Regulations and Standards Gap Analysis

First published July 2019

This white paper was written in July 2019, before SAE published ARP4754B and ARP4761A. Its references to draft standards and guidance reflect that date.

Introduction

Traditionally, novel technologies, and novel applications of technologies such as electric or hybrid-electric powertrains, have been accommodated through special conditions. These are often written independently of the safety analysis, which introduces inconsistencies. Also, the means of compliance, such as consensus standards from organizations like ASTM, may be inappropriate, incomplete, or missing details that cannot be added until the standards are applied to a system architecture.

The transition from non-performance-based to performance-based regulations is an abstraction that leaves a void, because systems engineering and design assurance objectives require traceability from regulations and safety assurance objectives, through requirements tiers, to the software and complex hardware.

Also, the Part 33 special conditions developed for inverters and electric motors have been derived from the regulations for turbines and reciprocating engines. This assumes there are parallels between these inherently different technologies. In some cases this is true. In others, regulations cannot simply be translated from turbines and reciprocating engines. For example:

Regulation	Observation
33.17 Fire protection	Applicable per the MagniX special conditions. However, 33.17 focuses on using a firewall to protect against flammable fluids. A firewall is likely to be a wholly ineffective protection against an electrical fire, and flammable fluids can be eliminated from inverters and electric motors.
13. Critical and life-limited parts	Applicable per MagniX special condition 13. Like other electrical and electronic equipment on an aircraft, the inverter and electric motor, with the exception of the bearings, may not experience a wear-out mechanism. Even the bearings may not wear out during the expected life of the electric motor. This is unlike turbines and reciprocating engines, which have many more life-limited moving parts.
14. Lubrication systems	Applicable per MagniX special condition 14. Lubrication systems apply to turbines and reciprocating engines, and to electric motors if they have, for example, gearboxes for auxiliary systems such as pumps and governors. However, if these can be replaced by electric pumps and governors, lubrication systems can be eliminated completely.
18. Ingestion	Applicable per MagniX special condition 18. Ingestion applies to engines with inlet ducts. However, there is no reason to assume that electric motors will have inlet ducts.

The proposal is that a holistic safety approach, similar to that advocated by Moak, L. et al. (2020), is used to derive and validate requirements that bridge the gap between regulations and standards, and that are consistent with safety assurance objectives. The underlying assumption is that an electric or hybrid-electric aircraft is not a special class of aircraft under 21.17(b). If it were, the same approach could still be applied.

The approach compresses the structure of the safety analysis, so that more frequent iterations can derive and validate requirements, and adds techniques to address human factors, which are generally missing from the safety analysis. It also uses a full aircraft modeling and simulation effort to derive and validate requirements for the systems and sub-systems that make up the system architecture. For the context of this approach, see our comparison of ARP4761 and ARP4761A.

Systems Theoretic Process Analysis

Systems Theoretic Process Analysis (STPA) is a relatively new safety analysis technique with a foundation in control theory. A control structure is created for a system or sub-system:

The control structure is then analyzed for control actions and unsafe control actions, focusing on:

• Not providing the control action.
• Providing the control action incorrectly.
• Providing a potentially safe control action, but too early, too late, or in the wrong order.
• Stopping the control action too soon, or applying it too long.

STPA is used to identify gaps in regulations and standards, missing failure conditions, and safety requirements, including human factors. The following examples apply STPA to an Electrical Propulsion System (EPS) and an Energy Storage System (ESS) to identify missing failure conditions. Integrating STPA with traditional safety analysis techniques in this way is innovative, and is expected to give a more holistic safety analysis that can bridge the gap between regulations and standards.

