Advisory U.S. Department of Transportation Federal Aviation Circular Administration Subject: Guidance Material For 14 CFR § 33.28, Date: 5/23/14 AC No: 33.28-3 Engine Control Systems Initiated by: ANE-111 This advisory circular (AC) provides guidance and describes acceptable methods, but not the only methods, for demonstrating compliance with the engine control systems requirements of § 33.28 of Title 14 of the Code of Federal Regulations (14 CFR part 33) at amendment level 33-26.
Colleen M. D’Alessandro Assistant Manager, Engine and Propeller Directorate, Aircraft Certification Service
Contents Chapter Page
1. Section 33.28 – General1
2. Section 33.28(a) – Applicability4
3. Section 33.28(b)(1) – Validation6
4. Section 33.28(b)(2) – Environmental Limits8
5. Section 33.28(c) – Control Transitions14
6. Section 33.28(d) – Engine Control System Failures18
7. Section 33.28(e) – System Safety Assessment27
8. Section 33.28(f) – Protection Systems31
9. Section 33.28(g) –Software34
10. Section 33.28(h) – Aircraft-supplied Data38
11. Section 33.28(i) – Aircraft-supplied Electrical Power43
12. Section 33.28(j) – Air Pressure Signal50
13. Section 33.28(k) – Automatic Availability and Control of Engine Power for a
30-Second OEI Rating51
14. Section 33.28(l) – Engine Shut Down Means52
15. Section 33.28(m) – Programmable Logic Devices (PLD)53
16. Other Considerations: Engine, Propeller and Aircraft Systems Integration and
Relations between Engine, Propeller and Aircraft Certification Activities55
Appendices Appendix Page
Appendix 1. References to Installation (and/or operating) InstructionsA1-1
Appendix 2. Certification Compliance DocumentA2-1
ii
Appendix 3. Guidance for System Safety Assessment for EECS Applied to
Reciprocating EnginesA3-1
Appendix 4. Related ReferencesA4-1
Appendix 5. DefinitionsA5-1
Appendix 6. Advisory Circular Feedback InformationA6-1
iii
CHAPTER 1. SECTION 33.28 - GENERAL.
1-1. Purpose. Section 33.28 regulates the general design and functioning of the ECS. It does not replace or supersede other regulations governing individual ECS components. Those components, such as alternators, sensors, and actuators, are also regulated under other part 33 sections, such as § 33.67 or 33.35 for the fuel system and § 33.91 or 33.53 for individual component tests.
1-2. Applicability. The guidance provided in this document is directed to engine manufacturers, modifiers, or Federal Aviation Administration (FAA) designated engineering representatives.
This guidance should also assist the engine installer in understanding the differences between certification of the engine and the aircraft, and the assumptions made by the engine manufacturer concerning the engine-to-aircraft interface.
This material is neither mandatory nor regulatory in nature and does not constitute a regulation.
It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if we become convinced that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation as the basis for finding compliance.
Applicants for engines equipped with electronic engine control systems (EECS) may require additional guidance, especially with regard to the interface of these engines with the certification of the aircraft or propeller or both. This AC discusses the tasks related to the engine, propeller, and aircraft certification processes generally, and indicates to a limited extent, how these tasks might be allocated among product manufacturers. This document applies to functions integrated into the EECS to the extent that these functions affect compliance with federal aviation regulations.
This AC does not apply to conventional magnetos or electrically-powered actuators whose actuation depends on pilot action through a dedicated electric circuit or electrical relays not controlled by the EECS.
The material in this AC does not change, create any additional, authorize changes in, or permit deviations from existing regulatory requirements.
1-3. Related Reading Material. Refer to Appendix 4 for reading material that is related to this AC.
1-4. Definitions. Refer to Appendix 5 for definitions that are used in this AC.
