d. The following are examples of components to which §33.28 does not apply:
(1) A conventional, new magneto;
(2) An electrically-powered actuator such as a solenoid whose actuation is dependant on pilot action through a dedicated electrical circuit; and
(3) An electrical relay not controlled by the EEC system.
e. The following are examples of components to which §33.28 does apply:
(1) Programmable logic controllers or arrays (PLCs or PLAs).
(2) An electrically-powered actuator, such as a solenoid, whose actuation is directly controlled by the EEC system.
(3) An electrical relay controlled by the EEC system.
Page 6 Par 2-2
CHAPTER 3. SECTION 33.28(a)
3-1. Rule Text. Section 33.28(a) provides that each EEC system: “Have the control system description, the percent of available power or thrust controlled in both normal operation and failure conditions, and the range of control of other controlled functions, specified in the instruction manual required by §33.5 for the engine.”
3-2. Intent of Rule. Section §33.28(a) requires the applicant to provide the engine installer with enough information about the EEC system to integrate the EEC-equipped engine system into the airplane design. A successful propulsion system installation requires a clear understanding of all aspects of the control system in normal and alternate control modes. The instruction manual specified in §33.5 includes both installation and operation instructions.
a. General. To show compliance with 33.28(a), the applicant may submit installation and operation manual sections for the engine manual or separate installation and operation manuals for the EEC system. The manual(s) should include descriptive, interface, and operating data in enough detail to support airplane certification. Limitations specified in the manual(s) should be consistent with those stated on the type certificate data sheet (TCDS), amended TCDS, or supplemental type certificate (STC), as applicable. These installation and operation instructions (or a separate Certification Data Interface Document) should also include the certification data specified in section 3-3d of this AC, to ensure that the part 33 certification is not invalidated when the engine is installed on the airplane.
b. Airplane Installation and Certification. Subpart E of part 23 provides regulations for the installation of a certificated engine into an airplane. The installed engine is defined as the powerplant system. These regulations require that the powerplant system design meet all the requirements, procedures, limitations, and assumptions specified in the engine instruction manual and the engine TCDS or STC. The applicant should coordinate this data with the prospective airplane designer and the appropriate FAA certification office. If the application is unknown or not defined at the time of engine certification, the EEC system applicant should substantiate any installation and operational assumptions made during the EEC system design.
As part of the airplane certification program, the FAA may require flight-testing to fully evaluate engine performance and operability characteristics for all operating modes. See §23.939.
3-3. Guidance. The following is a method, but not the only method, for demonstrating compliance with §33.28(a). The applicant should include this data in the engine installation and operation instructions submitted to show compliance with §33.5. See appendix 1 for a list of compliance documents that may be submitted for this section.
a. Control System Description. The applicant should include a brief control system description in the instruction manual and may reference a more detailed system description. The manual should include, but not be limited to, the following:
(1) A system schematic that includes electrical, mechanical, and fuel system elements;
Par 3-1 Page 7
(2) A description of the engine control functions performed by the EEC system; and
(3) An overview of the design of each of the system components.
b. Installation Requirements. The instruction manual should specify all of the physical, electrical, and functional installation requirements and limitations of the EEC system. For example, the instruction manual should include:
(1) Electrical Interface. The instruction manual should define the following:
(a) EEC system electrical power requirements and quality, including interrupt limitations, and grounding requirements. This should also include steady-state and transient under-voltage and over-voltage limits for the equipment. The power input requirements of DO- 160D, Section 16, provide an acceptable definition of such requirements. If DO-160 is used, the manual should state any exceptions to the power quality requirements cited in DO-160 for the particular category of equipment specified.
(b) Impedance and buffering limitations for the signals provided by the EEC system for display and instrumentation.
(c) Signals used by the EEC system, such as air data information, to ensure that the EEC system is adequately isolated and unaffected by other systems using these signals.
(d) Impedance, buffering, and range limitations for aircraft data signals used by the EEC system.
(e) Subtle interface requirements, such as power interrupt tolerance of the EEC system.
(f) EEC system power supply requirements and backup power reliability, if the backup electrical supply is not certified as part of the engine. The manual should clearly state that the backup electrical supply should be independent and isolated from the airplane bus system or systems.
(g) Endurance of the battery, if a battery is certified with the engine as a source of electrical power for the EEC system. The endurance of the battery should be consistent with the airworthiness standards applicable to the intended installation. The manual should also specify provisions for monitoring the health status of the battery.
(2) Engine control lever(s) interface requirements, including electrical and mechanical characteristics.
(3) Unique fuel system requirements, such as filtration and fuel inlet conditions (flow and pressure).
(4) Any unique engine instrumentation cockpit display requirements.
