(a) Inability to command a change in pitch,
(b) Uncommanded change in pitch,
(c) Uncontrollable propeller torque or speed fluctuation.
c. Uncommanded thrust or power oscillations. Any uncommanded thrust or power oscillations should not be of such a magnitude as to affect aircraft controllability. For example, thrust or power oscillations less than 10% peak-to-peak of take-off power, or thrust, or both, are acceptable where oscillation affects one engine only, unless the installer defines more or less restrictive requirements. Regardless of the levels discussed here, if the flight crew has to shut down an engine because of unacceptable thrust or power oscillations caused by the control system, we would deem such an event as an in-service LOTC/LOPC event.
d. Acceptable LOTC/LOPC rate. The applicant may propose an LOTC/LOPC rate other than those below. The applicant should substantiate such a proposal in relation to the criticality of the engine and control system relative to the intended installation. The intent is to show equivalence of the LOTC/LOPC rate to existing systems in comparable installations. Refer to SAE ARP5107B and FAA Policy Memorandum, PS-ANE100-2001-1993-33.28TLD-R1 for additional information.
(1) For turbine engines, the EECS should not cause more than one LOTC/LOPC event per 100,000 engine flight hours.
(2) For reciprocating engines intended for part 23 Class I., II., and III. aircraft, an LOPC rate of 45 per million engine flight hours (or 1 per 22,222 engine flight hours) represents the upper limit of an acceptable level for the most complex EECS. As a result of the architectures used in many of the EECS for these engines, the functions are implemented as independent system elements. These system elements or subsystems can be fuel control, ignition control, or others. For systems with only one element, such as a fuel control, we recommend applicants use a maximum system LOPC rate of 15 LOPC events per million engine flight hours (PMEFH). For systems that contain more than one element, we recommend applicants use a LOPC rate of 15 events PMEFH for each, but only up to 45 events PMEFH. So, if two elements are present, for example a fuel control and an ignition control, the appropriate rate is 30 events PMEFH. If three or more, then the LOPC rate would be 45 events PMEFH.
e. LOTC/LOPC analysis.
(1) Since the LOTC/LOPC analysis is part of the required System Safety Assessment of §33.28(e), applicants must perform and submit an LOTC/LOPC analysis for the ECS. An ECS LOTC/LOPC analysis may take the form of a system reliability analysis (refer to SAE ARP5107B). We recommend a numerical analysis such as a Markov model analysis, fault tree analysis, or equivalent analytical approach.
(2) The LOTC/LOPC analysis should address all components in the system that can contribute to LOTC/LOPC events. This includes all electrical (including wiring), mechanical, hydromechanical, and pneumatic elements of the ECS.
(3) The engine fuel pump is usually considered part of the fuel delivery system and, therefore, not included in an LOTC/LOPC analysis.
(4) An LOTC/LOPC analysis should include those sensors or elements that may not be part of the engine type design, but that may contribute to LOTC/LOPC events. An example is the throttle or power lever transducer, which is usually supplied by the installer. The LOTC/LOPC analysis should include the effects of loss, corruption, or failure of aircraft-supplied data. The engine installation instructions should include the assumed reliability and interface requirements for these nonengine type design elements. Within the aircraft system safety analyses, we recommend that installers ensure no double counting of the rate of failure of nonengine parts occurs.
(5) The LOTC/LOPC analysis should also consider all faults, both detected and undetected. The applicant should include any periodic maintenance actions needed to find and repair both covered and uncovered faults to meet the LOTC/LOPC rate in the engine instructions for continued airworthiness.
(6) See chapter 7 of this AC for additional guidance on how to perform the System Safety Assessment required under § 33.28(e).
f. Reliability assessment plan (RAP). We recommend the applicant prepare, and be ready to show us, a RAP (refer to SAE ARP5890A for a framework). A RAP documents the applicant’s controlled, repeatable processes for assessing the reliability of systems and equipment. It also helps assess the reliability of systems and equipment during design and operational life. The results of the RAP are important inputs to many safety assessment and analysis tasks. The results of a RAP can be used as a part of:
(1) Reliability program planning and monitoring,
(2) Safety assessments and analyses,
(3) Certification analyses,
(4) Equipment design decisions,
(5) System architecture selection, and
(6) Continued airworthiness assessments.
g. Commercial or industrial grade electronic parts.
