Engine control system requirements
The characteristics of a gas turbine engine, particularly its characteristics during acceleration, are such that some form of engine control is essential if protection against surge is to be provided, and if the rotor RPM is to be maintained sensibly constant without creating an unacceptable workload for the pilot. In multi-engine installations it is also essential that the engine characteristics be matched. The engine control system is an integral part of the design of the whole helicopter and should, therefore, be related to its overall aerodynamic characteristics and its role. The major requirements for an engine/control system for a gas turbine engine installation are: 
• If any part of the governor system is electronic, it must be free from electric – magnetic interference by both internal and external sources.
It may not be possible to meet all these requirements simultaneously. The emphasis placed on the importance of each requirement will depend on the operational roles of the helicopter. The above requirements may be summarized as follows:
• Steady state function. The system should provide closed loop rotor governing by altering the fuel flow to the engine to maintain the rotor speed constant or within allowable NR limits.
• Transient functions. The system should, when required, provide protection and set limits on free turbine speed, gas generator speed, temperature or rate of change of temperature and torque. Also the system should control the acceleration of the engine during start-up and transient operation.
• Control loop opening. The system should provide for the control loop to be opened under certain conditions.
Part of the control system requirement is commonly achieved using limiters:
• Nf limiter. The free turbine speed limiter (or overspeed trip) must be of the highest order of integrity. Following a break in the transmission system under load very high free turbine accelerations are achieved. To prevent a catastrophic turbine disk failure, which could occur within one second of the transmission failure, the fuel supply to the gas generator must be cut off within a very short time (of the order of 0.05 of a second). There is a danger associated with such a limiter, in that it could lead to fuel starvation of the gas generator during a routine transient NR overswing.
• Ng limiter. The gas generator maximum speed must be limited to prevent the compressor RPM exceeding the value which would produce a high NGIfQ stall or cause excessive compressor blade loading. In some installations a two-position stop is provided, to permit training at lower limiting power levels and thus conserve engine life (Puma, Super Puma).
• Temperature limiter. A temperature limiter is required if the combustion chamber and turbine systems are not to be damaged by excessively high combustion chamber temperatures. An example is the Protection and Control Unit (PCU) fitted to the Rolls-Royce Gem engine.
• Torque limiter. Originally it was thought necessary to include a torque limiter to ensure that the transmission torque limits were not exceeded. However, such a limiter caused the loss of several helicopters and these limiters are no longer used. Although by mishandling it is possible to overtorque the transmission it is now considered more cost effective to sacrifice it rather than lose the aircraft. Note, however, that the design philosophy behind the transmission system varies between manufacturers. In the West, it is general policy to provide the minimum transmission power to do the task with acceptable margins, thus saving weight and cost, and leave the pilot to do the power limiting. On the other hand, the Russians have typically over-engineered the transmission such that it can cope with the maximum engine power available; thus the power limiter is the collective top stop. Collective pitch limitations are sometimes used as a compromise solution.