d. System Safety Analysis (SSA).
(1) The applicant should complete and have available for review and acceptance an SSA for the EEC control system, addressing all declared dispatchable control configurations. Data used in the SSA should be substantiated. The SSA should include, but not necessarily be limited to, the following events caused by engine control system malfunctions:
(a) Failures affecting thrust:
1. Loss of the ability to modulate power or thrust between the selected idle and 90 percent of maximum rated power or thrust at all operating conditions. This failure mode is considered an LOTC event. A fault that increases idle thrust too much may be a concern in the aircraft approach configuration, because it affects the aircraft’s ability to maintain the desired approach angle or glide-slope. A fault that decreases idle thrust too much may affect cowl antiicing and go-around thrust capabilities. Therefore, while faults that result in not setting the proper idle thrust do pose a concern, small deviations from the correct, selected idle thrust due to small sensor errors, for example, should be acceptable. The engine failure modes and effects analysis (FMEA) and the aircraft SSA should examine these conditions.
2. Engine shutdown (a subset of all LOTC events).
3. Unwanted changes in magnitude or direction of power or thrust.
4. Instability in the control of a critical function.
(b) Transmission of faulty parameters, including engine indications such as oil pressure, rotor speed, inter-turbine or exhaust gas temperature, or the engine’s thrust parameter.
(c) Unwanted action of a critical control function, such as deployment of reversers.
(d) Degraded capability of executing a critical function, such as failure to auto feather.
(e) Inability of the engine to meet part 33 requirements, such as loss of engine protection features.
(2) When applicable, the SSA should also provide failure rates for loss of ancillary control functions and engine indications that directly or indirectly lead to engine shutdown, such as the following:
(a) Stability augmentation.
(b) Oil, engine case, or component cooling.
Page 6-4 Par 6-3.d.
(3) The SSA should consider the extent of power or thrust changes resulting from undetected faults:
(a) When operating in the take-off envelope, an uncovered fault in the control system or undetected fault in an aircraft signal used by the engine control system that results in a thrust or power change of greater than 3% thrust loss would generally be considered unacceptable for engines in installations that are required to meet part 25 requirements that include “obstacle clearance” requirements. The 3% requirement may not apply to engines for parts 27 and 29 rotorcraft and part 23 (non-commuter) aircraft installations. The applicant should still ensure that the full-up system is capable of providing the declared minimum rated thrust or power during take-off. Such faults should be random and should be detectable and correctable during routine inspections, overhauls, or power-checks. The applicant may have valid reasons for proposing thrust change levels that result from faults in aircraft-supplied data instead of the levels in this AC. In addition, the applicant may show that the particular guidance is not applicable to the specific engine installation. The ECO will consider these proposals and decide for each program, on a case-by-case basis, if they comply with the definition of unacceptable change in power or thrust.
(b) Undetected faults in an aircraft signal that result in a thrust or power change greater than three percent should be declared in the approved engine instruction manual. This data should describe the magnitude of the thrust or power change and the flight condition associated with the condition. Undetected faults resulting in thrust or power changes larger than three percent have generally been considered acceptable when operating outside the take-off envelope.
In previous aircraft applications, these “outside the take-off envelope” thrust or power changes have been limited to less than approximately 15 percent and have been allowed in conditions involving high altitude, high-speed aircraft operations, or both.
(4) During take-off, detected faults in aircraft signals used by the engine control system that result in a thrust or power change of less than or equal to 10 percent may be acceptable if their frequencies of occurrence are relatively low. In previous applications, frequencies of less than 10 -5 events per flight hour have been accepted.
(5) Single or multiple electrical or electronic failures, as well as hydromechanical system failures, that cause a greater than 10 percent change in power or thrust should be included in the control system’s LOTC analysis. A safety factor or margin should be used for the frequencies of occurrences for single electrical or electronic failures that result in a greater than 10 percent thrust or power change when a field service database is not available to support the data used in the analysis. A factor of two is typically acceptable. If a single electrical or electronic failure can result in an engine configuration that does not comply with part 33, this should be included in the SSA. The frequencies of occurrence of single electrical or electronic failures that cause thrust or power changes of less than 10 percent, but greater than three percent, or result in the engine not meeting part 33 requirements, should be approved by the ECO.
