CHAPTER 8. SECTION 33.28(e)
8-1. Rule Text ................................................................................................................. 8 - 1
8-2. Intent of Rule8-1
8-3. Compliance with §33.28(e)8-1
a. Software Level Requirements8-1
b. Software Partitioning8-1
c. Software Integrity8-1
d. Programmed Logic Devices8-1
APPENDIX 1. REGULATORY BASIS FOR REQUIRING AN EEC SSA AND LOTC ANALYSIS UNDER §33.28.................................. (2 pages) Page vii (and viii)
CHAPTER 1. GENERAL
1-1. Background.
a. Section 33.28 was added to part 33, Airworthiness Standards for Aircraft Engines, as Amendment 15 (58 FR 29095, 5/18/93) and became effective on August 16, 1993. An accompanying advisory circular (AC) was not issued at the time.
b. Initially, EEC technology was primarily applied to engines designed for large transport aircraft applications. The certification practice and implementation of §33.28 was oriented toward these applications. When the use of EEC technology was limited to a small group of manufacturers, the information and guidance provided in the rule itself was adequate. Since the use of EEC controls has spread, a need for an AC has become evident in several recent engine certification programs.
c. In addition, industry representatives from the engine community that design engines for applications other than large transport aircraft certificated under part 25 have questioned the criteria used to determine equivalence to the typical hydromechanical system. A basic criteria for FAA acceptance of the replacement of hydromechanical technology with electronic technology for engine controls is that the new technology must have an equivalent level of integrity and reliability as the technology being replaced. Because the data used to establish the criteria for equivalent reliability of a typical hydromechanical system was based on part 25 certification experience, other industry representatives have presented a valid argument that the equivalence criteria to a hydromechanical system should be based on data for hydromechanical control systems used in their respective part 23, 27, and 29 certifications.
1-2. Introduction. One of the objectives for the engine manufacturer in an engine certification program is to show that the certificated engine will be “installable” in a particular aircraft or aircraft type. If the aircraft application is unknown at the time of engine certification, the engine manufacturer should make reasonable installation and operational assumptions for the anticipated aircraft application.
a. To facilitate achieving this objective, the engine manufacturer should provide a document that describes the EEC system and its operation to both the engine certification office (ECO) and the aircraft certification office (ACO). Using this document, along with other documentation and test results, the ACO will determine if the EEC system has reasonable assurance of being in compliance with the applicable aircraft certification regulations (§§ 901, 903, and 1309 of parts 23, 25, 27, 29).
b. Providing the EEC documentation to the ACO is particularly important when the system is novel or unique and differs from previously certificated systems. The ECO will also coordinate with the appropriate FAA engine controls specialist(s) in this regard. If these reviews indicate that the engine may not be installable in the intended aircraft type, the ECO will inform the applicant and the appropriate ACO of any potential certification issues. The final determination for compliance with these aircraft regulations will be determined by the appropriate ACO at Par 1-1 Page 1-1
aircraft certification, when more complete test and analysis data is available. This coordination with the ACO is only necessary for the initial aircraft application of the engine. If an aircraft is not identified as the anticipated installation for the engine, a review may be conducted with the applicable Standards Staff. Any installation limitations or operational issues will be noted in the engine Installation or Operational Manuals and the engine Type Certification Data Sheet (TCDS). Applicants should also be aware that the ACO may require flight testing to fully evaluate engine performance and operability characteristics for all operating modes.
1-3. Definitions.
a. Aircraft-Supplied Data. Aircraft-supplied data is information that is generated in the aircraft systems and used by the engine control system, but whose source is not controlled under the design authority of the engine certification applicant. This does not include input from those sensors that are used by, and normally dedicated to, the engine control system but may be mounted in the airframe.
b. Aircraft-Supplied Power. Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
c. Alternate Control Mode(s). For the purposes of this AC, an alternate control mode is one in which the operating characteristics or capabilities of the engine control are sufficiently different from the “normal mode” that they may significantly impact or change the operating characteristics or capabilities of the aircraft, crew workload, or what constitutes appropriate crew procedures.
