CHAPTER 2. SECTION 33.28(a) - APPLICABILITY.
2-1. Rule Text. Section 33.28(a) reads:
“(a) Applicability. These requirements are applicable to any system or device that is part of engine type design, that controls, limits, or monitors engine operation, and is necessary for the continued airworthiness of the engine.”
2-2. Guidance: Applicability.
a. Section 33.28 applies to all types of engine control systems, including any of the following ECS types:
(1) Hydromechanical (except for those systems on reciprocating engines that are adequately covered through § 33.35 and § 33.37),
(2) Hydromechanical with a limited authority electronic supervisor,
(3) Single-channel full-authority electronic engine control with hydromechanical backup,
(4) Dual-channel full-authority EEC without backup,
(5) Three-channel full authority EEC (or 2 channels plus a voter), or
(6) Any other ECS combination.
b. The ECS includes all equipment necessary for controlling the engine and ensuring safe operation of the engine within its limits, as specified in § 33.28. Many components, including electronic control units, variable-geometry actuators, cables, wires, sensors, overspeed, overtorque, and over-temperature protection systems, fuel racks, and fuel metering units, are part of the ECS. Some engine monitoring systems are physically or functionally integrated with the ECS. These systems are considered part of the ECS if they:
(1) Perform functions that affect engine safety,
(2) Are used in the context of continued-operation, or
(3) Are used in return-to-service decisions.
For example, low-cycle fatigue counters for engine critical parts, as well as some trend monitors and devices that provide information for maintenance are part of the ECS.
Some components, such as a throttle position transducer, might be mounted in the aircraft and are not part of the engine type design, but they are dedicated to the ECS and powered by it. Such elements are integral components of the ECS.
2-3. Excluded elements. Some elements are excluded from the ECS. For example, fuel pumps, even though often engine-mounted and integrated with the fuel metering unit, are not part of the ECS. They are part of the fuel delivery system. Demand-control pumps, however, are, or can be, a fuel controlling or limiting element of the system and are considered part of the ECS.
Any other engine overspeed design features that are purely mechanical, such as rotor interference, or fuel cutoff methods through rotor axial movement, are not part of the ECS. For example, overspeed protection via blade shedding is purely mechanical protection, so blade shedding is not part of the ECS.
CHAPTER 3. SECTION 33.28(b)(1) - VALIDATION.
3-1. Rule Text. Section 33.28(b)(1) reads:
“(b) Validation.—(1) Functional Aspects. The applicant must substantiate by tests, analysis, or a combination thereof, that the engine control system performs the intended functions in a manner which:
(i ) Enables selected values of relevant control parameters to be maintained and the engine kept within the approved operating limits over changing atmospheric conditions in the declared flight envelope;
(ii) Complies with the operability requirements of §§ 33.51, 33.65 and 33.73, as appropriate, under all likely system inputs and allowable engine power or thrust demands, unless it can be demonstrated that this is not required for non-dispatchable specific control modes in the intended application;
(iii) Allows modulation of engine power or thrust with adequate sensitivity over the declared range of engine operating conditions; and
(iv) Does not create unacceptable power or thrust oscillations.”
3-2. Guidance: Validation.
a. The EECS can only perform its intended function if its software is successfully integrated with the control. Accordingly, the applicant should conduct testing to demonstrate successful integration of the EEC system software and the ECS. The applicant should perform this testing either on a complete engine or on a test rig that simulates the ECS.
b. The applicant may use Aerospace Recommended Practice (ARP) 4754A, Guidelines/or Development of Civil Aircraft and Systems, as an acceptable method for establishing a development assurance process. SAE ARP 4754A discusses the development of aircraft and systems taking into account the overall aircraft operating environment and functions. This includes validation of requirements and verification of the design implementation for certification and process assurance. Refer to AC20-174 for further understanding of the applicability of the ARP.
c. The specific exclusion for non-dispatchable modes in § 33.28(b)(1)(ii) is to create the opportunity to maintain engine operation, even if limited, to support a “get home” configuration.
