This subpart prescribes the general design and construction requirements for reciprocating and turbine aircraft engines.

The suitability and durability of materials used in the engine must—

(a) Be established on the basis of experience or tests; and

(b) Conform to approved specifications (such as industry or military specifications) that ensure their having the strength and other properties assumed in the design data.

(a) The design and construction of the engine and the materials used must minimize the probability of the occurrence and spread of fire during normal operation and failure conditions, and must minimize the effect of such a fire. In addition, the design and construction of turbine engines must minimize the probability of the occurrence of an internal fire that could result in structural failure or other hazardous effects.

(b) Except as provided in paragraph (c) of this section, each external line, fitting, and other component, which contains or conveys flammable fluid during normal engine operation, must be fire resistant or fireproof, as determined by the Administrator. Components must be shielded or located to safeguard against the ignition of leaking flammable fluid.

(c) A tank, which contains flammable fluids and any associated shut-off means and supports, which are part of and attached to the engine, must be fireproof either by construction or by protection unless damage by fire will not cause leakage or spillage of a hazardous quantity of flammable fluid. For a reciprocating engine having an integral oil sump of less than 23.7 liters capacity, the oil sump need not be fireproof or enclosed by a fireproof shield.

(d) An engine component designed, constructed, and installed to act as a firewall must be:

(1) Fireproof;

(2) Constructed so that no hazardous quantity of air, fluid or flame can pass around or through the firewall; and,

(3) Protected against corrosion;

(e) In addition to the requirements of paragraphs (a) and (b) of this section, engine control system components that are located in a designated fire zone must be fire resistant or fireproof, as determined by the Administrator.

(f) Unintentional accumulation of hazardous quantities of flammable fluid within the engine must be prevented by draining and venting.

(g) Any components, modules, or equipment, which are susceptible to or are potential sources of static discharges or electrical fault currents must be designed and constructed to be properly grounded to the engine reference, to minimize the risk of ignition in external areas where flammable fluids or vapors could be present.

(a) Engine design and construction must minimize the development of an unsafe condition of the engine between overhaul periods. The design of the compressor and turbine rotor cases must provide for the containment of damage from rotor blade failure. Energy levels and trajectories of fragments resulting from rotor blade failure that lie outside the compressor and turbine rotor cases must be defined.

(b) Each component of the propeller blade pitch control system which is a part of the engine type design must meet the requirements of §§ 35.21, 35.23, 35.42 and 35.43 of this chapter.

Engine design and construction must provide the necessary cooling under conditions in which the airplane is expected to operate.

(a) The maximum allowable limit and ultimate loads for engine mounting attachments and related engine structure must be specified.

(b) The engine mounting attachments and related engine structure must be able to withstand—

(1) The specified limit loads without permanent deformation; and

(2) The specified ultimate loads without failure, but may exhibit permanent deformation.

The engine must operate properly with the accessory drive and mounting attachments loaded. Each engine accessory drive and mounting attachment must include provisions for sealing to prevent contamination of, or unacceptable leakage from, the engine interior. A drive and mounting attachment requiring lubrication for external drive splines, or coupling by engine oil, must include provisions for sealing to prevent unacceptable loss of oil and to prevent contamination from sources outside the chamber enclosing the drive connection. The design of the engine must allow for the examination, adjustment, or removal of each accessory required for engine operation.

(a) For each fan, compressor, turbine, and turbosupercharger rotor, the applicant must establish by test, analysis, or a combination of both, that each rotor will not burst when operated in the engine for 5 minutes at whichever of the conditions defined in paragraph (b) of this section is the most critical with respect to the integrity of such a rotor.

(1) Test rotors used to demonstrate compliance with this section that do not have the most adverse combination of material properties and dimensional tolerances must be tested at conditions which have been adjusted to ensure the minimum specification rotor possesses the required overspeed capability. This can be accomplished by increasing test speed, temperature, and/or loads.

(2) When an engine test is being used to demonstrate compliance with the overspeed conditions listed in paragraph (b)(3) or (b)(4) of this section and the failure of a component or system is sudden and transient, it may not be possible to operate the engine for 5 minutes after the failure. Under these circumstances, the actual overspeed duration is acceptable if the required maximum overspeed is achieved.

