Voglio sapere a riguardo di…

lotter on DSK11XQN23PROD with RULES3

Federal Register / Vol. 86, No. 184 / Monday, September 27, 2021 / Rules and Regulations Hardware, dated April 19, 2000,6
distinguishes between complex and simple electronic hardware.
Special Condition no. 10d proposed to require the applicant to substantiate all functional aspects of the control system to show that it performs its intended functions throughout the declared operational envelope.
Special Condition no. 10e proposed to require the system and component tests in Special Condition no. 27 to demonstrate the control will function as intended at environmental limits that magniX cannot otherwise substantiate.
These limits include temperature, vibration, HIRF, and other limits addressed in RTCA DO160G, Environmental Conditions and Test Procedures for Airborne Electronic/
Electrical Equipment and Instruments 7
DO160G or other appropriate industry standards for airborne environmental-conditions testing, such as Mil-STD810 Environmental Engineering Considerations and Laboratory Tests, Mil-STD202 Test Method Standard for Electronic and Electrical Component Parts, Mil-461
Requirements for the Control of Electromagnetic Interference Characteristics of Subsystems and Equipment, and those listed in Advisory Circular 2116G, RTCA
Document DO160 versions D, E, F, and G, Environmental Conditions and Test Procedures for Airborne Equipment, Special Condition no. 10e also requires magniX to document the environmental limits to which the system has been qualified in the engine installation manual.
Special Condition no. 10f proposed to require the engine control system not to exceed a maximum rate of Loss of Power Control LOPC for the aircraft types that will use the magniX engines, be single-fault tolerant in the full-up configuration, not have any single failure that results in hazardous engine effects, and not have any likely failure or malfunction that lead to local events in the intended installation.
The FAA issued Advisory Circular AC
33.283, Guidance Material For 14 CFR
33.28, Engine Control Systems, on May 23, 2014.8 Paragraph 62 of this AC
provides applicants with guidance about defining an engine control system failure when showing compliance with the requirements of 33.28. It also explains the safety objectives of the requirements, provides criteria for a loss 6 https my.rtca.org/NC__Product?id=
a1B36000001IcjTEAS.
7 https my.rtca.org/NC__Product?id=
a1B36000001IcnSEAS.
8 https www.faa.gov/documentLibrary/media/
Advisory_Circular/AC_33_28-3.pdf.

VerDate Sep<11>2014

19:16 Sep 24, 2021

Jkt 253001

of thrust control LOTC/LOPC events for reciprocating and turbine engines.
However, the guidance in AC 33.283
may not have sufficient information to identify failure modes and establish acceptable LOTC/LOPC rates for the magniX electric engines because electric engines did not exist when the FAA
issued this AC.
The phrase in the full-up configuration used in Special Condition no. 10f2 refers to a system without any fault conditions present.
When in the full-up configuration, the electronic control system must be single fault tolerant for electrical, electrically detectable, and electronic failures involving LOPC events.
The term local events used in Special Condition no. 10f4 means failures or malfunctions that could lead to hazardous effects such as fire, overheat, or failures causing damage to engine control system components.
Special Condition no. 10g proposed to require magniX to conduct a system safety assessment to support the safety analysis in Special Condition no. 17.
Special Condition no. 10h proposed to require that the design and function of the engine control devices and systems, together with the engine instruments, operating instructions, and maintenance instructions, ensure that engine operating limits will not be exceeded in-service.
Special Condition no. 10i proposed to protect the airplane and engine from single failures relating to the aircraftsupplied data by mandating that the control system is able to detect and accommodate such failures, and not result in a hazardous engine effect.
The term independent, as it is used in fully independent engine systems, means that the controllers should be either self-sufficient and isolated from other aircraft systems or provide redundancy. In the case of loss, interruption, or corruption of aircraftsupplied data, the engine must continue to function without hazardous engine effects.
The term accommodated means that when a fault has been detected, the system must continue to function safely.
Special Condition no. 10j proposed to require magniX to show that the loss, malfunction, or interruption of the control system electrical power source will not result in a hazardous engine effect, the unacceptable transmission of erroneous data, or continued engine operation in the absence of the control function.
Comment Summary: Rolls-Royce asked that the FAA clarify the requirements contained in Special Condition nos. 10f1 and f2. The
PO 00000

Frm 00009

Fmt 4701

Sfmt 4700

53515

commenter expressed concern that the single fault tolerance requirement in Special Condition no. 10f2 would be applied to both historical electrical elements of the engine control system and to the new high-voltage electrical/
electronic elements required to motivate an electric motor. Rolls-Royce commented that it was possible the wording of this condition would be extended to cover loss of power LOP
events due to the difficulties of establishing the boundary between the control and the motor drive in an electric engine. Rolls-Royce asked the FAA to modify this special condition to clarify that the degree of fault tolerance in the high-voltage electrical/electronic elements will be governed by the LOP
reliability requirement of Special Condition no. 10f1, and not the single fault tolerance requirement of LOPC of Special Condition no. 10f2.
AIAB articulated a similar concern and recommended the FAA delete Special Condition no. 10f2 in these final special conditions. AIAB stated a loss of thrust control LOTC/LOPC event could be considered minor in aircraft with distributed propulsion, and therefore may not require electrical redundancy.
FAA Response: The comments from Rolls-Royce and AIAB describe the potential dependency between the electric engine safety analysis and certain aircraft configurations, and the potential effect the aircraft design could have on the need for engine design redundancy. However, magniX designed these engines for certain aircraft configurations that do not have special flight control capabilities, which is why the LOPC and single fault tolerance criteria from 14 CFR part 33 are adopted in these special conditions. The FAA
also included suitable for the intended aircraft application in Special Condition no. 10f1, and as determined by the Administrator in Special Condition no. 10f2 Engine control system failures to constrain the use of these engines to aircraft that are designed with compatible engine safety assumptions. Therefore, the FAA did not change these special conditions as a result of this comment.
Comment Summary: TCCA
commented that the FAAs introductory text to proposed Special Condition no.
10e, Environmental limits, indicated that the environmental limits are addressed in DO160G. However, TCCA
suggested that some of the test specifications, methods, and categories in DO160G might not be adequate for high-voltage systems such as the highvoltage components of this engine.
TCCA suggested that the FAA modify Special Condition no. 10e to require
E:FRFM27SER3.SGM

27SER3