(4) EECSA Results. The CDID should specify the estimated reliability of, or the failure rates for, safety-significant failure conditions and the other events associated with the control system (that is, events that the control system causes or is involved in preventing), as determined from the system safety analysis, such as the following:
(a) LOPC rate from the numerical fault tree analysis (FTA) and failure modes and effects analysis (FMEA);
(b) MPL rate from the numerical FTA and FMEA;
(c) Failures that result in a system transfer to an alternate control mode;
(d) Transmission of faulty parameters that affect cockpit-located engine displays or other safety critical functions identified in the EEC system output data content analysis;
(e) Loss of any critical safeguards, such as CHT or overboost limiting control, identified as latent failures in the FMEA or FTA;
(f) Failures of existing engine mechanical systems that could produce significant EEC system failure modes or effects as identified in the existing subsystems analysis; and
(g) Fault accommodation logic data (for EEC system faults) as identified in the fault accommodation logic analysis:
1. Tabulation of the fault accommodation logic for the critical parameters used by the control; and
2. Tabulation of the “default” or “fail-safe” states of all output effectors and the rationale for selection.
(5) Environmental Testing. The CDID should specify the types and levels of environmental exposure for which the EEC system has been successfully qualified (for example, vibration, temperature, electro-magnetic interference (EMI), HIRF, and lightning). For the HIRF, lightning, and EMI qualification tests, the CDID should describe the interfacing aircraft cables used for the tests.
(6) Software Validation and Verification. The CDID should identify the software level and documentation submitted in support of the software certification.
Par 3-3 Page 11 (and 12)
CHAPTER 4. SECTION 33.28(b)
4-1. Rule Text. Section 33.28(b) provides that each EEC system: “Be designed and constructed so that any failure of aircraft-supplied power or data will not result in an unacceptable change in power or thrust, or prevent continued safe operation of the engine.”
4-2. Intent of Rule. Section 33.28(b) requires that the EEC system maintain a level of selfsufficiency and isolation from the aircraft, or ensure a level of redundancy, that will enable the EEC system to accommodate aircraft electrical and data system failures. Conventional magneto ignition and mechanical fuel systems currently have the capability to accommodate these aircraft failures.
4-3. Guidance. The following is a method, but not the only method, for demonstrating compliance with §33.28(b). See appendix 1 for a list of compliance documents that may be submitted for this section.
a. General.
(1) Any LOPC event represents an unacceptable change in power. Therefore, the objective of both analyses described in this chapter should be to substantiate that the failure of aircraft-supplied power or data does not cause an LOPC.
(2) However, aircraft-supplied power or data failure events that result in engine effects less severe than an LOPC, such as an MPL, do not represent unacceptable changes in power. The analyses in this chapter and the installation instructions should identify these types of events along with their effect on engine operation. This data can then be used in the powerplant installation safety analysis required under the airplane airworthiness standards of part 23 to evaluate the impact of these failures on airplane operation.
b. Failure of Aircraft-Supplied Power. The applicant should provide an analysis, validated by engine or bench testing, that substantiates the function of the EEC system with a failure or interruption of an aircraft-supplied power source at any point within the declared engineoperating envelope. The following are acceptable design concepts:
(1) Engine Self-Contained Electrical Power System.
(a) This type of system is an integral part of the engine design and is both functionally and physically isolated from the aircraft electrical power system.
(b) This type of electrical power system is considered part of the EEC system; its predicted failure event rate should be included in the EECSA of chapter 5 of this AC.
Par 4-1 Page 13
(c) Back-up electrical power is not necessarily required with this type of system.
However, if the applicant elects to use aircraft power as a back-up source of power, then the applicant should provide detailed electrical system interface requirements in the installation instructions and demonstrate that abnormal behavior of the aircraft source cannot upset the EEC system. The predicted failure event rate of this back-up power system does not have to be included in the EECSA of chapter 5 of this AC.
(d) Power from an engine-mounted alternator or generator that is routed directly to the aircraft main power bus and then in turn used to power the EEC system is considered part of that aircraft bus and not a self-contained engine power source. However, EEC system power from a dedicated winding on an alternator with dual windings is considered a self-contained engine power source, even if the alternate winding is used to provide power for aircraft systems.
(2) Aircraft-Supplied Power System(s) for EEC System Electrical Power.
(a) Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
(b) A failure of a single aircraft bus on an aircraft equipped with multiple aircraft buses is not considered a loss of aircraft power if the buses are independent and isolated from each other and if each of the buses power the EEC system separately. Therefore, a backup source could be an alternate aircraft bus, such as an essential bus, that is independent and isolated from the bus serving as the primary power source. An essential bus is an isolated bus that services only electrical loads required for continued safe operation.