Par 6-3.d. Page 6-5
(6) The SSA should provide an allowance for uncovered faults and their effects on the control system. This acknowledges the potential presence of faults that can affect thrust or power yet may not be recognized in the FMEA and SSA and, therefore, for which no fault accommodation is provided. Uncovered faults that can have a greater than 10 percent influence on engine thrust or power could lead to LOTC events. Therefore, the fault rate for these uncovered faults should be included in the LOTC analysis, and the rate used should be substantiated.
(7) If the SSA assumes that a particular crew action would reduce the impact of a fault condition, that assumed crew action should be clearly detailed in the instruction manual. This crew action may need to be validated at the aircraft level during aircraft certification. If the applicant requires a particular crew action to avoid an unsafe condition, the applicant should specify the display requirements associated with the failure condition in the instruction manual.
(8) The SSA should consider potential faults in aircraft wiring associated with the engine control. The engine instruction manual should state the effect of a grounding or over-voltage condition on any EEC system wiring caused by opens or shorts in that wiring to other aircraft wiring or structures. The manual should also note any dispatch configuration in which the open, short, or over-voltage condition would cause an LOTC event. In addition, opens and shorts in the engine harness wiring should be shown to result in a safe engine response by test, analysis, or both.
(9) The applicant should have an FMEA available for review. The FMEA can be based on a piece part failure analysis or a functional analysis. Since FMEAs are usually completed from a complete type design configuration, performing an FMEA by completing a piece part failure analysis on redundant electrical or electronic components may not be particularly useful because the result for most of these failures is “no effect.” To understand the failure modes of a redundant EEC system, the intent of the propulsion control system FMEA should be to understand the system with regard to single failures. The analysis should be focused on those single elements of the control that cause an impact on the control system and, therefore, on engine operation. Single electrical or electronic and mechanical or hydromechanical failures that affect the operation of the control system are of particular interest. These may include undetected or uncovered faults, as well as detected faults. Mechanical or hydromechanical failures that cause the engine to possibly increase in power or thrust and disable or reduce the capability of a protective function, like the overspeed protective function, should be investigated, and the design should be altered or changed to avoid such a situation. The FMEA should determine the criticality of single failures. Single electrical or electronic and mechanical or hydromechanical failures that should be considered include those that cause the control system to:
(a) Change engine power or thrust;
(b) Not respond to throttle inputs;
(c) Lose the capability of shutting off fuel;
Page 6-6 Par 6-3.d.
(d) Cause the engine to overspeed;
(e) Cause loss of a protective function;
(f) Cause the control to “fail fixed” or change modes; and
(g) Cause the control to fail to a state that requires pilot intervention.
e. Control Mode Transitions. Systems that use alternate control modes as a backup system, including supervisory control systems, should incorporate automatic control features to transfer to the alternate mode when electrical or electronic failures that are otherwise not accommodated in the normal mode are detected. In some applications a “fail fixed” fuel flow followed by a manually activated switch to the alternate mode has been accepted. In these applications, there should be provisions for announcing the “fail fixed” condition to the flight crew by cockpit instrumentation. The alternate mode may be implemented using hydromechanical, electrical or electronic means, or any combination of these. The power or thrust change associated with an automatic transfer to the alternate mode should be declared in the approved engine instruction manual. Generally, designs involving automatic transfers have been limited to thrust changes of less than approximately 10 percent. Thrust changes greater than 10 percent have been accepted when they result from a crew-selected transfer. Acceptable transition between all control modes should be demonstrated for engine certification. During development, transition between control modes should be flight-tested, if possible. If pilot action is required in the fault accommodation and transfer of control, the faults involved in such a situation should be declared in the engine instruction manual, and the condition(s) should be evaluated during aircraft certification. For transfers that occur automatically, the following factors should be considered:
(1) The frequency of occurrence of transfers to any alternate control mode. Computed frequencies of transfer to any alternate control modes should be supported with data from endurance or reliability testing, in-service experience on similar equipment, or other acceptable data.
(2) Faults that would result in transfer to any alternate mode, and the capability for detection of these faults.
(3) Self-test coverage and diagnostics. Sufficient self-test coverage and diagnostics should be provided to enable detection of error conditions that are critical to system performance.