Electrical Propulsion System example

Unsafe control action	Failure condition
No motor shutdown by aircrew when over-temperature alert	Overtemperature
No motor shutdown by aircrew when over-vibration alert	Unbalanced motor
No motor shutdown by aircrew when over-speed alert	Overspeed
No motor shutdown by aircrew when over-torque alert	Overtorque
No motor shutdown by aircrew when over-current alert	Overtemperature
No voltage modulation when motor running	Loss of thrust
Incorrect voltage modulation when motor shut down	Uncommanded thrust
Incorrect voltage modulation when motor locked	Uncommanded thrust

Energy Storage System example

Unsafe control action	Failure condition
No charger shutdown by BMS when battery charged	Uncontained thermal runaway
No switch disconnect by BMS when battery discharged	Uncontained thermal runaway
Charger shutdown too early by BMS when battery discharged	Loss of thrust
Switch disconnect too early by BMS when battery charged	Loss of thrust
No cell deviation limiting when cell deviation from mean alert	Uncontained thermal runaway
No module deviation limiting when module deviation from mean alert	Uncontained thermal runaway
No emergency procedure by aircrew when battery unhealthy	Loss of thrust

The holistic safety analysis approach

Compared to ARP4761 and ARP4761A, the holistic safety analysis:

• Adds STPA to address human factors, identify missing failure conditions and hardware and software requirements, and validate those that already exist.
• Compresses the structure of the safety analysis.
• Shows the relationship between reliability prediction, endurance testing, Single Event Effects (SEE) analysis, and the other safety analysis activities.

STPA is chosen because of its relative maturity and regulatory acceptance compared to other model-based systems and safety techniques. It also identifies missing system, hardware, and software requirements, validates those that already exist, and bridges the gap between regulations and standards.

Flattening the structure to one tier, instead of two for ARP4761 and three for ARP4761A, streamlines the safety analysis, allows more frequent iterations, and can shorten the design and development lifecycle. It also enables a complete iteration of the safety analysis, to derive and validate requirements and bridge the gap, at the start of the engineering lifecycle, before a formal System Requirements Review (SRR). After the SRR, further iterations add detail and inform the software and complex hardware processes in a consistent, coordinated way.

A parallel modeling and simulation effort, specific to the system architecture under development, ensures the end-to-end consistency of requirements. In the absence of a full set of regulations and standards, it ensures coverage of system, high-level, and low-level requirements. Its output, specifically the functions and their interdependencies, can also be used as an input to the STPA.

The benefit of the holistic safety analysis is that it is agnostic to the system architecture, so it can be applied without a full set of regulations and standards. Once complete, the framework of system and sub-system requirements can be abstracted and applied to similar system architectures. For how the approach applies to Urban Air Mobility, see our holistic safety analysis for Urban Air Mobility.

Highest-priority regulations and standards

The known gaps described below are the highest priority. However, the holistic safety analysis approach is expected to identify further gaps.

Turbo generator system

TSO-C77b, which covers gas turbine Auxiliary Power Units (APUs), provides a useful foundation. However, a gas turbine supporting a powertrain has different requirements from an APU providing electrical, mechanical, or pneumatic power to aircraft systems. For example:

• Safety assurance requirements, such as probability budgets and Development Assurance Levels, are different.
• Environmental requirements, such as altitude, are different. An APU may not need to operate at maximum cruise altitude.
• There is no equivalent to 33.28(d)(2), which requires the engine control system to be single fault tolerant with respect to loss of thrust control and loss of power control events.
• TSO-C77b and 33.49(b) both require the equivalent of 150 hours of endurance testing, but on different schedules. TSO-C77b uses twenty periods of 7.5 hours, while 33.49(b) uses one period of 30 hours followed by six periods of 20 hours. TSO-C77b is therefore less stringent than 33.49(b).

Electrical Propulsion System

The MagniX special conditions were derived from turbine and reciprocating engine regulations. This approach is effective for failure conditions where turbine and reciprocating technology have parallels with inverters and electric motors, but inappropriate where they do not: for example, fires caused by flammable fluids compared with electrical fires, and their mitigations. 33.17 Fire Protection, 13. Critical and Life Limited Parts, 14. Lubrication Systems, and 18. Ingestion have been applied to inverters and electric motors through the MagniX special conditions, but remain heavily influenced by turbine and reciprocating engine technology.

