AC 33.4-3

U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Instructions for Continued Airworthiness: Aircraft Engine High Intensity Radiated Fields (HIRF) and Lightning Protection Features Date: 02/27/17 Initiated By: ANE-111 AC No: AC 33.4-3 Change: 1

1. Purpose. This advisory circular (AC) change updates the references provided in the original document. The AC change number and the date of the change are shown at the top of each applicable page. The change bar in the left margin indicates where the change is located. The changes described may shift the original text.

2. Principal Changes.

a. Paragraphs 4a and 4b, 5a – 5c, 6d, 8, and 9a reference citations have been updated for currency.

b. Paragraph 5d has been updated to improve clarity.

Page Control Chart Remove Pages Dated Insert Pages Dated 2, 3, 5, and 7 9/16/05 2, 3, 5, and 7 2/27/17

3. Website Availability. To access this AC electronically, go to the AC library at http://www.faa.gov/regulations_policies/advisory_circulars.

U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: INSTRUCTIONS FOR CONTINUED AIRWORTHINESS:

AIRCRAFT ENGINE HIGH INTENSITY

RADIATED FIELDS (HIRF) AND

LIGHTNING PROTECTION FEATURES Date: 9/16/05 Initiated By: ANE-111

AC No: 33.4-3

1. PURPOSE. This advisory circular (AC) provides guidance and acceptable methods, but not the only methods, that may be used to demonstrate compliance for aircraft engines with § 33.4, Instructions for Continued Airworthiness (ICA), of Title 14 of the Code of Federal Regulations. This AC provides guidance for developing ICA to ensure the continued airworthiness of aircraft engine HIRF and lightning protection features.

2. APPLICABILITY.

a. The guidance provided in this document is directed to engine manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) engine type certification engineers and their designees.

b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes an acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “shall,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used.

While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if the FAA becomes aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation as the basis for finding compliance.

c. This material does not change, create any additional, authorize changes in, or permit deviations from existing regulatory requirements.

3. RELATED REGULATIONS.

a. Part 33, §§ 33.4 and 33.28, and Appendix A.

b. Part 121, Subpart L.

AC 33.4-3, Chg 1 2/27/17 2

c. Part 135, Subpart J.

d. Part 25, § 25.1529.

4. RELATED READING MATERIAL.

The following materials are referenced in this document. Unless otherwise dated, you should use the latest revision.

a. FAA Documents.

(1) FSIMS Order 8900.1, Flight Standards Information Management Systems (FSIMS).

(2) AC 20-136, Aircraft Electrical and Electronic System Lightning Protection.

(3) DOT/FAA/AR-04/14, Shield Degradation Effects of Loosened Connector Backshells of Aircraft Wiring Harnesses.

(4) DOT/FAA/AR-04/15, Comparison of Various Impedance Measurement Techniques for Assessing Degradation in Wiring Harness Shield Effectiveness and a Field Survey of FADEC Shield Integrity of In-Service Aircraft.

b. Non-FAA Documents.

(1) SAE ARP5415B, User’s Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning.

(2) SAE ARP5583A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment Superseding.

5. BACKGROUND.

a. Advances in electronic control technology associated with flight critical systems and use of poorly conducting composite materials in aircraft structure have increased concern for the vulnerability of these systems to exposure to HIRF and lightning environments. The lack of specific information on the effects of in-service environmental factors such as corrosion, mechanical vibration, thermal cycling, mechanical damage and repair, and modification on the associated protection features of the type design has also increased concern. The guidance in AC 20-136 emphasizes the need to develop maintenance requirements for aircraft lightning and HIRF protection features. The guidance in FSIMS Order 8900.1, Lightning/High Intensity Radiated Fields (L/HIRF) Protection Maintenance Program ensures that the inspection/maintenance plan used by each operator assures that the HIRF and lightning protection features of the type design are maintained in an airworthy condition.

b. The FAA has an on-going initiative to ensure that the ICA includes appropriate inspection/maintenance functions for engine components that rely on these activities for continued airworthiness. This initiative and an earlier Flight Standards bulletin have revealed

