(b) Consideration of Local Events.
1. Whatever the local event, the resultant behavior of the EEC system should not cause a destructive event.
2. If accommodation of a particular local event is based on the assumption that there is another function that affords the necessary protection, it should be shown that this function is not rendered inoperative by the same local event on the engine (including destruction of wires, ducts, or power supplies).
3. For the purposes of this AC, an overheat condition exists when the temperature of the system components is greater than the maximum design operating temperature for the components, as declared by the engine manufacturer in the engine instructions for installation.
The electronic portions of the control system should not cause a hazardous engine effect when the electronic components or units of the system are exposed to a continuous overheat or overtemperature condition. Specific design features or analysis methods should be used to show compliance with respect to the prevention of hazardous effects. When this is not possible, due to the variability or the complexity of the failure sequence, for example, the FAA may require testing.
(c) Fire Testing. Exposure of the electrical and electronic parts of the EEC system to fire should not intensify the severity of the fire condition. If the EEC system is located in a fire zone, the applicant should perform either an analysis of system effects due to fire damage, or fire testing. Fire zones are defined in appropriate aircraft design regulations.
1. The fire requirements do not specify the length of time that electronic parts are required to function when exposed to fire. The FAA has developed an acceptance criteria for EEC systems that specifies either that the control system must maintain the ability to safely shut down the engine when exposed to fire, or that there must be an alternate method, such as a fuel shutoff valve, that allows the pilot to safely shutdown the engine when there is a fire in the engine compartment. In addition, the fire analysis or fire test should verify that when exposed to fire for a five minute period the system does not take unwanted action that could be hazardous to the aircraft.
2. The fuel handling parts of the EEC system, including the fuel injector valve parts that are directly in contact with the fuel, should comply with the requirements of §33.17, which requires these parts to be fire resistant and shielded or located to guard against the ignition of leaking flammable fluids.
3. The FAA has accepted computer simulations of EEC system exposure to fire instead of fire tests on production hardware as demonstration of compliance with fire requirements. The computer simulation should be validated by analysis or test, or both, and should be approved by the FAA. The FAA should also approve all assumptions upon which construction of the computer simulation is based.
Par 5-4 Page 29
4. Hardware emulations for use in fire tests are also acceptable. Hardware emulations should be validated by analysis or test, or both, and should be approved by the FAA.
(d) Probability of Local Events. There is no probability associated with the occurrence of local events. Therefore, all foreseeable local events should be considered. It is difficult to address all possible local events in the intended aircraft installation at the time of engine certification. Therefore, sound engineering judgement should be applied to identify the reasonably foreseeable local events.
1. Each wire interfacing with the electronic control unit should be tested or analyzed with respect to wiring faults. These faults should include opens and shorts to ground, and the test or analysis should show that the fault results in an identified and non-hazardous engine response.
2. Aircraft wiring that interfaces with the EEC system should be tested or analyzed for shorts to aircraft power. These “hot” shorts should result in an identified and non-hazardous effect. The engine instructions for installation should state the potential effects of wiring faults on aircraft interface wiring. The installer is responsible for ensuring that there are no wiring faults that could affect more than one engine, and if practical, more than one EEC system channel of a single engine by isolation and separation of the relevant wiring/conductors.
3. When the physical separation of conductors is not practical, the engine manufacturer and installer should coordinate with each other to ensure that the potential for common mode faults between engine controls is eliminated and that the potential for common mode faults between channels on one engine is minimized.
(e) Fluid Susceptibility. The applicant should assess the effects of hydraulic or lubricating leaks impinging on components of the EEC system by analysis or test. These conditions should not result in a hazardous engine effect, nor should the fluids be allowed to impinge on circuitry or printed circuit boards and result in a potential latent failure condition.
Refer to RTCA Document number DO-160D for test procedures for fluid susceptibility.
(6) Guidance for Use of Commercial or Industrial Grade Electronic Parts. When the engine type design specifies commercial or industrial grade electronic components, the applicant should have the following data available for review, as applicable:
(a) Reliability data that substantiates the failure rate for each component used in the EEC system reliability analysis and the EECSA for each commercial and industrial grade electrical component specified in the design.
