Document
Advisory
U.S. Department of Transportation Federal Aviation
Circular
Administration Subject: Instructions for Continued Date: 02/ 27 /1 7 AC No: AC 33.4 - 3 Airworthiness: Aircraft Engine High Intensity Initiated By: ANE - 111 Change: 1 Radiated Fields (HIRF) and Lightning Protection Features 1. Purpose . This advisory circular (AC) change updates the references provided in the original document. The AC change number and the date of the change are shown at the top of each applicable page. The change bar in the left margin indicates where the change is located. The changes described may shift the original text.
2. Principal Changes .
a. Paragraphs 4a and 4b, 5a – 5c, 6d, 8, and 9a reference citations have been updated for currency.
b. Paragraph 5d has been updated to improve clarity.
Page Control Chart Remove Pages Dated Insert Pages Dated 2, 3, 5, and 7 9/16/05 2, 3, 5 , and 7 2/27 /17 3. Website Availability . To access this AC electronically, go to the AC library at http://www.faa.gov/regulations_policies/advisory_circulars .
Advisory
U.S. Department of Transportation Federal Aviation
Circular
Administration Date: 9/16/05 AC No: 33.4-3 Subject: INSTRUCTIONS FOR CONTINUED AIRWORTHIN ESS: Initiated By: ANE-111 AIRCRAFT ENGINE HIGH INTENSITY RADIATED FIELDS (HIR F) AND LIGHTNING PROTECTION FEATURES 1. PURPOSE. This advisory circular (AC) provides guidance and acceptable methods, but not the only methods, that may be used to demonstrate compliance for aircraft engines with § 33.4, Instructions for Continued Airworthiness (ICA), of Title 14 of the Code of Federal Regulations. This AC provides guidance for developing ICA to ensure the continued airworthiness of aircraft engine HIRF and lightning protection features.
2. APPLICABILITY.
a. The guidance provided in this document is directed to engine manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) engine type certification engineers and their designees.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes an acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “shall,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used.
While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if the FAA becomes aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation as the basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from existing regulatory requirements.
3. RELATED REGULATIONS.
a. Part 33, §§ 33.4 and 33.28, and Appendix A.
b. Part 121, Subpart L.
AC 33.4-3, Chg 1 2/27/17 c. Part 135, Subpart J.
d. Part 25, § 25.1529.
4. RELATED READING MATERIAL.
The following materials are referenced in this document. Unless otherwise dated, you should use the latest revision.
a. FAA Documents.
(1) FSIMS Order 8900.1, Flight Standards Information Management Systems (FSIMS) .
(2) AC 20-136, Aircraft Electrical and Electronic System Lightning Protection .
(3) DOT/FAA/AR-04/14, Shield Degradation Effects of Loosened Connector Backshells of Aircraft Wiring Harnesses .
(4) DOT/FAA/AR-04/15, Comparison of Various Impedance Measurement Techniques for Assessing Degradation in Wiring Harness Shield Effectiveness and a Field Survey of FADEC Shield Integrity of In-Service Aircraft .
b. Non-FAA Documents.
(1) SAE ARP5415B, User’s Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning .
(2) SAE ARP5583A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment Superseding .
5. BACKGROUND.
a. Advances in electronic control technology associated with flight critical systems and use of poorly conducting composite materials in aircraft structure have increased concern for the vulnerability of these systems to exposure to HIRF and lightning environments. The lack of specific information on the effects of in-service environmental factors such as corrosion, mechanical vibration, thermal cycling, mechanical damage and repair, and modification on the associated protection features of the type design has also increased concern. The guidance in AC 20-136 emphasizes the need to develop maintenance requirements for aircraft lightning and HIRF protection features. The guidance in FSIMS Order 8900.1, Lightning/High Intensity Radiated Fields (L/HIRF) Protection Maintenance Program ensures that the inspection/maintenance plan used by each operator assures that the HIRF and lightning protection features of the type design are maintained in an airworthy condition.
