U.S. Department of Transportation Federal Aviation Administration
Advisory Circular
Subject: Guidance Material for 14 CFR § 35.23, Propeller Control System Date: 10/21/11 Initiated by: ANE-110 AC No: AC 35.23-1 Change:
1. Purpose. This advisory circular (AC) provides definitions and guidance for demonstrating compliance with the propeller control system requirements of Title 14 of the Code of Federal Regulations (14 CFR 35.23).
2. Applicability.
a. The guidance provided in this document is directed to propeller manufacturers, modifiers, and foreign regulatory authorities.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “shall,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if the FAA becomes aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation as the basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from existing regulatory requirements.
3. Related Reference Material.
a. Relevant Regulations. 14 CFR 23.901, 23.905, 23.1309, 25.901, 25.905, 25.1309, 33.19,
35.3, 35.4, 35.15, 35.21, 35.23, 35.42, 35.43, and Appendix A of part 35.
b. FAA Documents.
(1) AC 20-115B, titled “RTCA Inc., Document RTCA/DO-178B”; dated January 11, 1993.
(2) AC 20-136A, titled “Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning”; dated December 21, 2006.
(3) AC 20-152, titled “RTCA Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware”; dated June 30, 2005.
(4) AC 20-158, titled “The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment”; dated July 30, 2007.
(5) AC 21-16F, titled “RTCA, Inc. Document RTCA/DO-160F, Environmental Conditions and Test Procedures for Airborne Equipment”; dated December 20, 2005.
(6) AC 23.1309-1D, titled “Equipment, Systems, and Installations in Part 23 Airplanes”;
dated January 16, 2009.
(7) AC 25.1309-1A, titled “System Design and Analysis”; dated June 6, 1988.
(8) AC 35-1, titled “Certification of Propellers”; dated December 29, 2008.
(9) FAA Order 8110.49, titled “Software Approval Guidelines”; dated June 2, 2003.
(10) FAA Order 8110.105 CHG 1, titled “Simple and Complex Electronic Hardware Approval Guidance”; dated September 23, 2008.
c. European Aviation Safety Agency (EASA).
(1) AMC 20-115B, titled “General Acceptable Means of Compliance for Airworthiness of Products, Parts and Appliances, Recognition of EUROCAE ED-12B/RTCA DO-178B”; dated November 5, 2003.
(2) EASA Certification Specifications for Propellers (CS-P) Amendment 1; dated November 16, 2006.
d. Industry Documents.
(1) International Engineering Consortium (IEC).
(a) IEC/TS 62239, titled “Process Management for Avionics – Preparation of an Electronic Components Management Plan”, dated First edition 2003-05.
(b) IEC/TR 62240, titled “Process Managem ent for Avionics - Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges”, dated First edition 2005-06.
(2) RTCA Documents.
(a) RTCA DO-178B/EUROCAE ED-12B, titled “Software Considerations in Airborne Systems and Equipment Certification”; dated December 1992.
(b) RTCA DO-254/EUROCAE ED-80, titled “Design Assurance Guidance for Airborne Electronic Hardware”; dated April 19, 2000/April 2000.
(c) RTCA DO-160F/EUROCAE ED-14F, titled “Environmental Conditions and Test Procedures for Airborne Equipment”; dated December 6, 2007/March 2008.
(3) SAE International.
(a) SAE ARP5107A, titled “Guidelines for Time Limited Dispatch (TLD) Analysis for Electronic Engine Control Systems”; dated January 2005.
(b) SAE ARP5415A, titled “Users Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning”; dated May 2002.
(c) SAE ARP5416, titled “Aircraft Lightning Test Methods”; dated March 2005/April 2005.
(d) SAE ARP5583, titled “Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment”; dated January 2003.
(e) SAE ARP5757, titled “Guidelines for Engine Component Tests”; dated March 2008.
(f) SAE ARP5890, titled “Guidelines for Preparing Reliability Assessment Plans for Electronic Engine Controls”; dated November 2002.
e. Military Specifications.
