(2) The EEC system design should include provisions for separate cockpit indications for TLO faults and NTO faults, such as:
(a) Indicator lights, codes, etc.; and
(b) Confirmation of indicator function during the pre-flight check.
(3) Engine airworthiness limitations and operating limitations for TLO faults, NTO faults, and ULO faults should be specified in the following certification documents:
(a) Airworthiness Limitations Section (ALS) of the Instructions for Continued Airworthiness (ICA) issued for the type certificate (TC) or STC; and
(b) TCDS and STC limitations; and
(c) Instructions for installation.
(4) The limitations should then be published in the airplane maintenance manual and established as powerplant limitations in the Airplane Flight Manual (AFM) or Pilot Operating Handbook (POH).
(5) Information regarding maintenance actions associated with EEC system faults should be included in the troubleshooting procedures of the Engine Maintenance Manual.
TABLE 5-1 Full-Up System Safety Criteria Electrical or Electronic Components (Events per Million Hours)
Subsystem Maximum Total System Maximum
Failure Condition Ignition Fuel Other System Destructive Event <0.001 <0.001 <0.001 <0.003 LOPC 15 15 15 45 MPL 150 150 150 450 No Effect - - - -
Page 24 Par 5-4
TABLE 5-2 Degraded System Safety Criteria Electrical or Electronic Components (Events per Million Hours)
Subsystem Maximum Total System Maximum
Failure Condition Ignition Fuel Other System Destructive Event <0.001 <0.001 <0.001 <0.001 LOPC 150 150 150 450 MPL 1500 1500 1500 4500 No Effect - - - -
e. EECSA Qualitative Analyses. These analyses complement the quantitative analyses and substantiate that the applicant has evaluated all aspects of the EEC system design. These analyses should include the mechanical components as well as the electrical and electronic components.
(1) Alternate Control Mode Analysis. Alternate or backup control modes or systems are usually necessary to meet the essentially single fault tolerant requirement of §33.28(c).
However, unlike engines for transport category aircraft, the backup modes for reciprocating engines may have limited control authority.
(a) If the alternate control mode does not affect engine operability, and if the predicted event rate of the control mode does not exceed the criteria of table 5-2, then 20 hours of operation is permitted in this mode.
(b) The acceptability of these alternate systems should be based on the following factors:
1. Effect on engine operability; and
2. Characteristics of the transition to the alternate control mode.
Par 5-4 Page 25
(c) Factors relating to engine operability that should be considered in the design and evaluation of any alternate operating mode(s) should include, but are not limited to, the following:
1. Maximum power level achievable in the alternate operating mode;
2. Engine control range in the alternate operating mode;
3. Altitude restart capability;
4. Dormant failures of the alternate operating mode, and documentation of any automatic or manual checks to ensure the availability of the mode; and
5. Throttle motion restriction or any other envelope restrictions.
(2) Control Mode Transition Analysis. The EECSA should evaluate systems that use alternate control modes as backup systems, including fail-fixed or fail-to-manual control systems, to determine acceptability of the mode transfer mechanism.
(a) A manually activated switch to transition to the alternate mode may be acceptable if the instruction manual documents this emergency procedure and it is evaluated in the EECSA.
(b) In some turbine applications the FAA has accepted a “fail-fixed” fuel flow followed by a manually activated switch to the alternate mode. If this type of alternate control mode is incorporated in a reciprocating engine, the applicant should make provisions for indication of the “fail-fixed” condition to the flight crew.
(c) The alternate mode may be implemented using hydromechanical, electrical/electronic, manual means, or any combination of these means. The engine instruction manual should state the power change associated with an automatic transfer to the alternate mode.
(d) Power changes during automatic transfer to backup should be limited to less than 15%. Power changes greater than 15% may be accepted if they result from a crew-selected transfer.
(e) Acceptable transition between all control modes should be demonstrated to the greatest extent possible. Development flight-testing should be used for further evaluation, if available. If pilot action is required in the fault detection and transfer of control, the engine instruction manual should declare the faults involved in such a situation and the aircraft certification program should evaluate the condition(s).