AC 33.4-3, Chg 1 2/27/17 3 that the continued airworthiness of HIRF and lightning protection features depend on maintenance activities. The FSIMS Order 8900.1 relies heavily on the identification of critical systems, the protection features employed in their designs, and the ICA regarding the inspection, maintenance, and possible replacement of all of those features. The appropriate place for these recommendations is in the ICA (specifically, the maintenance, overhaul and component maintenance manuals). Operators may use the ICA, which includes the Inspection Program, when establishing and implementing their FAA approved Continuous Airworthiness Maintenance Programs or other FAA approved inspection/maintenance programs.

c. Although there have not been any inspection/maintenance functions that specifically address the HIRF and lightning protection features of these flight critical engine systems for the FAA to review. Existing overall engine inspection/maintenance functions are in place that ensures the integrity of the HIRF and lightning protection features. These general inspection/maintenance functions have been effective in maintaining the HIRF and lightning protection features in designs that are currently used by industry. This is demonstrated by the 430 million hours (through the first quarter of 2004) of in-service experience on engines with Electronic Engine Control (EEC) systems that have not had any known HIRF and lightning incidents attributed to in-service environmental degradation effects. There have not been any engine problems attributed to the lack of inspection and maintenance of HIRF and lightning protection features. However, in-service surveillance of airplane HIRF and lightning protection features indicates that existing airplane inspection/maintenance functions do not detect some protection degradation. In addition, researchers at Wichita State University have confirmed that without inspection/maintenance some HIRF and lightning protective features may degrade. The FAA Technical Center issued a technical report (DOT/FAA/AR-04/14) in October 2004 about this research (see the reference in paragraph 4a(3) of this AC).

d. FAA and industry committees have developed guidance for inspection/maintenance of aircraft lightning and HIRF protection features. AC 20-136 recommends that the certification applicant develop maintenance requirements for aircraft lightning protection features.

SAE ARP5415B provides additional details and guidelines for lightning protection maintenance.

SAE ARP5583A provides additional details and guidelines for HIRF protection maintenance. In 1999, we published internal guidance that called for review of applicants’ maintenance requirements for aircraft HIRF protection.

e. The following are examples of current inspection/maintenance functions that have played a role in providing good service experience:

(1) Inspection and associated procedures linked to troubleshooting and Line Replaceable Unit removals;

(2) Fault detection or annunciation of electrical system faults through Built-In-Test;

(3) General Visual Inspection associated with scheduled aircraft Zonal Inspection Programs; and

(4) Normally scheduled engine shop visits and specific component shop maintenance associated with periodic maintenance, alteration, or upgrade, soft-time component inspection, or maintenance and repair, when applicable.

f. However, typical inspection/maintenance on aircraft and engines has not always been adequate to ensure the continued airworthiness of HIRF and lightning protection features.

Depending upon the complexity of the protection design used, more specific and validated inspection/maintenance functions may be necessary to ensure the continued airworthiness of protection features in service.

g. Although there have been no known HIRF and lightning incidents attributed to inservice engine environmental degradation effects, there is one known case of an engine flameout attributed to lightning for which an airworthiness directive (AD) was issued. Investigation revealed that the engine flameout occurred because several shields for the cable harness of the EEC were no longer properly grounded to the airframe. This condition, if not corrected, could result in insufficient protection of the EEC. In one case it did lead to an engine flameout following a lightning strike. The service bulletin associated with the AD describes procedures for a visual inspection to verify the integrity of the shield grounds for the cable harness of the EEC and to correct any discrepancy. The service bulletin also describes procedures to measure the electrical resistance of certain shield grounds, and to repair them, if necessary. The repair procedures ensure that the metal overbraid (which provides lightning protection for the EEC cable harness) is electrically bonded to the connector, and that the electrical receptacles are electrically bonded to the airframe. This incident emphasizes the importance of maintaining the continued airworthiness of HIRF and lightning protection features.

6. GENERAL.

a. The engine TC, STC, or ATC applicant developing instructions for continued airworthiness for aircraft engine HIRF and lightning protection should identify the appropriate engine systems and equipment, their associated wiring, and all the protection features used by the type design to meet the engine HIRF and lightning protection requirements. The engine systems and equipment may be identified using criteria in the HIRF and lightning protection guidance, such as AC 20-136, or through functional hazard analyses or system safety analyses. Table 1 in Appendix 1 provides a list of potential problem areas and vulnerabilities that may contribute to degradation of protection and that can be considered when developing the ICA’s.

b. At a minimum, systems whose failure or malfunction could prevent continued safe flight and landing of the aircraft, and for lightning, systems whose failure or malfunction could reduce the capability of the aircraft or the ability of the flight crew to cope with adverse operating conditions, should be identified and specifically addressed during the ICA development. Next, the engine TC, STC, or ATC applicant developing the ICA should define the inspection and test method(s), acceptance criteria, and intervals that apply to these HIRF and lightning protection features. These HIRF and lightning instructions for continued airworthiness should detect degradation of protection features so that the features can be repaired to their original condition.