(1) The grade and handling of electronic parts is an important contributor to the reliability of the EEC. Two examples of industry documents that provide guidance on the application of commercial or industrial grade components are:
(a) IEC/TS 62239-1, Process Management for Avionics – Preparation of an Electronic Components Management Plan, and
(b) IEC/TR 62240-1, Process Management for Avionics – Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges.
(2) The applicant should prepare, and be ready to show us, their Electronic Component Management Plan (ECMP).
(3) When applicants specify as part of the engine type design commercial or industrialgrade electronic components, which are not manufactured to military standards, we recommend considering data similar to the following, as applicable:
(a) Reliability data for each commercial and industrial grade electrical component specified in the design.
(b) The applicant’s procurement, quality assurance, and process control plans for the vendor-supplied commercial and industrial grade parts. These plans should ensure that the parts will be able to maintain the reliability level specified in the approved engine type design.
(c) Unique databases, for similar components, obtained from different vendors because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard.
(4) Temperature ranges for commercial or industrial grade parts are typically a narrower range than those for military grade parts.
(a) If the applicant’s declared temperature environment for the ECS will result in the detail parts exceeding the stated capability of the commercial or industrial grade electronic components, the applicant should ensure through test and analysis, that the proposed range of the specified components is suitable for the intended ECS environment. The applicant should also show that the failure rates used for those components in the System Safety Asssessment (SSA) and LOTC/LOPC analyses are appropriately adjusted for the extended temperature environment.
(b) Sometimes commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required in the design of the EECS. The applicant should specify these provisions in the engine installation instructions, if action by the installer is required to provide cooling. This provision ensures that the cooling is not compromised. The cooling provisions included in the EECS design may have failure modes. If 22
the failure modes could result in exceeding temperature limits, then applicants should account for the probability of these failures in their SSA and LOTC/LOPC analyses.
(5) When any electrical or electronic components are changed, the applicant should review their SSA and LOTC/LOPC analyses with regard to the impact of any changes in component reliability. Component, subassembly or assembly level testing may be needed to evaluate a change that introduces commercial or industrial part(s). However, such a change would not be classified as “significant” with respect to § 21.101(b)(1).
h. Single fault accommodation.
(1) The following guidance clarifies the meaning of “single fault tolerant.”
(a) The applicant may show compliance with the single fault regulations of § 33.28(d)(2) and (3) by test and analysis. According to § 33.28(d), single failures or malfunctions in the ECS’s components, in its fully operational condition and all declared dispatchable configurations, must not result in a hazardous engine effect (refer to § 33.75(g)(2) for a definition of “hazardous engine effects”). In addition, § 33.28(d) requires that in its full-up configuration, the control system must be essentially single fault tolerant of electrical/electronic component failures with respect to LOTC/LOPC events.
(b) We recognize that achieving true single fault tolerance could require a triplicated design approach or one with 100% fault detection. Currently, systems have been designed with dual, redundant channels, or with backup systems that provide what has been called an “essentially single fault tolerant” system. Although these systems may have some single faults (that are not covered faults) that lead to LOTC/LOPC events, they have demonstrated excellent in-service safety and reliability and have proven to be acceptable.
Therefore, configurations such as these may be found to be compliant.
(2) Dual-channel or backup system configurations cover the vast majority of potential electrical and electronic faults. However, omitting some coverage because detection or accommodation of some electrical or electronic faults may not be practical, may be acceptable.
Single, simple electrical or electronic components or circuits can be employed in a reliable manner. In those cases, requiring redundancy may be unnecessary. In those cases, failures in certain single-electrical or electronic components, elements, or circuits may result in an LOTC/LOPC event. These systems, which are referred to as “essentially single fault tolerant,” are acceptable.
