(b) HIRF Levels. The following are the minimum system laboratory HIRF and RF susceptibility test standards for testing.
1. HIRF conducted RF susceptibility tests should be in accordance with RTCA DO-160F, Category W (150 mA).
2. HIRF radiated RF susceptibility continuous wave (CW) and square wave (SW) modulation tests should be in accordance with RTCA DO-160F, Category W (100 v/m).
3. HIRF radiated RF susceptibility pulse modulation tests should be in accordance with RTCA DO-160F, Category D (up to 750 v/m).
(c) Lightning Levels. The applicant should test utilizing the minimum levels for system laboratory lightning tests in accordance with RTCA DO-160F, Section 22, Level 3, for cable bundle injection tests and pin injection tests. The waveform set that includes single stroke, multiple stroke, and multiple burst waveforms for shielded wire bundles should be Category A3J33 in RTCA DO-160F, Section 22. Series impedance should not be used during the pin injection tests (see RTCA DO-160F, Section 22.5.1.h) unless the remote load impedance is in a component included as part of the propeller.
(3) Small Reciprocating Engine Aircraft Test Levels. The following are test levels and installation requirements for propellers installed on small airplanes with reciprocating engines.
These test levels accommodate the high safety levels defined in ACs 20-158 and 20-136A to permit installation on the airplane without further testing. The applicant always has the option to tailor testing for each airplane as described in paragraph 9.c.(1) above, and include that test levels in the instructions for installation and operation.
(a) Reciprocating Engine Aircraft installation requirements are as follows.
1. The propeller and EPCS are installed in an airplane with engine cowls and a firewall that incorporate electrically conducting materials. The conducting materials may be aluminum, copper, steel or carbon fiber composites, and may include thin metal foil or mesh incorporated into non-conducting composites. The EPCS should be installed either under the conducting cowl or on an airframe that uses structure with similar conducting materials.
2. Required wire shielding and connectors for wire bundles that connect the EPCS to airplane systems are specified in the engine installation or operating instructions. The required wire shielding and connectors should be used during the HIRF tests.
3. Electrical bonding requirements for the propeller and EPCS are specified in the propeller installation and operating instructions.
(b) Reciprocating Engine Aircraft HIRF Levels. HIRF levels are the same as defined in paragraph 9.c.(2)(b) above.
(c) Reciprocating Engine Aircraft Lightning Levels. EPCSs for these types of airplane installations are normally subject to very high lightning transients when lightning attaches to the propeller. Using the lightning design and test requirements below, the EPCS should be acceptable for airplane installation without further airplane lightning tests. The minimum levels for system laboratory lightning tests should be RTCA DO-160F, Section 22, and should be Category A3G33 for unshielded wire bundles. The waveform set for these tests that includes single stroke, multiple stroke, and multiple burst waveforms is in RTCA DO-160F, Section 22. The propeller control system tests, design, and the instructions for installation should meet the following requirements:
1. Test setup. The test setup guidance in RTCA DO-160F, Section 22.3 should be used. The cable bundle injection tests should be performed with the propeller electronic control system wire bundle shields disconnected so the transients are injected directly onto the wires.
Series impedance should not be used during the pin injection tests (RTCA DO-160F, Section
22.5.1.h) unless the remote load impedance is in a component included as part of the certified propeller.
2. Wire bundle shields. All wire bundles between propeller electronic control systems components, and from propeller electronic control systems components to the airplane should specify the use of shields. The shields should cover power and signal wires and their returns. The shield should have low resistance and high optical coverage. A shield may enclose an entire wire bundle, or multiple shields may be used over groups of wires within a bundle. The shields should be terminated to each connector. The shield terminations should be very short, preferably using backshells with zero length shield terminations. The connector shells and backshells should provide a very low resistance to the propeller components, FADEC, and airplane firewall or structure. Features required for electrically bonding the connectors to the airplane firewall or structure, such as surface preparation, should be specified in the instructions for propeller installation and operation.
(4) Test Procedures. The propeller control system used for the lightning and HIRF tests should include sensors, electronic actuators, and propeller and propeller-airplane interface wire bundles. The applicant should use the HIRF and lightning test procedures provided in RTCA DO-160F, Sections 20 and 22. However, the test procedures defined in RTCA DO-160F, Sections 20 and 22, are oriented to equipment tests. Further guidance on system level HIRF tests is available in SAE ARP5583. SAE ARP5415, titled “Users Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning” and SAE ARP5416, titled “Aircraft Lightning Test Methods” provide guidance on system level lightning tests.