(1) MIL-STD-461E, titled “Requirements for the Control of Electromagnetic Interference Characteristics”; dated August 20, 1999.
(2) MIL-STD-810E, titled “Test Method Standard for Environmental Engineering”; dated July 14, 1989.
(3) MIL-STD-810F, titled “Test Method Standard for Environmental Engineering”; dated January 1, 2000.
(4) MIL-E-5007E, titled “Engines, Aircraft, Turbojet and Turbofan, General Specification For”; dated Septem ber 1, 1983.
f. Reference Addresses. The following addresses are provided to aid in accessing some of the reference documents. The addresses are subject to change.
(1) EASA documents may be available online at: http://www.easa.eu.int.
(2) FAA documents may be available online at: http://ecfr.gpoaccess.gov for parts 23, 25, 33, and 35 of Title 14 of the Code of Federal Regulations (14 CFR), and http://www.faa.gov/regulations_policies/ for Advisory Circulars and Orders.
(3) IEC documents are available at: IEC, Central Office, 3, rue de Varembé, P.O. Box 131, CH - 1211 GENEVA 20, Switzerland. They may be available online at:
http://www.iec.org.
(4) MIL STD documents may be available online at: http://www.dtc.army.mil.
(5) RTCA documents are available at: RTCA, Inc. 1828 L Street, NW, Suite 805, Washington, DC 20036 or EUROCAE, 17, rue Hamelin, 75116, Paris, France. They may be available online at: http://www.rtca.org or http://www.eurocae.org.
(6) SAE documents are available at: SAE, 400 Commonwealth Drive, Warrendale, PA 15096-0001 USA or EUROCAE, 102, rue Etienne Dolet, 92240, Malakoff, France. They may be available online at: http://www.sae.org.
4. Definitions. For the purposes of this AC, the following definitions apply:
a. Airplane-supplied data. Any data supplied by or via airplane systems and used by the engine or propeller control system. Engine-supplied data is a subset of airplane-supplied data.
b. Airplane-supplied electrical power. Any electrical power supplied by or via airplane systems and used by the engine or propeller control system. Engine-supplied power is a subset of airplane-supplied power.
c. Airborne Electronic Hardware (AEH). (As defined in RTCA DO-254) includes line replaceable units, circuit board assemblies, application specific integrated circuits, programmable logic devices, etc.
d. Alternate mode. Any control mode that is not the primary mode.
e. Analysis and assessment. The two terms are, to some extent, interchangeable. However, “analysis” generally implies a specific and detailed evaluation, while “assessment” implies a general or broader evaluation that may include one or more types of analysis. In practice, the distinction comes from the specific application (for example, functional hazard analysis (FHA), fault tree analysis (FTA), Markov analysis, or preliminary system safety assessment (PSSA)).
f. Back-up mode. The back-up system control mode. The alternate channel in a dual channel electronic control system with identical channels is not a back-up mode. Any additional back-up means provided, differing from the two channels, are back-up modes under the definition.
g. Back-up system. A part of the engine or propeller control system where the operating characteristics or capabilities of the propeller control are sufficiently different from the primary system that the operating characteristics or capabilities of the airplane, crew workload, or what constitutes appropriate crew procedures may be significantly impacted or changed.
h. Control mode. Each defined operational state of the propeller control system in which the crew can exercise satisfactory propeller control.
i. Covered fault. A fault that is detected and accommodated.
j. Dedicated power source. A dedicated power source is defined as an electric power source that provides electrical power generated and supplied solely for use by a single propeller control system.
k. Dispatchable Configuration. All control system configurations approved for dispatch.
l. Electronic propeller control system (EPCS). A propeller control system in which the primary functions are provided using electronics. It includes all the components (for example, electrical, electronic, hydro-mechanical and pneumatic) necessary for the control of the propeller and may incorporate other control functions where desired. Components of the system provided by the installer may be considered part of the system.
m. Engine control system (ECS). Any system or device that controls, limits, or monitors engine operation.
n. Engine-supplied data. All data supplied by or via engine systems and used by the EPCS.
