(4) Previous regulatory practice preserved the independence of the engine from the aircraft. Hence, even with very reliable architectures, such as triplex air data computer (ADC) systems, the ECS provided an independent control that crews could use to safely fly the aircraft should all the ADC signals be lost. With the increased engine-aircraft integration currently occurring in the aviation industry, and with the improvement in reliability and implementation of aircraft-supplied data, the new requirement is that the ECS provide fault accommodation against single failures of aircraft-supplied data for which such accommodation is possible.
c. Design Assessment.
(1) As part of their compliance plan, applicants should provide an analysis, based on component, system, or engine testing, that shows they adequately evaluated the impact of a failure of aircraft data on the engine’s performance and operability throughout the aircraft flight envelope. This failure analysis should address all allowable engine control and aircraft dispatch configurations in which failure of aircraft data in that dispatch configuration would impact ECS response. “Failure of aircraft data,” includes airplane system failure events that either prevent data from being transmitted or result in the transmission of incorrect data. This analysis should include:
(a) Their evaluation of the engine control responses to aircraft data inputs, including an evaluation of the effect on the EECS of faulty and corrupted aircraft-supplied data.
(b) An evaluation of the potential for common mode faults affecting operation of more than one engine in EEC systems intended for installation on multiengine airplanes. The installation and/or the operating instructions should identify data transfers and exchanges between engines, and between the airplane and engines, that could produce common mode faults.
Examples of potential common mode faults that the analysis should address include:
1 A single erroneous data source transmitted from the aircraft to multiple engines and their associated EEC systems (for example, air data sources or auto throttle systems), 2 Control system operating faults spread through data links between engines (for example, maintenance recording, common bus, cross-talk, or automatic power reserve system), and 3 Loss or interruption of aircraft data used by the engine control when that loss or interruption is caused by the failure of another engine.
(c) An evaluation of the EECS fault accommodation logic for coverage of aircraftsupplied data failures. Applicants should conduct testing or analysis on the fault accommodated control mode to establish that the engine operating characteristics comply with all operability requirements of part 33. The applicant may incorporate precautions for addressing common effects in the aircraft system architecture or in the EECS itself.
(2) When the particular aircraft air data failure mode(s) are unknown, the engine applicant should assume typical failure modes for loss of data and erroneous data. The engine applicant should assume that erroneous data is being transmitted to the EECS and identify for the installer the impact of this data on engine operation.
(3) The applicant may use any number of tools and techniques to assess and to shape the design of the ECS and its interface with the aircraft data systems. One example is the use of a Fault Accommodation chart and Markov Modeling, wherein applicants define the fault accommodation architecture for the aircraft-supplied data.
(4) If the ECS relies entirely on aircraft air data to complete any of its critical control functions, then the aircraft air data system becomes an element of the ECS. To maintain compliance to § 33.28, the applicant must require via the installation, or the operating instructions, or both that:
(a) The aircraft air data system is unaffected by a complete loss of aircraft generated power (for example, the air data system is backed up by battery power).
(b) No common mode faults exist where multiple incorrect, but valid, signals are transmitted to the EECS (for example, dedicated sensor(s) and pneumatic lines for each air data computer).
(5) The ECS’s LOTC/LOPC analysis should also analyze the effects of air data system failures in all allowable ECS and air data system dispatch configurations.
(6) Elements of the ECS, such as a throttle position transducer, may be mounted in the aircraft and not part of the engine type design but dedicated to the ECS and powered by it. Such elements are an integral component of the EECS, and are not considered aircraft data. The applicant should include failures in the throttle position sensing system and thrust command system in their engine LOTC/LOPC analysis.
(7) When aircraft-supplied data can affect ECS operation, the applicant should address the effects of faulty and corrupted aircraft-supplied data on the EECS, as applicable, in the SSA or other appropriate documents.
d. Accommodation. Even with a redundant, multipath aircraft air data system, the EECS should incorporate appropriate accommodation features. These features should retain a thrust or power modulation capability for complete loss of all aircraft environmental (i.e., speed, altitude, temperature data) information. The following are examples of possible means of accommodation:
(1) Implementation of an alternate mode that is independent of aircraft-supplied data.
