Subject: GUIDANCE MATERIAL FOR 14 CFR §33.28, RECIPROCATING ENGINES,
ELECTRICAL AND ELECTRONIC ENGINE CONTROL SYSTEMS.
Date: 08/13/03 Initiated By: ANE-110
AC No: 33.28-2 Change:
Version:
1. PURPOSE. This advisory circular (AC) provides guidance and acceptable methods, but not the only methods, that may be used by designers of reciprocating engine electronic control systems to demonstrate compliance with §33.28 of Title 14 of the Code of Federal Regulations (14 CFR 33.28), Electrical and electronic engine control systems.
2. RELATED REGULATIONS.
a. Part 21. Section 21.16.
b. Part 23. Sections 23.901, 23.903, 23.909, and 23.1309.
c. Part 33. Sections 33.4, 33.5, 33.17, 33.28, 33.49, 33.53 and appendix A of part 33.
3. RELATED REFERENCE MATERIAL.
a. ACs, Notices, and Policy.
(1) AC 20-53A, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Due to Lightning, dated April 12, 1985.
(2) AC 20-115B, RTCA, Inc. Document DO-178B, Software Considerations in Airborne Systems and Equipment Certification, dated January 11, 1993.
(3) AC 20-136, Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning, dated March 5, 1990.
(4) AC 21-16D, RTCA Document No. DO-160D, Environmental Conditions and Test Procedures for Airborne Equipment, dated July 21, 1998.
(5) AC 23.1309-1C, Equipment, Systems, and Installations in Part 23 Airplanes, dated March 12, 1999.
(6) AC 33.28-1, Compliance Criteria for 14 CFR §33.28, Aircraft Engines, Electrical and Electronic Engine Control Systems, dated June 29, 2001.
(7) Notice N8110.71, Guidance for the Certification of Aircraft Operating in High Intensity Radiated Field (HIRF) Environments, issued April 2, 1998.
(8) Engine and Propeller Directorate Policy, Time Limited Dispatch (TLD) of Engines Fitted with Full Authority Digital Engine Control (FADEC) Systems, dated June 29, 2001.
(9) AC 33.4-1, Instructions for Continued Airworthiness, dated August 27, 1999.
b. Industry Documents.
(1) RTCA Document No. DO-160D (EUROCAE ED14D), Environmental Conditions and Test Procedures for Airborne Equipment, dated July 29, 1997.
(2) RTCA Document No. DO-178B (EUROCAE ED12D), Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992.
(3) SAE ARP 926B, Fault or Failure Analysis Procedure, issued June 1997.
(4) SAE ARP 1834A, Fault or Failure Analysis for Digital Systems and Equipment, issued June 1997.
(5) SAE ARP 4754, Certification Considerations for Highly-Integrated or Complex Aircraft Systems, issued November 1996.
(6) SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, issued December 1996.
(7) SAE ARP 5107, Guidelines for Time-Limited-Dispatch Analysis for Electronic Engine Control Systems, issued June 1997.
(8) IEC PAS 62239, Electronic Component Management Plans, edition 1.0, dated April 2001.
(9) IEC PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001.
Page ii Par 3
(10) RTCA Document No. DO-254, Design Assurance Guidance for Airborne Electronic Hardware, dated April 19, 2000.
c. Military Specifications.
(1) MIL-STD-461E, Requirements for the Control of Electromagnetic Interference Characteristics of the Subsystems and Equipment, dated August 20, 1999.
(2) MIL-STD-462D, Measurement of Electromagnetic Interference Characteristics, Test Standard For, dated February 5, 1996.
(3) MIL-STD-704, Aircraft Electrical Power Characteristics, dated March 22, 1994.
(4) MIL-STD-810E, Environmental Test Methods and Engineering Guidelines, dated July 31, 1995.
(5) MIL-STD-5007D, General Specification for Engine, Aircraft, Turbojet and Turbofan, Amendment 3, dated December 27, 1995.