The scope of these ICA depends on the detailed HIRF and lightning protection design approach of a particular engine model and the criticality of the systems being protected.

AC 33.4-3, Chg 1 2/27/17

c. Of special note is that coordination is required to assure compatibility between the engine’s and the installer’s ICA’s.

d. During design and packaging, consideration should be given to the ICA activities that are to be used. Providing easy access to protection components for checks and troubleshooting would be very helpful. Taking this into account in the design can be an important factor.

7. ICA TASKS—HIRF AND LIGHTNING PROTECTION FEATURES.

a. Inspection and maintenance functions for the HIRF and lightning protection features are an essential factor in the continued airworthiness of the protection features and devices. Results from these ICA inspection/maintenance functions may be used to evaluate the effectiveness of protection features of systems.

b. The engine and equipment HIRF and lightning protection features are typically designed to be effective over the life of the engine or equipment. Laboratory environmental tests for vibration, humidity, temperature, and salt exposure are often conducted on protection elements and equipment, and previous service experience on other aircraft engine models or configurations is typically considered when designing these features.

c. In addition, although findings from certain inspection/maintenance actions may not directly indicate the effectiveness of HIRF and lightning protection features, they may provide indirect indications that show degradation in capability. For example, a visual inspection may discover connector corrosion that would indicate the potential for increased shield bonding resistance. But direct measurement must be used to determine shielding effectiveness.

d. Therefore, the ICA should specify those inspection/maintenance functions necessary to provide a high degree of reliability and continued airworthiness for HIRF and lightning protection features and devices. These inspection/maintenance functions should be included in the inspection program and validated. The results of the inspection program should be used to assess its effectiveness in continuing the product’s compliance with the type design in service.

8. TYPICAL INSPECTION/MAINTENANCE FUNCTION ELEMENTS. The following are some of the common inspection/maintenance function element protection features (SAE ARP5415B and SAE ARP5583A provide more details on HIRF and lightning protection maintenance methods):

a. Detailed bonding resistance measurements are effective in determining changes to connector bonding resistance, panel bonding, or bonding jumper performance. The disadvantage of this method is that additional testing or analysis is required to assess if bonding resistance changes are affecting the overall system HIRF and lightning protection. Bonding resistance on certain components may have more effect on the HIRF and lightning protection than bonding resistance on other components. Also, traditional bonding resistance measurements are not effective for detecting wire shield degradation, particularly for complex wire bundles with many

6 branches and terminations. Advantages of bonding resistance measurements, however, are that they can often be taken during other aircraft/engine maintenance activities and do not require that the aircraft/engine be located at a specific test site.

b. Loop resistance or impedance measurements are effective in determining changes to wire bundle shields and connectors. Loop measurements are particularly good for complex wire bundles. As with bonding resistance measurements, additional testing or analysis is required to assess if loop resistance or impedance changes have any real effect on the overall system HIRF and lightning protection margin. High loop resistance on certain wire bundles may have more effect on the HIRF and lightning protection than high loop resistance on other wire bundles.

Loop resistance or impedance measurements can often be taken during other aircraft/engine maintenance activities, do not require that the aircraft/engine be located at a specific test site, and do not generally require wire bundle disassembly or disconnection. The FAA Technical Center issued a technical report (DOT/FAA/AR-04/15) in October 2004 on research performed at Wichita State University on this topic.

c. In some cases, an applicant may wish to include limited teardown inspections that may be part of the required inspection/maintenance functions. For example, it may be desirable to disassemble selected connectors to detect corrosion or shield termination failure that would not be visible during maintenance inspections.

d. Full aircraft/engine tests specified in the ICA are one method of determining the continued airworthiness of HIRF and lightning protection components or systems. Full aircraft/engine tests include high-level RF tests, low-level swept frequency tests, and low-level direct drive tests. The results of these tests can be directly compared to the original HIRF and lightning certification data. This approach may be used to evaluate adequacy of the inspection/maintenance functions. The disadvantage of full aircraft/engine tests is that these tests may not provide information on the location or extent of individual protection element degradation if that degradation results in compromising the system’s overall integrity. For example, a full aircraft/engine test could indicate unacceptable degradation, but could not be used to identify the cause, such as an individual connector or shield termination. Another disadvantage is that full aircraft/engine tests require highly specialized test equipment and training.

e. Acceptance criteria should be developed for each specified inspection/maintenance task.

