704
14 CFR Ch. I (1–1–24 Edition)
§ 33.28
or external to the engine. The over-
speed resulting from any other single
failure must be considered when select-
ing the most limiting overspeed condi-
tions applicable to each rotor. Over-
speeds resulting from combinations of
failures must also be considered unless
the applicant can show that the prob-
ability of occurrence is not greater
than extremely remote (probability
range of 10
¥
7
to 10
¥
9
per engine flight
hour).
(d) In addition, the applicant must
demonstrate that each fan, compressor,
turbine, and turbosupercharger rotor
complies with paragraphs (d)(1) and
(d)(2) of this section for the maximum
overspeed achieved when subjected to
the conditions specified in paragraphs
(b)(3) and (b)(4) of this section. The ap-
plicant must use the approach in para-
graph (a) of this section which specifies
the required test conditions.
(1) Rotor Growth must not cause the
engine to:
(i) Catch fire,
(ii) Release high-energy debris
through the engine casing or result in
a hazardous failure of the engine cas-
ing,
(iii) Generate loads greater than
those ultimate loads specified in
§ 33.23(a), or
(iv) Lose the capability of being shut
down.
(2) Following an overspeed event and
after continued operation, the rotor
may not exhibit conditions such as
cracking or distortion which preclude
continued safe operation.
(e) The design and functioning of en-
gine control systems, instruments, and
other methods not covered under § 33.28
must ensure that the engine operating
limitations that affect turbine, com-
pressor, fan, and turbosupercharger
rotor structural integrity will not be
exceeded in service.
(f) Failure of a shaft section may be
excluded from consideration in deter-
mining the highest overspeed that
would result from a complete loss of
load on a turbine rotor if the applicant:
(1) Identifies the shaft as an engine
life-limited-part and complies with
§ 33.70.
(2) Uses material and design features
that are well understood and that can
be analyzed by well-established and
validated stress analysis techniques.
(3) Determines, based on an assess-
ment of the environment surrounding
the shaft section, that environmental
influences are unlikely to cause a shaft
failure. This assessment must include
complexity of design, corrosion, wear,
vibration, fire, contact with adjacent
components or structure, overheating,
and secondary effects from other fail-
ures or combination of failures.
(4) Identifies and declares, in accord-
ance with § 33.5, any assumptions re-
garding the engine installation in mak-
ing the assessment described above in
paragraph (f)(3) of this section.
(5) Assesses, and considers as appro-
priate, experience with shaft sections
of similar design.
(6) Does not exclude the entire shaft.
(g) If analysis is used to meet the
overspeed requirements, then the ana-
lytical tool must be validated to prior
overspeed test results of a similar
rotor. The tool must be validated for
each material. The rotor being cer-
tified must not exceed the boundaries
of the rotors being used to validate the
analytical tool in terms of geometric
shape, operating stress, and tempera-
ture. Validation includes the ability to
accurately predict rotor dimensional
growth and the burst speed. The pre-
dictions must also show that the rotor
being certified does not have lower
burst and growth margins than rotors
used to validate the tool.
[Doc. No. FAA–2010–0398, Amdt. 33–31, 76 FR
42023, July 18, 2011]
§ 33.28
Engine control systems.
(a)
Applicability. These requirements
are applicable to any system or device
that is part of engine type design, that
controls, limits, or monitors engine op-
eration, and is necessary for the con-
tinued airworthiness of the engine.
(b)
Validation—(1) Functional aspects.