(2) Dual sources of aircraft-supplied sensor data with local engine sensors providing data as alternate sources. This local engine sensor can be used to aid in the selection of the 40
correct aircraft-supplied data. The local engine sensor used in this selection is often called a voter.
(3) Use of synthesized engine parameters to control or act as voters. When synthesized parameters are used for control or voting purposes, the SSA should consider the impact of temperature and other environmental effects on sensors whose data are used in the synthesis. Also, applicants should assess any data tolerances necessary to correlate the data from the sensors used in the synthesis and the parameters being synthesized.
(4) Triple redundant ADC systems that provide the required data.
e. Effects on the engine. Applicants should ensure that their ECS system is capable of ensuring that the engine provides the declared minimum rated thrust or power throughout the engine operating envelope. The effects of failures in aircraft-supplied data must be documented in the SSA as described in Chapter 7 of this AC.
f. Validation.
(1) Applicants should demonstrate by test, analysis, or a combination thereof, that their ECS fault accommodation logic continues to successfully manage engine performance when the aircraft air data system is not functional.
(2) Applicants should also show that for all dispatchable control modes that involve aircraft data, the next single fault in the EECS does not lead to a hazardous engine effect.
(3) When the alternate mode is intended to be a dispatchable mode, applicants should demonstrate that the ECS continues to successfully meet the engine and aircraft certification basis when operating in this alternate mode, and the aircraft air data system is not functional. The objective here is to assure that a dispatchable alternate mode does not lead to a hazardous engine effect when there is a subsequent loss of aircraft air data. The instructions for installation should include characteristics of operation in this alternate mode, even if it is a nondispatchable mode.
g. Installation requirements. As a result of increasing levels of integration between aircraft systems and ECSs, engine applicants should show that their installation instructions provide guidance with certain aspects of the data interface during the integration of the engine.
“Certain aspects” includes ensuring that the engine continues to meet its certification basis when installed. This means that the engine applicant should state in the engine installation instructions that the installer is responsible for ensuring that:
(1) The software in the data path to the EECS is at a level consistent with how the aircraft data is used by the EECS, as described and analyzed in the EECS’s SSA, and
(2) The impact of the engine responses are included in the aircraft’s SSA as the data path may include other aircraft equipment, such as aircraft thrust management computers, or other avionics equipment, and 41
(3) The effects of faulty or corrupted aircraft-supplied data on the EECS are addressed in the aircraft SSA, and
(4) Those sensors and equipment involved in delivering information to the EECS continue to operate properly when exposed to EMI, HIRF and lightning, and
(5) The reliability level for the aircraft-supplied data is no worse than that used as part of the EEC’s SSA and LOTC/LOPC analysis, and
(6) Any assumptions made during the ECS design assessment regarding the reliability or configuration of the aircraft systems are appropriate, and thus the results of the evaluation of erroneous aircraft data as documented in the SSA are also appropriate.
h. Thrust and power command signals.
(1) Thrust and power command signals sent from the aircraft are unique and are not subject to the regulations of § 33.28(h).
(2) Some aircraft thrust or power command systems are configured to move the engine thrust or power levers or transmit an electronic signal to command a thrust or power change.
When so configured, the ECS merely responds to the command and changes engine thrust or power as appropriate. In these cases, other than input range or data validity checks, the ECS should not attempt to differentiate between correct or erroneous throttle or power lever commands. For EEC systems in which the throttle or power lever command system is not included in the EEC system design, do not include thrust and power command signals sent from the aircraft in the evaluation required by § 33.28(h)(2).
(3) For EEC systems in which the power lever command is included in the EEC system design to be certificated under part 33, we recommend including the thrust and power command signals in the analysis.