(5) Open Loop and Closed Loop Testing. The applicant should conduct HIRF and lightning tests on the propeller control system operating in closed loop or open loop control. The closed loop set-up is usually provided with power to move actuators to close the inner actuating loops. A simplified propeller simulation may be used to close the outer propeller loop. HIRF and lightning tests should be conducted with the propeller control system controlling at the most sensitive operating point, as selected and detailed in the test plans by the applicant. The system should be exposed to the HIRF and lightning environments while operating at the selected condition. HIRF and lightning environments may have different sensitive operating points.
(6) Test Considerations. The following factors should also be considered:
(a) If special propeller control system test software is used, that software should be developed and implemented by guidelines defined for software levels of at least Level C in RTCA DO-178B, or equivalent. In some cases, the application code is modified to include the required test code features;
(b) The system test set-up should be capable of monitoring both the output drive signals and the input signals; and
(c) Anomalies observed during open loop testing on inputs or outputs should be duplicated on the propeller simulation to determine whether the resulting power or thrust perturbations comply with the pass/fail criteria.
d. Pass/Fail Criteria. The environmental tests, EMI, HIRF and lightning, should cause no adverse effects on the functionality of the propeller control system. The following are considered adverse effects:
(1) For propellers on a turbine engine greater than 3% change of rated speed or a pitch change that would result in greater than 3% take off thrust, whichever change is greater, from the normal control governing capability for a period of more than two seconds.
(2) For propellers on a reciprocating engine greater than 10% change of rated speed or a pitch change that would result in greater than 10% take off thrust, whichever change is greater, from the normal control governing capability for a period of more than two seconds.
(3) Transfers to alternate channels, back-up systems, or alternate modes.
(4) Component damage. Certain protection components, such as transient suppression diodes, may experience failures that are not detected by post test automatic test plan (ATP), and must be checked with specific test procedures.
(5) False annunciation to the crew that could cause unnecessary or inappropriate crew action.
(6) Erroneous operation of protection systems, such as low pitch stop or overspeed protection circuits.
e. Maintenance Actions.
(1) Section 35.4 requires the applicant to prepare ICA. Therefore, for any dedicated or inherent protection features that are part of the type design of the propeller control system and are required to meet the qualified levels of EMI, HIRF and lightning, the applicant should provide a maintenance plan to ensure the continued airworthiness for the parts of the installed system supplied by the propeller TC holder.
(2) The m aintenance actions considered include periodic inspections or tests for required structural shielding, wire shields, connectors, and EPCS protection components. The applicant should provide the engineering validation and substantiation of these maintenance actions.
10. Section 35.23(a)(3) – Flight Crew Action. In general, the propeller control system should transition to alternate modes automatically. However, systems in which pilot action is required to engage the back-up mode may also be acceptable. When pilot action is required, applicants must make certain that care is taken to ensure that any reliance on a pilot executing a manual transition does not pose an unacceptable operating characteristic, unacceptable crew workload, or require exceptional skill. If annunciation to the pilot is necessary, the type of annunciation should be appropriate with the nature of the transition. For example, when transition to an alternate mode of control is automatic and the only observable changes in operation of the propeller are different rotational speed settings, the annunciation is very different from when the pilot is required to take timely action to maintain control of the airplane. The instructions for propeller installation and operation should clearly state that assumed crew action and the acceptability of those crew actions should be evaluated during airplane certification.
11. Section 35.23(b) – Safety Assessment.
a. Airplane-Level Failure Classifications. Airplane-level failure classifications do not directly apply to propeller safety assessments because the airplane may have features that could decrease or increase the consequences of a propeller failure effect. Additionally, the same typecertificated propeller may be used in a variety of installations, each with different airplane-level failure classifications. The applicant should declare the type of airplane, such as a part 25 airplane or a part 23 single reciprocating engine airplane, on which the propeller control system will be installed. The applicant should also establish that the propeller failure modes and rates for certification and testing are at or above the airplane-level failure classifications. Otherwise, the propeller control system may not be of sufficient integrity for installation on the intended airplane. AC 23.1309 provides additional guidance for airplane-level failure classifications for part 23 airplanes. AC 25.1309 provides additional guidance for airplane-level failure classifications for part 25 airplanes.
