Submitted Document Major Sections AC Chapter Reference Part 33 Section Number Plan for Software Aspects of Certification (ref. RTCA/DO-178C) NOTE: Applicants should prepare all remaining Software 9 33.28(g) Software Configuration Index (ref. RTCA/DO-178C) Design Assurance documents as specified in RTCA/DO 9 33.28(g) Software Accomplishment Summary (ref. RTCA/DO-178C) 178B and have them on file and available for FAA audit.
9 33.28(g) Aircraft-Supplied Data Analysis Design Assessment Validation 10 33.28(h) Aircraft-Supplied Power Analysis Design Architecture Analysis Validation 11 33.28(i) Air Pressure Signals Analysis Design Analysis 12 33.28(j) Plan for Hardware Aspects of Certification (ref. RTCA/DO-254) NOTE: Applicants should prepare all remaining 15 33.28(m) Hardware Configuration Management Records (ref.
RTCA/DO-254) Hardware Design Assurance documents as specified in RTCA/DO-254 and have them 15 33.28(m) Hardware Accomplishment Summary (ref. RTCA/DO-254) on file and available for FAA audit.
15 33.28(m) EEC System Integration Certification Plan (SICP) (if applicable) Distribution of Compliance Tasks Interface Definition & Other Data Design Change Control 16 33.28 A2-2
APPENDIX 3. RECIPROCATING ENGINE EECS SSAs A reliability and safety analysis can show that the applicant’s system design meets its intended purpose. Two key terms that are used when evaluating system safety are “single-fault tolerant” and “unsafe condition.” Refer to chapter 11 of this AC for a discussion of ECS failures and, in particular, the subject of single-fault tolerance.
a. Unsafe condition. Engine power loss events are not typically considered unsafe conditions when evaluating airplane safety. However, if the frequency of these events is excessive relative to the safety objectives of the intended application, then they may be considered unsafe conditions. Consequently, engine power losses and shutdowns are included in the following failure conditions and categories that are considered unsafe conditions for reciprocating engines:
(1) Destructive events (DE).
(2) Excessive number of LOPC events.
(3) Excessive number of MPL events.
b. Continued operations
(1) Section 33.28 does not specifically address continued operations when faults are present in the EECS. However, service experience indicates that to be economically feasible, EECS-equipped engines must be permitted to operate for limited time periods with faults present in the system (that is, permitted to operate in a degraded state). In addition, a thorough system safety analysis includes all the components of the control system, including the mechanical components.
(2) To address these issues as well as meet the intent of the rule, the FAA has developed a method for demonstrating compliance for reciprocating engines that allows for operation with certain faults (that is, in a degraded state). This method consists of an ECS safety analysis with both quantitative and qualitative elements. The quantitative element compares the predicted number of failure events of the electrical or electronic components, with established criteria that represents unsafe conditions. Both full-up and degraded configurations are evaluated, but those degraded system configurations that are found acceptable are limited to 20 hours of operation. Mechanical component reliability is evaluated through the test and analyses required by §§ 33.19, 33.49, and 33.53. The qualitative elements provide an evaluation of the entire ECS.
(3) Instead of addressing all forms and levels of safety analyses, the FAA has developed a method for demonstrating compliance that meets the intent of § 33.28(e) and ensures an acceptable level of safety. The applicant may use a different method of showing A3-4
compliance. Alternative methods should be presented to the FAA for review and approval as early in the project as possible.
(4) The applicant may submit an EECS SSA to comply with § 33.28. The method of showing compliance described in this appendix allows for FAA approval of time-limited flight operations with certain reciprocating engine EECS faults. We derived a time limit of 20 hours from the unsafe condition criteria established for a degraded EECS. This 20 hour limit ensures that the engine maintains an acceptable reliability level during this type of operation.
c. EECS SSA: General. The EECS SSA includes a quantitative element that is intended to evaluate the predicted reliability of the components of the EECS, and to compare it to the system safety criteria included in this AC. The EECS SSA also includes a qualitative element that provides an evaluation of certain aspects of the EECS.
(1) The EECS SSA quantitative analysis will determine the instantaneous failure event rates in both the full-up system and degraded system. These event rates are then compared to the unsafe condition criteria for both full-up and degraded systems. The quantitative analysis may consist of the following analyses:
(a) Numerical FTA,
(b) FMEA, and
(c) Markov or similar type of analysis to evaluate the EEC system in a degraded condition.