1-5. Overview of this AC. This guidance focuses on electrical and electronic issues related to aircraft engine control systems. For EECSs, this AC also provides guidance for compliance with § 33.28 with special consideration to interfaces with the aircraft and the propeller.
a. This AC gives guidance on the precautions to be taken when using electrical and electronic technology for engine control, protection, limiting and monitoring functions, and, where applicable, for integration of functions specific to the aircraft or to the propeller. In these latter cases, this AC applies to functions integrated into the EECS, but only to the extent that these functions affect compliance with part 33. Functions added to the EECS that are not required for compliance with part 33 but are required for installation compliance are documented in the engine installation manual.
b. This guidance primarily addresses the thrust and power functions of an EECS, since thrust and power are the prime functions of the engine. Other functions that may be integrated into the system for control of engine operations, such as bleed air valve control, are also addressed in this AC. The principles outlined in this AC apply to the whole ECS.
c. Finally, introducing electronic engine control technology entails increased engine and aircraft control and control indicator integration, and an increased risk of failures affecting more than one engine. The applicant should, take special design precautions to minimize any adverse effects from any of the following:
(1) Insufficient protection from electromagnetic disturbance (lightning, internal or external radiation effects),
(2) Insufficient integrity of the aircraft electrical power supply,
(3) Insufficient integrity of data supplied from the aircraft,
(4) Hidden design faults or discrepancies within the design of the propulsion system (which are typically the result of incomplete or inaccurate requirements), or
(5) Omissions or errors in the system software or electronic hardware specification.
1-6. One of the objectives for the engine manufacturer in an engine certification program is to show that the certificated engine should be "installable" in a particular aircraft or aircraft type.
Subpart E of parts 23, 25, 27, and 29 provides requirements for the installation of a certificated engine into an aircraft. The installed engine becomes a part of the powerplant system. These regulations require that the powerplant system design meet all the requirements, procedures, limitations, and assumptions specified in the engine installation or operating instructions, the engine type certificate data sheet (TCDS), or the supplemental type certificate (STC).
1-7. Determining if an engine control system (ECS) complies with applicable aircraft certification regulations is done during aircraft certification. As part of the aircraft certification program, the FAA may also require flight-testing to fully evaluate engine performance and operability characteristics for all operating modes (refer to § 939 of 14 CFR parts 23, 25, 27, and 2
29). However, when the aircraft application is unknown at the time of engine certification, the engine manufacturer should make reasonable installation and operational assumptions for a target application. The engine manufacturer details any installation limitations or operational issues in the engine installation or operating instructions or both, or the TCDS.
1-8. When the applicant knows that aircraft components may contribute to or cause a failure condition that is evaluated in a part 33 safety analysis, the applicant should include the maximum allowable contribution from those aircraft components in both the safety analysis and the installation limitations and instructions. Accounting for these components ensures the engine will be installable.
1-9. Appendix 1 provides applicants with references to the installation or operating instructions or both as an aid in preparing complete installation and operating instructions. The installation or operating instructions or both should include descriptive, interface, and operating data in enough detail to support aircraft certification.
1-10. Limitations specified in the engine installation or operati ng manuals should be consistent with those stated on the TCDS, amended TCDS, or STC, as applicable. This information is intended to ensure that part 33 certification is not invalidated when the engine is installed on the aircraft. The applicant may also document these limitations in other manuals as long as they are referenced in the installation instructions or operating instructions or both. If the applicant uses reference documents, then the applicant must make them available to the FAA and any potential installer. We recommend that the engine and aircraft manufacturers coordinate implementation of limitations or operational issues or both with the appropriate FAA certification offices.
CHAPTER 2. SECTION 33.28(a) - APPLICABILITY.
2-1. Rule Text. Section 33.28(a) reads:
“(a) Applicability. These requirements are applicable to any system or device that is part of engine type design, that controls, limits, or monitors engine operation, and is necessary for the continued airworthiness of the engine.”
2-2. Guidance: Applicability.
a. Section 33.28 applies to all types of engine control systems, including any of the following ECS types:
(1) Hydromechanical (except for those systems on reciprocating engines that are adequately covered through § 33.35 and § 33.37),
(2) Hydromechanical with a limited authority electronic supervisor,
(3) Single-channel full-authority electronic engine control with hydromechanical backup,
(4) Dual-channel full-authority EEC without backup,
(5) Three-channel full authority EEC (or 2 channels plus a voter), or
(6) Any other ECS combination.
b. The ECS includes all equipment necessary for controlling the engine and ensuring safe operation of the engine within its limits, as specified in § 33.28. Many components, including electronic control units, variable-geometry actuators, cables, wires, sensors, overspeed, overtorque, and over-temperature protection systems, fuel racks, and fuel metering units, are part of the ECS. Some engine monitoring systems are physically or functionally integrated with the ECS. These systems are considered part of the ECS if they:
(1) Perform functions that affect engine safety,
(2) Are used in the context of continued-operation, or
(3) Are used in return-to-service decisions.