(1) Hazardous Propeller Effect Failure Rates. The propeller safety analysis should show that hazardous propeller effects are not predicted to occur at a rate in excess of that defined as extremely remote (probability of 10-7 or less per propeller flight hour). AC 35.1, Certification of Propellers, provides additional guidance for individual failures and probabilities of this low order of magnitude. We note that a probability of 10-7 per propeller flight hour is not acceptable for some part 23 airplanes or for any part 25 airplanes. Those airplanes may require a rate of 10-9 or less per propeller flight hour. The applicant should establish the rate required per propeller flight hour based on the airplane installation early in the control development program. This will ensure that the airplane meets its certification requirements with the propeller installed.
(2) Major Propeller Effect Failure Rates. A summary should be made of all failures that could result in a major propeller effect along with the expected hourly failure rate of occurrence 16
for those effects. AC 35.1, Certification of Propellers, provides further guidance on m ajor propeller effects.
b. Supplemental Guidance for the Safety Analysis § 35.15.
(1) The safety analysis in § 35.15 should address all operating modes, and the data used in the safety analysis should be substantiated.
(2) The safety analysis should consider all failures, both detected and undetected, and their effects on the propeller control system and the propeller itself. The intent is primarily to address failures or malfunctions that affect only one propeller control system, and therefore only one propeller. However, the safety analysis should also include failures or malfunctions in airplane, engine, or propeller signals, including those in a multi-engine installation that could affect more than one propeller.
(3) The propeller control system safety analysis (SSA) should identify the applicable assumptions and installation requirements and establish any limitations relating to propeller control system operation. The propeller instructions for installation and operation should state these assumptions, requirements, and limitations.
(4) If the safety analysis assumes a particular crew action would reduce the impact of a fault condition, the instructions for propeller installation and operation should clearly state the assumed crew action, and the acceptability of those crew actions should be evaluated during airplane certification.
(5) The safety analysis should address all failures identified in § 35.15 that could result in major or hazardous propeller effects. The applicant should provide a summary that lists the malfunctions or failures, as well as their effects and the expected per hour rate of occurrence for the event, caused by the propeller control system.
(6) The safety analysis should also consider all signals used by the propeller control system, in particular any cross-propeller control signals. The airplane applicant needs to define the criticality of functions included in the propeller control system for airplane level functions.
(7) Where adequate validation data is not available and extra conservatism is built into the analysis, then a normal post-certification in-service follow-up may be performed to obtain the data necessary to alleviate any consequence of the extra conservatism. This data may be used, for example, to extend system check intervals.
c. Criteria. The safety analysis should demonstrate or provide the following:
(1) Compliance with § 35.15.
(2) Failures leading to major propeller effects must show compliance with the agreed major propeller effects rates for the intended installation.
(3) Inform ation on the consequence of the transmission of a faulty parameter by the propeller control system. Any information necessary to mitigate the consequence of a faulty parameter transmission should be contained in the propeller operating instructions.
d. Malfunctions or Failures Affecting Speed or Thrust.
(1) When operating in the take-off envelope, uncovered failures in the propeller control system that result in speed or thrust changes in (5) below are generally considered acceptable.
However, this does not affect the applicant’s obligation to ensure that the full-up system is capable of providing the declared minimum rated speed or torque. In this regard, faults that could result in small thrust changes should be random in nature and detectable and correctable during routine inspections, overhauls, or power-checks.
(2) In an airplane installation, the receiving propeller control system should provide authority limits on the signals sent from one propeller control system to another so that undetected faults do not result in an unacceptable change in speed or torque on the propeller using those signals. An example of this are the signals used for an automatic takeoff power control system (ATPCS), and auto feather control system, or synchrophasing.
(3) When operating in the take-off envelope, detected faults in the propellers control system that result in a speed or thrust changes in (5) below may be acceptable if the total frequency of occurrence and magnitude for these types of failures is relatively low. The safety analysis should contain the predicted frequency of occurrence for this category of faults. The requirements for the allowable frequency of occurrence and magnitude for this category of faults and any need for a flight deck indication of these conditions should be reviewed during airplane certification.