(3) Single failures that result in a high thrust failure condition, with no throttle response, may be catastrophic for some aircraft operating conditions. As a cautionary note, engine certification applicants should be aware that in this case, either a modification of the engine control or an independent aircraft system will be needed for aircraft certification.
i. Local events.
(1) Under § 33.28(d)(4), foreseeable failures or malfunctions leading to local events, such as engine or installation-related failures that could lead to damage to control system electrical harnesses or connectors or to the control units, must not result in a hazardous engine event. We recommend that applicants analyze local events to ensure a hazardous engine event will not occur. These events include:
(a) Overheat conditions, for example, those resulting from hot air duct bursts,
(b) Fires,
(c) Maintenance and foreseeable maintenance errors such as using a wire bundle as a hand hold,
(d) Fluid leaks, and
(e) Mechanical disruptions that could lead to damage to control system electrical harnesses, connectors, or control unit(s).
(2) These local events are normally limited to one engine. A local event is not usually considered a common mode event, and common mode threats, such as HIRF, lightning and rain, are not considered local events. Examples of a single, common mode fault in systems are single source batteries in multiengine applications and the use of identical software in multiengine, dual-channel systems. In these and similar cases, the applicant should take extra design, testing or maintenance precautions to ensure safety.
(3) Although they are limited to one engine, local events affecting the ECS should not generate hazards to the aircraft. Local events, in particular fire and overheat, are dependent on installations and may also be addressed as a part of aircraft certification. Coordination with the installer is highly advised.
(4) Invalid assumptions of independence between failures, as well as failure to recognize common cause failure modes, are leading reasons for invalid conclusions within safety analyses. In the assessment of local events, emphasis should be placed on identifying and ensuring critical functional or physical isolation is maintained. The applicant should ensure no common cause event is present that would violate any assumptions of independence between failures. For example, fuel control components whose failure could result in overspeed are not affected by the same events that could cause loss of overspeed protection.
(5) Whatever the local event, the behavior of the EECS must not cause a hazardous engine effect in any declared dispatchable mode.
(6) When demonstrating that no hazardous engine effect exists based on the assumption that another function exists to provide the necessary protection, the applicant should show that the other function is not rendered inoperative by the same event (including destruction of wires, ducts, or power supplies).
(7) An overheat condition exists when the temperature of the system components is greater than the maximum safe design operating temperature declared by the engine applicant in the engine installation instructions. The ECS must not cause a hazardous engine effect when the components or units of the system are exposed to an overheat or over-temperature condition, or when it cools down. Applicants may use specific design features or analysis methods to show prevention of hazardous engine effects. We may require testing when this is not possible. For example, due to the variability or the complexity of the failure sequence. Refer to SAE ARP5757 for an example of this type of testing.
(8) The ECS, including the electrical, electronic, and mechanical parts of the system, must comply with the fire regulations of § 33.17. This rule applies to the elements of the ECS that are installed in designated fire zones. Refer to SAE ARP5757 and AC 33.17-1 for additional guidance.
(9) If an ECS component is located so that it could present an ignition source for flammable fluids or vapors, the applicant should conduct an explosion proof demonstration to verify that the component cannot be the source of ignition for an explosion. Refer to SAE ARP5757 for this type of demonstration.
(10) Applicants should consider all foreseeable local events when complying with § 33.28(d)(4). We recognize, however, that it is difficult to address all possible local events in the intended aircraft installation at the time of engine certification. Therefore, the applicant should use sound engineering judgment to identify reasonably foreseeable local events.
Compliance with this regulation may be shown by considering the end result of the local event on the ECS. Well documented local events and their analysis will aid in engine installation certification.
(11) The following guidance applies to ECS wiring.
