2 The interface and reliability requirements needed for the airplane system to meet overall EECS objectives, and 3 System charge level or power requirements and health monitoring requirements to ensure that power or charge level is available, and 4 For battery systems, a requirement to isolate the backup battery system from the engine starting battery system, and 5 For battery systems, a requirement that the battery capacity must allow for engine operation to be maintained in excess of the time required for the primary flight displays.
d. Aircraft-supplied power reliability.
(1) Power reliability values. The applicant should include in the engine installation instructions all aircraft-supplied power reliability values that they used in their system analyses.
This is to ensure that the installer does not violate any of the assumptions in the EECS SSA.
(2) Inclusion of aircraft power effects. Applicants should include in the EECS SSA all events where the aircraft-supplied power is used in any architecture and aircraft power faults or failures can contribute to LOTC/LOPC or hazardous engine effects.
(3) Credit for backup power. Aircraft-supplied power has typically been provided to accommodate the loss of the engine dedicated power source. However, we will review LOTC/LOPC allowance and any impact on the SSA for the use of aircraft-supplied power as the sole power source for an engine control backup system or as a backup power source on a case by-case basis. If the engine control can operate in the presence of aircraft power bus transfers, then the use of aircraft power as a backup may be acceptable.
(4) Without dedicated power source. In some system architectures, compliance with the regulations may not require an engine dedicated power source. Two examples are mixed electronic and hydro-mechanical systems, and EEC systems that could support a critical fly-by wire flight control system. Both are discussed below.
(a) Mixed electronic and hydromechanical systems.
1 These systems consist of a primary electronic single channel and a full capability hydromechanical backup system independent of electrical power. A full capability hydromechanical control system meets all part 33 regulations and does not depend on aircraft power. In this architecture, a loss or interruption of aircraft-supplied power is accommodated by transferring control to the hydromechanical system.
2 Transition from the electronic to the hydromechanical control system is addressed under § 33.28 (c). For these systems, the applicant should show that the transition from the electronic-powered mode to the mechanical control mode can be performed without the aircraft-supplied power and without the occurrence of an LOTC/LOPC.
(b) EECS powered by an aircraft power system that could support a critical fly-by wire flight control system.
1 These systems may be acceptable as the sole source of power for an EECS.
In this example, the engine installation instructions should state that a detailed design review and safety analysis must be conducted to identify latent failures and common cause failures that could result in the loss of all electrical power. The instructions should also state that any emergency power sources must be known to be operational at the beginning of the flight.
2 Any emergency power sources should be isolated from the normal electrical power system so that the emergency power system will be available no matter what happens to the normal generated power system. If batteries are the emergency power source, the applicant should show that the flight crew can determine battery condition prior to flight, and that battery capacity is sufficient to ensure exhaustion will not occur before the airplane lands. This will ensure that appropriate reliability assumptions are provided to the installer.
e. Aircraft-supplied power quality.
(1) Requirements. When aircraft electrical power is necessary for operation of the ECS, the engine installation instructions must contain the ECS’s electrical power supply quality requirements. This applies to any of the configurations listed above or to any new or novel configurations that use aircraft-supplied power. These quality requirements should include steady state and transient under-voltage and over-voltage limits for the equipment. RTCA/DO 160/EUROCAE ED-14 provides additional information on setting power input standards. If used, the applicant should identify any exceptions to the power quality standards cited for the category of equipment specified.
(2) Low voltage transients. We recognize that the electrical or electronic components of the ECS, when operated on aircraft-supplied power, may cease to operate during some low voltage aircraft power supply conditions beyond those required to sustain normal operation.
When the ECS is operating on aircraft-supplied power, if low voltage aircraft power supply conditions are below those required to sustain normal operation, the electrical or electronic components of the ECS may not function as intended. However, during these transients, EECS operation must not per regulation, result in a hazardous engine effect. Further, low voltage transients outside the control system’s declared capability should not:
(a) Cause permanent ECS loss of function, or
(b) Result in inappropriate system operation, or
(c) Cause the engine to exceed any operational limits, or
(d) Cause the transmission of unacceptable erroneous data.
f. Power recovery.