Page 26 Par 5-4
(f) For transfers that occur automatically, the following factors should be considered:
1. The frequency of occurrence of transfers to any alternate control mode.
Computed frequency of transfer to any alternate control mode should be supported with data from endurance or reliability testing, in-service experience on similar equipment, or other data acceptable to the FAA.
2. Faults that would result in transfer to any alternate mode, and the capability of detecting these faults.
3. Self-test coverage and diagnostics. Sufficient self-test coverage and diagnostics should be provided to allow detection of error conditions critical to system performance.
4. Time delays in the transfer of control. The engine installation manual should specify time delays in the transfer of control. In some cases, the certification engineer may not be able to determine if the mode transition provides a safe and acceptable system in accordance with part 33 based solely on analytical or simulation data. An engine test or flight test program could be used to provide additional data. In any case, such control transition delays may or may not be certifiable at the aircraft level depending on the installation. The aircraft certification program should fully evaluate any control mode transition.
5. Availability of the alternate mode. If the alternate mode is not exercised during normal mode operation, an inspection interval to uncover latent failures in the alternate mode components, or a procedure for exercising the alternate mode, should be specified to ensure that the alternate mode is functional and available. Any inspection interval or procedure requires FAA approval. This should be included in the Operating Instructions and in the Engine Maintenance Manual.
6. Provisions for signal(s) to indicate a mode transition.
(g) Pilot workload and performance during transition to or operation in an alternate control mode may need evaluation at the aircraft level. The applicant should review the applicable aircraft certification requirements and coordinate with the installer, if known, to determine if any alternate operating modes would comply with the applicable aircraft requirements. These issues have been significant for some programs.
(3) EEC System Output Data Analysis. The EECSA should include information about faults or failures that could cause the transmission of faulty or drifting engine parameters to the aircraft systems, including a prediction of the rate of occurrence. The following engine output parameters are examples of parameters that could be addressed in this analysis:
(a) Oil pressure;
(b) Engine speed;
(c) Manifold pressure;
Par 5-4 Page 27
(d) Cylinder head temperature;
(e) Turbine inlet temperature;
(f) Exhaust gas temperature;
(g) Calculated engine power parameters (horsepower or torque, etc.);
(h) Combustion pressure; and
(i) Engine detonation (sometimes called knock).
(4) Existing Subsystems Analysis. The EECSA should include an evaluation of the functional interaction of any existing mechanical control system elements that remain on the engine after incorporation of the EEC system or subsystem. The existing subsystems analysis should:
(a) Address existing mechanical subsystems such as carburetors, magneto ignition, turbo mechanical wastegates, and mechanical fuel injection;
(b) Substantiate interface and installation requirements related to these existing mechanical systems or components; and
(c) Address effects on the EEC system of failures of these mechanical systems.
(5) Local Events Analysis. When the installation environment is more severe than the declared environmental limits, the EECSA safety criteria does not apply. Occurrence of severe environmental events would normally be limited to one engine and are referred to as “local events.” A local event is not usually considered a common mode event; common mode threats, such as HIRF, lightning and rain are not considered local events. (There may be installations in which multiple engines are affected by the same local event. Such installations should be considered by the engine manufacturer and will be reviewed during aircraft certification.)
(a) Examples of local events:
1. Fluid leaks or mechanical disruptions that could lead to damage to control system electrical harnesses, connectors, or the control unit(s);
2. Fires; and
3. Overheat conditions, for example, those resulting from hot air duct bursts.
Page 28 Par 5-4
(b) Consideration of Local Events.
1. Whatever the local event, the resultant behavior of the EEC system should not cause a destructive event.
2. If accommodation of a particular local event is based on the assumption that there is another function that affords the necessary protection, it should be shown that this function is not rendered inoperative by the same local event on the engine (including destruction of wires, ducts, or power supplies).
3. For the purposes of this AC, an overheat condition exists when the temperature of the system components is greater than the maximum design operating temperature for the components, as declared by the engine manufacturer in the engine instructions for installation.
