CHAPTER 5. SECTION 33.28(c)
5-1. Rule Text. Section 33.28(c) provides that each EEC system must: “Be designed and constructed so that no single failure or malfunction, or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.”
5-2. Intent of Rule. Section 33.28(c) addresses the unique, random nature of EEC system failures as compared to the progressive, wear-out nature of mechanical control system failures.
These random failures can be accommodated by designing redundancy and reliability into the system. A reliability and safety analysis can substantiate that the system design meets this intended purpose. Two key terms that are used when evaluating system safety are “single-fault tolerant” and “unsafe condition.”
a. Single-Fault Tolerant. To meet the intent of 33.28(c), the engine control system should be essentially single fault tolerant of electrical and electronic component failures that can cause an unsafe condition.
(1) Achieving complete single fault tolerance could require a triplicate design approach, or a design approach with 100% fault detection. The FAA has determined that it may be appropriate for the applicant to omit some coverage because detection or accommodation of certain electrical or electronic faults may not be practical. In these cases, single, simple electrical or electronic components or circuits can be used in a reliable manner; requiring redundancy in some situations may add unnecessary complexity.
(2) EEC systems that are equipped with dual, redundant channels or with backup systems that do not provide complete coverage of faults have been approved by the FAA and have demonstrated excellent in-service safety and reliability. However, these FAA approvals were based upon a detailed review of each of these uncovered faults.
b. Unsafe Condition. Engine power loss events are not typically considered unsafe conditions when evaluating airplane safety. However, if the frequency of these events is excessive relative to the safety objectives of the intended application, then they can be considered unsafe conditions. Consequently, engine power losses and shutdowns are included in the following failure conditions and categories that are considered unsafe conditions for reciprocating engines:
(1) Destructive events (DE).
(2) Excessive number of LOPC events.
(3) Excessive number of MPL events.
Par 5-1 Page 19
5-3. Compliance.
a. Section 33.28(c) refers only to electrical and electronic components; it does not address mechanical control system components. The rule also does not specifically address operations when faults are present in the EEC system. However, service experience with EEC systems indicates that to be economically viable, EEC system equipped engines must be permitted to operate for limited time periods with faults present in the system (that is, permitted to operate in a degraded state). In addition, a thorough system safety analysis should include all of the components of the control system, including the mechanical components. To address these issues as well as meet the intent of the rule, the FAA has developed a method, but not the only method, for demonstrating compliance that allows for operation with certain faults (that is, in a degraded state) and that addresses the mechanical components of the control system.
b. This method consists of an engine control system safety analysis with both quantitative and qualitative elements. The quantitative element compares the predicted number of failure events of the electrical or electronic components with established criteria that represents unsafe conditions. Both full-up and degraded configurations are evaluated, but those degraded system configurations that are found acceptable are limited to 20 hours of operation. Mechanical component reliability is evaluated through the test and analyses required by §§33.19, 33.49, and
33.53. The qualitative elements provide an evaluation of the entire engine control system.
5-4. Guidance. Instead of addressing all forms and levels of safety analyses, the FAA has developed a method, but not the only method, for demonstrating compliance that meets the intent of §33.28(c) and ensures an acceptable level of safety. The applicant may use a different method of showing compliance; alternative methods should be reviewed and accepted by the FAA as early as possible in the project. The applicant can submit an EECSA to comply with §33.28.
The method of showing compliance described in this chapter allows for FAA approval of timelimited flight operations with certain EEC system faults. A time limit of 20 hours was derived from the unsafe condition criteria established for a degraded EEC system to ensure an acceptable reliability level is maintained during this type of operation. See appendix 1 for a list of compliance documents that may be submitted for this section.
a. EECSA General. The EECSA includes a quantitative element that is intended to evaluate the predicted reliability of the electrical or electronic components of the EEC system and compare it to the system safety criteria included in this AC. The EECSA also includes a qualitative element that provides an evaluation of certain aspects of the control system.
