Subject: INSTRUCTIONS FOR CONTINUED 

AIRWORTHINESS; AIRCRAFT ENGINE HIGH 

INTENSITY RADIATED FIELDS (HIRF) AND 

LIGHTNING PROTECTION FEATURES

Date: 9/16/05 

Initiated By: ANE-111 

AC No: 33.4-3 

Change: 

1. PURPOSE. This advisory circular (AC) provides guidance and acceptable methods, but not 

the only methods, that may be used to demonstrate compliance for aircraft engines with § 33.4, 

Instructions for Continued Airworthiness (ICA), of Title 14 of the Code of Federal Regulations. 

This AC provides guidance for developing ICA to ensure the continued airworthiness of aircraft 

engine HIRF and lightning protection features. 

2. APPLICABILITY. 

a. The guidance provided in this document is directed to engine manufacturers, modifiers, 

foreign regulatory authorities, and Federal Aviation Administration (FAA) engine type 

certification engineers and their designees. 

b. This material is neither mandatory nor regulatory in nature and does not constitute a 

regulation. It describes acceptable means, but not the only means, for demonstrating compliance 

with the applicable regulations. The FAA will consider other methods of demonstrating 

compliance that an applicant may elect to present. Terms such as “should,” “shall,” “may,” and 

“must” are used only in the sense of ensuring applicability of this particular method of 

compliance when the acceptable method of compliance in this document is used. While these 

guidelines are not mandatory, they are derived from extensive FAA and industry experience in 

determining compliance with the relevant regulations. On the other hand, if the FAA becomes 

aware of circumstances that convince us that following this AC would not result in compliance 

with the applicable regulations, we will not be bound by the terms of this AC, and we may 

require additional substantiation as the basis for finding compliance. 

c. This material does not change, create any additional, authorize changes in, or permit 

deviations from existing regulatory requirements. 

3. RELATED REGULATIONS. 

a. Part 33, §§ 33.4 and 33.28, and Appendix A. 

b. Part 121, Subpart L. 
AC 33.4-3 9/16/05 

c. Part 135, Subpart J. 

d. Part 25, § 25.1529. 

4. RELATED READING MATERIAL. 

a. Airworthiness Inspectors Handbook 8300.10, Volume 3, Chapter 36, (Change 14, dated 

January 30, 2002) Section 1, Paragraph 7, Subparagraph E, Special Maintenance/Safety 

Considerations and Volume 2, Chapter 1 (Change 20, dated August 27, 2004), Perform Field 

Approval of Major Repairs and Major Alterations. 

b. AC 25.1309-1A, System Design and Analysis, June 21, 1988. 

c. AC 20-136, Protection of Aircraft Electrical/Electronic Systems against the Indirect 

Effects of Lightning, March 5, 1990. 

d. DOT/FAA/AR-04/14, Shield Degradation Effects of Loosened Connector Backshells of 

Aircraft Wiring Harnesses, October 2004. 

e. DOT/FAA/AR-04/15, Comparison of Various Impedance Measurement Techniques for 

Assessing Degradation in Wiring Harness Shield Effectiveness and a Field Survey of FADEC 

Shield Integrity of In-Service Aircraft, October 2004. 

f. SAE ARP5415, User’s Manual for Certification of Aircraft Electrical/Electronic 

Systems for the Indirect Effects of Lightning, May 2002. 

g. SAE ARP5583, Guide to Certification of Aircraft in a High Intensity Radiated Field 

(HIRF) Environment, January 2003. 

5. BACKGROUND. 

a. Advances in electronic control technology associated with flight critical systems and 

use of poorly conducting composite materials in aircraft structure have increased concern for the 

vulnerability of these systems to exposure to HIRF and lightning environments. The lack of 

specific information on the effects of in-service environmental factors such as corrosion, 

mechanical vibration, thermal cycling, mechanical damage and repair, and modification on the 

associated protection features of the type design has also increased concern. The guidance in 

AC 20-136 emphasizes the need to develop maintenance requirements for aircraft lightning and 

HIRF protection features. Also, the FAA revised the Airworthiness Inspectors Handbook 

8300.10 in Change 14 to ensure that the inspection/maintenance plan for each operator assures 

that the HIRF and lightning protection features of the type design are maintained in an airworthy 

condition. 