d. Commercial and Industrial Grade Electronic Parts. Commercial (consumer quality parts) and industrial grade electronic parts have typical operating ranges of 0 degrees to +70 degrees Celsius and -40 degrees to +85 degrees Celsius, respectively. Vendor parts catalogs typically define commercial and industrial grade electronic parts in these temperature ranges.
e. Electronic Engine Control (EEC) System. The EEC system is the generic family of electrical/electronic engine control systems, including full authority digital engine controls, supervisory controls, and derivatives of these.
f. Fault or Failure. This is an occurrence that affects the operation of a component, part, or element such that it can no longer function as intended, and includes both loss of function as well as a malfunction. Errors that may cause failures are not considered as failures.
g. Fault or Failure Accommodation. This term refers to the capability of the control system or crew to mitigate, either wholly or in part, the failure condition.
Page 1-2 Par 1-2
h. Fault or Failure Condition. This is a condition having an effect on the airplane or its occupants, either direct or consequential, that is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.
i. Fault or Failure Detection. This term refers to the discovery of a fault or failure condition and either announcement of that condition to the flight crew by instrumentation or storage of the detection of that condition, or its results, in a fault memory for later retrieval through a built-in test capability of that control.
j. Full Authority Digital Engine Control (FADEC). FADEC is a control system in which the primary functions are provided electronically and the electronic unit has full-range authority over the engine power or thrust. FADEC systems have been certificated that employ either two identical channels to provide full-operational capability after failure of one channel or a single channel with a simplified electronic or hydromechanical back-up to provide an alternate operating mode. The “FADEC system” includes all the control elements identified in the instruction manual, including: sensors, wiring, mechanical, pneumatic, or hydromechanical components and other limiter or protection devices. If the control requires data from aircraft computers to operate, this data is considered part of the EEC or FADEC system, and the interface requirements for this data should be specified in the engine instruction manual.
Mechanical components, such as the fuel pump, that do not interface with the EEC system are generally not included in the definition of FADEC system components.
k. Full-up System or Configuration. For the purposes of the system safety assessment (SSA) analyses described in this AC, the “full-up system” is one that does not have any faults or failures present, detected or undetected, that affect the control of engine power or thrust, engine protection systems, indication of critical engine operating parameters or other safety features of the control. In a “full-up system,” everything is operative.
l. Loss of Thrust Control (LOTC). For engines intended for use in airplanes certified under part 23 Commuter Category standards, or part 25 standards (Transport Category), and in rotorcraft certified under part 27 or part 29 standards, this term refers to the loss of capability to modulate and maintain thrust or power between flight idle and 90 percent of maximum rated power or thrust at all operating conditions. For engines intended for use in airplanes certified under part 23 Normal, Utility, or Acrobatic standards, this term refers to the loss of capability to modulate and maintain thrust or power between flight idle and 85 percent of maximum rated power or thrust, at all operating conditions. One engine inoperative (OEI) or automatic take-off thrust control system (ATTCS) ratings and implementations are exempted from an LOTC analysis, because the portion of time spent at these ratings is relatively small, and they are covered by aircraft level analyses.
m. Per Hour. When the term “per hour” or “per flight hour” is used in this AC, the definition is “per engine flight hour.”
Par 1-3 Page 1-3
n. Range of Control. This term refers to modulation of the engine from idle to 100 percent maximum rated thrust or power and includes any red line or higher rotor speed protection controls and any engine temperature, torque, and pressure limits set and implemented by the control.
o. Take-off Envelope. This term refers to the operation of the aircraft at or below 1500 feet above ground level (AGL) during take-off or landing approach. When distant obstacle clearance is involved, the take-off envelope may be increased to a higher altitude than 1500 feet AGL. For rotorcraft, the take-off envelope is 1000 feet AGL for Category A rotorcraft, and within the height-velocity envelope for all others.
p. Uncovered Fault. An uncovered fault is a fault or failure for which either a detection mechanism does not exist or, if there is a detection mechanism, an accommodation does not exist.
q. Unsafe Condition. For purposes of this AC only, an unsafe condition is a condition that, if not corrected, is reasonably expected to result in one or more serious injuries. In this definition, “reasonably expected” means a probability of occurrence unacceptable to both the long-term risk and the intent of the applicable Type Design Standards.
