[Federal Register: November 14, 2003 (Volume 68, Number 220)]
[Proposed Rules]
[Page 64729-64798]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr14no03-41]
[[Page 64729]]
-----------------------------------------------------------------------
Part IV
Department of Transportation
-----------------------------------------------------------------------
Federal Aviation Administration
-----------------------------------------------------------------------
14 CFR Parts 1, 21, 25, 33, 121, 135
Extended Operations (ETOPS) of Multi-engine Airplanes; Proposed Rule
[[Page 64730]]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Parts 1, 21, 25, 33, 121, 135
[Docket No. FAA-2002-6717; Notice No. 03-11]
RIN 2120-AI03
Extended Operations (ETOPS) of Multi-engine Airplanes
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Notice of proposed rulemaking (NPRM).
-----------------------------------------------------------------------
SUMMARY: The FAA proposes to issue regulations governing the design,
maintenance, and operation of airplanes and engines for flights that go
beyond certain distances from an adequate airport. This proposal would
extend some requirements that previously applied only to two-engine
airplanes to airplanes with more than two-engines. The proposed rule
implements existing policy, industry best practices and
recommendations, and international standards to ensure that long-range
flights will operate safely.
DATES: Send your comments on or before January 13, 2004.
ADDRESSES: You may submit comments to DOT DMS Docket Number FAA-2002-
6717 by any of the following methods:
[sbull] Web Site: http://dms.dot.gov. Follow the instructions for
submitting comments on the DOT electronic docket site.
[sbull] Fax: 1-202-493-2251.
[sbull] Mail: Docket Management Facility; U.S. Department of
Transportation, 400 Seventh Street, SW., Nassif Building, Room PL-401,
Washington, DC 20590-0001.
[sbull] Hand Delivery: Room PL-401 on the plaza level of the Nassif
Building, 400 Seventh Street, SW., Washington, DC, between 9 a.m. and 5
p.m., Monday through Friday, except Federal holidays.
[sbull] Federal eRulemaking Portal: Go to http://www.regulations.gov.
Follow the online instructions for submitting
comments.
Instructions: All submissions must include the agency name and
docket number or Regulatory Identification Number (RIN) for this
rulemaking. For detailed instructions on submitting comments and
additional information on the rulemaking process, see the Public
Participation heading of the Supplementary Information section of this
document. Note that all comments received will be posted without change
to http://dms.dot.gov. including any personal information provided.
Please see the Privacy Act heading under Regulatory Notices.
Docket: For access to the docket to read background documents or
comments received, go to http://dms.dot.gov at any time or to Room PL-
401 on the plaza level of the Nassif Building, 400 Seventh Street, SW.,
Washington, DC, between 9 a.m. and 5 p.m., Monday through Friday,
except Federal holidays.
FOR FURTHER INFORMATION CONTACT: Eric vanOpstal, Flight Standards
Service, Air Transportation Division, AFS-200, Federal Aviation
Administration, 800 Independence Avenue SW., Washington, DC 20591;
telephone (202) 267-3774; facsimile (202) 267-5229.
SUPPLEMENTARY INFORMATION: Comments Invited. The FAA invites interested
persons to participate in this proposed rulemaking by submitting
written comments, data, or views. We also invite comments relating to
the economic, environmental, energy, or federalism impact that might
result from adopting the proposals in this document. The most helpful
comments reference a specific portion of the proposal, explain the
reason for any recommended change, and include supporting data. We ask
that you send us two copies of written comments.
We will file in the docket all comments we receive, as well as a
report summarizing each substantive public contact with FAA personnel
concerning this proposed rulemaking. The docket is available for public
inspection before and after the comment closing date. If you wish to
review the docket in person, go to the address in the ADDRESSES section
of this preamble between 9 a.m. and 5 p.m., Monday through Friday,
except Federal holidays. You may also review the docket using the
Internet at the web address in the ADDRESSES section.
Before acting on this proposal, we will consider all comments we
receive on or before the closing date for comments. We will consider
comments filed late if it is possible to do so without incurring
expense or delay. We may change this proposal in light of the comments
we receive.
If you want the FAA to acknowledge receipt of your comments on this
proposal, include with your comments a pre-addressed, stamped postcard
on which the docket number appears. We will stamp the date on the
postcard and mail it to you.
Regulatory Notices
Privacy Act: Anyone is able to search the electronic form of all
comments received into any of our dockets by the name of the individual
submitting the comment (or signing the comment, if submitted on behalf
of an association, business, labor union, etc.). You may review DOT's
complete Privacy Act Statement in the Federal Register published on
April 11, 2000 (Volume 65, Number 70; Pages 19477-78) or you may visit
http://dms.dot.gov.
Availability of Rulemaking Documents
You can get an electronic copy using the Internet by taking the
following steps:
(1) Go to the search function of the Department of Transportation's
electronic Docket Management System (DMS) Web page (http://dms.dot.gov/search
).
(2) On the search page type in the last five digits of the Docket
number shown at the beginning of this notice. Click on ``search.''
(3) On the next page, which contains the Docket summary information
for the Docket you selected, click on the document number of the item
you wish to view.
You can also get an electronic copy using the Internet through
FAA's web page at http://www.faa.gov/avr/arm/nprm/nprm.htm or the Federal Register's Web page at http://www.access.gpo.gov/su_docs/aces/
v/su_docs/aces/
You can also get a copy by submitting a request to the Federal
Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence
Avenue SW., Washington, DC 20591, or by calling (202) 267-9680. Make
sure to identify the docket number, notice number, or amendment number
of this rulemaking.
Background
The Federal Aviation Administration (FAA) has long-standing
regulations that restrict the operations of two-engine air carrier
airplanes operated under part 121, Title 14 of the Code of Federal
Regulations (14 CFR). Under current regulations these airplanes may not
be operated on routes that lie more than sixty minutes from an airport
unless authorized by the Administrator. The premise for these
restrictions was that two-engine airplanes were less safe than three
and four engine airplanes particularly over very long distances.
History of ETOPS
In the 1980s, a new generation of very reliable, two engine
airplanes came into service and changed the underlying premise that
restricted the operations of these airplanes. The airline industry
sought to take advantage of the
[[Page 64731]]
improvements in reliability, range, and payload capabilities that these
new airplanes offered. Beginning in 1985, the FAA allowed air carriers
to operate certain twin-engine airplanes on routes that included points
more than sixty-minutes from an adequate airport under a formal program
known as Extended Range Operation with Two Engine Airplanes
(``ETOPS''). The regulatory basis of ETOPS was the deviation authority
contained in 14 CFR section 121.161. With the cooperation of the
airlines, manufacturers, and other interested groups, the FAA carefully
controlled and monitored this new type of flight operation.
Historical Documents
Advisory Circulars 120-42 and 120-42A
In support of ETOPS, the FAA issued two Advisory Circulars (AC)
120-42 and 120-42A in 1985 and 1988 respectively. These two AC
documents have been the basis for type design and operational practices
for ETOPS to date. Initially, the FAA set a maximum approval of 120
minutes from an airport for ETOPS. During the nascent stage of ETOPS,
air carriers gained significant service experience; the safety and
efficiency of ETOPS became apparent. In 1988, the FAA increased that
approval to 180 minutes based on demonstrated safety record of these
operations.
Deviation Authority From Sec. 121.161 Prior to ETOPS
Since the 1970s, the FAA has authorized two-engine operations on
routes up to 75 minutes away from an airport exclusively in the
Caribbean. These were not considered ETOPS flights. These flights were
approved by the FAA as deviations under section 121.161, but were
authorized before a formal ETOPS program was developed. These
deviations were approved after a safety evaluation of the areas of
operation, the airplanes, and the operators conducting them.
207 Minute ETOPS
In March 1999, the Air Transport Association (ATA) asked the FAA to
extend the 180-minute ETOPS authorization an additional fifteen percent
to 207-minutes. The FAA published the ATA letter and asked for comments
(64 FR 22667, April 27, 1999). Several commenters suggested that the
FAA should formalize ETOPS in the regulations rather than continuing to
rely on the deviation authority in section 121.161 and advisory
materials. In January 2000, the FAA approved 207 minute ETOPS and
stated its intent to task an Aviation Rulemaking Advisory Committee
(ARAC) Working Group to study the issues and to recommend regulations
for ETOPS (65 FR 3522, January 21, 2000). In this same notice, the FAA
solicited comments from the public on its decision to approve 207
minute ETOPS.
Polar Operations Letter
The increasing use of Polar flights, while creating economic
benefits, has brought new challenges to extended operations such as
climactic extremes. Due to these new challenges and to the increasing
similarity among all long-range operations, experience began to show
that ETOPS requirements and processes are generally applicable to all
long-range operations including those by three and four engine
airplanes and would improve their safety.
Harmonization With International Standards
Related International Activity
Two related activities should be noted. First, the Joint Aviation
Authorities (JAA) of European nations has chartered a working group
that is also developing standards and guidance material for extended
operations. In ongoing efforts of both the FAA and JAA to coordinate
regulatory requirements, one of the ARAC ETOPS Working Group tasks was
to ``harmonize * * * standardized requirements across national
boundaries and regulatory bodies.'' Toward that end, there are
representatives who are members of both the ARAC ETOPS Working Group
and the JAA Working Group. Also, the two groups met together twice in
Europe to facilitate joint action and harmonization. Second, the
International Civil Aviation Organization (ICAO) Air Navigation
Commission (ANC) Operations Panel has decided to develop standards and
recommended practices (SARPS) for extended range operations. In May of
2001, the ARAC ETOPS Working Group held one of its meetings in
Montreal, Quebec, Canada (ICAO's headquarters city) for the purpose of
briefing members of the ANC and ICAO Air Navigation Bureau staff.
ARAC ETOPS Working Group Task Statement
The FAA established the ARAC ETOPS Working Group through a notice
in the Federal Register at 65 FR 37447, dated June 14, 2000. It was
given the following tasks:
1. Review the existing policy and requirements found in Advisory
Circular (AC) 120-42A, applicable ETOPS special conditions, and policy
memorandums and notices, for certification and operational regulations
and guidance material for ETOPS approvals up to 180 minutes.
2. Develop comprehensive ETOPS airworthiness standards for 14 CFR
parts 25, 33, 121, and 135, as appropriate, to codify the existing
policies and practices.