The failure conditions of 33.75(g)(2) have also been revised by the MagniX special conditions, but are still heavily influenced by turbine and reciprocating engine failure conditions. Some failure conditions are missing from the revised set, for example corona discharge, overvoltage, overvoltage caused by uncontrolled regenerative voltage, and partial discharge.

Relevant activities of the SAE E-40 Electrified Propulsion Committee:

• AIR8678, Architecture Examples for Electrified Propulsion Aircraft (work in progress).
• ARP8676, Nomenclature and Definitions for Electrified Propulsion Aircraft (work in progress).
• ARP8677, Safety Considerations for Electrified Propulsion Aircraft (work in progress).
• ARP8689, Endurance Tests for Aircraft Electric Engines (work in progress).

Energy Storage System

Introducing rechargeable lithium-ion batteries onto aircraft with a standard airworthiness certificate has been plagued by issues, and RTCA DO-311 and DO-311A were written in response. Arguably, as the dissenting opinion in DO-311A Appendix D notes, the battery thermal runaway containment test of DO-311A section 2.2.2.4 ignores the standard aerospace practice of relating severity to probability objectives, and is unrealistic, because it assumes test conditions that are not expected in service. DO-311A Appendix C proposes alternative, more realistic test conditions, but these have not been approved by the FAA.

Additionally, the revision of AC 20-184 to AC 20-184A, which is expected to clarify how DO-311A applies, was still in draft at the time of writing. Draft AC 20-184A Appendix F includes Table G-1, but with the caveat that “available paths to respective normal category airplane certification level in Table G-1 may not map to electric (or hybrid) airplane directly.”

Hydrogen fuel cell system

Relevant activities of the SAE AE-7AFC Fuel Cell Task Group:

• AIR6464, Hydrogen Fuel Cells Aircraft Fuel Cell Safety Guidelines.
• AIR7765, Considerations for Hydrogen Fuel Cells in Airborne Applications.
• AS6858, Installation of Fuel Cell Systems in Large Civil Aircraft.
• AS6679, Liquid Hydrogen Storage for Aviation (work in progress).

SAE AE-7AFC covers onboard applications, but not specifically onboard inverter and electric motor applications.

Another source of guidance is the Energy Supply Device (ESD) Aviation Rulemaking Committee (ARC) report to the FAA of 8 December 2017. The report has been used to validate failure conditions and identify missing ones, and compared with RTCA DO-160G to identify gaps between regulations and standards:

Part 23

It is a misconception that Part 23 Amendment 64 is a performance-based regulatory framework. In reality, many of the performance-based regulations in Amendment 62 do not exist in Amendment 64. Instead, it is an abstraction of Amendment 62 that eliminates a requirements tier. It accommodates a wider variety of system architectures by being less prescriptive. However, it leaves a void, because systems engineering and design assurance objectives require traceability from safety assurance objectives, through requirements tiers, to the software and complex hardware. The intent is to use the holistic safety approach to bridge the gap, particularly for:

• Integration of the Electrical Propulsion System.
• Integration of the Energy Storage System.
• Integration of the turbo generator system.

Part 25

Unlike Part 23, Part 25 has not been rewritten from a non-performance-based to a performance-based regulatory framework. It therefore cannot accommodate novel technology, and novel applications of technology, in the same way as Part 23. The hydrogen fuel cell powertrain may be accommodated through 21.17(b). Regardless, the holistic safety approach is intended to bridge the gap, particularly for:

• Integration of the Electrical Propulsion System.
• Integration of the hydrogen fuel cell system.
• Hydrogen storage.

Other areas that may require novel technology, or novel applications of technology, include the cooling system and hydrogen distribution.