would be appropriate for these applications.
b. Alternate Mode(s). The EEC systems should be essentially single fault tolerant with respect to electrical or electronic failures. In these systems, transfer to an alternate mode(s) should not be considered an LOTC event in the analysis, if the alternate mode(s) does not exceed the applicable LOTC guidelines in this AC. A functionally dissimilar hydromechanical or electronic system with reduced capability may be used to achieve an acceptable system reliability rate.
(1) The acceptability of these alternate modes should be assessed based on the following criteria:
(a) Compliance of the alternate mode with the requirements of part 33. Any exceptions should be identified and assessed with respect to proposed operational usage. Backup or alternate modes should not result in an unsafe condition.
(b) The failure rate from the primary control mode to the alternate mode.
(c) The LOTC rate of the control system.
Page 6-2 Par 6-3.a.
(d) Pilot workload and performance during transition to or operation in an alternate control mode. This issue may need evaluation at the aircraft level. The engine manufacturer should coordinate with the aircraft manufacturer and the ACO to determine if the alternate control modes comply with the applicable aircraft certification standards. These issues have been significant for some programs.
(2) The applicant should consider the following factors in the design and evaluation of any alternate control mode(s):
(a) Automatic protection from surge or lean limit blow-out.
(b) Acceleration and deceleration times.
(c) Altitude relight capability.
(d) Dormant failures of the alternate control mode and documentation of any automatic or manual checks to ensure the availability of the mode.
(e) Dispatchability, if any alternate modes are intended to be dispatchable.
c. Control System LOTC Analysis. The applicant should submit a system reliability analysis to substantiate the LOTC rate for the control system. The analysis should be a numerical analysis, such as a Markov model, fault tree or equivalent approach. The applicant should consider the following guidance for LOTC analyses:
(1) The analysis should address all components in the system that could contribute to LOTC events. This includes all electrical, mechanical, hydromechanical, and pneumatic elements of the system. This should also include aircraft signals or data used by the engine control when the failure or malfunction of those signals or data can contribute to LOTC events.
The analysis should also include failures and malfunctions that contribute to the transmission of incorrect information if that incorrect information would lead to a flight crew initiated engine shutdown or thrust reduction to a level within the LOTC definition. The fuel pump is generally not included, as it is usually considered part of the fuel delivery system. The system definition includes those sensors or elements that may not be part of the engine type design, but are dedicated to the system and contribute to LOTC events. An example of this is the throttle or power lever transducer, which is usually supplied by the installer. The engine instructions for installation should include reliability and interface requirements for these other than engine type design elements.
(2) The analysis should consider all fault types, including both covered and uncovered faults.
(3) The airworthiness limitations section of the engine instructions for continued airworthiness (ICA) should contain periodic maintenance actions necessary for finding and repairing both covered and uncovered fault conditions to meet the LOTC rate.
Par 6-3.b. Page 6-3