(b) The EEC system applicant’s procurement, quality assurance, and process control plans for the vendor-supplied commercial and industrial grade parts. These plans should ensure that the parts will be able to maintain the reliability level specified in the approved engine type design.
Page 30 Par 5-4
(c) Unique databases for similar components obtained from different vendors, because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard, such as military component standards.
(d) Substantiation that the proposed extended range of the specified components is suitable for the application, if the declared installation temperature environment for the EEC system is greater than that specified by the manufacturer of the electronic components specified in the engine type design. Additionally, if commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required in the design of the EEC system, the applicant should specify these provisions in the instructions for installation.
Failure modes of the cooling provisions included in the EEC system design that cause these limits to be exceeded should be considered in determining the probability of failure.
(e) Two recently published documents provide guidance on the application of commercial or industrial grade components:
1. IEC/PAS 62239, Electronic Component Management Plans, edition 1.0, dated April 2001.
2. IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001.
(7) Programmed Logic Devices. Due to the nature and complexity of systems containing digital logic, programmed logic devices should be developed using a structured development approach, equivalent to the hazard associated with failure or malfunction of the system in which the device is contained. Programmed logic devices include application specific integrated circuits (ASICs) and programmable logic devices (PLDs).
(a) ASICs are defined as integrated circuits that are developed to implement a function, including, but not limited to: gate arrays, standard cell and full custom components encompassing linear, digital and mixed mode technologies.
(b) A PLD is defined as any device that is purchased as an electronic part and altered to perform an application specific function. PLDs usually require programming by the equipment manufacturer. PLDs include, but are not limited to, the following:
1. Programmable array logic (PAL) devices;
2. Programmable logic array (PLA) devices;
3. General array logic (GAL) devices;
4. Field programmable gate array (FPGA) devices; and
5. Electrically or erasable programmable logic devices (EPLD).
Par 5-4 Page 31
(c) RTCA Document DO-254 provides guidance for the criticality, failure condition categories, and design assurance levels associated with development of programmed logic devices.
(d) For off-the-shelf equipment or modified equipment, service experience may be used to demonstrate compliance. This should be acceptable if the worst-case failure or malfunction of the device for the new installation is not more severe than that for the original installation of the same equipment on another application. The applicant should also consider significant differences related to the environmental or operational category of the aircraft in which the original system was installed and certified.
Page 32 Par 5-4
CHAPTER 6. SECTION 33.28(d)
6-1. Rule Text. Section 33.28(d) provides that each EEC system must: “Have environmental limits, including transients caused by lightning strikes, specified in the instruction manual.”
6-2. Intent of Rule. Section 33.28(d) ensures that the environmental operating limitations of the EEC system are specified in the certification data as installation requirements for the installer.
Section 33.28(d) complements §33.53, reciprocating engine component test, which requires the corresponding environmental testing used to establish the environmental limitations. Both §§33.28(d) and 33.53 encompass electrical environmental conditions such as lightning, HIRF, EMI, as well as physical environmental conditions such as temperature, humidity, vibration, and water. The applicant should substantiate the declared electrical environmental limitations by component and system tests of the EEC system. The engine endurance test of §33.49 provides some substantiation of the physical environmental conditions. However, for those physical environmental and installation conditions not simulated during the engine endurance test, the applicant should conduct tests or analyses to establish that both the individual components and the system will operate properly over the full range of these conditions.
6-3. Guidance. Although the FAA does not specify the test limits, the conditions declared by the applicant should represent environments that would be encountered in the engine installation.
Due to the obvious overlap of §§33.28(d) and 33.53, this AC provides guidance for the tests used to establish the environmental limitations. This guidance provides a method, but not the only method, for demonstrating compliance with §33.28(d). See appendix 1 for a list of compliance documents that may be submitted for this section.
6-4. Electrical Environmental Limitations. Electrical environmental limitations include limitations for the effects of HIRF, lightning, and EMI.
a. Declared Levels.