b. The FAA has an on-going initiative to ensure that the ICA include appropriate 

inspection/maintenance functions for engine components that rely on these activities for 

continued airworthiness. This initiative and an earlier Flight Standards bulletin have revealed 

2 
9/16/05 AC 33.4-3

that the continued airworthiness of HIRF and lightning protection features depend on 

maintenance activities. The Airworthiness Inspectors Handbook 8300.10 relies heavily on the 

identification of critical systems, the protection features employed in their designs, and the ICA 

regarding the inspection, maintenance, and possible replacement of all of those features. The 

appropriate place for these recommendations is in the ICA (specifically, the maintenance, 

overhaul and component maintenance manuals). Operators may use the ICA, which includes the 

Inspection Program, when establishing and implementing their FAA approved Continuous 

Airworthiness Maintenance Programs or other FAA approved inspection/maintenance programs. 

c. Although there have not been any inspection/maintenance functions that specifically 

address the HIRF and lightning protection features of these flight critical engine systems for the 

FAA to review, existing overall engine inspection/maintenance functions are in place that ensure 

the integrity of the HIRF and lightning protection features. These general 

inspection/maintenance functions have been effective in maintaining the HIRF and lightning 

protection features in designs that are currently used by industry. This is demonstrated by the 

430 million hours (through the first quarter of 2004) of in-service experience on engines with 

Electronic Engine Control (EEC) systems that have not had any known HIRF and lightning 

incidents attributed to in-service environmental degradation effects. There have not been any 

engine problems attributed to the lack of inspection and maintenance of HIRF and lightning 

protection features. However, in-service surveillance of airplane HIRF and lightning protection 

features indicates that existing airplane inspection/maintenance functions do not detect some

protection degradation. In addition, researchers at Wichita State University have confirmed that 

without inspection/maintenance some HIRF and lightning protective features may degrade. The 

FAA Technical Center issued a technical report (DOT/FAA/AR-04/14) in October 2004 about 

this research (see the reference in paragraph 4d of this AC). 

d. FAA and industry committees have developed guidance for inspection/maintenance of

aircraft lightning and HIRF protection features. AC 20-136 Section 7 recommends that the 

certification applicant develop maintenance requirements for aircraft lightning protection 

features. SAE ARP5415 Section 8 provides additional details and guidelines for lightning 

protection maintenance. SAE ARP5583 Section 9 provides additional details and guidelines for 

HIRF protection maintenance. In 1999, we published internal guidance that called for review of 

applicants’ maintenance requirements for aircraft HIRF protection. 

e. The following are examples of current inspection/maintenance functions that have 

played a role in providing good service experience: 

(1) Inspection and associated procedures linked to troubleshooting and Line 

Replaceable Unit removals; 

(2) Fault detection or annunciation of electrical system faults through Built-In-Test; 

(3) General Visual Inspection associated with scheduled aircraft Zonal Inspection 

Programs; and 

3 
AC 33.4-3 9/16/05 

(4) Normally scheduled engine shop visits and specific component shop maintenance 

associated with periodic maintenance, alteration, or upgrade, soft-time component inspection, or 

maintenance and repair, when applicable. 

 f. However, typical inspection/maintenance on aircraft and engines has not always been 

adequate to ensure the continued airworthiness of HIRF and lightning protection features. 

Depending upon the complexity of the protection design used, more specific and validated 

inspection/maintenance functions may be necessary to ensure the continued airworthiness of 

protection features in service. 

g. Although there have been no known HIRF and lightning incidents attributed to inservice engine environmental degradation effects, there is one known case of an engine flameout 

attributed to lightning for which an airworthiness directive (AD) was issued. Investigation 

revealed that the engine flameout occurred because several shields for the cable harness of the 

EEC were no longer properly grounded to the airframe. This condition, if not corrected, could 

result in insufficient protection of the EEC. The service bulletin associated with the AD 

describes procedures for a visual inspection to verify the integrity of the shield grounds for the 

cable harness of the EEC and to correct any discrepancy. The service bulletin also describes 

procedures to measure the electrical resistance of certain shield grounds, and to repair them, if 

necessary. The repair procedures ensure that the metal overbraid (which provides lightning 

protection for the EEC cable harness) is electrically bonded to the connector, and that the 

electrical receptacles are electrically bonded to the airframe. This incident emphasizes the 

importance of maintaining the continued airworthiness of HIRF and lightning protection 

features. 

