(d) Lightning levels. The applicant should test the EECS using the minimum levels for system laboratory lightning tests specified in RTCA/DO-160G Section 22 Level 3 for cable bundle injection tests and pin injection tests. The waveform set that includes single-stroke, multiple-stroke, and multiple-burst waveforms for shielded wire bundles should be Category A3J3L3 in RTCA/DO-160G Section 22. The applicant should not use series impedance during the pin injection tests (RTCA/DO-160G Section 22.5.1.h) unless the remote load impedance is in a component included as part of the engine or the remote load impedance is specified in the engine installation instructions.
(e) Alternate lightning levels for reciprocating engines with EECS and intended for use with propellers, or fuselage-mounted turbofan engine intended for use on Part 23 airplanes.
Electronic engine control systems for these types of engine installations are normally subject to very high lightning transients when lightning attaches to the propeller or engine inlet. Using the lightning design and test requirements below, reciprocating engines with EECS intended for use on small propeller-driven airplanes or fuselage-mounted turbofan engines intended for use on Part 23 airplanes, should be acceptable for airplane installation without further airplane lightning tests. The reciprocating engine minimum system lightning test levels should be RTCA/DO 160G, Section 22 and Category A3H3L3 for unshielded wire bundles. Lightning commonly strikes the propeller on airplanes with propellers. This results in all lightning current directly conducted on the engine, and a large portion of the current on ECS wiring. Lightning strikes to turbofan engines result in current conducted on the engine cowls and fairings, so typically a smaller portion of the lightning current is conducted on the ECS wiring. The fuselage-mounted turbofan engine minimum system lightning test levels should be RTCA/DO-160G Section 22 and Category B3H3L3 for unshielded wire bundles. These waveform sets includes single-stroke, multiple-stroke, and multiple-burst waveforms in RTCA/DO-160G Section 22. Engine applicants should ensure that the ECS tests, design, and the engine installation or operating instructions required by § 33.28 and § 33.5 meet the following requirements:
1 Lightning test setup. Use the test setup found in RTCA/DO-160G section
22.3. Perform the cable bundle injection test with the all EECS wire bundle shields disconnected.
This will ensure that the transients are injected directly onto the wires. Do not use series impedance during the pin injection tests (RTCA/DO-160G Section 22.5.1.h), unless the remote load impedance is in a component included as part of the certified engine or the remote load impedance is specified in the engine installation instructions.
2 Wire bundle shields. Install overbraid shields on all wire bundles between EECS components and from EECS components to the airplane. The shields should cover power and signal wires and their returns, and have low resistance and high-optical coverage. An overbraid shield may enclose an entire wire bundle, or multiple overbraid shields may be used over groups of wires within a bundle. For fuselage-mounted turbofan engines, install additional overbraid shields on each wire bundle where the bundle is routed outside the airplane fuselage to the engine. Each shield must be terminated to each connector. Shield terminations must be very short, preferably using backshells with zero length shield terminations. The connector shells and backshells must provide a very low resistance to the engine components, EECS, and airplane firewall or structure. Features required for electrically bonding the connectors to the airplane 10
firewall or structure, such as surface preparation, must be specified in the engine installation or operating instructions.
3 Engine bonding jumpers. Include at least three electrical bonding jumpers between the engine and the engine mounting frame. The bonding jumpers must be flat braided wire or flat solid conductors, with at least 16 mm2 conducting cross section, and less than 30 cm long. Specify the maximum bonding jumper length and minimum conducting cross section in the engine installation manual. Define the maximum allowed resistance between the engine, engine mounting frame, and airframe in the engine installation or operating instructions. Provide a lowresistance conducting path from the engine to the airframe.
4 Electronic engine control systems electrical bonding. Specify the maximum allowed electrical bonding resistance between EECS components and the surface they are mounted on in the engine installation or operating instructions. For example, specify the maximum allowed resistance between the component and the airframe or firewall to which it is attached. Also, include any special features required for this electrical bonding in the engine installation or operating instructions, such as surface preparation and or bonding jumpers.
5 Power and signal returns. You should not use the engine or engine mounting frame for power returns or low-power signal returns.