Page 1-4 Par 1-3
CHAPTER 2. SECTION 33.28(a)
2-1. Rule Text. Section 33.28(a) provides that each EEC must: “Have the control system description, the percent of available power or thrust controlled in both normal operation and failure conditions, and the range of control of other controlled functions, specified in the instruction manual required by §33.5 for the engine.”
2-2. Intent of Rule. Section 33.28(a) requires the applicant to provide the necessary information in the form of manuals to ensure safe engine installation and safe engine operation. The data underlying the information provided in the manuals should be created as part of the engine certification program. The manuals should include the following:
a. EEC system information that provides a clear understanding of the control system in the normal and any alternate control or operating modes;
b. Any differences in operation in other than the normal mode;
c. Any subtle interface requirements, such as power interrupt tolerance of the EEC;
d. Percent of available power or thrust in both normal operation and any alternate modes;
e. Range of control of other controlled functions; and
f. The environmental limitations of the engine installation.
2-3. Compliance with §33.28(a). The following is a method, but not the only method, of compliance with §33.28(a):
a. Control System Description. The applicant should include a brief control system description in the instruction manual and may incorporate a more detailed system description document by reference. The applicant should also consider other functions integrated into the EEC system. If functions other than those directly associated with the control of the engine are integrated into the EEC system, (such as thrust reverser control, propeller control, or automatic starting) the applicant should include descriptions of these functions in the instruction manual.
Even if the FADEC control is integrated wholly or in part within an aircraft avionics system, the engine manufacturer should provide an engine control system description that meets part 33 engine certification requirements and should include the relationship of the engine control system and the aircraft systems. Engine control systems that are embedded in aircraft avionics may require special conditions as prescribed under §21.16.
Par 2-1 Page 2-1
b. Interface Description. The instruction manual should include installation interface descriptions, limitations, and requirements of the engine control system. For example, the instruction manual should clearly define the EEC power requirements and quality, including interrupt limitations, for the engine installer. The manual should also specify the impedance and buffering limitations for the signals provided by the EEC system for display and instrumentation, or signals used by the EEC, such as air data information, to ensure that the EEC system is adequately isolated and unaffected by other systems using these signals.
c. Operational Description.
(1) The instruction manual should:
(a) Describe the control system operating characteristics in both the normal and alternate control modes.
(b) Define restrictions in the flight envelope or unusual operating characteristics in these alternate modes.
(c) Identify any abnormal control characteristics in all operational or dispatchable configurations that could have an impact on crew procedures, training, workload, or any other aspect of aircraft performance or operating characteristics, for evaluation during aircraft certification.
(2) If dispatch of the control system with faults has been approved by a time-limited dispatch (TLD) analysis or other analyses, the instruction manual, or other appropriate documentation, should include the time limitations for this type of operation. If TLD or other appropriate analysis or documentation is not submitted to substantiate the acceptability of dispatching the engine control with faults present or portions of the control inoperative, the control may be restricted to “full-up” dispatch only.
(3) Faults that leave the control in a condition that cannot meet part 33 performance and operability requirements are generally considered non-dispatchable. The instruction manual should indicate how the EEC system would announce that condition to the flight crew. It should also describe how the control system provides output information for such a condition.
(4) The instruction manual should describe the availability of information about ECO- approved dispatchable fault conditions, and the time limits approved for such operations. ECO approval of a particular fault condition as dispatchable does not guarantee that the ACO or the operator’s certificate management office will approve that same condition as dispatchable for the aircraft or operator.
Page 2-2 Par 2-3
d. Substantiating Data. The instruction manual should include data from analyses conducted to comply with §§33.28(b) and (c), data from the environmental testing conducted to comply with §33.28(d), and data from the software level determinations conducted to comply with §33.28(e). This data will assist the installer in safely installing the engine. The applicant should have available and provide, as required, the following specific data:
(1) Data for all operating modes, to demonstrate that the control meets its design intent.