(1) If the installation is known, the engine control system should be tested at levels that the engine and aircraft manufacturers have agreed upon. With this agreement, the installation should meet the aircraft certification requirements. Successful completion of the testing to the agreedupon levels would be accepted for engine type certification. This, however, may limit the engine to a specific aircraft installation.
(2) If the aircraft application is not known or defined at the time of the engine certification, the engine manufacturer may use the default values defined in this paragraph and use assumed installation attenuation effects.
(a) HIRF Default Values. The FAA has established recommended minimum default levels for system laboratory HIRF tests:
1. For frequencies from 10 kHz to 700 MHz, the minimum test level should be 100 volts per meter average.
Par 6-1 Page 33
2. For frequencies from 700 MHz to 18 GHz, the minimum test level should be 200 volts per meter average.
(b) EMI and Lightning Default Values. AC 20-136 and RTCA Document DO-160 provide appropriate test values.
b. Test Procedures.
(1) General. The installed engine controls system, including representative engine-aircraft interface cables, should be the basis for certification testing.
(a) EMI. EMI tests procedures and test levels should follow the guidelines of RTCA Document DO-160, MIL-STD-461, or MIL-STD-462. However, the applicant should provide the rationale for conducting a test using the MIL-STD-461 or MIL-STD-462 procedure if that test procedure differs from the corresponding RTCA Document DO-160D procedure.
(b) HIRF. The applicant should use the HIRF test guidelines provided in Section 20 of RTCA Document DO-160D, or the equivalent. However, the tests defined in RTCA Document DO-160D apply to a component test level, requiring the applicant to adapt these test procedures to a system level HIRF test to meet the intent of §33.28(d).
(c) Lightning. Lightning tests should follow the guidelines provided in AC 20-136 and Section 22 of RTCA Document DO-160D. Pin injection tests (PIT) should be conducted on the EEC unit and other system components as required. PIT levels should be appropriately selected from the tables of Section 22 of RTCA Document DO-160D. Environmental tests that follow the guidelines of MIL-STD-810E may be accepted instead of RTCA Document DO-160 tests if the MIL-STD-810E tests are equal to or more rigorous than those defined in RTCA Document DO-160D.
(2) Open Loop Versus Closed Loop Testing.
(a) HIRF, lightning, and EMI tests should be conducted as system tests on closed loop or open loop laboratory set-ups. The applicant should provide the closed loop set-up with the necessary mechanical means to actuate any system mechanical components to close the inner actuating loops. The applicant may use a simplified engine simulation to close the outer engine loop. Testing should be conducted with the engine control system controlling at the most sensitive operating point, as selected by the applicant. The system should be exposed to the HIRF, lightning, and EMI environmental threats while operating at the selected condition. The HIRF, lightning, and EMI environmental threats may have different operating points.
Page 34 Par 6-4
(b) If the applicant conducts tests in open loop set-ups, the following factors should be considered:
1. If special EEC system test software is used, that software should be developed and implemented by guidelines defined for software levels of at least Level C in RTCA Document DO-178B, or the equivalent. In some cases, the application code should be modified to include the required test code features.
2. The system test set-up should be instrumented to monitor both the output drive signals and the input signals.
3. Anomalies observed on inputs or outputs should be duplicated on the engine simulation to determine if the resulting power or thrust perturbations comply with the pass/fail criteria.
c. Pass/Fail Criteria.
(1) HIRF and Lightning. The control system operation should not experience any adverse effects when exposed to the conditions of the HIRF and lightning tests. The following are considered adverse effects:
(a) A greater than +/-10% change of rated power or thrust change from the normal control governing capability for a period of more than one second;
(b) Component damage;
(c) False fault annunciation to the crew that continues beyond the duration of the HIRF or lightning event and could cause unnecessary or inappropriate crew action; and
(d) Erroneous operation of engine protection circuits.
