CHAPTER 11. SECTION 33.28(i) – AIRCRAFT-SUPPLIED ELECTRICAL POWER
11-1. Rule Text. Section 33.28(i) reads: “(i) Aircraft-supplied electrical power. (1) The applicant must design the engine control system so that the loss, malfunction, or interruption of electrical power supplied from the aircraft to the engine control system will not result in any of the following:
(i) A hazardous engine effect, or
(ii) The unacceptable transmission of erroneous data.
(2) When an engine dedicated power source is required for compliance with paragraph (i)(1) of this section, its capacity should provide sufficient margin to account for engine operation below idle where the engine control system is designed and expected to recover engine operation automatically.
(3) The applicant must identify and declare the need for, and the characteristics of, any electrical power supplied from the aircraft to the engine control system for starting and operating the engine, including transient and steady state voltage limits, in the engine installation instructions.
(4) Low voltage transients outside the power supply voltage limitations declared in paragraph (i)(3) of this section must meet the requirements of paragraph (i)(1) of this section.
The engine control system must be capable of resuming normal operation when aircraft-supplied power returns to within the declared limits.”
11-2. Guidance: Aircraft-Supplied EECS Electrical Power.
a. The most common means of providing electrical power to an EECS has been an enginemounted alternator. An EECS dedicated engine-mounted alternator is not subject to the typical interruptions and power transients present in the aircraft power systems. In addition, this configuration is typically single-electric fault tolerant including common cause/mode electric fault tolerant. However, other options do exist, and are discussed below.
(1) Batteries. Batteries are not generally an acceptable aircraft-supplied power source, particularly for turbine engine aircraft, as they are unable to satisfy the reliability needs for the EECS. For reciprocating engines, however, an ECS dedicated battery may be acceptable. If an applicant proposes a battery as an EECS dedicated power source, the applicant should in the engine installation instructions, identify battery health, status, and maintenance requirements.
(2) Self-contained electrical power systems. This type of system is an integral part of the engine design. The self-contained reference may be only applicable to the critical functions of the ECS. It is both functionally and physically isolated from the aircraft electrical power system. This is acknowledging that there are means other than an alternator that may be used.
However, an engine driven alternator based system does fit into this type of system.
(a) A self-contained system is considered part of the EECS, and applicants should include the predicted failure event rate of the self-contained system in the EECS SSA.
(b) A self-contained system may not require backup electrical power. However, if aircraft power is a backup power source, then applicants should provide detailed electrical system interface requirements in the engine installation instructions.
(c) Applicants should also show in their compliance plan, that abnormalities in the aircraft power system cannot cause the EECS to behave abnormally. The applicant does not have to include the predicted failure event rate of this backup power system in the EECS SSA because we have not typically allowed credit toward achieving system reliability based on backup power from the aircraft.
(3) Aircraft power bus. If a power source supplies power to both the aircraft main power bus and the EECS, the source may be “independent” for purposes of evaluating EECS power sources, but further inquiry is needed. The determination is made by looking at what is dedicated to the EECS, and what is not. For example, if the EECS draws its power from the aircraft main power bus, the power is aircraft bus supplied power and the EECS does not have a self-contained engine power source. However, if a winding on an alternator with dual windings provides only the EECS with power, the dedicated winding is a self-contained engine power source, even if the other winding provides power to the main power bus. In this instant the EECS power source would be “independent,” even though the alternator supplies both.
b. Design architecture analysis.
(1) Dedicated aircraft power.
(a) Applicants should ensure that the design of any engine dedicated power source would provide sufficient power to allow the ECS to continue functioning during any anticipated engine recovery event. For example, when autolight is an intended ECS function, the ECS should have sufficient power to continue operation during an automatic relight after unintended shutdown. ECS independence from aircraft power during restart when the engine is windmilling, is not always required. For example the ignition system is often powered by the aircraft electrical system.
(b) The applicant should also ensure that the ECS design accounts for any anticipated variations in aircraft power availability, such as those due to temperature variations, manufacturing tolerances, or idle speed variations.