(1) Power recovery from voltage transients does not usually apply to systems powered by ECS dedicated PMA/PMG systems. However, aircraft supplied power does have the potential to have low voltage transient. Impact from these type of transients has been shown to affect ECS using aircraft power for backup power even when they are being powered by a PMA/PMG. The applicant should demonstrate the ECS reaction to aircraft power low voltage transients. The following cases should also be tested if the system could be operating on aircraft power:
(a) Recovery from low voltage. When aircraft power recovers from a low-voltage condition, the ECS must resume normal operation. Applicants should include in the engine installation or operating instructions the time interval associated with this recovery.
(b) Aircraft low power supply condition. These conditions may lead to engine shutdown or an engine condition that is not automatically recoverable. In these cases, the engine should be capable of being restarted. Also, applicants should include in the operating instructions any special flight crew procedures for executing an engine restart during such conditions.
(c) Low voltage transients effects. These transients can be associated with application of electrical loads that could cause an interruption in voltage or a decay in voltage level below that required for proper control functioning. Therefore, the applicant should consider the effects of any aircraft electrical bus-switching transients or power transients in the engine installation or operating instructions.
(2) All engine out restart. During certain aircraft operations, such as low engine speed and in-flight engine restarts, aircraft electrical power is generally used to operate the ECS.
However, operationally, battery power may have to suffice. If battery power is required to meet a low engine speed or “all engine out” restart requirement, the engine applicant should define the battery power requirements and verify them via test. Those power requirements will thereafter, be available to the installer in the engine installation instructions and will ensure that the EECS will generally have sufficient power during any in-flight engine restart(s).
g. Effects on the engine.
(1) Change of control mode. When loss of aircraft power results in a change in engine control mode, the control mode transition must meet the requirements of § 33.28(c).
(2) Acceptable loss of aircraft electrical power. For some engine control functions that rely exclusively upon aircraft-supplied electrical power, the loss of electrical power may still be acceptable. Acceptability is based on evaluation of the change in engine operating characteristics, current experience with similar designs, or the accommodation designed into the control system.
(a) Engine operating characteristics. These are acceptable if the engine is still capable of complying with all of the rules and does not operate in a manner unexpected by the pilot.
(b) Similar designs. Examples include the ignition systems and some performance enhancing systems (see (3) below) that are typically powered by aircraft.
(c) Accommodation. This refers to whether the loss of the function is accommodated by automatic control features that result in an unnoticeable operational change.
(3) Aircraft powered functions. Examples of engine control functions that have traditionally relied on aircraft power include
(a) Engine start and ignition,
(b) Thrust reverser deployment,
(c) Anti-icing (engine probe heat),
(d) Fuel shut-off,
(e) Over-speed protection systems, and
(f) Noncritical functions that are primarily performance enhancement functions that, if inoperative, do not affect the safe operation of the engine.
h. Validation. The applicant should demonstrate the effects of loss of aircraft-supplied electrical power by engine test, system validation test, bench test, or combination thereof.
i. New and novel design concepts. Technological advances in electrical powergenerating components and in the associated systems may allow for new and novel design concepts to meet the requirements of § 33.28(i). For example, dual use alternators or use of an essential battery, are concepts that until recently were not considered successful. Therefore, if an applicant has a new or novel design concept, we recommend contacting the responsible certification office early to develop an appropriate compliance plan.
CHAPTER 12. SECTION 33.28(j) – AIR PRESSURE SIGNAL.
12-1. Rule Text. Section 33.28(j) reads:
“(j) Air Pressure Signal. The applicant must consider the effects of blockage or leakage of the signal lines on the engine control system as part of the System Safety Assessment of paragraph
(e) of this section and must adopt the appropriate design precautions.”
12-2. Guidance: Section 33.28(j) covers ingress of foreign matter (for example, sand, dust, water, or insects) that could result in blockage of the lines and adversely affect engine operation.