(b) When determining the maximum overspeed condition applicable to each rotor in order to comply with paragraphs (a) and (c) of this section, the applicant must evaluate the following rotor speeds taking into consideration the part's operating temperatures and temperature gradients throughout the engine's operating envelope:

(1) 120 percent of the maximum permissible rotor speed associated with any of the engine ratings except one-engine-inoperative (OEI) ratings of less than 2 1/2 minutes.

(2) 115 percent of the maximum permissible rotor speed associated with any OEI ratings of less than 2 1/2 minutes.

(3) 105 percent of the highest rotor speed that would result from either:

(i) The failure of the component or system which, in a representative installation of the engine, is the most critical with respect to overspeed when operating at any rating condition except OEI ratings of less than 2 1/2 minutes, or

(ii) The failure of any component or system in a representative installation of the engine, in combination with any other failure of a component or system that would not normally be detected during a routine pre-flight check or during normal flight operation, that is the most critical with respect to overspeed, except as provided by paragraph (c) of this section, when operating at any rating condition except OEI ratings of less than 2 1/2 minutes.

(4) 100 percent of the highest rotor speed that would result from the failure of the component or system which, in a representative installation of the engine, is the most critical with respect to overspeed when operating at any OEI rating of less than 2 1/2 minutes.

(c) The highest overspeed that results from a complete loss of load on a turbine rotor, except as provided by paragraph (f) of this section, must be included in the overspeed conditions considered by paragraphs (b)(3)(i), (b)(3)(ii), and (b)(4) of this section, regardless of whether that overspeed results from a failure within the engine or external to the engine. The overspeed resulting from any other single failure must be considered when selecting the most limiting overspeed conditions applicable to each rotor. Overspeeds resulting from combinations of failures must also be considered unless the applicant can show that the probability of occurrence is not greater than extremely remote (probability range of 10−7 to 10−9 per engine flight hour).

(d) In addition, the applicant must demonstrate that each fan, compressor, turbine, and turbosupercharger rotor complies with paragraphs (d)(1) and (d)(2) of this section for the maximum overspeed achieved when subjected to the conditions specified in paragraphs (b)(3) and (b)(4) of this section. The applicant must use the approach in paragraph (a) of this section which specifies the required test conditions.

(1) Rotor Growth must not cause the engine to:

(i) Catch fire,

(ii) Release high-energy debris through the engine casing or result in a hazardous failure of the engine casing,

(iii) Generate loads greater than those ultimate loads specified in § 33.23(a), or

(iv) Lose the capability of being shut down.

(2) Following an overspeed event and after continued operation, the rotor may not exhibit conditions such as cracking or distortion which preclude continued safe operation.

(e) The design and functioning of engine control systems, instruments, and other methods not covered under § 33.28 must ensure that the engine operating limitations that affect turbine, compressor, fan, and turbosupercharger rotor structural integrity will not be exceeded in service.

(f) Failure of a shaft section may be excluded from consideration in determining the highest overspeed that would result from a complete loss of load on a turbine rotor if the applicant:

(1) Identifies the shaft as an engine life-limited-part and complies with § 33.70.

(2) Uses material and design features that are well understood and that can be analyzed by well-established and validated stress analysis techniques.

(3) Determines, based on an assessment of the environment surrounding the shaft section, that environmental influences are unlikely to cause a shaft failure. This assessment must include complexity of design, corrosion, wear, vibration, fire, contact with adjacent components or structure, overheating, and secondary effects from other failures or combination of failures.

(4) Identifies and declares, in accordance with § 33.5, any assumptions regarding the engine installation in making the assessment described above in paragraph (f)(3) of this section.

(5) Assesses, and considers as appropriate, experience with shaft sections of similar design.

(6) Does not exclude the entire shaft.

(g) If analysis is used to meet the overspeed requirements, then the analytical tool must be validated to prior overspeed test results of a similar rotor. The tool must be validated for each material. The rotor being certified must not exceed the boundaries of the rotors being used to validate the analytical tool in terms of geometric shape, operating stress, and temperature. Validation includes the ability to accurately predict rotor dimensional growth and the burst speed. The predictions must also show that the rotor being certified does not have lower burst and growth margins than rotors used to validate the tool.

