DOU 01/11/2024 - Diário Oficial da União - Brasil

TEXTO OFICIAL · ÍNTEGRA

Documento assinado digitalmente conforme MP nº 2.200-2 de 24/08/2001, que institui a Infraestrutura de Chaves Públicas Brasileira - ICP-Brasil. Este documento pode ser verificado no endereço eletrônico http://www.in.gov.br/autenticidade.html, pelo código 05152024110100244 244 Nº 212, sexta-feira, 1 de novembro de 2024 ISSN 1677-7042 Seção 1 (c) Safety analysis assumptions. The assumptions of the safety analysis as described in EVE.3375(d) with respect to the reliability of safety devices, instrumentation, early warning devices, maintenance checks, and similar equipment or procedures that are outside the control of the engine manufacturer. EVE.3307 - Engine ratings and operating limits. (a) Engine ratings and operating limitations are established by ANAC and included in the engine certificate data sheet specified in RBAC 21.41, including ratings and limitations based on the operating conditions and information specified in this section, as applicable, and any other information found necessary for safe operation of the engine. (b) For electric engines, ratings and operating limits are established relating to the following: (1) Shaft power, torque, rotational speed, and temperature for: (i) Rated takeoff power; (ii) Rated maximum continuous power; and (ii) Rated maximum temporary power and associated time limit. (2) Duty cycle and the rating at that duty cycle. The duty cycle must be declared in the type certificate data sheet or documented in the engine installation manual. (3) Reserved. (4) Power-supply requirements. (5) Any other ratings or limitations that are necessary for the safe operation of the engine. (c) In determining the engine performance and operating limitations, the overall limits of accuracy of the engine control system, of the engine electrical systems, and of the necessary instrumentation as defined in EVE.3305(a)(6) must be taken into account. EVE.3308 - Selection of Engine Power and Thrust Ratings (a) Requested engine power and thrust ratings must be selected by the applicant. (b) Each selected rating must be for the lowest power or thrust that all engines of the same type may be expected to produce under the conditions used to determine that rating. EVE.3315 - Materials (a) Be established on the basis of experience or tests; and (b) Conform to approved specifications (such as industry or military specifications) that ensure their having the strength and other properties assumed in the design data. EVE.3317 - Fire protection (a) The design and construction of the engine and the materials used must minimize the probability of the occurrence and spread of fire during normal operation and failure conditions, and must minimize the effect of such a fire. In addition, the design and construction of electrical engines must minimize the probability of the occurrence of an internal fire that could result in structural failure or other hazardous effects. EVE.3318 - High-Voltage EWIS arc fault protection (a) High-voltage EWIS must be protected against arc faults that can lead to hazardous engine effects as defined in EVE.3375(g)(2). Any non-protected electrical wiring interconnections must be analyzed to show that arc faults do not cause a hazardous engine effect.EVE.3319 - Durability. The engine design and construction must minimize the development of an unsafe condition of the engine between maintenance intervals, overhaul periods, or mandatory actions described in the applicable ICA. EVE.3321 - Engine cooling. Engine design and construction must provide the necessary cooling under conditions in which the aircraft is expected to operate. If cooling is required to satisfy the safety analysis as described in EVE.3375, the cooling system monitoring features and usage must be documented in the engine installation manual. EVE.3323 - Engine Mounting Attachment and Structure (a) The maximum allowable limit and ultimate loads for engine mounting attachments and related engine structure must be specified. (b) The engine mounting attachments and related engine structure must be able to withstand: (1) The specified limit loads without permanent deformation; and (2) The specified ultimate loads without failure,but may exhibit permanent deformation. EVE.3325 - Accessory Attachments The engine must operate properly with the accessory drive and mounting attachments loaded. Each engine accessory drive and mounting attachment must include provisions for sealing to prevent contamination of, or unacceptable leakage from, the engine interior. A drive and mounting attachment requiring lubrication for external drive splines, or coupling by engine oil, must include provisions for sealing to prevent unacceptable loss of oil and to prevent contamination from sources outside the chamber enclosing the drive connection. The design of the engine must allow for the examination, adjustment, or removal of each accessory required for engine operation. EVE.3327 - Overspeed (a) A rotor overspeed must not result in a burst, rotor growth, or damage that results in a hazardous engine effect, as defined in EVE.3375(g)(2). Compliance with this paragraph must be shown by test, validated analysis, or a combination of both. Applicable assumed rotor speeds must be declared and justified. (b) Rotors must possess sufficient strength with a margin to burst above certified operating conditions and above failure conditions leading to rotor overspeed. The margin to burst must be shown by test, validated analysis, or a combination thereof. (c) The engine must not exceed the rotor-speed