Engine-supplied data is a subset of airplane-supplied data.
o. Error. An omission or incorrect action by a person, a mistake in requirements, design or implementation. An error may result in a failure, but an error is not a failure in and of itself.
p. Failure condition. A condition with direct, consequential propeller-level effects caused or contributed to by one or more failures.
q. Failure mode. The cause of the failure or the manner in which an item or function can fail.
Examples include failures due to corrosion or fatigue, opens and shorts in circuits, and malfunctions of electronic components.
r. Fault (or) failure. A condition where the operation of a component, part, or element can no longer function as intended, including loss of function.
s. Fault (or) failure accommodation. The capability to mitigate, in either full or in part, the effects of a fault or failure.
t. Full authority digital engine control (FADEC). An engine control system in which the primary functions use digital electronics and the electronic engine control (EEC) unit has fullrange authority over the engine power or thrust. A FADEC may incorporate the propeller control functions.
u. Full-up configuration. An EPCS that has no known faults or failures present.
v. Local events. These are failures of airplane systems and components, other than the EPCS, that may affect the installed environment of the EPCS.
w. Primary mode. The mode for controlling the propeller under normal operation; often referred to as the ‘normal mode.’
x. Primary system. The part of the engine or propeller control system normally used for controlling the engine or propeller operation.
y. Programmable logic device (PLD). An electronic component that is altered to perform an installation specific function. PLDs include, but are not limited to, programmable array logic (PAL) components, general array logic (GAL) components, field programmable gate array (FPGA) components, and erasable programmable logic devices (EPLDs). These devices are a subset of AEH.
z. Propeller control system. Any system or device within the propeller system that controls, limits, or monitors propeller operation and is necessary for the continued airworthiness of the propeller. An EPCS is a subset of a propeller control system.
aa. Redundancy. Multiple independent methods incorporated within a system to accomplish a given function.
bb. Uncovered fault. A fault or failure for which either no detection mechanism exists or, if detected, no accommodation exists.
5. Background.
a. The purpose of § 35.23 is to set requirements for the general design and function of the propeller control system. These requirements do not replace or supersede other requirements.
Therefore, individual components of the control system, such as pumps, sensors, and actuators, should also be addressed in other paragraphs of part 35, such as § 35.42 Components of the propeller control system, and § 35.43 Propeller hydraulic components, as appropriate. Also, § 35.21 Variable and reversible pitch propellers, and § 35.22 Feathering propellers provide specific requirements for propellers that provide these features.
b. W hen part 35 was updated to amendment 8, changes were also made to parts 23, 25 and
33. Sections 23.905(d), 25.905(c), and 33.19(d) were modified to assure that propeller control systems included in the airplane or engine type design are subjected to equivalent requirements.
The specific part 35 requirements are §§ 35.21, 35.23, 35.42 and 35.43. These requirements are applicable to an airplane or engine as follows:
(1) The propeller control system requirements are applicable when new propeller controls are included in an airplane or engine type certificate (TC), amended TC or supplemental type certificate (STC).
(2) The propeller control system requirements are not applicable when a certified propeller is installed on a new or amended airplane TC or an STC and propeller control system has not changed.
c. The development of electronic technology and, in particular, digital electronic technology, for controlling constant speed propellers is relatively recent in commercial aviation history. In the past, an EPCS typically consisted of a mechanical governor that used electronic motors, instead of hydraulic or mechanical means, to drive pitch change actuation. Today, an EPCS normally consists of digital electronic control components that use software, electronic circuitry, and electro-hydraulic actuators to control the propeller. Today’s EPCS often incorporate additional functions such as failure monitoring, synchrophasing and beta scheduling. This addition of electronics to the control system may introduce new failure modes that can result in hazardous propeller effects. Therefore, although this AC is applicable to all propeller control systems, the majority of the guidance provided in this AC is associated with EPCSs since they are much more susceptible to environmental effects, rely on airplane supplied power and data, and require software or AEH.