(4) Detected faults in signals exchanged between propeller control systems should not result in greater than speed or thrust changes in (5) below on the propeller using the crosspropeller signals.
(5) Speed or thrust changes.
(a) For propellers on a turbine engine greater than 3% change of rated speed or a pitch change that would result in greater than 3% take off thrust.
(b) For propellers on a reciprocating engine greater than 10% change of rated speed or a pitch change that would result in greater than 10% take off thrust.
e. Commercial or Industrial Grade Electronic Parts.
(1) The grade and handling of electronic parts is an important contributor to the reliability of the EPCS. Two examples of industry documents that provide guidance on the application of commercial or industrial grade components are:
(a) IEC/TS 62239, Process Managem ent for Avionics – Preparation of an Electronic Components Management Plan, and
(b) IEC/TR 62240, Process Management for Avionics - Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges.
(2) When the propeller type design specifies commercial or industrial grade electronic components, and not manufactured to military standards, the applicant should have the following data available for review, as applicable:
(a) Reliability data for each commercial and industrial grade electrical component specified in the design.
(b) The applicant’s procurement, quality assurance, and process control plans for the vendor-supplied commercial and industrial grade parts. These plans should ensure that the parts will be able to maintain the reliability level specified in the approved propeller type design.
(c) Unique databases for similar components obtained from different vendors because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard.
(3) Commercial and industrial grade parts have typical operating ranges of 00 to +700 Celsius and -400 to +850 Celsius, respectively. Military grade parts are typically rated at -540 to 1250 Celsius. Commercial and industrial grade parts are typically defined in these temperature ranges in vendor parts catalogues. If the declared temperature environment for the propeller control system results in commercial or industrial grade electronic components exceeding their stated capability, the applicant should:
(a) Determine the temperature range for the component;
(b) Substantiate that the component is suitable for operation; and
(c) Adjust the failure rates used for those components in the SSA.
(4) Additionally, if commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required in the design of the EPCS, the applicant should specify these provisions in the propeller installation instructions to ensure that the provisions for cooling are not compromised. The cooling provisions included in the EPCS design may have failure modes. If failures could result in exceeding the temperature limits, the applicant should account for the probability of these failures in the SSA analysis.
(5) When any electrical or electronic components are changed, the applicant should review SSA analysis with regard to the impact of any changes in component reliability.
Component, subassembly or assembly level testing may be needed to substantiate a change that introduces commercial or industrial part(s). However, such a change would not be classified as “significant” with respect to § 21.101(b)(1).
12. Section 35.23(b)(1) – Single Fault Accommodation. The applicant should substantiate single failure specifications by a com bination of tests and analyses. It is intended that single failures or malfunctions in the propeller control system's components, in its fully operational condition and all declared dispatchable configurations, do not result in a hazardous propeller effect. In addition, for an EPCS in its full-up configuration, the control system should be “essentially single fault tolerant” of electrical/electronic component failures. We recognize, however, that to achieve true single fault tolerance would require either a triplicate design approach or a design approach with 100 % fault detection. Currently, systems are designed with dual, redundant channels or with back-up systems that provide what has been called an “essentially single fault tolerant” system.
13. Section 35.23(b)(2) – Local Events.
a. Examples of Local Events Include:
(1) Overheat conditions;
(2) Fires;
(3) Fluid leaks;
(4) Maintenance and foreseeable maintenance errors such as using a wire bundle as a hand hold; or
(5) Mechanical disruptions that could lead to damage of control system mechanical linkages, electrical harnesses, connectors, or the control itself.
b. Considerations for local events are:
(1) Local events normally affect only one propeller. Therefore, a local event is not usually considered a common mode event, which affects more than one propeller. Common mode threats, such as HIRF and rain, are not normally considered local events.
(2) Invalid assumptions of independence between failures as well as failure to recognize common cause failure modes are leading reasons invalid conclusions are reached within safety analyses. In the assessment of local events, emphasis should be placed on identifying and assuring critical functional or physical isolation is maintained. Then a zonal and/or other common cause/mode analyses can be conducted to assure that there is no common cause event that would violate any of those assumptions. For example:
(a) Pitch control components whose failure could result in overspeed are not impacted by the same event(s) that could cause loss of overspeed protection.
(3) During a local event, the behavior of the propeller control system should not cause a hazardous propeller effect in any approved dispatchable mode.