(2) EMI. RTCA Document DO-160D provides pass criteria for EMI testing.
d. Component and Software Design Changes. Hardware or software design changes implemented after initial qualification should be evaluated for their effects on the EMI and HIRF and lightning environment. Appropriate testing or analysis, or both, should be defined to ensure that the original basis for certification is maintained. The applicant should conduct component level testing for these purposes.
e. Maintenance Requirements. Section 33.4 and appendix A to part 33 require that the applicant prepare ICA for all engine parts to ensure the continued airworthiness of the installed systems. AC 33.4-1, “Instructions for Continued Airworthiness,” provides guidance for preparation of ICAs. These instructions should include maintenance requirements for the electrical environment protection features because these features depend, to some extent, on the physical integrity of the design. The maintenance requirements for HIRF protection features to Par 6-4 Page 35
be considered during certification include periodic inspections or tests for required structural shielding, wire shields, connectors, and equipment protection components. The applicant must provide the engineering validation and substantiation of these maintenance requirements.
Paragraph 7 of AC 20-136, “Maintenance and Surveillance,” provides additional guidance for continued airworthiness of system lightning protection features.
6-5. Physical Environmental Limitations. Physical environmental limitations include limitations for the effects of physical environmental factors such as temperature, humidity, vibration, and water. The applicant should substantiate all components of the EEC system, including all electronic units, sensors, harnesses, hydromechanical components, electromechanical components, and any other associated components, for proper operation over the full range of physical environmental conditions. For those components that undergo testing, the environmental limiting conditions should be simulated in a laboratory test fixture. If possible, the complete engine should be tested.
a. Environmental test requirements are specified in RTCA Document DO-160 and listed in table 6-1. Acceptable test procedures for each item are referenced in the same table. Not all tests are applicable to all components. The applicant should provide rationale for the selection of applicable tests for each component.
b. Use of the pre-established environmental classifications of RTCA Document DO-160 allows certification of components in a consistent manner, independently from installation considerations. However, the classification specified by the applicant should represent the environment of the proposed installation.
c. The applicant should prepare an environmental test plan, summarized in an environmental test matrix, that defines the method to be used to qualify the component for each of the environments. The applicant should submit the plan and test matrix to the FAA for review and approval before testing is initiated. Generally, the applicant should test only the types of environments that the components are expected to encounter. The matrix should note other environments as “not applicable.” The components may be qualified by test, similarity, analysis, and combinations of these factors. For substantiation by similarity, the component should be shown to be sufficiently similar and to operate in an environment that is the same or less severe than the previously certified component.
d. Before the testing is initiated, all conformity requirements for the software, hardware, and the test setups should be established and approved by the FAA. Conformity should be documented as part of the Certification Report. The applicant should reconcile any differences between the test hardware and the type design hardware in the test plan and submit it for FAA approval before the start of testing.
e. The list of applicable requirements and associated tests or procedures (or their equivalent) in table 6-1 has been accepted for evaluating component airworthiness. The applicant should obtain FAA approval of these environmental test plans before initiating the tests.
Page 36 Par 6-4
TABLE 6-1
ENVIRONMENTAL
CONDITIONS
ACCEPTABLE TESTS/PROCEDURES 1 High Temperature Demonstration
RTCA Document DO-160, section 4 or MIL-STD-5007D paragraph 4.6.2.2.5 2 Low Temperature Demonstration
RTCA Document DO-160, section 4 or MIL-STD-5007D paragraph 4.6.2.2.7 3 Room Temperature Demonstration RTCA Document DO-160, section 4 or MIL-STD-5007D paragraph 4.6.2.2.6 4 Contaminated Fluids Reference §§33.35, 33.39 for fuel/oil/air requirements or MIL-STD-5007D paragraph 4.6.2.2.6 (fuel test only) 5 Vibration RTCA Document DO-160, Section 8 6 Impact RTCA Document DO-160, Section 7 7 Sustained Acceleration RTCA Document DO-160, Section 7 or MIL-STD-810E, Method 513 8 Sand and Dust RTCA Document DO-160, Section 12, Category D or MIL-STD-810E 9 Fluid Susceptibility RTCA Document DO-160, Section 11, Category F 10 Salt Spray RTCA Document DO-160, Section 14, Category S or MIL-STD-810E 11 Induction Icing Reference §33.35 12 Fungus RTCA Document DO-160, Section 13, Category F 13 Temperature and Altitude RTCA Document DO-160, Section 4 14 Thermal Cycle RTCA Document DO-160, Section 5 15 Explosion Proofness RTCA Document DO-160, Section 9 16 Humidity RTCA Document DO-160, Section 6 or MIL-STD-810E 17 Waterproofness RTCA Document DO-160, Section 10 MIL-STD-810E (RAIN) 18 Power Input RTCA Document DO-160, Sections 16 and 17 or MIL-STD-704 Par 6-5 Page 37 (and 38)
CHAPTER 7. SECTION 33.28(e)
7-1. Rule Text. Section 33.28(e) provides that each EEC system must: “Have all associated software designed and implemented to prevent errors that would result in an unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved by the Administrator.”
