e. Anti-icing; and
f. Fuel shut-off.
5-4. Aircraft-Supplied Power as Backup Power. In the event of an alternator failure, aircraftsupplied power may be used as a source of backup power for the dedicated engine-mounted alternator. If the control is not required to have a dedicated power source and uses aircraft power as its normal power supply (such as a system with a full hydromechanical back-up), and the transition from the electronic to the hydromechanical control is acceptable, then this does not apply.
5-5. Control Systems Integrated with Avionics. For control systems integrated with avionics, aircraft-supplied power may be used as primary power for the EEC. The power should be able to meet the EEC quality and reliability requirements for operating the engine under all normal electrical load conditions (such as no dropout during engine/APU start and bus switching). The EEC should also have backup power from a battery capable of allowing a safe landing after loss of all generators and alternators, without loss of engine control. The required amount of battery backup power should be determined from the maximum certificated altitude of the aircraft and should include at least one missed approach and go-around.
Page 5-2 Par 5-3
CHAPTER 6. SECTION 33.28(c)
6-1. Rule Text. Section 33.28(c) provides that each EEC must: “Be designed and constructed so that no single failure or malfunction, or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.”
6-2. Intent of Rule. Section 33.28(c) ensures that the complete engine control system, including the electrical and electronic parts, provides a system that is considered equivalent in safety and reliability to engine control systems that are based on hydromechanical technology.
a. Current regulations (based on hydromechanical technology) rely on testing and mechanical inspection intervals to ensure control system reliability and airworthy operation. Electronic technology does not lend itself to mechanical inspection. Therefore, to ensure safe operation after an electrical or electronic component failure, redundancy techniques and self-monitoring have been required in EEC systems to achieve equivalent control system integrity. The predicted reliability of the control system should be determined by completing a loss-of-thrust-control (LOTC) analysis of the system.
b. Previous EEC systems have used the design approach of showing that the EEC system is essentially single fault tolerant with respect to electrical or electronic failures when establishing safety and reliability equivalence to conventional hydromechanical systems. The word “essentially” is used because it may not be practical to accommodate all failures. In the TLD analysis a two to five percent default value is assigned in some cases to these uncovered faults for a full dual channel redundant system. The value used should be substantiated by tests, analysis, or both.
6-3. Compliance with §33.28(c). The objective in accepting the transition from hydromechanical control (HMC) technology to electronic control technology is to maintain at least an equivalent level of system reliability and safety. The following guidance provides a method, but not the only method, of compliance with §33.28(c).
a. Engine Controls for Different Aircraft and Rotorcraft Applications.
(1) Part 25 Aircraft Applications (and Part 23 Aircraft Applications Certifying to Part 25 Rules). For engines intended for use in transport aircraft, the criteria used in early certification programs to establish that an EEC had an equivalent level of safety and reliability to an HMC was that an EEC system should not cause more than one LOTC event per 100,000 engine operating hours. In addition, compliance with an LOTC criteria of 100,000 hours per event would generally meet the aircraft level requirement of §25.1309(b)(1). This section requires that any aircraft system failures that would prevent continued safe flight and landing of the airplane must be extremely improbable. EECs that comply with the LOTC criteria should comply with this aircraft rule (that is, have a failure probability of 10-5 for a flight duration of one hour that would yield the probability (10-5)2 for the failure of both EECs. This is less than the 10-9 failure limitation described in AC 25.1309-1A for catastrophic failures. Redundancy techniques may be Par 6-1 Page 6-1
provided in the system by electronic, HMC, or other means. Generally, engines designed for installation on transport category airplanes use a fully capable dual channel FADEC or a single channel FADEC with a fully capable HMC.