6. Section 35.23 - General.
a. One of the objectives for the propeller manufacturer in a propeller certification program is to show that the certificated propeller is "installable" in a particular airplane or airplane type.
Parts 23 and 25 provide regulations for the installation of a certificated propeller into an airplane.
The installed propeller becomes a part of the powerplant system. These regulations require the powerplant system design meet all the requirements, procedures, limitations, and assumptions specified in the propeller installation or operating instructions and the propeller type certificate data sheet (TCDS) or STC. We recognize that the determination of compliance of the propeller control system with applicable airplane certification regulations will only be made during airplane certification. As part of the airplane certification program, the FAA may require flighttesting to fully evaluate the propeller performance and operability characteristics for all operating modes relating to the applicable airplane certification regulations. When the airplane application is unknown at the time of propeller certification, the propeller manufacturer should make a reasonable installation and operational assumptions for the target application. Any installation limitations or operational issues must be noted in the propeller installation or operating instructions and/or the TCDS.
b. Propeller and airplane manufacturers should coordinate with the relevant authorities.
c. W hen it is known or expected that airplane components, which are not part of the propeller type design, will contribute to or cause the failure conditions being evaluated in a part 35 safety analysis, the maximum allowable contribution from those additional airframe/engine components should be accounted for, both within the part 35 safety analysis and the installation limitations and instructions to assure the propeller will be installable. When the airplane installation is known the propeller manufacturer and the airplane manufacturer should coordinate with each other, and with the appropriate FAA certification offices to set propeller control system failure rates acceptable to the FAA for airplane certification.
d. The severity of propeller control system malfunctions increases with the complexity of the control and the range of pitch change permitted by the propeller control system. Most single engine general aviation airplanes use a control system with mechanical high and low pitch stops that limit pitch control failures to these mechanical stops. These stops are typically set to a failsafe pitch. However, these control systems do not permit reverse thrust or feathering. When the control system introduces reverse thrust and feathering, the range of permissible pitch increases from about 10 to 40 degree limits to about -15 to 90 degree limits with an in-flight low pitch stop of about 10 degrees. For all propellers, flight operation below the in-flight low pitch stop is hazardous. Section 35.21, Variable and reversible pitch propellers, provides additional requirements to prevent operation below the in-flight pitch position. With mechanical stops, some of the failures considered are the structural failure of the stop, miss-assembly of the stop, or improper setting of the stop. With reversing and feathering systems the control system typically involves a control mode transition from flight forward thrust operation to ground taxi and reverse thrust operation. In addition, the control design must prevent hazardous unintended travel below the in-flight low pitch stop.
7. Section 35.23 - Applicability.
a. The regulation applies to all types of propeller control systems. These might be mechanical, hydro-mechanical, hydro-mechanical with a limited authority electronic supervisor, single channel full authority propeller control with hydro-mechanical back-up, or dual channel full authority electronic propeller control or any other combination. The electronic technology can be analog or digital.
b. This guidance applies to propeller certification for designs ranging from applications used on single reciprocating engine airplanes certified under part 23 to those used on multi-engine transport airplanes certified under part 25.
c. This guidance applies to primary propeller control of pitch and rotational speed as well as other functions, such as syncrophasing control, which may be integrated into the system for noise abatement, vibration abatement, or both.
d. Although this AC is applicable to all propeller control systems, the majority of the guidance provided in this AC is associated with EPCS, since they are much more susceptible to environmental effects, may rely on airplane supplied power and data, and require software or AEH.
8. Section 35.23(a)(1) – Control Modes and Transitions.
a. General.
(1) The applicant should perform all necessary testing and analysis to ensure that all control modes function as intended.
(2) The primary or normal mode includes all control functions designed for the intended control of the propeller. These control functions may include governing, beta control, feathering, and the transitions between the various primary mode control functions. Operation in an alternate mode occurs for failure accommodation when propeller control moves from the primary mode to an alternate or back-up mode.