3. Develop ETOPS requirements for operations in excess of 180
minutes up to whatever extent that may be justified. Develop those
requirements such that incremental approvals up to a maximum may be
approved.
4. Develop standardized requirements for extended range operations
for all airplanes, regardless of the number of engines, including all
turbojet and turbopropeller commercial twin-engine airplanes (business
jets), excluding reciprocating engine powered commercial airplanes.
This effort should establish criteria for diversion times up to 180
minutes that is consistent with existing ETOPS policy and procedures.
It should also develop criteria for diversion times beyond 180 minutes
that is consistent with the ETOPS criteria developed by the Working
Group.
5. Develop additional guidance and/or advisory material as the ARAC
finds appropriate.
6. Harmonize such standardized requirements across national
boundaries and regulatory bodies.
7. Any proposal to increase the safety requirements for existing
ETOPS approvals up to 207 minutes must contain data defining the unsafe
conditions that would warrant the safety requirements.
8. The Working Group will provide briefings to the Transport
Airplane and Engine Issues group.
9. The recommendations should consider the comments received as a
result of the April 27, 1999 and January 21, 2000 Federal Register
notices.
10. Within one year of publication of the ARAC task in the Federal
Register, submit recommendations to the FAA in the form of a proposed
rule.
Formation and Membership of the ETOPS Working Group
Formation
Following the formal tasking notice in the Federal Register, the
ARAC organized an ETOPS Working Group.
Membership
The ETOPS Working Group consisted of over 50 representatives of
U.S. and foreign airlines, aircraft and engine manufacturers, pilots'
unions, industry groups, air disaster support groups, and
[[Page 64732]]
representatives from the Joint Aviation Authority (JAA), International
Civil Aviation Organization (ICAO) and the FAA.
In accordance with the task statement and the Working Group's work
plan approved by the ARAC Air Carrier Operations Issues Group on August
15, 2000, the Working Group reviewed existing ETOPS documents and
developed a risk assessment method for ETOPS and other long-range
flights. The risk assessment method is comprised of three parts: a loss
of thrust model; a system safety analysis using the FAR/JAR 25.1309
process; and an operational assessment assuring that pertinent
operational considerations are taken into account.
On the basis of the risk model and their review of long-range
operations, the Working Group used the following general concepts as
the basis for proposed regulations and advisory material.
[sbull] Special considerations must be given for extended range
flights to prevent the need for a diversion and to protect the airplane
and passengers during the diversion when it cannot be prevented;
[sbull] Airplanes must be designed and built for the intended
mission.
[sbull] Airplanes must be designed, manufactured, and maintained at
a level that ensures the original reliability throughout the life of
the airplane.
[sbull] When engine reliability reaches a certain level, as
measured by the In Flight Shut Down (IFSD) rate (IFSD=0.01/1,000
hours), the risk of independent failures leading to loss of all thrust
is not significant enough to require limiting the allowed time from an
airport and other limiting factors come into play.
[sbull] For part 121 air carrier operations, ETOPS should be
defined as flights more than 60 minutes from an adequate airport for
two-engine airplanes and more than 180 minutes from an adequate airport
for air carrier airplanes with more than two engines. For part 135
operations ETOPS should be defined as flights more than 180 minutes
from an adequate airport.
[sbull] Because of extreme climactic conditions certain ETOPS
requirements should be applied to Polar operations even if those
operations would not otherwise be considered ETOPS
[sbull] Part 135 operations have unique considerations
Improvements in airplane engine and system reliability have reached
a point that they may no longer be the constraining factor on the long-
range flight operations. The Working Group found, however, and the FAA
agrees, that it would be prudent for two-engine airplanes to remain
within 180 minutes of an adequate airport whenever possible. There is a
positive correlation between risk and diversion length. Thus the FAA
believes that diversion lengths should be kept to a minimum.
ARAC ETOPS Working Group Concept General Observations
As already noted, the working group acknowledged that the
reliability of aircraft engines and systems has improved to the point
that it may not be limiting to the operation. The Working Group
recommended that two-engine airplanes should be approved in many cases
for 180 minutes ETOPS and ETOPS beyond 180 minutes may be appropriate
in some situations. The Working Group recommended that airplanes with
more than two engines should be approved for ETOPS beyond 180 minutes
in many cases. Even though engine reliability has significantly
improved, diversions are sometimes necessary for reasons that are
unrelated to the number of engines on an aircraft and their
reliability, such as passenger illness or other occurrences.
Regarding extended range operations by jet-powered airplanes under
part 135, FAA policy for many years has permitted such flights up to
180 minutes from an airport, without additional ETOPS-like
requirements. Operational experience has validated that policy, and the
Working Group proposal continues existing policy and provides for
flights with longer diversion times with appropriate additional
requirements.
Regarding extended range operations by air carrier airplanes with
more than two engines, those flights have been conducted without any
ETOPS-like requirements since the air carrier jet era began. The
Working Group's proposals would ensure the continued safety of those
flights by adding requirements in areas that are not dependent upon the
number of engines on the airplane, such as cargo fire protection
duration.
The ETOPS Working Group has proposed regulations and guidance
material in three specific areas: Type Design (parts 25 and 33); part
121 Operations; and part 135 Operations.
General Discussion of the Proposal
FAA Approach to the ARAC Recommendations
In developing this proposal the FAA has accepted ARAC
recommendations without change where possible. The FAA made changes for
clarity, to correct for incomplete ARAC recommendations, to ensure that
requirements are legally sufficient, and to make improvements in style
of presentation. The FAA provides explanation in this notice for any
substantial differences with the ARAC recommendation.
General Issues
Terminology--Extended Operations (ETOPS)
This proposal has two primary objectives: (1) To create new
regulations and amend existing regulations for the design, maintenance,
and operation of aircraft used in ETOPS; thus far ETOPS has been
allowed by the FAA's discretionary authority and supported by an
Advisory Circular and; (2) To apply the lessons learned from ETOPS to
all airplanes that are operated in Extended Operations (ETOPS)
regardless of the number of engines. The acronym ETOPS would apply to
all airplanes in Extended Operations and not just twin-engine
airplanes. These rules would apply equally to airplanes operating over
oceanic areas or routes entirely over land.
Risk Model
Item 3 of the ARAC tasking was to ``develop ETOPS requirements for
operations in excess of 180 minutes up to whatever extent that may be
justified.'' At the early ARAC ETOPS Working Group meetings, the FAA
presented a new risk model for assessing risk on an ETOPS flight. The
new approach for assessing the overall risk of critical thrust loss on
an ETOPS flight considers such factors as the length of the flight and
engine reliability in addition to the more traditional maximum
diversion time.
The ARAC ETOPS Working Group adopted the FAA's proposed risk model
and further developed it to apply it to three and four engine
airplanes. It did this by including the corresponding engine failure
rate that would be required to achieve an equivalent risk of critical
thrust loss due to independent failures on three and four engine
airplanes. We will now summarize the risk model used in the development
of this proposed rule.
The basic premise that the FAA used in developing its risk model is
that ETOPS service experience is excellent and that any changes to
allow further expansion of ETOPS need to preserve this record. With
this premise in mind, the basic objective is to define a risk model
that would allow an expansion of two engine airplane operations to use
the same routes as three and four engine airplanes with no substantial
change in the overall risk.
[[Page 64733]]
Currently, we manage dual engine shut down risk on two engine
airplanes by limiting the maximum allowable diversion distance and
requiring a low engine in-flight shutdown rate. This is a one-
dimensional risk model in that with a constant in-flight shutdown rate,
the existing ETOPS requirements and policy consider only the maximum
distance that an operator may plan a route from an enroute diversion
airport. It assumes that there is a constant risk during the course of
a flight with no consideration of how the actual diversion times vary
along the track as different alternate airports come into and out of
range of the airplane. This approach also does not consider the
increase in overall risk that is created by increasing an airplane's
range, and thus time aloft, by adding fuel. Further, this model
provides no means to assess the effect on overall risk with changes
with engine failure rates. Actual ETOPS involve continuously changing
distances to alternates. Current ETOPS limits on maximum diversion time
don't represent real world risk because diversions can occur anywhere
along the track, not just at the maximum point. The new ETOPS risk
model adopted for the development of this new proposed rule is based on
the introduction of a ``two dimensional'' model to replace the ``one
dimensional'' maximum diversion time/distance model currently in use.
The new ETOPS Exposure Index is a simplified form of several risk
equations that have been developed over the past forty years. All share
similar characteristics. The ARAC ETOPS Working Group compared several
different mathematical representations for allowable risk versus engine
failure rate. Each showed that an engine failure rate on the order of
0.01 per 1,000 engine flight hours was adequate to allow diversion
times for two engine airplanes that for all practical purposes could be
considered as unrestricted.
The new risk model consists of a comparative risk index based on a
combination of range, average diversion distance, and engine failure
rate. Independent cause dual engine shut down risk is driven by the
footprint area of the route multiplied by the engine failure rate (E)
squared. The footprint area is defined as the route length (L)
multiplied by the average diversion distance (D). Note that the engine
shut down rate is squared to account for loss of first engine and then
loss of second engine. Therefore, we define ``ETOPS Exposure Index''
(EEI) as a function of:
[sbull] Footprint Area (Route Length x Average Diversion Distance)
(L x D) and
[sbull] E2 (Engine Failure Rate Squared)
EEI = L x D x E2
The ETOPS Exposure Index can be used as an evaluation tool to
assess risk of ETOPS operations due to independent engine failure
causes. Assuming the following values for each of the terms of the
equation:
[sbull] Route Length = 5500 nautical miles,
[sbull] Average Distance for 180 minute ETOPS = 800 nautical miles,
and
[sbull] Engine failure rate at the current required level = 0.02
shutdowns/1,000 engine-hours or 50,000 hours time between shutdowns.
The EEI would then be:
EEI = 5500 x 800 x 0.022 = 1760
With the ETOPS Exposure Index fixed at this level, longer flights
and greater maximum diversion distances can be offset by decreased
engine failure rate. In other words, as E becomes smaller, L and/or D
can increase appropriately. An engine failure rate of one-half the
current requirement (E = 0.01/1,000 engine-hours) would allow a four
times increase in ``footprint'' area.