(1) The EECSA quantitative analysis will determine the instantaneous failure event rates in both the full-up system and degraded system. These event rates are then compared to the unsafe condition criteria for both the full-up and degraded systems. The quantitative analysis should consist of the following analyses:
(a) Numerical fault tree analysis (FTA);
(b) Failure modes and effects analysis (FMEA); and Page 20 Par 5-3
(c) Markov or similar type of analysis to evaluate the EEC system in a degraded condition.
(2) The EECSA qualitative analysis consists of design appraisals of certain aspects of the EEC system. Paragraph 5-3e of this AC provides a detailed overview of these analyses. The qualitative analyses should include the following reports:
(a) Alternate control mode(s) characteristics;
(b) Control mode transition;
(c) EEC system output data content;
(d) Existing subsystems;
(e) Local events analysis;
(f) Commercial, automotive, or industrial grade electronic parts analysis; and
(g) Programmed logic device usage.
b. EECSA Assumptions. The EECSA should explain any assumptions made regarding airplane installation and operating conditions. These assumptions should be consistent with corresponding data contained in the ICAs and the instructions for installation. These assumptions could include, but are not limited to, the following:
(1) Maintenance actions and associated intervals;
(2) Airplane systems or equipment response;
(3) Powerplant installation design and environment; and
(4) Latent failure exposure period.
c. EECSA Quantitative Analysis. The quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgement and experience.
In general, the depth and scope of an acceptable safety analysis depends on the complexity and criticality of the functions performed by the system and can vary considerably for different types of systems. Because this analysis is limited to reciprocating engine electronic control systems, the criteria provided in this AC can be more specific. The quantitative analysis should encompass all elements of the control system, electrical or electronic and mechanical. However, the analysis should only consider failure rates from the electrical or electronic components for predictions of system reliability. The analysis should not consider the reliability of mechanical components, because it is assumed that they are not subject to random failures. The durability of the mechanical components should be evaluated during the certification block testing.
Par 5-4 Page 21
(1) EECSA Safety Criteria. This AC provides safety criteria, expressed in terms of events per million hours, that has been found acceptable for EEC systems installed on reciprocating engines.
(a) The safety criteria is provided for each of the two major control subsystems (fuel and ignition), and also for any other subsystem. This is intended to accommodate varying degrees of system functionality by increasing the allowable failure event rates as subsystems or functions are added to the total system definition. However, once the total number of subsystems is defined and the associated maximum failure event rates are calculated, these failure rates are allocated across the total system and not to the individual subsystems.
(b) Criteria is also provided for both full-up and degraded configurations. Criteria other than that presented in this AC may be appropriate if data is available that substantiates the alternative reliability objective.
(c) The FAA consulted with industry representatives and analyzed available service data to establish the reciprocating engine control system failure event rates. This included a review of the FAA service difficulty reports (SDR) database, the National Transportation Safety Board (NTSB)/FAA accident database, and the Airplane Operators and Pilots Association (AOPA) accident data. SDR events relating to fuel system or ignition system failures were tabulated and corrected for known underreporting of events, and assumptions were made regarding the event data to estimate the actual rate. This reciprocating engine in-service data was then reviewed with reciprocating engine industry representatives and compared to the turbine requirement of one Loss of Thrust Control (LOTC) event per 100,000 hours. After an evaluation of the respective criticality of these two types of engines in their typical installations, the failure event rates of tables 5-1 and 5-2 were found to be consistent with FAA safety objectives for reciprocating engines.
(2) Full-Up System Analysis Methods and Criteria. This analysis should be used to confirm that the full-up system meets the system safety criteria specified in table 5-1. The applicant should perform both a numerical FTA and an FMEA. An FMEA is a structured, inductive, bottom-up analysis used to evaluate the effects of each possible failure of the control system on engine operation. An FTA is a structured, deductive, top-down analysis used to identify the conditions, failures, and events that would cause each defined failure event. An FTA is a graphic method of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations of both that can cause the failure condition.
(a) Mechanical components should be included in the structure of each of these analyses, but only to evaluate the interrelationships among the EEC system components.
However, reliability values should not be assigned to the mechanical components, and they should not be included in the cumulative event rate for the system.