(3) The applicant should describe the functioning of the propeller control system in its primary and any alternate modes in the propeller instructions for installation and operation. The applicant should also clearly state any limitations on operations in alternate modes in this manual.
(4) Analyses, testing, or both are necessary to substantiate that transferring operation to alternate modes has no unacceptable effect on propeller durability or endurance. The applicant may demonstrate the durability and reliability of the control system in all modes by component testing. Performing some portion of the propeller testing in the alternate mode(s) and during transition between modes can be used as part of the system validation.
(5) All dispatchable control modes should be declared. If the applicant wants to dispatch with the propeller in an alternate mode, all relevant subsequent single failures must be considered and demonstrate no threat to continued safe flight and landing. All declared dispatchable control modes should perform their intended functions in the environmental conditions, including but not limited to, high intensity radiated fields (HIRF) and lightning, declared in the propeller instructions for installation.
b. Propeller Test Considerations.
(1) The applicant may use the propeller endurance test and functional tests defined in §§ 35.39 and 35.41 using the primary full-up control system. The applicant, however, should demonstrate by test and/or analysis based on test, that the propeller can meet the defined criteria when operating in any alternative or back-up control mode. Adding some portion to the propeller endurance test and functional test in the alternate or back-up mode(s), including transition between modes, can be used as part of system validation, if desired. The component testing of § 35.42 addresses the durability of the control system.
(2) If the applicant performs propeller certification tests using only the propeller control system’s primary mode in the full-up configuration, and is requesting approval for dispatch in the alternate mode, then the applicant should demonstrate by analysis, test, or both, the propeller 9
can m eet the defined test success criteria when operating in any alternate mode that is proposed as a dispatchable configuration.
(3) Capabilities may be lost in some control modes that are not dispatchable. These modes do not require propeller test demonstration under the adverse conditions for which they have lost capabilities as long as the installation instructions reflect this loss of capability.
c. Back-up Mode Availability. If the applicant claims there is no control degradation for a back-up mode which is not normally exercised, then the availability of such a back-up mode must be established by routine testing or monitoring to ensure it will be available when needed.
The applicant should document the minimum frequency of inspection of testing needed to ensure the availability of the back-up mode in the instructions for continued airworthiness (ICA).
d. Control Transitions.
(1) The propeller control system should transition between all the primary or normal mode control functions, and to alternate modes without adverse speed or torque changes. These primary or normal mode control functions may include governing, beta control, feathering, and the transitions between the various primary mode control functions.
(a) Adverse speed or torque changes are changes that could affect the structural capability of the propeller in addition to the controllability of the propeller installation.
(b) Transitions include control system checks such as feather checks, overspeed governor checks, etc.
(2) In general, the propeller control system should transition to alternate modes automatically. However, systems in which pilot action is required to engage the back-up mode may also be acceptable. When pilot action is required, applicants must ensure that any reliance on manual transition does not pose an unacceptable operating characteristic, unacceptable crew workload, or require exceptional skill.
(3) The applicant should evaluate the transient change in speed or torque associated with all the primary or normal mode control functions and transfer to alternate modes for acceptability. For alternate modes, the applicant should establish the frequency of occurrence of transfers to any alternate mode and the capability of the alternate mode. Computed frequency of transfer rates should be supported with data from endurance or reliability testing, in service experience on similar propeller control system, or other appropriate data.
(4) The applicant should evaluate the magnitude of the speed and torque transients and should also declare the speed or torque change associated with the transition in the instructions for installing the propeller.
(5) The applicant should demonstrate, by simulation or other means, the ability of the propeller control system to control the propeller safely during the transition.
(6) The applicant should provide an analysis to identify those failures that cause control m ode transitions either automatically or through pilot action.
(7) Control transitions that are the result of failure accommodation should occur in an acceptable manner.
e. Time Delays. The applicant should identify any observable time delays associated with the control mode, channel or system transitions, or in re-establishing the pilot’s ability to modulate propeller speed or torque, in the propeller instructions for installation and operation.