(2) Aircraft Applications Other Than Transport Category Aircraft. For applications other than transport category airplanes, such as general aviation aircraft certified under part 23 and both normal and transport category rotorcraft, certified under parts 27 and 29, the LOTC rate should be one event per 100,000 engine hours. However, criteria other than this rate may be appropriate, depending on the reliability demonstrated by the previous control systems used on those engines and provided that in-service experience has proven the reliability of those previous systems to be satisfactory. In this case, a rate equivalent to that of the HMC systems of more than one event per 100,000 engine hours may be acceptable. An LOTC rate of 40,000 hours has been shown to be acceptable for airplanes certified in the Normal, Utility, or Acrobatic categories under part 23. In addition, it may be acceptable to modify the upper limit of the LOTC criteria from the 90% defined for part 25 applications to 85%. This modification would be acceptable because the loss of one magneto in a dual magneto system for reciprocating engines has usually resulted in a maximum power loss of 15% and has historically been determined to be acceptable by the FAA in general aviation applications. Applicants proposing alternate LOTC rates should comply with guidance for hazard levels for system failures applicable to EEC system installation (see AC23.1309-1C). Turbine engine powered rotorcraft certificated under parts 27 and 29 have demonstrated a need for controls systems with a higher degree of integrity. The 100,000 hours integrity level would be appropriate for these applications.
b. Alternate Mode(s). The EEC systems should be essentially single fault tolerant with respect to electrical or electronic failures. In these systems, transfer to an alternate mode(s) should not be considered an LOTC event in the analysis, if the alternate mode(s) does not exceed the applicable LOTC guidelines in this AC. A functionally dissimilar hydromechanical or electronic system with reduced capability may be used to achieve an acceptable system reliability rate.
(1) The acceptability of these alternate modes should be assessed based on the following criteria:
(a) Compliance of the alternate mode with the requirements of part 33. Any exceptions should be identified and assessed with respect to proposed operational usage. Backup or alternate modes should not result in an unsafe condition.
(b) The failure rate from the primary control mode to the alternate mode.
(c) The LOTC rate of the control system.
Page 6-2 Par 6-3.a.
(d) Pilot workload and performance during transition to or operation in an alternate control mode. This issue may need evaluation at the aircraft level. The engine manufacturer should coordinate with the aircraft manufacturer and the ACO to determine if the alternate control modes comply with the applicable aircraft certification standards. These issues have been significant for some programs.
(2) The applicant should consider the following factors in the design and evaluation of any alternate control mode(s):
(a) Automatic protection from surge or lean limit blow-out.
(b) Acceleration and deceleration times.
(c) Altitude relight capability.
(d) Dormant failures of the alternate control mode and documentation of any automatic or manual checks to ensure the availability of the mode.
(e) Dispatchability, if any alternate modes are intended to be dispatchable.
c. Control System LOTC Analysis. The applicant should submit a system reliability analysis to substantiate the LOTC rate for the control system. The analysis should be a numerical analysis, such as a Markov model, fault tree or equivalent approach. The applicant should consider the following guidance for LOTC analyses:
(1) The analysis should address all components in the system that could contribute to LOTC events. This includes all electrical, mechanical, hydromechanical, and pneumatic elements of the system. This should also include aircraft signals or data used by the engine control when the failure or malfunction of those signals or data can contribute to LOTC events.
The analysis should also include failures and malfunctions that contribute to the transmission of incorrect information if that incorrect information would lead to a flight crew initiated engine shutdown or thrust reduction to a level within the LOTC definition. The fuel pump is generally not included, as it is usually considered part of the fuel delivery system. The system definition includes those sensors or elements that may not be part of the engine type design, but are dedicated to the system and contribute to LOTC events. An example of this is the throttle or power lever transducer, which is usually supplied by the installer. The engine instructions for installation should include reliability and interface requirements for these other than engine type design elements.
(2) The analysis should consider all fault types, including both covered and uncovered faults.
(3) The airworthiness limitations section of the engine instructions for continued airworthiness (ICA) should contain periodic maintenance actions necessary for finding and repairing both covered and uncovered fault conditions to meet the LOTC rate.
Par 6-3.b. Page 6-3
d. System Safety Analysis (SSA).
(1) The applicant should complete and have available for review and acceptance an SSA for the EEC control system, addressing all declared dispatchable control configurations. Data used in the SSA should be substantiated. The SSA should include, but not necessarily be limited to, the following events caused by engine control system malfunctions:
(a) Failures affecting thrust:
1. Loss of the ability to modulate power or thrust between the selected idle and 90 percent of maximum rated power or thrust at all operating conditions. This failure mode is considered an LOTC event. A fault that increases idle thrust too much may be a concern in the aircraft approach configuration, because it affects the aircraft’s ability to maintain the desired approach angle or glide-slope. A fault that decreases idle thrust too much may affect cowl antiicing and go-around thrust capabilities. Therefore, while faults that result in not setting the proper idle thrust do pose a concern, small deviations from the correct, selected idle thrust due to small sensor errors, for example, should be acceptable. The engine failure modes and effects analysis (FMEA) and the aircraft SSA should examine these conditions.
