d. Onboard or Field Loadable Software and Part Number Marking. Use the following guidelines and refer to FAA order 8110.49 when onboard or field loading of electronic propeller control software and associated EPM is implemented:
(1) For software changes, document the software to be loaded by an approved design change and released with a service bulletin or other appropriate documentation.
(2) For an EPCS unit with separate part numbers for hardware and software, the software part number(s) need not be displayed on the unit as long as they are embedded in the loaded software and can be verified by electronic means. When new software is loaded into the unit, the same verification requirement applies and the proper software part number should be verified before the unit is returned to service.
(3) For an EPCS unit with only one part number, the single part number represents a combination of a software and hardware build. Applicants should change or update the unit part number on the nameplate when the new software is loaded. The software build or version number should be verified before the unit is returned to service.
(4) For an EPCS that will be onboard or field loaded, the configuration control system and the use of EPM should be approved. The drawing system should provide a compatibility table that tabulates the combinations of hardware part numbers and software versions that have been approved by the Administrator. The top-level compatibility table should be under configuration control, and it should be updated for each change that affects hardware/software combinations.
The applicable service bulletin should define the hardware configurations with which the new software version is compatible.
(5) The loading system should be in compliance with the guidelines of RTCA DO-178B, Section 2.5. If the applicant proposes more than one source for loading, (for example, diskette or mass storage), all sources should comply with these guidelines.
(6) The service bulletin should require verification that the correct software version has been loaded after installation on the airplane.
e. Software Change Category. The processes and methods used to change software should not affect the design assurance level of that software.
(1) The determination of major change versus minor change is established in § 21.93. A change to the software in a propeller control system may affect the reliability, operational characteristics, or other characteristics affecting the airworthiness of the product and is, therefore, normally classified as a major change. Paragraphs (2) and (3) below provide additional guidance regarding classification of software changes.
(2) The failure effect of EPCS software is always assumed to have a major effect because an error could result in a hazardous or major propeller effect. Therefore, software changes are almost always classified as a major change. Exceptions are decided on a case-by-case basis.
Therefore, a change to software produced in accordance with RTCA DO-178B should be 25
classified as a m ajor change if any of the following applies and the failure effect is categorized as catastrophic, hazardous or major:
(a) The executable code for software, determined to be level A or B in accordance with RTCA DO-178B, is changed, unless that change involves only a variation of a parameter value within a range already verified for the previous certification standard;
(b) The software is upgraded to, or downgraded from, level A, B or C in RTCA DO- 178B; or
(c) The executable code, determined to be level C in RTCA DO-178B, is substantially changed. For example, after adding a function or after a software reengineering process accompanying a change of processor.
(3) For software developed to processes other than RTCA DO-178B, the applicant should assess changes in accordance with the system principles established in §§ 23.1309 or 25.1309 and coordinated with the cognizant ACO. For systems assessed under §§ 23.1309 or 25.1309, the classification process is based on the functional aspects of the change and its potential effects on safety. The following guidance applies:
(a) When the failure effect at the airplane level is "catastrophic" or "hazardous," the change should be classified as a major change.
(b) When the failure effect at the airplane level is "major", the change should be classified as a major change if:
1. Aspects of the compliance demonstration uses methods not previously accepted for the nature of the change to the system;
2. The change affects the pilot/system interface (displays, controls, approved procedures); or
3. The change introduces new types of functions/systems.
f. Software Changes by Others than the TC Holder.
(1) Software changes by someone other than the original TC holder are generally not feasible. The applicant should address the approval process with the certification authority to determine feasibility.
(2) Two types of software changes exist that could be implemented by someone other than the original TC holder. The two types are option-selectable software, or usermodifiable software (UMS).
(a) Option-selectable changes are pre-certified logic that uses a method of selection shown not to be capable of causing a control malfunction.
(b) UMS is software intended for m odification by the airplane operator without review by the certification authority, the airplane applicant, the propeller manufacturer, or the equipment vendor. For propeller control systems, UMS has generally not been applicable.
However, approval of UMS, if required, would be addressed on a case-by-case basis.
(3) The necessary guidance for UMS is contained in RTCA DO-178B, paragraph 2.4.
The guidance allows non-TC holders to modify the software within the modification constraints defined by the TC holder if the system has been certified with the provision for software user modifications. To certify an EPCS with the provision for software modification by a non-TC holder, the TC holder should (1) provide the necessary information for approval of the design and implementation of a software change; and (2) demonstrate that the necessary precautions have been taken to prevent the user modification, regardless of whether it is implemented correctly, from affecting propeller airworthiness.
