(d) Hardware emulations for use in fire tests may also be acceptable. Approved hardware emulations should be validated by analysis, test, or both.
(e) The engine manufacturer should note that as part of aircraft certification for transport aircraft, the Transport Airplane Directorate (TAD) has required actual fire tests on all elements of systems in which there is the potential for fire causing a catastrophic failure, such as elements that could cause a catastrophic reverser deployment or an uncontained rotor burst.
(5) The applicant should demonstrate by analysis or test that when any EEC system component input or output electrical connection opens or shorts to ground, the system behaves in a safe and predictable manner. In addition, the applicant should show that any EEC system component connector that becomes disconnected while the engine is operating does not cause a hazard to the continued safe flight and landing of the aircraft.
(a) EEC aircraft interface wiring should be tested or analyzed for shorts to aircraft power; these “hot” shorts should result in an identified and non-hazardous effect. When aircraft interface wiring is involved, the installer should be informed of the potential effects of wiring faults on aircraft interface wiring in the engine instructions for installation.
(b) When physical separation of conductors is not practical, the engine manufacturer and the installer should coordinate to ensure that the potential for common mode faults between engine controls is eliminated and that the potential for common mode faults between channels on one engine is minimized.
(6) The applicant should demonstrate by analysis or test that hydraulic or lubricating leaks impinging on the EEC control system do not cause a hazard to the continued safe flight and landing of the aircraft.
(7) The applicant should demonstrate by test, analysis, or both, that mechanical disruptions that could sever connections or damage EEC system components do not result in a hazard to the continued safe flight and landing of the aircraft. The evaluation of this design feature is installation dependent in many cases; these considerations in the design for mechanical disruptions should be considered on a case-by-case basis.
Page 6-12 Par 6-3.h.
CHAPTER 7. SECTION 33.28(d)
7-1. Rule Text. Section 33.28(d) provides that each EEC must: “Have environmental limits, including transients caused by lightning strikes, specified in the instruction manual.”
7-2. Intent of Rule. Section 33.28(d) ensures that the engine and control system meet acceptable environmental operating conditions. The instruction manual should clearly define EEC system operational limitations, for the benefit of the engine installer, and provide assurance that the EEC system is functional in a reasonably designed aircraft environment.
7-3. Compliance with §33.28(d). The following guidance provides a method, but not the only method, of compliance with §33.28(d).
a. General Test Requirements. Section 33.28(d) requires that the EEC system have environmental limits specified in the engine instruction manual, including those associated with lightning and high intensity radiated fields (HIRF). Environmental tests conducted on an individual system component basis in accordance with test procedures defined in RTCA Document DO-160D (see AC 21.16D), or equivalent, have been acceptable, except for temperature variation, HIRF, and lightning tests.
(1) A minimum of 10 temperature cycles should be performed for temperature variation tests.
(2) Adaptations and combinations of the test procedures in RTCA Document DO-160D should be used for the HIRF, lightning, and electromagnetic interference (EMI) system tests.
The test procedures in RTCA Document DO-160D are directed toward tests of individual pieces of equipment rather than systems, such as EEC controls.
(3) EMI tests conducted in accordance with MIL-STD-461/462 have been accepted as providing procedures and test levels equivalent to those in RTCA Document DO-160D. When the two test procedures differ for a particular test case, the more rigorous test procedure should be used unless use of the alternate test can be justified. HIRF and lightning tests should be conducted using the procedures described in paragraphs 7-3.b., 7-3.c., and 7-3.d. of this AC.
(4) Environmental tests in accordance with MIL-STD-810E may be accepted instead of RTCA Document DO-160D tests when the MIL-STD-810E tests are equal to or more rigorous than those defined in RTCA Document DO-160D.
b. System Test Configuration Considerations. EEC manufacturers and engine manufacturers have conducted HIRF, lightning, and EMI tests as system tests on closed loop laboratory setups.
The closed loop setup is usually provided with hydraulic pressure to move actuators to close the inner actuating loops. A simplified engine simulation may be used to close the outer engine loop.
Par 7-1 Page 7-1
(1) Open Loop Laboratory Tests. In some cases, open loop laboratory setups with EEC test software have been accepted. If the applicant conducts open loop setups, the following factors should be considered:
(a) The EEC test software should be developed and implemented by guidelines defined for software levels of at least Level 2 or Level C, in RTCA Document DO-178A and RTCA Document DO-178B, respectively. In some cases, the application code should be modified to include the required test code features.
