PORTARIA Nº 15.760, DE 31 DE OUTUBRO DE 2024 (parte 4 de 5)

The applicant must provide an Aircraft Flight Manual that must be delivered
with each aircraft.
(a) The Aircraft Flight Manual must contain the following information:
(1) Aircraft operating limitations;
(2) Aircraft operating procedures;
(3) Performance information;
(4) Loading information; and
(5) Other information that is necessary for safe operation because of design,
operating, or handling characteristics.
(b) The portions of the Aircraft Flight Manual containing the information
specified in paragraphs (a)(1) through (a)(4) of this section must be approved by the
ANAC.
SUBPART H - ELECTRIC ENGINE REQUIREMENTS
EVE.3305 - Instruction manual for installing and operating the engine.
(a) Installation instructions.
(1) The location of engine mounting attachments, the method of attaching the
engine to the aircraft, and the maximum allowable load for the mounting attachments and
related structure.
(2) The location and description of engine connections to be attached to
accessories, pipes, wires, cables, ducts, and cowling.
(3) An outline drawing of the engine including overall dimensions.
(4) A definition of the physical and functional interfaces with the aircraft and
aircraft equipment, including the propeller when applicable.
(5) Where an engine system relies on components that are not part of the
engine type design, the interface conditions and reliability requirements for those
components upon which engine type certification is based must be specified in the engine
installation instructions directly or by reference to appropriate documentation.
(6) A list of the instruments necessary for control of the engine, including the
overall limits of accuracy and transient response required of such instruments for control
of the operation of the engine, must also be stated so that the suitability of the
instruments as installed may be assessed.
(b) Operation instructions.
(1) The operating limitations established by ANAC.
(2) The power or thrust ratings and procedures for correcting for nonstandard
atmosphere.
(3) The recommended procedures, under normal and extreme ambient
conditions for:
(i) Starting;
(ii) Operating on the ground; and
(iii) Operating during flight.
(4) For engines having one or more engine inoperative ratings or other
contingency ratings, applicants must provide data on engine performance characteristics
and variability to enable the aircraft manufacturer to establish aircraft power assurance
procedures.
(5) A description of the primary and all alternate modes, and any back-up
system, together with any associated limitations, of the engine control system and its
interface with the aircraft systems, including the propeller when applicable.
(c) Safety analysis assumptions. The assumptions of the safety analysis as
described in EVE.3375(d) with respect to the reliability of safety devices, instrumentation,
early warning devices, maintenance checks, and similar equipment or procedures that are
outside the control of the engine manufacturer.
EVE.3307 - Engine ratings and operating limits.
(a) Engine ratings and operating limitations are established by ANAC and
included in the engine certificate data sheet specified in RBAC 21.41, including ratings and
limitations based on the operating conditions and information specified in this section, as
applicable, and any other information found necessary for safe operation of the engine.
(b) For electric engines, ratings and operating limits are established relating to
the following:
(1) Shaft power, torque, rotational speed, and temperature for:
(i) Rated takeoff power;
(ii) Rated maximum continuous power; and
(ii) Rated maximum temporary power and associated time limit.
(2) Duty cycle and the rating at that duty cycle. The duty cycle must be
declared in the type certificate data sheet or documented in the engine installation
manual.
(3) Reserved.
(4) Power-supply requirements.
(5) Any other ratings or limitations that are necessary for the safe operation of
the engine.
(c) In determining the engine performance and operating limitations, the overall
limits of accuracy of the engine control system, of the engine electrical systems, and of the
necessary instrumentation as defined in EVE.3305(a)(6) must be taken into account.
EVE.3308 - Selection of Engine Power and Thrust Ratings
(a) Requested engine power and thrust ratings must be selected by the
applicant.
(b) Each selected rating must be for the lowest power or thrust that all engines
of the same type may be expected to produce under the conditions used to determine that
rating.
EVE.3315 - Materials
(a) Be established on the basis of experience or tests; and
(b) Conform to approved specifications (such as industry or military
specifications) that ensure their having the strength and other properties assumed in the
design data.
EVE.3317 - Fire protection
(a) The design and construction of the engine and the materials used must
minimize the probability of the occurrence and spread of fire during normal operation and
failure conditions, and must minimize the effect of such a fire. In addition, the design and
construction of electrical engines must minimize the probability of the occurrence of an
internal fire that could result in structural failure or other hazardous effects.