(4) Time delays in the transfer of control. The engine instruction manual should indicate if there are time delays in the transfer of control. The engine certification engineer may not be able to determine that the mode transition provides a safe and acceptable system in accordance with part 33 based solely on analytical or simulation data. In those cases, the applicant should propose a brief flight test program to support the data. In any case, such control transition delays may or may not be acceptable for aircraft certification, depending on the installation. Therefore, Par 6-3.d. Page 6-7
the engine manufacturer should coordinate with the aircraft manufacturer and the aircraft certification office to evaluate this configuration early in the program. Control mode transitions should also be fully evaluated during aircraft certification.
(5) Availability of the alternate mode. If the alternate mode is not exercised during normal mode operation, an inspection interval or procedure for exercising the alternate mode should be specified to ensure that it remains functional and available. Inspection intervals or procedures may result in an operational limitation and will require the approval of the ECO.
(6) Provisions for signal(s) to indicate a mode transition.
f. Overspeed Protection System Requirements. For engine designs that require an overspeed protection control function, two categories of overspeed malfunction should be considered: those caused by shaft failure or loss of load, and those caused by control or fuel system failures. For shaft failure cases, the engine design may have some alternate methods of protection against rotor overspeed to comply with §33.75, such as “blade-shedding” or a “mash-and-clash” turbine design. In cases in which the basic engine design protects the rotor from an overspeed above structural limits, a control system overspeed protection system is usually unnecessary. If a control system overspeed protection function is necessary, the overspeed protection system should be evaluated with regard to its functionality and reliability as part of the engine control system.
(1) For overspeed protection systems, the following guidance provides one method, but not the only method, of compliance with both §§33.28 and 33.75.
(a) The combined engine and overspeed protection system should be at least two faults removed from a potential rotor burst event, when one of the faults induces the overspeed. In this respect, a potential rotor overspeed burst should only be possible as a result of a first fault inducing an overspeed and an independent fault preventing the overspeed protection system from operating.
(b) The analysis should show that the probability per engine flight hour of an uncontrolled overspeed condition from any cause in combination with overspeed protection system failure is one event per 100 million hours (a failure rate of 10 –8 events per hour). Due to the severity of an uncontained engine failure in some installations, certification of the aircraft may require the rate for this combined event to be demonstrated to be less than one event per billion hours (10–9).
(c) The failure rate of the overspeed protection system, itself, should be on the order of one event per 10,000 hours (E10-4).
(d) The probability of an inadvertent activation of the overspeed protection system should be commensurate with the fault consequences. The LOTC analysis should include the frequency of inadvertent activations of the overprotection protection system that cause a greater than 10% thrust or power change.
Page 6-8 Par 6-3.e.
(e) Overspeed protection is a necessary function for dispatch, required by §§33.28(c) and 33.75. Therefore, when the overspeed protection function is part of the control system, and its implementation involves the use of electrical or electronic components, a self-test of the overspeed protection system to ensure that the system is functional before each flight should be performed. Verification of the overspeed protection system at engine shutdown of the previous engine run has been acceptable.
(f) When multiple paths can invoke the overspeed protection system, a test of a different path should be performed each engine cycle, so that a complete test of the overspeed system can be achieved in a minimum number of engine cycles. If a path is found to be inoperative, the failure rate of the remaining path(s) should be less than 10-4 failures per hour, and combinations of failure leading to an uncontrolled overspeed event should still be extremely improbable. The control system should not be knowingly dispatched with the overspeed protection system failure rate greater than 10-4 failures per hour, or if the system is known to be inoperative.
(g) The applicant may provide data that demonstrates that the mechanical part of the overspeed protection system, such as the fuel shut-off mechanism, can operate without failures between stated periods. The applicant may also propose establishing a periodic inspection and test interval for the shut-off mechanism instead of testing the shut-off mechanism operation as part of the self-test conducted for each flight. When this approach is used, the self-test conducted for each flight should be limited to the electrical and electronic components of the overspeed protection system.
(h) Use of shared resources between the control system and the overspeed protection system should be evaluated. An analysis should show that the probability of faults of shared resources that could cause or contribute to an overspeed event as well as inhibit the overspeed protection function is extremely improbable, that is less than one event per billion engine flight hours (10E-09). Single failures should not cause such a condition. The overspeed protection system should be independent from the normal control.
(i) When the overspeed control function is implemented through mechanical or hydromechanical means only, such as a fly-ball governor system, a periodic inspection and test interval for compliance with the requirement for “continued system availability” is acceptable.
The periodic inspection and test interval should be based on test or in-service data that demonstrates that the system operates without failure between intervals.
(2) The overspeed malfunctions used in the failure analysis should be addressed when complying with §33.27.