The electronic portions of the control system should not cause a hazardous engine effect when the electronic components or units of the system are exposed to a continuous overheat or overtemperature condition. Specific design features or analysis methods should be used to show compliance with respect to the prevention of hazardous effects. When this is not possible, due to the variability or the complexity of the failure sequence, for example, the FAA may require testing.
(c) Fire Testing. Exposure of the electrical and electronic parts of the EEC system to fire should not intensify the severity of the fire condition. If the EEC system is located in a fire zone, the applicant should perform either an analysis of system effects due to fire damage, or fire testing. Fire zones are defined in appropriate aircraft design regulations.
1. The fire requirements do not specify the length of time that electronic parts are required to function when exposed to fire. The FAA has developed an acceptance criteria for EEC systems that specifies either that the control system must maintain the ability to safely shut down the engine when exposed to fire, or that there must be an alternate method, such as a fuel shutoff valve, that allows the pilot to safely shutdown the engine when there is a fire in the engine compartment. In addition, the fire analysis or fire test should verify that when exposed to fire for a five minute period the system does not take unwanted action that could be hazardous to the aircraft.
2. The fuel handling parts of the EEC system, including the fuel injector valve parts that are directly in contact with the fuel, should comply with the requirements of §33.17, which requires these parts to be fire resistant and shielded or located to guard against the ignition of leaking flammable fluids.
3. The FAA has accepted computer simulations of EEC system exposure to fire instead of fire tests on production hardware as demonstration of compliance with fire requirements. The computer simulation should be validated by analysis or test, or both, and should be approved by the FAA. The FAA should also approve all assumptions upon which construction of the computer simulation is based.
Par 5-4 Page 29
4. Hardware emulations for use in fire tests are also acceptable. Hardware emulations should be validated by analysis or test, or both, and should be approved by the FAA.
(d) Probability of Local Events. There is no probability associated with the occurrence of local events. Therefore, all foreseeable local events should be considered. It is difficult to address all possible local events in the intended aircraft installation at the time of engine certification. Therefore, sound engineering judgement should be applied to identify the reasonably foreseeable local events.
1. Each wire interfacing with the electronic control unit should be tested or analyzed with respect to wiring faults. These faults should include opens and shorts to ground, and the test or analysis should show that the fault results in an identified and non-hazardous engine response.
2. Aircraft wiring that interfaces with the EEC system should be tested or analyzed for shorts to aircraft power. These “hot” shorts should result in an identified and non-hazardous effect. The engine instructions for installation should state the potential effects of wiring faults on aircraft interface wiring. The installer is responsible for ensuring that there are no wiring faults that could affect more than one engine, and if practical, more than one EEC system channel of a single engine by isolation and separation of the relevant wiring/conductors.
3. When the physical separation of conductors is not practical, the engine manufacturer and installer should coordinate with each other to ensure that the potential for common mode faults between engine controls is eliminated and that the potential for common mode faults between channels on one engine is minimized.
(e) Fluid Susceptibility. The applicant should assess the effects of hydraulic or lubricating leaks impinging on components of the EEC system by analysis or test. These conditions should not result in a hazardous engine effect, nor should the fluids be allowed to impinge on circuitry or printed circuit boards and result in a potential latent failure condition.
Refer to RTCA Document number DO-160D for test procedures for fluid susceptibility.
(6) Guidance for Use of Commercial or Industrial Grade Electronic Parts. When the engine type design specifies commercial or industrial grade electronic components, the applicant should have the following data available for review, as applicable:
(a) Reliability data that substantiates the failure rate for each component used in the EEC system reliability analysis and the EECSA for each commercial and industrial grade electrical component specified in the design.
(b) The EEC system applicant’s procurement, quality assurance, and process control plans for the vendor-supplied commercial and industrial grade parts. These plans should ensure that the parts will be able to maintain the reliability level specified in the approved engine type design.
Page 30 Par 5-4
(c) Unique databases for similar components obtained from different vendors, because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard, such as military component standards.