EVE.3318 - High-Voltage EWIS arc fault protection
(a) High-voltage EWIS must be protected against arc faults that can lead to
hazardous engine effects as defined in EVE.3375(g)(2). Any non-protected electrical wiring
interconnections must be analyzed to show that arc faults do not cause a hazardous engine
effect.EVE.3319 - Durability.
The engine design and construction must minimize the development of an
unsafe condition of the engine between maintenance intervals, overhaul periods, or
mandatory actions described in the applicable ICA.
EVE.3321 - Engine cooling.
Engine design and construction must provide the necessary cooling under
conditions in which the aircraft is expected to operate. If cooling is required to satisfy the
safety analysis as described in EVE.3375, the cooling system monitoring features and usage
must be documented in the engine installation manual.
EVE.3323 - Engine Mounting Attachment and Structure
(a) The maximum allowable limit and ultimate loads for engine mounting
attachments and related engine structure must be specified.
(b) The engine mounting attachments and related engine structure must be
able to withstand:
(1) The specified limit loads without permanent deformation; and
(2) The specified ultimate loads without failure,but may exhibit permanent
deformation.
EVE.3325 - Accessory Attachments
The engine must operate properly with the accessory drive and mounting
attachments loaded. Each engine accessory drive and mounting attachment must include
provisions for sealing to prevent contamination of, or unacceptable leakage from, the
engine interior. A drive and mounting attachment requiring lubrication for external drive
splines, or coupling by engine oil, must include provisions for sealing to prevent
unacceptable loss of oil and to prevent contamination from sources outside the chamber
enclosing the drive connection. The design of the engine must allow for the examination,
adjustment, or removal of each accessory required for engine operation.
EVE.3327 - Overspeed
(a) A rotor overspeed must not result in a burst, rotor growth, or damage that
results in a hazardous engine effect, as defined in EVE.3375(g)(2). Compliance with this
paragraph must be shown by test, validated analysis, or a combination of both. Applicable
assumed rotor speeds must be declared and justified.
(b) Rotors must possess sufficient strength with a margin to burst above
certified operating conditions and above failure conditions leading to rotor overspeed. The
margin to burst must be shown by test, validated analysis, or a combination thereof.
(c) The engine must not exceed the rotor-speed operational limitations that
could affect rotor structural integrity.
EVE.3328 - Engine control systems.
(a) Applicability. - These requirements apply to any system or device that is part
of the engine type design that controls, limits, monitors, or protects engine operation and
is necessary for the continued airworthiness of the engine.
(b) Engine control. - The engine control system must ensure the engine does
not experience any unacceptable operating characteristics or exceed its operating limits,
including in failure conditions where the fault or failure results in a change from one
control mode to another, from one channel to another, or from the primary system to the
back-up system, if applicable.
(c) Design assurance. The software and complex electronic hardware, including
programmable logic devices, must be:
(1) Designed and developed using a structured and systematic approach that
provides a level of assurance for the logic commensurate with the hazard associated with
the failure or malfunction of the systems in which the devices are located; and
(2) Substantiated by a verification methodology acceptable to ANAC.
(d) Validation. All functional aspects of the control system must be
substantiated by test, analysis, or a combination thereof, to show that the engine control
system performs the intended functions throughout the approved flight envelope.
(e) Environmental limits. Environmental limits that cannot be adequately
substantiated by endurance demonstration, validated analysis, or a combination thereof
must be demonstrated by the system and component tests in EVE.3391.
(f) Engine control system failures. The engine control system must:
(1) Have a maximum rate of Loss of Power Control (LOPC) that is suitable for
the intended aircraft application. The estimated LOPC rate must be specified in the engine
installation manual;
(2) When in the full-up configuration, be single fault tolerant, as determined by
ANAC, for electrical, electrically detectable, and electronic failures involving LOPC events;
(3) Not have any single failure that results in hazardous engine effects as
defined in EVE.3375(g)(2); and
(4) Ensure failures or malfunctions that lead to local events in the aircraft do
not result in hazardous engine effects as defined in EVE.3375(g)(2) due to engine control
system failures or malfunctions.
(g) System safety assessment. The applicant must perform a system safety
assessment. This assessment must identify faults or failures that affect normal operation,
together with the predicted frequency of occurrence of these faults or failures. The
intended aircraft application must be taken into account to assure the assessment of the
engine control system safety is valid. The rates of hazardous and major faults must be
declared in the engine installation manual.