(2) The EECS SSA qualitative analysis consists of design appraisals of certain aspects of the EECS. The qualitative analyses may include the following reports:
(a) Alternate control mode(s) characteristics,
(b) Control mode transition (refer to Chapter 5 of this AC),
(c) EECS output data content,
(d) Existing subsystems,
(e) Local events test or analysis (refer to Chapter 6 of this AC), and
(f) Commercial, automotive, or industrial grade electronic parts analysis (refer to Chapter 6 of this AC).
d. EECS SSA assumptions. The applicant should include in the EECS SSA, an explanation of any assumptions it made regarding airplane installation and operating conditions.
The applicant’s assumptions should be consistent with it’s data in the ICAs and the engine installation or operating instructions. The applicant’s assumptions may include the following:
A3-2
(1) Maintenance actions and associated intervals,
(2) Airplane systems or equipment response,
(3) Powerplant installation design and environment, and
(4) Latent failure exposure period.
e. EECS SSA quantitative analysis. The quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgment and experience. In general, the depth and scope of an acceptable safety analysis depend on the complexity and criticality of the functions performed by the system, and can vary considerably for different types of systems. Because this analysis is limited to reciprocating engine electronic control systems, the criteria provided in this appendix are more specific. The quantitative analysis should encompass all elements of the control system: electrical or electronic, and mechanical.
(1) EECS SSA safety criteria. This appendix provides safety criteria, expressed in terms of events per million hours, for full-up and degraded configurations. The applicant may propose different criteria. However, if the applicant does so, the applicant should show that it’s different criteria provide an equally effective method of meeting the safety criteria.
(a) The safety criteria is provided for each of the two typical reciprocating engine control subsystems (fuel and ignition), and also for any other subsystem. This accommodates varying degrees of system functionality by increasing the allowable failure event rates as subsystems or functions are added to the total system definition. Once the total number of subsystems is defined and the associated maximum failure event rates are calculated, the applicant’s failure rates should be allocated across the total system and not to the individual subsystems. The failure event rates of tables A3-1 and A3-2 are consistent with FAA safety objectives for reciprocating engines.
(2) Full-up system analysis methods. The applicant may use this analysis to confirm that the full-up system meets the system safety criteria specified in table A3-1. We recommend that the applicant performs a numerical FTA and an FMEA, and that the applicant includes all engine parts in each.
(a) Each of the system elements in table A3-1 is additive. “Other” applies to each subsystem. For example, an EECS comprised of fuel, ignition, and wastegate control functions should meet a total system reliability of 15+15+15= 45 LOPC events per million hours (and 450 MPL events per million hours). This criteria is then applied to the entire system and not allocated to each of the subsystems.
(b) The applicant should limit the maximums to 45 LOPC and 450 MPL events per million hours, regardless of the number of subsystems. For example, if the EECS includes more than three subsystems, the sum of the LOPC rates for the total system should not exceed 45 A3-3
LOPC or 450 MPL events per million hours for all of the electrical and electronic elements.
Finally, the applicant should apply the event rates in table A3-1 to the highest appropriate system or subsystem level and not to individual components of the same system.
(3) Degraded system analysis methods and criteria. The applicant may use this analysis to confirm that the degraded system meets the system safety criteria of table A3-2 with existing fault(s), or with time limited operations. If the existing fault(s) does not affect engine operability and the criteria of table A3-2 are met, then Time-Limited Operations (TLO) may be approved for these fault conditions. The analysis determines the instantaneous failure rate with one or more failures in the system. A Markov analysis, or channel failure analysis for simple systems, may be used.
f. Time-limited operations (TLO) implementation requirements. The EEC SSA should include the following:
(1) The applicant should group all EECS faults into one of the following three operating limitations categories:
(a) No take-off (NTO). Faults in this category preclude departure. These faults are total system faults that result in calculated event rates that exceed the degraded system limits, or when the total system has insufficient resources to properly operate the engine. These system faults are defined as NTO faults.
(b) TLO. TLO faults permit operations up to 20 hours, and preclude them thereafter. These faults are also system faults that result in calculated event rates that exceed the full-up system limits but which are less than the degraded system limits. Also, the system LOPC and MPL rates are not generally greater than 450 and 4500 events per million flight hours, respectively. These system faults are defined as TLO faults.
(c) Unlimited operation (ULO). ULO faults are system faults where the calculated event rates are less than the full-up system limits (this may also apply to degraded system with certain minor faults).
(2) The applicant should ensure that its EECS design provides separate cockpit indications for TLO faults and NTO faults, such as:
(a) Indicator lights, codes, etc., and
(b) Confirmation of indicator function during the pre-flight check.