2. Engine shutdown (a subset of all LOTC events).
3. Unwanted changes in magnitude or direction of power or thrust.
4. Instability in the control of a critical function.
(b) Transmission of faulty parameters, including engine indications such as oil pressure, rotor speed, inter-turbine or exhaust gas temperature, or the engine’s thrust parameter.
(c) Unwanted action of a critical control function, such as deployment of reversers.
(d) Degraded capability of executing a critical function, such as failure to auto feather.
(e) Inability of the engine to meet part 33 requirements, such as loss of engine protection features.
(2) When applicable, the SSA should also provide failure rates for loss of ancillary control functions and engine indications that directly or indirectly lead to engine shutdown, such as the following:
(a) Stability augmentation.
(b) Oil, engine case, or component cooling.
Page 6-4 Par 6-3.d.
(3) The SSA should consider the extent of power or thrust changes resulting from undetected faults:
(a) When operating in the take-off envelope, an uncovered fault in the control system or undetected fault in an aircraft signal used by the engine control system that results in a thrust or power change of greater than 3% thrust loss would generally be considered unacceptable for engines in installations that are required to meet part 25 requirements that include “obstacle clearance” requirements. The 3% requirement may not apply to engines for parts 27 and 29 rotorcraft and part 23 (non-commuter) aircraft installations. The applicant should still ensure that the full-up system is capable of providing the declared minimum rated thrust or power during take-off. Such faults should be random and should be detectable and correctable during routine inspections, overhauls, or power-checks. The applicant may have valid reasons for proposing thrust change levels that result from faults in aircraft-supplied data instead of the levels in this AC. In addition, the applicant may show that the particular guidance is not applicable to the specific engine installation. The ECO will consider these proposals and decide for each program, on a case-by-case basis, if they comply with the definition of unacceptable change in power or thrust.
(b) Undetected faults in an aircraft signal that result in a thrust or power change greater than three percent should be declared in the approved engine instruction manual. This data should describe the magnitude of the thrust or power change and the flight condition associated with the condition. Undetected faults resulting in thrust or power changes larger than three percent have generally been considered acceptable when operating outside the take-off envelope.
In previous aircraft applications, these “outside the take-off envelope” thrust or power changes have been limited to less than approximately 15 percent and have been allowed in conditions involving high altitude, high-speed aircraft operations, or both.
(4) During take-off, detected faults in aircraft signals used by the engine control system that result in a thrust or power change of less than or equal to 10 percent may be acceptable if their frequencies of occurrence are relatively low. In previous applications, frequencies of less than 10 -5 events per flight hour have been accepted.
(5) Single or multiple electrical or electronic failures, as well as hydromechanical system failures, that cause a greater than 10 percent change in power or thrust should be included in the control system’s LOTC analysis. A safety factor or margin should be used for the frequencies of occurrences for single electrical or electronic failures that result in a greater than 10 percent thrust or power change when a field service database is not available to support the data used in the analysis. A factor of two is typically acceptable. If a single electrical or electronic failure can result in an engine configuration that does not comply with part 33, this should be included in the SSA. The frequencies of occurrence of single electrical or electronic failures that cause thrust or power changes of less than 10 percent, but greater than three percent, or result in the engine not meeting part 33 requirements, should be approved by the ECO.
Par 6-3.d. Page 6-5
(6) The SSA should provide an allowance for uncovered faults and their effects on the control system. This acknowledges the potential presence of faults that can affect thrust or power yet may not be recognized in the FMEA and SSA and, therefore, for which no fault accommodation is provided. Uncovered faults that can have a greater than 10 percent influence on engine thrust or power could lead to LOTC events. Therefore, the fault rate for these uncovered faults should be included in the LOTC analysis, and the rate used should be substantiated.
(7) If the SSA assumes that a particular crew action would reduce the impact of a fault condition, that assumed crew action should be clearly detailed in the instruction manual. This crew action may need to be validated at the aircraft level during aircraft certification. If the applicant requires a particular crew action to avoid an unsafe condition, the applicant should specify the display requirements associated with the failure condition in the instruction manual.