(h) Protection systems. The engine control devices and systems' design and
function, together with engine instruments, operating instructions, and maintenance
instructions, must ensure that engine operating limits that can lead to a hazard will not be
exceeded in-service.
(i) Aircraft-supplied data. Any single failure leading to loss, interruption, or
corruption of aircraft-supplied data (other than power command signals from the aircraft),
or aircraft-supplied data shared between engine systems within a single engine or between
fully independent engine systems, must:
(1) Not result in a hazardous engine effect, as defined in EVE.3375(g)(2), for any
engine installed on the aircraft; and
(2) Be able to be detected and accommodated by the control system.
(j) Engine control system electrical power.(1) The engine control system must
be designed such that the loss, malfunction, or interruption of the control system electrical
power source will not result in a hazardous engine effect, as defined in EVE.3375(g)(2), the
unacceptable transmission of erroneous data, or continued engine operation in the
absence of the control function. The engine control system must be capable of resuming
normal operation when aircraft-supplied power returns to within the declared limits.
(2) The applicant must identify and declare, in the engine installation manual,
the characteristics of any electrical power supplied from the aircraft to the engine control
system, including transient and steady-state voltage limits, and any other characteristics
necessary for safe operation of the engine.
EVE.3329 - Instrument connection.
(a) Unless it is constructed to prevent its connection to an incorrect instrument,
each connection provided for powerplant instruments required by aircraft airworthiness
regulations or necessary to insure operation of the engine in compliance with any engine
limitation must be marked to identify it with its corresponding instrument.
(b) In addition, as part of the system-safety assessment of EVE.3328(g) and
EVE.33100(h), the applicant must assess the possibility and subsequent effect of incorrect
fit of instruments, sensors, or connectors. Where practicable, the applicant must take
design precautions to prevent incorrect configuration of the system.
(c) The applicant must make provision for the installation of instrumentation
necessary to ensure operation in compliance with engine operating limitations. Where, in
presenting the safety analysis, or complying with any other requirement, dependence is
placed on instrumentation that is not otherwise mandatory in the assumed aircraft
installation, then the applicant must specify this instrumentation in the engine installation
instructions and declare it mandatory in the engine approval documentation.
(d) The applicant must provide instrumentation enabling the flightcrew to
monitor the functioning of the engine cooling system unless evidence shows that:
(1) Other existing instrumentation provides adequate warning of failure or
impending failure;
(2) Failure of the cooling system would not lead to hazardous engine effects, as
defined in EVE.3375(g)(2), before detection; or
(3) The probability of failure of the cooling system is extremely remote.
(e) The sensors, together with associated wiring and signal conditioning, must
be segregated, electrically and physically, to the extent necessary to ensure that the
probability of a fault propagating from instrumentation and monitoring functions to control
functions, or vice versa, is consistent with the failure effect of the fault.
EVE.3362 - Stress analysis.
(a) A mechanical and thermal stress analysis, as well as the stress caused by
electromagnetic forces, must show a sufficient design margin to prevent unacceptable
operating characteristics and hazardous engine effects as defined in EVE.3375(g)(2).
(b) Maximum stresses in the engine must be determined by test, validated
analysis, or a combination thereof, and must be shown not to exceed minimum material
properties."
EVE.3363 - Vibration
(a) The engine must be designed and constructed to function throughout its
normal operating range of rotor speeds and engine output power, including defined
exceedances, without inducing excessive stress in any of the engine parts because of
vibration and without imparting excessive vibration forces to the aircraft structure.
(b) Each engine design must undergo a vibration survey to establish that the
vibration characteristics of those components subject to induced vibration are acceptable
throughout the declared flight envelope and engine operating range for the specific
installation configuration. The possible sources of the induced vibration that the survey
must assess are mechanical, aerodynamic, acoustical, internally induced electromagnetic,
installation induced effects that can affect the engine vibration characteristics, and likely
environmental effects. This survey must be shown by test, validated analysis, or a
combination thereof.
EVE.3370 - Critical and life-limited parts.
(a) The applicant must show, by a safety analysis or means acceptable to the
ANAC, whether rotating or moving components, bearings, shafts, static parts, and non-
redundant mount components should be classified, designed, manufactured, and managed
throughout their service life as critical or life-limited parts.
(1) Critical part means a part that must meet prescribed integrity specifications
to avoid its primary failure, which is likely to result in a hazardous engine effect as defined
in EVE.3375(g)(2).