EEI = L x D x E2
EEI = 5500 x 800 x 0.022 = 1760 equals
EEI = 5500 x 3200 x 0.012 = 1760 equals
EEI = 11,000 x 1600 x 0.012 = 1760
In other words, with an engine failure rate that is one-half the
current requirement for 180 minute ETOPS we could allow four times the
average diversion distance or a combination of increased route length
and average diversion distance with no change in the current ETOPS
risk.
For a two engine airplane, engine failure rate has the biggest
impact on ETOPS risk because the factor is squared. A reduction in the
engine failure rate has a large impact on the size of an allowable
footprint area for the same risk. Using the ETOPS Exposure Index
concept with a reduction in the engine failure rate standard allows the
development of ETOPS rules for two engine airplanes that minimize
restrictions on airline operations while maintaining the current
excellent ETOPS safety record.
Current in-service engines are capable of achieving better than
100,000 hours time between shutdowns (.01/1,000 engine-hours), or
double the current ETOPS reliability standard. This represents two in-
flight shutdowns in the entire life of a typical transport airplane. It
is not reasonable to expect that two in-flight shutdowns due to
independent causes in the entire life of a typical transport airplane
would occur on the same flight.
With an IFSD rate of 0.01/1,000 hours, the probability of complete
loss of thrust due to independent failures will be sufficiently low so
that the main focus of long-range operational safety can be on reducing
the possibility of other risk factors.
We emphasize that this risk model represents a good tool for
evaluating the risk of critical thrust loss due to ``independent''
failure causes. The biggest threat to long-range operational safety
continues to be the loss of thrust from multiple engines resulting
from:
Common Cause Multiple Failures
Cascading Multiple Failures
Fuel Exhaustion
These threats are common to all long-range operations, regardless of
the number of engines on the airplane.
Examples of common cause multiple failure events:
Eastern Airlines L1011 nearly lost all engines after improper
installation of engine magnetic chip detectors.
B-747 volcanic ash cloud encounter during volcanic eruption in Alaska--
All engines severely damaged by ash.
Example of potential cascading failure:
Worn-out second engine fails after application of higher power
following failure of first engine
Examples of Fuel Exhaustion events:
Air Canada 767--No power landing into Gimli, Canada
Air Transat A330--No power landing in the Azores
Sources of Common Cause and Cascading Failures:
Common Design Faults
Hardware
Software
Environmental Exposures
Weather
Volcanic Ash Clouds
Bird Strikes
High Intensity Radiated Fields (HIRF)
Lightning
Simultaneous Maintenance on More than One Engine
Contaminated Fuel
Sources of Fuel Exhaustion:
Operational Errors
Fuel System Mismanagement
Fuel Loading Errors
Misleading Fuel Quantity Indications
Misleading Fuel Loading Procedures particularly during a non-normal
(MEL) dispatch
Constant awareness of potential sources of common cause failures,
cascading failures, and fuel exhaustion is the key to continued long-
range operational safety. This awareness, growing from operating
experience, is the basis for continued ETOPS safety. ETOPS safety
enhancements focus on defining methods to prevent potential threats
caused by known sources.
Examples of Common Cause/Cascading Failure Prevention Strategies:
[[Page 64734]]
1. No single person performing simultaneous engine maintenance or
servicing
2. Conservative fuel loading requirements
3. Intense rain/hail ingestion engine design requirements
4. Constant adherence to established ETOPS procedures without exception
5. Robust engine condition monitoring program
The FAA incorporated prevention strategies for these types of failures
into airworthiness requirements and ETOPS policy as we learned of them.
This proposal would codify those prevention strategies for known
sources of common cause, cascading and fuel exhaustion failures that
have not been incorporated into the regulations.
The ARAC ETOPS Working Group also looked at how the new risk model
could be applied to airplanes with more than two engines. For these
types of airplanes, the working group had to decide what a critical
loss of thrust was in order to determine the impact that engine failure
rate would have on overall risk. For a two-engine airplane, the risk
model assumes that a loss of both engines is a critical thrust loss.
This is because there is a general expectation that the result of such
an occurrence would be a catastrophic loss of the airplane; though
there are examples of safe landings following the loss of both engines.
The working group applied a similar approach to define a critical
thrust loss for airplanes with more than two engines.
The operating rules contained in 14 CFR part 121 have minimum
performance requirements with two engines inoperative for airplanes
that have more than two engines. Using this as a guide, the working
group assumed that critical thrust loss for both three and four engine
airplanes would be three engines. If three engines fail on either kind
of airplane, there is a general expectation that the result would be a
catastrophic loss of the airplane. In other words, the risk model
assumes the fourth engine on a four-engine airplane provides no
additional safety benefit compared to the loss of all engines on a
three-engine airplane. As is the case for two-engine airplanes, there
are examples where a flight crew was able to safely land a four-engine
airplane following the loss of three of the engines. However, the ETOPS
risk model makes the conservative assumption that this would result in
loss of the airplane.
This assumption for three and four engine airplanes changes the
risk model equations so that for these types of airplanes, the
probability of the loss of three engines would be much more remote than
the loss of both engines on a two engine airplane. Under this
assumption there is a higher probability of losing three engines on a
four-engine airplane than on a three-engine airplane. The following
example illustrates the concept. A three-engine and a four-engine
airplane are in-flight. Both airplanes suffer the loss of two-engines
due to independent causes but can reach a diversion airport. However
the loss of an additional engine for either airplane at this point
would be catastrophic for the airplane. The three-engine airplane has a
single engine that could possibly fail while the four-engine airplane
has two engines that could possibly fail. In this unlikely situation,
the four-engine airplane is at greater risk because the probability of
experiencing an engine failure event increases with the number of
engines. Assuming that the engine failure rate is the same for each
type of airplane, a four-engine airplane would have twice the
probability of losing one of the two remaining engines than the three-
engine airplane would have of losing the one remaining engine.
Using the available risk model equations with these considerations,
the ARAC ETOPS Working Group determined that the in-flight shutdown
rate for a three engine airplane would be approximately 0.2 shutdowns
per 1,000 engine-hours to have an equivalent risk of critical thrust
loss compared to a two engine airplane with an in-flight shutdown rate
of 0.01 per 1,000 engine-hours. On a four-engine airplane, the
equivalent in-flight shutdown rate would be 0.1 per 1,000 engine-hours.
Because these rates are so high compared to the failure rates
currently achieved by today's turbine engines, the FAA does not
consider it necessary to specify in-flight shutdown rates for three and
four engine airplanes other than as part of an operator's propulsion
system monitoring program. Under these programs, the operator must
notify the FAA and take corrective action if these rates are exceeded.
In-flight Shutdown (IFSD) Rate
Propulsion system monitoring is vital to ensure safe ETOPS flights.
A propulsion system monitoring program is intended to detect adverse
trends, to identify potential problems, and to establish criteria for
when corrective action may be necessary. The certificate holder would
have to ensure that its ETOPS airplanes have In-Flight Shutdown (IFSD)
rates commensurate with the world fleet's operation for that airplane
type. Propulsion system monitoring at the operator level has been
accomplished via the guidance of AC 120-42A which defined specific IFSD
rates for ETOPS.
Propulsion system problems and IFSD may be caused by type design
deficiencies, ineffective maintenance or operational procedures. It is
very important to identify the root cause of events so that appropriate
corrective action may be determined. The diverse causes of propulsion
system problems require different solutions. For example, type design
problems may affect the world fleet of aircraft. If an individual
certificate holder experiences a problem caused by a type design issue,
it may not be appropriate for the FAA to reduce or withdraw the
particular operator's ETOPS authority. However, maintenance or
operational problems may be wholly, or partially, the responsibility of
the certificate holder. If a certificate holder has an unacceptable
IFSD rate risk attributed to maintenance or operational practices, then
action carefully tailored to that certificate holder may be required.
The FAA does not use IFSD rate as the sole means to determine a
certificate holder's ETOPS authority. The FAA considers the 12-month
rolling average standard that occurs for a mature fleet after the
commencement of ETOPS. A high IFSD rate could be due to the limited
number of engine operating hours used as the denominator for the rate
calculation or a small fleet. The effect may be an IFSD rate jump well
above the standard rate due to a single IFSD event. The underlying
causes for such a jump in the rate will have to be considered by the
Administrator. Conversely, there may be occasions when a single ETOPS
event may warrant corrective action even though the overall IFSD rate
is not exceeded. In such a case, the cause would be certificate holder
specific and may require changes to their operational, dispatch or
maintenance procedures.
Configuration, Maintenance, and Procedures (CMP) Document
The use of a CMP document has been in the ETOPS criteria from AC
120-42, and later 120-42A, from the very first ETOPS airplane
approvals. The CMP document defines airplane and propulsion system
design configurations, maintenance procedures, and operational
procedures required to comply with the ETOPS requirements that are not
already a part of the original type design approved by the original
issuance of the airplane and engine type certificates.
The CMP document is comprised of service bulletins, service
letters,
[[Page 64735]]
maintenance manual references, and other pertinent documents which
define the alterations, maintenance or operational requirements and
limitations that the FAA requires to make an airplane type design
suitable for ETOPS. The CMP is an amendment to the airplane type design
defined in 14 CFR 21.31. The initial CMP approval, as a change to the
type design, is analogous to other type design approvals for specific
operations such as Category III autoland approval for autopilot systems
that could involve design changes to a previously certified system.
After ETOPS approval, the CMP may be modified by any airworthiness
directives (ADs) issued in accordance with part 39 that supersede
existing CMP requirements. CMP document requirements will not increase
except by AD.
Misconceptions about the criteria for revising CMP documents
generated some of the biggest discussions in the ARAC ETOPS Working
Group meetings. The FAA approved airplanes for ETOPS under the original
AC 120-42 between 1985 and 1989 without a defined propulsion system
reliability standard. The approach used in AC 120-42 to assess the
suitability of an airplane-engine combination for ETOPS was to use a
``fix all problems'' approach. This process involved identifying the
causes of propulsion system problems in service on the candidate
airplane and including identified corrective actions into an approved
CMP document as a condition for ETOPS approval. This was an ongoing
process and the FAA conducted regular reviews to determine additional
corrective actions as new problems occurred in service. As a result,
the FAA routinely required the airplane manufacturer to revise the CMP
documents during this period.