b. The FAA has an on-going initiative to ensure that the ICA includes appropriate inspection/maintenance functions for engine components that rely on these activities for continued airworthiness. This initiative and an earlier Flight Standards bulletin have revealed AC 33.4-3, Chg 1 2/27/17 that the continued airworthiness of HIRF and lightning protection features depend on maintenance activities. The FSIMS Order 8900.1 relies heavily on the identification of critical systems, the protection features employed in their designs, and the ICA regarding the inspection, maintenance, and possible replacement of all of those features. The appropriate place for these recommendations is in the ICA (specifically, the maintenance, overhaul and component maintenance manuals). Operators may use the ICA, which includes the Inspection Program, when establishing and implementing their FAA approved Continuous Airworthiness Maintenance Programs or other FAA approved inspection/maintenance programs.
c. Although there have not been any inspection/maintenance functions that specifically address the HIRF and lightning protection features of these flight critical engine systems for the FAA to review. Existing overall engine inspection/maintenance functions are in place that ensures the integrity of the HIRF and lightning protection features. These general inspection/maintenance functions have been effective in maintaining the HIRF and lightning protection features in designs that are currently used by industry. This is demonstrated by the 430 million hours (through the first quarter of 2004) of in-service experience on engines with Electronic Engine Control (EEC) systems that have not had any known HIRF and lightning incidents attributed to in-service environmental degradation effects. There have not been any engine problems attributed to the lack of inspection and maintenance of HIRF and lightning protection features. However, in-service surveillance of airplane HIRF and lightning protection features indicates that existing airplane inspection/maintenance functions do not detect some protection degradation. In addition, researchers at Wichita State University have confirmed that without inspection/maintenance some HIRF and lightning protective features may degrade. The FAA Technical Center issued a technical report (DOT/FAA/AR-04/14) in October 2004 about this research (see the reference in paragraph 4a(3) of this AC).
d. FAA and industry committees have developed guidance for inspection/maintenance of aircraft lightning and HIRF protection features. AC 20-136 recommends that the certification applicant develop maintenance requirements for aircraft lightning protection features.
SAE ARP5415B provides additional details and guidelines for lightning protection maintenance.
SAE ARP5583A provides additional details and guidelines for HIRF protection maintenance. In 1999, we published internal guidance that called for review of applicants’ maintenance requirements for aircraft HIRF protection.
e. The following are examples of current inspection/maintenance functions that have played a role in providing good service experience: (1) Inspection and associated procedures linked to troubleshooting and Line Replaceable Unit removals; (2) Fault detection or annunciation of electrical system faults through Built-In-Test; (3) General Visual Inspection associated with scheduled aircraft Zonal Inspection Programs; and AC 33.4-3 9/16/05 (4) Normally scheduled engine shop visits and specific component shop maintenance associated with periodic maintenance, alteration, or upgrade, soft-time component inspection, or maintenance and repair, when applicable.
f. However, typical inspection/maintenance on aircraft and engines has not always been adequate to ensure the continued airworthiness of HIRF and lightning protection features.
Depending upon the complexity of the protection design used, more specific and validated inspection/maintenance functions may be necessary to ensure the continued airworthiness of protection features in service.
g. Although there have been no known HIRF and lightning incidents attributed to in- service engine environmental degradation effects, there is one known case of an engine flameout attributed to lightning for which an airworthiness directive (AD) was issued. Investigation revealed that the engine flameout occurred because several shields for the cable harness of the EEC were no longer properly grounded to the airframe. This condition, if not corrected, could result in insufficient protection of the EEC. In one case it did lead to an engine flameout following a lightning strike. The service bulletin associated with the AD describes procedures for a visual inspection to verify the integrity of the shield grounds for the cable harness of the EEC and to correct any discrepancy. The service bulletin also describes procedures to measure the electrical resistance of certain shield grounds, and to repair them, if necessary. The repair procedures ensure that the metal overbraid (which provides lightning protection for the EEC cable harness) is electrically bonded to the connector, and that the electrical receptacles are electrically bonded to the airframe. This incident emphasizes the importance of maintaining the continued airworthiness of HIRF and lightning protection features.