(d) Substantiation that the proposed extended range of the specified components is suitable for the application, if the declared installation temperature environment for the EEC system is greater than that specified by the manufacturer of the electronic components specified in the engine type design. Additionally, if commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required in the design of the EEC system, the applicant should specify these provisions in the instructions for installation.
Failure modes of the cooling provisions included in the EEC system design that cause these limits to be exceeded should be considered in determining the probability of failure.
(e) Two recently published documents provide guidance on the application of commercial or industrial grade components:
1. IEC/PAS 62239, Electronic Component Management Plans, edition 1.0, dated April 2001.
2. IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001.
(7) Programmed Logic Devices. Due to the nature and complexity of systems containing digital logic, programmed logic devices should be developed using a structured development approach, equivalent to the hazard associated with failure or malfunction of the system in which the device is contained. Programmed logic devices include application specific integrated circuits (ASICs) and programmable logic devices (PLDs).
(a) ASICs are defined as integrated circuits that are developed to implement a function, including, but not limited to: gate arrays, standard cell and full custom components encompassing linear, digital and mixed mode technologies.
(b) A PLD is defined as any device that is purchased as an electronic part and altered to perform an application specific function. PLDs usually require programming by the equipment manufacturer. PLDs include, but are not limited to, the following:
1. Programmable array logic (PAL) devices;
2. Programmable logic array (PLA) devices;
3. General array logic (GAL) devices;
4. Field programmable gate array (FPGA) devices; and
5. Electrically or erasable programmable logic devices (EPLD).
Par 5-4 Page 31
(c) RTCA Document DO-254 provides guidance for the criticality, failure condition categories, and design assurance levels associated with development of programmed logic devices.
(d) For off-the-shelf equipment or modified equipment, service experience may be used to demonstrate compliance. This should be acceptable if the worst-case failure or malfunction of the device for the new installation is not more severe than that for the original installation of the same equipment on another application. The applicant should also consider significant differences related to the environmental or operational category of the aircraft in which the original system was installed and certified.
Page 32 Par 5-4
CHAPTER 6. SECTION 33.28(d)
6-1. Rule Text. Section 33.28(d) provides that each EEC system must: “Have environmental limits, including transients caused by lightning strikes, specified in the instruction manual.”
6-2. Intent of Rule. Section 33.28(d) ensures that the environmental operating limitations of the EEC system are specified in the certification data as installation requirements for the installer.
Section 33.28(d) complements §33.53, reciprocating engine component test, which requires the corresponding environmental testing used to establish the environmental limitations. Both §§33.28(d) and 33.53 encompass electrical environmental conditions such as lightning, HIRF, EMI, as well as physical environmental conditions such as temperature, humidity, vibration, and water. The applicant should substantiate the declared electrical environmental limitations by component and system tests of the EEC system. The engine endurance test of §33.49 provides some substantiation of the physical environmental conditions. However, for those physical environmental and installation conditions not simulated during the engine endurance test, the applicant should conduct tests or analyses to establish that both the individual components and the system will operate properly over the full range of these conditions.
6-3. Guidance. Although the FAA does not specify the test limits, the conditions declared by the applicant should represent environments that would be encountered in the engine installation.
Due to the obvious overlap of §§33.28(d) and 33.53, this AC provides guidance for the tests used to establish the environmental limitations. This guidance provides a method, but not the only method, for demonstrating compliance with §33.28(d). See appendix 1 for a list of compliance documents that may be submitted for this section.
6-4. Electrical Environmental Limitations. Electrical environmental limitations include limitations for the effects of HIRF, lightning, and EMI.
a. Declared Levels.
(1) If the installation is known, the engine control system should be tested at levels that the engine and aircraft manufacturers have agreed upon. With this agreement, the installation should meet the aircraft certification requirements. Successful completion of the testing to the agreedupon levels would be accepted for engine type certification. This, however, may limit the engine to a specific aircraft installation.
(2) If the aircraft application is not known or defined at the time of the engine certification, the engine manufacturer may use the default values defined in this paragraph and use assumed installation attenuation effects.