The ``fix all problems'' approach to airplane propulsion system
assessment was carried over into the revised AC 120-42A at the end of
1988, and continues on in this notice in proposed part 25 Appendix L
paragraph II(a)(ii). However, revision A of the AC added a propulsion
system reliability standard as a provision for ETOPS type design
approval that did not exist in the original AC. With an established
propulsion system reliability standard, the FAA now had a gauge to
monitor the safety of the approved ETOPS fleet without a need to
continually update the CMP as new problems occurred. Also, several
ETOPS operators began objecting to the FAA requiring them to
continually upgrade existing ETOPS approved airplanes without any input
to the changes being required.
The FAA recognized that our previous practice of requiring upgrades
to already approved airplanes without prior public review created an
undue burden on operators. As a result, the FAA changed its approval
process for revisions to CMP documents. The FAA documented this change
in an internal memorandum signed by the managers of the Transport
Airplane Directorate, and the Engine and Propeller Directorate on April
3, 1990. In that memo, the directorate managers noted that the AC gave
them the responsibility for the continuing airworthiness of the type
design CMP standard and that the CMP should not be changed unless the
reliability of the airplane-engine combination is not achieving or
maintaining the reliability objective, or some other unsafe condition
arises. As with any type design, the FAA permits manufacturers and
operators to incorporate minor changes and routine enhancements by
service bulletins or production design changes. However, the FAA will
not mandate such enhancements in a revision to the CMP standard. The
memo concludes by stating that the Transport Airplane and the Engine
and Propeller Directorates plan to use the AD process to control the
continuing airworthiness type design requirements of the ETOPS CMP
standard.
As a result of the joint memo, the FAA established strict
guidelines for CMP revisions to ensure that the requirements of the
basic CMP standard originally approved for an airplane-engine
combination are not increased without going through the AD process.
The FAA approves revisions to an airplane's CMP document for the
following reasons:
1. When incorporating the CMP standard for a newly approved
airplane-engine combination into an existing CMP document.
2. When correcting errors in previous revisions.
3. When ADs are issued that supersede existing CMP requirements.
4. When approving optional alternatives to existing requirements.
5. When mandating changes to the CMP by an AD.
The FAA aircraft certification offices have used these guidelines
since issuance of the joint memo to approve CMP revisions. Because
operators had already complied with several revisions to previously
approved CMP documents in force at the time the FAA issued the new CMP
guidelines, the FAA worked with the airlines and the manufacturers to
establish ``baseline'' CMP requirements for each ETOPS approved
airplane-engine combination. The affected operators agreed to ensure
that all of the requirements of these baseline CMPs are incorporated
into their ETOPS fleets. Thereafter, the new CMP revision guidelines
would be the standard way of making subsequent revisions.
Summary of the Proposed Changes
The following chart summarizes which operations would be affected
by the proposed rule changes:
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current requirements Proposed rule
--------------------------------------------------------------------------------------------------------------------------------------------------------
Beyond 60 min up to
Up to 60 minutes Beyond 60 minutes Up to 60 minutes 180 minutes Beyond 180 minutes
--------------------------------------------------------------------------------------------------------------------------------------------------------
Part 121 two engine................ Section 121.161 Advisory material and No change............ Would apply (Would Would apply.
applies. policy letters. codify previous
practice).
Part 121 more than two engine...... No current regulation. No current regulation No change............ No change............ Would apply.
Part 135........................... No current regulation. No current regulation No change............ No change............ Would apply.
--------------------------------------------------------------------------------------------------------------------------------------------------------
BILLING CODE 4910-13-P
[[Page 64736]]
The chart below summarizes ETOPS regulations before and after the
proposed changes.
[GRAPHIC] [TIFF OMITTED] TP14NO03.002
BILLING CODE 4910-13-C
[[Page 64737]]
Section-by-Section Discussion of the Proposal
We begin the discussion by clarifying the term ``ETOPS''. Since its
inception eighteen years ago, the term ``ETOPS'' has described
extended-range operations of two-engine air carrier airplanes under a
deviation from 14 CFR 121.161. The term has gained broad acceptance
among operators and regulators throughout much of the world.
This proposal would create regulatory requirements for extended
operations for all air carrier airplanes. As described previously, the
thresholds for applicability would vary by the number of engines and
type of operation. In its deliberations, the Working Group stated that
it struggled with the question of whether to use a new term to describe
the operations of airplanes beyond 180 minutes from an adequate
airport. Early on, the Working Group considered and agreed to the term
``LROPS'' which stands for Long Range Operations to describe flights
beyond the 180-minute threshold. However, as their efforts progressed
the Working Group found that the use of two terms (ETOPS and LROPS) for
two-engine airplanes flying beyond 60 minutes and 180 minutes from an
airport quickly became awkward and cumbersome. Further, the Working
Group members representing the maintenance community expressed great
concern that the introduction of the LROPS term would needlessly create
confusion among the maintenance community and would also require
painstaking and potentially expensive revisions to numerous maintenance
manuals and programs. In order to avoid any potential confusion, the
Working Group recommended the use of the term ETOPS for all air carrier
extended range operations irrespective of the number of engines.
The FAA strongly agrees with this recommendation. The FAA also
believes that the addition of a new term could needlessly create
confusion. Further it would potentially dilute the intent of this
proposal, which is to codify existing ETOPS standards and procedures
and to extend those concepts to airplanes with more than two engines.
The FAA believes that the introduction of a new term could be
misinterpreted as creating a new operational concept as opposed to the
extension of an existing one.
The proposed amendments to the Type Design Rules 14 CFR parts 25
and 33 and supporting advisory material are a consolidation of
requirements taken from AC 120-42A, the 777 Special Conditions, and JAA
Information Leaflet (IL) 20. The materials contained in the proposed
Airplane Type Design Rule (part 25) and AC are a compilation of the
existing AC120-42A, 777 Special Condition, and JAA IL20.
The following discussion takes each of the Rule sections and
attempts to capture all of the comments and discussion from the ARAC
activities.
Part 1
Section by Section Discussion of the Proposed Changes to Part 1
Section 1.1--General Definitions
The proposed definitions were adopted directly from the ARAC
recommendation. This proposal would establish three different
definitions of ETOPS in three significant ways. In each case, the
acronym would stand for ``extended operations'' for all airplanes
regardless of the number of engines. The definition would vary in part
121, however, depending on whether the airplane involved has two
engines or more than two engines. This proposal also would introduce
ETOPS into part 135 for the first time, where ETOPS would have a third
definition. The FAA believes the remainder of the proposed definitions
for section 1.1 are self-explanatory.
Part 21
The amendments to part 21 would create reporting requirements for
the holders of type certificate for two-engine ETOPS airplanes and
ETOPS eligible engines. This would require type certificate holders to
closely monitor the performance of their products to ensure their
continuing reliability. These amendments would also ensure that the FAA
is kept apprised of any existing or potential problems in a timely
manner.
Section by Section Discussion of the Proposed Changes to Part 21
Proposed New Section 21.4--ETOPS Reporting Requirements
This proposal would add a new regulation consisting of two parts,
Early ETOPS Problem Reporting & Tracking for all ETOPS airplanes, and
ETOPS Operational Service Reliability Reporting for two-engine
airplanes.
Explanation
1. Reporting for all ETOPS airplanes. The proposed rule is a
codification of what the FAA considers to be one of the essential and
objective elements of the early ETOPS Special Conditions (SC) for the
B777 aircraft; specifically as they pertain to problem tracking and
reporting. The FAA accepts the ARAC recommendation and proposes it as a
new section 21.4. Section 21.4 would require the type certificate
holder to establish an early ETOPS problem reporting system. The
proposed system would contain a means for the prompt identification of
those problems that could impact the safety of ETOPS operations in
order that they may be resolved in a timely manner. The system would
also contain the process for the timely notification to the responsible
FAA office of all relevant problems encountered, and identification of
corrective actions deemed necessary and provide for appropriate FAA
review of all planned corrective actions. The system would be in place
for the first 250,000 engine-hours of fleet operating experience after
the airplane enters service.
For two-engine ETOPS airplanes the system would remain in effect
beyond 250,000 engine-hours of fleet operating experience until the
fleet has demonstrated a specified and stable IFSD rate consistent with
the approved diversion time of the aircraft. For the service period,
this system would define the sources and content of in-service data
that will be made available to the type certificate holder in support
of the problem tracking system. The content of the data provided would
include the data necessary to evaluate the specific cause of all
service events reportable under section 21.3(c) of part 21, in addition
to any other failure or malfunction that could affect the safety of
ETOPS operation. Ten event occurrences, specifically defined with
respect to reliable, safe ETOPS operation that would require reporting
are defined in the proposal.
2. Reporting for two engine ETOPS airplanes. Paragraph (b)(1) of
the proposed section 21.4 would require engine and airplane
manufacturers to report periodically on the reliability of their two-
engine airplane fleets. Reporting would include: IFSD events, IFSD
rates, and ETOPS fleet statistics. This reporting may be combined with
the reporting required by section 21.3. The proposed rule also would
require the identification of cause and appropriate corrective action
to assure reliable, safe ETOPS operations.
The periodic reporting of the reliability required of the
manufacturers of engines and airplanes approved for ETOPS service would
begin at the introduction of the product into service and continue
throughout its product life. The interval of the reporting would be
more frequent early in its product cycle and generally longer later in
its product service life, especially after the product has achieved
maturity with regard to engine reliability. Reliability would be
indicated by a stable engine
[[Page 64738]]
shutdown event rate at or below the target values.
Generally, early product service life reporting on a quarterly
basis is adequate, especially considering the fact that the
manufacturers report engine failure events as they occur under the
requirements of section 21.3. Event rates may fluctuate considerably
early in the product's service life cycle because, although the fleet
is growing in numbers of engine-airplane combinations in service, the
accumulation of engine flight hours is generally slow. Typically, event
rates are not very stable when the fleet cumulative time is less than 1
or 2 million engine flight hours. Therefore the focus should be on
event occurrences, not failure rates, with a small fleet typical of
early service time.
After maturity (a stable engine shutdown event rate at or below the
target values) with a large fleet, reporting intervals continue on a
quarterly basis. Regardless of fleet size, fleet age, and state of
maturity, engine failures are reported under the requirements of
section 21.3.