(4) In both moving and non-moving throttle (or power lever) configurations, the installer should ensure that a proper functional hazard analysis is performed on the aircraft system involved in generating engine thrust or power commands. The installer should also ensure that the system meets the appropriate aircraft functional hazard assessment safety related regulations. This should be shown at aircraft certification. However, failures in the throttle position sensing system and thrust command system must be included in the LOTC/LOPC analysis of the engine as defined in the LOTC/LOPC analysis system description.
CHAPTER 11. SECTION 33.28(i) – AIRCRAFT-SUPPLIED ELECTRICAL POWER
11-1. Rule Text. Section 33.28(i) reads: “(i) Aircraft-supplied electrical power. (1) The applicant must design the engine control system so that the loss, malfunction, or interruption of electrical power supplied from the aircraft to the engine control system will not result in any of the following:
(i) A hazardous engine effect, or
(ii) The unacceptable transmission of erroneous data.
(2) When an engine dedicated power source is required for compliance with paragraph (i)(1) of this section, its capacity should provide sufficient margin to account for engine operation below idle where the engine control system is designed and expected to recover engine operation automatically.
(3) The applicant must identify and declare the need for, and the characteristics of, any electrical power supplied from the aircraft to the engine control system for starting and operating the engine, including transient and steady state voltage limits, in the engine installation instructions.
(4) Low voltage transients outside the power supply voltage limitations declared in paragraph (i)(3) of this section must meet the requirements of paragraph (i)(1) of this section.
The engine control system must be capable of resuming normal operation when aircraft-supplied power returns to within the declared limits.”
11-2. Guidance: Aircraft-Supplied EECS Electrical Power.
a. The most common means of providing electrical power to an EECS has been an enginemounted alternator. An EECS dedicated engine-mounted alternator is not subject to the typical interruptions and power transients present in the aircraft power systems. In addition, this configuration is typically single-electric fault tolerant including common cause/mode electric fault tolerant. However, other options do exist, and are discussed below.
(1) Batteries. Batteries are not generally an acceptable aircraft-supplied power source, particularly for turbine engine aircraft, as they are unable to satisfy the reliability needs for the EECS. For reciprocating engines, however, an ECS dedicated battery may be acceptable. If an applicant proposes a battery as an EECS dedicated power source, the applicant should in the engine installation instructions, identify battery health, status, and maintenance requirements.
(2) Self-contained electrical power systems. This type of system is an integral part of the engine design. The self-contained reference may be only applicable to the critical functions of the ECS. It is both functionally and physically isolated from the aircraft electrical power system. This is acknowledging that there are means other than an alternator that may be used.
However, an engine driven alternator based system does fit into this type of system.
(a) A self-contained system is considered part of the EECS, and applicants should include the predicted failure event rate of the self-contained system in the EECS SSA.
(b) A self-contained system may not require backup electrical power. However, if aircraft power is a backup power source, then applicants should provide detailed electrical system interface requirements in the engine installation instructions.
(c) Applicants should also show in their compliance plan, that abnormalities in the aircraft power system cannot cause the EECS to behave abnormally. The applicant does not have to include the predicted failure event rate of this backup power system in the EECS SSA because we have not typically allowed credit toward achieving system reliability based on backup power from the aircraft.
(3) Aircraft power bus. If a power source supplies power to both the aircraft main power bus and the EECS, the source may be “independent” for purposes of evaluating EECS power sources, but further inquiry is needed. The determination is made by looking at what is dedicated to the EECS, and what is not. For example, if the EECS draws its power from the aircraft main power bus, the power is aircraft bus supplied power and the EECS does not have a self-contained engine power source. However, if a winding on an alternator with dual windings provides only the EECS with power, the dedicated winding is a self-contained engine power source, even if the other winding provides power to the main power bus. In this instant the EECS power source would be “independent,” even though the alternator supplies both.
b. Design architecture analysis.
(1) Dedicated aircraft power.
(a) Applicants should ensure that the design of any engine dedicated power source would provide sufficient power to allow the ECS to continue functioning during any anticipated engine recovery event. For example, when autolight is an intended ECS function, the ECS should have sufficient power to continue operation during an automatic relight after unintended shutdown. ECS independence from aircraft power during restart when the engine is windmilling, is not always required. For example the ignition system is often powered by the aircraft electrical system.