Lines used for measuring the static pressure in the compressor of turbine engines can suffer from two predominate failure modes: signal lines are either blocked by frozen water (leading to a loss of power or to failures to detect changes in the engine static pressure) or they fail to open or develop a leak, thereby leading to a loss of power. Each are discussed separately.
a. Signal lines can be blocked by frozen water. We recommend applicants take precautions, such as:
(1) Use of protected openings,
(2) Filters,
(3) Drains for water,
(4) Effective geometry of plumbing to aid in draining,
(5) Appropriate plumbing line inside diameter to aid in draining,
(6) Appropriate bleed hole and drain hole sizing,
(7) Heating the lines to prevent freezing of condensed water, and
(8) Corrosion resistant features.
b. Signal lines can also fail to open or develop a leak. Precautions might in this case, include:
(1) Enhanced support of the plumbing lines to prevent loosening or fracture due to vibration or handling damage during maintenance,
(2) Special design precautions to prevent loosening of the fittings, and
(3) Appropriate plumbing line size for durability.
c. In addressing system failure modes, the applicant should consider both pressure line failure modes in paragraphs a. and b. above independently and in combination.
CHAPTER 13. SECTION 33.28(k) – AUTOMATIC AVAILABILITY AND CONTROL OF ENGINE POWER FOR A 30-SECOND OEI RATING.
13-1. Rule Text. Section 33.28(k) reads:
“(k) Automatic availability and control of engine power for 30-second OEI rating. Rotorcraft engines having a 30-second OEI rating must incorporate means, or a provision for a means, for automatic availability and automatic control of the 30-second OEI power within its operating limitations.”
13-2. Guidance: Using a 30-second OEI rating during flight may create high pilot workload.
Therefore, the rating should be applied and controlled automatically by the ECS, other than to terminate it. Until terminated, the software should automatically prevent the engine from exceeding its limits, specified in the engine's TCDS and associated with this rating. Because the 30-second OEI rating may use almost all the available margin in the engine design, exceeding the rating limits would likely result in engine failure.
a. The required automatic control of the 30-second OEI power should eliminate the need to monitor engine parameters, such as output shaft torque or power, output shaft speed, gas generator speed, and gas path temperatures. This should free the pilot to focus on flying the aircraft. Such means for automatic control within the operating limitations must be effective during normal and abnormal operations.
b. When selected, the means required by § 33.28(k) must automatically govern the engine to its 30-second OEI power rating. The applicant should provide information in it’s installation instructions, on methods to ensure that engine limiter settings do not prevent the engine from reaching the 30-second OEI power. These limiter settings may include engine speed, measured gas temperature and fuel flow. Pay particular attention to take-off conditions with a cold-soaked engine.
CHAPTER 14. SECTION 33.28(L) – ENGINE SHUT DOWN MEANS.
14-1. Rule Text. Section 33.28(l) reads:
“(l) Engine Shut Down Means. Means must be provided for shutting down the engine rapidly.”
14-2. Guidance: Engine shut down means. This requirement is usually met through a fuel shut off valve in the fuel metering system of the engine control. The pilot usually activates the valve via a switch or lever. In some applications, however, the valve is not part of the engine control.
In these cases, the applicant should indicate in the installation manual that a pilot initiated means for rapid shutdown of the engine must be provided by the installer. The engine manufacturer and the installer should coordinate a mutually acceptable means. The issues to be addressed include the acceptability of the valve’s location and response time, its compatibility with the ECS, and the pilot’s capability to rapidly select this function. In addition, the valve may have reliability, environmental, fire, or other requirements.
CHAPTER 15. SECTION 33.28(M) - PROGRAMMABLE LOGIC DEVICES (PLDS).
15-1. Rule Text. Section 33.28(m) reads:
“(m) Programmable logic devices. The development of programmable logic devices using digital logic or other complex design technologies must provide a level of assurance for the encoded logic, which is commensurate with the hazard associated with the failure or malfunction of the systems in which the devices are located. The applicant must design, implement, and verify all associated logic to minimize the existence of errors by using a method, approved by the FAA, that is consistent with the criticality of the performed function.”
15-2. Guidance: Previously, PLDs were the devices of greatest concern in the family of devices complex enough to require additional certification scrutiny. Further, the FAA had not yet recognized RTCA/DO-254 as a method for showing compliance. So, the FAA issued AC 20 152, RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, which limits the scope of the application of DO-254. AC 20-152 remains “current guidance.” However, AC 33.28-1A supplements and reinforces the guidance in AC 20-152, and provides guidance specific to engine controls. Applicants should be aware that the broader scope of AEH, covered by AC 20-152, is verified at the installation level.
a. Objective. Applicants should design their logic to minimize logic errors that would result in an unacceptable effect on power or thrust or in other unsafe conditions. Because of the nature and complexity of systems containing digital logic, the applicant should develop PLDs using a structured development approach. The applicant’s approach must be commensurate with the hazard associated with failure or malfunction of the system in which the digital logic is contained. Applicants may not be able to establish with certainty that their PLD design is without error. However, if the applicant uses the hardware design assurance level appropriate for the criticality of the performed functions and an approved development method, the logic satisfies the requirement to minimize errors.
b. Approved methods. The primary FAA guidance on PLDs is found in AC 20-152.
