although not a requirement for engine certification, might be a requirement for aircraft installation. The applicant may also demonstrate by test or analysis that the EEC system is not an ignition source.
(b) The applicant should state the type of explosion proof test that has been conducted in the installation instructions. In addition, if the applicant anticipates installations in a zone where flammable fluid requirements may be imposed, the test or analysis that demonstrates that the EEC system is not an ignition source should be referenced or included in the installation instructions.
g. Time Limited Dispatch (TLD) Environmental Tests. Although TLD is not a requirement for certification, HIRF and lightning tests for TLD should be conducted with the tests conducted for certification. To get approval for the use of TLD, applicants should demonstrate that dispatchable EEC configurations continue to meet the environmental requirements of the certification basis. SAE Document ARP 5107 contains applicable TLD information. For HIRF and lightning, applicants have usually determined that the single channel dispatch configuration is the worst case dispatch configuration; they have conducted HIRF and lightning tests with one channel inoperative to demonstrate compliance. For other environments, the applicants have complied by analysis and statements of compliance.
Page 7-6 Par 7-3.f.
CHAPTER 8. SECTION 33.28(e)
8-1. Rule Text. Section 33.28(e) provides that each EEC must: “Have all associated software designed and implemented to prevent errors that would result in an unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved by the Administrator.”
8-2. Intent of Rule. Section 33.28(e) requires that electrical and electronic engine control systems have all associated software designed and implemented to prevent errors that would result in a unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved for the application.
8-3. Compliance with §33.28(e). The following guidance provides a method, but not the only method, of compliance with §33.28(e).
a. Software Level Requirements. Software should be designed and implemented according to the standards established as Level 1 or Level A, as provided in RTCA documents DO-178A and DO-178B, respectively; the applicant should complete any additional testing required by the Administrator. RTCA Document DO-178A has been superseded by RTCA Document DO 178B; engine certification projects with a date of application after January 11, 1993, should use RTCA Document DO-178B. Part 23 applications not intended to be certificated to part 25 requirements should use the standards of DO-178B level B or C for the control. The applicant should coordinate this with the airframe manufacturer and the ACO early in the certification program.
b. Software Partitioning. It may be possible to partition non-critical software from the critical software to allow the non-critical software to be designed and implemented at a lower level than that established in the RTCA documents. Applicants should substantiate the adequacy of the partitioning method and should consider if the lower levels of the partitioned software are appropriate for the anticipated installations. If the criticality level requirement were higher in subsequent applications, it would be difficult to raise the software level without repeating the software life cycle processes for the new level.
c. Software Integrity. RTCA Document DO-178B provides guidance for software used at specified hazard levels. As with all guidance in this document, this may be modified due to future events or advancements in technology.
d. Programmed Logic Devices. Due to the nature and complexity of systems containing digital logic, programmed logic devices should be developed using a structured development approach, equivalent to the hazard associated with failure or malfunction of the system in which the device is contained. Programmed logic devices include application specific integrated circuits (ASIC) and programmable logic devices (PLDs). An ASIC is defined as any masked programmed integrated circuit that requires physical customization of the device die by an ASIC Par 8-1 Page 8-1
vendor. Gate array, cell-based and custom designs are included, as they involve some level of customization of the mask sets used in the fabrication of the devices. A PLD is defined as any device that is purchased as an electronic part and altered to perform an application specific function. PLDs usually require programming by the equipment manufacturer.
(1) PLDs include, but are not limited to, the following:
(a) Programmable array logic (PAL) devices;
(b) Programmable logic array (PLA ) devices;
(c) General array logic (GAL) devices;
(d) Field programmable gate array (FPGA) devices; and
(e) Electrically or erasable programmable logic devices (EPLD).
(2) RTCA Document DO-254 provides guidance for the criticality, failure condition categories, and design assurance levels associated with development of programmed logic devices. This is an acceptable means, but not the only means, for demonstrating compliance with §33.28(e).
(3) For off-the-shelf equipment or modified equipment, service experience may be used to demonstrate compliance. This should be acceptable if the worst case failure or malfunction of the device for the new installation is not more severe than that for the original installation of the same equipment on another application. The applicant should also consider significant differences related to the environmental or operational category of the aircraft in which the original system was installed and certified.