(4) W hen demonstrating that no hazardous propeller effect exists based on the assumption that another function exists to provide the necessary protection, the applicant should show that this function is not rendered inoperative by the same local event on the propeller (including destruction of wires, power supplies, and linkages).
(5) An overheat condition exists when the temperature of the system components is greater than the maximum safe design operating temperature for the components, as declared by the applicant in the propeller instructions for installation. When the components of the propeller control system are exposed to an overheat condition, the system should not cause a hazardous propeller effect. This includes the recovery after the heat source is removed. The applicant may use specific design features or analysis methods to show compliance to the prevention of hazardous propeller effects. When this is not possible, due for example to the variability or complexity of the failure sequence, then we may require testing.
(6) We recognize that it is difficult to address all possible local events in the intended airplane installation at the time of propeller certification. Therefore, the applicant should apply sound engineering judgment to identify reasonably foreseeable local events. The applicant may show compliance with this specification by considering the end result of the local event on the propeller control system. The applicant should clearly document the analyzed local events to aid in certification of the propeller installation.
(7) The applicant should assess by analysis or test the effects of hydraulic or lubricating leaks impinging on components of the propeller control system. Such conditions should not result in a hazardous propeller effect, nor should the fluids be allowed to impinge on circuitry or printed circuit boards that could result in a potential latent failure condition.
c. The following guidance applies to propeller control system wiring:
(1) Each wire or combination of wires interfacing with the EPCS that could be affected by a local event should be tested or analyzed with respect to local events. The assessment should include open circuits, shorts to ground, and shorts to power (when appropriate). The results should show that faults result in specific responses and do not result in hazardous propeller effects. In addition, the applicant should show that any EPCS component connector that becomes disconnected while the propeller is operating does not cause a hazard to the continued safe flight and landing of the airplane.
(2) The applicant should test or analyze propeller control unit airplane interface wiring for shorts to airplane power; these “hot” shorts should result in a specific and non-hazardous propeller effect. Where airplane interface wiring is involved, the propeller installation instructions should inform the installer of the potential effects of shorts in the interface wiring.
The installer should ensure that no wiring faults exist that:
(a) Are not detectable and not accommodated; or
(b) Could result in a hazardous propeller effect.
(3) W here practical, wiring faults should not affect more than one channel. The propeller applicant should include any assumptions regarding channel separation in the SSA analysis.
(4) Where physical separation of conductors is not practical, the propeller applicant and the installer should coordinate to ensure that the potential for common mode faults between propeller control systems is eliminated and between channels on one propeller is minimized.
(5) The applicant should assess, by analysis or test, the effects of fluid leaks impinging on components of the EPCS. Such conditions should not result in a hazardous propeller effect, and the fluids may not be allowed to impinge on circuitry or printed circuit boards or result in a potential latent failure condition.
14. Section 35.23(b)(3) – Back-Up Systems. The propeller should have a protection system or back-up devices, such as an overspeed governor, counter weights, pitch lock, high pitch or low pitch stop. Two categories of malfunction should be considered. Those resulting from external causes such as engine failures and airplane flight conditions, and those caused by propeller control system failures. If a control system protection function is necessary, then the protection system should be evaluated with regard to its functionality and reliability as part of the propeller control system.
a. The combined normal or primary propeller control and protection system should not have a single point failure that results in a hazardous propeller effect. For example, a single failure mode should not result in unintended movement below the in-flight low pitch position. In this case, a potential overspeed or high drag condition will only be possible as a result of the initial fault causing a low pitch command and an independent fault preventing the protection system from operating.
b. The analysis should show that the hourly failure rate per occurrence of a hazardous propeller control system failure condition from any cause in combination with failures of the appropriate protection system is less than 10-9 for part 25 and part 23 commuter applications.
Although, AC 23.1309-1D provides guidance for part 23 airplanes that shows airplane hazardous and catastrophic failure rates from 10-5 to 10-9 the minimum failure rate for a propeller hazardous effect is 10-7. Since 10-7 is greater than the some failure rates specified in AC 23.1309D the applicant should establish an overall hourly failure rate per occurrence for the intended installation to ensure that the propeller is installable. Some installations require that a probability of 10-9 per hour be shown for unintended movement below the in-flight low pitch position.
c. The probability of the protection system failing to operate when required should be on the order of 10-4 or less per flight hour including effects of latency.
d. The probability of an inadvertent operation of the protection system should be commensurate with the failure consequences.
e. Dedicated protection system s that are provided to prevent hazardous propeller effects are a necessary function for dispatch. Therefore, the applicant should test the protection system in a manner the intended installation and the reliability of the protection system.