(a) HIRF Default Values. The FAA has established recommended minimum default levels for system laboratory HIRF tests:
1. For frequencies from 10 kHz to 700 MHz, the minimum test level should be 100 volts per meter average.
Par 6-1 Page 33
2. For frequencies from 700 MHz to 18 GHz, the minimum test level should be 200 volts per meter average.
(b) EMI and Lightning Default Values. AC 20-136 and RTCA Document DO-160 provide appropriate test values.
b. Test Procedures.
(1) General. The installed engine controls system, including representative engine-aircraft interface cables, should be the basis for certification testing.
(a) EMI. EMI tests procedures and test levels should follow the guidelines of RTCA Document DO-160, MIL-STD-461, or MIL-STD-462. However, the applicant should provide the rationale for conducting a test using the MIL-STD-461 or MIL-STD-462 procedure if that test procedure differs from the corresponding RTCA Document DO-160D procedure.
(b) HIRF. The applicant should use the HIRF test guidelines provided in Section 20 of RTCA Document DO-160D, or the equivalent. However, the tests defined in RTCA Document DO-160D apply to a component test level, requiring the applicant to adapt these test procedures to a system level HIRF test to meet the intent of §33.28(d).
(c) Lightning. Lightning tests should follow the guidelines provided in AC 20-136 and Section 22 of RTCA Document DO-160D. Pin injection tests (PIT) should be conducted on the EEC unit and other system components as required. PIT levels should be appropriately selected from the tables of Section 22 of RTCA Document DO-160D. Environmental tests that follow the guidelines of MIL-STD-810E may be accepted instead of RTCA Document DO-160 tests if the MIL-STD-810E tests are equal to or more rigorous than those defined in RTCA Document DO-160D.
(2) Open Loop Versus Closed Loop Testing.
(a) HIRF, lightning, and EMI tests should be conducted as system tests on closed loop or open loop laboratory set-ups. The applicant should provide the closed loop set-up with the necessary mechanical means to actuate any system mechanical components to close the inner actuating loops. The applicant may use a simplified engine simulation to close the outer engine loop. Testing should be conducted with the engine control system controlling at the most sensitive operating point, as selected by the applicant. The system should be exposed to the HIRF, lightning, and EMI environmental threats while operating at the selected condition. The HIRF, lightning, and EMI environmental threats may have different operating points.
Page 34 Par 6-4
(b) If the applicant conducts tests in open loop set-ups, the following factors should be considered:
1. If special EEC system test software is used, that software should be developed and implemented by guidelines defined for software levels of at least Level C in RTCA Document DO-178B, or the equivalent. In some cases, the application code should be modified to include the required test code features.
2. The system test set-up should be instrumented to monitor both the output drive signals and the input signals.
3. Anomalies observed on inputs or outputs should be duplicated on the engine simulation to determine if the resulting power or thrust perturbations comply with the pass/fail criteria.
c. Pass/Fail Criteria.
(1) HIRF and Lightning. The control system operation should not experience any adverse effects when exposed to the conditions of the HIRF and lightning tests. The following are considered adverse effects:
(a) A greater than +/-10% change of rated power or thrust change from the normal control governing capability for a period of more than one second;
(b) Component damage;
(c) False fault annunciation to the crew that continues beyond the duration of the HIRF or lightning event and could cause unnecessary or inappropriate crew action; and
(d) Erroneous operation of engine protection circuits.
(2) EMI. RTCA Document DO-160D provides pass criteria for EMI testing.
d. Component and Software Design Changes. Hardware or software design changes implemented after initial qualification should be evaluated for their effects on the EMI and HIRF and lightning environment. Appropriate testing or analysis, or both, should be defined to ensure that the original basis for certification is maintained. The applicant should conduct component level testing for these purposes.
e. Maintenance Requirements. Section 33.4 and appendix A to part 33 require that the applicant prepare ICA for all engine parts to ensure the continued airworthiness of the installed systems. AC 33.4-1, “Instructions for Continued Airworthiness,” provides guidance for preparation of ICAs. These instructions should include maintenance requirements for the electrical environment protection features because these features depend, to some extent, on the physical integrity of the design. The maintenance requirements for HIRF protection features to Par 6-4 Page 35