(2) Failure of aircraft-supplied power. The applicant should show through analysis, or bench testing that the EECS continues to function properly during and after a failure or interruption of an aircraft-supplied power source at any point within the declared engineoperating envelope. The applicant’s analysis of the ECS design architecture should identify all requirements for engine-dedicated and aircraft-supplied power sources. The analysis should also include the sources of power and the effects of losing these sources. If the engine depends on 44
aircraft-supplied power for any operational functions, the analysis should also define the aircraftsupplied power requirements.
c. Aircraft-supplied power system(s). Applicants should consider the single bus failure rate.
(1) Failure of a single bus. A failure of one of multiple aircraft buses is not considered a loss of aircraft power if the buses are independent and power the EECS separately. Therefore, a backup source could be an alternate bus, such as an essential bus, that is independent, isolated from the bus serving as the primary power source, and services only electrical loads required for continued safe operation.
(2) Installation instructions. The engine installation instructions may reference a detailed wiring diagram with the information. If it does, the wiring diagram itself should not need to be issued as a part of the engine installation and/or operating instructions.
(3) Failure event rate. If required to meet the declared LOTC/LOPC failure rate, the applicant should include in the installation instructions the maximum allowable failure event rate for the aircraft electrical power system, recalling that the total EECS failure event rate, including the aircraft power source, must remain within the EECS SSA criteria for full-up and degraded systems. This inclusion of failure rate data insures that, as installed, the ECS still satisfies the allowable rates.
(4) Aircraft as primary power source. If aircraft-supplied power, such as an aircraft bus and battery system, is used as the primary power source, then the EECS should have an isolated backup power source. This backup power source can be integral to the engine EECS or provided by the airplane.
(a) Separation of EECS power and aircraft power. Aircraft electrical power generators or battery systems certified with the engine should be physically and functionally separate from the primary EECS power system to avoid any interaction and potential for common cause or common mode failures.
(b) Backup power source monitoring. The applicant should provide ICA and provisions for system monitoring. System monitoring will ensure that the backup system is capable of powering the EECS for continued safe flight. For example, a battery system should incorporate provisions for charge level monitoring and the ICA should include maintenance procedures to ensure that the charge level is adequate to power the EECS.
(c) Backup power, such as alternate buses, essential buses, or battery systems. We recommend that the engine installation, or operating instructions, or both, specify the following to ensure that the installer does not violate any of the assumptions in the EECS SSA:
1 A requirement that the backup system be physically and functionally separate from the primary EECS power system, and 45
2 The interface and reliability requirements needed for the airplane system to meet overall EECS objectives, and 3 System charge level or power requirements and health monitoring requirements to ensure that power or charge level is available, and 4 For battery systems, a requirement to isolate the backup battery system from the engine starting battery system, and 5 For battery systems, a requirement that the battery capacity must allow for engine operation to be maintained in excess of the time required for the primary flight displays.
d. Aircraft-supplied power reliability.
(1) Power reliability values. The applicant should include in the engine installation instructions all aircraft-supplied power reliability values that they used in their system analyses.
This is to ensure that the installer does not violate any of the assumptions in the EECS SSA.
(2) Inclusion of aircraft power effects. Applicants should include in the EECS SSA all events where the aircraft-supplied power is used in any architecture and aircraft power faults or failures can contribute to LOTC/LOPC or hazardous engine effects.
(3) Credit for backup power. Aircraft-supplied power has typically been provided to accommodate the loss of the engine dedicated power source. However, we will review LOTC/LOPC allowance and any impact on the SSA for the use of aircraft-supplied power as the sole power source for an engine control backup system or as a backup power source on a case by-case basis. If the engine control can operate in the presence of aircraft power bus transfers, then the use of aircraft power as a backup may be acceptable.
(4) Without dedicated power source. In some system architectures, compliance with the regulations may not require an engine dedicated power source. Two examples are mixed electronic and hydro-mechanical systems, and EEC systems that could support a critical fly-by wire flight control system. Both are discussed below.
(a) Mixed electronic and hydromechanical systems.
1 These systems consist of a primary electronic single channel and a full capability hydromechanical backup system independent of electrical power. A full capability hydromechanical control system meets all part 33 regulations and does not depend on aircraft power. In this architecture, a loss or interruption of aircraft-supplied power is accommodated by transferring control to the hydromechanical system.