3. Paragraph (b)(2) of the proposed section 21.4 identifies world
fleet IFSD rate/reliability requirements. The standards in section
21.4(b)(2)(i) are the IFSD rates compatible with the current FAA ETOPS
AC and Policy for operation up to 180 minutes (including North Pacific
operation). The standard in section 21.4(b)(2)(ii) is an IFSD rate
compatible with operation beyond 180 minutes to 240 minutes and beyond,
as contained in the proposed Operational rule and guidance material.
As discussed in this proposed NPRM, an IFSD rate of 0.01/1,000
Engine Flight Hours (EFH) is consistent with an extremely improbable
risk of a dual in-flight power loss from independent causes for a two-
engine airplane, even assuming a decision of practically unlimited
duration. The rates given are not operator specific, but rather apply
across the fleet of a given airplane-engine combination.
The FAA expects implementation of corrective action will maintain
an acceptable in-flight shutdown rate below the required levels. This
is borne out by the current ETOPS fleet in-flight shutdown rates, which
have achieved and consistently maintained rates at or below 0.01 per
1,000 engine-hours. If the normal airworthiness monitoring process is
not sufficient by itself to maintain an acceptable propulsion system
reliability for a particular airplane-engine combination, then the FAA
may require additional corrective actions, or reduce or withdraw the
ETOPS diversion authority as described in section 21.4(c), if the risk
of dual power loss is unacceptably high. Before such action is taken,
however, the certificate holder and the FAA will assess the fleet-wide
risk based upon the risk model developed for ETOPS presented in this
preamble.
Part 25
Section by Section Discussion of the Proposed Changes to Part 25
Proposed Change to Paragraph 25.857(c)(2)--Cargo Fire Suppression
The proposed change to section 25.857(c)(2) would require that the
applicant furnish the certified time capability of a Class C cargo fire
suppression system in the Airplane Flight Manual (AFM) in accordance
with section 25.1581(a)(2). The time capability of a system is the
maximum length of time a system can suppress a fire.
Explanation
The proposed new section 121.633 and part 135, Appendix H,
paragraph E would specify that the time that an operator needs to fly
to a planned ETOPS alternate may not exceed the maximum time capability
specified in the Airplane Flight Manual for the airplane's most time
limited system. This change to section 25.857(c)(2) and a similar
requirement in the new Appendix L, section I, paragraph (e)(4) will
ensure that the Airplane Flight Manual provides the information that
the operators will need regarding the fire suppression system to comply
with the operating requirements. The justification for these changes is
further discussed in the explanations for those proposed operating
rules.
Proposed New Section 25.1535--ETOPS Approval
A proposed new section 25.1535 would prescribe the requirements for
obtaining ETOPS type design approval.
Explanation
This new rule in the body of part 25 is effectively a pointer to a
new Appendix L, which sets out additional design, analysis and test
requirements for ETOPS type design approval. This rule also requires
that in showing compliance with part 25 rules the applicant must
consider the maximum length ETOPS mission. The applicant must also
consider the effects of airplane system failure on crew workload and
passenger physiological needs during a diversion of the maximum time
considered. The system safety assessment required by section 25.1309 is
an example of a rule where the ETOPS mission profile would be
considered in an analysis to determine compliance. The ETOPS mission
profile (including the maximum diversion time) could also affect the
compliance analysis for section 25.1011(b) concerning oil endurance,
and section 25.571 governing structural fatigue and damage tolerance.
This proposed rule is crucial to ensure that throughout the
airplane design, the ETOPS mission profile is properly considered, and
the standard of compliance is high because of it. The ``ETOPS
Scenario'' diagram and the ETOPS significant systems definition that
would be provided in the associated advisory circular for this rule are
good tools that system designers can use to assess all conditions
although they are not regulatory. There are also additional
requirements in Appendix L to provide focus on those airplane systems
that have, historically, been important to ETOPS operations such as
electrical power, APU, and fuel systems. The emphasis on these specific
airplane systems does not mean that these are the only airplane systems
that are important to ETOPS. The section 25.1535 and Appendix L
requirements along with the advisory circular guidance for ETOPS
significant systems and the ETOPS mission profile provide the basis for
assessing other airplane systems for ETOPS approval.
Proposed New Part 25 Appendix L--Extended Operations
A proposed new appendix L to part 25 defines additional
airworthiness requirements for ETOPS approval.
Explanation
Appendix L would codify the airworthiness standards unique to ETOPS
from Advisory Circular 120-42A, the Boeing 777 ETOPS special
conditions, and the 207-minute ETOPS Policy Letter EPL 20-01. The
requirements of Appendix L would go beyond simply considering the ETOPS
mission in applying the basic part 25 requirements.
Since we would not require an applicant to comply with these ETOPS
requirements in order to receive a basic part 25 type certificate, we
decided that a separate appendix to part 25 would be the best location
for these additional requirements for ETOPS.
Appendix L Format
Appendix L is organized into three sections. Section I sets out
design requirements that all airplanes must comply with for ETOPS
approval. Section II prescribes specific requirements for two engine
airplanes. Section III prescribes specific
[[Page 64739]]
requirements for airplanes with more than two engines.
The proposed numbering system and organization of Appendix L is a
significant departure from the ARAC recommendation. As an aid to
readers familiar with the original ARAC proposal, Tables 1 and 2 cross-
reference the original Appendix L paragraph numbers recommended by ARAC
to the reorganized appendix proposed in this notice.
Table 1.--Cross-Reference of ARAC Proposed and New Appendix L Paragraph Numbers
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------
Original ARAC Proposal New
----------------------------------------------------------
L25.1............................. ..................... Appendix L.......... Applicability
L25.2............................. (a).................. Section I........... (a)
(a)(i)............... Section I........... (a)(1)
(a)(i)(1)............ Section I........... (a)(1)(i)
(a)(i)(2)............ Section I........... (a)(1)(ii)
(a)(ii).............. Section I........... (a)(2)
(a)(ii)(1)........... Section I........... (a)(2)(i)
(a)(ii)(2)........... Section I........... (a)(2)(ii)
(a)(ii)(3)........... Section I........... (a)(2)(iii)
(a)(iii)............. Section I........... (a)(3)
(b).................. Section I........... (b)
(b)(i)............... Section I........... (b)(1)
(b)(i)(1)............ Section I........... (b)(1)(i)
(b)(ii).............. Section I........... (b)(1)
(b)(iii)............. Section I........... (b)(1)(ii)
(b)(iv).............. Section I........... (b)(2)
(b)(iv)(1)........... Section I........... (b)(2)(i)
(b)(iv)(2)........... Section I........... (b)(2)(ii)
L25.3............................. (i).................. Section II.......... (b)(1)
(ii)................. Section II.......... (b)(2)(ii)
(iii)................ Section I........... (c)
L25.4............................. Section II, Section ...............................
III
(a).................. Section II, Section (a)
III.
(a)(i)............... Section II, Section (a)(1)
III.
(a)(ii).............. Section II, Section (a)(1)
III.
(a)(iii)............. Section II.......... (a)(2), (a)(3)
Section III......... (a)(2)
(a)(iv).............. Section II.......... (a)(4)
(a)(iv)(a)........... Section II.......... (a)(4)(i)
(a)(iv)(b)........... Section II.......... (a)(4)(ii)
(a)(iv)(c)........... Section II.......... (a)(4)(iii)
(a)(v)............... Section II.......... (a)(3)
Section III......... (a)(2)
(a)(vi).............. Section II.......... (a)(5)
Section III......... (a)(3)
(a)(vii)............. Section I........... (d)
(b).................. Omit ...............................
(b)(i)............... Section II.......... (b)(9)
Section III......... (b)(6)
(b)(i)(1)............ Section II.......... (b)(4)
(b)(i)(1)(a)......... Section II.......... (b)(4)(i)
(b)(i)(1)(b)......... Section II.......... (b)(4)(ii)
(b)(i)(2)............ Section II.......... (b)(6)
(b)(i)(2)............ Section III......... (b)(3)
(b)(i)(3)............ Section II.......... (b)(7)
(b)(i)(3)............ Section III......... (b)(4)
(b)(i)(3)(a)......... Section II.......... (b)(7)(i)
Section III......... (b)(4)(i)
(b)(i)(3)(a)(i)...... Section II.......... (b)(7)(i)(1)
Section III......... (b)(4)(i)(1)
(b)(i)(3)(a)(ii)..... Section II.......... (b)(7)(i)(2)
Section III......... (b)(4)(i)(2)
(b)(i)(3)(a)(iii).... Section II.......... (b)(7)(i)(3)
Section III......... (b)(4)(i)(3)
(b)(i)(3)(a)(iv)..... Section II.......... (b)(7)(i)(4)
Section III......... (b)(4)(i)(4)
(b)(i)(3)(a)(v)...... Section II.......... (b)(7)(i)(5)
Section III......... (b)(4)(i)(5)
(b)(i)(3)(a)(vi)..... Section II.......... (b)(7)(i)(6)
Section III......... (b)(4)(i)(6)
(b)(i)(3)(b)......... Section II.......... (b)(7)(ii)
Section III......... (b)(4)(ii)
(b)(i)(3)(c)......... Section II.......... (b)(7)(iii)
Section III......... (b)(4)(iii)
(b)(i)(3)(d)......... Section II.......... (b)(7)(iv)
Section III......... (b)(4)(iv)
----------------------------------------------------------------------------------------------------------------
[[Page 64740]]
Table 1.--Cross-Reference of ARAC Proposed and New Appendix L Paragraph Numbers--Continued
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------
Original ARAC Proposal New
----------------------------------------------------------
(b)(i)(3)(e)......... Section II.......... (b)(7)(v)
Section III......... (b)(4)(v)
(b)(ii).............. Section II.......... (b)(8)
Section III......... (b)(5)
(b)(ii)(a)........... Section II.......... (b)(8)(i)
Section III......... (b)(5)(i)
(b)(ii)(b)........... Section II.......... (b)(8)(ii)
Section III......... (b)(5)(ii)
(b)(ii)(c)........... Section II.......... (b)(8)(iii)
Section III......... (b)(5)(iii)
(b)(ii)(d)........... Section II.......... (b)(8)(iv)
Section III......... (b)(5)(iv)
(b)(iii)............. Section II.......... (b)(3)
Section III......... (b)(1)
(c).................. Section II, Section (c)
III.