(a) Test or analyze each wire or combination of wires interfacing with the EECS that could be affected by a local event. The assessment should include opens, shorts to ground, and shorts to power (when appropriate). The results should show that faults result in specific responses and do not result in hazardous engine effects. Any EEC system component connector that becomes disconnected while the engine is operating must not result in a hazardous engine effect. Nor should it endanger the continued safe flight and landing of the aircraft.
(b) The applicant should test or analyze engine control unit aircraft interface wiring for shorts to aircraft power. These “hot” shorts should result in a specific and non-hazardous engine effect. Where aircraft interface wiring is involved, the engine installation instructions should inform the installer of the potential effects of shorts in the interface wiring. The installer should ensure that no wiring faults exist that are not detectable and not accommodated. Also, these wiring faults must not result in a hazardous engine effect.
(c) Where practical, wiring faults should not affect more than one channel. The engine applicant should include any assumptions regarding channel separation in the LOTC/LOPC analysis.
(d) Where physical separation of conductors is not practical, the engine applicant and the installer should coordinate to ensure that the potential for common mode faults is minimized between channels on one engine and eliminated between ECSs.
(e) The applicant should test and analyze the effects of fluid leaks impinging on EECS components. Impingement must not result in a hazardous engine effect, and the fluids should not impinge on circuitry or printed circuit boards, nor result in a potential latent failure condition.
(f) If the installation of the engine could be subject to part 25 rules, refer to the applicable sections of 14 CFR 25, Subpart H, Electrical Wiring Interconnection Systems (EWIS).
CHAPTER 7. SECTION 33.28(e) – SYSTEM SAFETY ASSESSMENT.
7-1. Rule Text. Section 33.28(e) reads: “(e) System safety assessment. When complying with this section and 33.75, the applicant must complete a System Safety Assessment for the engine control system. This assessment must identify faults or failures that result in a change in thrust or power, transmission of erroneous data, or an effect on engine operability producing a surge or stall together with the predicted frequency of occurrence of these faults or failures.”
7-2 Guidance: System Safety Assessment . Refer to Appendix 3 “Guidance for System Safety Assessment for EECS Applied to Reciprocating Engines.”
a. Scope of the assessment. The methods presented in ARP4761 for conducting safety assessment are recognized for ECS assessments.
(1) The SSA required under § 33.28 (e) must address all operating modes.
(2) The LOTC/LOPC analysis described in § 33.28(d) is a subset of the SSA. The LOTC/LOPC analysis and SSA may be separate or combined as a single analysis. For clarity, the remainder of the discussion mentions only the SSA, but it is equally applicable to an LOTC/LOPC analysis or combined SSA/LOTC/LOPC analysis.
(3) The SSA must consider all faults, both detected and undetected, and their effects on the ECS and engine operation. The SSA must also include faults or malfunctions in aircraft signals, including electrical opens, shorts, data validation, signal input errors and any other malfunction defined by the installer. These malfunctions should include those in a multiengine aircraft installation that could affect more than one engine. These types of faults are addressed under § 33.28(h).
(4) The ECS SSA should identify the applicable assumptions and installation requirements. It should also establish any limitations relating to ECS operation. These assumptions, requirements, and limitations should be stated in the engine installation and operating instructions, as appropriate.
(5) As necessary, the airworthiness limitations section of the instructions for continued airworthiness should include the limitations related to the ECS operation. For example, the LOTC/LOPC analysis may classify faults into various categories that may require repair within an approved time frame. Refer to SAE ARP5107B for additional information.
(6) The SSA must address all failure effects identified under § 33.75, as appropriate.
The applicant may reference the § 33.75 analysis in this SSA when appropriate.
(7) The applicant must provide a summary listing the malfunctions or failures and their effects caused by the ECS, such as:
(a) Failures affecting power or thrust resulting in LOTC/LOPC events.
(b) Failures that result in the engine’s inability to meet the operability regulations.
If these failure cases are not considered LOTC/LOPC events according to the criteria of Chapter 6, then document the expected frequency of occurrence for these events.