For example, low-cycle fatigue counters for engine critical parts, as well as some trend monitors and devices that provide information for maintenance are part of the ECS.
Some components, such as a throttle position transducer, might be mounted in the aircraft and are not part of the engine type design, but they are dedicated to the ECS and powered by it. Such elements are integral components of the ECS.
2-3. Excluded elements. Some elements are excluded from the ECS. For example, fuel pumps, even though often engine-mounted and integrated with the fuel metering unit, are not part of the ECS. They are part of the fuel delivery system. Demand-control pumps, however, are, or can be, a fuel controlling or limiting element of the system and are considered part of the ECS.
Any other engine overspeed design features that are purely mechanical, such as rotor interference, or fuel cutoff methods through rotor axial movement, are not part of the ECS. For example, overspeed protection via blade shedding is purely mechanical protection, so blade shedding is not part of the ECS.
CHAPTER 3. SECTION 33.28(b)(1) - VALIDATION.
3-1. Rule Text. Section 33.28(b)(1) reads:
“(b) Validation.—(1) Functional Aspects. The applicant must substantiate by tests, analysis, or a combination thereof, that the engine control system performs the intended functions in a manner which:
(i ) Enables selected values of relevant control parameters to be maintained and the engine kept within the approved operating limits over changing atmospheric conditions in the declared flight envelope;
(ii) Complies with the operability requirements of §§ 33.51, 33.65 and 33.73, as appropriate, under all likely system inputs and allowable engine power or thrust demands, unless it can be demonstrated that this is not required for non-dispatchable specific control modes in the intended application;
(iii) Allows modulation of engine power or thrust with adequate sensitivity over the declared range of engine operating conditions; and
(iv) Does not create unacceptable power or thrust oscillations.”
3-2. Guidance: Validation.
a. The EECS can only perform its intended function if its software is successfully integrated with the control. Accordingly, the applicant should conduct testing to demonstrate successful integration of the EEC system software and the ECS. The applicant should perform this testing either on a complete engine or on a test rig that simulates the ECS.
b. The applicant may use Aerospace Recommended Practice (ARP) 4754A, Guidelines/or Development of Civil Aircraft and Systems, as an acceptable method for establishing a development assurance process. SAE ARP 4754A discusses the development of aircraft and systems taking into account the overall aircraft operating environment and functions. This includes validation of requirements and verification of the design implementation for certification and process assurance. Refer to AC20-174 for further understanding of the applicability of the ARP.
c. The specific exclusion for non-dispatchable modes in § 33.28(b)(1)(ii) is to create the opportunity to maintain engine operation, even if limited, to support a “get home” configuration.
d. When evaluating adequate sensitivity in compliance with § 33.28(b)(1)(iii), the applicant should consider two additional aspects of power or thrust modulation. First, the power or thrust setting regions should be void of any inversions. Second, flats, or “no response” regions, in the power or thrust setting implementation, other than at the ends of range, are undesirable, except for positions that represent fixed power settings like maximum climb or cruise power. The applicant should also show that increasing the power lever settings in the 6
cockpit, results in the engine thrust or power output increases. The applicant should show that it has a continuous (no discontinuities) positive relationship (no inversions, such that increasing forward throttle movement results in decreasing thrust or power), unless it shows that in special applications, safety is enhanced by deviating from this relationship. Any deviation approved under Part 33 will also have to be approved at the aircraft installation (Part 23/25/27/29) level and therefore close coordination with the engine installer will be required to ensure the acceptability of any deviation granted.
e. For ECSs that have a governing mode for power turbine speed, § 33.28(b)(1)(iii) refers to the ability to manage engine power to maintain power turbine speed within specified limits.
f. Chapter 6 further discusses power and thrust oscillations.
CHAPTER 4. SECTION 33.28(b)(2) – ENVIRONMENTAL LIMITS.
4-1. Rule Text. Section 33.28(b)(2) reads:
“(2) Environmental limits. The applicant must demonstrate, when complying with §§ 33.53 or
33.91, that the engine control system functionality will not be adversely affected by declared environmental conditions, including electromagnetic interference (EMI), High Intensity Radiated Fields (HIRF), and lightning. The limits to which the system has been qualified must be documented in the engine installation instructions.”