(c) When the EEC system design relies on an aircraft electrical power system for primary power, backup power, or both, the applicant should provide detailed electrical system interface requirements in the installation instructions.
(d) For EEC systems that rely on aircraft electrical power systems for primary power or backup power, a maximum allowable failure event rate should be derived for that system such that the total EEC system failure event rate, including the aircraft power source, remains within the EECSA criteria for full-up and degraded systems of chapter 5 of this AC. This maximum allowable failure event rate requirement for the aircraft electrical power system(s) should be defined in the instructions for installation in chapter 3 of this AC.
(e) If aircraft-supplied power, such as the aircraft bus and battery system, is used as the primary power source, then the EEC system should have a backup power source that is isolated from the primary source. This backup power source can be integral to the engine EEC system or provided by the airplane.
Page 14 Par 4-3
1. Integral EEC System or Engine Electrical Backup Power. Generators or battery systems certified with the engine should be physically and functionally separate from the primary EEC power system.
(aa) The engine instructions for installation should specify installation and interface requirements for the backup system.
(bb) The applicant should provide instructions for continued airworthiness (ICA) and provisions for system monitoring, to ensure that the backup system is capable of powering the EEC system for continued safe flight. For example, a battery system should incorporate provisions for charge level monitoring and the ICA should include maintenance procedures to ensure that the charge level is adequate to power the EEC system.
2. Airplane System Electrical Backup Power, such as Alternate Buses, Essential Buses, or Battery Systems. The engine instructions for installation should specify the following:
(aa) A requirement that the backup system is an essential system physically and functionally separate from the primary EEC power system;
(bb) The interface and reliability requirements for the airplane system to meet overall EEC system objectives;
(cc) System charge level or power requirements and health monitoring requirements to ensure that power or charge level is available.
(dd) For battery systems, a requirement to isolate the backup battery system from the engine starting battery system.
(3) Mechanical Alternate Control Mode. A backup electrical power source is not required for hybrid systems that incorporate a full mechanical alternate control mode. For these systems, the applicant should substantiate that the transition from the electronic-powered mode to the mechanical control mode can be performed without the aircraft-supplied power and without the occurrence of an LOPC.
(4) New and Novel Design Concepts. Technological advances in electrical powergenerating components and in the associated systems may allow for new and novel design concepts to meet the requirements of §33.28(b). The following are examples of possible EEC electrical power system concepts:
(a) Use of an engine alternator, or alternators, to provide power to both the airplane bus system and the engine EEC system. This would require substantiation of the ability of the alternator to continue to supply the EEC system power in the event of an airplane bus failure.
Par 4-3 Page 15
(b) Use of an existing airplane backup essential battery system to also provide backup power for the EEC system. This would require a re-evaluation of the electrical load requirements and the consequent battery endurance. The battery system would have to be essential and could not be the same battery used to start the engine. In addition, the battery system would need to be isolated and independent from the airplane bus system(s).
(5) Non-Critical Engine Control Functions. Some non-critical engine control functions, such as engine starting, that have traditionally relied exclusively upon aircraft electrical power may not have to meet the requirements of §33.28(b).
c. Failure of Aircraft-Supplied Data. The applicant should provide an analysis, based on component, system, or engine testing, as required, that evaluates the impact of the failure of aircraft data on the engine’s performance and operability throughout the flight envelope. This analysis should address all allowable engine control and aircraft dispatch configurations in which failure of aircraft data in that dispatch configuration would impact engine control system response. Failure of aircraft data includes airplane system failure events that either prevent data from being transmitted or result in the transmission of incorrect data. This analysis should consider the following:
(1) The analysis should evaluate the engine control responses to aircraft data inputs and should include an evaluation of the effect of faulty and corrupted aircraft-supplied data on the engine control system.
(2) For EEC systems in which the throttle or power lever command system is not included in the EEC system design, thrust and power command signals sent from aircraft should not be included in this analysis. If the aircraft thrust or power command system is configured to move the engine thrust or power levers or transmit an electronic signal to command a thrust or power change, the engine control system merely responds to the command and changes engine thrust or power as appropriate. The engine control system design should not attempt to differentiate between correct or erroneous throttle or power lever commands. Evaluation of this type of system is performed under the aircraft powerplant installation certification. However, for EEC systems in which the power lever command is included in the EEC system design to be certificated under part 33, the analysis should include the thrust and power command signals.
(3) The design of EEC systems intended for use on multi-engine airplanes should include an evaluation of the potential for common mode faults affecting the operation of more than one engine. The instruction manual should identify data transfers and exchanges between engines, and between the airplane and engines, that could produce common mode faults. The following are examples of potential common mode faults that the analysis should address:
(a) A single erroneous data source transmitted from the aircraft to multiple engines and their associated EEC systems (for example, air data sources, or autothrottle systems).
