k. Fault or Failure. A fault or failure is an occurrence that affects the operation of an engine component, part, or element so that it cannot function as intended (this includes both loss of function and malfunction). Software errors may cause failures, but are not considered faults.
l. Fault or Failure Accommodation. This term refers to the capability of the control system or flight crew to mitigate, either entirely or in part, the fault or failure.
m. Fault or Failure Detection. This term refers to the discovery of a fault or failure or the resulting condition.
n. Full Authority Digital Engine Control (FADEC). FADEC is an engine control system in which the primary functions are provided using digital electronics and the EEC unit has fullrange authority over the engine power.
o. Full-up System or Configuration. The full-up system or configuration is an EEC system that has no faults or failures present, detected or undetected, that affect the control of engine power, engine protection systems, indication of critical engine operating parameters or other safety features of the engine control system.
p. Local Events. Local events are failures of aircraft systems and components, other than the EEC system, that may affect the installed environment of the EEC.
q. Loss of Power Control (LOPC). LOPC is an EEC failure event resulting in the inability to attain at least 85% of rated power, or the inability to modulate power at all normal operating conditions.
r. Minor Power Loss (MPL). MPL is an EEC failure event resulting in the ability to attain greater than 85%, but less than 95%, of rated power.
s. Primary Mode. This is the mode of operation intended to control the engine. This is often referred to as the “normal mode.”
t. Programmed Logic Device. A programmed logic device is a custom micro-coded component, such as application specific integrated circuits (ASIC) or programmable logic devices (PLDs).
u. Single-Fault Tolerant. Single-fault tolerant refers to the capability of the EEC system design architecture to accommodate the occurrence of any single EEC system fault to prevent an unsafe condition.
v. Time-Limited Operations (TLO). TLO refers to the duration of flight operations permitted with the EEC system in a degraded condition.
w. Unacceptable Change in Power. For the purposes of this AC, an unacceptable change in power is defined as an LOPC.
Par 1-3 Page 3
x. Uncovered Fault. An uncovered fault is a fault or failure for which either a detection mechanism does not exist or, if there is a detection mechanism, an accommodation for the fault does not exist.
y. Unsafe Condition. For the purposes of this AC, an unsafe condition refers to any malfunction or failure of the EEC system that could result in a destructive event or EEC system LOPC and MPL rates in excess of those specified in Tables 5-1 and 5-2 of this AC. This definition is intended to apply to certification activities for reciprocating engine EEC systems and is not applicable to continued airworthiness activities related to these engines and systems.
Page 4 Par 1-3
CHAPTER 2. SECTION 33.28 GENERAL
2-1. Rule Text. The introduction to §33.28 specifies that the requirements of §33.28 apply to:
“Each control system which relies on electrical and electronic means for normal operation.”
2-2. Intent of Rule.
a. Section 33.28 applies to engine control systems, or subsystems, that include the following design elements:
(1) Modulation of one or more engine control parameters;
(2) Logic that discriminates the desired condition of an engine control parameter; and
(3) Electronic implementation of logic.
b. Section 33.28 applies to the entire scope of integration of electronic and electrical systems into engine control systems, including the following:
(1) Primary and back-up systems;
(2) Full-authority and limited authority systems;
(3) Digital and analog systems;
(4) Supervisory systems;
(5) Electronic subsystems such as turbocharger wastegate controllers, ignition timing systems, and fuel injection systems; and
(6) Hybrid systems that rely on mechanical systems to back-up primary EEC systems.
c. Section 33.28 does not apply to engine control systems using electrical, but non-electronic, components with the following design characteristics:
(1) The operating state of the device is not directly determined by the EEC system; and
(2) The device does not itself incorporate the design elements of paragraph 2-2a of this AC.
Par 2-1 Page 5
d. The following are examples of components to which §33.28 does not apply:
(1) A conventional, new magneto;
(2) An electrically-powered actuator such as a solenoid whose actuation is dependant on pilot action through a dedicated electrical circuit; and
(3) An electrical relay not controlled by the EEC system.
e. The following are examples of components to which §33.28 does apply:
(1) Programmable logic controllers or arrays (PLCs or PLAs).
(2) An electrically-powered actuator, such as a solenoid, whose actuation is directly controlled by the EEC system.
(3) An electrical relay controlled by the EEC system.