Page 22 Par 5-4
(b) Table 5-1 provides safety criteria for the full-up system. Each of these system elements is additive; “other” applies to each subsystem in addition to the fuel and ignition systems. For example, an EEC system comprised of fuel, ignition, and wastegate control functions should meet a total system reliability of 15+15+15=45 LOPC events per million hours (and 450 MPL events per million hours). This criteria is then applied to the entire system and not allocated to each of the subsystems. Note that a maximum of 45 LOPC and 450 MPL events per million hours are allowed, regardless of the number of subsystems. For example, if the EEC system includes more than three subsystems, the sum of the LOPC rates for the total system should not exceed 45 LOPC or 450 MPL events per million hours for all of the electrical and electronic elements.
(c) The event rates in table 5-1 should be applied to the highest appropriate system or subsystem level and not, for example, to individual components of the same system.
(3) Degraded System Analysis Methods and Criteria. This analysis should be used to confirm that the system meets the system safety criteria stated in table 5-2 with an existing fault or faults in the system, when time limited operations with that fault or faults is desired. If the existing fault or faults does not affect engine operability and the criteria of table 5-2 are met, then Time-Limited Operations (TLO) may be approved for these fault conditions. The analysis determines the instantaneous failure rate with one or more failures in the system. A Markov analysis, or channel failure analysis for simple systems, may be used.
d. TLO Implementation Requirements. FAA acceptance of the EECSA is based upon incorporating provisions in the EEC system design for the following:
(1) All EEC system faults should be grouped into one of the following three operating limitation categories:
(a) No Take-Off (NTO). Take-off is not acceptable for total system faults that result in calculated event rates that exceed the degraded system limits or when the system does not have sufficient resources to operate the engine properly. These system faults are defined as NTO faults.
(b) TLO. Twenty hours of operation with total system faults is acceptable when the calculated event rates are greater than the full-up limits but less than the degraded system limits.
These system faults are defined as TLO faults. In addition, the total system LOPC and MPL rates should not be greater than 450 and 4500 events per million flight hours, respectively, for the system to considered acceptable for TLO operations.
(c) Unlimited Operation (ULO). Unlimited operation is acceptable when the calculated event rates are less than the full-up system analysis limits (this may apply to degraded system with certain minor faults).
(d) The system limits are additive (from tables 5-1 and 5-2) for all subsystems included in the applicant’s EEC system design.
Par 5-4 Page 23
(2) The EEC system design should include provisions for separate cockpit indications for TLO faults and NTO faults, such as:
(a) Indicator lights, codes, etc.; and
(b) Confirmation of indicator function during the pre-flight check.
(3) Engine airworthiness limitations and operating limitations for TLO faults, NTO faults, and ULO faults should be specified in the following certification documents:
(a) Airworthiness Limitations Section (ALS) of the Instructions for Continued Airworthiness (ICA) issued for the type certificate (TC) or STC; and
(b) TCDS and STC limitations; and
(c) Instructions for installation.
(4) The limitations should then be published in the airplane maintenance manual and established as powerplant limitations in the Airplane Flight Manual (AFM) or Pilot Operating Handbook (POH).
(5) Information regarding maintenance actions associated with EEC system faults should be included in the troubleshooting procedures of the Engine Maintenance Manual.
TABLE 5-1 Full-Up System Safety Criteria Electrical or Electronic Components (Events per Million Hours)
Subsystem Maximum Total System Maximum
Failure Condition Ignition Fuel Other System Destructive Event <0.001 <0.001 <0.001 <0.003 LOPC 15 15 15 45 MPL 150 150 150 450 No Effect - - - -
Page 24 Par 5-4
TABLE 5-2 Degraded System Safety Criteria Electrical or Electronic Components (Events per Million Hours)
Subsystem Maximum Total System Maximum
Failure Condition Ignition Fuel Other System Destructive Event <0.001 <0.001 <0.001 <0.001 LOPC 150 150 150 450 MPL 1500 1500 1500 4500 No Effect - - - -
e. EECSA Qualitative Analyses. These analyses complement the quantitative analyses and substantiate that the applicant has evaluated all aspects of the EEC system design. These analyses should include the mechanical components as well as the electrical and electronic components.