The applicant must substantiate by
tests, analysis, or a combination there-
of, that the engine control system per-
forms the intended functions in a man-
ner which:
(i) Enables selected values of rel-
evant control parameters to be main-
tained and the engine kept within the
VerDate Sep<11>2014
09:06 Jun 28, 2024
Jkt 262046
PO 00000
Frm 00714
Fmt 8010
Sfmt 8010
Y:\SGML\262046.XXX
262046
jspears on DSK121TN23PROD with CFR
705
Federal Aviation Administration, DOT
§ 33.28
approved operating limits over chang-
ing atmospheric conditions in the de-
clared flight envelope;
(ii) Complies with the operability re-
quirements of §§ 33.51, 33.65 and 33.73, as
appropriate, under all likely system in-
puts and allowable engine power or
thrust demands, unless it can be dem-
onstrated that failure of the control
function results in a non-dispatchable
condition in the intended application;
(iii) Allows modulation of engine
power or thrust with adequate sensi-
tivity over the declared range of engine
operating conditions; and
(iv) Does not create unacceptable
power or thrust oscillations.
(2)
Environmental limits. The applicant
must demonstrate, when complying
with §§ 33.53 or 33.91, that the engine
control system functionality will not
be adversely affected by declared envi-
ronmental conditions, including elec-
tromagnetic interference (EMI), High
Intensity Radiated Fields (HIRF), and
lightning. The limits to which the sys-
tem has been qualified must be docu-
mented in the engine installation in-
structions.
(c)
Control transitions. (1) The appli-
cant must demonstrate that, when
fault or failure results in a change
from one control mode to another,
from one channel to another, or from
the primary system to the back-up sys-
tem, the change occurs so that:
(i) The engine does not exceed any of
its operating limitations;
(ii) The engine does not surge, stall,
or experience unacceptable thrust or
power changes or oscillations or other
unacceptable characteristics; and
(iii) There is a means to alert the
flight crew if the crew is required to
initiate, respond to, or be aware of the
control mode change. The means to
alert the crew must be described in the
engine installation instructions, and
the crew action must be described in
the engine operating instructions;
(2) The magnitude of any change in
thrust or power and the associated
transition time must be identified and
described in the engine installation in-
structions and the engine operating in-
structions.
(d)
Engine control system failures. The
applicant must design and construct
the engine control system so that:
(1) The rate for Loss of Thrust (or
Power) Control (LOTC/LOPC) events,
consistent with the safety objective as-
sociated with the intended application
can be achieved;
(2) In the full-up configuration, the
system is single fault tolerant, as de-
termined by the Administrator, for
electrical or electronic failures with
respect to LOTC/LOPC events;
(3) Single failures of engine control
system components do not result in a
hazardous engine effect; and
(4) Foreseeable failures or malfunc-
tions leading to local events in the in-
tended aircraft installation, such as
fire, overheat, or failures leading to
damage to engine control system com-
ponents, do not result in a hazardous
engine effect due to engine control sys-
tem failures or malfunctions.
(e) S
ystem safety assessment. When
complying with this section and § 33.75,
the applicant must complete a System
Safety Assessment for the engine con-
trol system. This assessment must
identify faults or failures that result in
a change in thrust or power, trans-
mission of erroneous data, or an effect
on engine operability producing a surge
or stall together with the predicted fre-
quency of occurrence of these faults or
failures.
(f)
Protection systems. (1) The design
and functioning of engine control de-
vices and systems, together with en-
gine instruments and operating and
maintenance instructions, must pro-
vide reasonable assurance that those
engine operating limitations that af-
fect turbine, compressor, fan, and tur-
bosupercharger rotor structural integ-
rity will not be exceeded in service.
(2) When electronic overspeed protec-
tion systems are provided, the design
must include a means for testing, at
least once per engine start/stop cycle,
to establish the availability of the pro-
tection function. The means must be
such that a complete test of the system
can be achieved in the minimum num-
ber of cycles. If the test is not fully
automatic, the requirement for a man-
ual test must be contained in the en-
gine instructions for operation.
(3) When overspeed protection is pro-
vided through hydromechanical or me-
chanical means, the applicant must
VerDate Sep<11>2014
09:06 Jun 28, 2024
Jkt 262046
PO 00000
Frm 00715
Fmt 8010
Sfmt 8010
Y:\SGML\262046.XXX
262046
jspears on DSK121TN23PROD with CFR
706
14 CFR Ch. I (1–1–24 Edition)
§ 33.29
demonstrate by test or other accept-
able means that the overspeed function
remains available between inspection
and maintenance periods.