(4) When the software is changed in a manner not allowed by the TC holder as "user modifiable," the non-TC holder applicant should comply with all the specific applicable requirements of 14 CFR 35; and in particular all the provisions of § 35.23 as well as the requirements in part 21, subpart E. Refer to FAA Order 8110.49, particularly Chapter 7, "Approval of Airborne Systems and Equipment Containing User-Modifiable Software (UMS)" for additional information.
17. Section 35.23(d) – Airplane-Supplied Data.
a. Context. Airplane-supplied data, in this context, includes all analog, discrete, and digital data provided by airplane systems to the EPCS. Engine-supplied data is a subset of airplanesupplied data.
b. Items to Address. When airplane-supplied data can affect propeller control system operation, the applicant should address the following items, as applicable, in the safety analysis or other appropriate documents:
(1) Software and complex electronic hardware in the data path to the EPCS should be at a level consistent with the criticality of the EPCS function that uses that data. The data path may include other airplane avionics.
(2) The applicant should state in the instructions for installation that the airplane applicant is responsible for ensuring that changes to airplane avionics units, including software, in the data path to the EPCS do not affect the integrity of the data provided to the propeller as defined by the EPCS instructions for installation.
(3) The applicant should provide the effects of faulty and corrupted airplane-supplied data on the EPCS in the propeller instructions for installation.
(4) The instructions for installation should state the installer should ensure those sensors that deliver information to the EPCS are capable of operating in “severe” HIRF and lightning 27
environm ents, as defined in the certification basis for the airplane, without affecting their proper and continued operation.
(5) The applicant should state the reliability level for airplane-supplied data used as part of the safety analysis as an "assumed value" in the instructions for installation.
c. Additional Considerations.
(1) If the airplane command system is configured to move the propeller speed and torque levers or to transmit an electronic signal to command a speed or torque change, then the propeller control system merely responds to the command and changes to propeller speed and torque as appropriate. The propeller control system may have no way of detecting the sensed speed or torque lever movement was correct or erroneous. Faulty or erroneous airplane data should not have an adverse effect on propeller protection systems.
(2) In both the moving speed (or condition) lever and torque (or power) lever configurations, it is the installer’s responsibility to show that a proper functional hazard analysis has been performed on the airplane system involved in generating propeller speed and torque commands. The installer should also show that the system meets the appropriate airplane’s functional hazard assessment safety related specifications. This task is an airplane certification issue.
d. Design Assessment.
(1) The applicant should prepare a fault accommodation chart that defines the fault accommodation architecture for the airplane-supplied data.
(2) There may be elements of the propeller control system, such as a blade position syncronizer, that are mounted in the airplane and are not part of the propeller type design, but which are dedicated to the propeller control system and powered by it. In these instances, such elements are considered an integral component of the EPCS and are not considered airplane data.
(3) When particular failure modes of the airplane air data are unknown, the applicant should assume typical failure modes of loss of data and erroneous data. We are using the term "erroneous data" in this AC to describe a condition where the data appears to be valid, but is incorrect.
(4) The applicant should provide such assumptions and the results of the evaluation of erroneous airplane data to the installer.
(5) The following are examples of possible means of fault accommodation:
(a) Provision of an alternate mode that is independent of airplane-supplied data.
(b) Dual sources of airplane-supplied sensor data with local propeller sensors provided as voters and alternate data sources.
(c) Use of synthesized propeller parameters as voters. When synthesized parameters are used for control or voting purposes, the analysis should consider the impact of temperature and other environmental effects on those sensors whose data are used in the synthesis. The applicant should also assess the variability of any data or information necessary to relate the data from the sensors used in the synthesis to the parameters being synthesized.
(d) Triple redundant air data computer systems that provide the required data.
(6) If, for airplane certification, the applicant intends to show that the complete loss of the airplane air data system is extremely improbable, then the applicant should show the airplane air data system is unaffected by a complete loss of airplane generated power. An example would be an airplane power system that is backed up by battery power.
e. Validation.
(1) The applicant should demonstrate functionality of the fault accommodation logic by test, analysis, or a combination of both. When the airplane air data system is not functional because of the loss of all airplane generated power, the propeller control system should include validated fault accommodation logic that prevents the propeller from producing a hazardous propeller effect. Propeller operation in this system configuration should be demonstrated by test.
(2) For all dispatchable control modes, the next single fault should be shown not to lead to a hazardous propeller effect.