(2) Test procedures. The EECS used for the lightning and HIRF tests should include sensors, actuators, and engine and engine-aircraft interface wire bundles. Use the HIRF and lightning test procedures provided in RTCA/DO-160G/EUROCAE ED-14G Sections 20 and 22.
However, the test procedures defined in RTCA/DO-160G/EUROCAE ED-14G Sections 20 and 22 are oriented to equipment tests. Therefore, adapt those test procedures to develop the system level HIRF test, the test the applicant will use to show compliance with §§ 33.53 and 33.91.
(a) Additional guidance on system level HIRF tests may be found in SAE ARP5583A.
(b) SAE ARP5415A and ARP5416A provide guidance on system level lightning tests.
(3) Open loop and closed loop testing. Conduct HIRF and lightning tests on the ECS operating in closed loop or open loop control. The closed loop set-up is usually powered to move actuators to close the inner actuating loops. The applicant may use a simplified engine simulation to close the outer engine loop. The applicant should conduct the HIRF and lightning tests with the ECS controlling at the most sensitive operating point, as selected and detailed in the applicant’s test plans. The reference to ‘the most sensitive operating point’ is in relationship to schedule sensitivity. We are suggesting that the set point not be where controlling schedules are on flat portions of the schedules. The system should be exposed to the HIRF and lightning environments while operating at the selected condition. HIRF and lightning environments may have different most sensitive operating points.
(4) Test considerations.
(a) If special ECS test software is embedded in the target for EMC, HIRF or 11
lightning testing, the applicant must ensure that the software was developed and implemented by guidelines defined for software levels of at least Level 2 in DO-178A, Level C in DO-178B, Level C in DO-178C, or equivalent. In some cases, the applicants modify the application code to include the required test code features.
(b) The test must be capable of monitoring both the output drive signals and the input signals.
(c) The applicant must duplicate all anomalies observed on inputs or outputs during open loop testing to enable the test to show compliance with the following pass/fail criteria. The applicant must perform this duplication on the engine simulation to determine whether the resulting power or thrust perturbations comply with the §§ 33.53 and 33.91 test pass/fail criteria.
(5) Pass/fail criteria. To comply with §§ 33.53 and 33.91, the HIRF and lightning tests must cause no adverse effects on the functionality of the ECS. The following are adverse effects:
(a) For turbine engines: a change greater than 3% of most sensitive operating point or 1% of take-off power or thrust, whichever is greater, for a period of more than 2 seconds.
(b) For reciprocating engines: a change greater than 10% of power at the operating point for a period of more than 2 seconds.
(c) Transfers to alternate channels, backup systems, or alternate modes.
(d) Component damage. Certain protection components, such as transient suppression diodes, may experience failures that are not detected by post-test automatic test plan (ATP), and must be checked with specific test procedures.
(e) False annunciation to the crew that could cause unnecessary or inappropriate crew action.
(f) Erroneous operation of protection systems, such as over-speed or thrust reverser circuits.
(6) Engine applicants should ensure that the ECS design and the engine installation or operating instructions required by § 33.28 and § 33.5, specify the following protection features:
(a) The engine and EECS are installed in an airplane with engine cowls and a firewall that incorporate electrically conducting materials. The conducting materials may be aluminum, copper, steel or carbon fiber composites, and may include thin metal foil or mesh incorporated into nonconducting composites. The EECS should be installed either under the conducting cowl or on an airframe that uses structure with similar conducting materials.
(b) Required wire shielding and connectors for wire bundles that connect the EECS to airplane systems are specified in the engine installation or operating instructions. The required wire shielding and connectors should be used during the HIRF tests.
(c) Electrical bonding requirements for the engine and EECS are specified in the engine installation or operating instructions.
e. Maintenance actions.
(1) Section 33.4 requires that the applicant prepare Instructions for Continued Airworthiness (ICA). Instructions for Continuing Airworthiness generally include a maintenance plan. The applicant should provide a maintenance plan for any protection system that is part of the type design of the ECS, and that is required to meet the qualified levels of EMC, HIRF and lightning. The plan is used to ensure the continued airworthiness for the parts of the installed system supplied by the engine type certificate holder. AC 33.4-3 provides information related to the ICA, aircraft engine HIRF, and lightning protection.