(6) MIL-HDBK-179A, Microcircuit Acquisition Handbook, dated July 20, 1995.
(7) MIL-HDBK-217F, Reliability Prediction of Electronic Equipment, dated February 28, 1995.
4. APPLICABILITY.
a. The guidance provided in this document is directed to engine manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) engine type certification engineers and their designees.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “shall,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if the FAA becomes aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation as the basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from existing regulatory requirements.
Par 3 Page iii
d. This AC applies to electrical and electronic engine control (EEC) systems used on reciprocating engines certificated under part 33 and intended for use in aircraft certificated under part 23 (normal, utility, or acrobatic categories) or under Civil Air Regulation (CAR) part 3.
These engines are generally installed on small, general aviation airplanes. This AC applies to any electrical or electronic sub-systems that control a specific engine function installed on one of these engines (for example, turbocharger, fuel injection, or ignition timing systems).
e. However, this guidance does not apply to or address the following:
(1) EEC systems installed on engines used on airplanes certificated under part 23 commuter category or part 25 transport category.
(2) Non-engine control functions integrated into the EEC system that are not normally covered under part 33 (for example, propeller controls regulated under part 35). This AC does, however, apply to these functions when they affect part 33 requirements.
Original signed by MJB 8/13/03
Marc J. Bouthillier Acting Manager, Engine and Propeller Directorate, Aircraft Certification Service Page iv Par 4
CONTENTS Paragraph Page
CHAPTER 1. GENERAL
1-1. Background1
1-2. Limitations1
1-3. Definitions1
CHAPTER 2. SECTION 33.28 GENERAL
2-1. Rule Text5
2-2. Intent of Rule5
CHAPTER 3. SECTION 33.28(a)
3-1. Rule Text7
3-2. Intent of Rule7
a. General7
b. Airplane Installation and Certification7
3-3. Guidance7
a. Control System Description7
b. Installation Requirements8
c. Operational Requirements9
d. Certification Data Interface Document10
CHAPTER 4. SECTION 33.28(b)
4-1. Rule Text13
4-2. Intent of Rule13
4-3. Guidance13
a. General13
b. Failure of Aircraft-Supplied Power13
c. Failure of Aircraft-Supplied Data16
CHAPTER 5. SECTION 33.28(c)
5-1. Rule Text19
5-2. Intent of Rule19
a. Single-Fault Tolerance19
b. Unsafe Condition19
5-3. Compliance20
Page v
5-4. Guidance20
a. EECSA General20
b. EECSA Assumptions21
c. EECSA Quantitative Analysis21
d. TLO Implementation Requirements23
e. EECSA Qualitative Analysis25
CHAPTER 6. SECTION 33.28(d)
6-1. Rule Text33
6-2. Intent of Rule33
6-3. Guidance33
6-4. Electrical Environmental Limitations33
a. Declared Levels33
b. Test Procedures34
c. Pass/Fail Criteria35
d. Component and Software Design Changes35
e. Maintenance Requirements35
6-5. Physical Environmental Limitations36
CHAPTER 7. SECTION 33.28(e)
7-1. Rule Text39
7-2. Intent of Rule39
7-3. Guidance39
a. Compliance Elements39
b. Software Level Requirement40
c. Software Partitioning40
d. Software Integrity40
CHAPTER 8. INTEGRATION OF ENGINE, PROPELLER AND AIRCRAFT SYSTEMS
8-1. EEC System Integration Plan41
a. Distribution of Compliance Tasks41
b. Interface Definition & Other Data41
c. Design Change Control42
8-2. Aircraft Functions Integrated into the Engine Control System42
a. Integration Activities42
b. Certification Considerations42
8-3. Integration of Engine Control Functions into Aircraft Systems43
a. Integration Activities43
b. Certification Considerations43
APPENDIX 1. CERTIFICATION COMPLIANCE DOCUMENTS Page vi
CHAPTER 1. GENERAL
1-1. Background.