(2) Life-limited parts may include but are not limited to a rotor and major
structural static part, the failure of which can result in a hazardous engine effect, as
defined in EVE.3375(g)(2), due to low-cycle fatigue (LCF) mechanism. A life limit is an
operational limitation that specifies the maximum allowable number of flight cycles that a
part can endure before the applicant must remove it from the engine.
(b) In establishing the integrity of each critical part or life-limited part, the
applicant must provide to the ANAC the following three plans for approval:(1) An
engineering plan that contains the steps required to ensure each engine life-limited part is
withdrawn from service at an approved life before hazardous engine effects can occur. In
addition, the engineering plan must contain the steps to ensure each engine critical part is
withdrawn from service before hazardous engine effects can occur. These steps include
validated analysis, test, or service experience which ensures that the combination of loads,
material properties, environmental influences and operating conditions, including the
effects of other engine parts influencing these parameters, are sufficiently well known and
predictable so that the operating limitations can be established and maintained for each
engine life- limited and critical part. Applicants must perform appropriate damage
tolerance assessments to address the potential for failure from material, manufacturing,
and service induced anomalies within the approved life of the part. Applicants must publish
a list of the life-limited engine parts and the approved life for each part in the
Airworthiness Limitations Section of the Instructions for Continued Airworthiness as
required by EVE.1529.
(2) A manufacturing plan that identifies the specific manufacturing constraints
necessary to consistently produce each engine life-limited and critical part with the
attributes required by the engineering plan.
(3) A service management plan that defines in-service processes for
maintenance and the limitations to repair for each engine life-limited and critical part that
will maintain attributes consistent with those required by the engineering plan. These
processes and limitations will become part of the Instructions for Continued
Airworthiness.
EVE.3373 - Power response.
(a) The design and construction of the engine, including its control system,
must enable an increase-
(1) From the minimum power setting to the highest rated power without
detrimental engine effects in the intended aircraft application;
(2) From the minimum obtainable power while in flight, and while on the
ground, to the highest rated power within a time interval determined to be appropriate for
the intended aircraft application; and
(3) From the minimum torque to the highest rated torque without detrimental
engine effects in the intended aircraft application.
(b) The results of the increases in paragraphs (a)(1), (a)(2), and (a)(3) of this
section must be included in the engine installation manual.
EVE.3374 - Continued rotation.
If the design allows any of the engine main rotating systems to continue to
rotate after the engine is shut down while in-flight, this continued rotation must not result
in hazardous engine effects, as specified in EVE.3375(g)(2).
EVE.3375 - Safety Analysis
(a)(1) The applicant must analyze the engine, including the control system, to
assess the likely consequences of all failures that can reasonably be expected to occur. This
analysis will take into account, if applicable:
(i) Aircraft-level devices and procedures assumed to be associated with a typical
installation. Such assumptions must be stated in the analysis.
(ii) Consequential secondary failures and latent failures.
(iii) Multiple failures referred to in paragraph (d) of this section or that result in
the hazardous engine effects defined in paragraph (g)(2) of this section.
(2) The applicant must summarize those failures that could result in major
engine effects or hazardous engine effects, as defined in paragraph (g) of this section, and
estimate the probability of occurrence of those effects. Any engine part the failure of
which could reasonably result in a hazardous engine effect must be clearly identified in this
summary.
(b) The applicant must comply with paragraphs (a)(1) and (a)(2) of this section
using the failure definitions in paragraph (g) of this section and ICA in EVE.1529.
(c) The primary failure of certain single elements cannot be sensibly estimated
in numerical terms. If the failure of such elements is likely to result in hazardous engine
effects, then compliance may be shown by reliance on the prescribed integrity
requirements such as EVE.3315, EVE.3327, EVE.3370, or combinations thereof, as
applicable. These instances must be stated in the safety analysis.
(d) If reliance is placed on a safety system to prevent a failure from progressing
to hazardous engine effects, the possibility of a safety system failure in combination with
a basic engine failure must be included in the analysis. Such a safety system may include
safety devices, instrumentation, early warning devices, maintenance checks, and other
similar equipment or procedures. If items of a safety system are outside the control of the
engine manufacturer, the assumptions of the safety analysis with respect to the reliability
of these parts must be clearly stated in the analysis and identified in the installation
instructions under EVE.3305.
(e) If the safety analysis depends on one or more of the following items, those
items must be identified in the analysis and appropriately substantiated.