(3) If an alternate mode, independent of airplane-supplied data, has been provided to accommodate the loss of all data, the applicant should conduct sufficient testing to demonstrate that the operability specifications have been met when operating in this mode. The instructions for installation should include characteristics of operation in this mode, even if this is a nondispatchable mode.
18. Section 35.23(e) – Airplane-Supplied Electrical Power.
a. Airplane-Supplied Electrical Power. Airplane-supplied electrical power should provide an electrical power source to the EPCS that is at a minimum single fault tolerant. The most common method of achieving this objective has been to provide an independent alternator (dedicated power supply) as the electrical power source for the EPCS. However, with the increased integration of propeller-airplane systems and with the application of EPCS to small propellers, both on reciprocating and turbine engines, use of an independent alternator may not necessarily be the only design approach to meet this objective. If airplane power faults or failures can contribute to major or hazardous propeller effects, these events should be included in the SSA. The instructions for installation should contain the assumed quality and reliability levels of airplane power. Engine-supplied power is a subset of airplane-supplied power.
b. Analysis of the Design Architecture.
(1) An analysis and review of the design architecture should identify the requirem ents for dedicated electrical power sources and airplane-supplied power sources. The analysis should include the sources of power and the effects of losing these sources. If the propeller depends on airplane-supplied power for any operational functions, the analysis should result in a definition of the requirements for airplane-supplied power.
(2) The capacity of any EPCS dedicated power source should provide sufficient margin to maintain confidence that the propeller control system will continue to function in all anticipated operating conditions where the control system is designed and expected to recover propeller operation in-flight. This margin should account for any other anticipated variations in the output of the dedicated power source, such as those due to temperature variations, manufacturing tolerances, and idle speed variations. The design margin should be substantiated by test, analysis, or both, and should take into account any deterioration over the life of the propeller.
(3) When compliance imposes a dedicated electrical power source, the SSA should address the failure of this source. In general, the dedicated electrical power source should have sufficient reliability to be acceptable without taking credit for airplane-supplied-electrical power as a backup. This is done because the airplane-supplied electrical power may have a much lower reliability than the dedicated electric power source and it is not advisable to mix systems with widely differing reliability within an SSA to achieve an overall system safety level. However, the FAA will review, on a case-by-case basis, any impact on the SSA for the use of airplane power as the power source for a propeller control back-up system.
(4) When the EPC system design relies on an airplane-electrical power system for primary power, backup power, or both, applicants should consider the following.
(a) Failure of a single bus. A failure of one of multiple airplane buses is not considered a loss of airplane power if the buses are independent, isolated from each other, and power the EPCS separately. Therefore, a backup source could be an alternate bus, such as an essential bus, which is independent, isolated from the bus serving as the primary power source, and services only electrical loads required for continued safe operation.
(b) Installation instructions. The applicant should provide detailed electrical system interface requirements in the propeller installation and/or operating instructions.
(c) Failure Event Rate. The applicant should provide their maximum allowable failure event rate for the airplane electrical power system, such that the total EPCS failure event rate, including the airplane power source, remains within the EPCS SSA criteria for full-up and degraded systems. This maximum allowable failure event rate requirement for the airplane electrical power system(s) should be included in the propeller installation and/or operating instructions.
(d) Airplane as Primary Power Source. If airplane-supplied power, such as the airplane bus and battery system, is used as the primary power source, then the EPCS should have an isolated backup power source.
(e) Backup Power Source Monitoring. The applicant should provide ICA and provisions for system monitoring to ensure that the backup system is capable of powering the EPCS for continued safe flight. For example, a battery system should incorporate provisions for charge level monitoring and the ICA should include maintenance procedures to ensure that the charge level is adequate to power the EPCS.
(f) When airplane power recovers from a low-voltage condition to a condition the control is expected to operate normally, the propeller control system should resume normal operation. The time interval associated with this recovery should be contained in the propeller instructions for installation. We recognize that airplane power supply conditions may lead to a propeller feather or condition that is not recoverable automatically. We will determine the acceptability of any non-recoverable propeller operating conditions that are the result of airplane power supply conditions at airplane certification.
(7) In some system architectures, a dedicated power source may not be required and an airplane-supplied electrical power supply may be acceptable as the sole source of power.
(a) One example is a system that consists of a primary electronic single channel and a full capability hydro-mechanical back-up system that meets all specifications and does not depend on airplane power that is independent of electrical power. In this architecture, loss or interruption of airplane-supplied power is accommodated by transferring control to the hydromechanical system. If fault accommodation credit is established to transfer the control to the hydro-mechanical back-up, assure the fault accommodation cannot prevent such a transfer.