15. Section 35.23(b)(4) – Shared Data or Signals. In the exchange of data with the airplane, consideration should be given to eliminate unacceptable common mode faults affecting the operation of more than one propeller. Common faults that affect propeller protection limit systems or could hazard the airplane are generally unacceptable. In particular, the applicant should consider the following:
a. Erroneous data received from the airplane or engine by the propeller control system if the data source is common to more than one propeller (for example, air data sources, synchronizing controls).
b. Control system operating faults propagating via data links between propellers (for example, maintenance recording, common bus, cross-talk, auto-feathering, and ATPCS implementation).
c. Loss or interruption of airplane data or electrical power used by the propeller control when that loss or interruption is caused by the failure of another propeller system.
d. Exchange of data between propellers to implement control functions (for example, synchrophasing) should be shown to incorporate authority limits to prevent unacceptable common mode loss of control.
16. Section 35.23(c) – Software Design and Implementation.
a. Objective.
(1) For propeller control systems that use embedded software, the objective is to prevent as much as possible, logic errors that would result in an unacceptable effect on pitch, speed and torque, or other unsafe conditions. Because of the nature and complexity of components containing digital logic, the software should be developed using a structured development approach, commensurate with the hazard associated with a failure or malfunction of the components in which the digital logic is contained.
(2) Applicants may not be able to establish with certainty that the software has been designed without errors. However, if the applicant uses the software level or the hardware design assurance level appropriate for the criticality of the performed functions and uses an approved development method, the software satisfies the requirement to minimize errors. In multiple propeller installations, the possibility of digital logic errors common to more than one propeller control system may determine the criticality level of the software. However, the need for dissimilar designs has not been required when level A in RTCA DO-178B is used.
b. Approved Methods. The primary FAA guidance on software methods is found in AC 20- 115B and in FAA order 8110.49. For acceptable methods in developing software, comply with 23
the guidelines of docum ents RTCA DO-178B. Alternative methods for developing software may be proposed by the applicant and are subject to approval by the Administrator.
c. Level of Software.
(1) Determination of the appropriate software level may depend on the failure modes and consequences of those failures. For example, it is possible that failures resulting in significant pitch change or speed oscillations may be more severe than a failure to a fixed pitch and should be considered when selecting a given software level.
(2) In multiple propeller installations to be type certificated under part 25 transport or part 23 commuter airplanes, the design, implementation and verification of software in accordance with level A in RTCA DO-178B, is normally needed to achieve the certification objectives for the airplane. This level of verification is not normally required for non-essential functions, functions not capable of creating a hazardous condition, or functions unrelated to propeller control (for example, monitoring functions).
(3) The criticality of functions on other airplanes may be different, and therefore, a different level of software design assurance may be acceptable.
(4) For propellers on reciprocating engines, the following guidelines have been set:
(a) Software level C in RTCA DO-178B has been determined to be the minimum requirement for a non-reversing and non-feathering propeller on a reciprocating engine EPCS.
Additional guidance on software levels for part 23 airplane is found in AC 23.1309.
(b) For reciprocating engine EPCS installed in airplanes approved under part 23 commuter or part 25 transport categories, the minimum software level for those EPCS should be determined by performing an airplane system-level safety analysis.
(c) For reciprocating engine EPCS installed in any other airplane, the applicant should evaluate the failure condition criticality of EPCS functions to determine if level C in RTCA DO- 178B software would be adequate. This would require coordination with the airplane designer and the cognizant FAA Aircraft Certification Office (ACO) during the EPCS development program.
(5) Applicants may protect or partition non-critical software from critical software and design and implement the non-critical software to a lower level. The applicant should demonstrate the adequacy of the partitioning method as well as the protection and isolation features needed to prevent corruption between the two levels of software. This demonstration should consider whether the protected/partitioned lower software levels are appropriate for any anticipated installations. Should the criticality level be higher in subsequent installations, the applicant would need to meet all requirements for the higher software level.