(2) Consider including periodic inspections or tests for required structural shielding, wire shields, connectors, and equipment protection components, in the ICAs. Also consider inspections or tests when the part is exposed. The applicant should also show that the maintenance actions introduced by its plan are effective in maintaining the engine’s continued airworthiness.
f. Time-limited dispatch environmental tests. Time-Limited Dispatch (TLD) is an optional requirement. If the applicant conducts EMC, HIRF and lightning tests for TLD, we recommend that the testing be done with other tests at certification. Refer to paragraph 7.c. of the Policy Memorandum, PS-ANE100-2001-1993-33.28TLD-R1, for the TLD requirements related to environmental compliance.
CHAPTER 5 - SECTION 33.28(c) – CONTROL TRANSITIONS.
5-1. Rule Text. Section 33.28(c) reads:
“c. Control Transitions. (1) The applicant must demonstrate that, when fault or failure results in a change from one control mode to another, from one channel to another, or from the primary system to the backup system, the change occurs so that:
(i) The engine does not exceed any of its operating limitations,
(ii) The engine does not surge, stall, or experience unacceptable thrust or power changes or oscillations or other unacceptable characteristics; and
(iii) There is a means to alert the flight crew if the crew is required to initiate, respond to, or be aware of the control mode change. The means to alert the crew must be described in the engine installation instructions, and the crew action must be described in the engine operating instructions;
(2) The magnitude of any change in thrust or power and the associated transition time must be identified and described in the engine installation instructions and the engine operating instructions.”
5-2. Guidance: Control Transitions.
a. General.
(1) In the showing of compliance to § 33.28(c)(1), the applicant should perform all necessary testing and analysis to ensure that all control modes, including those that occur as a result of control fault accommodation strategies, are implemented as required.
(2) The applicant should show that all declared dispatchable control modes are capable of performing their intended functions in the environmental conditions, including but not limited to EMI, HIRF and lightning, declared in the engine installation instructions.
(3) The need to provide protective functions, such as over-speed protection, for all control modes, including any alternate modes, must be reviewed under the requirements of § 33.28(d), (e), and (f) and § 33.75.
(4) The above applies to the ECS operating in any dispatchable configuration.
(5) The applicant must show that any limitations on operations in alternate modes are clearly stated in the engine installation and operating instructions.
(6) The applicant should provide in the engine installation and operating instructions a description of the ECS operating in its primary and alternate modes.
(7) The applicant should use analyses, or testing, or both, to show that changing to, and operating in, alternate modes has no unacceptable effect on engine durability or endurance. This should not be interpreted as the need to run multiple §33.87 endurance tests. Short segments of testing in combination with analysis may be sufficient for showing of compliance.
(8) The applicant should demonstrate the durability and reliability of the control system in all modes, primarily through the engine system and component testing of §§ 33.53 and
33.91. Performing some portion of the engine certification testing in the alternate mode(s) and during transition between modes can be used as part of the system validation required under § 33.28(b)(1).
(9) Engine test considerations.
(a) The engine certification tests defined in part 33, Subparts D and F, are often performed using only the ECS’s primary mode. If the applicant requests approval for dispatch in an alternate mode under TLD, then the applicant must demonstrate that the engine can meet the defined test-success criteria in any alternate mode that is proposed as a dispatchable configuration. If a configuration is to be dispatchable, then that mode should be demonstrated to operate in all foreseeable environmental conditions. This demonstration may use analysis or test and should include capabilities such as operability in rain or hail or bird ingestion.
(b) Some capabilities, such as operability in rain or hail or bird ingestion, may be lost in some control modes that are not dispatchable. Modes that are not dispatchable do not require engine test demonstration as long as the engine installation and operating instructions reflect this loss of capability.
(10) Availability. Applicants should demonstrate through testing or monitoring, that any backup mode will be available when needed. The applicant should document in the ICA the minimum frequency of inspection or testing needed to ensure its availability.
b. Crew training modes. As part of the System Safety Assessment of 33.28(e), applicants should assess crew training modes. These modes are usually installation, and possibly operator specific and need to be negotiated on a case-by-case basis. For example, one common application of crew training modes is simulation of the ‘fail-fixed’ mode on a twin-engine rotorcraft. The applicant must describe training modes in the engine installation and operating instructions as appropriate. Also, the applicant must take precautions in the design of the ECS and its crew interfaces to prevent inadvertent entry into any training modes. The applicant must assess crew-training modes, including lockout systems.
c. Non-dispatchable configurations and modes.