a. EEC technology was initially applied to turbine engines designed for large transport aircraft applications. Therefore, the information and guidance for showing compliance with §33.28 provided by the FAA was oriented toward these applications. However, the increasing use of EEC systems in reciprocating piston engines has created a need for guidance specifically for reciprocating engines.
b. The application of electronic technology to reciprocating engine control systems introduces systems safety considerations:
(1) A greater dependence of the engine on aircraft systems due to the use of electrical power or data supplied from the aircraft;
(2) A risk of significant failures common to more than one engine of the aircraft that might, for example, occur as a result of the following:
(a) Insufficient protection from electromagnetic disturbance (lightning, internal or external radiation effects);
(b) Insufficient integrity of the aircraft electrical power supply;
(c) Insufficient integrity of data supplied from the aircraft;
(d) Hidden design faults or discrepancies contained within the design of the propulsion system control software; or
(e) Omissions or errors in the system/software specification.
c. This AC provides guidance and acceptable methods, but not the only methods, for demonstrating compliance with §33.28 that address these issues. This guidance is consistent with the FAA objective of isolating the engine from the effects of airplane system failures.
1-2. Limitations. The engine Type Certificate Data Sheet (TCDS) or engine Supplemental Type Certificate (STC) issued by the FAA upon approval of an EEC system substantiated in accordance with this AC should specify the following limitation:
“Installation of this engine is not approved for airplanes certificated under part 23 commuter or part 25 transport categories.”
1-3. Definitions. The following definitions apply to reciprocating engines and may not be appropriate for turbine engines.
Par 1-1 Page 1
a. Aircraft-Supplied Data. Aircraft-supplied data is information that is generated in the aircraft systems and used by the engine control system, but whose source is not controlled under the design authority of the engine certification applicant. This does not include input from those sensors that are used by, and normally dedicated to, the engine control system but may be mounted in the airframe.
b. Aircraft-Supplied Power. Aircraft-supplied power is any electrical power source that is an integral part of the aircraft electrical system and whose primary function is to power aircraft systems (for example, an electrical bus).
c. Alternate Control Mode(s). For the purposes of this AC, an alternate control mode is characterized by engine control operating characteristics or capabilities that are sufficiently different from the “normal mode” and may significantly affect the operating characteristics or capabilities of the aircraft, crew workload, or anything that constitutes appropriate crew procedures.
d. Back-up System. A back-up system is a different type of system that is used as a stand-by or alternate control mode to the primary or normal control mode or system.
e. Commercial and Industrial Grade Electronic Parts. Commercial and industrial grade electronic parts are not manufactured to military standards.
f. Degraded System or Configuration. A degraded system or configuration is an EEC system that has faults or failures present that have no effect on engine operation but may cause a loss of redundancy in the system.
g. Destructive Event. A destructive event is any malfunction or failure of the EEC system that could result in a condition in which the engine, or any of its components, causes physical damage to the airplane structure or its occupants that could potentially impact continued safe operation of the airplane. For example, engine separation from its mounts, uncontrolled fire, inability to shutdown the engine, generation of toxic products, or destructive engine explosion.
h. Electronic Engine Control (EEC) System. The EEC system consists of systems or subsystems, with full or limited-authority functional capability, which have the following characteristics:
(1) Modulation of one or more engine control parameters;
(2) Logic that discriminates the desired condition of an engine control parameter; and
(3) Electronic implementation of logic.
i. Failure Condition. A failure condition is an abnormal or non-operating state of the engine that is caused by or contributed to by one or more faults or failures.
j. Failure Event. See definition for “failure condition.”