6. GENERAL.
a. The engine TC, STC, or ATC applicant developing instructions for continued airworthiness for aircraft engine HIRF and lightning protection should identify the appropriate engine systems and equipment, their associated wiring, and all the protection features used by the type design to meet the engine HIRF and lightning protection requirements. The engine systems and equipment may be identified using criteria in the HIRF and lightning protection guidance, such as AC 20-136, or through functional hazard analyses or system safety analyses. Table 1 in Appendix 1 provides a list of potential problem areas and vulnerabilities that may contribute to degradation of protection and that can be considered when developing the ICA’s.
b. At a minimum, systems whose failure or malfunction could prevent continued safe flight and landing of the aircraft, and for lightning, systems whose failure or malfunction could reduce the capability of the aircraft or the ability of the flight crew to cope with adverse operating conditions, should be identified and specifically addressed during the ICA development. Next, the engine TC, STC, or ATC applicant developing the ICA should define the inspection and test method(s), acceptance criteria, and intervals that apply to these HIRF and lightning protection features. These HIRF and lightning instructions for continued airworthiness should detect degradation of protection features so that the features can be repaired to their original condition.
The scope of these ICA depends on the detailed HIRF and lightning protection design approach of a particular engine model and the criticality of the systems being protected.
AC 33.4-3, Chg 1 2/27/17 c. Of special note is that coordination is required to assure compatibility between the engine’s and the installer’s ICA’s.
d. During design and packaging, consideration should be given to the ICA activities that are to be used. Providing easy access to protection components for checks and troubleshooting would be very helpful. Taking this into account in the design can be an important factor.
7. ICA TASKS — HIRF AND LIGHTNING PROTECTION FEATURES.
a. Inspection and maintenance functions for the HIRF and lightning protection features are an essential factor in the continued airworthiness of the protection features and devices. Results from these ICA inspection/maintenance functions may be used to evaluate the effectiveness of protection features of systems.
b. The engine and equipment HIRF and lightning protection features are typically designed to be effective over the life of the engine or equipment. Laboratory environmental tests for vibration, humidity, temperature, and salt exposure are often conducted on protection elements and equipment, and previous service experience on other aircraft engine models or configurations is typically considered when designing these features.
c. In addition, although findings from certain inspection/maintenance actions may not directly indicate the effectiveness of HIRF and lightning protection features, they may provide indirect indications that show degradation in capability. For example, a visual inspection may discover connector corrosion that would indicate the potential for increased shield bonding resistance. But direct measurement must be used to determine shielding effectiveness.
d. Therefore, the ICA should specify those inspection/maintenance functions necessary to provide a high degree of reliability and continued airworthiness for HIRF and lightning protection features and devices. These inspection/maintenance functions should be included in the inspection program and validated. The results of the inspection program should be used to assess its effectiveness in continuing the product’s compliance with the type design in service.
8. TYPICAL INSPECTION/MAINTENANCE FUNCTION ELEMENTS. The following are some of the common inspection/maintenance function element protection features (SAE ARP5415B and SAE ARP5583A provide more details on HIRF and lightning protection maintenance methods): a. Detailed bonding resistance measurements are effective in determining changes to connector bonding resistance, panel bonding, or bonding jumper performance. The disadvantage of this method is that additional testing or analysis is required to assess if bonding resistance changes are affecting the overall system HIRF and lightning protection. Bonding resistance on certain components may have more effect on the HIRF and lightning protection than bonding resistance on other components. Also, traditional bonding resistance measurements are not effective for detecting wire shield degradation, particularly for complex wire bundles with many AC 33.4-3 9/16/05 branches and terminations. Advantages of bonding resistance measurements, however, are that they can often be taken during other aircraft/engine maintenance activities and do not require that the aircraft/engine be located at a specific test site.