6. GENERAL. 

a. The engine TC, STC or ATC applicant developing ICA for aircraft engine HIRF and 

lightning protection should identify the appropriate engine systems and equipment, their 

associated wiring, and all the protection features used by the type design to meet the engine 

HIRF and lightning protection requirements. The engine systems and equipment may be 

identified using criteria in the HIRF and lightning protection guidance, such as AC 20-136, or 

through functional hazard analyses or system safety analyses. Table 1 in Appendix 1 provides a 

list of potential problem areas and vulnerabilities that may contribute to degradation of 

protection and that can be considered when developing the ICA’s. 

b. At a minimum, systems whose failure or malfunction could prevent continued safe 

flight and landing of the aircraft, and for lightning, systems whose failure or malfunction could 

reduce the capability of the aircraft or the ability of the flight crew to cope with adverse 

operating conditions, should be identified and specifically addressed during the ICA 

development. Next, the engine TC, STC or ATC applicant developing the ICA should define the 

inspection and test method(s), acceptance criteria, and intervals that apply to these HIRF and 

lightning protection features. These HIRF and lightning ICA should detect degradation of 

protection features so that the features can be repaired to their original condition. The scope of 

these ICA depends on the detailed HIRF and lightning protection design approach of a particular 

engine model and the criticality of the systems being protected. 

4 
9/16/05 AC 33.4-3

c. Of special note is that coordination is required to assure compatibility between the 

engine’s and the installer’s ICA’s. 

d. During the design and packaging, consideration should be given to the ICA activities 

that are to be used. It may be key to the ICA’s that easy access to protection components for 

checks and troubleshooting is helpful. Taking this into account in the design can be an important 

factor. 

7. ICA TASKS—HIRF AND LIGHTNING PROTECTION FEATURES. 

a. Inspection and maintenance functions for the HIRF and lightning protection features are 

an essential factor in the continued airworthiness of the protection features and devices. Results 

from these ICA inspection/maintenance functions may be used to evaluate the effectiveness of 

protection features of systems. 

b. The engine and equipment HIRF and lightning protection features are typically 

designed to be effective over the life of the engine or equipment. Laboratory environmental tests 

for vibration, humidity, temperature, and salt exposure are often conducted on protection 

elements and equipment, and previous service experience on other aircraft engine models or 

configurations is typically considered when designing these features. 

c. In addition, although findings from certain inspection/maintenance actions may not 

directly indicate the effectiveness of HIRF and lightning protection features, they may provide 

indirect indications that show degradation in capability. For example, a visual inspection may 

discover connector corrosion that would indicate the potential for increased shield bonding 

resistance. But direct measurement must be used to determine shielding effectiveness. 

d. Therefore, the ICA should specify those inspection/maintenance functions necessary to 

provide a high degree of reliability and continued airworthiness for HIRF and lightning 

protection features and devices. These inspection/maintenance functions should be included in 

the inspection program and validated. The results of the inspection program should be used to 

assess its effectiveness in continuing the product’s compliance with the type design in service. 

8. TYPICAL INSPECTION/MAINTENANCE FUNCTION ELEMENTS. The following are 

some of the common elements of the protection features of inspection/maintenance functions 

(SAE ARP5583 Section 9 and SAE ARP5415 Section 8 provide more details on HIRF and 

lightning protection maintenance methods): 

a. Detailed bonding resistance measurements are effective in determining changes to 

connector bonding resistance, panel bonding, or bonding jumper performance. The disadvantage 

of this method is that additional testing or analysis is required to assess if bonding resistance 

changes are affecting the overall system HIRF and lightning protection. Bonding resistance on 

certain components may have more effect on the HIRF and lightning protection than bonding 

resistance on other components. Also, traditional bonding resistance measurements are not 

effective for detecting wire shield degradation, particularly for complex wire bundles with many 

5 
AC 33.4-3 9/16/05 

branches and terminations. Advantages of bonding resistance measurements, however, are that 

they can often be taken during other aircraft/engine maintenance activities and do not require that 

the aircraft/engine be located at a specific test site. 

b. Loop resistance or impedance measurements are effective in determining changes to 

wire bundle shields and connectors. Loop measurements are particularly good for complex wire 

bundles. As with bonding resistance measurements, additional testing or analysis is required to 

assess if loop resistance or impedance changes have any real effect on the overall system HIRF 

and lightning protection margin. High loop resistance on certain wire bundles may have more 

effect on the HIRF and lightning protection than high loop resistance on other wire bundles. 