Page 6 Par 2-2
CHAPTER 3. SECTION 33.28(a)
3-1. Rule Text. Section 33.28(a) provides that each EEC system: “Have the control system description, the percent of available power or thrust controlled in both normal operation and failure conditions, and the range of control of other controlled functions, specified in the instruction manual required by §33.5 for the engine.”
3-2. Intent of Rule. Section §33.28(a) requires the applicant to provide the engine installer with enough information about the EEC system to integrate the EEC-equipped engine system into the airplane design. A successful propulsion system installation requires a clear understanding of all aspects of the control system in normal and alternate control modes. The instruction manual specified in §33.5 includes both installation and operation instructions.
a. General. To show compliance with 33.28(a), the applicant may submit installation and operation manual sections for the engine manual or separate installation and operation manuals for the EEC system. The manual(s) should include descriptive, interface, and operating data in enough detail to support airplane certification. Limitations specified in the manual(s) should be consistent with those stated on the type certificate data sheet (TCDS), amended TCDS, or supplemental type certificate (STC), as applicable. These installation and operation instructions (or a separate Certification Data Interface Document) should also include the certification data specified in section 3-3d of this AC, to ensure that the part 33 certification is not invalidated when the engine is installed on the airplane.
b. Airplane Installation and Certification. Subpart E of part 23 provides regulations for the installation of a certificated engine into an airplane. The installed engine is defined as the powerplant system. These regulations require that the powerplant system design meet all the requirements, procedures, limitations, and assumptions specified in the engine instruction manual and the engine TCDS or STC. The applicant should coordinate this data with the prospective airplane designer and the appropriate FAA certification office. If the application is unknown or not defined at the time of engine certification, the EEC system applicant should substantiate any installation and operational assumptions made during the EEC system design.
As part of the airplane certification program, the FAA may require flight-testing to fully evaluate engine performance and operability characteristics for all operating modes. See §23.939.
3-3. Guidance. The following is a method, but not the only method, for demonstrating compliance with §33.28(a). The applicant should include this data in the engine installation and operation instructions submitted to show compliance with §33.5. See appendix 1 for a list of compliance documents that may be submitted for this section.
a. Control System Description. The applicant should include a brief control system description in the instruction manual and may reference a more detailed system description. The manual should include, but not be limited to, the following:
(1) A system schematic that includes electrical, mechanical, and fuel system elements;
Par 3-1 Page 7
(2) A description of the engine control functions performed by the EEC system; and
(3) An overview of the design of each of the system components.
b. Installation Requirements. The instruction manual should specify all of the physical, electrical, and functional installation requirements and limitations of the EEC system. For example, the instruction manual should include:
(1) Electrical Interface. The instruction manual should define the following:
(a) EEC system electrical power requirements and quality, including interrupt limitations, and grounding requirements. This should also include steady-state and transient under-voltage and over-voltage limits for the equipment. The power input requirements of DO- 160D, Section 16, provide an acceptable definition of such requirements. If DO-160 is used, the manual should state any exceptions to the power quality requirements cited in DO-160 for the particular category of equipment specified.
(b) Impedance and buffering limitations for the signals provided by the EEC system for display and instrumentation.
(c) Signals used by the EEC system, such as air data information, to ensure that the EEC system is adequately isolated and unaffected by other systems using these signals.
(d) Impedance, buffering, and range limitations for aircraft data signals used by the EEC system.
(e) Subtle interface requirements, such as power interrupt tolerance of the EEC system.
(f) EEC system power supply requirements and backup power reliability, if the backup electrical supply is not certified as part of the engine. The manual should clearly state that the backup electrical supply should be independent and isolated from the airplane bus system or systems.
(g) Endurance of the battery, if a battery is certified with the engine as a source of electrical power for the EEC system. The endurance of the battery should be consistent with the airworthiness standards applicable to the intended installation. The manual should also specify provisions for monitoring the health status of the battery.
(2) Engine control lever(s) interface requirements, including electrical and mechanical characteristics.
(3) Unique fuel system requirements, such as filtration and fuel inlet conditions (flow and pressure).
(4) Any unique engine instrumentation cockpit display requirements.
Page 8 Par 3-3
c. Operational Requirements. The instruction manual should contain a description of the control system operating procedures and limitations in both the normal and alternate control modes. For example, the instruction manual should provide:
(1) Restrictions in the flight envelope or unusual operating characteristics in these alternate modes.
