CONTENTS Paragraph Page
CHAPTER 1. GENERAL
1-1. Background1
1-2. Limitations1
1-3. Definitions1
CHAPTER 2. SECTION 33.28 GENERAL
2-1. Rule Text5
2-2. Intent of Rule5
CHAPTER 3. SECTION 33.28(a)
3-1. Rule Text7
3-2. Intent of Rule7
a. General7
b. Airplane Installation and Certification7
3-3. Guidance7
a. Control System Description7
b. Installation Requirements8
c. Operational Requirements9
d. Certification Data Interface Document10
CHAPTER 4. SECTION 33.28(b)
4-1. Rule Text13
4-2. Intent of Rule13
4-3. Guidance13
a. General13
b. Failure of Aircraft-Supplied Power13
c. Failure of Aircraft-Supplied Data16
CHAPTER 5. SECTION 33.28(c)
5-1. Rule Text19
5-2. Intent of Rule19
a. Single-Fault Tolerance19
b. Unsafe Condition19
5-3. Compliance20
Page v
5-4. Guidance20
a. EECSA General20
b. EECSA Assumptions21
c. EECSA Quantitative Analysis21
d. TLO Implementation Requirements23
e. EECSA Qualitative Analysis25
CHAPTER 6. SECTION 33.28(d)
6-1. Rule Text33
6-2. Intent of Rule33
6-3. Guidance33
6-4. Electrical Environmental Limitations33
a. Declared Levels33
b. Test Procedures34
c. Pass/Fail Criteria35
d. Component and Software Design Changes35
e. Maintenance Requirements35
6-5. Physical Environmental Limitations36
CHAPTER 7. SECTION 33.28(e)
7-1. Rule Text39
7-2. Intent of Rule39
7-3. Guidance39
a. Compliance Elements39
b. Software Level Requirement40
c. Software Partitioning40
d. Software Integrity40
CHAPTER 8. INTEGRATION OF ENGINE, PROPELLER AND AIRCRAFT SYSTEMS
8-1. EEC System Integration Plan41
a. Distribution of Compliance Tasks41
b. Interface Definition & Other Data41
c. Design Change Control42
8-2. Aircraft Functions Integrated into the Engine Control System42
a. Integration Activities42
b. Certification Considerations42
8-3. Integration of Engine Control Functions into Aircraft Systems43
a. Integration Activities43
b. Certification Considerations43
APPENDIX 1. CERTIFICATION COMPLIANCE DOCUMENTS Page vi
CHAPTER 1. GENERAL
1-1. Background.
a. EEC technology was initially applied to turbine engines designed for large transport aircraft applications. Therefore, the information and guidance for showing compliance with §33.28 provided by the FAA was oriented toward these applications. However, the increasing use of EEC systems in reciprocating piston engines has created a need for guidance specifically for reciprocating engines.
b. The application of electronic technology to reciprocating engine control systems introduces systems safety considerations:
(1) A greater dependence of the engine on aircraft systems due to the use of electrical power or data supplied from the aircraft;
(2) A risk of significant failures common to more than one engine of the aircraft that might, for example, occur as a result of the following:
(a) Insufficient protection from electromagnetic disturbance (lightning, internal or external radiation effects);
(b) Insufficient integrity of the aircraft electrical power supply;
(c) Insufficient integrity of data supplied from the aircraft;
(d) Hidden design faults or discrepancies contained within the design of the propulsion system control software; or
(e) Omissions or errors in the system/software specification.
c. This AC provides guidance and acceptable methods, but not the only methods, for demonstrating compliance with §33.28 that address these issues. This guidance is consistent with the FAA objective of isolating the engine from the effects of airplane system failures.
1-2. Limitations. The engine Type Certificate Data Sheet (TCDS) or engine Supplemental Type Certificate (STC) issued by the FAA upon approval of an EEC system substantiated in accordance with this AC should specify the following limitation:
“Installation of this engine is not approved for airplanes certificated under part 23 commuter or part 25 transport categories.”
1-3. Definitions. The following definitions apply to reciprocating engines and may not be appropriate for turbine engines.