If electrical bonding or loop resistance measurements are required, maximum acceptable electrical resistance values should be specified. These maximum acceptable resistance values should be based on the engine HIRF and lightning protection certification tests or analyses.

f. Certain HIRF and lightning protection features may require specific functional tests to determine their continued airworthiness. For example, lightning protection devices such as transient suppression diodes may require specialized test equipment to determine if these protection devices are still functional. These functional tests are sometimes required following aircraft exposure to severe lightning or to a HIRF environment that can result in failure of these protection features without any fault indication.

AC 33.4-3, Chg 1 2/27/17

g. Inspection of protection features within the electronic engine control has been acceptable at intervals when the electronic engine control has been opened for some other reason, such as, repair of a detected internal fault. However, for this to be a valid method, it must be established that this interval is appropriate. It is possible, though not likely, that the interval could take the unit to its end of life (that is, if the EEC is never returned for repair). This approach depends on no introduction of common mode HIRF and lightning failures, common to more than one engine that would invalidate the original system certification. This factor must be shown to be valid.

h. Appendix A of this document provides an example of the calculation of the average system failure rate for a system where there are undetectable failures in some of the system’s lightning strike protective components and those components are only repaired when the unit is undergoing repair for failures of components that are detectable.

9. VALIDATION OF INSPECTION/MAINTENANCE FUNCTIONS AND DETERMINATION OF THEIR EFFECTIVENESS.

a. The extent of validation activity depends on the scope of the engine inspection/maintenance tasks specific to HIRF and lightning protection. If the results from inspection/maintenance tasks do not provide information to determine the effectiveness of the HIRF and lightning protection features, then validation is necessary. For example, visual inspection may be used to determine the continued airworthiness of the wire shielding or raceways; however, validation tasks should be specified to include direct measurements of appropriate protection features to show acceptable capability. SAE ARP5583A and SAE°ARP5415B provide more details on HIRF and lightning protection assurance approaches that may be used to validate the inspection/maintenance functions.

b. If the inspection/maintenance tasks provide a direct measurement of the protection elements, then validation may not be required for these elements. When an engine TC, STC, or ATC applicant has determined that validation is not required, the applicant should document the rationale for this determination and present it to the FAA for concurrence. For example, the applicant may have relevant operating experience gained in the past with the same or similar installations. If the effect of this design experience has already been included in the applicant’s design, the applicant may show that a validation activity is not necessary.

c. The validation activity typically uses a sample of in-service engines. When selecting engines for the sample, the applicant should:

(1) Focus on high operating time and high flight cycle aircraft.

(2) Consider the operating environment for the selected engines, such as extreme temperatures, corrosive environments like salt spray, or other harsh environments.

(3) If applicable, consider the engine installation configurations.

(4) Use more than one engine in the sampling activity. For example, when dealing with engine models with expected fleet sizes that exceed 500 aircraft, an initial sample size of five to ten aircraft and their associated engines is considered adequate.

d. During normal engine maintenance actions, the HIRF and lightning protection features may be affected, which may affect the validation activity. For example, during an engine shop visit for maintenance it may be determined that a harness should be replaced. Replacing the harness prior to validation, however, would alter the data for establishing the deterioration of the shielding effectiveness of the harness with time. The validation activities in the ICA should consider how to account for engine maintenance actions that may affect the HIRF and lightning protection features.

e. Sampling activities are normally scheduled as close to the beginning of heavy maintenance activities as possible to ensure an evaluation of in-service conditions. Sampling, which can be scheduled along with the heavy maintenance activities, typically requires suitable engine accessibility to gain access to HIRF and lightning protection features. Sampling activities scheduled every four to five years for the selected aircraft/engine are adequate.