operational limitations that could affect rotor structural integrity. EVE.3328 - Engine control systems. (a) Applicability. - These requirements apply to any system or device that is part of the engine type design that controls, limits, monitors, or protects engine operation and is necessary for the continued airworthiness of the engine. (b) Engine control. - The engine control system must ensure the engine does not experience any unacceptable operating characteristics or exceed its operating limits, including in failure conditions where the fault or failure results in a change from one control mode to another, from one channel to another, or from the primary system to the back-up system, if applicable. (c) Design assurance. The software and complex electronic hardware, including programmable logic devices, must be: (1) Designed and developed using a structured and systematic approach that provides a level of assurance for the logic commensurate with the hazard associated with the failure or malfunction of the systems in which the devices are located; and (2) Substantiated by a verification methodology acceptable to ANAC. (d) Validation. All functional aspects of the control system must be substantiated by test, analysis, or a combination thereof, to show that the engine control system performs the intended functions throughout the approved flight envelope. (e) Environmental limits. Environmental limits that cannot be adequately substantiated by endurance demonstration, validated analysis, or a combination thereof must be demonstrated by the system and component tests in EVE.3391. (f) Engine control system failures. The engine control system must: (1) Have a maximum rate of Loss of Power Control (LOPC) that is suitable for the intended aircraft application. The estimated LOPC rate must be specified in the engine installation manual; (2) When in the full-up configuration, be single fault tolerant, as determined by ANAC, for electrical, electrically detectable, and electronic failures involving LOPC events; (3) Not have any single failure that results in hazardous engine effects as defined in EVE.3375(g)(2); and (4) Ensure failures or malfunctions that lead to local events in the aircraft do not result in hazardous engine effects as defined in EVE.3375(g)(2) due to engine control system failures or malfunctions. (g) System safety assessment. The applicant must perform a system safety assessment. This assessment must identify faults or failures that affect normal operation, together with the predicted frequency of occurrence of these faults or failures. The intended aircraft application must be taken into account to assure the assessment of the engine control system safety is valid. The rates of hazardous and major faults must be declared in the engine installation manual. (h) Protection systems. The engine control devices and systems' design and function, together with engine instruments, operating instructions, and maintenance instructions, must ensure that engine operating limits that can lead to a hazard will not be exceeded in-service. (i) Aircraft-supplied data. Any single failure leading to loss, interruption, or corruption of aircraft-supplied data (other than power command signals from the aircraft), or aircraft-supplied data shared between engine systems within a single engine or between fully independent engine systems, must: (1) Not result in a hazardous engine effect, as defined in EVE.3375(g)(2), for any engine installed on the aircraft; and (2) Be able to be detected and accommodated by the control system. (j) Engine control system electrical power.(1) The engine control system must be designed such that the loss, malfunction, or interruption of the control system electrical power source will not result in a hazardous engine effect, as defined in EVE.3375(g)(2), the unacceptable transmission of erroneous data, or continued engine operation in the absence of the control function. The engine control system must be capable of resuming normal operation when aircraft-supplied power returns to within the declared limits. (2) The applicant must identify and declare, in the engine installation manual, the characteristics of any electrical power supplied from the aircraft to the engine control system, including transient and steady-state voltage limits, and any other characteristics necessary for safe operation of the engine. EVE.3329 - Instrument connection. (a) Unless it is constructed to prevent its connection to an incorrect instrument, each connection provided for powerplant instruments required by aircraft airworthiness regulations or necessary to insure operation of the engine in compliance with any engine limitation must be marked to identify it with its corresponding instrument. (b) In addition, as part of the system-safety assessment of EVE.3328(g) and EVE.33100(h), the applicant must assess the possibility and subsequent effect of incorrect fit of instruments, sensors, or connectors. Where practicable, the applicant must take design precautions to prevent incorrect configuration of the system. (c) The applicant must make provision for the installation of instrumentation necessary to ensure operation in compliance with engine operating limitations. Where, in presenting the safety analysis, or complying with any other requirement, dependence is placed on instrumentation that is not otherwise mandatory in the assumed aircraft installation, then the applicant must specify this instrumentation in the engine installation instructions and declare it mandatory in the engine approval documentation. (d) The