(c)(i)............... Section II, Section (c)(1)
III.
(c)(ii).............. Section II, Section (c)(2)
III.
L25.5............................. Section I........... (e)(4)
----------------------------------------------------------------------------------------------------------------
Table 2.--Cross-Reference of New and ARAC Proposed Appendix L Paragraph Numbers
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------
New Original ARAC Proposal
----------------------------------------------------------
Appendix L........................ Applicability........ L25.1...............
Section I......................... ..................... L25.2...............
(a).................. L25.2............... (a)
(a)(1)............... L25.2............... (a)(i)
(a)(1)(i)............ L25.2............... (a)(i)(1)
(a)(1)(ii)........... L25.2............... (a)(i)(2)
(a)(1)(iii).......... New.................
(a)(2)............... L25.2............... (a)(ii)
(a)(2)(i)............ L25.2............... (a)(ii)1
(a)(2)(ii)........... L25.2............... (a)(ii)(2)
(a)(2)(iii).......... L25.2............... (a)(ii)(3)
(a)(3)............... L25.2............... (a)(iii)
(b).................. L25.2............... (b)
(b)(1)............... L25.2............... (b)(i), (b)(ii)
(b)(1)(i)............ L25.2............... (b)(i)(1)
(b)(1)(ii)........... L25.2............... (b)(iii)
(b)(2)............... L25.2............... (b)(iv)
(b)(2)(i)............ L25.2............... (b)(iv)(1)
(b)(2)(ii)........... L25.2............... (b)(iv)(2)
(b)(3)............... New.................
(c).................. L25.3............... (iii)
(d).................. L25.4............... (a)(vii)
(e).................. New.................
(e)(1)............... New.................
(e)(2)............... New.................
(e)(3)............... New.................
(e)(4)............... L25.5...............
(e)(5)............... New.................
Section II........................ ..................... L25.4...............
(a).................. L25.4............... (a)
(a)(1)............... L25.4............... (a)(i), (a)(ii)
(a)(2)............... L25.4............... (a)(iii)
(a)(3)............... L25.4............... (a)(iii), (a)(v)
(a)(4)............... L25.4............... (a)(iv)
(a)(4)(i)............ L25.4............... (a)(iv)(a)
(a)(4)(ii)........... L25.4............... (a)(iv)(b)
(a)(4)(iii).......... L25.4............... (a)(iv)(c)
(a)(5)............... L25.4............... (a)(vi)
(b)(1)............... L25.3............... (i)
(b)(2)(i)............ New.................
(b)(2)(ii)........... L25.3............... (ii)
(b)(3)............... L25.4............... (b)(iii)
(b)(4)............... L25.4............... (b)(i)(1)
(b)(4)(i)............ L25.4............... (b)(i)(1)(a)
(b)(4)(ii)........... L25.4............... (b)(i)(1)(b)
(b)(5)............... New.................
----------------------------------------------------------------------------------------------------------------
[[Page 64741]]
Table 2.--Cross-Reference of New and ARAC Proposed Appendix L Paragraph Numbers--Continued
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------
New Original ARAC Proposal
----------------------------------------------------------
(b)(6)............... L25.4............... (b)(i)(2)
(b)(7)............... L25.4............... (b)(i)(3)
(b)(7)(i)............ L25.4............... (b)(i)(3)(a)
(b)(7)(i)(1)......... L25.4............... (b)(i)(3)(a)(i)
(b)(7)(i)(2)......... L25.4............... (b)(i)(3)(a)(ii)
(b)(7)(i)(3)......... L25.4............... (b)(i)(3)(a)(iii)
(b)(7)(i)(4)......... L25.4............... (b)(i)(3)(a)(iv)
(b)(7)(i)(5)......... L25.4............... (b)(i)(3)(a)(v)
(b)(7)(i)(6)......... L25.4............... (b)(i)(3)(a)(vi)
(b)(7)(ii)........... L25.4............... (b)(i)(3)(b)
(b)(7)(iii).......... L25.4............... (b)(i)(3)(c)
(b)(7)(iv)........... L25.4............... (b)(i)(3)(d)
(b)(7)(v)............ L25.4............... (b)(i)(3)(e)
(b)(8)............... L25.4............... (b)(ii)
(b)(8)(i)............ L25.4............... (b)(ii)(a)
(b)(8)(ii)........... L25.4............... (b)(ii)(b)
(b)(8)(iii).......... L25.4............... (b)(ii)(c)
(b)(8)(iv)........... L25.4............... (b)(ii)(d)
(b)(9)............... L25.4............... (b)(i)
(c).................. L25.4............... (c)
(c)(1)............... L25.4............... (c)(i)
(c)(2)............... L25.4............... (c)(ii)
Section III....................... ..................... L25.4...............
(a).................. L25.4............... (a)
(a)(1)............... L25.4............... (a)(i), (a)(ii)
(a)(2)............... L25.4............... (a)(iii), (a)(v)
(a)(3)............... L25.4............... (a)(vi)
(b)(1)............... L25.4............... (b)(iii)
(b)(2)............... New.................
(b)(3)............... L25.4............... (b)(i)(2)
(b)(4)............... L25.4............... (b)(i)(3)
(b)(4)(i)............ L25.4............... (b)(i)(3)(a)
(b)(4)(i)(1)......... L25.4............... (b)(i)(3)(a)(i)
(b)(4)(i)(2)......... L25.4............... (b)(i)(3)(a)(ii)
(b)(4)(i)(3)......... L25.4............... (b)(i)(3)(a)(iii)
(b)(4)(i)(4)......... L25.4............... (b)(i)(3)(a)(iv)
(b)(4)(i)(5)......... L25.4............... (b)(i)(3)(a)(v)
(b)(4)(i)(6)......... L25.4............... (b)(i)(3)(a)(vi)
(b)(4)(ii)........... L25.4............... (b)(i)(3)(b)
(b)(4)(iii).......... L25.4............... (b)(i)(3)(c)
(b)(4)(iv)........... L25.4............... (b)(i)(3)(d)
(b)(4)(v)............ L25.4............... (b)(i)(3)(e)
(b)(5)............... L25.4............... (b)(ii)
(b)(5)(i)............ L25.4............... (b)(ii)(a)
(b)(5)(ii)........... L25.4............... (b)(ii)(b)
(b)(5)(iii).......... L25.4............... (b)(ii)(c)
(b)(5)(iv)........... L25.4............... (b)(ii)(d)
(b)(6)............... L25.4............... (b)(i)
(c).................. L25.4............... (c)
(c)(1)............... L25.4............... (c)(i)
(c)(2)............... L25.4............... (c)(ii)
----------------------------------------------------------------------------------------------------------------
We discuss each paragraph of the proposed new Appendix L below.
Section I--Design Requirements
I(a) Airplane Systems
I(a)(1) Operation in Icing Conditions
I(a)(1)(i)
ETOPS airplanes would have to comply with the requirements of
section 25.1419 for operation in icing conditions.
Explanation
Section 25.1419 sets out the requirements for certifying a
transport category airplane for flight into icing conditions. This
requirement is optional in that an applicant may choose to not apply
for approval in icing conditions. However, from a practical standpoint
no one would request certification of an airplane that did not meet
this requirement. This proposed new regulation makes this approval
mandatory for ETOPS approval.
I(a)(1)(ii)
The airframe and propulsion system ice protection would have to be
capable of continued safe flight and landing at engine-inoperative and
decompression altitudes in icing conditions. Following the loss of an
engine at cruising altitude, an airplane will drift down to a lower
(engine-inoperative) altitude. A decompression altitude is an altitude
to which an airplane must descend following the loss of cabin pressure.
Decompression altitudes are 10,000 feet MSL and below.
Explanation
This paragraph would codify AC 120-42A, paragraph 8(b)(11) for
airframe ice protection. The applicant would have to demonstrate that
the airplane is capable of continued safe flight and landing at
[[Page 64742]]
the decompression altitudes. This rule would require the applicant to
demonstrate to the FAA that the anti-icing systems on the airplane will
assure the airplane's capability to continue to operate during a worst-
case diversion. The ARAC Working Group recommended a standard that
would require the capability to safely divert if anti-icing cannot be
shown available for all scenarios. This recommended standard tacitly
assumes that airplane ice protection is not necessarily required during
an ETOPS diversion. We disagree with this recommendation. Paragraph
8(b)(11) of AC 120-42A says that the airframe and propulsion ice
protection should be shown to provide adequate capability for the
intended operation. The AC says that this should account for prolonged
exposure to lower altitudes associated with the engine-out diversion,
cruise, holding, approach and landing. We do not interpret this
paragraph as allowing circumstances where anti-icing would not normally
be available during an ETOPS diversion. An applicant would have to
address any failure conditions where the ice-protection systems would
not be available during an ETOPS diversion as part of the safety
analysis required by section 25.1309.
The preamble justification provided in the ARAC proposal stated
that this rule ``will also require the applicant to demonstrate that
the non-heated (or ``non-deiced'') areas of the airplane will not pick
up a load of ice that would make the airplane uncontrollable or create
too much drag to complete the diversion.'' This statement is consistent
with how the FAA has applied the criteria of AC 120-42A paragraph
8.(b)(11) for all airplanes certified using that policy. However, the
ARAC recommendation did not include this specific provision. We have
added this requirement into the proposed rule as a new paragraph
I(a)(1)(iii). It is consistent with ARAC's recommendation and
consistent with what has been standard ETOPS type certification
practice to consider the accumulation of ice on the non-heated or non-
deiced areas of the airplane.
The associated advisory material for this proposed requirement will
describe the conditions and assumptions that an applicant may use in
simulating a diversion icing environment for showing compliance with
the proposed rule. The advisory material will also provide guidance for
developing analyses or testing that would justify not having to assume
that the entire diversion would be in icing conditions.
I(a)(2) Electrical Power Supply
I(a)(2)(i) and (ii)
These paragraphs would establish reliability requirements for the
electrical power supply system on an ETOPS flight.
