1、_SAE Technical Standards Board Rules provide that: “This report is published by SAE to advance the state of technical and engineering sciences. The use of this report is entirely voluntary, and its applicability and suitability for any particular use, including any patent infringement arising theref
2、rom, is the sole responsibility of the user.” SAE reviews each technical report at least every five years at which time it may be revised, reaffirmed, stabilized, or cancelled. SAE invites your written comments and suggestions.Copyright 2014 SAE International All rights reserved. No part of this pub
3、lication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of SAE. TO PLACE A DOCUMENT ORDER: Tel: 877-606-7323 (inside USA and Canada) Tel: +1 724-776-4970
4、(outside USA) Fax: 724-776-0790 Email: CustomerServicesae.org SAE WEB ADDRESS: http:/www.sae.orgSAE values your input. To provide feedback on this Technical Report, please visit http:/www.sae.org/technical/standards/ARP6109AEROSPACERECOMMENDED PRACTICEARP6109Issued 2014-02 Electronic Engine Control
5、Hardware Change Management RATIONALEThe reason for this guidance report on change management is to recommend procedures and practices that clarify the level of risk associated with changes to an engine control system. There are recommendations regarding the engineering processes that should accompan
6、y the various levels of change in order to keep the risk of unforeseen effects as low as is reasonably possible. Guidance is also provided on the communication amongst relevant parties.FOREWORDChanges to engine control systems have traditionally been classified as either minor or major, with the for
7、mer being defined as having no change to the form, fit or function of the item to be changed. This method of classification has proved somewhat awkward with changes to electronic control or protection functions that address obsolescence.The change might be to a component or function which is complex
8、 or which is obviously safety-related (such as the over speed protection function) while causing no change to form, fit or function. A level of risk may exist with this change which could warrant the use of a modification process, which may involve all parties to determine if an aircraft modificatio
9、n is required. This is often referred to as a Full Modification Process. For the full modification process, procedures and review stages not called for in the minor change process will need to be introduced. The resultant level of scrutiny that accompanies the change may be considered more fitting g
10、iven its complexity or its potential functional impact if not implemented correctly. The use of a full modification process often requires identification of the revised configuration. This enables effective tracking in service should the change prove to have unexpected effects on unit performance. H
11、owever, a shift from the minor change process to a full modification process could be considered excessive in some situations, as well as unmanageable for any unit that is regularly affected by obsolescence issues.SAE INTERNATIONAL ARP6109 Page 2 of 16 TABLE OF CONTENTS1. SCOPE 31.1 General . 31.2 P
12、urpose . 32. REFERENCES 32.1 Applicable Documents 32.1.1 SAE Publications . 32.1.2 FAA Publications . 42.1.3 EASA Publications 42.1.4 Other Publications . 42.2 Terms and Definitions . 53. REGULATION AND GUIDANCE MATERIAL . 53.1 Change Management Regulatory Requirements . 53.2 Change Management and F
13、leet Management Guidance . 63.3 Product Configuration Management . 63.4 Major versus Minor Change Classification . 73.4.1 Alternative Sources . 73.4.2 Product Improvements 83.5 Class I and Class II Versus Major and Minor Classification . 84. DESIGN CHANGE EVALUATION 84.1 Product, Market and Design P
14、rocess Evolutions . 84.2 Hardware Development Cycle 94.2.1 Planning Phase. 94.2.2 Specification Phase 104.2.3 Verification Phase . 105. ASPECTS OF COMPLEXITY ANALYSIS 115.1 Complexity Analysis 115.1.1 Step 1: Interface Identification 125.1.2 Step 2: Circuit Functionality 125.1.3 Step 3: Change Compl
15、exity Assessment . 126. DECISION TOOL - CLASSIFICATION CRITERIA . 136.1 Classification Criteria 136.2 Criteria Explanation . 157. NOTES 16FIGURE 1 13SAE INTERNATIONAL ARP6109 Page 3 of 16 1. SCOPE 1.1 General This document is intended for use by manufacturers of aircraft, engines and Electronic Engi
16、ne Controls EECs as a component change process and evaluation guideline. Its purpose is to provide an effective means of managing the modification of electronic hardware. The process defined in this document is based upon: an understanding of the electronic component market evolution, e.g., obsolesc
17、ence; lessons learned from the effects caused by the introduction of electrical component changes in a service fleet environment; industry best practice; and an understanding of the applicable regulations. 1.2 Purpose The introduction of any design change to an Electronic Engine Control system will
