PPRuNe Forums - View Single Post - JAR and S.E. safety
View Single Post
Old 29th Jul 2002, 23:22
  #9 (permalink)  
Avnx EO
 
Join Date: Jul 2002
Location: Lost in thought
Posts: 103
Likes: 0
Received 0 Likes on 0 Posts
I'm not sure if people realize the half of it. Anyone who has been involved with a Cat A certification effort recently will have probably encountered the South West's interpretation for systems cert - that "Cat A" means the engine failure is "a given". So you get no credit for the failed engine in systems design. This means that systems must provide the same level of availability both before and AFTER the first engine has failed. The remaining engine itself doesn't provide more than 10e-5 (even though dual engine failure in IMC in part 29 is typically considered Catastrophic), and the remaining electrical system is close behind - but the regulatory agencies counter that they are willing to "make exceptions" in those areas, because "the technology isn't there." - But for flight and engine display systems (and for that matter, radios and everything else) "we can, and therefore we should in the interest of safety"

Now consider for a moment the EICAS (engine indicating and crew alerting system.) The criticality of the EICAS system actually INCREASES after the first engine failure (because if I mis-manage the reamining engine, I'm REALLY cooked.) With no credit for the engine failure itself, and with no other engine to perform cross-checking, I now have to provide a much more complex system, with a lot more redundancy in order to meet this new criticality. (triple Ng sensors, redundant processing paths, comparison monitors for multiple data paths, increased Caution messages to show loss of redundancy, miscompares, etc.)

This increased safety for systems is not free. It complicates things something awful, increases the size of generators, batteries, etc. and few - if any - of the current, sans-FADEC, steam-gauge cockpits could be certified today if this same interpretation were applied. The weight and cost devoted to over-designing these areas takes away from performance and other electronics. On one hand, I agree that for Cat A we need to assure that remaining systems are operational when they are most needed, but on the other hand, giving no credit for an engine failure is absurd. Most engines will give you 10e-4 or 10e-5.... Hell, if they just gave us 10e-2 credit for the sake of systems certification, you could assure more than reasonable system availability, given the fact that you should no be faced with this every day.

Anyone else been running ito this??
Avnx EO is offline