(8) The SSA should consider potential faults in aircraft wiring associated with the engine control. The engine instruction manual should state the effect of a grounding or over-voltage condition on any EEC system wiring caused by opens or shorts in that wiring to other aircraft wiring or structures. The manual should also note any dispatch configuration in which the open, short, or over-voltage condition would cause an LOTC event. In addition, opens and shorts in the engine harness wiring should be shown to result in a safe engine response by test, analysis, or both.
(9) The applicant should have an FMEA available for review. The FMEA can be based on a piece part failure analysis or a functional analysis. Since FMEAs are usually completed from a complete type design configuration, performing an FMEA by completing a piece part failure analysis on redundant electrical or electronic components may not be particularly useful because the result for most of these failures is “no effect.” To understand the failure modes of a redundant EEC system, the intent of the propulsion control system FMEA should be to understand the system with regard to single failures. The analysis should be focused on those single elements of the control that cause an impact on the control system and, therefore, on engine operation. Single electrical or electronic and mechanical or hydromechanical failures that affect the operation of the control system are of particular interest. These may include undetected or uncovered faults, as well as detected faults. Mechanical or hydromechanical failures that cause the engine to possibly increase in power or thrust and disable or reduce the capability of a protective function, like the overspeed protective function, should be investigated, and the design should be altered or changed to avoid such a situation. The FMEA should determine the criticality of single failures. Single electrical or electronic and mechanical or hydromechanical failures that should be considered include those that cause the control system to:
(a) Change engine power or thrust;
(b) Not respond to throttle inputs;
(c) Lose the capability of shutting off fuel;
Page 6-6 Par 6-3.d.
(d) Cause the engine to overspeed;
(e) Cause loss of a protective function;
(f) Cause the control to “fail fixed” or change modes; and
(g) Cause the control to fail to a state that requires pilot intervention.
e. Control Mode Transitions. Systems that use alternate control modes as a backup system, including supervisory control systems, should incorporate automatic control features to transfer to the alternate mode when electrical or electronic failures that are otherwise not accommodated in the normal mode are detected. In some applications a “fail fixed” fuel flow followed by a manually activated switch to the alternate mode has been accepted. In these applications, there should be provisions for announcing the “fail fixed” condition to the flight crew by cockpit instrumentation. The alternate mode may be implemented using hydromechanical, electrical or electronic means, or any combination of these. The power or thrust change associated with an automatic transfer to the alternate mode should be declared in the approved engine instruction manual. Generally, designs involving automatic transfers have been limited to thrust changes of less than approximately 10 percent. Thrust changes greater than 10 percent have been accepted when they result from a crew-selected transfer. Acceptable transition between all control modes should be demonstrated for engine certification. During development, transition between control modes should be flight-tested, if possible. If pilot action is required in the fault accommodation and transfer of control, the faults involved in such a situation should be declared in the engine instruction manual, and the condition(s) should be evaluated during aircraft certification. For transfers that occur automatically, the following factors should be considered:
(1) The frequency of occurrence of transfers to any alternate control mode. Computed frequencies of transfer to any alternate control modes should be supported with data from endurance or reliability testing, in-service experience on similar equipment, or other acceptable data.
(2) Faults that would result in transfer to any alternate mode, and the capability for detection of these faults.
(3) Self-test coverage and diagnostics. Sufficient self-test coverage and diagnostics should be provided to enable detection of error conditions that are critical to system performance.
(4) Time delays in the transfer of control. The engine instruction manual should indicate if there are time delays in the transfer of control. The engine certification engineer may not be able to determine that the mode transition provides a safe and acceptable system in accordance with part 33 based solely on analytical or simulation data. In those cases, the applicant should propose a brief flight test program to support the data. In any case, such control transition delays may or may not be acceptable for aircraft certification, depending on the installation. Therefore, Par 6-3.d. Page 6-7
the engine manufacturer should coordinate with the aircraft manufacturer and the aircraft certification office to evaluate this configuration early in the program. Control mode transitions should also be fully evaluated during aircraft certification.
(5) Availability of the alternate mode. If the alternate mode is not exercised during normal mode operation, an inspection interval or procedure for exercising the alternate mode should be specified to ensure that it remains functional and available. Inspection intervals or procedures may result in an operational limitation and will require the approval of the ECO.