(2) Data to show that a progressive means of increasing power or thrust with throttle or load demand is provided for all control modes.
(3) Data for the following:
(a) The software level (for each function, if necessary).
(b) The estimated failure rates for:
1. Engine shut-down in-flight due to engine control causes.
2. Loss of engine or propeller control or significant change in power or thrust.
3. Failures to the back-up system.
4. Transmission of faulty parameters that affect cockpit located engine displays, or other safety critical functions.
5. Loss of any critical safeguards, such as overspeed or valves needed for fire protection.
6. Loss of any aircraft-supplied data or power required to assure proper engine operation.
7. Other safety significant failure conditions, such as the probability of an uncontrolled overspeed and the other control system associated events as determined from the system safety analysis (SSA). A control system event is one that the control system causes or is involved in preventing.
(4) The types and levels of environmental exposure for which the EEC system has been successfully qualified; for example, vibration, temperature, HIRF, and lightning. For new applications of a previously certified control system, substantiation of the environmental capability of the EEC system by similarity analyses, as well as tests, may be acceptable. The certification approach to be pursued should be indicated in the certification plan. For HIRF, lightning and electromagnetic interference (EMI) qualification tests, the interfacing aircraft cables used for the tests should be described.
Par 2-3 Page 2-3
e. Fault Accommodation Logic Data. The applicant should have available and provide, as required, the following:
(1) A tabulation of the fault accommodation logic for the critical parameters used by the control; and
(2) A tabulation of the “default” or “fail-safe” states of all EEC system outputs, and the rationale for their selection.
Page 2-4 Par 2-3
CHAPTER 3. SECTION 33.28(b)
3-1. Rule Text. Section 33.28(b) provides that each EEC system: “Be designed and constructed so that any failure of aircraft-supplied power or data will not result in an unacceptable change in power or thrust, or prevent continued safe operation of the engine.”
3-2. Intent of Rule. Section 33.28(b) requires that the engine and control system continue to function in a safe and reliable manner in the event of the failure of aircraft-supplied power or data, or both, while providing sufficient flexibility to accommodate the increasing engine and aircraft integration that accrues from the use of electronic control technology. For single engine installations, the effects should be reviewed as part of the overall safety and reliability objectives of §33.28(b).
a. Unacceptable Change in Power or Thrust. An “unacceptable change in power or thrust” is a change that has a significant impact on the performance margins of the intended application.
Although the complete or partial loss or change of thrust or power in a single engine installed on a multi-engine aircraft is not necessarily an unsafe condition, the ECO will evaluate both partial and complete loss of power or thrust. This evaluation includes the frequency, duration, and percentage of power or thrust change that results from the failure of aircraft-supplied data or power. This evaluation also considers location in the flight regime at the time of the event. The applicant should provide analytical or test data for this evaluation. The data may include worst case plots of percentage power or thrust change over the declared operating envelope for failure of aircraft-supplied data or power.
b. Continued Safe Operation of the Engine. In case of loss, corruption or failure of aircraftsupplied data or power, the engine should continue to function in a safe and acceptable manner, without unacceptable effects on thrust or power, hazardous engine effects, or loss of ability to comply with the operating requirements of §§33.51, 33.65 and 33.73.
Par 3-1 Page 3-1 (and 3-2)
CHAPTER 4. COMPLIANCE WITH SECTION 33.28(b):
FAILURE OF AIRCRAFT-SUPPLIED DATA
4-1. Failure of Aircraft-Supplied Data. The following guidance provides a method, but not the only method, of compliance with §33.28(b) for failure of aircraft-supplied data. The applicant should define in the instruction manual the effect of the failure of aircraft-supplied data on the engine’s output power or thrust characteristic throughout the flight envelope. That data should be provided for all allowable engine control and aircraft dispatch configurations in which the loss of aircraft power or data in that dispatch configuration would result in a different engine control system response.