d. When evaluating adequate sensitivity in compliance with § 33.28(b)(1)(iii), the applicant should consider two additional aspects of power or thrust modulation. First, the power or thrust setting regions should be void of any inversions. Second, flats, or “no response” regions, in the power or thrust setting implementation, other than at the ends of range, are undesirable, except for positions that represent fixed power settings like maximum climb or cruise power. The applicant should also show that increasing the power lever settings in the 6
cockpit, results in the engine thrust or power output increases. The applicant should show that it has a continuous (no discontinuities) positive relationship (no inversions, such that increasing forward throttle movement results in decreasing thrust or power), unless it shows that in special applications, safety is enhanced by deviating from this relationship. Any deviation approved under Part 33 will also have to be approved at the aircraft installation (Part 23/25/27/29) level and therefore close coordination with the engine installer will be required to ensure the acceptability of any deviation granted.
e. For ECSs that have a governing mode for power turbine speed, § 33.28(b)(1)(iii) refers to the ability to manage engine power to maintain power turbine speed within specified limits.
f. Chapter 6 further discusses power and thrust oscillations.
CHAPTER 4. SECTION 33.28(b)(2) – ENVIRONMENTAL LIMITS.
4-1. Rule Text. Section 33.28(b)(2) reads:
“(2) Environmental limits. The applicant must demonstrate, when complying with §§ 33.53 or
33.91, that the engine control system functionality will not be adversely affected by declared environmental conditions, including electromagnetic interference (EMI), High Intensity Radiated Fields (HIRF), and lightning. The limits to which the system has been qualified must be documented in the engine installation instructions.”
4-2. Guidance: Environmental conditions include temperature, vibration, humidity, EMI, HIRF and lightning. The environmental condition requirements are addressed under §§ 33.53 and
33.91. Although we do not specify the test limits, the conditions the applicant declares should represent environments that engine installers and operators would encounter
a. Environmental test procedures and test limits. AC 21-16G and SAE ARP5757 provide further guidance on showing compliance with §§ 33.53, 33.91, and 33.28. This AC recommends SAE ARP5757 in combination with RTCA/DO-160G for testing, but you may use MIL-STD-810 when the tests are equal to, or more rigorous than, those defined in RTCA/DO 160G. As RTCA/DO-160 is very likely to be revised beyond revision G during the life of this AC, we encourage applicants to coordinate with the certification office before using a more recent revision of RTCA/DO-160. Unlike RTCA/DO-160G, however, we recommend performing a minimum of 10 temperature cycles for temperature variation tests. We also recommend applicants recognize that installers will use AC 20-136B and AC20-158 to show lightning and HIRF compliance, respectively, for the engine installation in the aircraft.
b. Radio frequency (RF) emission test procedures and test limits. The procedures and limits in MIL-STD-461 or RTCA/DO-160G Section 21 are acceptable.
c. HIRF and lightning tests. Aircraft HIRF compliance regulations are found in §§ 23.1308, 25.1317, 27.1317, and 29.1317. FAA guidance on HIRF compliance is found in AC
20-158. Aircraft lightning compliance regulations are found in §§ 23.1306, 25.1316, 27.1316, and 29.1316. FAA guidance on system lightning compliance is found in AC 20-136B.
(1) Test levels. Engine and aircraft applicants should select the HIRF and lightning test levels for the ECS. Applicants should select these test levels so that the EECS, when installed, meets aircraft certification regulations. If the applicant wants to claim any credit for HIRF and lightning testing, and if the applicant wants this claim shown on the TCDS or the IOI, the applicant must have successfully completed the ECS HIRF and lightning tests. The engine applicant should use the DO-160 section 20 and 22 categories and waveform sets defined in 4 2d(1)(c) of this AC if HIRF and lightning test levels have not been determined for a specific aircraft engine installation. Hardware or software design changes implemented after initial environmental testing should be evaluated for their effects with respect to electromagnetic compatibility (EMC), HIRF and lightning.