Page 8-2 Par 8-3
Appendix 1 APPENDIX 1. REGULATORY BASIS FOR REQUIRING
AN EEC SSA AND LOTC ANALYSIS UNDER §33.28
1. This appendix explains the basis for requiring an SSA as part of an applicant’s demonstration of compliance with §33.28. Before §33.28 was added to part 33, EEC systems were certified only upon demonstration of complete redundancy in the electronic portions of critical loops of the system. Applicants that did not perform an SSA were required to demonstrate sufficient similarity to earlier EEC accepted designs that had adequate redundancy. Section 33.28 codified for general applicability the practices used in these early EEC engine certification programs. If changes in EEC design make it no longer possible to accept EECs based on similarity with earlier accepted designs, then future applicants must, in order to demonstrate compliance with §33.28, submit an SSA for each EEC design.
2. The FAA will accept new technologies on the basis that the safety and reliability of that new technology are equivalent to, or an improvement over, current technologies. On this basis the EECs were accepted in place of HMC designs after establishing the basis for comparison as one LOTC event per 100,000 hours of service. An LOTC event is one in which there is a loss of the ability to control engine thrust from flight idle to 90 percent of maximum rated thrust. This basis for comparison was established after extensive review, by FAA and industry, of in-service reliability data of existing engine control systems. The results of that review were documented in issue papers and technical memoranda.
3. To meet this reliability standard, early EEC systems were designed with dual channel redundancy from the sensed inputs to the dual output devices for the critical control loops, defined as the fuel, stator vanes, and bleed control loops. Parts of the engine control system that remained with HMC technology generally were not made redundant.
4. A means, but not the only means, of compliance with §33.28 is provided in this AC through analysis that demonstrates that the proposed EEC system meets the LOTC criteria and that the EEC system has adequate redundancy and fault accommodation.
5. Section 33.28 provides that “no single failure or malfunction or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.” The term unsafe condition as used in this context is not limited to those specific conditions described in §33.75. While changes in thrust alone, however, will not always constitute an unsafe condition, the FAA will continue to evaluate unwanted changes in thrust or power with regard to the frequency of those events, their magnitude, and their occurrence in the flight envelope in determining whether an LOTC constitutes an unsafe condition for a particular engine design. New technology electrical and electronic EEC systems introduce potential failures that could result in unsafe conditions requiring an SSA under §33.28. Those failures include, but are not limited to, the following:
a. Complete loss of control over the engine.
b. Instability in the control of a critical function of the engine.
Appendix 1
c. Unwanted change in magnitude or direction of power or thrust in some operating conditions.
d. Unwanted action of a critical control function, such as the uncommanded deployment of thrust reversers.
6. Early EEC system designs have full redundancy on electronic parts of the system that control critical loops and, therefore, were found to provide reliability equivalent to the HMC systems they replaced based on the established reliability criteria of one LOTC event in 100,000 hours of service. These systems are essentially single fault tolerant. They cannot be considered fully single fault tolerant because a small percentage of failure types either cannot be addressed or are not detectable and as such cannot be accommodated. Using this criteria, subsequent systems can be accepted based on their similarity in design with these early redundant EEC systems. In recent certification programs, however, applicants have proposed engine designs using EEC systems that offer less than full redundancy. In these newer EEC designs significant unwanted changes in thrust or power could occur as a result of single system failures. Therefore, since these newer systems were not similar in design and did not meet the LOTC reliability criteria equivalent to HMC systems, the FAA could not accept these systems without an SSA to demonstrate compliance with §33.28.
7. The FAA has recognized that a uniform method for demonstrating how newer EEC systems comply with §33.28 would both promote safety in air commerce and aid industry. This AC provides that method based on meeting the LOTC reliability criteria for HMC designs through tests, analysis, or both. The FAA also recognizes that the LOTC reliability criteria for HMC designs was established through review of service experience data for aircraft certified under part 25 only, and an acceptable reliability criteria for aircraft certified under other standards (parts 23, 27 or 29) may differ from the part 25 criteria. Applicants are cautioned, however, that engines certified under part 33 are generally not restricted to a specific operational use. Therefore, the FAA may have to apply the more conservative part 25 criteria in a particular certification program if it determines that the engine involved in that program may be eligible for installation on an aircraft that may be certified under part 25.