(b) The system test setup should be instrumented to monitor both the output drive signals and the input signals.
(c) Anomalies observed on inputs or outputs should be duplicated on the engine simulation to determine if the resulting power or thrust perturbations comply with the pass/fail criteria.
(2) Pass/Fail Criteria. The tests should be conducted with the EEC system controlling the engine at the most sensitive operating point, as selected by the applicant. This may be a different operating point for the three different tests. The system should be exposed to the HIRF, lightning, and EMI environmental threats while operating at the selected condition. The pass criteria for HIRF and lightning is that there is “no effect” on the operation or operational characteristics of the system. “No effect” is defined as less than ±2 percent of power or thrust change from the normal control governing capability for a period of less than one second. For EMI testing, the limits selected from the appropriate section of RTCA/DO-160D should be used.
The following results are considered test failures:
(a) Transfers to alternate channels, backup HMC systems, or reversionary modes.
(b) Component damage.
(c) Significant fault codes recorded in the fault memory.
(d) False fault announcements to the crew that could cause unnecessary or inappropriate crew action.
(e) Erroneous operation of overspeed or reverser circuits.
c. HIRF Test Requirements. For HIRF testing, systems have been accepted for engine certification using an interim high energy radiated fields (HERF) policy memo dated December 5, 1989. That interim policy memo served as the basis for Notice N8110.67, Guidance for the Certification of Aircraft Operating in High Intensity Radiated Fields (HIRF) Environments, which was later reissued as N8110.71 in April 1998. Using 100 volts per meter average from 10 KHZ to 18 GHZ is an acceptable level for conducting HIRF bench tests for systems that perform critical functions. For rotorcraft applications, the HIRF bench test level should be 200 volts per meter average from 10 KHZ to 18 GHZ.
Page 7-2 Par 7-3.b.
(1) The Engine and Propeller Directorate has used 200 volts per meter average over the entire frequency range from 10 KHZ to 18 KHZ as the standard for testing EEC systems.
(2) At a minimum, the modulations specified in RTCA Document DO-160D, Section 20, for categories W or Y should be used. Additional modulations based on the EEC operating frequencies or control loop bandwidth should be used for the system HIRF tests.
(3) In many cases, additional pulse modulation tests in the microwave range are specified by the aircraft manufacturers. These additional tests are generally at field levels in excess of 1000 volts per meter. Experience to date has shown that EECs that pass 200 volts per meter average will also pass tests at the higher pulse modulated field levels at the higher frequencies.
However, it should not be assumed that the system is hardened to these levels without completing the high-level pulse tests. Test procedures generally follow the guidelines of Section 20 of RTCA Document DO-160D.
d. Lightning Test Requirements. Lightning tests should follow the guidelines of AC 20-136 and Section 22 of RTCA Document DO-160D. Multiple stroke (MS) and multiple burst (MB) tests should be conducted on the system connected on the test bench (see paragraph 7-3.b. of this AC).
(1) EEC MS Lightning Tests. Low-level lightning test(s) should be conducted to establish the engine cable shield current levels. Low-level tests have been used to establish the waveforms and current levels coupled on to the cables for the MS tests. The shield current level for large engines has been on the order of 1000 to 2000 amperes. For smaller engines, shield current levels have been higher. These levels are typically determined by low current level lightning tests on the engine without the full benefit of nacelle attenuation and, therefore, should be conservative. Although the shield current level is not a requirement of an MS lightning test, the applicant should demonstrate that it is a realistic level for the category of engine and its application.
(2) EEC MB Lightning Tests. Past MB tests have been conducted using the chattering relay test defined in Section 19.3.4.1 of RTCA Document DO-160D. However, the chattering relay test has been superseded by MB tests using Waveform 3 or Component H (see AC 20-136).
(3) EEC Pin Injection Tests (PIT). PITs should be conducted on the EEC. PIT levels should be appropriately selected from the tables of Section 22 of RTCA Document DO-160D.
PITs should be conducted on other system components as required.
Par 7-3.c. Page 7-3
(a) PITs should be used to verify that equipment does not exhibit permanent upset or damage when subject to the pin-injected transient waveforms. During these tests, the transient waveforms are applied directly to the designated pins on the equipment connector, normally between each pin and the equipment chassis ground, as described in Section 22 of RTCA Document DO-160. This method assesses the dielectric withstand voltage or damage tolerance of the equipment interface circuit. For equipment electrical interface circuits that are electrically isolated from the equipment chassis or grounds, the applicant can perform a dielectric withstand or high-potential (hi-pot) test that meets or exceeds the peak transient waveform voltage amplitude in place of the PIT.