2 Transition from the electronic to the hydromechanical control system is addressed under § 33.28 (c). For these systems, the applicant should show that the transition from the electronic-powered mode to the mechanical control mode can be performed without the aircraft-supplied power and without the occurrence of an LOTC/LOPC.
(b) EECS powered by an aircraft power system that could support a critical fly-by wire flight control system.
1 These systems may be acceptable as the sole source of power for an EECS.
In this example, the engine installation instructions should state that a detailed design review and safety analysis must be conducted to identify latent failures and common cause failures that could result in the loss of all electrical power. The instructions should also state that any emergency power sources must be known to be operational at the beginning of the flight.
2 Any emergency power sources should be isolated from the normal electrical power system so that the emergency power system will be available no matter what happens to the normal generated power system. If batteries are the emergency power source, the applicant should show that the flight crew can determine battery condition prior to flight, and that battery capacity is sufficient to ensure exhaustion will not occur before the airplane lands. This will ensure that appropriate reliability assumptions are provided to the installer.
e. Aircraft-supplied power quality.
(1) Requirements. When aircraft electrical power is necessary for operation of the ECS, the engine installation instructions must contain the ECS’s electrical power supply quality requirements. This applies to any of the configurations listed above or to any new or novel configurations that use aircraft-supplied power. These quality requirements should include steady state and transient under-voltage and over-voltage limits for the equipment. RTCA/DO 160/EUROCAE ED-14 provides additional information on setting power input standards. If used, the applicant should identify any exceptions to the power quality standards cited for the category of equipment specified.
(2) Low voltage transients. We recognize that the electrical or electronic components of the ECS, when operated on aircraft-supplied power, may cease to operate during some low voltage aircraft power supply conditions beyond those required to sustain normal operation.
When the ECS is operating on aircraft-supplied power, if low voltage aircraft power supply conditions are below those required to sustain normal operation, the electrical or electronic components of the ECS may not function as intended. However, during these transients, EECS operation must not per regulation, result in a hazardous engine effect. Further, low voltage transients outside the control system’s declared capability should not:
(a) Cause permanent ECS loss of function, or
(b) Result in inappropriate system operation, or
(c) Cause the engine to exceed any operational limits, or
(d) Cause the transmission of unacceptable erroneous data.
f. Power recovery.
(1) Power recovery from voltage transients does not usually apply to systems powered by ECS dedicated PMA/PMG systems. However, aircraft supplied power does have the potential to have low voltage transient. Impact from these type of transients has been shown to affect ECS using aircraft power for backup power even when they are being powered by a PMA/PMG. The applicant should demonstrate the ECS reaction to aircraft power low voltage transients. The following cases should also be tested if the system could be operating on aircraft power:
(a) Recovery from low voltage. When aircraft power recovers from a low-voltage condition, the ECS must resume normal operation. Applicants should include in the engine installation or operating instructions the time interval associated with this recovery.
(b) Aircraft low power supply condition. These conditions may lead to engine shutdown or an engine condition that is not automatically recoverable. In these cases, the engine should be capable of being restarted. Also, applicants should include in the operating instructions any special flight crew procedures for executing an engine restart during such conditions.
(c) Low voltage transients effects. These transients can be associated with application of electrical loads that could cause an interruption in voltage or a decay in voltage level below that required for proper control functioning. Therefore, the applicant should consider the effects of any aircraft electrical bus-switching transients or power transients in the engine installation or operating instructions.
(2) All engine out restart. During certain aircraft operations, such as low engine speed and in-flight engine restarts, aircraft electrical power is generally used to operate the ECS.
However, operationally, battery power may have to suffice. If battery power is required to meet a low engine speed or “all engine out” restart requirement, the engine applicant should define the battery power requirements and verify them via test. Those power requirements will thereafter, be available to the installer in the engine installation instructions and will ensure that the EECS will generally have sufficient power during any in-flight engine restart(s).
g. Effects on the engine.
(1) Change of control mode. When loss of aircraft power results in a change in engine control mode, the control mode transition must meet the requirements of § 33.28(c).
(2) Acceptable loss of aircraft electrical power. For some engine control functions that rely exclusively upon aircraft-supplied electrical power, the loss of electrical power may still be acceptable. Acceptability is based on evaluation of the change in engine operating characteristics, current experience with similar designs, or the accommodation designed into the control system.