A3-4
(3) The applicant should also specify engine airworthiness and operating limitations for TLO faults, NTO faults, and ULO faults, in the TCDS and STC limitations sections, the Instructions for Continued Airworthiness Limitations Section, and the Engine installation and/or operating instructions. The applicant should also include maintenance actions information associated with EECS faults in the troubleshooting procedures of the engine maintenance manual.
(4) The installer should publish limitations in the Airplane Flight Manual or Pilot Operating Handbook.
TABLE A3-1. Full-Up System Safety Criteria. Electrical or Electronic Components (Events per Million Hours) Subsystem Maximum Total System Maximum Failure Condition Ignition Fuel Other System Destructive Event <0.001 <0.001 <0.001 <0.003 LOPC 15 15 15 45 MPL 150 150 150 450 No Effect (i.e., the fault does not affect the LOPC or MPL rate)
- - TABLE A3-2. Degraded System Safety Criteria. Electrical or Electronic Components (Events per Million Hours) Subsystem Maximum Total System Maximum Failure Condition Ignition Fuel Other System Destructive Event <0.001 <0.001 <0.001 <0.003 LOPC 150 150 150 450 MPL 1500 1500 1500 4500 No Effect - - A3-5
g. EECS SSA qualitative analysis. Your Qualitative analysis should include the mechanical, electrical, and electronic components. It should also include the following sections:
(1) Alternate control mode analysis. Refer to Chapter 5 of this AC for guidance on alternate mode analysis.
(3) EECS output data analysis. The applicant’s reciprocating engine EECS SSA should include information about faults or failures that could cause the transmission of faulty or drifting engine parameters to aircraft systems. It should also include a prediction of the rates of occurrence of those faults or failures. The following engine output parameters are examples of parameters that this analysis could address:
(a) Oil pressure,
(b) Engine speed,
(c) Manifold pressure,
(d) Cylinder head temperature,
(e) Turbine inlet temperature,
(f) Exhaust gas temperature,
(g) Calculated engine power parameters (horsepower or torque, etc.),
(h) Combustion pressure, and
(i) Engine detonation (sometimes called knock).
(4) Existing subsystems analysis. The applicant’s reciprocating engine EECS SSA should include an evaluation of the functional interaction of any existing mechanical control system elements that remain on the engine after incorporation of the EECS or subsystem. The existing subsystems analysis should:
(a) Analyze existing mechanical subsystems such as carburetors, magneto ignition, turbo mechanical wastegates, and mechanical fuel injection,
(b) Identify interface and installation requirements related to existing mechanical systems or components, and
(c) Analyze the effects on the EECS of failures of these mechanical systems.
(5) Local events analysis. Refer to Chapter 6 of this AC for guidance on Local Event Analysis.
A3-7
(6) Guidance for use of commercial or industrial grade electronic parts. Refer to Chapter 6 of this AC for guidance on Commercial and Industrial Grade Electronic Parts analysis.
A3-2
APPENDIX 4. RELATED REFERENCES The following references are related to this AC:
A4-1. Related Regulations in 14 CFR. Sections 23.901, 23.903, 23.909, 23.1309, 25.901,
25.903, 25.939, 25.1181, 25.1309, 27.901, 27.903, 27.1309, 29.901, 29.903, 29.1309, 33.4, 33.5,
33.17, 33.19, 33.27, 33.29, 33.35, 33.49, 33.53, 33.65, 33.66, 33.67, 33.69, 33.73, 33.75, 33.91, and Appendix A of part 33.
A4-2. FAA ACs, Orders, & Policy. Use latest revision available.
AC 20-115C, RTCA, Inc. Document RTCA/DO-178C, July 19, 2013.
AC 20-136B, Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning, September 7, 2011.
AC 20-152, RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, June 30, 2005.
AC 20-158, The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment, July 30, 2007.
AC 20-174, Development of Civil Aircraft and Systems, September 30, 2011.
AC 21-16G, RTCA, Inc. Document RTCA/DO-160 versions D, E, F, and G, Environmental Conditions and Test Procedures for Airborne Equipment, June 22, 2011.
AC 33-2B Aircraft Engine Type Certification Handbook, June 30, 1993.
AC 33.4-3, Instructions For Continued Airworthiness; Aircraft Engine High Intensity Radiated Fields (HIRF) And Lightning Protection Features, September 16, 2005.
AC 33.17-1A, Engine Fire Protection § 33.17, August 3, 2009.
AC 33.91-1, Engine System and Component Tests, December 9, 2010.
AC 20-171, Alternatives to RTCA/DO-178B for Software in Airborne Systems and Equipment, January 19. 2011.