(b) Equipment interface circuits with low impedance with respect to the equipment chassis should be subjected to the PIT. For pin injection purposes, low impedance should be considered less than 100 ohms at any frequency below 10 KHZ. Shunt filters and transient suppression devices such as Tranzorbs(tm) normally produce low impedance to chassis to provide transient protection and should be subjected to the PITs at the selected waveform levels.
(4) Aircraft and Engine Certification Lightning Tests.
(a) For engine-mounted EECs, lightning tests conducted on an EEC system may be adequate to cover aircraft certification, as well as engine certification, provided the aircraftengine interface cables and current levels are adequately represented in the test. The test levels should be at a level compatible with the installation. The applicant and the ECO should mutually agree on the test level in the test plan. To account for the aircraft contribution to the test levels, the applicant should coordinate with the ACO to determine a mutually acceptable test level for the category of aircraft involved.
(b) The engine manufacturer should note that each aircraft manufacturer installing an engine must determine the levels to which the installed engine and EEC system will be exposed for the particular aircraft. The aircraft manufacturer should demonstrate that these levels are equal to or less than the levels used for engine certification testing. If the aircraft manufacturer cannot demonstrate this, then EEC system lightning tests may be needed to show compliance with aircraft certification standards.
e. Maintenance Requirements. Section 33.4 and Appendix A to part 33 require that the engine manufacturer prepare ICA for all engine parts. A maintenance plan must be part of the ICA. Therefore, as part of the environmental protection system that is part of the engine type design and is used to protect the EEC system from HIRF and lightning, a maintenance plan must be provided to ensure the continued airworthiness of the installed systems. Notice 8110.71 provides some guidance that can be used to meet the ICA requirement. Maintenance requirements may include periodic inspections or tests for required structural shielding, wire shields, connectors, and equipment protection components. The applicant should provide the engineering validation and substantiation of these maintenance requirements.
Page 7-4 Par 7-3.d.
f. Environmental Testing. All components of the EEC system, including all electronics units, sensors, harnesses, hydromechanical elements, and any other relevant elements or units, should be tested to establish that they will operate properly in their declared environment. When applicable, tests defined in RTCA Document DO-160D have been accepted. Environmental test plans should be approved by the ECO before the tests are conducted.
(1) Although environmental test limits are not specified in this AC, environmental tests should be representative of the environments that are expected to be encountered in the engine installation. Special attention should be given to any condition that could affect more than one engine or propeller control system, such as a faulty operation during hot day ambient conditions.
The environment for which the component is qualified should be entered into the instruction manual and is considered an installation limitation for the installer.
(2) The applicant should prepare an environmental test plan summarized in an environmental test matrix that defines the method to be used to qualify the component for each of the environments. The environments and test procedures defined in RTCA Document DO 160D have been acceptable to the FAA for electrical and electronic components. Generally, only the environments that are expected to be encountered should be tested. The matrix can note other environments as “not applicable.” The components should be qualified by test, similarity, analysis, or any combination of these.
(3) The applicant should provide the proposed test plan for approval before conducting tests of fuel handling, hydraulic, and pneumatic components, such as the fuel metering unit (FMU) and actuators. These components should be qualified by test, similarity, analysis or any combination of these. In some cases, the testing required for the engine block tests under §§33.49 or 33.87 may be adequate to qualify these components. Otherwise, additional tests are required under §§33.28(d) and 33.91(a).
(4) The explosion proof testing verifies that a component cannot cause an explosion of flammable fluids or vapors. If applicable, explosion proof testing may be performed as defined in Section 9 of RTCA DO-160. Section 9 of DO-160D applies to demonstrating compliance with §§33.28 and 33.91. DO-160D defines Environment I as equipment mounted in fuel tanks or within fuel systems and Environment II as an atmosphere in which flammable mixtures can be expected to occur as the result of a “fault causing spillage or leakage.” These definitions for the equipment environment may not be in complete agreement with definitions for aircraft engine installations.