Par 6-3.f. Page 6-9
g. Guidance for Use of Commercial or Industrial Grade Electronic Parts. Two recently published documents provide guidance on the application of commercial or industrial grade components: IEC/PAS 62239, Electronic Component Management Plans, edition 1.0, dated April 2001, and IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001. These should be used with the following guidance. When the engine type design specifies commercial or industrial grade electronic components, the applicant should have the following data available for review, as required:
(1) For each commercial and industrial grade electrical component specified in the design, reliability data that substantiates the failure rate for each component used in the EEC reliability analysis and the SSA.
(2) Procurement, quality assurance, and process control plans established for the vendorsupplied commercial and industrial grade parts. These plans should assure that the parts would maintain the reliability level specified in the approved engine type design.
(3) Unique databases for similar components procured from different vendors, because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard, such as military component standards
(4) Substantiation that the proposed extended range of the specified components is suitable for the application, if the declared installation temperature environment for the EEC is greater than that of the electronic components specified in the engine type design. Additionally, if commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required, the applicant should specify these provisions. Failure modes of the cooling provisions that cause these limits to be exceeded should be considered in determining the probability of failure.
h. Consideration of Local Events. When designing an electronic control system to meet the requirements of §33.28, the engine manufacturer should provide a control system with at least an equivalent level of safety and reliability as that of engines or propellers equipped with HMC systems. HMC systems have been shown to perform safely and reliably in the face of “local events.” In some cases, a comparison to HMC systems is not practical because the EEC system either provides functions not previously provided by HMC systems or is implemented differently. In these cases the acceptability of the effect of local events should be based on their effect on aircraft safe flight and landing. Examples of local events include: engine overheating conditions or fires, electrical problems, hydraulic and lubricating fluid leaks, and mechanical disruptions.
(1) Whatever the local event, the behavior of the EEC system should not cause a hazard to the continued safe flight and landing of the aircraft. Effects such as the control of the thrust reverser deployment, an overspeed of the engine, transients effects, or inadvertent propeller pitch change under any flight condition should be considered.
Page 6-10 Par 6-3.g.
(2) When demonstrating that local events do not cause a hazard to the continued safe flight and landing of the aircraft, the applicant should show that any other function necessary to provide protection would be available at the time of the local event and would not be rendered inoperative by the same local event (such as destruction of wires, ducts, or power supplies). This includes proposed designs in which the engine manufacturer assumes that the aircraft (or aircraft components) provides the necessary protection. This engine failure modes effects and criticality analysis (FMECA) should document this assumption.
(3) When the temperature to which the EEC is exposed is greater than the maximum safe design operating temperature declared by the engine manufacturer, an overheat condition results.
The electronic portions of the control should not cause a hazardous condition when the EEC is exposed to a continuous overheat or over-temperature condition, such as a duct burst or leak within a nacelle. Specific design features or analysis methods may be used to show compliance with respect to the prevention of hazardous effects. When this is not possible due to the variability or complexity of the failure sequence, acceptable testing may be required. Computer simulation techniques similar to those discussed for fire testing have also been acceptable. The compliance criteria requires that when the EEC system is exposed to an overheat condition, the system should not cause the engine to behave in an unsafe manner and should allow a safe engine shut down.
(4) To show compliance with fire as a local event, the EEC system must comply with fire test requirements when the system is located in a fire zone. Fire zones are defined in the appropriate aircraft certification standards. Fire requirements for the electronic parts of the EEC system are not covered precisely in the regulations with regard to the length of time they are required to function when exposed to fire. Therefore, the FAA has developed compliance criteria for EEC systems. When exposed to fire, the EEC system should allow a safe engine shut down without an unwanted action during the exposure that could become hazardous to the aircraft.
(a) The fuel handling parts of the EEC system, including the fuel shut-off valve (SOV), should comply with §33.17, which requires that these parts be fire resistant. Section 33.17 requires that the engine design minimize the probability of the occurrence and spread of fire.
Therefore, consideration should be given to those parts of the EEC system that control airflow, which could fail and contribute to the fire when the system is exposed to fire.
(b) In addition, §33.75 requires that fire cannot cause the engine to lose the capability to shut down. For system designs that depend on electric power to actuate the SOV, high temperature wire or other protective means should be used to ensure that the capability to shut down the engine is maintained when the EEC is exposed to fire.