(b) Control system operating faults spread through data links between engines (for example, maintenance recording, common bus, cross-talk, or automatic power reserve system).
Page 16 Par 4-3
(c) Loss or interruption of aircraft data or electrical power used by the engine control, when that loss or interruption is caused by the failure of another engine.
(4) The applicant should include an evaluation of the EEC system fault accommodation logic for coverage of aircraft-supplied data failures. Testing or analysis should be conducted on the fault accommodated control mode to establish that the engine operating characteristics comply with all operability requirements of part 33. Precautions for addressing common effects may be incorporated in the aircraft system architecture or in the EEC system itself. The following are examples of possible accommodation means:
(a) Alternate control modes that are independent from aircraft-supplied data.
(b) Dual sources of aircraft-supplied sensor data with local engine sensors provided as voters and alternate data sources.
(c) Use of synthesized engine parameters as voters. When synthesized parameters are used for control or voting purposes, the analysis should consider the impact of temperature and other environmental effects on those sensors whose data is used in the synthesis. The analysis should also assess the variability of any data or information necessary to relate the data from the sensors used for the synthesized parameters.
Par 4-3 Page 17 (and 18)
CHAPTER 5. SECTION 33.28(c)
5-1. Rule Text. Section 33.28(c) provides that each EEC system must: “Be designed and constructed so that no single failure or malfunction, or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.”
5-2. Intent of Rule. Section 33.28(c) addresses the unique, random nature of EEC system failures as compared to the progressive, wear-out nature of mechanical control system failures.
These random failures can be accommodated by designing redundancy and reliability into the system. A reliability and safety analysis can substantiate that the system design meets this intended purpose. Two key terms that are used when evaluating system safety are “single-fault tolerant” and “unsafe condition.”
a. Single-Fault Tolerant. To meet the intent of 33.28(c), the engine control system should be essentially single fault tolerant of electrical and electronic component failures that can cause an unsafe condition.
(1) Achieving complete single fault tolerance could require a triplicate design approach, or a design approach with 100% fault detection. The FAA has determined that it may be appropriate for the applicant to omit some coverage because detection or accommodation of certain electrical or electronic faults may not be practical. In these cases, single, simple electrical or electronic components or circuits can be used in a reliable manner; requiring redundancy in some situations may add unnecessary complexity.
(2) EEC systems that are equipped with dual, redundant channels or with backup systems that do not provide complete coverage of faults have been approved by the FAA and have demonstrated excellent in-service safety and reliability. However, these FAA approvals were based upon a detailed review of each of these uncovered faults.
b. Unsafe Condition. Engine power loss events are not typically considered unsafe conditions when evaluating airplane safety. However, if the frequency of these events is excessive relative to the safety objectives of the intended application, then they can be considered unsafe conditions. Consequently, engine power losses and shutdowns are included in the following failure conditions and categories that are considered unsafe conditions for reciprocating engines:
(1) Destructive events (DE).
(2) Excessive number of LOPC events.
(3) Excessive number of MPL events.
Par 5-1 Page 19
5-3. Compliance.
a. Section 33.28(c) refers only to electrical and electronic components; it does not address mechanical control system components. The rule also does not specifically address operations when faults are present in the EEC system. However, service experience with EEC systems indicates that to be economically viable, EEC system equipped engines must be permitted to operate for limited time periods with faults present in the system (that is, permitted to operate in a degraded state). In addition, a thorough system safety analysis should include all of the components of the control system, including the mechanical components. To address these issues as well as meet the intent of the rule, the FAA has developed a method, but not the only method, for demonstrating compliance that allows for operation with certain faults (that is, in a degraded state) and that addresses the mechanical components of the control system.
b. This method consists of an engine control system safety analysis with both quantitative and qualitative elements. The quantitative element compares the predicted number of failure events of the electrical or electronic components with established criteria that represents unsafe conditions. Both full-up and degraded configurations are evaluated, but those degraded system configurations that are found acceptable are limited to 20 hours of operation. Mechanical component reliability is evaluated through the test and analyses required by §§33.19, 33.49, and
33.53. The qualitative elements provide an evaluation of the entire engine control system.
5-4. Guidance. Instead of addressing all forms and levels of safety analyses, the FAA has developed a method, but not the only method, for demonstrating compliance that meets the intent of §33.28(c) and ensures an acceptable level of safety. The applicant may use a different method of showing compliance; alternative methods should be reviewed and accepted by the FAA as early as possible in the project. The applicant can submit an EECSA to comply with §33.28.