Page 8 Par 3-3
c. Operational Requirements. The instruction manual should contain a description of the control system operating procedures and limitations in both the normal and alternate control modes. For example, the instruction manual should provide:
(1) Restrictions in the flight envelope or unusual operating characteristics in these alternate modes.
(2) Abnormal control characteristics that could have an impact on crew procedures, training, workload, or any other aspects of aircraft performance or operating characteristics, for evaluation during aircraft certification.
(3) Control system output information to the cockpit, such as fault indication or control mode status.
(4) General information to help the pilot determine that the engine is actually producing the commanded power, such as the percent of available power in both normal operation and any alternate modes.
(5) General information associated with engine parameters that have limiting functions, including range information on those parameters. The instruction manual should specify those parameters that are within the pilot’s control (such as engine rpm) and those that are not (such as fuel flow, manifold air pressure (MAP), cylinder head temperature (CHT), exhaust gas temperature (EGT) ), as well as range of control.
(6) General information associated with operation lean of the EGT peak, including the allowable CHT or EGT range and transient behavior.
(7) General information about automatic engine limiting functions independent of the propeller governor, such as speed, MAP, CHT, and EGT. The manual should also specify unusual interactions with a (conventional) propeller governor.
(8) In-flight restarting procedures, both normal and abnormal.
(9) A list of approved fuels, including any operating restrictions or limitations resulting from use of alternate fuels.
(10) Descriptions of other abnormal operations, such as failed control channel or inoperative sensors.
(11) Operating limitations. If applicable, the instruction manual should identify the operating limitations associated with EEC system faults such as:
(a) Unlimited operation;
(b) Time-limited operation (TLO); and Par 3-3 Page 9
(c) No take-off permitted.
d. Certification Data Interface Document (CDID). The applicant should submit a document that includes data from safety analyses, environmental testing, and software validation and verification that is necessary for systems analysis of the powerplant installation and any other associated aircraft system. In lieu of a separate document, this data may be included in the instruction manual. If the applicant submits this data in a separate document, the instructions for installation should reference the document to ensure that the data is integrated into the airplane designer’s powerplant system safety analysis. The CDID should include, but is not limited to, the following specific data:
(1) Failure of Aircraft Power Analysis. The CDID should include the assumptions and results from this analysis that should be considered in the aircraft design. Chapter 4 of this AC provides more information on this analysis. The CDID should also include, but is not limited to, the following specific data:
(a) Data for the engine response to the transition from primary to backup power sources, or from primary to mechanical backup controls modes; and
(b) Effects on engine power and the duration of those effects.
(2) Failure of Aircraft Data Analysis. The CDID should include the assumptions and results from this analysis that should be considered in the aircraft design. Chapter 4 of this AC provides more information on this analysis. The CDID should include, but is not limited to, the following specific data:
(a) Fault accommodations taken for these aircraft-supplied signals;
(b) Those air data signals whose failure can cause an engine MPL;
(c) EEC system limitations for aircraft-supplied data, and signals for protection against common mode faults; and
(d) Hardware and software requirements for aircraft components in the data path between the EEC system and the aircraft.
(3) EEC Safety Analysis (EECSA) Assumptions. The CDID should include assumptions relating to airplane installation and operation conditions, such as the following:
(a) Operating procedures;
(b) Maintenance actions and associated intervals;
(c) Installed environment; and
(d) Latent failure exposure period.
Page 10 Par 3-3
(4) EECSA Results. The CDID should specify the estimated reliability of, or the failure rates for, safety-significant failure conditions and the other events associated with the control system (that is, events that the control system causes or is involved in preventing), as determined from the system safety analysis, such as the following:
(a) LOPC rate from the numerical fault tree analysis (FTA) and failure modes and effects analysis (FMEA);
(b) MPL rate from the numerical FTA and FMEA;
(c) Failures that result in a system transfer to an alternate control mode;
(d) Transmission of faulty parameters that affect cockpit-located engine displays or other safety critical functions identified in the EEC system output data content analysis;
(e) Loss of any critical safeguards, such as CHT or overboost limiting control, identified as latent failures in the FMEA or FTA;
(f) Failures of existing engine mechanical systems that could produce significant EEC system failure modes or effects as identified in the existing subsystems analysis; and
(g) Fault accommodation logic data (for EEC system faults) as identified in the fault accommodation logic analysis:
1. Tabulation of the fault accommodation logic for the critical parameters used by the control; and
2. Tabulation of the “default” or “fail-safe” states of all output effectors and the rationale for selection.
(5) Environmental Testing. The CDID should specify the types and levels of environmental exposure for which the EEC system has been successfully qualified (for example, vibration, temperature, electro-magnetic interference (EMI), HIRF, and lightning). For the HIRF, lightning, and EMI qualification tests, the CDID should describe the interfacing aircraft cables used for the tests.