(c) Transmission of erroneous parameters, for example; false high indication of the thrust or power setting that could lead to thrust or power changes greater than 3% of take-off power, or thrust, or both, (10% for reciprocating engines installations), or high exhaust gas temperature or turbine temperatures, or low-oil pressure that could lead to engine shutdown.
These levels have typically been considered unacceptable, however, applicants may propose different levels for a specific engine.
(d) Failures affecting aircraft functions included in the ECS, for example, propeller control, thrust reverser control, control of cooling air, or control of fuel recirculation.
(e) Failures resulting in major engine effects and hazardous engine effects. In addition, reciprocating engine applicants must address failures resulting in destructive events.
(8) The SSA should also consider all signals used by the ECS, particularly any crossengine control signals and air pressure signals as described in § 33.28(j).
(9) The SSA should include functions implemented in the ECS that involve aircraft level functions. The aircraft applicant needs to define the criticality of aircraft level functions.
b. Criteria. The SSA should demonstrate or provide the following:
(1) Compliance with §§ 33.75, as appropriate.
(2) For failures leading to LOTC/LOPC events, Chapter 6, paragraph 6-2.d., provides guidance on compliance with the agreed LOTC/LOPC rate for the intended installation.
(3) For failures affecting engine operability but not necessarily leading to LOTC/LOPC events, only the rate of occurrence of the faults that could lead to an operability limitation should be documented. Any aircraft flight deck indications deemed necessary to inform the flight crew of such a failure will be determined at aircraft certification.
(4) The applicant must identify the consequences of the transmission by the ECS of a faulty parameter that is not indicated or identified as failed or faulty. If the consequence can result in loss of the ability to set power, then that fault should be included in the LOTC/LOPC analysis. The engine operating instructions should include any information necessary to mitigate the consequences of a detected faulty parameter transmission. For example, the engine operating instructions may indicate that a display of zero oil pressure may be ignored in flight if the oil quantity and temperature displays appear normal. In this situation, failure to transmit oil pressure or transmitting a zero oil pressure signal should not lead to an engine shutdown or LOTC/LOPC event.
(5) Flight crew initiated shutdowns have occurred in-service as the result of failure conditions, such as the ECS transmitting a faulty parameter. If the engine operating instructions provide information to mitigate this failure condition, then control system faults or malfunctions leading to the failure condition would not have to be included in the LOTC/LOPC analysis. In the case of the ECS transmitting faulty parameters, the loss of multiple functions should be included in the LOTC/LOPC analysis. For example, if the display of zero oil pressure and zero oil quantity (or high oil temperature) would result in a crew-initiated shutdown, then the applicant should include those failures in the systems LOTC/LOPC analysis.
c. Malfunctions or faults affecting thrust or power.
(1) In multiengine aircraft, faults that result in thrust or power changes of less than approximately 10% of take-off power or thrust, may be undetectable by the flight crew. This level is based on pilot assessment and has been used for a number of years. Pilots have indicated that flight crews will note engine operating differences when the difference is greater than 10% in asymmetric thrust or power. A thrust change larger than 10% of take-off power or thrust, may be acceptable if authorized by the installer.
(2) Engine applicants and the installer should agree on the detectable difference level for engines for other installations. This is important as the installation can significantly affect the pilot’s ability to detect the operating difference between engines. If the pilot cannot detect this difference and take appropriate action, the result may be hazardous to the aircraft.
(3) When operating in the take-off envelope, uncovered faults in the ECS that result in a thrust or power change of less than 3% (10% for reciprocating engines installations) are generally considered acceptable. However, this does not diminish the applicant’s obligation to ensure that the full-up system is capable of providing the declared minimum rated thrust or power. In this regard, faults that could result in small thrust changes should be random in nature and detectable and correctable during routine inspections, overhauls, or power-checks.