Loop resistance or impedance measurements can often be taken during other aircraft/engine 

maintenance activities, do not require that the aircraft/engine be located at a specific test site, and 

do not generally require wire bundle disassembly or disconnection. The FAA Technical Center 

issued a technical report (DOT/FAA/AR-04/15) in October 2004 on research performed at 

Wichita State University on this topic. 

c. In some cases, an applicant may wish to include limited tear-down inspections that may 

be part of the required inspection/maintenance functions. For example, it may be desirable to 

disassemble selected connectors to detect corrosion or shield termination failure that would not 

be visible during maintenance inspections. 

 

d. Full aircraft/engine tests specified in the ICA are one method of determining the 

continued airworthiness of HIRF and lightning protection components or systems. Full 

aircraft/engine tests include high-level RF tests, low-level swept frequency tests, and low-level 

direct drive tests. The results of these tests can be directly compared to the original HIRF and 

lightning certification data. This approach may be used to evaluate adequacy of the 

inspection/maintenance functions. The disadvantage of full aircraft/engine tests is that these 

tests may not provide information on the location or extent of individual protection element 

degradation if that degradation results in compromising the system’s overall integrity. For 

example, a full aircraft/engine test could indicate unacceptable degradation, but could not be 

used to identify the cause, such as an individual connector or shield termination. Another 

disadvantage is that full aircraft/engine tests require highly specialized test equipment and 

training. 

e. Acceptance criteria should be developed for each specified inspection/maintenance task. 

If electrical bonding or loop resistance measurements are required, maximum acceptable 

electrical resistance values should be specified. These maximum acceptable resistance values 

should be based on the engine HIRF and lightning protection certification tests or analyses. 

f. Certain HIRF and lightning protection features may require specific functional tests to 

determine their continued airworthiness. For example, lightning protection devices such as 

transient suppression diodes may require specialized test equipment to determine if these 

protection devices are still functional. These functional tests are sometimes required following 

aircraft exposure to severe lightning or to a HIRF environment that can result in failure of these 

protection features without any fault indication. 

6 
9/16/05 AC 33.4-3

g. Inspection of protection features within the electronic engine control has been 

acceptable at intervals when the electronic engine control has been opened for some other 

reason, such as, repair of a detected internal fault. However, for this to be a valid method, it 

must be established that this interval is appropriate. It is possible, though not likely, that the 

interval could take the unit to its end of life (that is, if the EEC is never returned for repair). This 

approach depends on no introduction of common mode HIRF and lightning failures, common to 

more than one engine, that would invalidate the original system certification. This factor must be 

shown to be valid. 

h. Appendix 1 of this document provides an example of the calculation of the average 

system failure rate for a system where there are undetectable failures in some of the system’s 

lightning strike protective components and those components are only repaired when the unit is 

undergoing repair for failures of components that are detectable. 

9. VALIDATION OF INSPECTION/MAINTENANCE FUNCTIONS AND 

DETERMINATION OF THEIR EFFECTIVENESS. 

a. The extent of validation activity depends on the scope of the engine 

inspection/maintenance tasks specific to HIRF and lightning protection. If the results from

inspection/maintenance tasks do not provide information to determine the effectiveness of the 

HIRF and lightning protection features, then validation is necessary. For example, visual 

inspection may be used to determine the continued airworthiness of the wire shielding or 

raceways; however, validation tasks should be specified to include direct measurements of 

appropriate protection features to show acceptable capability. SAE ARP5583 Section 9.4 and 

SAE ARP5415 Section 8.4 provide more details on HIRF and lightning protection assurance 

approaches that may be used to validate the inspection/maintenance functions. 

b. If the inspection/maintenance tasks provide a direct measurement of the protection 

elements, then validation may not be required for these elements. When an engine TC, STC or 

ATC applicant has determined that validation is not required, the applicant should document the 

rationale for this determination and present it to the FAA for concurrence. For example, the 

applicant may have relevant operating experience gained in the past with the same or similar 

installations. If the effect of this design experience has already been included in the applicant’s 

design, the applicant may show that a validation activity is not necessary. 