f. The engine TC, STC, or ATC applicant may set up a separate inspection/maintenance validation activity for individual engine systems, electrical equipment, or electronic engine controls for HIRF and lightning protection features located within equipment that cannot be effectively verified by aircraft/engine tests or equipment in-service acceptance tests.

g. If the engine ICA does not specify tests to determine functionality of HIRF and lightning protection components, such as filters or transient suppression devices based on an assumed reliability of the protection components, then the validation activity could include tests to validate the assumed reliability. This validation activity could also be done by other means, such as failure mode substantiation or field experience.

h. The validation of the inspection/maintenance functions of the ICA should focus on engine HIRF and lightning protection features associated with systems and features whose failure or malfunction could prevent continued safe flight and landing of the aircraft.

//Original signed by FAF on 9/16/05// Fran A. Favara Acting Manager, Engine and Propeller Directorate Aircraft Certification Service

Appendix 1 A1-1 APPENDIX 1. AVERAGE SYSTEM FAILURE RATE.

Note: The following example illustrates calculation of the average system failure rate for a system where there are undetectable failures in some of the system’s lightning strike protective components and those components are only repaired when the unit is undergoing repair for failures of components that are detectable.

1. The subject of using an electronic unit’s mean-time-between-failure (MTBF) for detectable failures as the repair interval for the unit’s undetected failures in the lightning protective components has been receiving increased attention. This appendix presents a simplified Markov model analysis of a basic 2-unit system, such as a full-authority-digital-engine control (FADEC) system. The example shows that the impact of system failures caused by lightning strikes is quite small. The results also show that using the electronic unit’s MTBF for detected failures as the repair interval for undetected failures in the lightning protective components is adequate.

2. Two configurations are analyzed:

(a) The first configuration is a dual channel system where both channels are contained in the same physical unit. In this system, both channel’s lightning protective elements can be inspected and repaired when the unit is opened for repair of detected faults in either channel.

(b) The second configuration is when each channel is contained in its own separate box, in this case, only those lightning protective components in the unit being repaired for a detected fault can be inspected and, if faulty, repaired.

3. In either case, the applicant must include the instructions in the unit’s Component Maintenance Manual that inspection and repair of the protection devices must be carried out in accordance with these assumptions.

4. The analysis assumes that 10 percent of a channel’s components are for lightning protection.

This is a very conservative, high estimate. It is also assumed that 10 percent of the lightning protective components can fail in an undetected state, also a conservative estimate. Thus, one percent of the units MTBF for detectable failure are assumed to result in undetectable failures in the lightning protective components. It is also assumed that the system is approved for timelimited-dispatch (TLD) operation. TLD operation allows the system to be dispatched with one unit known to be inoperative for a specified number of flight hours before repair of the faulty unit is required.

5. In both examples, the average failure rate with respect to lightning strikes is added to the average random component system failure rate to yield an overall average system failure rate.

This average includes the impact of TLD operations. The impact of TLD operations is shown in the following results.

Appendix 1 A1-2 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) The 2-channel system configuration is shown in Figure 1. This figure is meant to show just the redundant electronic elements of the system.

Figure 1. Simplified Diagram of a Redundant 2-Channel System The system is composed of components with a detectable failure rate of R that affect the system’s loss-of-thrust-control (LOTC) rate and of components with an undetectable failure rate of r in the lightning protective components.

Markov Model:

A simplified Markov model of the system is shown in Figure 2. The Markov model includes the following conditions:

1. The system can fail due to random failures in the R components. This is shown by the 1FAIL-LOTC transitions from the P2 and P4 states to the PLOTC state.

2. The system can also fail due to lightning strikes. This is shown by the  transitions from the P3 and P4 states to the PLOTC state.

Appendix 1

A1-3 APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) The model shows the two configurations where both channels are in the same physical unit and where the two channels are contained in separate units.

 When both channels are in the same unit the repair rate () from the P4 state is to the fullup state because any undetected failures in the lightning protective elements in the channel that does not have detected faults will be found and repaired in either channel.

 When each channel is in a separate unit the repair rate  from the P4 state is to the P1 state because undetected faults in the channel that is not being repaired (for detected faults) will not be found and repaired.

Figure 2. Simple Markov Model of 2-channel FADEC system for both channels in a single box and each channel has its own separate box.