(a) Engine and aircraft manufacturers typically determine HIRF and lightning test levels through lightning transient and HIRF attenuation characterization tests. These tests are typically conducted on the aircraft with engines installed. If the HIRF and lightning test levels for the engine installation on a particular aircraft are not known at engine certification, the engine applicant may use the test levels in paragraphs 4-2d(1)(c) through 4-2d(1)(e) below. The aircraft applicant should confirm the compatibility of the engine test levels and the lightning transient characterization and HIRF attenuation tests with engines installed prior to aircraft certification. If these assumed test levels used for engine certification are not adequate for a particular aircraft installation, the engine applicant may need to conduct additional ECS HIRF and lightning tests or analysis.
(b) The engine installation or operating instructions should specify any wire shields, connectors, or terminations, and any electrical bonding, for HIRF and lightning protection that are required when the engine is installed. The applicant should perform the HIRF and lightning tests with the same shielding and electrical bonding configuration specified in the engine installation or operating instructions.
(c) HIRF minimum levels. The following table identifies the minimum system laboratory HIRF RF susceptibility test standards for EECS:
RTCA/DO-160G Categories Conducted Radiated
CW & SW Modulation Radiated Pulse Modulation Fixed-Wing Airplanes with Turbine Engines Cat W (150 mA) Cat W (100 V/m) Cat D (up to 750 V/m) Rotorcraft (all engine types) Cat W (150 mA) Cat Y (200 V/m) Cat F (up to 1500 V/m) Reciprocating Engine Intended for use with Propellers (Note 1) Cat W (150 mA) Cat W (100 V/m) Cat D (up to 750 V/m) Fuselage-Mounted Turbofan Engine Intended for use on Part23 Airplanes (Note 2) Cat Y (300 mA) 100 MHz to 400 MHz – Cat G (100 V/m) 400MHz to 18GHz – Cat F (up to 150V/m) Cat F (up to 1500 V/m) Note 1: Using these HIRF test levels and the design requirements in paragraph (e) below, reciprocating engines with EECSs intended for use on propeller-driven Part 23 airplanes should be acceptable without further airplane HIRF testing.
Note 2: Using these HIRF test levels and the design requirements in paragraph (e) below, turbofan engines with EECSs intended to be fuselage-mounted on part 23 airplanes should be acceptable without further HIRF testing.
(d) Lightning levels. The applicant should test the EECS using the minimum levels for system laboratory lightning tests specified in RTCA/DO-160G Section 22 Level 3 for cable bundle injection tests and pin injection tests. The waveform set that includes single-stroke, multiple-stroke, and multiple-burst waveforms for shielded wire bundles should be Category A3J3L3 in RTCA/DO-160G Section 22. The applicant should not use series impedance during the pin injection tests (RTCA/DO-160G Section 22.5.1.h) unless the remote load impedance is in a component included as part of the engine or the remote load impedance is specified in the engine installation instructions.
(e) Alternate lightning levels for reciprocating engines with EECS and intended for use with propellers, or fuselage-mounted turbofan engine intended for use on Part 23 airplanes.
Electronic engine control systems for these types of engine installations are normally subject to very high lightning transients when lightning attaches to the propeller or engine inlet. Using the lightning design and test requirements below, reciprocating engines with EECS intended for use on small propeller-driven airplanes or fuselage-mounted turbofan engines intended for use on Part 23 airplanes, should be acceptable for airplane installation without further airplane lightning tests. The reciprocating engine minimum system lightning test levels should be RTCA/DO 160G, Section 22 and Category A3H3L3 for unshielded wire bundles. Lightning commonly strikes the propeller on airplanes with propellers. This results in all lightning current directly conducted on the engine, and a large portion of the current on ECS wiring. Lightning strikes to turbofan engines result in current conducted on the engine cowls and fairings, so typically a smaller portion of the lightning current is conducted on the ECS wiring. The fuselage-mounted turbofan engine minimum system lightning test levels should be RTCA/DO-160G Section 22 and Category B3H3L3 for unshielded wire bundles. These waveform sets includes single-stroke, multiple-stroke, and multiple-burst waveforms in RTCA/DO-160G Section 22. Engine applicants should ensure that the ECS tests, design, and the engine installation or operating instructions required by § 33.28 and § 33.5 meet the following requirements:
1 Lightning test setup. Use the test setup found in RTCA/DO-160G section
22.3. Perform the cable bundle injection test with the all EECS wire bundle shields disconnected.
This will ensure that the transients are injected directly onto the wires. Do not use series impedance during the pin injection tests (RTCA/DO-160G Section 22.5.1.h), unless the remote load impedance is in a component included as part of the certified engine or the remote load impedance is specified in the engine installation instructions.
2 Wire bundle shields. Install overbraid shields on all wire bundles between EECS components and from EECS components to the airplane. The shields should cover power and signal wires and their returns, and have low resistance and high-optical coverage. An overbraid shield may enclose an entire wire bundle, or multiple overbraid shields may be used over groups of wires within a bundle. For fuselage-mounted turbofan engines, install additional overbraid shields on each wire bundle where the bundle is routed outside the airplane fuselage to the engine. Each shield must be terminated to each connector. Shield terminations must be very short, preferably using backshells with zero length shield terminations. The connector shells and backshells must provide a very low resistance to the engine components, EECS, and airplane firewall or structure. Features required for electrically bonding the connectors to the airplane 10
firewall or structure, such as surface preparation, must be specified in the engine installation or operating instructions.
3 Engine bonding jumpers. Include at least three electrical bonding jumpers between the engine and the engine mounting frame. The bonding jumpers must be flat braided wire or flat solid conductors, with at least 16 mm2 conducting cross section, and less than 30 cm long. Specify the maximum bonding jumper length and minimum conducting cross section in the engine installation manual. Define the maximum allowed resistance between the engine, engine mounting frame, and airframe in the engine installation or operating instructions. Provide a lowresistance conducting path from the engine to the airframe.
4 Electronic engine control systems electrical bonding. Specify the maximum allowed electrical bonding resistance between EECS components and the surface they are mounted on in the engine installation or operating instructions. For example, specify the maximum allowed resistance between the component and the airframe or firewall to which it is attached. Also, include any special features required for this electrical bonding in the engine installation or operating instructions, such as surface preparation and or bonding jumpers.
5 Power and signal returns. You should not use the engine or engine mounting frame for power returns or low-power signal returns.
(2) Test procedures. The EECS used for the lightning and HIRF tests should include sensors, actuators, and engine and engine-aircraft interface wire bundles. Use the HIRF and lightning test procedures provided in RTCA/DO-160G/EUROCAE ED-14G Sections 20 and 22.
However, the test procedures defined in RTCA/DO-160G/EUROCAE ED-14G Sections 20 and 22 are oriented to equipment tests. Therefore, adapt those test procedures to develop the system level HIRF test, the test the applicant will use to show compliance with §§ 33.53 and 33.91.
(a) Additional guidance on system level HIRF tests may be found in SAE ARP5583A.
(b) SAE ARP5415A and ARP5416A provide guidance on system level lightning tests.
(3) Open loop and closed loop testing. Conduct HIRF and lightning tests on the ECS operating in closed loop or open loop control. The closed loop set-up is usually powered to move actuators to close the inner actuating loops. The applicant may use a simplified engine simulation to close the outer engine loop. The applicant should conduct the HIRF and lightning tests with the ECS controlling at the most sensitive operating point, as selected and detailed in the applicant’s test plans. The reference to ‘the most sensitive operating point’ is in relationship to schedule sensitivity. We are suggesting that the set point not be where controlling schedules are on flat portions of the schedules. The system should be exposed to the HIRF and lightning environments while operating at the selected condition. HIRF and lightning environments may have different most sensitive operating points.