(2) Abnormal control characteristics that could have an impact on crew procedures, training, workload, or any other aspects of aircraft performance or operating characteristics, for evaluation during aircraft certification.
(3) Control system output information to the cockpit, such as fault indication or control mode status.
(4) General information to help the pilot determine that the engine is actually producing the commanded power, such as the percent of available power in both normal operation and any alternate modes.
(5) General information associated with engine parameters that have limiting functions, including range information on those parameters. The instruction manual should specify those parameters that are within the pilot’s control (such as engine rpm) and those that are not (such as fuel flow, manifold air pressure (MAP), cylinder head temperature (CHT), exhaust gas temperature (EGT) ), as well as range of control.
(6) General information associated with operation lean of the EGT peak, including the allowable CHT or EGT range and transient behavior.
(7) General information about automatic engine limiting functions independent of the propeller governor, such as speed, MAP, CHT, and EGT. The manual should also specify unusual interactions with a (conventional) propeller governor.
(8) In-flight restarting procedures, both normal and abnormal.
(9) A list of approved fuels, including any operating restrictions or limitations resulting from use of alternate fuels.
(10) Descriptions of other abnormal operations, such as failed control channel or inoperative sensors.
(11) Operating limitations. If applicable, the instruction manual should identify the operating limitations associated with EEC system faults such as:
(a) Unlimited operation;
(b) Time-limited operation (TLO); and Par 3-3 Page 9
(c) No take-off permitted.
d. Certification Data Interface Document (CDID). The applicant should submit a document that includes data from safety analyses, environmental testing, and software validation and verification that is necessary for systems analysis of the powerplant installation and any other associated aircraft system. In lieu of a separate document, this data may be included in the instruction manual. If the applicant submits this data in a separate document, the instructions for installation should reference the document to ensure that the data is integrated into the airplane designer’s powerplant system safety analysis. The CDID should include, but is not limited to, the following specific data:
(1) Failure of Aircraft Power Analysis. The CDID should include the assumptions and results from this analysis that should be considered in the aircraft design. Chapter 4 of this AC provides more information on this analysis. The CDID should also include, but is not limited to, the following specific data:
(a) Data for the engine response to the transition from primary to backup power sources, or from primary to mechanical backup controls modes; and
(b) Effects on engine power and the duration of those effects.
(2) Failure of Aircraft Data Analysis. The CDID should include the assumptions and results from this analysis that should be considered in the aircraft design. Chapter 4 of this AC provides more information on this analysis. The CDID should include, but is not limited to, the following specific data:
(a) Fault accommodations taken for these aircraft-supplied signals;
(b) Those air data signals whose failure can cause an engine MPL;
(c) EEC system limitations for aircraft-supplied data, and signals for protection against common mode faults; and
(d) Hardware and software requirements for aircraft components in the data path between the EEC system and the aircraft.
(3) EEC Safety Analysis (EECSA) Assumptions. The CDID should include assumptions relating to airplane installation and operation conditions, such as the following:
(a) Operating procedures;
(b) Maintenance actions and associated intervals;
(c) Installed environment; and
(d) Latent failure exposure period.
Page 10 Par 3-3
(4) EECSA Results. The CDID should specify the estimated reliability of, or the failure rates for, safety-significant failure conditions and the other events associated with the control system (that is, events that the control system causes or is involved in preventing), as determined from the system safety analysis, such as the following:
(a) LOPC rate from the numerical fault tree analysis (FTA) and failure modes and effects analysis (FMEA);
(b) MPL rate from the numerical FTA and FMEA;
(c) Failures that result in a system transfer to an alternate control mode;
(d) Transmission of faulty parameters that affect cockpit-located engine displays or other safety critical functions identified in the EEC system output data content analysis;
(e) Loss of any critical safeguards, such as CHT or overboost limiting control, identified as latent failures in the FMEA or FTA;
(f) Failures of existing engine mechanical systems that could produce significant EEC system failure modes or effects as identified in the existing subsystems analysis; and
(g) Fault accommodation logic data (for EEC system faults) as identified in the fault accommodation logic analysis:
1. Tabulation of the fault accommodation logic for the critical parameters used by the control; and
2. Tabulation of the “default” or “fail-safe” states of all output effectors and the rationale for selection.
(5) Environmental Testing. The CDID should specify the types and levels of environmental exposure for which the EEC system has been successfully qualified (for example, vibration, temperature, electro-magnetic interference (EMI), HIRF, and lightning). For the HIRF, lightning, and EMI qualification tests, the CDID should describe the interfacing aircraft cables used for the tests.