(c) To demonstrate compliance with fire resistance requirements, computer simulations of EEC exposure to fire may be used instead of fire tests on production hardware. Approved computer simulations should be validated by analysis, test, or both, including all assumptions upon which the computer simulation is based.
Par 6-3.h. Page 6-11
(d) Hardware emulations for use in fire tests may also be acceptable. Approved hardware emulations should be validated by analysis, test, or both.
(e) The engine manufacturer should note that as part of aircraft certification for transport aircraft, the Transport Airplane Directorate (TAD) has required actual fire tests on all elements of systems in which there is the potential for fire causing a catastrophic failure, such as elements that could cause a catastrophic reverser deployment or an uncontained rotor burst.
(5) The applicant should demonstrate by analysis or test that when any EEC system component input or output electrical connection opens or shorts to ground, the system behaves in a safe and predictable manner. In addition, the applicant should show that any EEC system component connector that becomes disconnected while the engine is operating does not cause a hazard to the continued safe flight and landing of the aircraft.
(a) EEC aircraft interface wiring should be tested or analyzed for shorts to aircraft power; these “hot” shorts should result in an identified and non-hazardous effect. When aircraft interface wiring is involved, the installer should be informed of the potential effects of wiring faults on aircraft interface wiring in the engine instructions for installation.
(b) When physical separation of conductors is not practical, the engine manufacturer and the installer should coordinate to ensure that the potential for common mode faults between engine controls is eliminated and that the potential for common mode faults between channels on one engine is minimized.
(6) The applicant should demonstrate by analysis or test that hydraulic or lubricating leaks impinging on the EEC control system do not cause a hazard to the continued safe flight and landing of the aircraft.
(7) The applicant should demonstrate by test, analysis, or both, that mechanical disruptions that could sever connections or damage EEC system components do not result in a hazard to the continued safe flight and landing of the aircraft. The evaluation of this design feature is installation dependent in many cases; these considerations in the design for mechanical disruptions should be considered on a case-by-case basis.
Page 6-12 Par 6-3.h.
CHAPTER 7. SECTION 33.28(d)
7-1. Rule Text. Section 33.28(d) provides that each EEC must: “Have environmental limits, including transients caused by lightning strikes, specified in the instruction manual.”
7-2. Intent of Rule. Section 33.28(d) ensures that the engine and control system meet acceptable environmental operating conditions. The instruction manual should clearly define EEC system operational limitations, for the benefit of the engine installer, and provide assurance that the EEC system is functional in a reasonably designed aircraft environment.
7-3. Compliance with §33.28(d). The following guidance provides a method, but not the only method, of compliance with §33.28(d).
a. General Test Requirements. Section 33.28(d) requires that the EEC system have environmental limits specified in the engine instruction manual, including those associated with lightning and high intensity radiated fields (HIRF). Environmental tests conducted on an individual system component basis in accordance with test procedures defined in RTCA Document DO-160D (see AC 21.16D), or equivalent, have been acceptable, except for temperature variation, HIRF, and lightning tests.
(1) A minimum of 10 temperature cycles should be performed for temperature variation tests.
(2) Adaptations and combinations of the test procedures in RTCA Document DO-160D should be used for the HIRF, lightning, and electromagnetic interference (EMI) system tests.
The test procedures in RTCA Document DO-160D are directed toward tests of individual pieces of equipment rather than systems, such as EEC controls.
(3) EMI tests conducted in accordance with MIL-STD-461/462 have been accepted as providing procedures and test levels equivalent to those in RTCA Document DO-160D. When the two test procedures differ for a particular test case, the more rigorous test procedure should be used unless use of the alternate test can be justified. HIRF and lightning tests should be conducted using the procedures described in paragraphs 7-3.b., 7-3.c., and 7-3.d. of this AC.
(4) Environmental tests in accordance with MIL-STD-810E may be accepted instead of RTCA Document DO-160D tests when the MIL-STD-810E tests are equal to or more rigorous than those defined in RTCA Document DO-160D.
b. System Test Configuration Considerations. EEC manufacturers and engine manufacturers have conducted HIRF, lightning, and EMI tests as system tests on closed loop laboratory setups.
The closed loop setup is usually provided with hydraulic pressure to move actuators to close the inner actuating loops. A simplified engine simulation may be used to close the outer engine loop.