The method of showing compliance described in this chapter allows for FAA approval of timelimited flight operations with certain EEC system faults. A time limit of 20 hours was derived from the unsafe condition criteria established for a degraded EEC system to ensure an acceptable reliability level is maintained during this type of operation. See appendix 1 for a list of compliance documents that may be submitted for this section.
a. EECSA General. The EECSA includes a quantitative element that is intended to evaluate the predicted reliability of the electrical or electronic components of the EEC system and compare it to the system safety criteria included in this AC. The EECSA also includes a qualitative element that provides an evaluation of certain aspects of the control system.
(1) The EECSA quantitative analysis will determine the instantaneous failure event rates in both the full-up system and degraded system. These event rates are then compared to the unsafe condition criteria for both the full-up and degraded systems. The quantitative analysis should consist of the following analyses:
(a) Numerical fault tree analysis (FTA);
(b) Failure modes and effects analysis (FMEA); and Page 20 Par 5-3
(c) Markov or similar type of analysis to evaluate the EEC system in a degraded condition.
(2) The EECSA qualitative analysis consists of design appraisals of certain aspects of the EEC system. Paragraph 5-3e of this AC provides a detailed overview of these analyses. The qualitative analyses should include the following reports:
(a) Alternate control mode(s) characteristics;
(b) Control mode transition;
(c) EEC system output data content;
(d) Existing subsystems;
(e) Local events analysis;
(f) Commercial, automotive, or industrial grade electronic parts analysis; and
(g) Programmed logic device usage.
b. EECSA Assumptions. The EECSA should explain any assumptions made regarding airplane installation and operating conditions. These assumptions should be consistent with corresponding data contained in the ICAs and the instructions for installation. These assumptions could include, but are not limited to, the following:
(1) Maintenance actions and associated intervals;
(2) Airplane systems or equipment response;
(3) Powerplant installation design and environment; and
(4) Latent failure exposure period.
c. EECSA Quantitative Analysis. The quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgement and experience.
In general, the depth and scope of an acceptable safety analysis depends on the complexity and criticality of the functions performed by the system and can vary considerably for different types of systems. Because this analysis is limited to reciprocating engine electronic control systems, the criteria provided in this AC can be more specific. The quantitative analysis should encompass all elements of the control system, electrical or electronic and mechanical. However, the analysis should only consider failure rates from the electrical or electronic components for predictions of system reliability. The analysis should not consider the reliability of mechanical components, because it is assumed that they are not subject to random failures. The durability of the mechanical components should be evaluated during the certification block testing.
Par 5-4 Page 21
(1) EECSA Safety Criteria. This AC provides safety criteria, expressed in terms of events per million hours, that has been found acceptable for EEC systems installed on reciprocating engines.
(a) The safety criteria is provided for each of the two major control subsystems (fuel and ignition), and also for any other subsystem. This is intended to accommodate varying degrees of system functionality by increasing the allowable failure event rates as subsystems or functions are added to the total system definition. However, once the total number of subsystems is defined and the associated maximum failure event rates are calculated, these failure rates are allocated across the total system and not to the individual subsystems.
(b) Criteria is also provided for both full-up and degraded configurations. Criteria other than that presented in this AC may be appropriate if data is available that substantiates the alternative reliability objective.
(c) The FAA consulted with industry representatives and analyzed available service data to establish the reciprocating engine control system failure event rates. This included a review of the FAA service difficulty reports (SDR) database, the National Transportation Safety Board (NTSB)/FAA accident database, and the Airplane Operators and Pilots Association (AOPA) accident data. SDR events relating to fuel system or ignition system failures were tabulated and corrected for known underreporting of events, and assumptions were made regarding the event data to estimate the actual rate. This reciprocating engine in-service data was then reviewed with reciprocating engine industry representatives and compared to the turbine requirement of one Loss of Thrust Control (LOTC) event per 100,000 hours. After an evaluation of the respective criticality of these two types of engines in their typical installations, the failure event rates of tables 5-1 and 5-2 were found to be consistent with FAA safety objectives for reciprocating engines.
(2) Full-Up System Analysis Methods and Criteria. This analysis should be used to confirm that the full-up system meets the system safety criteria specified in table 5-1. The applicant should perform both a numerical FTA and an FMEA. An FMEA is a structured, inductive, bottom-up analysis used to evaluate the effects of each possible failure of the control system on engine operation. An FTA is a structured, deductive, top-down analysis used to identify the conditions, failures, and events that would cause each defined failure event. An FTA is a graphic method of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations of both that can cause the failure condition.
(a) Mechanical components should be included in the structure of each of these analyses, but only to evaluate the interrelationships among the EEC system components.
However, reliability values should not be assigned to the mechanical components, and they should not be included in the cumulative event rate for the system.
Page 22 Par 5-4