(b) The applicant should also ensure that the ECS design accounts for any anticipated variations in aircraft power availability, such as those due to temperature variations, manufacturing tolerances, or idle speed variations.
(2) Failure of aircraft-supplied power. The applicant should show through analysis, or bench testing that the EECS continues to function properly during and after a failure or interruption of an aircraft-supplied power source at any point within the declared engineoperating envelope. The applicant’s analysis of the ECS design architecture should identify all requirements for engine-dedicated and aircraft-supplied power sources. The analysis should also include the sources of power and the effects of losing these sources. If the engine depends on 44
aircraft-supplied power for any operational functions, the analysis should also define the aircraftsupplied power requirements.
c. Aircraft-supplied power system(s). Applicants should consider the single bus failure rate.
(1) Failure of a single bus. A failure of one of multiple aircraft buses is not considered a loss of aircraft power if the buses are independent and power the EECS separately. Therefore, a backup source could be an alternate bus, such as an essential bus, that is independent, isolated from the bus serving as the primary power source, and services only electrical loads required for continued safe operation.
(2) Installation instructions. The engine installation instructions may reference a detailed wiring diagram with the information. If it does, the wiring diagram itself should not need to be issued as a part of the engine installation and/or operating instructions.
(3) Failure event rate. If required to meet the declared LOTC/LOPC failure rate, the applicant should include in the installation instructions the maximum allowable failure event rate for the aircraft electrical power system, recalling that the total EECS failure event rate, including the aircraft power source, must remain within the EECS SSA criteria for full-up and degraded systems. This inclusion of failure rate data insures that, as installed, the ECS still satisfies the allowable rates.
(4) Aircraft as primary power source. If aircraft-supplied power, such as an aircraft bus and battery system, is used as the primary power source, then the EECS should have an isolated backup power source. This backup power source can be integral to the engine EECS or provided by the airplane.
(a) Separation of EECS power and aircraft power. Aircraft electrical power generators or battery systems certified with the engine should be physically and functionally separate from the primary EECS power system to avoid any interaction and potential for common cause or common mode failures.
(b) Backup power source monitoring. The applicant should provide ICA and provisions for system monitoring. System monitoring will ensure that the backup system is capable of powering the EECS for continued safe flight. For example, a battery system should incorporate provisions for charge level monitoring and the ICA should include maintenance procedures to ensure that the charge level is adequate to power the EECS.
(c) Backup power, such as alternate buses, essential buses, or battery systems. We recommend that the engine installation, or operating instructions, or both, specify the following to ensure that the installer does not violate any of the assumptions in the EECS SSA:
1 A requirement that the backup system be physically and functionally separate from the primary EECS power system, and 45
2 The interface and reliability requirements needed for the airplane system to meet overall EECS objectives, and 3 System charge level or power requirements and health monitoring requirements to ensure that power or charge level is available, and 4 For battery systems, a requirement to isolate the backup battery system from the engine starting battery system, and 5 For battery systems, a requirement that the battery capacity must allow for engine operation to be maintained in excess of the time required for the primary flight displays.
d. Aircraft-supplied power reliability.
(1) Power reliability values. The applicant should include in the engine installation instructions all aircraft-supplied power reliability values that they used in their system analyses.
This is to ensure that the installer does not violate any of the assumptions in the EECS SSA.
(2) Inclusion of aircraft power effects. Applicants should include in the EECS SSA all events where the aircraft-supplied power is used in any architecture and aircraft power faults or failures can contribute to LOTC/LOPC or hazardous engine effects.
(3) Credit for backup power. Aircraft-supplied power has typically been provided to accommodate the loss of the engine dedicated power source. However, we will review LOTC/LOPC allowance and any impact on the SSA for the use of aircraft-supplied power as the sole power source for an engine control backup system or as a backup power source on a case by-case basis. If the engine control can operate in the presence of aircraft power bus transfers, then the use of aircraft power as a backup may be acceptable.