(4) The SSA documentation should include the frequency of occurrence of uncovered faults that result in a thrust or power change greater than 3% of take-off power, or thrust, but less than the change defined as an LOTC/LOPC event. No specific regulations relating to this class of faults for engine certification exist. However, the rate of occurrence of these types of faults should be reasonably low. We recommend on the order of 10-5 events per engine flight hour or less. Documentation of these faults may be required in the aircraft certification analysis.
(5) Signals sent from one ECS to another, such as signals used for an ATTCS, APR or synchrophasing, are addressed under § 33.28(h). These cross-engine signals should be limited in authority by the receiving ECS, so that undetected faults do not result in an unacceptable change in thrust or power for the engine using those signals. The maximum thrust or power loss on the engine using a cross-engine signal should generally be limited to 3% absolute difference of the current operating condition. The ATTCS or APR, when activated, may command a thrust or power increase of 10% or more on the remaining engine(s). These thrust and power losses do not have to be considered LOTC/LOPC events. In addition, in a rotorcraft installation, signals sent 29
from one engine control to another, such as load sharing and OEI, can have a much greater impact on engine power when those signals fail. However, data on these failure modes should be in the SSA.
(6) When operating in the take-off envelope, detected faults in the ECS, that result in a thrust or power change of up to 10% (15% for reciprocating engines), may be acceptable if the total frequency of occurrence for these types of failures is relatively low. A thrust change larger than 10% (15% for reciprocating engines) of take-off power, or thrust, may be acceptable if authorized by the installer. The predicted frequency of occurrence for this category of faults should be in the SSA documentation. Requirements for the allowable frequency of occurrence for this category of faults and any need for a flight deck indication of these conditions are reviewed during aircraft certification. A total frequency of occurrence of less than of 10 –5 events per engine flight hour would normally be acceptable, as the occurrence of this on multiple engines would be an extremely remote event.
(7) Detected faults in signals exchanged between ECSs should be accommodated so as not to result in greater than a 3% thrust or power change on the engine using the cross-engine signals.
CHAPTER 8. SECTION 33.28(f) – PROTECTION SYSTEMS.
8-1 Rule Text . Section 33.28(f) reads: “Protection Systems.
“(f) Protection Systems. (1) The design and functioning of engine control devices and systems, together with engine instruments and operating and maintenance instructions, must provide reasonable assurance that those engine operating limitations that affect turbine, compressor, fan, and turbosupercharger rotor structural integrity will not be exceeded in service.
(2) When electronic overspeed protection systems are provided, the design must include a means for testing, at least once per engine start/stop cycle, to establish the availability of the protection function. The means must be such that a complete test of the system can be achieved in the minimum number of cycles. If the test is not fully automatic, the requirement for a manual test must be contained in the engine instructions for operation.
(3) When overspeed protection is provided through hydromechanical or mechanical means, the applicant must demonstrate by test or other acceptable means that the overspeed function remains available between inspection and maintenance periods.”
8-2. Guidance: Protection Systems.
a. Rotor overspeed protection.
(1) In engines of recent design, the applicant usually provides overspeed protection, or circuits, or both, utilizing the engine control devices, systems and instruments referred to in §
33.28(f). Although they may be independent devices, the overspeed protection and circuits are generally part of the EECS
(2) Rotor overspeed protection is usually achieved by providing an independent overspeed protection system that requires two independent faults or malfunctions (as described below) to result in an uncontrolled overspeed. Examples of engine provided, as opposed to ECS provided, overspeed protection include blade shedding, rotor interference, or fuel cutoff methods through rotor axial movement. Engine-provided overspeed protection methods are addressed by § 33.27.
(3) The following guidance applies if the rotor overspeed protection is provided solely by an ECS protective function.
(a) In all dispatchable configurations, the combined engine control and overspeed protection system should be at least two independent faults removed from an uncontrolled overspeed event. Hence, a potential rotor burst due to overspeed should only be possible as a result of an independent fault preventing the overspeed protection system from operating properly in combination with a control system fault causing an overspeed.
(b) The SSA should show that the probability per engine flight hour of an uncontrolled overspeed condition from any cause in combination with a failure of the overspeed 31