Addition information can be found in FAA order 8110.105 CHG 1, Simple and Complex Electronic Hardware Approval Guidance. Methods for developing PLDs, compliant with the guidelines of document AC 20-152, are generally acceptable. The applicant may, however, also propose alternative methods for developing PLDs.
c. Level of hardware design assurance.
(1) Determining the appropriate hardware design assurance level depends on failure modes and consequences of those failures. For example, failures resulting in significant thrust or power increases or oscillations may be more severe than an engine shutdown. Therefore, the applicant should consider the possibility of these types of failures when selecting a given hardware design assurance level.
(2) In multiple engine installations, the possibility of digital logic errors common to more than one ECS may determine the criticality of the hardware design assurance level.
However, the FAA has not required dissimilar designs when the PLD is designed as specified in Level A (DO-254).
(3) The criticality of control functions on other aircraft may be different, and therefore, a different level of hardware design assurance may be acceptable. For example, in the case of a reciprocating engine in a single engine aircraft, level C (DO-254) hardware design assurance has been found acceptable.
(4) If the criticality level is higher in subsequent installations, the applicant should meet all the requirements for the higher hardware design assurance level.
CHAPTER 16. OTHER CONSIDERATIONS: ENGINE, PROPELLER, AND AIRCRAFT
SYSTEMS INTEGRATION AND RELATIONSHIPS BETWEEN ENGINE,
PROPELLER, AND AIRCRAFT CERTIFICATION ACTIVITIES
16-1. Systems Integration.
a. Two forms of systems integration are discussed. First, aircraft or propeller functions integrated into EECS hardware and software, and second, integrating engine functions into aircraft systems. One version of systems integration involves the integration of aircraft or propeller functions (i.e. those that have traditionally not been considered engine control functions) into the EECS hardware and software. The other version involves aircraft systems performing functions traditionally considered part of the ECS. These are addressed in paragraphs
(2)(a) and (2)(b), respectively, below.
b. We encourage applicants with highly integrated systems to develop an EEC System Integration Certification Plan (SICP). A SICP should identify the tasks unique to integration.
You should include in it’s SICP a clear definition of the respective certification tasks of the engine, propeller, and aircraft manufacturers. The applicant should also develop it’s plan during close coordination with the associated engine, propeller, and aircraft certification authorities. The SICP may provide valuable information to the installer and should be provided to the installer for their use. It may address the following types of integration:
(1) Aircraft or propeller functions integrated into the ECS or EECS.
(a) Examples of aircraft or propeller functions integrated into the ECS include thrust reverser control systems, propeller speed governors, ATTCS, and APR System. When integrating aircraft or propeller functions into the ECS, the EECS failure cases related to the integration need to be included in the Aircraft Level SSA by the installer. Although aircraft functions incorporated into the ECS may be reviewed at engine certification, the acceptability of the safety analysis involving these functions will be determined at aircraft certification.
(b) The EECS may be configured to contain parts or all of the aircraft system’s functionality. Thrust reverser control systems are an example of including only part of the functionality in the EECS. In those control systems, the aircraft is configured with separate switches and logic (i.e., independent from the EECS) as part of the thrust reverser control system. This separation of reverser control system elements and logic provides an architectural means to limit the criticality of the functions provided by the EECS.
(c) One example of configuring the ECS to contain all functionality of an aircraft system: an ECS designed to fully govern propeller speed in turboprop aircraft. Here, the engine applicant may need to configure the ECS logic to feather a propeller when an engine fails.