(6) Software Validation and Verification. The CDID should identify the software level and documentation submitted in support of the software certification.
Par 3-3 Page 11 (and 12)
CHAPTER 4. SECTION 33.28(b)
4-1. Rule Text. Section 33.28(b) provides that each EEC system: “Be designed and constructed so that any failure of aircraft-supplied power or data will not result in an unacceptable change in power or thrust, or prevent continued safe operation of the engine.”
4-2. Intent of Rule. Section 33.28(b) requires that the EEC system maintain a level of selfsufficiency and isolation from the aircraft, or ensure a level of redundancy, that will enable the EEC system to accommodate aircraft electrical and data system failures. Conventional magneto ignition and mechanical fuel systems currently have the capability to accommodate these aircraft failures.
4-3. Guidance. The following is a method, but not the only method, for demonstrating compliance with §33.28(b). See appendix 1 for a list of compliance documents that may be submitted for this section.
a. General.
(1) Any LOPC event represents an unacceptable change in power. Therefore, the objective of both analyses described in this chapter should be to substantiate that the failure of aircraft-supplied power or data does not cause an LOPC.
(2) However, aircraft-supplied power or data failure events that result in engine effects less severe than an LOPC, such as an MPL, do not represent unacceptable changes in power. The analyses in this chapter and the installation instructions should identify these types of events along with their effect on engine operation. This data can then be used in the powerplant installation safety analysis required under the airplane airworthiness standards of part 23 to evaluate the impact of these failures on airplane operation.
b. Failure of Aircraft-Supplied Power. The applicant should provide an analysis, validated by engine or bench testing, that substantiates the function of the EEC system with a failure or interruption of an aircraft-supplied power source at any point within the declared engineoperating envelope. The following are acceptable design concepts:
(1) Engine Self-Contained Electrical Power System.
(a) This type of system is an integral part of the engine design and is both functionally and physically isolated from the aircraft electrical power system.
(b) This type of electrical power system is considered part of the EEC system; its predicted failure event rate should be included in the EECSA of chapter 5 of this AC.
Par 4-1 Page 13
(c) Back-up electrical power is not necessarily required with this type of system.
However, if the applicant elects to use aircraft power as a back-up source of power, then the applicant should provide detailed electrical system interface requirements in the installation instructions and demonstrate that abnormal behavior of the aircraft source cannot upset the EEC system. The predicted failure event rate of this back-up power system does not have to be included in the EECSA of chapter 5 of this AC.
(d) Power from an engine-mounted alternator or generator that is routed directly to the aircraft main power bus and then in turn used to power the EEC system is considered part of that aircraft bus and not a self-contained engine power source. However, EEC system power from a dedicated winding on an alternator with dual windings is considered a self-contained engine power source, even if the alternate winding is used to provide power for aircraft systems.
(2) Aircraft-Supplied Power System(s) for EEC System Electrical Power.
(a) Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
(b) A failure of a single aircraft bus on an aircraft equipped with multiple aircraft buses is not considered a loss of aircraft power if the buses are independent and isolated from each other and if each of the buses power the EEC system separately. Therefore, a backup source could be an alternate aircraft bus, such as an essential bus, that is independent and isolated from the bus serving as the primary power source. An essential bus is an isolated bus that services only electrical loads required for continued safe operation.
(c) When the EEC system design relies on an aircraft electrical power system for primary power, backup power, or both, the applicant should provide detailed electrical system interface requirements in the installation instructions.
(d) For EEC systems that rely on aircraft electrical power systems for primary power or backup power, a maximum allowable failure event rate should be derived for that system such that the total EEC system failure event rate, including the aircraft power source, remains within the EECSA criteria for full-up and degraded systems of chapter 5 of this AC. This maximum allowable failure event rate requirement for the aircraft electrical power system(s) should be defined in the instructions for installation in chapter 3 of this AC.
(e) If aircraft-supplied power, such as the aircraft bus and battery system, is used as the primary power source, then the EEC system should have a backup power source that is isolated from the primary source. This backup power source can be integral to the engine EEC system or provided by the airplane.
Page 14 Par 4-3
1. Integral EEC System or Engine Electrical Backup Power. Generators or battery systems certified with the engine should be physically and functionally separate from the primary EEC power system.
(aa) The engine instructions for installation should specify installation and interface requirements for the backup system.
(bb) The applicant should provide instructions for continued airworthiness (ICA) and provisions for system monitoring, to ensure that the backup system is capable of powering the EEC system for continued safe flight. For example, a battery system should incorporate provisions for charge level monitoring and the ICA should include maintenance procedures to ensure that the charge level is adequate to power the EEC system.