Page 2 Par 1-3
k. Fault or Failure. A fault or failure is an occurrence that affects the operation of an engine component, part, or element so that it cannot function as intended (this includes both loss of function and malfunction). Software errors may cause failures, but are not considered faults.
l. Fault or Failure Accommodation. This term refers to the capability of the control system or flight crew to mitigate, either entirely or in part, the fault or failure.
m. Fault or Failure Detection. This term refers to the discovery of a fault or failure or the resulting condition.
n. Full Authority Digital Engine Control (FADEC). FADEC is an engine control system in which the primary functions are provided using digital electronics and the EEC unit has fullrange authority over the engine power.
o. Full-up System or Configuration. The full-up system or configuration is an EEC system that has no faults or failures present, detected or undetected, that affect the control of engine power, engine protection systems, indication of critical engine operating parameters or other safety features of the engine control system.
p. Local Events. Local events are failures of aircraft systems and components, other than the EEC system, that may affect the installed environment of the EEC.
q. Loss of Power Control (LOPC). LOPC is an EEC failure event resulting in the inability to attain at least 85% of rated power, or the inability to modulate power at all normal operating conditions.
r. Minor Power Loss (MPL). MPL is an EEC failure event resulting in the ability to attain greater than 85%, but less than 95%, of rated power.
s. Primary Mode. This is the mode of operation intended to control the engine. This is often referred to as the “normal mode.”
t. Programmed Logic Device. A programmed logic device is a custom micro-coded component, such as application specific integrated circuits (ASIC) or programmable logic devices (PLDs).
u. Single-Fault Tolerant. Single-fault tolerant refers to the capability of the EEC system design architecture to accommodate the occurrence of any single EEC system fault to prevent an unsafe condition.
v. Time-Limited Operations (TLO). TLO refers to the duration of flight operations permitted with the EEC system in a degraded condition.
w. Unacceptable Change in Power. For the purposes of this AC, an unacceptable change in power is defined as an LOPC.
Par 1-3 Page 3
x. Uncovered Fault. An uncovered fault is a fault or failure for which either a detection mechanism does not exist or, if there is a detection mechanism, an accommodation for the fault does not exist.
y. Unsafe Condition. For the purposes of this AC, an unsafe condition refers to any malfunction or failure of the EEC system that could result in a destructive event or EEC system LOPC and MPL rates in excess of those specified in Tables 5-1 and 5-2 of this AC. This definition is intended to apply to certification activities for reciprocating engine EEC systems and is not applicable to continued airworthiness activities related to these engines and systems.
Page 4 Par 1-3
CHAPTER 2. SECTION 33.28 GENERAL
2-1. Rule Text. The introduction to §33.28 specifies that the requirements of §33.28 apply to:
“Each control system which relies on electrical and electronic means for normal operation.”
2-2. Intent of Rule.
a. Section 33.28 applies to engine control systems, or subsystems, that include the following design elements:
(1) Modulation of one or more engine control parameters;
(2) Logic that discriminates the desired condition of an engine control parameter; and
(3) Electronic implementation of logic.
b. Section 33.28 applies to the entire scope of integration of electronic and electrical systems into engine control systems, including the following:
(1) Primary and back-up systems;
(2) Full-authority and limited authority systems;
(3) Digital and analog systems;
(4) Supervisory systems;
(5) Electronic subsystems such as turbocharger wastegate controllers, ignition timing systems, and fuel injection systems; and
(6) Hybrid systems that rely on mechanical systems to back-up primary EEC systems.
c. Section 33.28 does not apply to engine control systems using electrical, but non-electronic, components with the following design characteristics:
(1) The operating state of the device is not directly determined by the EEC system; and
(2) The device does not itself incorporate the design elements of paragraph 2-2a of this AC.
Par 2-1 Page 5
d. The following are examples of components to which §33.28 does not apply:
(1) A conventional, new magneto;
(2) An electrically-powered actuator such as a solenoid whose actuation is dependant on pilot action through a dedicated electrical circuit; and
(3) An electrical relay not controlled by the EEC system.
e. The following are examples of components to which §33.28 does apply:
(1) Programmable logic controllers or arrays (PLCs or PLAs).
(2) An electrically-powered actuator, such as a solenoid, whose actuation is directly controlled by the EEC system.
(3) An electrical relay controlled by the EEC system.
Page 6 Par 2-2