(a) For installations in designated fire zones as defined in §§23.1181, 25.1181, 27.1181, and 29.1181, the fire zone should have extinguishing provisions so that the explosion proof test given by Section 9 of Environment II of DO-160D would be adequate. However, flammable fluid leakage areas as defined in §25.863 and other sections may not have fire extinguishing provisions or any of the other safety requirements associated with fire zones, due to the assumption that there are no ignition sources in those areas. In these cases, the applicant should be aware that the explosion proof test given by Section 9 of Environment I of DO-160D, Par 7-3.f. Page 7-5
although not a requirement for engine certification, might be a requirement for aircraft installation. The applicant may also demonstrate by test or analysis that the EEC system is not an ignition source.
(b) The applicant should state the type of explosion proof test that has been conducted in the installation instructions. In addition, if the applicant anticipates installations in a zone where flammable fluid requirements may be imposed, the test or analysis that demonstrates that the EEC system is not an ignition source should be referenced or included in the installation instructions.
g. Time Limited Dispatch (TLD) Environmental Tests. Although TLD is not a requirement for certification, HIRF and lightning tests for TLD should be conducted with the tests conducted for certification. To get approval for the use of TLD, applicants should demonstrate that dispatchable EEC configurations continue to meet the environmental requirements of the certification basis. SAE Document ARP 5107 contains applicable TLD information. For HIRF and lightning, applicants have usually determined that the single channel dispatch configuration is the worst case dispatch configuration; they have conducted HIRF and lightning tests with one channel inoperative to demonstrate compliance. For other environments, the applicants have complied by analysis and statements of compliance.
Page 7-6 Par 7-3.f.
CHAPTER 8. SECTION 33.28(e)
8-1. Rule Text. Section 33.28(e) provides that each EEC must: “Have all associated software designed and implemented to prevent errors that would result in an unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved by the Administrator.”
8-2. Intent of Rule. Section 33.28(e) requires that electrical and electronic engine control systems have all associated software designed and implemented to prevent errors that would result in a unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved for the application.
8-3. Compliance with §33.28(e). The following guidance provides a method, but not the only method, of compliance with §33.28(e).
a. Software Level Requirements. Software should be designed and implemented according to the standards established as Level 1 or Level A, as provided in RTCA documents DO-178A and DO-178B, respectively; the applicant should complete any additional testing required by the Administrator. RTCA Document DO-178A has been superseded by RTCA Document DO 178B; engine certification projects with a date of application after January 11, 1993, should use RTCA Document DO-178B. Part 23 applications not intended to be certificated to part 25 requirements should use the standards of DO-178B level B or C for the control. The applicant should coordinate this with the airframe manufacturer and the ACO early in the certification program.
b. Software Partitioning. It may be possible to partition non-critical software from the critical software to allow the non-critical software to be designed and implemented at a lower level than that established in the RTCA documents. Applicants should substantiate the adequacy of the partitioning method and should consider if the lower levels of the partitioned software are appropriate for the anticipated installations. If the criticality level requirement were higher in subsequent applications, it would be difficult to raise the software level without repeating the software life cycle processes for the new level.
c. Software Integrity. RTCA Document DO-178B provides guidance for software used at specified hazard levels. As with all guidance in this document, this may be modified due to future events or advancements in technology.
d. Programmed Logic Devices. Due to the nature and complexity of systems containing digital logic, programmed logic devices should be developed using a structured development approach, equivalent to the hazard associated with failure or malfunction of the system in which the device is contained. Programmed logic devices include application specific integrated circuits (ASIC) and programmable logic devices (PLDs). An ASIC is defined as any masked programmed integrated circuit that requires physical customization of the device die by an ASIC Par 8-1 Page 8-1
vendor. Gate array, cell-based and custom designs are included, as they involve some level of customization of the mask sets used in the fabrication of the devices. A PLD is defined as any device that is purchased as an electronic part and altered to perform an application specific function. PLDs usually require programming by the equipment manufacturer.
(1) PLDs include, but are not limited to, the following:
(a) Programmable array logic (PAL) devices;
(b) Programmable logic array (PLA ) devices;
(c) General array logic (GAL) devices;
(d) Field programmable gate array (FPGA) devices; and
(e) Electrically or erasable programmable logic devices (EPLD).
(2) RTCA Document DO-254 provides guidance for the criticality, failure condition categories, and design assurance levels associated with development of programmed logic devices. This is an acceptable means, but not the only means, for demonstrating compliance with §33.28(e).
(3) For off-the-shelf equipment or modified equipment, service experience may be used to demonstrate compliance. This should be acceptable if the worst case failure or malfunction of the device for the new installation is not more severe than that for the original installation of the same equipment on another application. The applicant should also consider significant differences related to the environmental or operational category of the aircraft in which the original system was installed and certified.