b. Loop resistance or impedance measurements are effective in determining changes to wire bundle shields and connectors. Loop measurements are particularly good for complex wire bundles. As with bonding resistance measurements, additional testing or analysis is required to assess if loop resistance or impedance changes have any real effect on the overall system HIRF and lightning protection margin. High loop resistance on certain wire bundles may have more effect on the HIRF and lightning protection than high loop resistance on other wire bundles.
Loop resistance or impedance measurements can often be taken during other aircraft/engine maintenance activities, do not require that the aircraft/engine be located at a specific test site, and do not generally require wire bundle disassembly or disconnection. The FAA Technical Center issued a technical report (DOT/FAA/AR-04/15) in October 2004 on research performed at Wichita State University on this topic.
c. In some cases, an applicant may wish to include limited teardown inspections that may be part of the required inspection/maintenance functions. For example, it may be desirable to disassemble selected connectors to detect corrosion or shield termination failure that would not be visible during maintenance inspections.
d. Full aircraft/engine tests specified in the ICA are one method of determining the continued airworthiness of HIRF and lightning protection components or systems. Full aircraft/engine tests include high-level RF tests, low-level swept frequency tests, and low-level direct drive tests. The results of these tests can be directly compared to the original HIRF and lightning certification data. This approach may be used to evaluate adequacy of the inspection/maintenance functions. The disadvantage of full aircraft/engine tests is that these tests may not provide information on the location or extent of individual protection element degradation if that degradation results in compromising the system’s overall integrity. For example, a full aircraft/engine test could indicate unacceptable degradation, but could not be used to identify the cause, such as an individual connector or shield termination. Another disadvantage is that full aircraft/engine tests require highly specialized test equipment and training.
e. Acceptance criteria should be developed for each specified inspection/maintenance task.
If electrical bonding or loop resistance measurements are required, maximum acceptable electrical resistance values should be specified. These maximum acceptable resistance values should be based on the engine HIRF and lightning protection certification tests or analyses.
f. Certain HIRF and lightning protection features may require specific functional tests to determine their continued airworthiness. For example, lightning protection devices such as transient suppression diodes may require specialized test equipment to determine if these protection devices are still functional. These functional tests are sometimes required following aircraft exposure to severe lightning or to a HIRF environment that can result in failure of these protection features without any fault indication.
AC 33.4-3, Chg 1 2/27/17 g. Inspection of protection features within the electronic engine control has been acceptable at intervals when the electronic engine control has been opened for some other reason, such as, repair of a detected internal fault. However, for this to be a valid method, it must be established that this interval is appropriate. It is possible, though not likely, that the interval could take the unit to its end of life (that is, if the EEC is never returned for repair). This approach depends on no introduction of common mode HIRF and lightning failures, common to more than one engine that would invalidate the original system certification. This factor must be shown to be valid.
h. Appendix A of this document provides an example of the calculation of the average system failure rate for a system where there are undetectable failures in some of the system’s lightning strike protective components and those components are only repaired when the unit is undergoing repair for failures of components that are detectable.
9. VALIDATION OF INSPECTION/MAINTENANCE FUNCTIONS AND DETERMINATION OF THEIR EFFECTIVENESS.
a. The extent of validation activity depends on the scope of the engine inspection/maintenance tasks specific to HIRF and lightning protection. If the results from inspection/maintenance tasks do not provide information to determine the effectiveness of the HIRF and lightning protection features, then validation is necessary. For example, visual inspection may be used to determine the continued airworthiness of the wire shielding or raceways; however, validation tasks should be specified to include direct measurements of appropriate protection features to show acceptable capability. SAE ARP5583A and SAE ° ARP5415B provide more details on HIRF and lightning protection assurance approaches that may be used to validate the inspection/maintenance functions.