7-2. Intent of Rule. Section 33.28(e) requires that EEC system software undergo a sufficient level of design assurance testing to ensure, with a high level of confidence, that errors in the software are prevented, and requires that the FAA approve the method used to design and implement the software.
7-3. Guidance. The following guidance provides a method, but not the only method, for demonstrating compliance with §33.28(e). Compliance with §33.28(e) should be demonstrated by software design and implementation in accordance with an approved method, such as RTCA Document DO-178B, in combination with system validation testing.
a. Compliance Elements.
(1) Software Design and Implementation Process. RTCA Document DO-178B, “Software Considerations in Airborne Systems and Equipment Certification,” provides guidelines for the software design and implementation process. This process includes the following activities:
(a) Life cycle definition;
(b) Planning;
(c) Development;
(d) Software verification;
1. Requirements-based coverage analysis should be conducted to demonstrate that the system requirements allocated to the software have been properly implemented.
2. The software should be verified by open or closed loop bench testing on a system that provides an electrical simulation of the engine system.
(e) Configuration management; and
(f) Quality assurance.
(2) System Validation Testing. Validation testing should be conducted to substantiate successful integration of the EEC system software and the engine control system. Validation testing should be performed on a complete engine, or on a test rig that provides a physical simulation of the engine control system.
Par 7-1 Page 39
b. Software Level Requirement. The level of confidence regarding error prevention in the software is directly related to the scope of the design assurance activity. These design assurance scopes have been defined in terms of software levels. These levels have been correlated to EEC system functional criticality. The FAA has accepted EEC system software verification to software levels defined in RTCA Document DO-178B as substantiation for the error prevention requirement. The following information is provided for determining the software level:
(1) RTCA Document DO-178B software level C has been determined to be the minimum requirement for the reciprocating engine EEC systems to which this AC applies. Level C would be acceptable for single-engine or twin-engine airplanes under 6000 pounds maximum take-off weight (MTOW) approved under part 23 normal, utility or acrobatic categories, or similar CAR 3 approval.
(2) The guidance provided in this AC does not apply to reciprocating EEC systems installed in airplanes approved under part 23 commuter or part 25 transport categories.
Therefore, the minimum software level for those EEC systems should be determined by performing an airplane system-level safety analysis.
(3) For reciprocating EEC systems installed in any other aircraft, the applicant should evaluate the failure condition criticality of EEC system functions to determine if Level C software would be adequate. This would require coordination with the aircraft designer and the cognizant aircraft ACO during the EEC system development program.
c. Software Partitioning. Non-critical software may be partitioned from the critical software, allowing the non-critical software to be designed and implemented at a lower level than that established for the critical software.
(1) The applicant should substantiate the adequacy of the partitioning method.
(2) The partition should be developed to the highest level of the components being partitioned.
(3) The applicant should consider if the lower levels of the partitioned software are appropriate for the anticipated installations. If the criticality level requirement were higher in subsequent applications, it would be difficult to raise the software level without repeating the software life cycle processes for the new level.
d. Software Integrity. RTCA Document DO-178B provides guidance for assurance of software used at specified hazard levels. As with all guidance to which this document refers, DO-178B may be modified or updated due to events or advancements in technology.
Page 40 Par 7-3