applicant must provide instrumentation enabling the flightcrew to monitor the functioning of the engine cooling system unless evidence shows that: (1) Other existing instrumentation provides adequate warning of failure or impending failure; (2) Failure of the cooling system would not lead to hazardous engine effects, as defined in EVE.3375(g)(2), before detection; or (3) The probability of failure of the cooling system is extremely remote. (e) The sensors, together with associated wiring and signal conditioning, must be segregated, electrically and physically, to the extent necessary to ensure that the probability of a fault propagating from instrumentation and monitoring functions to control functions, or vice versa, is consistent with the failure effect of the fault. EVE.3362 - Stress analysis. (a) A mechanical and thermal stress analysis, as well as the stress caused by electromagnetic forces, must show a sufficient design margin to prevent unacceptable operating characteristics and hazardous engine effects as defined in EVE.3375(g)(2). (b) Maximum stresses in the engine must be determined by test, validated analysis, or a combination thereof, and must be shown not to exceed minimum material properties." EVE.3363 - Vibration (a) The engine must be designed and constructed to function throughout its normal operating range of rotor speeds and engine output power, including defined exceedances, without inducing excessive stress in any of the engine parts because of vibration and without imparting excessive vibration forces to the aircraft structure. (b) Each engine design must undergo a vibration survey to establish that the vibration characteristics of those components subject to induced vibration are acceptable throughout the declared flight envelope and engine operating range for the specific installation configuration. The possible sources of the induced vibration that the survey must assess are mechanical, aerodynamic, acoustical, internally induced electromagnetic, installation induced effects that can affect the engine vibration characteristics, and likely environmental effects. This survey must be shown by test, validated analysis, or a combination thereof. EVE.3370 - Critical and life-limited parts. (a) The applicant must show, by a safety analysis or means acceptable to the ANAC, whether rotating or moving components, bearings, shafts, static parts, and non- redundant mount components should be classified, designed, manufactured, and managed throughout their service life as critical or life-limited parts. (1) Critical part means a part that must meet prescribed integrity specifications to avoid its primary failure, which is likely to result in a hazardous engine effect as defined in EVE.3375(g)(2). (2) Life-limited parts may include but are not limited to a rotor and major structural static part, the failure of which can result in a hazardous engine effect, as defined in EVE.3375(g)(2), due to low-cycle fatigue (LCF) mechanism. A life limit is an operational limitation that specifies the maximum allowable number of flight cycles that a part can endure before the applicant must remove it from the engine. (b) In establishing the integrity of each critical part or life-limited part, the applicant must provide to the ANAC the following three plans for approval:(1) An engineering plan that contains the steps required to ensure each engine life-limited part is withdrawn from service at an approved life before hazardous engine effects can occur. In addition, the engineering plan must contain the steps to ensure each engine critical part is withdrawn from service before hazardous engine effects can occur. These steps include validated analysis, test, or service experience which ensures that the combination of loads, material properties, environmental influences and operating conditions, including the effects of other engine parts influencing these parameters, are sufficiently well known and predictable so that the operating limitations can be established and maintained for each engine life- limited and critical part. Applicants must perform appropriate damage tolerance assessments to address the potential for failure from material, manufacturing, and service induced anomalies within the approved life of the part. Applicants must publish a list of the life-limited engine parts and the approved life for each part in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness as required by EVE.1529. (2) A manufacturing plan that identifies the specific manufacturing constraints necessary to consistently produce each engine life-limited and critical part with the attributes required by the engineering plan. (3) A service management plan that defines in-service processes for maintenance and the limitations to repair for each engine life-limited and critical part that will maintain attributes consistent with those required by the engineering plan. These processes and limitations will become part of the Instructions for Continued Airworthiness. EVE.3373 - Power response. (a) The design and construction of the engine, including its control system, must enable an increase- (1) From the minimum power setting to the highest rated power without detrimental engine effects in the intended aircraft application; (2) From the minimum obtainable power while in flight, and while on the ground, to the highest rated power within a time interval determined to be appropriate for the intended aircraft application; and (3) From the minimum torque to the highest rated torque without detrimental engine effects in the intended aircraft application.