9. Section 35.23(a)(2) – Environmental Considerations.
a. The applicant must demonstrate that the control system can function in its installed environment and to declare those environmental limitations as part of the type design characteristics in the instructions for propeller installation and operation. The declared environmental conditions, including but not limited to, temperature, electromagnetic interference (EMI), HIRF, and lightning.
(1) When the airplane installer specifies the environmental conditions of the installation, the applicant should demonstrate compliance by environmental testing that meets the specified installation requirements.
(2) When the airplane installation requirements are not specified, the applicant should conduct environmental testing to demonstrate that the control system can be installed in a typical installation for which the control system is designed.
(3) Electronics may be sensitive to lightning and other EMI. Therefore, electronic controls are designed with protections to compensate for this sensitivity. For compliance, the system design should demonstrate the functional integrity of the control system when subjected to designated levels of electromagnetic disturbances.
(4) Hydro-mechanical and mechanical control systems have not been sensitive to lightning, HIRF and other EMI. Compliance may be shown by similarity to existing designs with service experience for these environmental conditions.
b. Environmental Conditions.
(1) The use of general conditions, such as those referenced in paragraph 3d(2)(c) of this AC, and RTCA DO-160F, allows certification of the propeller control system in a consistent manner. However, installation on some airplanes may require additional considerations.
Therefore, the applicant and airplane manufacturer should coordinate with each other, as well as with the appropriate FAA certification offices, to ensure the propeller installation is acceptable.
Additional guidance for HIRF and lighting are found in AC 20-158, AC 20-136A and SAE ARP5757, which is more specific to engine components.
(a) MIL-STD-810 m ay be used when the tests are equal to or more rigorous than those defined in RTCA DO-160F.
(b) When conducting temperature variation cycles defined in RTCA DO-160F the minimum number of cycles should be increase to 10.
(2) Radio Frequency (RF) Emission Test Procedures and Test Lim its. The procedures and limits in MIL-STD-461 or RTCA DO-160F, Section 21, are acceptable.
c. HIRF and Lightning Tests. This AC provides HIRF and lightning guidance for three circumstances that are common with propeller certification. Those are certification for a specific airplane with installer specified test levels, certification for a typical airplane, and certification on small airplanes with reciprocating engines.
(1) Installer Specified HIRF and Lighting Test Levels. Propeller and aircraft applicants should agree to the HIRF and lightning test levels for the propeller control system. Applicants should select these test levels so that the installation meets aircraft certification regulations.
Successful completion of the propeller control system HIRF and lightning tests at these levels must be accomplished for propeller type certification and documented in the propeller installation or operating instructions. Hardware or software design changes implemented after initial environmental testing should be evaluated for their effects with respect to the EMI, HIRF and lightning environment.
(a) The HIRF compliance regulations are §§ 23.1308 and 25.1317. FAA guidance on HIRF compliance is in AC 20-158.
(b) The lightning compliance regulations are §§ 23.1309(e) and 25.1316. FAA guidance on system lightning compliance is in AC 20-136A.
(2) Typical HIRF and Lightning Test Levels. The HIRF and lightning test levels are typically determined through lightning transient and HIRF attenuation characterization tests on the airplane. If the applicant does not know the HIRF and lightning test levels for the propeller installation on a particular aircraft, the propeller applicant may use the test levels in RTCA DO- 160F, sections 20 and 22. Categories and waveform sets are defined in the paragraphs below.
The aircraft applicants should confirm the compatibility of the propeller test levels and the lightning transient characterization and HIRF attenuation tests with propeller installed prior to aircraft certification. If these assumed test levels used for propeller certification are not adequate for a particular aircraft installation, the applicant may need to conduct additional propeller control system HIRF and lightning tests or analysis.
(a) The propeller installation and operating instructions should specify any wire shields, connectors, or terminations, and any electrical bonding, for HIRF and lightning protection which are required when the propeller is installed. The applicant should conduct the HIRF and lightning tests with the same shielding and electrical bonding configuration.