(6) Software Validation and Verification. The CDID should identify the software level and documentation submitted in support of the software certification.
Par 3-3 Page 11 (and 12)
CHAPTER 4. SECTION 33.28(b)
4-1. Rule Text. Section 33.28(b) provides that each EEC system: “Be designed and constructed so that any failure of aircraft-supplied power or data will not result in an unacceptable change in power or thrust, or prevent continued safe operation of the engine.”
4-2. Intent of Rule. Section 33.28(b) requires that the EEC system maintain a level of selfsufficiency and isolation from the aircraft, or ensure a level of redundancy, that will enable the EEC system to accommodate aircraft electrical and data system failures. Conventional magneto ignition and mechanical fuel systems currently have the capability to accommodate these aircraft failures.
4-3. Guidance. The following is a method, but not the only method, for demonstrating compliance with §33.28(b). See appendix 1 for a list of compliance documents that may be submitted for this section.
a. General.
(1) Any LOPC event represents an unacceptable change in power. Therefore, the objective of both analyses described in this chapter should be to substantiate that the failure of aircraft-supplied power or data does not cause an LOPC.
(2) However, aircraft-supplied power or data failure events that result in engine effects less severe than an LOPC, such as an MPL, do not represent unacceptable changes in power. The analyses in this chapter and the installation instructions should identify these types of events along with their effect on engine operation. This data can then be used in the powerplant installation safety analysis required under the airplane airworthiness standards of part 23 to evaluate the impact of these failures on airplane operation.
b. Failure of Aircraft-Supplied Power. The applicant should provide an analysis, validated by engine or bench testing, that substantiates the function of the EEC system with a failure or interruption of an aircraft-supplied power source at any point within the declared engineoperating envelope. The following are acceptable design concepts:
(1) Engine Self-Contained Electrical Power System.
(a) This type of system is an integral part of the engine design and is both functionally and physically isolated from the aircraft electrical power system.
(b) This type of electrical power system is considered part of the EEC system; its predicted failure event rate should be included in the EECSA of chapter 5 of this AC.
Par 4-1 Page 13
(c) Back-up electrical power is not necessarily required with this type of system.
However, if the applicant elects to use aircraft power as a back-up source of power, then the applicant should provide detailed electrical system interface requirements in the installation instructions and demonstrate that abnormal behavior of the aircraft source cannot upset the EEC system. The predicted failure event rate of this back-up power system does not have to be included in the EECSA of chapter 5 of this AC.
(d) Power from an engine-mounted alternator or generator that is routed directly to the aircraft main power bus and then in turn used to power the EEC system is considered part of that aircraft bus and not a self-contained engine power source. However, EEC system power from a dedicated winding on an alternator with dual windings is considered a self-contained engine power source, even if the alternate winding is used to provide power for aircraft systems.
(2) Aircraft-Supplied Power System(s) for EEC System Electrical Power.
(a) Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
(b) A failure of a single aircraft bus on an aircraft equipped with multiple aircraft buses is not considered a loss of aircraft power if the buses are independent and isolated from each other and if each of the buses power the EEC system separately. Therefore, a backup source could be an alternate aircraft bus, such as an essential bus, that is independent and isolated from the bus serving as the primary power source. An essential bus is an isolated bus that services only electrical loads required for continued safe operation.
(c) When the EEC system design relies on an aircraft electrical power system for primary power, backup power, or both, the applicant should provide detailed electrical system interface requirements in the installation instructions.
(d) For EEC systems that rely on aircraft electrical power systems for primary power or backup power, a maximum allowable failure event rate should be derived for that system such that the total EEC system failure event rate, including the aircraft power source, remains within the EECSA criteria for full-up and degraded systems of chapter 5 of this AC. This maximum allowable failure event rate requirement for the aircraft electrical power system(s) should be defined in the instructions for installation in chapter 3 of this AC.
(e) If aircraft-supplied power, such as the aircraft bus and battery system, is used as the primary power source, then the EEC system should have a backup power source that is isolated from the primary source. This backup power source can be integral to the engine EEC system or provided by the airplane.
Page 14 Par 4-3