(a) Engine operating characteristics. These are acceptable if the engine is still capable of complying with all of the rules and does not operate in a manner unexpected by the pilot.
(b) Similar designs. Examples include the ignition systems and some performance enhancing systems (see (3) below) that are typically powered by aircraft.
(c) Accommodation. This refers to whether the loss of the function is accommodated by automatic control features that result in an unnoticeable operational change.
(3) Aircraft powered functions. Examples of engine control functions that have traditionally relied on aircraft power include
(a) Engine start and ignition,
(b) Thrust reverser deployment,
(c) Anti-icing (engine probe heat),
(d) Fuel shut-off,
(e) Over-speed protection systems, and
(f) Noncritical functions that are primarily performance enhancement functions that, if inoperative, do not affect the safe operation of the engine.
h. Validation. The applicant should demonstrate the effects of loss of aircraft-supplied electrical power by engine test, system validation test, bench test, or combination thereof.
i. New and novel design concepts. Technological advances in electrical powergenerating components and in the associated systems may allow for new and novel design concepts to meet the requirements of § 33.28(i). For example, dual use alternators or use of an essential battery, are concepts that until recently were not considered successful. Therefore, if an applicant has a new or novel design concept, we recommend contacting the responsible certification office early to develop an appropriate compliance plan.
CHAPTER 12. SECTION 33.28(j) – AIR PRESSURE SIGNAL.
12-1. Rule Text. Section 33.28(j) reads:
“(j) Air Pressure Signal. The applicant must consider the effects of blockage or leakage of the signal lines on the engine control system as part of the System Safety Assessment of paragraph
(e) of this section and must adopt the appropriate design precautions.”
12-2. Guidance: Section 33.28(j) covers ingress of foreign matter (for example, sand, dust, water, or insects) that could result in blockage of the lines and adversely affect engine operation.
Lines used for measuring the static pressure in the compressor of turbine engines can suffer from two predominate failure modes: signal lines are either blocked by frozen water (leading to a loss of power or to failures to detect changes in the engine static pressure) or they fail to open or develop a leak, thereby leading to a loss of power. Each are discussed separately.
a. Signal lines can be blocked by frozen water. We recommend applicants take precautions, such as:
(1) Use of protected openings,
(2) Filters,
(3) Drains for water,
(4) Effective geometry of plumbing to aid in draining,
(5) Appropriate plumbing line inside diameter to aid in draining,
(6) Appropriate bleed hole and drain hole sizing,
(7) Heating the lines to prevent freezing of condensed water, and
(8) Corrosion resistant features.
b. Signal lines can also fail to open or develop a leak. Precautions might in this case, include:
(1) Enhanced support of the plumbing lines to prevent loosening or fracture due to vibration or handling damage during maintenance,
(2) Special design precautions to prevent loosening of the fittings, and
(3) Appropriate plumbing line size for durability.
c. In addressing system failure modes, the applicant should consider both pressure line failure modes in paragraphs a. and b. above independently and in combination.
CHAPTER 13. SECTION 33.28(k) – AUTOMATIC AVAILABILITY AND CONTROL OF ENGINE POWER FOR A 30-SECOND OEI RATING.
13-1. Rule Text. Section 33.28(k) reads:
“(k) Automatic availability and control of engine power for 30-second OEI rating. Rotorcraft engines having a 30-second OEI rating must incorporate means, or a provision for a means, for automatic availability and automatic control of the 30-second OEI power within its operating limitations.”
13-2. Guidance: Using a 30-second OEI rating during flight may create high pilot workload.
Therefore, the rating should be applied and controlled automatically by the ECS, other than to terminate it. Until terminated, the software should automatically prevent the engine from exceeding its limits, specified in the engine's TCDS and associated with this rating. Because the 30-second OEI rating may use almost all the available margin in the engine design, exceeding the rating limits would likely result in engine failure.
a. The required automatic control of the 30-second OEI power should eliminate the need to monitor engine parameters, such as output shaft torque or power, output shaft speed, gas generator speed, and gas path temperatures. This should free the pilot to focus on flying the aircraft. Such means for automatic control within the operating limitations must be effective during normal and abnormal operations.
b. When selected, the means required by § 33.28(k) must automatically govern the engine to its 30-second OEI power rating. The applicant should provide information in it’s installation instructions, on methods to ensure that engine limiter settings do not prevent the engine from reaching the 30-second OEI power. These limiter settings may include engine speed, measured gas temperature and fuel flow. Pay particular attention to take-off conditions with a cold-soaked engine.