4-2. Guidance: Environmental conditions include temperature, vibration, humidity, EMI, HIRF and lightning. The environmental condition requirements are addressed under §§ 33.53 and
33.91. Although we do not specify the test limits, the conditions the applicant declares should represent environments that engine installers and operators would encounter
a. Environmental test procedures and test limits. AC 21-16G and SAE ARP5757 provide further guidance on showing compliance with §§ 33.53, 33.91, and 33.28. This AC recommends SAE ARP5757 in combination with RTCA/DO-160G for testing, but you may use MIL-STD-810 when the tests are equal to, or more rigorous than, those defined in RTCA/DO 160G. As RTCA/DO-160 is very likely to be revised beyond revision G during the life of this AC, we encourage applicants to coordinate with the certification office before using a more recent revision of RTCA/DO-160. Unlike RTCA/DO-160G, however, we recommend performing a minimum of 10 temperature cycles for temperature variation tests. We also recommend applicants recognize that installers will use AC 20-136B and AC20-158 to show lightning and HIRF compliance, respectively, for the engine installation in the aircraft.
b. Radio frequency (RF) emission test procedures and test limits. The procedures and limits in MIL-STD-461 or RTCA/DO-160G Section 21 are acceptable.
c. HIRF and lightning tests. Aircraft HIRF compliance regulations are found in §§ 23.1308, 25.1317, 27.1317, and 29.1317. FAA guidance on HIRF compliance is found in AC
20-158. Aircraft lightning compliance regulations are found in §§ 23.1306, 25.1316, 27.1316, and 29.1316. FAA guidance on system lightning compliance is found in AC 20-136B.
(1) Test levels. Engine and aircraft applicants should select the HIRF and lightning test levels for the ECS. Applicants should select these test levels so that the EECS, when installed, meets aircraft certification regulations. If the applicant wants to claim any credit for HIRF and lightning testing, and if the applicant wants this claim shown on the TCDS or the IOI, the applicant must have successfully completed the ECS HIRF and lightning tests. The engine applicant should use the DO-160 section 20 and 22 categories and waveform sets defined in 4 2d(1)(c) of this AC if HIRF and lightning test levels have not been determined for a specific aircraft engine installation. Hardware or software design changes implemented after initial environmental testing should be evaluated for their effects with respect to electromagnetic compatibility (EMC), HIRF and lightning.
(a) Engine and aircraft manufacturers typically determine HIRF and lightning test levels through lightning transient and HIRF attenuation characterization tests. These tests are typically conducted on the aircraft with engines installed. If the HIRF and lightning test levels for the engine installation on a particular aircraft are not known at engine certification, the engine applicant may use the test levels in paragraphs 4-2d(1)(c) through 4-2d(1)(e) below. The aircraft applicant should confirm the compatibility of the engine test levels and the lightning transient characterization and HIRF attenuation tests with engines installed prior to aircraft certification. If these assumed test levels used for engine certification are not adequate for a particular aircraft installation, the engine applicant may need to conduct additional ECS HIRF and lightning tests or analysis.
(b) The engine installation or operating instructions should specify any wire shields, connectors, or terminations, and any electrical bonding, for HIRF and lightning protection that are required when the engine is installed. The applicant should perform the HIRF and lightning tests with the same shielding and electrical bonding configuration specified in the engine installation or operating instructions.
(c) HIRF minimum levels. The following table identifies the minimum system laboratory HIRF RF susceptibility test standards for EECS:
RTCA/DO-160G Categories Conducted Radiated
CW & SW Modulation Radiated Pulse Modulation Fixed-Wing Airplanes with Turbine Engines Cat W (150 mA) Cat W (100 V/m) Cat D (up to 750 V/m) Rotorcraft (all engine types) Cat W (150 mA) Cat Y (200 V/m) Cat F (up to 1500 V/m) Reciprocating Engine Intended for use with Propellers (Note 1) Cat W (150 mA) Cat W (100 V/m) Cat D (up to 750 V/m) Fuselage-Mounted Turbofan Engine Intended for use on Part23 Airplanes (Note 2) Cat Y (300 mA) 100 MHz to 400 MHz – Cat G (100 V/m) 400MHz to 18GHz – Cat F (up to 150V/m) Cat F (up to 1500 V/m) Note 1: Using these HIRF test levels and the design requirements in paragraph (e) below, reciprocating engines with EECSs intended for use on propeller-driven Part 23 airplanes should be acceptable without further airplane HIRF testing.
Note 2: Using these HIRF test levels and the design requirements in paragraph (e) below, turbofan engines with EECSs intended to be fuselage-mounted on part 23 airplanes should be acceptable without further HIRF testing.