b. If the inspection/maintenance tasks provide a direct measurement of the protection elements, then validation may not be required for these elements. When an engine TC, STC, or ATC applicant has determined that validation is not required, the applicant should document the rationale for this determination and present it to the FAA for concurrence. For example, the applicant may have relevant operating experience gained in the past with the same or similar installations. If the effect of this design experience has already been included in the applicant’s design, the applicant may show that a validation activity is not necessary.
c. The validation activity typically uses a sample of in-service engines. When selecting engines for the sample, the applicant should: (1) Focus on high operating time and high flight cycle aircraft.
(2) Consider the operating environment for the selected engines, such as extreme temperatures, corrosive environments like salt spray, or other harsh environments.
(3) If applicable, consider the engine installation configurations.
AC 33.4-3 9/16/05 (4) Use more than one engine in the sampling activity. For example, when dealing with engine models with expected fleet sizes that exceed 500 aircraft, an initial sample size of five to ten aircraft and their associated engines is considered adequate.
d. During normal engine maintenance actions, the HIRF and lightning protection features may be affected, which may affect the validation activity. For example, during an engine shop visit for maintenance it may be determined that a harness should be replaced. Replacing the harness prior to validation, however, would alter the data for establishing the deterioration of the shielding effectiveness of the harness with time. The validation activities in the ICA should consider how to account for engine maintenance actions that may affect the HIRF and lightning protection features.
e. Sampling activities are normally scheduled as close to the beginning of heavy maintenance activities as possible to ensure an evaluation of in-service conditions. Sampling, which can be scheduled along with the heavy maintenance activities, typically requires suitable engine accessibility to gain access to HIRF and lightning protection features. Sampling activities scheduled every four to five years for the selected aircraft/engine are adequate.
f. The engine TC, STC, or ATC applicant may set up a separate inspection/maintenance validation activity for individual engine systems, electrical equipment, or electronic engine controls for HIRF and lightning protection features located within equipment that cannot be effectively verified by aircraft/engine tests or equipment in-service acceptance tests.
g. If the engine ICA does not specify tests to determine functionality of HIRF and lightning protection components, such as filters or transient suppression devices based on an assumed reliability of the protection components, then the validation activity could include tests to validate the assumed reliability. This validation activity could also be done by other means, such as failure mode substantiation or field experience.
h. The validation of the inspection/maintenance functions of the ICA should focus on engine HIRF and lightning protection features associated with systems and features whose failure or malfunction could prevent continued safe flight and landing of the aircraft.
//Original signed by FAF on 9/16/05// Fran A. Favara Acting Manager, Engine and Propeller Directorate Aircraft Certification Service AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERAGE SYSTEM FAILURE RATE.
Note : The following example illustrates calculation of the average system failure rate for a system where there are undetectable failures in some of the system’s lightning strike protective components and those components are only repaired when the unit is undergoing repair for failures of components that are detectable.
1. The subject of using an electronic unit’s mean -time-between-failure (MTBF) for detectable failures as the repair interval for the unit’s undetected failures in the lightning protective components has been receiving increased attention. This appendix presents a simplified Markov model analysis of a basic 2-unit system, such as a full-authority-digital-engine control (FADEC) system. The example shows that the impact of system failures caused by lightning strikes is quite small. The results also show that using the elec tronic unit’s MTBF for detected failures as the repair interval for undetected failures in the lightning protective components is adequate.
2. Two configurations are analyzed: (a) The first configuration is a dual channel system where both channels are contained in the same physical unit. In this system, both channel’s lightning protective elements can be inspected and repaired when the unit is opened for repair of detected faults in either channel.
(b) The second configuration is when each channel is contained in its own separate box, in this case, only those lightning protective components in the unit being repaired for a detected fault can be inspected and, if faulty, repaired.