(1) Alternate Control Mode Analysis. Alternate or backup control modes or systems are usually necessary to meet the essentially single fault tolerant requirement of §33.28(c).
However, unlike engines for transport category aircraft, the backup modes for reciprocating engines may have limited control authority.
(a) If the alternate control mode does not affect engine operability, and if the predicted event rate of the control mode does not exceed the criteria of table 5-2, then 20 hours of operation is permitted in this mode.
(b) The acceptability of these alternate systems should be based on the following factors:
1. Effect on engine operability; and
2. Characteristics of the transition to the alternate control mode.
Par 5-4 Page 25
(c) Factors relating to engine operability that should be considered in the design and evaluation of any alternate operating mode(s) should include, but are not limited to, the following:
1. Maximum power level achievable in the alternate operating mode;
2. Engine control range in the alternate operating mode;
3. Altitude restart capability;
4. Dormant failures of the alternate operating mode, and documentation of any automatic or manual checks to ensure the availability of the mode; and
5. Throttle motion restriction or any other envelope restrictions.
(2) Control Mode Transition Analysis. The EECSA should evaluate systems that use alternate control modes as backup systems, including fail-fixed or fail-to-manual control systems, to determine acceptability of the mode transfer mechanism.
(a) A manually activated switch to transition to the alternate mode may be acceptable if the instruction manual documents this emergency procedure and it is evaluated in the EECSA.
(b) In some turbine applications the FAA has accepted a “fail-fixed” fuel flow followed by a manually activated switch to the alternate mode. If this type of alternate control mode is incorporated in a reciprocating engine, the applicant should make provisions for indication of the “fail-fixed” condition to the flight crew.
(c) The alternate mode may be implemented using hydromechanical, electrical/electronic, manual means, or any combination of these means. The engine instruction manual should state the power change associated with an automatic transfer to the alternate mode.
(d) Power changes during automatic transfer to backup should be limited to less than 15%. Power changes greater than 15% may be accepted if they result from a crew-selected transfer.
(e) Acceptable transition between all control modes should be demonstrated to the greatest extent possible. Development flight-testing should be used for further evaluation, if available. If pilot action is required in the fault detection and transfer of control, the engine instruction manual should declare the faults involved in such a situation and the aircraft certification program should evaluate the condition(s).
Page 26 Par 5-4
(f) For transfers that occur automatically, the following factors should be considered:
1. The frequency of occurrence of transfers to any alternate control mode.
Computed frequency of transfer to any alternate control mode should be supported with data from endurance or reliability testing, in-service experience on similar equipment, or other data acceptable to the FAA.
2. Faults that would result in transfer to any alternate mode, and the capability of detecting these faults.
3. Self-test coverage and diagnostics. Sufficient self-test coverage and diagnostics should be provided to allow detection of error conditions critical to system performance.
4. Time delays in the transfer of control. The engine installation manual should specify time delays in the transfer of control. In some cases, the certification engineer may not be able to determine if the mode transition provides a safe and acceptable system in accordance with part 33 based solely on analytical or simulation data. An engine test or flight test program could be used to provide additional data. In any case, such control transition delays may or may not be certifiable at the aircraft level depending on the installation. The aircraft certification program should fully evaluate any control mode transition.
5. Availability of the alternate mode. If the alternate mode is not exercised during normal mode operation, an inspection interval to uncover latent failures in the alternate mode components, or a procedure for exercising the alternate mode, should be specified to ensure that the alternate mode is functional and available. Any inspection interval or procedure requires FAA approval. This should be included in the Operating Instructions and in the Engine Maintenance Manual.
6. Provisions for signal(s) to indicate a mode transition.
(g) Pilot workload and performance during transition to or operation in an alternate control mode may need evaluation at the aircraft level. The applicant should review the applicable aircraft certification requirements and coordinate with the installer, if known, to determine if any alternate operating modes would comply with the applicable aircraft requirements. These issues have been significant for some programs.