(1) For control configurations that are not dispatchable, but for which the applicant seeks to take credit in the system LOTC/LOPC analysis (this analysis and the LOTC/LOPC concept are covered in full in Chapter 6 below), specific operating limitations may be acceptable.
This means that the system will not be charged with an LOTC/LOPC event when the fault is covered by a backup means that allows the system to continue to function safely. The system, 15
however, would not be dispatchable in this configuration. Compliance with § 33.28(b)(1) in non dispatchable configurations does not imply strict compliance with the operability requirements of § 33.65 and § 33.89, if applicants demonstrate that in the intended installation no likely pilot control system inputs will result in engine surge, stall, flameout, or unmanageable delay in power recovery or engine controllability issues. For example, in a twin-engine rotorcraft, a rudimentary backup system may be adequate since frequent and rapid changes in power setting when operating in the backup system may not be necessary. In this example, it is very unlikely that dispatch would be allowed with the engine controlled by this rudimentary backup system.
(2) In addition to these operability considerations, the applicant should consider the following factors in assessing the acceptability of a reduced-capability backup mode:
(a) The installed operating characteristics of the backup mode and the differences from the primary mode.
(b) The likely impact of the backup mode operations on pilot workload, if the aircraft installation is known.
(c) The frequency of transfer from the primary mode to the backup mode (i.e. the reliability of the primary mode). Frequencies of transfer of less than 1 per 20,000 engine flight hours are acceptable.
d. Control transitions.
(1) Section 33.28(c) requires that any control transitions that occur as a result of fault accommodation occur in an acceptable manner.
(2) In general, the ECS should transition to alternate modes automatically. However, systems in which pilot action is required to engage the backup mode are also acceptable. For instance, a fault in the primary system may result in a “fail-fixed” fuel flow that requires some action by the pilot to engage the backup system to modulate engine power. When pilot action is required, applicants should ensure that any reliance on a pilot executing a manual transition does not pose an unacceptable operating characteristic, unacceptable crew workload, or require exceptional skill.
(3) The applicant must review the transient change in power or thrust associated with transfer to alternate modes for compliance with § 33.28(c). If available, consider input from the installer.
(4) Applicants should consider at the minimum, the following items when reviewing control mode transitions:
(a) The frequency of occurrence of transfers to any alternate mode and the capability of the alternate mode. Applicants should support computed frequency-of-transfer rates with data from endurance or reliability testing, in-service experience on similar equipment, or other appropriate data.
(b) The magnitude of the power, thrust, rotor or propeller speed transients may affect the dynamics of the aircraft. Therefore these transients should be carefully assessed to assure acceptability for installation. The applicant should coordinate these characteristics with the intended installer.
(c) Successful demonstration, by simulation or other means, that the ECS controls the engine during the transition. In some cases, particularly those involving rotorcraft, applicants may be unable, analytically or through simulation, to show that the ECS can control the engine during mode transition. Therefore, applicants should propose a flight test program to demonstrate that the ECS controls the engine acceptably during in-flight control mode transitions.
(d) An analysis to identify those faults that cause either automatic or pilot initiated control mode transitions.
(e) For turboprop or turboshaft engines, the control mode transition should not result in excessive over-speed or under-speed of the rotor or propeller. These speed transitions could cause emergency shutdown, loss of electrical generator power, or setting off warning devices.
(f) Including in the engine installation instructions, a declaration of the power or thrust change associated with a transition. If the change is negligible, declare it as such.
(5) Time delays. Applicants should include in the engine installation and operating instructions a description of any observable time delays associated with control mode, channel or system transitions, or in re-establishing the pilot’s ability to modulate engine thrust or power.
The acceptability of these delays may need to be assessed during aircraft certification.
(6) Annunciation to the flight crew.
(a) If annunciation is necessary to comply with § 33.28(c)(1)(iii), the type of annunciation to the flight crew must be commensurate with the nature of the transition. For example, the form of annunciation for a reversion to an alternate mode of control when the transition is automatic and the only observable changes in engine operation are different thrust control schedules would be very different than if timely action by the pilot is required to maintain control of the aircraft.