3. In either case, the applicant must include the instructions in the unit’s Component Maintenance Manual that inspection and repair of the protection devices must be carried out in accordance with these assumptions.
4. The analysis assumes that 10 percent of a channel’s components are for lightning protection.
This is a very conservative, high estimate. It is also assumed that 10 percent of the lightning protective components can fail in an undetected state, also a conservative estimate. Thus, one percent of the units MTBF for detectable failure are assumed to result in undetectable failures in the lightning protective components. It is also assumed that the system is approved for time- limited-dispatch (TLD) operation. TLD operation allows the system to be dispatched with one unit known to be inoperative for a specified number of flight hours before repair of the faulty unit is required.
5. In both examples, the average failure rate with respect to lightning strikes is added to the average random component system failure rate to yield an overall average system failure rate.
This average includes the impact of TLD operations. The impact of TLD operations is shown in the following results.
A1-1 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) The 2-channel system configuration is shown in Figure 1. This figure is meant to show just the redundant electronic elements of the system.
Figure 1. Simplified Diagram of a Redundant 2-Channel System The system is composed of components with a detectable failure rate of R that affect the system’s loss -of-thrust-control (LOTC) rate and of components with an undetectable failure rate of r in the lightning protective components.
Markov Model: A simplified Markov model of the system is shown in Figure 2. The Markov model includes the following conditions: 1. The system can fail due to random failures in the R components. This is shown by the transitions from the P2 and P4 states to the P state.
1FAIL-LOTC LOTC 2. The system can also fail due to lightning strikes. This is shown by the transitions from the P3 and P4 states to the P state.
LOTC A1-2 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) The model shows the two configurations where both channels are in the same physical unit and where the two channels are contained in separate units.
When both channels are in the same unit the repair rate ( ) from the P4 state is to the full- up state because any undetected failures in the lightning protective elements in the channel that does not have detected faults will be found and repaired in either channel.
When each channel is in a separate unit the repair rate from the P4 state is to the P1 state because undetected faults in the channel that is not being repaired (for detected faults) will not be found and repaired.
Figure 2 . Simple Markov Model of 2-channel FADEC system for both channels in a single box and each channel has its own separate box.
A1-3 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) In this model: PFU is the probability of being in the full-up state with regard to undetectable failures in the lightning protective elements.
P1 is the probability of having undetected failures in the lightning components of one of the two channels.
P2 is the probability of having detected failures in one of the two channels.
P3 is the probability of having undetected failures in the lightning protective components of both channels.
P4 is the probability of having detected failures in one of the two channels and having undetected failures in the lightning components of the other channel.
r is the failure rate for undetectable failure in the lightning components of one channel.
R is the failure rate for detectable failures in a channel. The reciprocal of R is the MTBF for detected failures in a channel.
1FAIL-LOTC represents the failure rate from the state where one unit has a detected failure to the loss-of-thrust-control (system) failure state.
is the repair rate for channels with a detected failure. It is equal to 1/TREPAIR. Hence, it is not assumed that a channel with a detected failure is repaired immediately. That channel is allowed to remain in service for TREPAIR flight hours before repair is required.
is the rate for lightning strikes that are of sufficient magnitude to cause the unit(s) to fail, if there are undetectable failures in the lightning protective elements of the unit(s).
In the model pictured, the system repairs itself from the “one unit with failed lightning protection elements” to the full -up state either via: (1) A detected failure in that unit, which causes the unit to get pulled for repair (at which time the protective circuitry is confirmed to be inoperative and repaired) or (2) A lightning strike strong enough to cause the unit to fail, which causes it to be pulled for repair.
A1-4 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) The steady state Markov model equations (eq.) to be solved to obtain the average failure rate of the system are: Conservation Eq. P + P1 + P2 + P3 + P4 + P = 1 FU LOTC P1 State Eq. 2r*P + ( *P4) = ( + 2R + r)*P FU Note1 1 Note 1. If both channels are in the same unit, the *P4 is not in this equation.