 

c. The validation activity typically uses a sample of in-service engines. When selecting 

engines for the sample, the applicant should: 

(1) Focus on high operating time and high flight cycle aircraft. 

 

(2) Consider the operating environment for the selected engines, such as extreme 

temperatures, corrosive environments like salt spray, or other harsh environments. 

(3) If applicable, consider the engine installation configurations. 

7 
AC 33.4-3 9/16/05 

(4) Use more than one engine in the sampling activity. For example, when dealing 

with engine models with expected fleet sizes that exceed 500 aircraft, an initial sample size of 

five to ten aircraft and their associated engines is considered adequate. 

d. During normal engine maintenance actions, the HIRF and lightning protection features 

may be affected, which may affect the validation activity. For example, during an engine shop 

visit for maintenance it may be determined that a harness should be replaced. Replacing the 

harness prior to validation, however, would alter the data for establishing the deterioration of the 

shielding effectiveness of the harness with time. The validation activities in the ICA should 

consider how to account for engine maintenance actions that may affect the HIRF and lightning 

protection features. 

e. Sampling activities are normally scheduled as close to the beginning of heavy 

maintenance activities as possible to ensure an evaluation of in-service conditions. Sampling, 

which can be scheduled along with the heavy maintenance activities, typically requires suitable 

engine accessibility to gain access to HIRF and lightning protection features. Sampling activities 

scheduled every four to five years for the selected aircraft/engine are adequate. 

f. The engine TC, STC or ATC applicant may set up a separate inspection/maintenance 

validation activity for individual engine systems, electrical equipment, or electronic engine 

controls for HIRF and lightning protection features located within equipment that cannot be 

effectively verified by aircraft/engine tests or equipment in-service acceptance tests. 

g. If the engine ICA do not specify tests to determine functionality of HIRF and lightning 

protection components, such as filters or transient suppression devices, based on an assumed 

reliability of the protection components, then the validation activity could include tests to 

validate the assumed reliability. This validation activity could also be done by other means, such 

as failure mode substantiation or field experience. 

h. The validation of the inspection/maintenance functions of the ICA should focus on 

engine HIRF and lightning protection features associated with systems and features whose 

failure or malfunction could prevent continued safe flight and landing of the aircraft. 

//Original signed by FAF on 9/16/05// 

Fran A. Favara 

Acting Manager, Engine and Propeller Directorate 

Aircraft Certification Service 

8 
9/16/05 AC 33.4-3 

 Appendix 1 

APPENDIX 1. AVERAGE SYSTEM FAILURE RATE 

Note: The following example illustrates calculation of the average system failure 

rate for a system where there are undetectable failures in some of the system’s 

lightning strike protective components and those components are only repaired 

when the unit is undergoing repair for failures of components that are detectable. 

1. The subject of using an electronic unit’s mean-time-between-failure (MTBF) for detectable 

failures as the repair interval for the unit’s undetected failures in the lightning protective 

components has been receiving increased attention. This appendix presents a simplified Markov 

model analysis of a basic 2-unit system, such as a full-authority-digital-engine control (FADEC) 

system. The example shows that the impact of system failures caused by lightning strikes is quite 

small. The results also show that using the electronic unit’s MTBF for detected failures as the 

repair interval for undetected failures in the lightning protective components is adequate. 

2. Two configurations are analyzed: 

(a) The first configuration is a dual channel system where both channels are contained in 

the same physical unit. In this system, both channel’s lightning protective elements can be 

inspected and repaired when the unit is opened for repair of detected faults in either channel. 

(b) The second configuration is when each channel is contained in its own separate box. In 

this case, only those lightning protective components in the unit being repaired for a detected 

fault can be inspected and, if faulty, repaired. 

3. In either of the two configurations analyzed, the applicant must include instructions, within 

the unit’s Component Maintenance Manual, that inspection and repair of the protection devices 

must be carried out in accordance with these assumptions. 

4. The analysis assumes that 10 percent of a channel’s components are for lightning 

protection. This is a very conservative, high estimate. It is also assumed that 10 percent of the 

lightning protective components can fail in an undetected state, also a conservative estimate. 

Thus, one percent of the units MTBF for detectable failure are assumed to result in undetectable 

failures in the lightning protective components. It is also assumed that the system is approved 

for time-limited-dispatch (TLD) operation. TLD operation allows the system to be dispatched 

with one unit known to be inoperative for a specified number of flight hours before repair of the 

faulty unit is required. 

