7
$\begingroup$

I am confused regarding the Design Assurance Level (DAL) of aircraft engines. I attended a seminar in which the speaker mentioned aircraft engines as being DAL level B; when we asked about it, he answered that it's not required by the FAA to have two engines running because an aircraft is capable of flying with only one engine. Hence, it's classified as DAL level B.

If I'm not wrong, the FAA states that an commercial aircraft should be able to fly with one engine with for at least 1.5 to 2 hours. So was the speaker right about the DAL classification?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ From reading the wikipedia article, it looks like DO-178B only applies to software. So when you ask this question, do you mean the mechanical components of the engine? Or can we safely assume you mean the software components controlling the engine? $\endgroup$ – Jay Carr Dec 16 '16 at 14:46
  • $\begingroup$ I'm assuming this is applying to the software, as that is what is assigned a DAL by the manufacturer (and accepted by the FAA) during the DO-178B/C process. $\endgroup$ – selectstriker2 Dec 23 '16 at 18:14
10
$\begingroup$

DAL started in the software world with DO-178, but it has been extended to the entire development process. This is documented in ARP4754A Guidelines For Development Of Civil Aircraft and Systems and ARP4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.

But to the direct question, 14 CFR 33.75 Safety Analysis, describes the safety levels required for the engine. Matching the wording there

(3) The applicant must show that hazardous engine effects are predicted to occur at a rate not in excess of that defined as extremely remote (probability range of 10−7 to 10−9 per engine flight hour).

with ARP4761, it is describing DAL B. So I would have to agree with the speaker.

But I will offer one point of personal experience which is that one FAA certification officer insisted the DAL for the FADEC software should be DAL A. The argument is that a common mode fault in the FADEC software could result in simultaneous loss of both engines.

One other fine point of certification is that complying with Part 33 allows you to get a Type Certificate for the engine. That doesn't mean it meets all the requirements necessary to allow an aircraft with that engine installed receive an aircraft Type Certificate (under Parts 23 or 25).

|improve this answer
$\endgroup$
1
$\begingroup$

Assuming a two engine aircraft, this is wrong. While the FHA (see SAE ARP 4761) may have a case that says the loss of one engine is Major (Part 25 DAL C) The FHA should also have a case that says loss of both is Catastrophic (Part 25 DAL A). Catastrophic requires DAL A or two things that are DAL B that are dissimilar. Or rather, two things that use a dissimilar development assurance process, see SAE ARP 4754A. Since the fine folks that make the FADEC are not going to do that, you are left with DAL A.

|improve this answer
$\endgroup$
  • $\begingroup$ I think you will find that quite a few FADEC's are DAL B. $\endgroup$ – selectstriker2 Oct 25 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.