(4) Test considerations.
(a) If special ECS test software is embedded in the target for EMC, HIRF or 11
lightning testing, the applicant must ensure that the software was developed and implemented by guidelines defined for software levels of at least Level 2 in DO-178A, Level C in DO-178B, Level C in DO-178C, or equivalent. In some cases, the applicants modify the application code to include the required test code features.
(b) The test must be capable of monitoring both the output drive signals and the input signals.
(c) The applicant must duplicate all anomalies observed on inputs or outputs during open loop testing to enable the test to show compliance with the following pass/fail criteria. The applicant must perform this duplication on the engine simulation to determine whether the resulting power or thrust perturbations comply with the §§ 33.53 and 33.91 test pass/fail criteria.
(5) Pass/fail criteria. To comply with §§ 33.53 and 33.91, the HIRF and lightning tests must cause no adverse effects on the functionality of the ECS. The following are adverse effects:
(a) For turbine engines: a change greater than 3% of most sensitive operating point or 1% of take-off power or thrust, whichever is greater, for a period of more than 2 seconds.
(b) For reciprocating engines: a change greater than 10% of power at the operating point for a period of more than 2 seconds.
(c) Transfers to alternate channels, backup systems, or alternate modes.
(d) Component damage. Certain protection components, such as transient suppression diodes, may experience failures that are not detected by post-test automatic test plan (ATP), and must be checked with specific test procedures.
(e) False annunciation to the crew that could cause unnecessary or inappropriate crew action.
(f) Erroneous operation of protection systems, such as over-speed or thrust reverser circuits.
(6) Engine applicants should ensure that the ECS design and the engine installation or operating instructions required by § 33.28 and § 33.5, specify the following protection features:
(a) The engine and EECS are installed in an airplane with engine cowls and a firewall that incorporate electrically conducting materials. The conducting materials may be aluminum, copper, steel or carbon fiber composites, and may include thin metal foil or mesh incorporated into nonconducting composites. The EECS should be installed either under the conducting cowl or on an airframe that uses structure with similar conducting materials.
(b) Required wire shielding and connectors for wire bundles that connect the EECS to airplane systems are specified in the engine installation or operating instructions. The required wire shielding and connectors should be used during the HIRF tests.
(c) Electrical bonding requirements for the engine and EECS are specified in the engine installation or operating instructions.
e. Maintenance actions.
(1) Section 33.4 requires that the applicant prepare Instructions for Continued Airworthiness (ICA). Instructions for Continuing Airworthiness generally include a maintenance plan. The applicant should provide a maintenance plan for any protection system that is part of the type design of the ECS, and that is required to meet the qualified levels of EMC, HIRF and lightning. The plan is used to ensure the continued airworthiness for the parts of the installed system supplied by the engine type certificate holder. AC 33.4-3 provides information related to the ICA, aircraft engine HIRF, and lightning protection.
(2) Consider including periodic inspections or tests for required structural shielding, wire shields, connectors, and equipment protection components, in the ICAs. Also consider inspections or tests when the part is exposed. The applicant should also show that the maintenance actions introduced by its plan are effective in maintaining the engine’s continued airworthiness.
f. Time-limited dispatch environmental tests. Time-Limited Dispatch (TLD) is an optional requirement. If the applicant conducts EMC, HIRF and lightning tests for TLD, we recommend that the testing be done with other tests at certification. Refer to paragraph 7.c. of the Policy Memorandum, PS-ANE100-2001-1993-33.28TLD-R1, for the TLD requirements related to environmental compliance.
CHAPTER 5 - SECTION 33.28(c) – CONTROL TRANSITIONS.