5. In both examples, the average failure rate with respect to lightning strikes is added to the 

average random component system failure rate to yield an overall average system failure rate. 

This average includes the impact of TLD operations. The impact of TLD operations is shown in 

the following results. 

1
AC 33.4-3 9/16/05 

Appendix 1 

APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) 

The 2-channel system configuration is shown in Figure 1. This figure is meant to show just the 

redundant electronic elements of the system. 

 Detectable Faults Failure Rate = R 

Undetectable Faults Failure Rate = r 

 Detectable Faults Failure Rate = R 

Undetectable Faults Failure Rate = r

Channel A

Channel B

 Figure 1. Simplified Diagram of a Redundant 2-Channel System 

The system is composed of components with a detectable failure rate of R that affect the 

system’s loss-of-thrust-control (LOTC) rate and of components with an undetectable failure rate 

of r in the lightning protective components. 

Markov Model:

A simplified Markov model of the system is shown in Figure 2. The Markov model includes the 

following conditions: 

1. The system can fail due to random failures in the R components. This is shown by the 

λ1FAIL-LOTC transitions from the P2 and P4 states to the PLOTC state. 

2. The system can also fail due to lightning strikes. This is shown by the σ transitions 

from the P3 and P4 states to the PLOTC state. 

The model shows the two configurations where both channels are in the same physical unit and 

where the two channels are contained in separate units. 

• When both channels are in the same unit: 

o The repair rate (μ) from the P4 state is to the full-up state (PFU) because any 

undetected failures in the lightning protective elements in the channel that does 

not have detected faults will be found and repaired in either channel. 

• When each channel is in a separate unit: 

o The repair rate μ from the P4 state is to the P1 state because undetected faults in 

the channel that is not being repaired (for detected faults) will not be found and 

repaired. 

2 
9/16/05 AC 33.4-3 

 Appendix 1 

3 

APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) 

2 

UNDET 

FAIL

1 DET 

OPP 

SIDE 

1 

UNDET 

FAIL

1 

DET 

FAIL

P1 

PLOTC

P3 

P4

P2

PFU

R + σ

μ

2r 

σ + λ1fail-lotc

σ

2R 

r 

μfb

R r 

μ

2R 

λ1fail-lotc

Separate 

Boxes 

Single 

Box

 Figure 2. Simple Markov Model of 2-channel FADEC system for both channels in

a single box and each channel has its own separate box. 
AC 33.4-3 9/16/05 

Appendix 1 

APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) 

In this model: 

PFU is the probability of being in the full-up state—with regard to undetectable failures in the 

lightning protective elements. 

P1 is the probability of having undetected failures in the lightning components of one of the two 

channels. 

P2 is the probability of having detected failures in one of the two channels. 

P3 is the probability of having undetected failures in the lightning protective components of both 

channels. 

P4 is the probability of having detected failures in one of the two channels and having undetected 

failures in the lightning components of the other channel. 

r is the failure rate for undetectable failure in the lightning components of one channel. 

R is the failure rate for detectable failures in a channel. The reciprocal of R is the MTBF for 

detected failures in a channel. 

λ1FAIL-LOTC represents the failure rate from the state where one unit has a detected failure to the 

loss-of-thrust-control (system) failure state. 

μ is the repair rate for channels with a detected failure. It is equal to 1/TREPAIR. Hence, it is not 

assumed that a channel with a detected failure is repaired immediately. That channel is allowed 

to remain in service for TREPAIR flight hours before repair is required. 

σ is the rate for lightning strikes that are of sufficient magnitude to cause the unit(s) to fail—if

there are undetectable failures in the lightning protective elements of the unit(s). 

In the model pictured, the system repairs itself from the “one unit with failed lightning protection 

elements” to the full-up state either via (1) a detected failure in that unit, which causes the unit to 

get pulled for repair (at which time the protective circuitry is confirmed to be inoperative and 

repaired) or (2) a lightning strike strong enough to cause the unit to fail, which causes it to get 

pulled for repair. 