4-2. System Configurations. Examples of system configurations that have been found to be acceptable under §33.28(b) include the following:
a. Dual Sources. A system may use dual sources of aircraft-supplied data with local engine sensors provided as “voters” and alternate data sources. Sensors that act as “voters” provide a method for the EEC system to determine if one of the primary data sources is providing erroneous data, and to then eliminate that erroneous source from consideration. In the event of a failure in the aircraft-supplied data, the engine sensors act as the primary source of sensed data through the fault accommodation logic. In the event of the loss of this engine-sensed data, the system uses modeled or synthesized parameters.
b. Synthesized Engine Parameters. In some cases, a system may use synthesized engine parameters as voters. The applicant should provide data that gives the worst case percentage change of power or thrust over the declared operating envelope when inaccuracies of the synthesizing process are considered, as well as the environmental effects on the sensors used in the synthesis.
c. Third Source. A system may use a third source of aircraft-supplied data as the voter instead of engine sensors. In this case, when aircraft data is used exclusively, the applicant should address the following items, as applicable, in the SSA or other appropriate documents:
(1) Software in the data path to the EEC should be at a level consistent with that defined for the EEC. The data path may include other aircraft equipment, such as aircraft air data computers (ADC), thrust management computers, or other avionics equipment.
(2) The applicant should state in the instruction manual that the aircraft manufacturer must ensure that changes to aircraft equipment, including software, in the data path to the engine do not affect the integrity of the data provided to the engine as defined by the instruction manual.
(3) If dispatchability of the aircraft without the third source is anticipated, the applicant should provide analysis that demonstrates the acceptability of this dispatch configuration for the minimum maintenance equipment list (MMEL) or the TLD documents, as applicable.
Par 4-1 Page 4-1
(4) Since aircraft-supplied data has an effect on EEC system operation, the applicant should supply the effects of faulty and corrupted aircraft data on the EEC system in the engine instruction manual. In the three ADC configuration the EEC system could be significantly affected by erroneous or faulty air data information; the engine could experience a significant thrust or power change during such a condition. If this is the case, the applicant should indicate in the instruction manual that air data information, and any other aircraft information that could have a significant impact on engine thrust or power, is considered critical to EEC system operation. Therefore, the instruction manual should state that the installer should ensure that those sensors and equipment involved in delivering information to the EECs are capable of operating in the “severe” HIRF and lightning environments, as defined in the certification basis for the aircraft, without affecting their proper and continued operation.
(5) The applicant should state the reliability level for the aircraft-supplied data that was used as part of the SSA and LOTC analysis as an “assumed value” in the instruction manual.
4-3. Complete Loss of ADC Inputs. The applicant should provide fault accommodation logic for the complete loss of ADC inputs or other aircraft-supplied data, even though this loss may be extremely improbable. In this case, the applicant should conduct sufficient testing or analysis, or both, on the fault accommodated control mode to establish that the engine operating characteristics comply with all operability requirements of part 33.
4-4. Common Mode Faults. In the exchange of data with the aircraft, consideration should be given to elimination of unacceptable common mode faults affecting the operation of more than one engine or propeller. This AC describes limits for unacceptable common mode faults that affect power or thrust in the discussion of §33.28(c). Common faults that affect engine protection limit systems or could hazard the aircraft would generally be unacceptable. The applicant should demonstrate the logic included in the control system to accommodate common faults. Any precautions needed to address common effects should be taken either through the aircraft system architecture or by logic internal to the engine control system. This should be demonstrated as part of the software integration testing during the EEC software verification or EEC system validation test program. Specifically, the applicant should consider the following cases:
a. Erroneous data received from the aircraft by the engine or propeller control system, if the data source is common to more than one engine or propeller; for example, air data sources, autothrottle systems, and synchronizing controls.
b. Control system operating faults propagating through data links between engine or propeller; for example, maintenance recording, common bus, cross-talk, auto-feathering, and automatic power reserve system.
c. Loss or interruption of aircraft data or electrical power used by the engine control, when that loss or interruption is caused by the failure of another engine.
Page 4-2 Par 4-2