Explanation
Paragraphs I(a)(2)(i) and (ii) are basically a restatement of
section 25.1309 for the electrical power supply system in consideration
of the ETOPS mission. We agree with the ARAC's apparent intent that
these paragraphs, in conjunction with the new sections 25.1535(a) and
(b), codify paragraphs 8(b)(1), 8(b)(6), 8(b)(7) and 8(c)(4) of AC 120-
42A for the electrically powered ETOPS significant systems. These
paragraphs establish the overall system safety objectives for these
systems in extended operations.
The proposed rule is not as explicit as AC 120-42A in stating the
types of functions that an applicant would need to consider in applying
the safety objectives of section 25.1309 for an ETOPS mission. The
general philosophy of the proposed rule is to let the existing policy
associated with section 25.1309 compliance determine the design
analysis for ETOPS. This philosophy is consistent with paragraph (c)(1)
of the Boeing Model 777 ETOPS special conditions, which requires the
applicant to comply with part 25 with regards to the ETOPS mission.
Although we discuss this regulatory philosophy here in reference to the
specific electrical power supply system requirements, it also applies
to other ETOPS significant systems that are not specifically addressed
in the proposed rule.
The FAA's intent for paragraphs I(a)(2)(i) and (ii) is to assure
that the applicant properly focuses on electrical power redundancy and
reliability when considering ETOPS mission scenarios in showing
compliance with section 25.1309. On a two-engine airplane, the
potential lack of redundancy available for electrical power generation
makes this requirement especially important. However, the new emphasis
is in paragraph (ii). It will be up to the applicant to demonstrate
which functions would reduce the capability of the airplane or the
ability of the crew to cope with adverse operating conditions. It is
not realistic, for instance, for an applicant to state that operating
for an extended period of time on suction feed would not reduce the
capability of the airplane to cope with adverse operating conditions
(for example, negative g or turbulence). Additionally, the applicant
would have to determine what navigation and communication systems must
be powered by emergency generation sources during a worst case ETOPS
diversion.
I(a)(2)(iii)
This paragraph would require at least three independent electrical
generation sources for airplanes being certified for greater than 180
minutes.
Explanation
Paragraph I(a)(2)(iii) would codify the three generator requirement
of paragraph 8.(b)(8) in AC 120-42A. However, the ARAC recommendation
only applies this requirement to airplanes being certified for greater
than 180-minute ETOPS. The AC specifies three generators for any ETOPS
approval. This specific requirement created much discussion within the
ARAC ETOPS Working Group. Paragraph I(a)(2)(iii) as proposed in this
notice represents the compromise position that allowed working group
consensus. The following paragraphs are the ARAC's recommended
justification for this requirement. The FAA is publishing them without
comment.
This topic is inextricably linked to the discussion about MMELs.
The MMEL or Master Minimum Equipment List allows an airplane operator
to fly without equipment not on this fully functioning. There is
concern that without a specific number of generators required in the
rule, the MMEL could strip away some of the redundancy required for
long-range flight. The arguments against a prescriptive number are
generally as follows:
(1) Defining a number of generators would not assure proper system
reliability (for example, is it better to have three generators with a
Mean Time Between Failures (MTBF) of 20,000 hours each, or four
generators with an MTBF of 3,000 each?)
(2) Defining a number of generators would either artificially
constrain or give a ``pass'' to future airplane designs. For instance,
if a new airplane had a system architectural need for 8 generating
systems, requiring three in the ETOPS rule would not assure an
adequately safe design.
(3) Trying to address the formation of the MMEL in part 25 is
impractical and inconsistent with agreed-to policies for MMEL
development.
``Nonetheless, it was agreed that there should be a tie-in between
the analysis performed for Part 25 ETOPS approval and the analysis the
Flight Operations Evaluation Review Board (FOEB), who develop the MMEL,
used in determining dispatch criteria. This is almost always the case
in today's process, but
[[Page 64743]]
formalizing the process would be a positive step.
``Therefore, an additional paragraph has been added to the ETOPS
regulation to require a minimum number of electrical generators. This
requirement codifies the existing AC 120-42A electrical generator
redundancy criteria. The intent of this requirement is to ensure future
airplanes to be certified for ETOPS have an electrical generation
system architecture equivalent to the 737, 757, 767, 777 and A310, 320,
A330 era airplanes. Future airplane electrical system architectures may
be significantly different from today's airplanes, but the architecture
must be equivalent from the perspective of robustness to independent
failure scenarios.''
I(a)(3) Time Limited Systems
This paragraph would require that the applicant state the
capability of most time limiting ETOPS significant system in the
airplane flight manual.
Explanation
As stated previously for the revised paragraph 25.857(c)(2), this
requirement would provide the information that the operators would need
to comply with the applicable operating requirements. Advisory Circular
120-42A has two main categories of ETOPS approval (120 minutes and 180
minutes) based on demonstrated propulsion system reliability. The ETOPS
approval, as stated in the airplane flight manual in currently approved
ETOPS airplanes, identifies the maximum approved diversion time based
as one of these two times. In order to qualify for the ETOPS type
design approval, the applicant must design the airplane time-limited
systems to support this maximum approved diversion time with an
additional 15 minutes capability to allow for airplane holding,
approach and landing.
In the context of proposed paragraph I(a)(3), we do not consider
the propulsion system as a time-limited ETOPS significant system.
Proposed Appendix L, section II(a), codifies the service experience
method for ETOPS approval from AC 120-42A. Paragraph II(a)(4) of this
section defines the required world fleet in-flight shutdown rate with
each level of ETOPS operational approval. In this particular case, the
level of ETOPS approval refers to the operational approval authority
defined in the operating rules, not the time-limited system capability
required in paragraph I(a)(3).
I(b) Propulsion System
I(b)(1) Fuel System Design
This paragraph would require design features to ensure that fuel
necessary to complete an ETOPS mission will be available at the flow
and pressure required for the engine, during a diversion for the
longest time being approved for the airplane. The proposed rule
includes a requirement for alerts to the crew when the fuel available
to the engines falls below the level required to complete the mission
which can occur because of fuel mismanagement, abnormal transfer
between tanks, and fuel loss.
Explanation
Fuel system design and the ability of the crew to properly deal
with fuel system malfunctions are arguably the most important issues
facing the designer of ETOPS airplanes. The proposed rule (with
corresponding AC guidance) addresses the need for:
(1) Positive fuel pressure at the engine fuel pump (no suction
feed);
(2) Fuel availability following system failures (no hidden/trapped
fuel, functional crossfeed valves, etc.); and
(3) Flight deck alerts when fuel available to the engines falls
below the level required to complete the mission.
The proposed requirements would codify the intent of paragraph
8.(b)(2)(iii) of AC 120-42A, paragraph (c)(3)(i)(C) of the Boeing 777
ETOPS special conditions, and items 7 and 8 of the type design
provisions of the 207 minute ETOPS Policy Letter EPL 20-1.
There has been some discussion regarding newer generation airplanes
(B777) and their system architecture being the standard by which
operations beyond 180 minutes will be judged. Currently, all transport
category aircraft are required to perform suction feed testing as part
of basic part 25 certification, which requires the applicant to
simulate an all Alternating Current (AC) power loss at the highest
altitude the airplane is used in service (``service ceiling''). The
testing is performed to demonstrate that in the event of an all AC
power loss, there is still ability (at some safe altitude) to re-start
the engines after flameout on suction feed and generate thrust to a
safe landing. This demonstration does not, however, provide any
assurance that the engines can operate on suction feed for the long
duration diversion times envisioned for ETOPS. The engines are
certified with a minimum engine fuel pump inlet pressure limit of
typically one-half pound per square inch (0.5 psi) above the ambient
air pressure, or the fuel vapor pressure, whichever is higher. Section
25.955 requires that the airplane fuel system deliver fuel to the
engine at this minimum pressure for the maximum fuel flow required by
the engine. Without the fuel boost pressure, airplanes cannot comply
with Sec. 25.955. The fuel system design requirements proposed in this
notice are intended to ensure that continued operation on suction feed
is not a practical possibility on ETOPS airplanes. Paragraph I(b)(1)
would be applicable to all ETOPS airplanes irrespective of the number
of engines.
Loss of normal electrical power to the boost pumps is the primary
cause of the loss of fuel system boost pressure. A specific fuel feed
capability requirement has been added for twin-engine ETOPS operations
beyond 180 minutes that is intended to address the concerns about loss
of fuel boost pressure raised in the development of the 207 minute
ETOPS policy. The 207-minute policy included a provision to also
address fuel cross-feed capability following the failure of normal
electrical power. Proposed paragraph I(b)(1)(i) would require that the
applicant design the airplane fuel system with a fuel boost pump in
each main tank and the capability to operate at least one crossfeed
valve by a back-up electrical generation source other than the primary
engine driven or APU driven generators. There is an exception in the
proposed rule for fuel system designs for situations when electrical
power does not provide required fuel boost pressure or crossfeed valve
actuation. Although this is a specific design requirement applicable to
two engine airplanes for ETOPS beyond 180 minutes, the overall design
objective underlying paragraph I(b)(1) is applicable to all ETOPS
airplanes. The applicant may use the same design features required by
paragraph I(b)(1)(i) as part of their compliance with paragraph I(b)(1)
for airplanes not specifically covered by this subparagraph.
The other possible source of the loss of fuel boost pressure is
mechanical failure of fuel system components. These include pump
failures or performance degradation, valve failures, and plumbing
failures causing internal or external fuel leaks that result in
significant fuel pressure loss. Possible design alternatives to address
mechanical failures as a source of loss of fuel system boost pressure
are:
1. Redundancy (additional boost pumps, cross-feed valves, etc.)
2. Improved component reliability (including any instructions for
continued airworthiness necessary to maintain that level of
reliability)
[[Page 64744]]
3. Enlarged main fuel tank capacity (to minimize the effect of loss
of boost pressure in other fuel tanks)
4. A time-limited engine fuel inlet pressure limit at which the
engine can demonstrate acceptable operation and integrity for the
longest diversion time for which the airplane manufacturer is
requesting approval.
Each of these design alternatives has advantages and disadvantages
that the manufacturer would need to consider in designing an airplane
to comply with the proposed rule.
We intend that the proposed paragraph I(b)(1) would preclude all
causes of loss of system boost pressure in extended operations. This is
consistent with the overall safety objectives established by the part
25 airworthiness standards for potentially catastrophic failure
conditions.