(g)
Software. The applicant must de-
sign, implement, and verify all associ-
ated software to minimize the exist-
ence of errors by using a method, ap-
proved by the FAA, consistent with the
criticality of the performed functions.
(h)
Aircraft-supplied data. Single fail-
ures leading to loss, interruption or
corruption of aircraft-supplied data
(other than thrust or power command
signals from the aircraft), or data
shared between engines must:
(1) Not result in a hazardous engine
effect for any engine; and
(2) Be detected and accommodated.
The accommodation strategy must not
result in an unacceptable change in
thrust or power or an unacceptable
change in engine operating and start-
ing characteristics. The applicant must
evaluate and document in the engine
installation instructions the effects of
these failures on engine power or
thrust, engine operability, and starting
characteristics throughout the flight
envelope.
(i)
Aircraft-supplied electrical power. (1)
The applicant must design the engine
control system so that the loss, mal-
function, or interruption of electrical
power supplied from the aircraft to the
engine control system will not result
in any of the following:
(i) A hazardous engine effect, or
(ii) The unacceptable transmission of
erroneous data.
(2) When an engine dedicated power
source is required for compliance with
paragraph (i)(1) of this section, its ca-
pacity should provide sufficient margin
to account for engine operation below
idle where the engine control system is
designed and expected to recover en-
gine operation automatically.
(3) The applicant must identify and
declare the need for, and the character-
istics of, any electrical power supplied
from the aircraft to the engine control
system for starting and operating the
engine, including transient and steady
state voltage limits, in the engine in-
structions for installation.
(4) Low voltage transients outside
the power supply voltage limitations
declared in paragraph (i)(3) of this sec-
tion must meet the requirements of
paragraph (i)(1) of this section. The en-
gine control system must be capable of
resuming normal operation when air-
craft-supplied power returns to within
the declared limits.
(j)
Air pressure signal. The applicant
must consider the effects of blockage
or leakage of the signal lines on the en-
gine control system as part of the Sys-
tem Safety Assessment of paragraph
(e) of this section and must adopt the
appropriate design precautions.
(k)
Automatic availability and control
of engine power for 30-second OEI rating.
Rotorcraft engines having a 30-second
OEI rating must incorporate a means,
or a provision for a means, for auto-
matic availability and automatic con-
trol of the 30-second OEI power within
its operating limitations.
(l)
Engine shut down means. Means
must be provided for shutting down the
engine rapidly.
(m)
Programmable logic devices. The
development of programmable logic de-
vices using digital logic or other com-
plex design technologies must provide
a level of assurance for the encoded
logic commensurate with the hazard
associated with the failure or malfunc-
tion of the systems in which the de-
vices are located. The applicant must
provide evidence that the development
of these devices has been done by using
a method, approved by the FAA, that is
consistent with the criticality of the
performed function.
[Amdt. 33–26, 73 FR 48284, Aug. 19, 2008]
§ 33.29
Instrument connection.
(a) Unless it is constructed to pre-
vent its connection to an incorrect in-
strument, each connection provided for
powerplant instruments required by
aircraft airworthiness regulations or
necessary to insure operation of the en-
gine in compliance with any engine
limitation must be marked to identify
it with its corresponding instrument.
(b) A connection must be provided on
each turbojet engine for an indicator
system to indicate rotor system unbal-
ance.
(c) Each rotorcraft turbine engine
having a 30-second OEI rating and a 2-
minute OEI rating must have a means
or a provision for a means to:
VerDate Sep<11>2014
09:06 Jun 28, 2024
Jkt 262046
PO 00000
Frm 00716
Fmt 8010
Sfmt 8010
Y:\SGML\262046.XXX
262046
jspears on DSK121TN23PROD with CFR