P2 State Eq. 2R*P + ( + R)*P1 = ( + + r)*P FU 1FAIL-LOTC 2 P3 State Eq. r*P1 = ( + 2R)*P3 P4 State Eq. R*P2 + 2R*P3 = ( + + )*P4 1FAIL-LOTC The failure rate of the system is: *(P2 + P4)/P + *(P3 + P4)/P 1FAIL-LOTC FU FU = ------------------------------------------------------------ LOTC 1 + (P1 + P2 + P3 + P4)/P FU The first term in the numerator represents those system failures caused by having random components, which affect the LOTC rate, fail in both channels. The second term represents system failures caused by lightning strikes of sufficient magnitude to cause the system to fail if there are undetected failures in one channel of the system combined with detected failures in the other channel or undetected failures in the lightning protective components of channels.
Calculations were based on the following data, where it is assumed that one percent of a channel’s detectable failure rat e represents the undetectable failure of elements providing lightning protection: -6 R = 50*10 failures per hour -6 r = 0.5*10 failures per hour -6 = 34*10 events/hr.
1FAIL-LOTC = varied from 100 up to 800 events/hour in increments of 100 hours.
= varied from 1/2500 to 1/37500 events/hour in increments of 5000 hours.
A1-5 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) Results for the case where both channels are in the same unit are shown in Figure 3 as a function of the lightning strike rate for repair rates of 125, 200 and 350 hours. The data shows that the impact of lightning strikes increases when the mean-time-between-lightning-strikes (MTBLS) decrease. Thus, the MTBLS for the remaining plots is set at 2500 hours. This is very conservative, as the MTBLS for severe lightning strikes (estimated) is expected to be approximately 15,000 hours or greater.
Figure 3 -- System Failure Rate vs. Mean Time Between Lightning Strikes Both Channels in Same Box 1.60E-06 1.40E-06 1.20E-06 Trep(ave) = 200 hrs., Random only Trep(ave) = 125 hrs., Random only 1.00E-06 Trep(ave) = 125 hrs., Random + Lightning Trep(ave) = 200 hrs., Random + Lightning Trep(ave) = 350 hrs., Random + Lightning Failures per hour 8.00E-07 Trep(ave) = 350 hrs., Random only 6.00E-07 4.00E-07 2.00E-07 2500 7500 12500 17500 22500 27500 32500 37500 Mean Time Between Lightning Strikes A1-6 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) Figure 4 represents the case of both channels in the same unit, and it shows the average system failure rate as a function of the repair interval in hours. The repair interval is the allowed dispatch interval for operation with one unit having detected faults in components that lead to an LOTC event. The MTBLS is fixed at 2500 hours.
The data shows that the effect on the overall average system failure rate caused by lightning strikes is quite small. The repair rate — or allowable time for dispatching with one channel having detected faults has a much greater impact.
A1-7 AC 33.4-3 9/16/05 Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) Figure 5 shows the same data for a system configuration where the two channels have their own separate boxes. Similar to Figure 4, the data shows that the impact of having separate boxes for each channel has a negligible impact on the LOTC rate of the system as compared with the repair time, or allowed dispatch interval, for a failed unit.
Figure 5 -- Redundant Electronics Failure Rate as a function of Repair Hours with Lightning Strikes Fixed at 2500 hours - channels in separate boxes 3.00E-06 2.50E-06 2.00E-06 1.50E-06 1.00E-06 System Failure Rate Random + Lightning Strike Failure Rate Random Failure Rate Only 5.00E-07 0.00E+00 100 200 300 400 500 600 700 800 Repair Time in Hours A1-8 AC 33.4-3 9/16/05 Appendix 1 Conclusion Both Figures 4 and 5 show that the unit repair time has a much greater influence than lightning strikes on the system’s LOTC. The contribution to the system failure rate from lightning strikes is less than one percent for any reasonable system repair rate.