4 
9/16/05 AC 33.4-3 

 Appendix 1 

APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) 

The steady state Markov model equations (eq.) to be solved to obtain the average failure rate of 

the system are: 

Conservation Eq. PFU + P1 + P2 + P3 + P4 + PLOTC = 1 

P1 State Eq. 2r*PFU + (μ*P4)Note1 = (σ + 2R + r)*P1 

Note 1. If both channels are in the same unit, the μ*P4 is not in this equation. 

P2 State Eq. 2R*PFU + (σ + R)*P1 = (μ + λ1FAIL-LOTC + r)*P2 

P3 State Eq. r*P1 = (σ + 2R)*P3 

P4 State Eq. R*P2 + 2R*P3 = (σ + μ + λ1FAIL-LOTC)*P4 

The failure rate of the system is: 

 λ1FAIL-LOTC *(P2 + P4)/PFU + σ*(P3 + P4)/PFU

 λLOTC = ---------------------------------------------------------------------- 

 1 + (P1 + P2 + P3 + P4)/PFU 

The first term in the numerator represents those system failures caused by having random

components, which affect the LOTC rate, fail in both channels. The second term represents 

system failures caused by lightning strikes of sufficient magnitude to cause the system to fail if

there are undetected failures in one channel of the system combined with detected failures in the 

other channel or undetected failures in the lightning protective components of channels. 

Calculations were based on the following data, where it is assumed that one percent of a 

channel’s detectable failure rate represents the undetectable failure of elements providing 

lightning protection: 

R = 50*10-6 failures per hour 

r = 0.5*10-6 failures per hour 

λ1FAIL-LOTC = 34*10-6 events/hr. 

μ = varied from 100 up to 800 events/hour in increments of 100 hours. 

σ = varied from 1/2500 to 1/37500 events/hour in increments of 5,000 hours. 

5 
AC 33.4-3 9/16/05 

Appendix 1 

APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) 

Results for the case where both channels are in the same unit are shown in Figure 3 as a function 

of the lightning strike rate for repair rates of 125, 200 and 350 hours. The data shows that the 

impact of lightning strikes increases when the mean-time-between-lightning-strikes (MTBLS) 

decreases. Thus, the MTBLS for the remaining plots is set at 2,500 hours. This is very 

conservative, as the MTBLS for severe lightning strikes (estimated) is expected to be 

approximately 15,000 hours or greater. 

Figure 3--System Failure Rate vs. Mean Time Between Lightning Strikes 

Both Channels in Same Box

2.00E-07

4.00E-07

6.00E-07

8.00E-07

1.00E-06

1.20E-06

1.40E-06

1.60E-06

2500 7500 12500 17500 22500 27500 32500 37500

Mean Time Between Lightning Strikes

Failures per hour

Trep(ave) = 200 hrs., Random only

Trep(ave) = 125 hrs., Random only

Trep(ave) = 125 hrs., Random + Lightning

Trep(ave) = 200 hrs., Random + Lightning

Trep(ave) = 350 hrs., Random + Lightning

Trep(ave) = 350 hrs., Random only

6 
9/16/05 AC 33.4-3 

 Appendix 1 

APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) 

Figure 4 represents the case of both channels in the same unit, and it shows the average system

failure rate as a function of the repair interval in hours. The repair interval is the allowed 

dispatch interval for operation with one unit having detected faults in components that lead to an 

LOTC event. The MTBLS is fixed at 2,500 hours. 

Figure 4--Redundant Electronics Failure Rate as a function of 

Repair Hours with Lightning Strikes Fixed at 2,500 hours

- channels in same box

0.00E+00

5.00E-07

1.00E-06

1.50E-06

2.00E-06

2.50E-06

3.00E-06

100 200 300 400 500 600 700 800

Repair Time in Hours

System Failure Rate

Random + Lightning Strike Failure Rate

Random Failure Rate Only

The data shows that the effect on the overall average system failure rate caused by lightning 

strikes is quite small. The repair rate—or allowable time for dispatching with one channel 

having detected faults—has a much greater impact. 

7 
AC 33.4-3 9/16/05 

Appendix 1 

APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) 

Figure 5 shows the same data for a system configuration where the two channels have their own 

separate boxes. Similar to Figure 4, the data shows that the impact of having separate boxes for 

each channel has a negligible impact on the LOTC rate of the system as compared with the repair 

time, or allowed dispatch interval, for a failed unit. 