(b) Another example is an airplane power system that could support a fly-by-wire flight control system. This power system may be acceptable as the sole source of power for an EPCS.
c. Electrical Power Sources.
(1) Use of two isolated/independent airplane buses as the means of compliance with this specification is acceptable.
d. Effects on the Propeller.
(1) When loss of airplane power results in a change in propeller control mode, the control mode transition should meet guidance of paragraph 8.d. of this AC.
(2) When a dedicated power source is part of the system configuration, the loss of some propeller control functions that rely on airplane-supplied electrical power may still be acceptable. Acceptability is based on an evaluation of the change in propeller operating characteristics, current experience with similar designs, and/or the accommodation designed into the control system.
e. Validation. The applicant should demonstrate the effects of loss of airplane-supplied electrical power by propeller test, system validation test, bench test, or any combination.
19. Section 35.3(a)(1) – Instructions for Propeller Installation and Operation.
a. Control System Description. The applicant should include a brief control system description and may reference a more detailed system description document.
b. Interface Description. The description should specify all of the physical, electrical, and functional interface requirements of the control system. The following types of information should be included for an EPCS:
(1) EPCS power requirements and quality, including interrupt limitations.
(2) Impedance and buffering limitations for the signals provided by the EPCS for display and instrumentation.
(3) Signals used by the EPCS, such as air data information. This is to ensure that the EPCS is adequately isolated and unaffected by other systems using these signals.
(4) Subtle interface requirements, such as power interrupt tolerance of the EPCS.
(5) Control system output information for maintenance to the cockpit, and fault information.
c. Operational Description. The instructions for installing and operating the propeller should contain a description of the control system operating characteristics in both the normal and alternate control and operating modes.
(1) Restrictions in the flight envelope or unusual operating characteristics in these alternate modes should be clearly defined and included in the operational description.
(2) Abnormal control characteristics that could affect crew procedures, training, workload, or any other aspects of airplane performance or operating characteristics should be identified and included for evaluation during airplane certification.
d. Substantiation Data. The applicant should, in the instructions for installing and operating the propeller, include or reference data from safety analyses, environmental testing, and software level determinations that will assist the installer to safely install the propeller.
e. Safety Analysis. The applicant should, in the instructions for installing and operating the propeller, include from the SSA the estimated reliability of, or the failure rates for, significant failure conditions and the other control system associated events.
f. Environmental Testing. The types and levels of environmental exposure for which the control system has been successfully qualified (for example, vibration, temperature, HIRF, or lightning) should be stated. For the HIRF, lightning and EMI qualification tests, the interfacing airplane cables used for the tests should be stated.
g. Software and Airborne Electronic Hardware (AEH) Validation and Verification. The documentation submitted in support of the software and AEH aspects of certification should be stated.
20. Airborne Electronic Hardware (AEH).
a. For propeller control systems that use AEH in the form of PLD or similar devices, the objective is to prevent errors that would result in an unacceptable effect on pitch, speed and torque, or in other unsafe conditions. Because of the nature and complexity of systems containing digital logic, the PLDs should be developed using a structured development approach that is equivalent to the hazard associated with the failure or malfunction of the system in which the digital logic is contained.
b. Applicants may not be able to establish with certainty that the PLD has been designed without errors. However, if the applicant uses the hardware design assurance level appropriate for the criticality of the performed functions and uses an approved development method, the PLD satisfies the requirement to minimize errors. In multiple propeller installations, the possibility of digital logic errors common to more than one propeller control system may determine the criticality level of the hardware design assurance level. However, the need for dissimilar designs has not been required when Level A is used.
c. Design Practices.
(1) Because of the nature and complexity of systems containing digital logic, PLDs should be developed using a structured development approach, corresponding with the hazard associated with failure or malfunction of the system in which the device is contained.
(2) RTCA DO-254, describes standards for the criticality and design assurance levels associated with PLD development. This document describes an acceptable means, but not the only means, to show compliance. For systems requiring certification to levels higher than RTCA DO-254 Level D, we may require additional validation and verification. AC 20-152, provides guidance when using RTCA DO-254.
(a) The primary FAA guidance on PLD methods is found in AC 20-152 and additional information is found in Order 8110.105 CHG 1. Methods for developing PLDs, compliant with the guidelines of RTCA DO-254 are acceptable. Alternative methods for developing PLDs may be proposed by the applicant and are subject to approval by the Administrator.
Thomas A. Boudreau, 33
Acting Assistant Manager, Engine and Propeller Directorate Aircraft Certification Service