(6) Provisions for signal(s) to indicate a mode transition.
f. Overspeed Protection System Requirements. For engine designs that require an overspeed protection control function, two categories of overspeed malfunction should be considered: those caused by shaft failure or loss of load, and those caused by control or fuel system failures. For shaft failure cases, the engine design may have some alternate methods of protection against rotor overspeed to comply with §33.75, such as “blade-shedding” or a “mash-and-clash” turbine design. In cases in which the basic engine design protects the rotor from an overspeed above structural limits, a control system overspeed protection system is usually unnecessary. If a control system overspeed protection function is necessary, the overspeed protection system should be evaluated with regard to its functionality and reliability as part of the engine control system.
(1) For overspeed protection systems, the following guidance provides one method, but not the only method, of compliance with both §§33.28 and 33.75.
(a) The combined engine and overspeed protection system should be at least two faults removed from a potential rotor burst event, when one of the faults induces the overspeed. In this respect, a potential rotor overspeed burst should only be possible as a result of a first fault inducing an overspeed and an independent fault preventing the overspeed protection system from operating.
(b) The analysis should show that the probability per engine flight hour of an uncontrolled overspeed condition from any cause in combination with overspeed protection system failure is one event per 100 million hours (a failure rate of 10 –8 events per hour). Due to the severity of an uncontained engine failure in some installations, certification of the aircraft may require the rate for this combined event to be demonstrated to be less than one event per billion hours (10–9).
(c) The failure rate of the overspeed protection system, itself, should be on the order of one event per 10,000 hours (E10-4).
(d) The probability of an inadvertent activation of the overspeed protection system should be commensurate with the fault consequences. The LOTC analysis should include the frequency of inadvertent activations of the overprotection protection system that cause a greater than 10% thrust or power change.
Page 6-8 Par 6-3.e.
(e) Overspeed protection is a necessary function for dispatch, required by §§33.28(c) and 33.75. Therefore, when the overspeed protection function is part of the control system, and its implementation involves the use of electrical or electronic components, a self-test of the overspeed protection system to ensure that the system is functional before each flight should be performed. Verification of the overspeed protection system at engine shutdown of the previous engine run has been acceptable.
(f) When multiple paths can invoke the overspeed protection system, a test of a different path should be performed each engine cycle, so that a complete test of the overspeed system can be achieved in a minimum number of engine cycles. If a path is found to be inoperative, the failure rate of the remaining path(s) should be less than 10-4 failures per hour, and combinations of failure leading to an uncontrolled overspeed event should still be extremely improbable. The control system should not be knowingly dispatched with the overspeed protection system failure rate greater than 10-4 failures per hour, or if the system is known to be inoperative.
(g) The applicant may provide data that demonstrates that the mechanical part of the overspeed protection system, such as the fuel shut-off mechanism, can operate without failures between stated periods. The applicant may also propose establishing a periodic inspection and test interval for the shut-off mechanism instead of testing the shut-off mechanism operation as part of the self-test conducted for each flight. When this approach is used, the self-test conducted for each flight should be limited to the electrical and electronic components of the overspeed protection system.
(h) Use of shared resources between the control system and the overspeed protection system should be evaluated. An analysis should show that the probability of faults of shared resources that could cause or contribute to an overspeed event as well as inhibit the overspeed protection function is extremely improbable, that is less than one event per billion engine flight hours (10E-09). Single failures should not cause such a condition. The overspeed protection system should be independent from the normal control.
(i) When the overspeed control function is implemented through mechanical or hydromechanical means only, such as a fly-ball governor system, a periodic inspection and test interval for compliance with the requirement for “continued system availability” is acceptable.
The periodic inspection and test interval should be based on test or in-service data that demonstrates that the system operates without failure between intervals.
(2) The overspeed malfunctions used in the failure analysis should be addressed when complying with §33.27.
Par 6-3.f. Page 6-9
g. Guidance for Use of Commercial or Industrial Grade Electronic Parts. Two recently published documents provide guidance on the application of commercial or industrial grade components: IEC/PAS 62239, Electronic Component Management Plans, edition 1.0, dated April 2001, and IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001. These should be used with the following guidance. When the engine type design specifies commercial or industrial grade electronic components, the applicant should have the following data available for review, as required:
(1) For each commercial and industrial grade electrical component specified in the design, reliability data that substantiates the failure rate for each component used in the EEC reliability analysis and the SSA.