Page 8-2 Par 8-3
Appendix 1 APPENDIX 1. REGULATORY BASIS FOR REQUIRING
AN EEC SSA AND LOTC ANALYSIS UNDER §33.28
1. This appendix explains the basis for requiring an SSA as part of an applicant’s demonstration of compliance with §33.28. Before §33.28 was added to part 33, EEC systems were certified only upon demonstration of complete redundancy in the electronic portions of critical loops of the system. Applicants that did not perform an SSA were required to demonstrate sufficient similarity to earlier EEC accepted designs that had adequate redundancy. Section 33.28 codified for general applicability the practices used in these early EEC engine certification programs. If changes in EEC design make it no longer possible to accept EECs based on similarity with earlier accepted designs, then future applicants must, in order to demonstrate compliance with §33.28, submit an SSA for each EEC design.
2. The FAA will accept new technologies on the basis that the safety and reliability of that new technology are equivalent to, or an improvement over, current technologies. On this basis the EECs were accepted in place of HMC designs after establishing the basis for comparison as one LOTC event per 100,000 hours of service. An LOTC event is one in which there is a loss of the ability to control engine thrust from flight idle to 90 percent of maximum rated thrust. This basis for comparison was established after extensive review, by FAA and industry, of in-service reliability data of existing engine control systems. The results of that review were documented in issue papers and technical memoranda.
3. To meet this reliability standard, early EEC systems were designed with dual channel redundancy from the sensed inputs to the dual output devices for the critical control loops, defined as the fuel, stator vanes, and bleed control loops. Parts of the engine control system that remained with HMC technology generally were not made redundant.
4. A means, but not the only means, of compliance with §33.28 is provided in this AC through analysis that demonstrates that the proposed EEC system meets the LOTC criteria and that the EEC system has adequate redundancy and fault accommodation.
5. Section 33.28 provides that “no single failure or malfunction or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.” The term unsafe condition as used in this context is not limited to those specific conditions described in §33.75. While changes in thrust alone, however, will not always constitute an unsafe condition, the FAA will continue to evaluate unwanted changes in thrust or power with regard to the frequency of those events, their magnitude, and their occurrence in the flight envelope in determining whether an LOTC constitutes an unsafe condition for a particular engine design. New technology electrical and electronic EEC systems introduce potential failures that could result in unsafe conditions requiring an SSA under §33.28. Those failures include, but are not limited to, the following:
a. Complete loss of control over the engine.
b. Instability in the control of a critical function of the engine.
Appendix 1
c. Unwanted change in magnitude or direction of power or thrust in some operating conditions.
d. Unwanted action of a critical control function, such as the uncommanded deployment of thrust reversers.
6. Early EEC system designs have full redundancy on electronic parts of the system that control critical loops and, therefore, were found to provide reliability equivalent to the HMC systems they replaced based on the established reliability criteria of one LOTC event in 100,000 hours of service. These systems are essentially single fault tolerant. They cannot be considered fully single fault tolerant because a small percentage of failure types either cannot be addressed or are not detectable and as such cannot be accommodated. Using this criteria, subsequent systems can be accepted based on their similarity in design with these early redundant EEC systems. In recent certification programs, however, applicants have proposed engine designs using EEC systems that offer less than full redundancy. In these newer EEC designs significant unwanted changes in thrust or power could occur as a result of single system failures. Therefore, since these newer systems were not similar in design and did not meet the LOTC reliability criteria equivalent to HMC systems, the FAA could not accept these systems without an SSA to demonstrate compliance with §33.28.
7. The FAA has recognized that a uniform method for demonstrating how newer EEC systems comply with §33.28 would both promote safety in air commerce and aid industry. This AC provides that method based on meeting the LOTC reliability criteria for HMC designs through tests, analysis, or both. The FAA also recognizes that the LOTC reliability criteria for HMC designs was established through review of service experience data for aircraft certified under part 25 only, and an acceptable reliability criteria for aircraft certified under other standards (parts 23, 27 or 29) may differ from the part 25 criteria. Applicants are cautioned, however, that engines certified under part 33 are generally not restricted to a specific operational use. Therefore, the FAA may have to apply the more conservative part 25 criteria in a particular certification program if it determines that the engine involved in that program may be eligible for installation on an aircraft that may be certified under part 25.