CHAPTER 14. SECTION 33.28(L) – ENGINE SHUT DOWN MEANS.
14-1. Rule Text. Section 33.28(l) reads:
“(l) Engine Shut Down Means. Means must be provided for shutting down the engine rapidly.”
14-2. Guidance: Engine shut down means. This requirement is usually met through a fuel shut off valve in the fuel metering system of the engine control. The pilot usually activates the valve via a switch or lever. In some applications, however, the valve is not part of the engine control.
In these cases, the applicant should indicate in the installation manual that a pilot initiated means for rapid shutdown of the engine must be provided by the installer. The engine manufacturer and the installer should coordinate a mutually acceptable means. The issues to be addressed include the acceptability of the valve’s location and response time, its compatibility with the ECS, and the pilot’s capability to rapidly select this function. In addition, the valve may have reliability, environmental, fire, or other requirements.
CHAPTER 15. SECTION 33.28(M) - PROGRAMMABLE LOGIC DEVICES (PLDS).
15-1. Rule Text. Section 33.28(m) reads:
“(m) Programmable logic devices. The development of programmable logic devices using digital logic or other complex design technologies must provide a level of assurance for the encoded logic, which is commensurate with the hazard associated with the failure or malfunction of the systems in which the devices are located. The applicant must design, implement, and verify all associated logic to minimize the existence of errors by using a method, approved by the FAA, that is consistent with the criticality of the performed function.”
15-2. Guidance: Previously, PLDs were the devices of greatest concern in the family of devices complex enough to require additional certification scrutiny. Further, the FAA had not yet recognized RTCA/DO-254 as a method for showing compliance. So, the FAA issued AC 20 152, RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, which limits the scope of the application of DO-254. AC 20-152 remains “current guidance.” However, AC 33.28-1A supplements and reinforces the guidance in AC 20-152, and provides guidance specific to engine controls. Applicants should be aware that the broader scope of AEH, covered by AC 20-152, is verified at the installation level.
a. Objective. Applicants should design their logic to minimize logic errors that would result in an unacceptable effect on power or thrust or in other unsafe conditions. Because of the nature and complexity of systems containing digital logic, the applicant should develop PLDs using a structured development approach. The applicant’s approach must be commensurate with the hazard associated with failure or malfunction of the system in which the digital logic is contained. Applicants may not be able to establish with certainty that their PLD design is without error. However, if the applicant uses the hardware design assurance level appropriate for the criticality of the performed functions and an approved development method, the logic satisfies the requirement to minimize errors.
b. Approved methods. The primary FAA guidance on PLDs is found in AC 20-152.
Addition information can be found in FAA order 8110.105 CHG 1, Simple and Complex Electronic Hardware Approval Guidance. Methods for developing PLDs, compliant with the guidelines of document AC 20-152, are generally acceptable. The applicant may, however, also propose alternative methods for developing PLDs.
c. Level of hardware design assurance.
(1) Determining the appropriate hardware design assurance level depends on failure modes and consequences of those failures. For example, failures resulting in significant thrust or power increases or oscillations may be more severe than an engine shutdown. Therefore, the applicant should consider the possibility of these types of failures when selecting a given hardware design assurance level.
(2) In multiple engine installations, the possibility of digital logic errors common to more than one ECS may determine the criticality of the hardware design assurance level.
However, the FAA has not required dissimilar designs when the PLD is designed as specified in Level A (DO-254).
(3) The criticality of control functions on other aircraft may be different, and therefore, a different level of hardware design assurance may be acceptable. For example, in the case of a reciprocating engine in a single engine aircraft, level C (DO-254) hardware design assurance has been found acceptable.
(4) If the criticality level is higher in subsequent installations, the applicant should meet all the requirements for the higher hardware design assurance level.