Figure 5--Redundant Electronics Failure Rate as a function of 

Repair Hours with Lightning Strikes Fixed at 2,500 hours 

- channels in separate boxes

0.00E+00

5.00E-07

1.00E-06

1.50E-06

2.00E-06

2.50E-06

3.00E-06

100 200 300 400 500 600 700 800

Repair Time in Hours

System Failure Rate

Random + Lightning Strike Failure Rate

Random Failure Rate Only

8 
9/16/05 AC 33.4-3 

 Appendix 1 

APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) 

Conclusion

Both Figures 4 and 5 show that the unit repair time has a much greater influence than lightning 

strikes on the system’s LOTC. The contribution to the system failure rate from lightning strikes 

is less than one percent for any reasonable system repair rate. 

9 
AC 33.4-3 9/16/05 

Appendix 1 

APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) 

TABLE 1—POTENTIAL PROBLEM AREAS AND VULNERABILITIES CONTRIBUTING 

TO POSSIBLE DEGRADATION OF HIRF AND LIGHTNING PROTECTION OF ENGINE 

AND PROPELLER ELECTRONIC CONTROL SYSTEMS FOR CONSIDERATION IN THE 

ESTABLISHMENT OF INSPECTION/MAINTENANCE FUNCTIONS:

 I. Structures Integrity: (i.e., conductive current path; attenuation; 

struts and wing fairings (composites); and; 

how material is installed around bundles)

• structural parts bonding • galvanic action 

• internal and external meshes • damage tolerance 

• internal and external surface treatments 

(coatings) 

• hydroscopic contamination (absorption of 

moisture) 

• structural corrosion • gaskets and seals 

• ground strap integrity • latches and hinges 

• structural repairs • change of materials and material integrity 

• aperture control (holes and slots) 

II. Installation, Location, and Routing 

Integrity: 

(i.e., location of Electronic Control; 

accuracy of cable routing; physical geometry 

and relation to structure, and; distance to 

ground)

• distance from ground plane • inappropriate repair/alteration 

• proper cable retention • nonessential system installation 

• routing wire path apertures • system to system proximity 

• wear, fretting • changing zone threats 

• rebundling/rerouting • ground and bonding integrity

III. Wire and Bundling Shielding 

Integrity:

(i.e., integrity of cables; enclosures of 

Electronic Controls; meshes, and; actuators)

• connectors (Electromagnetic Interference 

(EMI) fingers in place, tight, and not 

damaged) 

• gasket integrity 

• backshells (in place and tight) • pin and socket security 

• shield termination • wire abrasion or cold flowing 

• shield corrosion • wire shorts to connector shell 

• shield deformation/damage • wire shorts to conductors 

• connector corrosion • wire count 

• connector damage • cable dress/wire sleeves 

• ground strap surface corrosion • element failures 

• fastener security (tightness) • surge protection failures 

• faying surface condition • isolation resistance/insulation breakdown 

10 
9/16/05 AC 33.4-3 

 Appendix 1 

APPENDIX 1. AVERAGE SYSTEM FAILURE RATE (Continued) 

IV. Terminal Protection Device (TPD) 

Integrity:

(i.e., internal, on board, and external; EMI 

filters; transzorbs; Metal Oxide Varistors 

(MOV’s); and resistor elements)

• Silicon Avalanche Diode (SAD) failures 

(open, short, or shift) 

• moisture and contamination 

• solder joint integrity • EMI gasket deterioration

• tightness (during assembly) • cracked/damaged ferrites

• filter pin ground opening • inductance element defects (filters) 

• MOV failure (open, short, or shift) • series resistance defects 

• reverse leakage • corrosion 

• capacitor element defects (filters) 

V. Circuit Design Integrity: (i.e., enclosures for circuits; ground plane; 

isolation; AC/DC coupling; changes to 

circuit characteristics, and; effects on 

protection after functional failure)

• green wire repairs (jumper repair) • unterminated lines 

• violation of approved parts list • cuts and jumpers 

• inappropriate approved parts list • damage to ground planes 

• grounding and bonding • corrosion to ground planes 

• gaskets • component solder joint integrity

• component fault tolerance (operation 

with faults present) 

VI. Grounding and Bonding Integrity: (i.e., ground straps in place; impedance 

bonding of connectors, and; protection 

device grounding) 

• loose ground straps • damage to ground planes 

• corrosion to connector shells • corrosion to ground planes 

11