(4) Without dedicated power source. In some system architectures, compliance with the regulations may not require an engine dedicated power source. Two examples are mixed electronic and hydro-mechanical systems, and EEC systems that could support a critical fly-by wire flight control system. Both are discussed below.
(a) Mixed electronic and hydromechanical systems.
1 These systems consist of a primary electronic single channel and a full capability hydromechanical backup system independent of electrical power. A full capability hydromechanical control system meets all part 33 regulations and does not depend on aircraft power. In this architecture, a loss or interruption of aircraft-supplied power is accommodated by transferring control to the hydromechanical system.
2 Transition from the electronic to the hydromechanical control system is addressed under § 33.28 (c). For these systems, the applicant should show that the transition from the electronic-powered mode to the mechanical control mode can be performed without the aircraft-supplied power and without the occurrence of an LOTC/LOPC.
(b) EECS powered by an aircraft power system that could support a critical fly-by wire flight control system.
1 These systems may be acceptable as the sole source of power for an EECS.
In this example, the engine installation instructions should state that a detailed design review and safety analysis must be conducted to identify latent failures and common cause failures that could result in the loss of all electrical power. The instructions should also state that any emergency power sources must be known to be operational at the beginning of the flight.
2 Any emergency power sources should be isolated from the normal electrical power system so that the emergency power system will be available no matter what happens to the normal generated power system. If batteries are the emergency power source, the applicant should show that the flight crew can determine battery condition prior to flight, and that battery capacity is sufficient to ensure exhaustion will not occur before the airplane lands. This will ensure that appropriate reliability assumptions are provided to the installer.
e. Aircraft-supplied power quality.
(1) Requirements. When aircraft electrical power is necessary for operation of the ECS, the engine installation instructions must contain the ECS’s electrical power supply quality requirements. This applies to any of the configurations listed above or to any new or novel configurations that use aircraft-supplied power. These quality requirements should include steady state and transient under-voltage and over-voltage limits for the equipment. RTCA/DO 160/EUROCAE ED-14 provides additional information on setting power input standards. If used, the applicant should identify any exceptions to the power quality standards cited for the category of equipment specified.
(2) Low voltage transients. We recognize that the electrical or electronic components of the ECS, when operated on aircraft-supplied power, may cease to operate during some low voltage aircraft power supply conditions beyond those required to sustain normal operation.
When the ECS is operating on aircraft-supplied power, if low voltage aircraft power supply conditions are below those required to sustain normal operation, the electrical or electronic components of the ECS may not function as intended. However, during these transients, EECS operation must not per regulation, result in a hazardous engine effect. Further, low voltage transients outside the control system’s declared capability should not:
(a) Cause permanent ECS loss of function, or
(b) Result in inappropriate system operation, or
(c) Cause the engine to exceed any operational limits, or
(d) Cause the transmission of unacceptable erroneous data.
f. Power recovery.
(1) Power recovery from voltage transients does not usually apply to systems powered by ECS dedicated PMA/PMG systems. However, aircraft supplied power does have the potential to have low voltage transient. Impact from these type of transients has been shown to affect ECS using aircraft power for backup power even when they are being powered by a PMA/PMG. The applicant should demonstrate the ECS reaction to aircraft power low voltage transients. The following cases should also be tested if the system could be operating on aircraft power:
(a) Recovery from low voltage. When aircraft power recovers from a low-voltage condition, the ECS must resume normal operation. Applicants should include in the engine installation or operating instructions the time interval associated with this recovery.
(b) Aircraft low power supply condition. These conditions may lead to engine shutdown or an engine condition that is not automatically recoverable. In these cases, the engine should be capable of being restarted. Also, applicants should include in the operating instructions any special flight crew procedures for executing an engine restart during such conditions.
(c) Low voltage transients effects. These transients can be associated with application of electrical loads that could cause an interruption in voltage or a decay in voltage level below that required for proper control functioning. Therefore, the applicant should consider the effects of any aircraft electrical bus-switching transients or power transients in the engine installation or operating instructions.