18、carry a potential risk to the aircraft safety and operability. The evaluation of the impact for any change can be difficult to manage as it may require involvement of the EEC manufacturer, the engine manufacturer and the aircraft manufacturer, who must each support the showing of conformance to all
19、applicable certification standards. Further complexity is brought about by the variety in the quantity and quality of the original design data.The purpose of this document is to provide guidance on how to evaluate and classify a design change. It also provides a definition of the coverage and depth
20、of analysis necessary to manage the risk of impact on aircraft safety and operability to a satisfactory level. 2. REFERENCES 2.1 Applicable Documents The following publications form a part of this document to the extent specified herein. The latest issue of SAE publications shall apply. The applicab
21、le issue of other publications shall be the issue in effect on the date of the purchase order. In the event of conflict between the text of this document and references cited herein, the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulat
22、ions unless a specific exemption has been obtained. 2.1.1 SAE Publications Available from SAE International, 400 Commonwealth Drive, Warrendale, PA 15096-0001, Tel: 877-606-7323 (inside USA and Canada) or 724-776-4970 (outside USA), www.sae.org.ARP4754A Guidelines for Development of Civil Aircraft a
23、nd Systems SAE INTERNATIONAL ARP6109 Page 4 of 16 2.1.2 FAA Publications Available from Federal Aviation Administration, 800 Independence Avenue, SW, Washington, DC 20591, Tel: 866-835-5322, www.faa.gov.14 CFR Part 21 CERTIFICATION PROCEDURES FOR PRODUCTS AND PARTS 14 CFR Part 23 NORMAL, UTILITY, AC
24、ROBATIC, AND COMMUTER CATEGORY AIRPLANES 14 CFR Part 25 AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES 14 CFR Part 27 NORMAL CATEGORY ROTORCRAFT 14 CFR Part 29 TRANSPORT CATEGORY ROTORCRAFT 14 CFR Part 33 AIRCRAFT ENGINES TSO C-77B GAS TURBINE AUXILIARY POWER UNITS AC 33.28-1 Compliance Crite
25、ria for 14 CFR 33.28, Aircraft Engines, Electrical and Electronic Engine Control Systems 2.1.3 EASA Publications Available from European Aviation Safety Agency, Postfach 10 12 53, D-50452 Cologne, Germany, Tel: +49-221-8999-000, www.easa.eu.int.Part 21 Certification of Aircraft and related product,
26、parts and appliance, and production organisations. CS - 23 Certification Specifications for Normal, Utility, Aerobatic and Commuter Aeroplanes CS - 25 Certification Specifications for Large Aeroplanes CS - 27 Certification Specifications for Normal/Small Category Rotorcraft CS - 29 Certification Spe
27、cifications for Transport/Large Category Rotorcraft CS - E Certification Specifications for Engines AMC 20-1 Certification of Aircraft Propulsion Systems Equipped with Electronic Control Systems AMC 20-3 Certification of Engines Equipped with Electronic Engine Control Systems 2.1.4 Other Publication
28、s IEC/PAS 62239-1 Process Management for Avionics - Preparation of an Electronic ComponentsManagement Plan RCTA DO-254 / EUROCAE ED-80 Design Assurance Guidance for Airborne Electronic Hardware MIL-STD-883H Department of Defense Test Method Standard, Microcircuits (Feb 26th, 2010) MIL-HDBK-61A Confi
29、guration Management Guidance SAE INTERNATIONAL ARP6109 Page 5 of 16 2.2 Terms and Definitions Terms not listed below are used in this document as defined in ISO 9000. ARP: Aerospace Recommended Practice CCB: Change Control Board CFR: Code of Federal Regulations COTS: Commercial Off-The-Shelf CS: Cer
30、tification Specification (EASA nomenclature) DOA: Design Organization Approval EASA: European Aviation Safety Agency EEC: Electronic Engine Control FAA: Federal Aviation Administration FAR: Federal Aviation Regulation FADEC: Full Authority Digital Engine Control IEC: International Electrotechnical C
31、ommission Major Change (as defined in CFR 21.93 (a): Any change that does not meet the definition of Minor Change. Minor Change (as defined in CFR 21.93 (a): A change is considered Minor if it has no appreciable effect on weight, balance, structural strength, reliability, operational characteristics
32、 or other characteristics affecting the airworthiness of theproduct.ODA: Organization Designation Authorization Type Certificate: A type certificate is awarded by aviation regulating bodies after it has been established that the design of an aircraft, engine, or propeller has fulfilled all prevailin
33、g airworthiness requirements. 3. REGULATION AND GUIDANCE MATERIAL 3.1 Change Management Regulatory Requirements Part of the designers responsibility is to control the configuration of their products. The manufacturing of the complete aircraft including the engine and its components, along with its u