(b) The intent and purpose of the cockpit annunciation must be clearly stated in the engine installation and operating instructions, as appropriate.
CHAPTER 6. SECTION 33.28(d) – ENGINE CONTROL SYSTEM FAILURES.
6-1. Rule Text. Section 33.28(d) reads:
“d. Engine control system failures. The applicant must design and construct the engine control system so that:
(1) The rate for Loss of Thrust (or Power) Control (LOTC/LOPC) events, consistent with the safety objective associated with the intended application can be achieved;
(2) In the full-up configuration, the system is single fault tolerant, as determined by the Administrator, for electrical or electronic failures with respect to LOTC/LOPC events;
(3) Single failures of engine control system components shall not result in a hazardous engine effect; and
(4) Foreseeable failures or malfunctions leading to local events in the intended aircraft installation such as fire, overheat, or failures leading to damage to engine control system components do not result in a hazardous engine effect due to engine control system failures or malfunctions.”
6-2 Guidance: Engine Control System Failures .
a. Objective. Section 33.28(d) establishes ECS integrity requirements that are consistent with the operational requirements of the various installations. The introduction of EECSs should provide at least an equivalent level of safety and reliability for the engine as achieved by engines equipped with hydro-mechanical control and protection systems and magneto systems (refer to SAE ARP5107B and FAA Policy Memorandums on TLD in paragraph 3.b.). In chapters 9 and 15 of this AC, the concept of development errors being introduced within the software, or AEH designs ,or both, and the development assurance processes are addressed. This chapter and chapter 7 discuss the development error concept at the system level for an ECS.
b. Criteria for an LOTC/LOPC event. Industry practice over the past 30 years has resulted in the following generally accepted criteria for defining an LOTC/LOPC event. The applicant may propose another set of criteria if it defines an LOTC/LOPC event.
(1) For turbine engines not intended for rotorcraft, we consider an LOTC/LOPC event occurs when the ECS:
(a) Has lost the capability to modulate thrust or power between idle and 90% of maximum rated power or thrust,
(b) Suffers a fault that results in a thrust or power oscillation greater than the levels given in Paragraph 6-2c of this AC, or 18
(c) Has lost the capability to govern the engine in a manner that allows compliance with the operability regulations given in §§ 33.65 and 33.89.
(2) For turbine engines intended for helicopters, an LOTC/LOPC event occurs when the ECS:
(a) Has lost the capability to modulate power between idle and 90% of maximum rated power at flight condition and, if appropriate, at rotorcraft operating condition, or
(b) Suffers a fault that results in a power oscillation greater than the levels given in Paragraph 6-2 c of this AC, or
(c) Has lost the capability to govern the engine in a manner that allows compliance with the operability regulations given in §§ 33.65 and 33.89. The inability, however, to meet the operability regulations in the alternate modes may not need to be included as LOPC events.
1 Single-engine rotorcraft will normally be required to meet the operability regulations in the alternate modes. Engine operability in alternate modes is a necessity if the control transitions to the alternate mode occur more frequently than the acceptable LOPC rate, or normal flight crew activity requires rapid changes in power to safely fly the aircraft.
2 The LOPC definition typically includes the ability to meet the operability regulations in the alternate mode(s). For multiengine rotorcraft, it may be acceptable if one engine control transitions to an alternate mode that may not have robust operability. That engine can be left at reasonably fixed power condition so that the engines with normally operating controls can change power as necessary to complete aircraft maneuvers and safely land the aircraft. Where this potential exists, i.e., differing operability levels, applicants may be required to demonstrate the ECS continues to meet regulatory standards under all conditions at aircraft certification.
(3) For reciprocating engines intended for part 23 Class I., II., and III. Aircraft, an LOPC event occurs when the ECS:
(a) Has lost the capability to modulate power between idle and 85% of maximum rated power at all operating conditions, or
(b) Suffers a fault that results in a power oscillation greater than the levels given in Paragraph 6-2 c. of this AC, or
(c) Has lost the capability to govern the engine in a manner that allows compliance with the operability regulations in § 33.51.