(2) Procurement, quality assurance, and process control plans established for the vendorsupplied commercial and industrial grade parts. These plans should assure that the parts would maintain the reliability level specified in the approved engine type design.
(3) Unique databases for similar components procured from different vendors, because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard, such as military component standards
(4) Substantiation that the proposed extended range of the specified components is suitable for the application, if the declared installation temperature environment for the EEC is greater than that of the electronic components specified in the engine type design. Additionally, if commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required, the applicant should specify these provisions. Failure modes of the cooling provisions that cause these limits to be exceeded should be considered in determining the probability of failure.
h. Consideration of Local Events. When designing an electronic control system to meet the requirements of §33.28, the engine manufacturer should provide a control system with at least an equivalent level of safety and reliability as that of engines or propellers equipped with HMC systems. HMC systems have been shown to perform safely and reliably in the face of “local events.” In some cases, a comparison to HMC systems is not practical because the EEC system either provides functions not previously provided by HMC systems or is implemented differently. In these cases the acceptability of the effect of local events should be based on their effect on aircraft safe flight and landing. Examples of local events include: engine overheating conditions or fires, electrical problems, hydraulic and lubricating fluid leaks, and mechanical disruptions.
(1) Whatever the local event, the behavior of the EEC system should not cause a hazard to the continued safe flight and landing of the aircraft. Effects such as the control of the thrust reverser deployment, an overspeed of the engine, transients effects, or inadvertent propeller pitch change under any flight condition should be considered.
Page 6-10 Par 6-3.g.
(2) When demonstrating that local events do not cause a hazard to the continued safe flight and landing of the aircraft, the applicant should show that any other function necessary to provide protection would be available at the time of the local event and would not be rendered inoperative by the same local event (such as destruction of wires, ducts, or power supplies). This includes proposed designs in which the engine manufacturer assumes that the aircraft (or aircraft components) provides the necessary protection. This engine failure modes effects and criticality analysis (FMECA) should document this assumption.
(3) When the temperature to which the EEC is exposed is greater than the maximum safe design operating temperature declared by the engine manufacturer, an overheat condition results.
The electronic portions of the control should not cause a hazardous condition when the EEC is exposed to a continuous overheat or over-temperature condition, such as a duct burst or leak within a nacelle. Specific design features or analysis methods may be used to show compliance with respect to the prevention of hazardous effects. When this is not possible due to the variability or complexity of the failure sequence, acceptable testing may be required. Computer simulation techniques similar to those discussed for fire testing have also been acceptable. The compliance criteria requires that when the EEC system is exposed to an overheat condition, the system should not cause the engine to behave in an unsafe manner and should allow a safe engine shut down.
(4) To show compliance with fire as a local event, the EEC system must comply with fire test requirements when the system is located in a fire zone. Fire zones are defined in the appropriate aircraft certification standards. Fire requirements for the electronic parts of the EEC system are not covered precisely in the regulations with regard to the length of time they are required to function when exposed to fire. Therefore, the FAA has developed compliance criteria for EEC systems. When exposed to fire, the EEC system should allow a safe engine shut down without an unwanted action during the exposure that could become hazardous to the aircraft.
(a) The fuel handling parts of the EEC system, including the fuel shut-off valve (SOV), should comply with §33.17, which requires that these parts be fire resistant. Section 33.17 requires that the engine design minimize the probability of the occurrence and spread of fire.
Therefore, consideration should be given to those parts of the EEC system that control airflow, which could fail and contribute to the fire when the system is exposed to fire.
(b) In addition, §33.75 requires that fire cannot cause the engine to lose the capability to shut down. For system designs that depend on electric power to actuate the SOV, high temperature wire or other protective means should be used to ensure that the capability to shut down the engine is maintained when the EEC is exposed to fire.
(c) To demonstrate compliance with fire resistance requirements, computer simulations of EEC exposure to fire may be used instead of fire tests on production hardware. Approved computer simulations should be validated by analysis, test, or both, including all assumptions upon which the computer simulation is based.
Par 6-3.h. Page 6-11