A4-3. The following Orders and Policy are referenced for completeness and are not requirements for the applicants showing of compliance.
a. FAA Orders and Policy
Order 8110.49 CHG 1, Software Approval Guidelines, September 28, 2011.
A5-1
Order 8110.105 CHG 1, Simple and Complex Electronic Hardware Approval Guidance, September 23, 2008.
Policy Memorandum, PS-ANE100-2001-1993-33.28TLD-R1, Policy for Time Limited Dispatch (TLD) of Engines Fitted with Full Authority Digital Engine Controls (FADEC) Systems, June 29, 2001.
Policy Letter PL-45, Time Limited Dispatch (TLD) Authorization for Full Authority Digital Electronic Control (FADEC) Engines, Rev 2, March 4, 2004 (available at http://www.opspecs.com/).
Policy Memorandum, PS-ACE100-2004-10024, Installation of Electronic Engine Control for Reciprocating Engine, November 18, 2004.
b. European Aviation Safety Agency (EASA) Orders and Policy.
Advisory, AMC 20-115B, General Acceptable Means of Compliance for Airworthiness of Products, Parts and Appliances, Recognition of Eurocae ED-12B/RTCA/DO-178B, November 5, 2003.
A4-4 Industry Documents .
a. International Electrotechnical Commission (IEC) Documents.
IEC/TS 62239-1, Process Management for Avionics – Preparation of an Electronic Components Management Plan, 2012-07.
IEC/TR 62240-1, Process Management for Avionics – Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, First edition 2005-06.
b. RTCA Documents.
RTCA/DO-178A, Software Considerations in Airborne Systems and Equipment Certification, March 22, 1985.
RTCA/DO-178B/EUROCAE ED-12B, Software Considerations in Airborne Systems and Equipment Certification, December 1992.
RTCA/DO-178C/EUROCAE ED-12C, Software Considerations in Airborne Systems and Equipment Certification, December 13, 2011.
RTCA DO-330, Software Tool Qualification Considerations, December 13, 2011.
RTCA DO-331, Model-Based Development and Verification Supplement to DO 178C and DO-278A, December 13, 2011.
A5-2
RTCA DO-332, Object-Oriented Technology and Related Techniques Supplement to DO-178C and DO-278A, December 13, 2011.
RTCA DO-333, Formal Methods Supplement to DO-178C and DO-278A, December 13, 2011.
RTCA/DO-254/EUROCAE ED-80, Design Assurance Guidance for Airborne Electronic Hardware, April 19, 2000/April 2000.
RTCA/DO-160G/EUROCAE ED-14G, Environmental Conditions and Test Procedures for Airborne Equipment, December 8, 2010/May 2011.
c. SAE International Documents.
SAE ARP4754A, Guidelines for Development of Civil Aircraft and Systems, December 21, 2010.
SAE ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, December 1996.
SAE ARP5107B, Guidelines for Time Limited Dispatch (TLD) Analysis for Electronic Engine Control Systems, November 15, 2006.
SAE ARP5415A, Users Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning, February 16, 2008.
SAE ARP5416A, Aircraft Lightning Test Methods, January 7, 2013.
SAE ARP5583, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment, June 4, 2010.
SAE ARP5757, Guidelines for Engine Component Tests, March 2008.
SAE ARP5890A, Guidelines for Preparing Reliability Assessment Plans for Electronic Engine Controls, February 3, 2011.
A4-5 Military Specifications .
MIL-STD-461E, Requirements for the Control of Electromagnetic Interference Characteristics, August 20, 1999.
MIL-STD-810G, Test Method Standard for Environmental Engineering Considerations and Laboratory Tests, October 31, 2008.
MIL-E-5007D, Engines, Aircraft, Turbojet and Turbofan, General Specification For, December 27, 1995.
A5-3
A4-6. Reference Addresses. The following addresses are provided to aid in accessing some of the reference documents.
EASA: www.easa.eu.int.
FAA: www.faa.gov.
IEC: IEC, Central Office, 3, rue de Varembé, P.O. Box 131, CH - 1211 GENEVA 20, Switzerland. They are also available online at www.iec.org.
RTCA: RTCA, Inc. 1150 18th Street, NW, Suite 910, Washington, DC 20036. Also available online at www.rtca.org.
SAE: SAE World Headquarters, 400 Commonwealth Drive, Warrendale, PA 15096 0001 USA. Also available online at www.rtca.org .
EUROCAE: EUROCAE, 102, rue Etienne Dolet, 92240 Malakoff, France. Also available online at www.eurocae.net.
Military Specifications: Available online at http://dodssp.daps.dla.mil A5-4