Par 1-1 Page 1
a. Aircraft-Supplied Data. Aircraft-supplied data is information that is generated in the aircraft systems and used by the engine control system, but whose source is not controlled under the design authority of the engine certification applicant. This does not include input from those sensors that are used by, and normally dedicated to, the engine control system but may be mounted in the airframe.
b. Aircraft-Supplied Power. Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
c. Alternate Control Mode(s). For the purposes of this AC, an alternate control mode is characterized by engine control operating characteristics or capabilities that are sufficiently different from the “normal mode” and may significantly affect the operating characteristics or capabilities of the aircraft, crew workload, or anything that constitutes appropriate crew procedures.
d. Back-up System. A back-up system is a different type of system that is used as a stand-by or alternate control mode to the primary or normal control mode or system.
e. Commercial and Industrial Grade Electronic Parts. Commercial and industrial grade electronic parts are not manufactured to military standards.
f. Degraded System or Configuration. A degraded system or configuration is an EEC system that has faults or failures present that have no effect on engine operation but may cause a loss of redundancy in the system.
g. Destructive Event. A destructive event is any malfunction or failure of the EEC system that could result in a condition in which the engine, or any of its components, causes physical damage to the airplane structure or its occupants that could potentially impact continued safe operation of the airplane. For example, engine separation from its mounts, uncontrolled fire, inability to shutdown the engine, generation of toxic products, or destructive engine explosion.
h. Electronic Engine Control (EEC) System. The EEC system consists of systems or subsystems, with full or limited-authority functional capability, which have the following characteristics:
(1) Modulation of one or more engine control parameters;
(2) Logic that discriminates the desired condition of an engine control parameter; and
(3) Electronic implementation of logic.
i. Failure Condition. A failure condition is an abnormal or non-operating state of the engine that is caused by or contributed to by one or more faults or failures.
j. Failure Event. See definition for “failure condition.”
Page 2 Par 1-3
k. Fault or Failure. A fault or failure is an occurrence that affects the operation of an engine component, part, or element so that it cannot function as intended (this includes both loss of function and malfunction). Software errors may cause failures, but are not considered faults.
l. Fault or Failure Accommodation. This term refers to the capability of the control system or flight crew to mitigate, either entirely or in part, the fault or failure.
m. Fault or Failure Detection. This term refers to the discovery of a fault or failure or the resulting condition.
n. Full Authority Digital Engine Control (FADEC). FADEC is an engine control system in which the primary functions are provided using digital electronics and the EEC unit has fullrange authority over the engine power.
o. Full-up System or Configuration. The full-up system or configuration is an EEC system that has no faults or failures present, detected or undetected, that affect the control of engine power, engine protection systems, indication of critical engine operating parameters or other safety features of the engine control system.
p. Local Events. Local events are failures of aircraft systems and components, other than the EEC system, that may affect the installed environment of the EEC.
q. Loss of Power Control (LOPC). LOPC is an EEC failure event resulting in the inability to attain at least 85% of rated power, or the inability to modulate power at all normal operating conditions.
r. Minor Power Loss (MPL). MPL is an EEC failure event resulting in the ability to attain greater than 85%, but less than 95%, of rated power.
s. Primary Mode. This is the mode of operation intended to control the engine. This is often referred to as the “normal mode.”
t. Programmed Logic Device. A programmed logic device is a custom micro-coded component, such as application specific integrated circuits (ASIC) or programmable logic devices (PLDs).
u. Single-Fault Tolerant. Single-fault tolerant refers to the capability of the EEC system design architecture to accommodate the occurrence of any single EEC system fault to prevent an unsafe condition.
v. Time-Limited Operations (TLO). TLO refers to the duration of flight operations permitted with the EEC system in a degraded condition.
w. Unacceptable Change in Power. For the purposes of this AC, an unacceptable change in power is defined as an LOPC.
Par 1-3 Page 3
x. Uncovered Fault. An uncovered fault is a fault or failure for which either a detection mechanism does not exist or, if there is a detection mechanism, an accommodation for the fault does not exist.
y. Unsafe Condition. For the purposes of this AC, an unsafe condition refers to any malfunction or failure of the EEC system that could result in a destructive event or EEC system LOPC and MPL rates in excess of those specified in Tables 5-1 and 5-2 of this AC. This definition is intended to apply to certification activities for reciprocating engine EEC systems and is not applicable to continued airworthiness activities related to these engines and systems.
Page 4 Par 1-3
CHAPTER 2. SECTION 33.28 GENERAL
2-1. Rule Text. The introduction to §33.28 specifies that the requirements of §33.28 apply to:
“Each control system which relies on electrical and electronic means for normal operation.”