(1) Maintenance actions being carried out at stated intervals. This includes the
verification of the serviceability of items that could fail in a latent manner. When necessary
to prevent hazardous engine effects, these maintenance actions and intervals must be
published in the ICA required under EVE.1529. Additionally, if errors in maintenance of the
engine, including the control system, could lead to hazardous engine effects, the
appropriate procedures must be included in the relevant engine manuals.
(2) Verification of the satisfactory functioning of safety or other devices at pre-
flight or other stated periods. The details of this satisfactory functioning must be published
in the appropriate manual.
(3) The provisions of specific instrumentation not otherwise required.
(4) Flight crew actions to be specified in the operating instructions established
under EVE.3305.
(f) The applicant must comply with paragraphs (d) and (e) of this section using
the failure definitions in paragraph (g) of this section.
(g) Unless otherwise approved by ANAC and stated in the safety analysis, the
following failure definitions apply to the engine:
(1) A minor engine effect does not prohibit the engine from meeting its type-
design requirements and the intended functions in a manner consistent with (g)(1)(i),
(g)(1)(ii), and (g)(1)(iii) of this section, and the engine complies with the operability
requirements such as EVE.3373 and EVE.3389, as appropriate, or does not result in
LOPC.
(i) Enables selected values of relevant control parameters to be maintained and
the engine kept within the approved operating limits over changing atmospheric conditions
in the approved flight envelope;
(ii) Allows modulation of engine power or thrust with adequate sensitivity over
the declared range of engine operating conditions; and
(iii) Does not create unacceptable power or thrust oscillation."
(2) The following effects will be regarded as hazardous engine effects:
(i) Non-containment of high-energy debris;
(ii) Reserved.
(iii) Significant thrust in the opposite direction to that commanded by the
pilot;
(iv) Uncontrolled fire;
(v) Failure of the engine mount system leading to inadvertent engine
separation;
(vi) Release of the propeller by the engine, if applicable;
(vii) Complete inability to shut the engine down;
(viii) Electrocution of the crew, passengers, operators, maintainers, or others;
and
(ix) Reserved.
(h) The intended aircraft application must be taken into account when
performing the safety analysis.
(i) The results of the safety analysis and the assumptions about the aircraft
application used in the safety analysis must be documented in the engine installation
manual.
EVE.3377 - Ingestion
(a) Rain, ice and hail ingestion must not result in an abnormal operation such
as shutdown, power loss, erratic operation, or power oscillations throughout the engine
operating range.
(b) Ingestion from other likely sources (birds, induction system ice, hailstones,
foreign objects- ice slabs) must not result in hazardous engine effects, as defined in
EVE.3375(g)(2), or unacceptable power loss.
(c) If the design of the engine relies on features, attachments, or systems that
the installer may supply, for the prevention of unacceptable power loss or hazardous
engine effects as defined in EVE.3375(g)(2) following potential ingestion, then the features,
attachments, or systems must be documented in the engine installation manual.
EVE.3384 - Engine overtorque test.
When approval is sought for a transient maximum engine overtorque, the
applicant must demonstrate by test, validated analysis, or a combination thereof, that the
engine can continue operation after operating at the maximum engine overtorque
condition without maintenance action. Upon conclusion of overtorque tests conducted to
show compliance with this subpart, or any other tests that are conducted in combination
with the overtorque test, each engine part or individual groups of components must meet
the requirements of EVE.3393.
EVE.3385 - Calibration Test
Each engine must be subjected to calibration tests to establish its power
characteristics and the conditions both before and after the endurance and durability
demonstrations specified in EVE.3387 and EVE.3390.
EVE.3387 - Endurance Demonstration
(a) The applicant must subject the engine to an endurance demonstration,
acceptable to ANAC, to demonstrate the engine's limit capabilities.
(b) The endurance demonstration must include increases and decreases of the
engine's power settings, energy regeneration, and dwellings at the power settings or
energy regeneration for durations that produce the extreme physical conditions the engine
experiences at rated performance levels, operational limits, and at any other conditions or
power settings that are required to verify the limit capabilities of the engine.
EVE.3388 - Temperature Limit.
The engine design must demonstrate its capability to endure operation at its
temperature limits plus an acceptable margin. The applicant must quantify and justify to
ANAC the margin. The demonstration must be repeated for all declared duty cycles and
ratings, and operating environments, that would impact temperature limits.