Failure of the prop to feather may result in catastrophic aircraft failure as the result of excessive drag. Another example is an ATTCS or APR in turbofan aircraft. If an engine fails during takeoff, the engine applicant may need to configure the logic to increase the thrust of the remaining engine(s). Both examples indicate that criticality is not limited, since ECS failure 55
could result in loss of aircraft. Both examples also involve aircraft functionality that would receive significant review during aircraft certification.
(d) When functions like these are integrated into the ECS so that they render an ECS critical, the applicant should ensure that no single failure (including common cause/mode) could cause the critical failure condition. For example, exposing the EECS to overheat should not cause both an engine shutdown and failure of the propeller to feather.
(2) Integration of engine control functions into aircraft systems.
(a) Applicants may use aircraft systems to implement a significant number of ECS functions. For example, integrated flight and ECSs, such as those integrated into avionics, may be used to govern engine speed, and in helicopters, rotor speed, rotor pitch angle, and rotor tilt angle. A special case of this type of implementation is via an Integrated Modular Avionics system as defined in RTCA/DO-297. Implementation of a FADEC in an Integrated Modular Avionics system will require special considerations. The engine applicant needs to coordinate this with the Engine and Propeller Directorate. In these examples, we may require aircraft systems be used during engine certification. If so, then the engine applicant should specify the EECS requirements in the engine installation instructions and show that those EECS requirements are adequate to protect the engine from any hazardous engine effects.
(b) An example of limited integration is an engine control that receives a torque output demand signal from the aircraft and responds by changing the engine’s fuel flow and other variables to meet that demand. Then the EECS, which is part of the type design, provides all the functionality required to safely operate the engine as required by part 33 or other applicable specifications.
16-2. Certification Activities.
a. Engine certification. All hardware and software that reside on the engine, including those that provide aircraft or propeller functions, must meet the requirements of §§ 33.28(b), (f),
(g) and (m). This should include environmental testing of all components and software, and quality assurance of the software that performs both the engine and aircraft functions. The EECS SSA and other analyses (aircraft power, fault accommodation, etc.) that the engine applicant submits for engine certification, should address only engine functions performed by the EECS.
The aircraft and propeller functions do not need to be evaluated in the EECS SSA unless the functions affect engine operation or reliability.
b. Aircraft or propeller certification.
(1) The aircraft or propeller certification program should include all hardware and software substantiation requirements for the hardware and software that reside on the aircraft or propeller, including those that perform engine control functions. The applicant should also include environmental testing of all components and software, and quality assurance of the software that performs both engine and airplane functions.
(2) To satisfy aircraft requirements, such as §§ XX.901, XX.903 and XX.1309, the applicant should analyze the consequences to the aircraft of ECS failures. Together with the aircraft applicant, the engine applicant should ensure that the ECS software and AEH levels and safety and reliability objectives are consistent with aircraft certification requirements.
c. Interface Definition and System Responsibilities.
(1) The applicant should identify in the appropriate documents, e.g., EEC SICP or an Interface Control Document (ICD), the system responsibilities as well as interface definitions for the functions, the hardware and the software. These interfaces are typically between the engine, propeller, and aircraft systems.
(2) The engine, propeller, and aircraft documents should include:
(a) Requirements and categorization of the severity of the effects of a failure condition (that may be based on engine, propeller, and aircraft considerations),
(b) Fault accommodation strategies,
(c) Maintenance strategies,
(d) The software and airborne electronic hardware levels (per function if necessary), and
(e) The reliability objectives for:
1 LOTC/LOPC and MPL events, and 2 Transmission of faulty parameters.
(f) The environmental requirements including the degree of protection against lightning or other electromagnetic effects (for example, level of induced voltages that can be supported at the interfaces),
(g) Engine, propeller, and aircraft interface data and characteristics, and
(h) Aircraft power supply requirements and characteristics (if relevant).
d. Distribution of compliance tasks. Engine, propeller, and aircraft applicants often share aircraft propulsion system certification tasks. This is particularly true for aircraft propulsion systems equipped with electronic controls. Therefore, applicants sharing aircraft propulsion system certification tasks should identify how these tasks are distributed between themselves.
They should also include this distribution in their compliance plan(s). For example, the EEC SICP should list each task related to the EECS certification, identifying what each applicant should accomplish. The plan should likewise, address all analyses and tests required for EECS certification, also identifying what each applicant should accomplish. The appropriate engine, 57