5-1. Rule Text. Section 33.28(c) reads:
“c. Control Transitions. (1) The applicant must demonstrate that, when fault or failure results in a change from one control mode to another, from one channel to another, or from the primary system to the backup system, the change occurs so that:
(i) The engine does not exceed any of its operating limitations,
(ii) The engine does not surge, stall, or experience unacceptable thrust or power changes or oscillations or other unacceptable characteristics; and
(iii) There is a means to alert the flight crew if the crew is required to initiate, respond to, or be aware of the control mode change. The means to alert the crew must be described in the engine installation instructions, and the crew action must be described in the engine operating instructions;
(2) The magnitude of any change in thrust or power and the associated transition time must be identified and described in the engine installation instructions and the engine operating instructions.”
5-2. Guidance: Control Transitions.
a. General.
(1) In the showing of compliance to § 33.28(c)(1), the applicant should perform all necessary testing and analysis to ensure that all control modes, including those that occur as a result of control fault accommodation strategies, are implemented as required.
(2) The applicant should show that all declared dispatchable control modes are capable of performing their intended functions in the environmental conditions, including but not limited to EMI, HIRF and lightning, declared in the engine installation instructions.
(3) The need to provide protective functions, such as over-speed protection, for all control modes, including any alternate modes, must be reviewed under the requirements of § 33.28(d), (e), and (f) and § 33.75.
(4) The above applies to the ECS operating in any dispatchable configuration.
(5) The applicant must show that any limitations on operations in alternate modes are clearly stated in the engine installation and operating instructions.
(6) The applicant should provide in the engine installation and operating instructions a description of the ECS operating in its primary and alternate modes.
(7) The applicant should use analyses, or testing, or both, to show that changing to, and operating in, alternate modes has no unacceptable effect on engine durability or endurance. This should not be interpreted as the need to run multiple §33.87 endurance tests. Short segments of testing in combination with analysis may be sufficient for showing of compliance.
(8) The applicant should demonstrate the durability and reliability of the control system in all modes, primarily through the engine system and component testing of §§ 33.53 and
33.91. Performing some portion of the engine certification testing in the alternate mode(s) and during transition between modes can be used as part of the system validation required under § 33.28(b)(1).
(9) Engine test considerations.
(a) The engine certification tests defined in part 33, Subparts D and F, are often performed using only the ECS’s primary mode. If the applicant requests approval for dispatch in an alternate mode under TLD, then the applicant must demonstrate that the engine can meet the defined test-success criteria in any alternate mode that is proposed as a dispatchable configuration. If a configuration is to be dispatchable, then that mode should be demonstrated to operate in all foreseeable environmental conditions. This demonstration may use analysis or test and should include capabilities such as operability in rain or hail or bird ingestion.
(b) Some capabilities, such as operability in rain or hail or bird ingestion, may be lost in some control modes that are not dispatchable. Modes that are not dispatchable do not require engine test demonstration as long as the engine installation and operating instructions reflect this loss of capability.
(10) Availability. Applicants should demonstrate through testing or monitoring, that any backup mode will be available when needed. The applicant should document in the ICA the minimum frequency of inspection or testing needed to ensure its availability.
b. Crew training modes. As part of the System Safety Assessment of 33.28(e), applicants should assess crew training modes. These modes are usually installation, and possibly operator specific and need to be negotiated on a case-by-case basis. For example, one common application of crew training modes is simulation of the ‘fail-fixed’ mode on a twin-engine rotorcraft. The applicant must describe training modes in the engine installation and operating instructions as appropriate. Also, the applicant must take precautions in the design of the ECS and its crew interfaces to prevent inadvertent entry into any training modes. The applicant must assess crew-training modes, including lockout systems.
c. Non-dispatchable configurations and modes.
(1) For control configurations that are not dispatchable, but for which the applicant seeks to take credit in the system LOTC/LOPC analysis (this analysis and the LOTC/LOPC concept are covered in full in Chapter 6 below), specific operating limitations may be acceptable.
This means that the system will not be charged with an LOTC/LOPC event when the fault is covered by a backup means that allows the system to continue to function safely. The system, 15