(a) Applicability. These requirements are applicable to any system or device that is part of engine type design, that controls, limits, or monitors engine operation, and is necessary for the continued airworthiness of the engine.

(b) Validation—(1) Functional aspects. The applicant must substantiate by tests, analysis, or a combination thereof, that the engine control system performs the intended functions in a manner which:

(i) Enables selected values of relevant control parameters to be maintained and the engine kept within the approved operating limits over changing atmospheric conditions in the declared flight envelope;

(ii) Complies with the operability requirements of §§ 33.51, 33.65 and 33.73, as appropriate, under all likely system inputs and allowable engine power or thrust demands, unless it can be demonstrated that failure of the control function results in a non-dispatchable condition in the intended application;

(iii) Allows modulation of engine power or thrust with adequate sensitivity over the declared range of engine operating conditions; and

(iv) Does not create unacceptable power or thrust oscillations.

(2) Environmental limits. The applicant must demonstrate, when complying with §§ 33.53 or 33.91, that the engine control system functionality will not be adversely affected by declared environmental conditions, including electromagnetic interference (EMI), High Intensity Radiated Fields (HIRF), and lightning. The limits to which the system has been qualified must be documented in the engine installation instructions.

(c) Control transitions. (1) The applicant must demonstrate that, when fault or failure results in a change from one control mode to another, from one channel to another, or from the primary system to the back-up system, the change occurs so that:

(i) The engine does not exceed any of its operating limitations;

(ii) The engine does not surge, stall, or experience unacceptable thrust or power changes or oscillations or other unacceptable characteristics; and

(iii) There is a means to alert the flight crew if the crew is required to initiate, respond to, or be aware of the control mode change. The means to alert the crew must be described in the engine installation instructions, and the crew action must be described in the engine operating instructions;

(2) The magnitude of any change in thrust or power and the associated transition time must be identified and described in the engine installation instructions and the engine operating instructions.

(d) Engine control system failures. The applicant must design and construct the engine control system so that:

(1) The rate for Loss of Thrust (or Power) Control (LOTC/LOPC) events, consistent with the safety objective associated with the intended application can be achieved;

(2) In the full-up configuration, the system is single fault tolerant, as determined by the Administrator, for electrical or electronic failures with respect to LOTC/LOPC events;

(3) Single failures of engine control system components do not result in a hazardous engine effect; and

(4) Foreseeable failures or malfunctions leading to local events in the intended aircraft installation, such as fire, overheat, or failures leading to damage to engine control system components, do not result in a hazardous engine effect due to engine control system failures or malfunctions.

(e) System safety assessment. When complying with this section and § 33.75, the applicant must complete a System Safety Assessment for the engine control system. This assessment must identify faults or failures that result in a change in thrust or power, transmission of erroneous data, or an effect on engine operability producing a surge or stall together with the predicted frequency of occurrence of these faults or failures.

(f) Protection systems. (1) The design and functioning of engine control devices and systems, together with engine instruments and operating and maintenance instructions, must provide reasonable assurance that those engine operating limitations that affect turbine, compressor, fan, and turbosupercharger rotor structural integrity will not be exceeded in service.

(2) When electronic overspeed protection systems are provided, the design must include a means for testing, at least once per engine start/stop cycle, to establish the availability of the protection function. The means must be such that a complete test of the system can be achieved in the minimum number of cycles. If the test is not fully automatic, the requirement for a manual test must be contained in the engine instructions for operation.

(3) When overspeed protection is provided through hydromechanical or mechanical means, the applicant must demonstrate by test or other acceptable means that the overspeed function remains available between inspection and maintenance periods.

(g) Software. The applicant must design, implement, and verify all associated software to minimize the existence of errors by using a method, approved by the FAA, consistent with the criticality of the performed functions.

(h) Aircraft-supplied data. Single failures leading to loss, interruption or corruption of aircraft-supplied data (other than thrust or power command signals from the aircraft), or data shared between engines must:

(1) Not result in a hazardous engine effect for any engine; and

(2) Be detected and accommodated. The accommodation strategy must not result in an unacceptable change in thrust or power or an unacceptable change in engine operating and starting characteristics. The applicant must evaluate and document in the engine installation instructions the effects of these failures on engine power or thrust, engine operability, and starting characteristics throughout the flight envelope.