34、se and maintenance by operators (flight operations), requires configuration approval. This configuration approval is referred to as type design certification. Subsequent change to the certified type design must be approved for products to enter and to stay in service. The EEC is made of analog and d
35、igital electronic hardware, operating system and application software. A growing percentage of EECs incorporate Commercial Off-The-Shelf (COTS) electronic components that were not developed specifically for use in EECs. The evolution of the electronic component market is such that many of these comp
36、onents become obsolete in a very short time when compared to the expected service life of the EEC. In order to introduce a change to the bill of materials, a change to the configuration must be approved. Component obsolescence or cost reduction are examples that may cause changes to the bill of mate
37、rials. SAE INTERNATIONAL ARP6109 Page 6 of 16 For aircraft and engine type design certificate holders, this approval is regulated by certification requirements such as Part 21, military or other civil authorities equivalent. Suppliers to these type design certificate holders, such as EEC manufacture
38、rs, will usually receive requirements embodied in procurement specifications. This will include requirements to identify and label parts, components, assembly or equipment by part number and in some cases, by serial number. While the complete aircraft with installed engine must comply with aircraft
39、type design certification requirements, credit can be taken for the data collected and produced as part of the engine type certification activities. It should also be noted that the EEC system is certificated as part of the engine type design. Change management should be used to guide the evaluation
40、 of changes in order to feed the configuration management process. In some cases, it may be simple to conclude that a substitute part will operate in precisely the same manner as the one it replaced. In other cases, however, a more comprehensive process, which includes independent review, may be req
41、uired to evaluate the change. Depending on the complexity of the change, a review may require involvement of the aircraft type design holder to ensure compliance with applicable aircraft requirements is maintained. The ultimate goal is to maintain compliance to both the engine and the aircraft type
42、design certifications when changes to the EEC design are introduced. Reasonable and practical procedures are presented to efficiently manage such change.3.2 Change Management and Fleet Management Guidance Whenever design choices are made related to changes to already certified products, the potentia
43、l impact of those choices on the fleet users must be considered. Aircraft are managed by configuration. The configuration of each item on the aircraft must be available to the end user, the operator. The usual way to manage this configuration is by using part numbers.In terms of configuration manage
44、ment, all items with the same part number are identical. If a change is introduced without a corresponding part number change, and if there is a need to identify or locate these changed products in service or storage, it can be difficult and costly. Tools are used by airlines to determine, in real t
45、ime, the configuration of each aircraft. If a change is introduced to an itemwithout a change to its part number, then some of these tools would not be able to identify the difference between a changed and unchanged item. The identification of changed items would therefore require review of the main
46、tenance log and the confirmation could require access to inspect the parts, component or equipment labels, which can only occur when the aircraft is on the ground. It is desirable to have a means to isolate potentially suspect units. It is also desirable to minimize proliferation of configurations.
47、The level of difficulty associated with locating a changed part in the field must therefore be considered when assessing the necessity to modify the part number; serialization (serial number or lot) may also be considered. 3.3 Product Configuration Management Outside of certification considerations
48、and constraints, the EEC, engine and aircraft manufacturers may have different needs for controlling the configuration of the product. Change control is a high level process which includes within it, configuration management activities. In the context of the changes that are addressed in this docume
49、nt, we have to answer the question: “what kind of change do we have to manage under configuration and at which level (EEC, engine, aircraft)?”The difficulty is to determine the level, up to which, a component change needs to be managed in configuration. Obviously, identification and control of hardware and software part numbers at some level is required. Any change in form, fit or function needs to be identified and controlle