2. Airplane System Electrical Backup Power, such as Alternate Buses, Essential Buses, or Battery Systems. The engine instructions for installation should specify the following:
(aa) A requirement that the backup system is an essential system physically and functionally separate from the primary EEC power system;
(bb) The interface and reliability requirements for the airplane system to meet overall EEC system objectives;
(cc) System charge level or power requirements and health monitoring requirements to ensure that power or charge level is available.
(dd) For battery systems, a requirement to isolate the backup battery system from the engine starting battery system.
(3) Mechanical Alternate Control Mode. A backup electrical power source is not required for hybrid systems that incorporate a full mechanical alternate control mode. For these systems, the applicant should substantiate that the transition from the electronic-powered mode to the mechanical control mode can be performed without the aircraft-supplied power and without the occurrence of an LOPC.
(4) New and Novel Design Concepts. Technological advances in electrical powergenerating components and in the associated systems may allow for new and novel design concepts to meet the requirements of §33.28(b). The following are examples of possible EEC electrical power system concepts:
(a) Use of an engine alternator, or alternators, to provide power to both the airplane bus system and the engine EEC system. This would require substantiation of the ability of the alternator to continue to supply the EEC system power in the event of an airplane bus failure.
Par 4-3 Page 15
(b) Use of an existing airplane backup essential battery system to also provide backup power for the EEC system. This would require a re-evaluation of the electrical load requirements and the consequent battery endurance. The battery system would have to be essential and could not be the same battery used to start the engine. In addition, the battery system would need to be isolated and independent from the airplane bus system(s).
(5) Non-Critical Engine Control Functions. Some non-critical engine control functions, such as engine starting, that have traditionally relied exclusively upon aircraft electrical power may not have to meet the requirements of §33.28(b).
c. Failure of Aircraft-Supplied Data. The applicant should provide an analysis, based on component, system, or engine testing, as required, that evaluates the impact of the failure of aircraft data on the engine’s performance and operability throughout the flight envelope. This analysis should address all allowable engine control and aircraft dispatch configurations in which failure of aircraft data in that dispatch configuration would impact engine control system response. Failure of aircraft data includes airplane system failure events that either prevent data from being transmitted or result in the transmission of incorrect data. This analysis should consider the following:
(1) The analysis should evaluate the engine control responses to aircraft data inputs and should include an evaluation of the effect of faulty and corrupted aircraft-supplied data on the engine control system.
(2) For EEC systems in which the throttle or power lever command system is not included in the EEC system design, thrust and power command signals sent from aircraft should not be included in this analysis. If the aircraft thrust or power command system is configured to move the engine thrust or power levers or transmit an electronic signal to command a thrust or power change, the engine control system merely responds to the command and changes engine thrust or power as appropriate. The engine control system design should not attempt to differentiate between correct or erroneous throttle or power lever commands. Evaluation of this type of system is performed under the aircraft powerplant installation certification. However, for EEC systems in which the power lever command is included in the EEC system design to be certificated under part 33, the analysis should include the thrust and power command signals.
(3) The design of EEC systems intended for use on multi-engine airplanes should include an evaluation of the potential for common mode faults affecting the operation of more than one engine. The instruction manual should identify data transfers and exchanges between engines, and between the airplane and engines, that could produce common mode faults. The following are examples of potential common mode faults that the analysis should address:
(a) A single erroneous data source transmitted from the aircraft to multiple engines and their associated EEC systems (for example, air data sources, or autothrottle systems).
(b) Control system operating faults spread through data links between engines (for example, maintenance recording, common bus, cross-talk, or automatic power reserve system).
Page 16 Par 4-3
(c) Loss or interruption of aircraft data or electrical power used by the engine control, when that loss or interruption is caused by the failure of another engine.
(4) The applicant should include an evaluation of the EEC system fault accommodation logic for coverage of aircraft-supplied data failures. Testing or analysis should be conducted on the fault accommodated control mode to establish that the engine operating characteristics comply with all operability requirements of part 33. Precautions for addressing common effects may be incorporated in the aircraft system architecture or in the EEC system itself. The following are examples of possible accommodation means:
(a) Alternate control modes that are independent from aircraft-supplied data.
(b) Dual sources of aircraft-supplied sensor data with local engine sensors provided as voters and alternate data sources.
(c) Use of synthesized engine parameters as voters. When synthesized parameters are used for control or voting purposes, the analysis should consider the impact of temperature and other environmental effects on those sensors whose data is used in the synthesis. The analysis should also assess the variability of any data or information necessary to relate the data from the sensors used for the synthesized parameters.
Par 4-3 Page 17 (and 18)