A1-9 AC 33.4-3 9/16/05 Appendix 1 TABLE 1 — POTENTIAL PROBLEM AREAS AND VULNERABILITIES CONTRIBUTING TO POSSIBLE DEGRADATION OF ELECTROMAGNETIC INTERFERENCE (EMI) AND LIGHTNING PROTECTION OF ENGINE AND PROPELLER ELECTRONIC CONTROL SYSTEMS FOR CONSIDERATION IN THE ESTABLISHMENT OF INSPECTION/MAINTENANCE FUNCTIONS: (i.e., conductive current path; attenuation; I. Structures Integrity: struts and wing fairings (composites); and; how material is installed around bundles) • structural parts bonding • galvanic action • internal and external meshes • damage tolerance • internal and external surface treatments • hydroscopic contamination (absorption of (coatings) moisture) • structural corrosion • gaskets and seals • ground strap integrity • latches and hinges • structural repairs • change of materials and material integrity • aperture control (holes and slots) II. Installation, Location, and Routing (i.e., location of Electronic Control; Integrity: accuracy of cable routing; physical geometry and relation to structure, and; distance to ground) • distance from ground plane • inappropriate repair/alteration • proper cable retention • nonessential system installation • routing wire path apertures • system to system proximity • wear, fretting • changing zone threats • rebundling/rerouting • ground and bonding integrity (i.e., integrity of cables; enclosures of III. Wire and Bundling Shielding Integrity: Electronic Controls; meshes, and; actuators) • connectors (EMI fingers in place, tight, • gasket integrity and not damaged) • backshells (in place and tight) • pin and socket security • shield termination • wire abrasion or cold flowing • shield corrosion • wire shorts to connector shell • shield deformation/damage • wire shorts to conductors • connecto r corrosion • wire count • connector damage • cable dress/wire sleeves • ground strap surface corrosion • element failures • fastener security (tightness) • surge protection failures • faying surface condition • isolation resistance/insulation breakdown A1-10 AC 33.4-3 9/16/05 Appendix 1 (i.e., internal, on board, and external; EMI IV. Terminal Protection Device (TPD) Integrity: filters; transzorbs; Metal Oxide Varistors (MOV’s); and resistor elements) • Silicon Avalanche Diode (SAD) failures • moisture and contamination (open, short, or shift) • solder joint integrity • EMI gasket deterioration • tightness (during assembly) • cracked/damaged ferrites • filter pin ground opening • inductance element defects (filters) • MOV failure (open, short, or shift) • series resistance defects • reverse leakage • corrosion • capacitor element defects (filters) V. Circuit Design Integrity: (i.e., enclosures for circuits; ground plane; isolation; AC/DC coupling; changes to circuit characteristics, and; effects on protection after functional failure) • green wire repairs (jumper repair) • unterminated lines • violation of approved parts list • cuts and jumpers • inappropriate approved parts list • damage to ground planes • grounding and bonding • corrosion to ground planes • gaskets • component solder joint integrity • component fault tolerance (operation with faults present) (i.e., ground straps in place; impedance VI. Grounding and Bonding Integrity: bonding of connectors, and; protection device grounding) • loose ground straps • damage to ground planes • corrosion to connector shells • corrosion to ground planes A1-11 AC 33.4-3 9/16/05 ADVISORY CIRCULAR FEEDBACK INFORMATION If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) complete the form online at https://ksn2.faa.gov/avs/dfs/Pages/Home.aspx or (2) emailing this form to 9-AWA-AVS-AIR- DMO@faa.gov Subject: AC 33.4-3 Date: ___________ Please mark all appropriate line items: An error (procedural or typographical) has been noted in paragraph _______ on page _______ .
Recommend paragraph _______ on page _____ __ be changed as follows: In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)
Other comments: I would like to discuss the above. Please contact me.
Submitted by: _________________________________ Date: __________________