(3) EEC System Output Data Analysis. The EECSA should include information about faults or failures that could cause the transmission of faulty or drifting engine parameters to the aircraft systems, including a prediction of the rate of occurrence. The following engine output parameters are examples of parameters that could be addressed in this analysis:
(a) Oil pressure;
(b) Engine speed;
(c) Manifold pressure;
Par 5-4 Page 27
(d) Cylinder head temperature;
(e) Turbine inlet temperature;
(f) Exhaust gas temperature;
(g) Calculated engine power parameters (horsepower or torque, etc.);
(h) Combustion pressure; and
(i) Engine detonation (sometimes called knock).
(4) Existing Subsystems Analysis. The EECSA should include an evaluation of the functional interaction of any existing mechanical control system elements that remain on the engine after incorporation of the EEC system or subsystem. The existing subsystems analysis should:
(a) Address existing mechanical subsystems such as carburetors, magneto ignition, turbo mechanical wastegates, and mechanical fuel injection;
(b) Substantiate interface and installation requirements related to these existing mechanical systems or components; and
(c) Address effects on the EEC system of failures of these mechanical systems.
(5) Local Events Analysis. When the installation environment is more severe than the declared environmental limits, the EECSA safety criteria does not apply. Occurrence of severe environmental events would normally be limited to one engine and are referred to as “local events.” A local event is not usually considered a common mode event; common mode threats, such as HIRF, lightning and rain are not considered local events. (There may be installations in which multiple engines are affected by the same local event. Such installations should be considered by the engine manufacturer and will be reviewed during aircraft certification.)
(a) Examples of local events:
1. Fluid leaks or mechanical disruptions that could lead to damage to control system electrical harnesses, connectors, or the control unit(s);
2. Fires; and
3. Overheat conditions, for example, those resulting from hot air duct bursts.
Page 28 Par 5-4
(b) Consideration of Local Events.
1. Whatever the local event, the resultant behavior of the EEC system should not cause a destructive event.
2. If accommodation of a particular local event is based on the assumption that there is another function that affords the necessary protection, it should be shown that this function is not rendered inoperative by the same local event on the engine (including destruction of wires, ducts, or power supplies).
3. For the purposes of this AC, an overheat condition exists when the temperature of the system components is greater than the maximum design operating temperature for the components, as declared by the engine manufacturer in the engine instructions for installation.
The electronic portions of the control system should not cause a hazardous engine effect when the electronic components or units of the system are exposed to a continuous overheat or overtemperature condition. Specific design features or analysis methods should be used to show compliance with respect to the prevention of hazardous effects. When this is not possible, due to the variability or the complexity of the failure sequence, for example, the FAA may require testing.
(c) Fire Testing. Exposure of the electrical and electronic parts of the EEC system to fire should not intensify the severity of the fire condition. If the EEC system is located in a fire zone, the applicant should perform either an analysis of system effects due to fire damage, or fire testing. Fire zones are defined in appropriate aircraft design regulations.
1. The fire requirements do not specify the length of time that electronic parts are required to function when exposed to fire. The FAA has developed an acceptance criteria for EEC systems that specifies either that the control system must maintain the ability to safely shut down the engine when exposed to fire, or that there must be an alternate method, such as a fuel shutoff valve, that allows the pilot to safely shutdown the engine when there is a fire in the engine compartment. In addition, the fire analysis or fire test should verify that when exposed to fire for a five minute period the system does not take unwanted action that could be hazardous to the aircraft.
2. The fuel handling parts of the EEC system, including the fuel injector valve parts that are directly in contact with the fuel, should comply with the requirements of §33.17, which requires these parts to be fire resistant and shielded or located to guard against the ignition of leaking flammable fluids.
3. The FAA has accepted computer simulations of EEC system exposure to fire instead of fire tests on production hardware as demonstration of compliance with fire requirements. The computer simulation should be validated by analysis or test, or both, and should be approved by the FAA. The FAA should also approve all assumptions upon which construction of the computer simulation is based.
Par 5-4 Page 29