(4) For engines incorporating functions for propeller control integrated in the EECS, the applicant should consider the following faults or failures, either individually or in combination with another, as LOPC events:
(a) Inability to command a change in pitch,
(b) Uncommanded change in pitch,
(c) Uncontrollable propeller torque or speed fluctuation.
c. Uncommanded thrust or power oscillations. Any uncommanded thrust or power oscillations should not be of such a magnitude as to affect aircraft controllability. For example, thrust or power oscillations less than 10% peak-to-peak of take-off power, or thrust, or both, are acceptable where oscillation affects one engine only, unless the installer defines more or less restrictive requirements. Regardless of the levels discussed here, if the flight crew has to shut down an engine because of unacceptable thrust or power oscillations caused by the control system, we would deem such an event as an in-service LOTC/LOPC event.
d. Acceptable LOTC/LOPC rate. The applicant may propose an LOTC/LOPC rate other than those below. The applicant should substantiate such a proposal in relation to the criticality of the engine and control system relative to the intended installation. The intent is to show equivalence of the LOTC/LOPC rate to existing systems in comparable installations. Refer to SAE ARP5107B and FAA Policy Memorandum, PS-ANE100-2001-1993-33.28TLD-R1 for additional information.
(1) For turbine engines, the EECS should not cause more than one LOTC/LOPC event per 100,000 engine flight hours.
(2) For reciprocating engines intended for part 23 Class I., II., and III. aircraft, an LOPC rate of 45 per million engine flight hours (or 1 per 22,222 engine flight hours) represents the upper limit of an acceptable level for the most complex EECS. As a result of the architectures used in many of the EECS for these engines, the functions are implemented as independent system elements. These system elements or subsystems can be fuel control, ignition control, or others. For systems with only one element, such as a fuel control, we recommend applicants use a maximum system LOPC rate of 15 LOPC events per million engine flight hours (PMEFH). For systems that contain more than one element, we recommend applicants use a LOPC rate of 15 events PMEFH for each, but only up to 45 events PMEFH. So, if two elements are present, for example a fuel control and an ignition control, the appropriate rate is 30 events PMEFH. If three or more, then the LOPC rate would be 45 events PMEFH.
e. LOTC/LOPC analysis.
(1) Since the LOTC/LOPC analysis is part of the required System Safety Assessment of §33.28(e), applicants must perform and submit an LOTC/LOPC analysis for the ECS. An ECS LOTC/LOPC analysis may take the form of a system reliability analysis (refer to SAE ARP5107B). We recommend a numerical analysis such as a Markov model analysis, fault tree analysis, or equivalent analytical approach.
(2) The LOTC/LOPC analysis should address all components in the system that can contribute to LOTC/LOPC events. This includes all electrical (including wiring), mechanical, hydromechanical, and pneumatic elements of the ECS.
(3) The engine fuel pump is usually considered part of the fuel delivery system and, therefore, not included in an LOTC/LOPC analysis.
(4) An LOTC/LOPC analysis should include those sensors or elements that may not be part of the engine type design, but that may contribute to LOTC/LOPC events. An example is the throttle or power lever transducer, which is usually supplied by the installer. The LOTC/LOPC analysis should include the effects of loss, corruption, or failure of aircraft-supplied data. The engine installation instructions should include the assumed reliability and interface requirements for these nonengine type design elements. Within the aircraft system safety analyses, we recommend that installers ensure no double counting of the rate of failure of nonengine parts occurs.
(5) The LOTC/LOPC analysis should also consider all faults, both detected and undetected. The applicant should include any periodic maintenance actions needed to find and repair both covered and uncovered faults to meet the LOTC/LOPC rate in the engine instructions for continued airworthiness.
(6) See chapter 7 of this AC for additional guidance on how to perform the System Safety Assessment required under § 33.28(e).
f. Reliability assessment plan (RAP). We recommend the applicant prepare, and be ready to show us, a RAP (refer to SAE ARP5890A for a framework). A RAP documents the applicant’s controlled, repeatable processes for assessing the reliability of systems and equipment. It also helps assess the reliability of systems and equipment during design and operational life. The results of the RAP are important inputs to many safety assessment and analysis tasks. The results of a RAP can be used as a part of:
(1) Reliability program planning and monitoring,
(2) Safety assessments and analyses,
(3) Certification analyses,
(4) Equipment design decisions,
(5) System architecture selection, and
(6) Continued airworthiness assessments.