When operating Twin Engine helicopter with FADEC controls, is is necessary to certify at DAL-A? If so, why? Is it related to the FADEC certification or is this required for an aircraft potentially roling into a military platform?
$\begingroup$
$\endgroup$
4
-
1$\begingroup$ That is going to depend on the System Safety Analysis for the aircraft $\endgroup$– selectstriker2Commented Feb 26, 2019 at 19:41
-
$\begingroup$ Thanks... I was inquiring of that earlier, likely candidate for this discussion is data acquisition only, not likely requiring Class A $\endgroup$– user37553Commented Feb 26, 2019 at 19:50
-
$\begingroup$ Wait, are you talking about the FADEC software DAL level or something else? I would expect the FADEC software to be either DAL A or B, depending on the installation and system safety analysis. $\endgroup$– selectstriker2Commented Feb 26, 2019 at 19:53
-
$\begingroup$ data acquisition related to FADEC, but not part of the FADEC $\endgroup$– user37553Commented Feb 26, 2019 at 20:08
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
With no reversion to a direct mode, ie retaining control of the engine possibly with limitation after fadec failure would imply DAL A since that fault results in loss of ability to maintain flight.
With some form of control reversion, the authorities would accept a much lower dal.
You cannot claim credit for the second engine since both engines use common. Software and hardware. So any common cause, common mode fault could take out both engines.
For part 29 helicopters I would expect Dal A, part 27 probably B..
$\begingroup$
$\endgroup$
One thing that must be addressed is that while the engine is certificated as part of the airplane or rotorcraft, it first must receive its own Type certificate under Part 33. The requirements there often are more stringent than at the aircraft level as the engine is normally developed for the most stringent application of the engine.
Looking for guidance we can start with Part 33 which gives us the rule that the DAL must be appropriate to the risks identified in the safety analysis. Since the question is about FADECs, it's worth looking at the Advisory Circulars, starting with AC 33.28-3 Guidance Material For 14 CFR §33.28, Engine Control Systems.
Chapter 9 addresses software.
9-1. Rule Text. Section 33.28(g) reads:
“(g) Software. The applicant must design, implement, and verify all associated software to minimize the existence of errors by using a method, approved by the FAA, consistent with the criticality of the performed functions.”
Moving down to the software section:
9-2. Guidance: Software.
d. Software levels.
(1) The level of software required for certification depends on the criticality of the functions it performs. For example, failures resulting in significant thrust or power increases or oscillations may be more severe than an engine shutdown. Therefore, consider these failures when selecting a given software level.
(a) Design, implementation, and verification of software as specified in Level A (DO-178C) is normally needed for turbine engines.
(b) For a reciprocating engine EECS, software implemented as specified in Level C is the minimum acceptable requirement.
(c) The applicant may choose to evaluate the failure condition criticality of EECS functions to determine if Level B or C software would be adequate. The applicant must coordinate this evaluation with the aircraft designer and the cognizant aircraft ACO during the EECS development program.
So it would appear that assuming your twin-engine helicopter used turbine engines, the FADEC would require Level A software.