Par 7-1 Page 7-1
(1) Open Loop Laboratory Tests. In some cases, open loop laboratory setups with EEC test software have been accepted. If the applicant conducts open loop setups, the following factors should be considered:
(a) The EEC test software should be developed and implemented by guidelines defined for software levels of at least Level 2 or Level C, in RTCA Document DO-178A and RTCA Document DO-178B, respectively. In some cases, the application code should be modified to include the required test code features.
(b) The system test setup should be instrumented to monitor both the output drive signals and the input signals.
(c) Anomalies observed on inputs or outputs should be duplicated on the engine simulation to determine if the resulting power or thrust perturbations comply with the pass/fail criteria.
(2) Pass/Fail Criteria. The tests should be conducted with the EEC system controlling the engine at the most sensitive operating point, as selected by the applicant. This may be a different operating point for the three different tests. The system should be exposed to the HIRF, lightning, and EMI environmental threats while operating at the selected condition. The pass criteria for HIRF and lightning is that there is “no effect” on the operation or operational characteristics of the system. “No effect” is defined as less than ±2 percent of power or thrust change from the normal control governing capability for a period of less than one second. For EMI testing, the limits selected from the appropriate section of RTCA/DO-160D should be used.
The following results are considered test failures:
(a) Transfers to alternate channels, backup HMC systems, or reversionary modes.
(b) Component damage.
(c) Significant fault codes recorded in the fault memory.
(d) False fault announcements to the crew that could cause unnecessary or inappropriate crew action.
(e) Erroneous operation of overspeed or reverser circuits.
c. HIRF Test Requirements. For HIRF testing, systems have been accepted for engine certification using an interim high energy radiated fields (HERF) policy memo dated December 5, 1989. That interim policy memo served as the basis for Notice N8110.67, Guidance for the Certification of Aircraft Operating in High Intensity Radiated Fields (HIRF) Environments, which was later reissued as N8110.71 in April 1998. Using 100 volts per meter average from 10 KHZ to 18 GHZ is an acceptable level for conducting HIRF bench tests for systems that perform critical functions. For rotorcraft applications, the HIRF bench test level should be 200 volts per meter average from 10 KHZ to 18 GHZ.
Page 7-2 Par 7-3.b.
(1) The Engine and Propeller Directorate has used 200 volts per meter average over the entire frequency range from 10 KHZ to 18 KHZ as the standard for testing EEC systems.
(2) At a minimum, the modulations specified in RTCA Document DO-160D, Section 20, for categories W or Y should be used. Additional modulations based on the EEC operating frequencies or control loop bandwidth should be used for the system HIRF tests.
(3) In many cases, additional pulse modulation tests in the microwave range are specified by the aircraft manufacturers. These additional tests are generally at field levels in excess of 1000 volts per meter. Experience to date has shown that EECs that pass 200 volts per meter average will also pass tests at the higher pulse modulated field levels at the higher frequencies.
However, it should not be assumed that the system is hardened to these levels without completing the high-level pulse tests. Test procedures generally follow the guidelines of Section 20 of RTCA Document DO-160D.
d. Lightning Test Requirements. Lightning tests should follow the guidelines of AC 20-136 and Section 22 of RTCA Document DO-160D. Multiple stroke (MS) and multiple burst (MB) tests should be conducted on the system connected on the test bench (see paragraph 7-3.b. of this AC).
(1) EEC MS Lightning Tests. Low-level lightning test(s) should be conducted to establish the engine cable shield current levels. Low-level tests have been used to establish the waveforms and current levels coupled on to the cables for the MS tests. The shield current level for large engines has been on the order of 1000 to 2000 amperes. For smaller engines, shield current levels have been higher. These levels are typically determined by low current level lightning tests on the engine without the full benefit of nacelle attenuation and, therefore, should be conservative. Although the shield current level is not a requirement of an MS lightning test, the applicant should demonstrate that it is a realistic level for the category of engine and its application.
(2) EEC MB Lightning Tests. Past MB tests have been conducted using the chattering relay test defined in Section 19.3.4.1 of RTCA Document DO-160D. However, the chattering relay test has been superseded by MB tests using Waveform 3 or Component H (see AC 20-136).
(3) EEC Pin Injection Tests (PIT). PITs should be conducted on the EEC. PIT levels should be appropriately selected from the tables of Section 22 of RTCA Document DO-160D.
PITs should be conducted on other system components as required.
Par 7-3.c. Page 7-3