(i) Aircraft-supplied electrical power. (1) The applicant must design the engine control system so that the loss, malfunction, or interruption of electrical power supplied from the aircraft to the engine control system will not result in any of the following:

(i) A hazardous engine effect, or

(ii) The unacceptable transmission of erroneous data.

(2) When an engine dedicated power source is required for compliance with paragraph (i)(1) of this section, its capacity should provide sufficient margin to account for engine operation below idle where the engine control system is designed and expected to recover engine operation automatically.

(3) The applicant must identify and declare the need for, and the characteristics of, any electrical power supplied from the aircraft to the engine control system for starting and operating the engine, including transient and steady state voltage limits, in the engine instructions for installation.

(4) Low voltage transients outside the power supply voltage limitations declared in paragraph (i)(3) of this section must meet the requirements of paragraph (i)(1) of this section. The engine control system must be capable of resuming normal operation when aircraft-supplied power returns to within the declared limits.

(j) Air pressure signal. The applicant must consider the effects of blockage or leakage of the signal lines on the engine control system as part of the System Safety Assessment of paragraph (e) of this section and must adopt the appropriate design precautions.

(k) Automatic availability and control of engine power for 30-second OEI rating. Rotorcraft engines having a 30-second OEI rating must incorporate a means, or a provision for a means, for automatic availability and automatic control of the 30-second OEI power within its operating limitations.

(l) Engine shut down means. Means must be provided for shutting down the engine rapidly.

(m) Programmable logic devices. The development of programmable logic devices using digital logic or other complex design technologies must provide a level of assurance for the encoded logic commensurate with the hazard associated with the failure or malfunction of the systems in which the devices are located. The applicant must provide evidence that the development of these devices has been done by using a method, approved by the FAA, that is consistent with the criticality of the performed function.

(a) Unless it is constructed to prevent its connection to an incorrect instrument, each connection provided for powerplant instruments required by aircraft airworthiness regulations or necessary to insure operation of the engine in compliance with any engine limitation must be marked to identify it with its corresponding instrument.

(b) A connection must be provided on each turbojet engine for an indicator system to indicate rotor system unbalance.

(c) Each rotorcraft turbine engine having a 30-second OEI rating and a 2-minute OEI rating must have a means or a provision for a means to:

(1) Alert the pilot when the engine is at the 30-second OEI and the 2-minute OEI power levels, when the event begins, and when the time interval expires;

(2) Automatically record each usage and duration of power at the 30-second OEI and 2-minute OEI levels;

(3) Alert maintenance personnel in a positive manner that the engine has been operated at either or both of the 30-second and 2-minute OEI power levels, and permit retrieval of the recorded data; and

(4) Enable routine verification of the proper operation of the above means.

(d) The means, or the provision for a means, of paragraphs (c)(2) and (c)(3) of this section must not be capable of being reset in flight.

(e) The applicant must make provision for the installation of instrumentation necessary to ensure operation in compliance with engine operating limitations. Where, in presenting the safety analysis, or complying with any other requirement, dependence is placed on instrumentation that is not otherwise mandatory in the assumed aircraft installation, then the applicant must specify this instrumentation in the engine installation instructions and declare it mandatory in the engine approval documentation.

(f) As part of the System Safety Assessment of § 33.28(e), the applicant must assess the possibility and subsequent effect of incorrect fit of instruments, sensors, or connectors. Where necessary, the applicant must take design precautions to prevent incorrect configuration of the system.

(g) The sensors, together with associated wiring and signal conditioning, must be segregated, electrically and physically, to the extent necessary to ensure that the probability of a fault propagating from instrumentation and monitoring functions to control functions, or vice versa, is consistent with the failure effect of the fault.

(h) The applicant must provide instrumentation enabling the flight crew to monitor the functioning of the turbine cooling system unless appropriate inspections are published in the relevant manuals and evidence shows that:

(1) Other existing instrumentation provides adequate warning of failure or impending failure;

(2) Failure of the cooling system would not lead to hazardous engine effects before detection; or

(3) The probability of failure of the cooling system is extremely remote.