(2) All engine out restart. During certain aircraft operations, such as low engine speed and in-flight engine restarts, aircraft electrical power is generally used to operate the ECS.
However, operationally, battery power may have to suffice. If battery power is required to meet a low engine speed or “all engine out” restart requirement, the engine applicant should define the battery power requirements and verify them via test. Those power requirements will thereafter, be available to the installer in the engine installation instructions and will ensure that the EECS will generally have sufficient power during any in-flight engine restart(s).
g. Effects on the engine.
(1) Change of control mode. When loss of aircraft power results in a change in engine control mode, the control mode transition must meet the requirements of § 33.28(c).
(2) Acceptable loss of aircraft electrical power. For some engine control functions that rely exclusively upon aircraft-supplied electrical power, the loss of electrical power may still be acceptable. Acceptability is based on evaluation of the change in engine operating characteristics, current experience with similar designs, or the accommodation designed into the control system.
(a) Engine operating characteristics. These are acceptable if the engine is still capable of complying with all of the rules and does not operate in a manner unexpected by the pilot.
(b) Similar designs. Examples include the ignition systems and some performance enhancing systems (see (3) below) that are typically powered by aircraft.
(c) Accommodation. This refers to whether the loss of the function is accommodated by automatic control features that result in an unnoticeable operational change.
(3) Aircraft powered functions. Examples of engine control functions that have traditionally relied on aircraft power include
(a) Engine start and ignition,
(b) Thrust reverser deployment,
(c) Anti-icing (engine probe heat),
(d) Fuel shut-off,
(e) Over-speed protection systems, and
(f) Noncritical functions that are primarily performance enhancement functions that, if inoperative, do not affect the safe operation of the engine.
h. Validation. The applicant should demonstrate the effects of loss of aircraft-supplied electrical power by engine test, system validation test, bench test, or combination thereof.
i. New and novel design concepts. Technological advances in electrical powergenerating components and in the associated systems may allow for new and novel design concepts to meet the requirements of § 33.28(i). For example, dual use alternators or use of an essential battery, are concepts that until recently were not considered successful. Therefore, if an applicant has a new or novel design concept, we recommend contacting the responsible certification office early to develop an appropriate compliance plan.
CHAPTER 12. SECTION 33.28(j) – AIR PRESSURE SIGNAL.
12-1. Rule Text. Section 33.28(j) reads:
“(j) Air Pressure Signal. The applicant must consider the effects of blockage or leakage of the signal lines on the engine control system as part of the System Safety Assessment of paragraph
(e) of this section and must adopt the appropriate design precautions.”
12-2. Guidance: Section 33.28(j) covers ingress of foreign matter (for example, sand, dust, water, or insects) that could result in blockage of the lines and adversely affect engine operation.
Lines used for measuring the static pressure in the compressor of turbine engines can suffer from two predominate failure modes: signal lines are either blocked by frozen water (leading to a loss of power or to failures to detect changes in the engine static pressure) or they fail to open or develop a leak, thereby leading to a loss of power. Each are discussed separately.
a. Signal lines can be blocked by frozen water. We recommend applicants take precautions, such as:
(1) Use of protected openings,
(2) Filters,
(3) Drains for water,
(4) Effective geometry of plumbing to aid in draining,
(5) Appropriate plumbing line inside diameter to aid in draining,
(6) Appropriate bleed hole and drain hole sizing,
(7) Heating the lines to prevent freezing of condensed water, and
(8) Corrosion resistant features.
b. Signal lines can also fail to open or develop a leak. Precautions might in this case, include:
(1) Enhanced support of the plumbing lines to prevent loosening or fracture due to vibration or handling damage during maintenance,
(2) Special design precautions to prevent loosening of the fittings, and
(3) Appropriate plumbing line size for durability.
c. In addressing system failure modes, the applicant should consider both pressure line failure modes in paragraphs a. and b. above independently and in combination.