2-2. Intent of Rule.
a. Section 33.28 applies to engine control systems, or subsystems, that include the following design elements:
(1) Modulation of one or more engine control parameters;
(2) Logic that discriminates the desired condition of an engine control parameter; and
(3) Electronic implementation of logic.
b. Section 33.28 applies to the entire scope of integration of electronic and electrical systems into engine control systems, including the following:
(1) Primary and back-up systems;
(2) Full-authority and limited authority systems;
(3) Digital and analog systems;
(4) Supervisory systems;
(5) Electronic subsystems such as turbocharger wastegate controllers, ignition timing systems, and fuel injection systems; and
(6) Hybrid systems that rely on mechanical systems to back-up primary EEC systems.
c. Section 33.28 does not apply to engine control systems using electrical, but non-electronic, components with the following design characteristics:
(1) The operating state of the device is not directly determined by the EEC system; and
(2) The device does not itself incorporate the design elements of paragraph 2-2a of this AC.
Par 2-1 Page 5
d. The following are examples of components to which §33.28 does not apply:
(1) A conventional, new magneto;
(2) An electrically-powered actuator such as a solenoid whose actuation is dependant on pilot action through a dedicated electrical circuit; and
(3) An electrical relay not controlled by the EEC system.
e. The following are examples of components to which §33.28 does apply:
(1) Programmable logic controllers or arrays (PLCs or PLAs).
(2) An electrically-powered actuator, such as a solenoid, whose actuation is directly controlled by the EEC system.
(3) An electrical relay controlled by the EEC system.
Page 6 Par 2-2
CHAPTER 3. SECTION 33.28(a)
3-1. Rule Text. Section 33.28(a) provides that each EEC system: “Have the control system description, the percent of available power or thrust controlled in both normal operation and failure conditions, and the range of control of other controlled functions, specified in the instruction manual required by §33.5 for the engine.”
3-2. Intent of Rule. Section §33.28(a) requires the applicant to provide the engine installer with enough information about the EEC system to integrate the EEC-equipped engine system into the airplane design. A successful propulsion system installation requires a clear understanding of all aspects of the control system in normal and alternate control modes. The instruction manual specified in §33.5 includes both installation and operation instructions.
a. General. To show compliance with 33.28(a), the applicant may submit installation and operation manual sections for the engine manual or separate installation and operation manuals for the EEC system. The manual(s) should include descriptive, interface, and operating data in enough detail to support airplane certification. Limitations specified in the manual(s) should be consistent with those stated on the type certificate data sheet (TCDS), amended TCDS, or supplemental type certificate (STC), as applicable. These installation and operation instructions (or a separate Certification Data Interface Document) should also include the certification data specified in section 3-3d of this AC, to ensure that the part 33 certification is not invalidated when the engine is installed on the airplane.
b. Airplane Installation and Certification. Subpart E of part 23 provides regulations for the installation of a certificated engine into an airplane. The installed engine is defined as the powerplant system. These regulations require that the powerplant system design meet all the requirements, procedures, limitations, and assumptions specified in the engine instruction manual and the engine TCDS or STC. The applicant should coordinate this data with the prospective airplane designer and the appropriate FAA certification office. If the application is unknown or not defined at the time of engine certification, the EEC system applicant should substantiate any installation and operational assumptions made during the EEC system design.
As part of the airplane certification program, the FAA may require flight-testing to fully evaluate engine performance and operability characteristics for all operating modes. See §23.939.
3-3. Guidance. The following is a method, but not the only method, for demonstrating compliance with §33.28(a). The applicant should include this data in the engine installation and operation instructions submitted to show compliance with §33.5. See appendix 1 for a list of compliance documents that may be submitted for this section.
a. Control System Description. The applicant should include a brief control system description in the instruction manual and may reference a more detailed system description. The manual should include, but not be limited to, the following:
(1) A system schematic that includes electrical, mechanical, and fuel system elements;
Par 3-1 Page 7
(2) A description of the engine control functions performed by the EEC system; and
(3) An overview of the design of each of the system components.
b. Installation Requirements. The instruction manual should specify all of the physical, electrical, and functional installation requirements and limitations of the EEC system. For example, the instruction manual should include:
(1) Electrical Interface. The instruction manual should define the following:
(a) EEC system electrical power requirements and quality, including interrupt limitations, and grounding requirements. This should also include steady-state and transient under-voltage and over-voltage limits for the equipment. The power input requirements of DO- 160D, Section 16, provide an acceptable definition of such requirements. If DO-160 is used, the manual should state any exceptions to the power quality requirements cited in DO-160 for the particular category of equipment specified.
(b) Impedance and buffering limitations for the signals provided by the EEC system for display and instrumentation.
(c) Signals used by the EEC system, such as air data information, to ensure that the EEC system is adequately isolated and unaffected by other systems using these signals.
(d) Impedance, buffering, and range limitations for aircraft data signals used by the EEC system.
(e) Subtle interface requirements, such as power interrupt tolerance of the EEC system.
(f) EEC system power supply requirements and backup power reliability, if the backup electrical supply is not certified as part of the engine. The manual should clearly state that the backup electrical supply should be independent and isolated from the airplane bus system or systems.
(g) Endurance of the battery, if a battery is certified with the engine as a source of electrical power for the EEC system. The endurance of the battery should be consistent with the airworthiness standards applicable to the intended installation. The manual should also specify provisions for monitoring the health status of the battery.
(2) Engine control lever(s) interface requirements, including electrical and mechanical characteristics.
(3) Unique fuel system requirements, such as filtration and fuel inlet conditions (flow and pressure).
(4) Any unique engine instrumentation cockpit display requirements.
Page 8 Par 3-3
c. Operational Requirements. The instruction manual should contain a description of the control system operating procedures and limitations in both the normal and alternate control modes. For example, the instruction manual should provide:
(1) Restrictions in the flight envelope or unusual operating characteristics in these alternate modes.
(2) Abnormal control characteristics that could have an impact on crew procedures, training, workload, or any other aspects of aircraft performance or operating characteristics, for evaluation during aircraft certification.
(3) Control system output information to the cockpit, such as fault indication or control mode status.
(4) General information to help the pilot determine that the engine is actually producing the commanded power, such as the percent of available power in both normal operation and any alternate modes.
(5) General information associated with engine parameters that have limiting functions, including range information on those parameters. The instruction manual should specify those parameters that are within the pilot’s control (such as engine rpm) and those that are not (such as fuel flow, manifold air pressure (MAP), cylinder head temperature (CHT), exhaust gas temperature (EGT) ), as well as range of control.
(6) General information associated with operation lean of the EGT peak, including the allowable CHT or EGT range and transient behavior.
(7) General information about automatic engine limiting functions independent of the propeller governor, such as speed, MAP, CHT, and EGT. The manual should also specify unusual interactions with a (conventional) propeller governor.
(8) In-flight restarting procedures, both normal and abnormal.
(9) A list of approved fuels, including any operating restrictions or limitations resulting from use of alternate fuels.
(10) Descriptions of other abnormal operations, such as failed control channel or inoperative sensors.
(11) Operating limitations. If applicable, the instruction manual should identify the operating limitations associated with EEC system faults such as:
(a) Unlimited operation;
(b) Time-limited operation (TLO); and Par 3-3 Page 9
(c) No take-off permitted.
d. Certification Data Interface Document (CDID). The applicant should submit a document that includes data from safety analyses, environmental testing, and software validation and verification that is necessary for systems analysis of the powerplant installation and any other associated aircraft system. In lieu of a separate document, this data may be included in the instruction manual. If the applicant submits this data in a separate document, the instructions for installation should reference the document to ensure that the data is integrated into the airplane designer’s powerplant system safety analysis. The CDID should include, but is not limited to, the following specific data:
(1) Failure of Aircraft Power Analysis. The CDID should include the assumptions and results from this analysis that should be considered in the aircraft design. Chapter 4 of this AC provides more information on this analysis. The CDID should also include, but is not limited to, the following specific data:
(a) Data for the engine response to the transition from primary to backup power sources, or from primary to mechanical backup controls modes; and
(b) Effects on engine power and the duration of those effects.
(2) Failure of Aircraft Data Analysis. The CDID should include the assumptions and results from this analysis that should be considered in the aircraft design. Chapter 4 of this AC provides more information on this analysis. The CDID should include, but is not limited to, the following specific data:
(a) Fault accommodations taken for these aircraft-supplied signals;
(b) Those air data signals whose failure can cause an engine MPL;
(c) EEC system limitations for aircraft-supplied data, and signals for protection against common mode faults; and
(d) Hardware and software requirements for aircraft components in the data path between the EEC system and the aircraft.
(3) EEC Safety Analysis (EECSA) Assumptions. The CDID should include assumptions relating to airplane installation and operation conditions, such as the following:
(a) Operating procedures;
(b) Maintenance actions and associated intervals;
(c) Installed environment; and
(d) Latent failure exposure period.
Page 10 Par 3-3