Proposed paragraph I(b)(1)(ii) would require flight deck alerts
when the fuel available to the engines falls below that required to
complete the mission. The FAA's intent is that the required flight deck
alerts would give flight crews clear warning of impending fuel
exhaustion with enough time to safely land the airplane before the
condition becomes critical. As a minimum, the manufacturer would have
to design the flight deck alerts to address the types of failures or
human errors that have resulted in airline fuel exhaustion events in
service.
Examples of fuel exhaustion events include an Air Canada Boeing 767
that landed on an abandoned runway after both engines flamed out from
fuel exhaustion. In this case, the normal low fuel alerts did not
function because of a fuel quantity indication system failure. The fuel
exhaustion was caused by the crew not receiving a low fuel alert, in
combination with an unapproved airplane dispatch and a fueling error.
An Air Tran Airbus A330 landed in the Azores following flameout of both
engines caused by fuel exhaustion due to an unrecognized engine fuel
leak. The AC provides guidance on critical fuel system alerts derived
from these types of fuel loss events that have occurred in the current
generation of aircraft.
I(b)(2) APU design
If operation of an auxiliary power unit (APU) were needed to comply
with the ETOPS requirements, the applicant would have to demonstrate
that the APU has adequate reliability for that operation. Also, if in-
flight start and run capability is necessary, the APU in-flight
operating envelope would have to extend to the maximum operating
altitude of the airplane or 45,000 feet, whichever is lower.
Explanation
The electrical system reliability standard contained in AC 120-42A
envisions three independent alternating current (AC) electrical
generators. Besides the two engine driven generators, an auxiliary
power unit (APU) could drive a third generator to meet this standard.
Auxiliary power units are separately controlled small engines that are
installed on an aircraft to power services when the main aircraft
engines are not running. Airlines normally use an airplane APU at the
gate to provide electrical power for onboard lighting and an air source
for the air conditioning system between flights. Besides this normal
function, the FAA may allow an airline to use an APU powered electrical
generator during a revenue flight when a main engine generator is not
working.
The electrical system reliability requirements proposed in this
notice do not specifically require three independent generators except
for airplanes being certified for ETOPS diversion times greater than
180 minutes. Current two engine aircraft that the FAA has approved for
ETOPS would only be able to comply with the proposed requirement for
electrical system reliability by having three independent generators.
Other required aircraft system functions also may be powered by an APU.
Proposed paragraph I(b)(2) of the rule would require that if the
applicant is going to rely on the APU for compliance with the ETOPS
requirements:
(1) The APU has to have adequate reliability; and
(2) If it must be started and run in-flight, the APU must
demonstrate that it has the capability to start and perform its
intended function up to the maximum operating altitude of the airplane,
or 45,000 feet, whichever is lower.
The major reason for wanting high altitude APU in-flight start
capability is to avoid having flight level changes that would cause the
flight to have to cross through established flight track systems just
to start the APU. Also, once the flight leaves the established track
system it can be very difficult, or impossible to re-enter the track
system, reducing the pilot's flexibility to fly the optimum flight
plan. Having an in-flight start capability up to 45,000 feet mitigates
these concerns.
``Adequate'' reliability consumed much of the Working Group's
discussion time during development of the rule. This term can only be
placed in context by understanding the overall electrical and pneumatic
system architecture of the airplane. For instance, if an applicant has
installed generators with inadequate reliability, their mean time
between failure (MTBF) may require an extremely reliable APU generator
in order to comply with the electrical system reliability objectives of
Sec. 25.1309. This would drive the applicant into a significant APU
reliability demonstration program. The reverse could also be true. An
electrical system may have generators with an excellent MTBF of 100,000
hours with additional non-APU back-up sources. In this case, the
``required'' reliability of the APU would be less than for current
airplane electrical systems with APU driven generators. However, the
applicant would have to present a convincing system level reliability
analysis backed by validated component reliability data before the FAA
would accept an assumption of lower APU reliability from that required
for today's airplanes.
An APU has traditionally been used only to ``back-up'' the
electrical system, and the proposed new regulatory and advisory
material focuses on this function. No current aircraft utilizes an APU
to provide ``back-up'' pneumatic system capability to meet ETOPS
significant system reliability standards. However, the associated
advisory circular addresses the possible operational need for APU
pneumatics on the ground to power the cabin air conditioning system
following an airplane diversion. If the APU is necessary as a bleed
source to comply with section 25.1309 or the new section 25.1535, the
applicant would have to define the operating envelope of where it can
perform this intended function. The FAA requires this for any APU
required function under the existing airworthiness standards of part
25. Currently most APUs can only provide both bleed air and electrical
power at lower cruise altitudes, and cannot provide enough bleed air to
power an air conditioning pack at the airplane service ceiling. The
applicant would have to fully account for the use of a ``limited''
ETOPS APU operating envelope in substantiating compliance with section
25.1309 or section 25.1535. In accounting for a limited APU operating
envelope, the applicant would have to address the operational
implications, including air traffic control, of having to descend to a
lower altitude in order to use the required APU function.
ARAC recommended the following language for paragraph I(b)(2): ``If
operation of the APU installation is required to comply with this
appendix, the applicant must * * *''. Except for
[[Page 64745]]
the electrical system, which has specific requirements in proposed
Appendix L, all other potential airplane system functions that could be
powered by an APU are addressed by the overall ETOPS requirement
contained in section 25.1535(a). Examples include the cabin
pressurization and hydraulic systems, which may be powered by an APU.
The ARAC recommended proposed rule and preamble states the intent that
this requirement should not be limited to just electrical system
reliability. We have corrected this oversight by replacing ``this
appendix'' with section 25.1535 in proposed paragraph I(b)(2).
I(b)(3) Engine Oil Tank Design
The engine oil filler cap design would have to comply with a
proposed change to section 33.71(c)(4), which will require oil tank cap
designs that prevent hazardous oil loss in the event of an oil tank cap
installation error.
Explanation
See the proposed change to section 33.71(c)(4) for an explanation
of the reasons for this change. We added paragraph I(b)(3) to Appendix
L to ensure that engines installed on ETOPS airplanes comply with the
part 33 requirement.
I(c) Engine Condition Monitoring
The applicant would have to define and validate, as required, an
engine condition monitoring process in accordance with part 33,
Appendix A, paragraph A33.4.
Explanation
This requirement would codify paragraph a(5) of Appendix A of AC
120-42A and paragraph (b)(2) of the Boeing Model 777 ETOPS special
conditions.
With the propulsion system reliabilities existing on today's long
range airplanes, the FAA is very concerned that the biggest threat to
ETOPS safety is the risk associated with common cause, cascading
failures and fuel exhaustion. Several of the proposed requirements in
this notice would address these threats. The engine condition
monitoring process requirement specifically addresses the potential of
additional engine failure or failures resulting from the increased
thrust or service demands on the remaining engine or engines.
Operators would be required, in the proposed changes to parts 121
and 135, to have an engine condition monitoring program as part of
their ETOPS maintenance program. Paragraph I(c) of Appendix L and
paragraph A33.4 in part 33 would require the airplane and engine
manufacturer to provide the instructions necessary for an operator to
develop this program.
Since the potential for a catastrophic loss of thrust is greater on
a two engine airplane than on airplanes with more than two engines,
this proposed rule would require that the applicant validate the engine
condition monitoring process for use on two engine airplanes before
ETOPS approval. For airplanes with more than two engines, the applicant
would need only to define the process.
I(d) Configuration, Maintenance and Procedures
The applicant would have to identify configuration, maintenance, or
operational standards necessary to maintain appropriate reliability or
to obtain required capability for ETOPS in a Configuration,
Maintenance, and Procedures (CMP) document.
Explanation
Paragraph I(d) of the proposed rule would codify material AC 120-
42A. All existing policy on revising CMP documents would remain in
force under the new rule. This is discussed more fully previously under
general issues in the general discussion of the proposal.
I(e) Airplane Flight Manual
This paragraph would specify certain information that the airplane
flight manual (AFM) must contain for ETOPS approval.
Explanation
This proposed requirement would codify paragraph 8(f)(1) of AC 120-
42A. ARAC did not include this paragraph in their proposed rule draft.
However, there are provisions within the AC paragraph that the FAA has
required in all ETOPS type design approvals issued since 1985. The
ETOPS approval statement contained in AC subparagraph 8(f)(1)(vi) is
particularly important as applicants have based their airplane flight
manual ETOPS approval statements on this wording. We are proposing to
add the relevant provisions from AC paragraph 8(f)(1) into this notice
in order to maintain continuity with the historical AFM ETOPS
requirements.
The two provisions from AC 120-42A that we are not proposing to
incorporate directly into proposed paragraph I(e) are subparagraphs
8(f)(1)(iii) and (v). Subparagraph 8(f)(1)(iii) addresses inclusion of
the performance data used to comply with the engine-inoperative
diversion criteria of the flight dispatch considerations in the
operational approval section of the advisory circular. Contrary to this
advisory circular provision, the FAA has not required that the
performance data be included in the approved parts of the AFM and have
not included this provision in the proposed rule. Subparagraph
8(f)(1)(v) asks for a description or reference to a document containing
the approved airplane configuration CMP standard. The CMP document
identification has traditionally been included in the ETOPS approval
statement defined in subparagraph 8(f)(1)(vi) for ETOPS airplanes
approved under the existing policy. Therefore, we have combined
subparagraphs 8(f)(1)(v) and 8(f)(1)(vi) from the AC into the new
proposed paragraph I(e)(5).
We are also proposing to add the original AFM requirement from the
ARAC proposal into paragraph I(e)(4). This proposed requirement is not
in AC 120-42A. This proposed paragraph would require the applicant to
define the maximum ETOPS diversion time capability required by
paragraph I(a)(3) into the airplane flight manual in accordance with
Sec. 25.1581(a)(2), ``Furnishing Information.'' This proposed
requirement provides a cross-reference to proposed paragraph I(a)(3),
which would require that the ETOPS capability defined by most limiting
ETOPS significant system capability be stated in the airplane flight
manual.
Section II--Two Engine Airplanes
In addition to the requirements of section I, an applicant for a
two engine airplane would have to also show compliance with one of
three proposed requirements of section II.
II(a) Service Experience Method
The applicant would have to demonstrate that the airplane and
engine combination for which approval is sought has the required
airplane and propulsion system capability to safely conduct an ETOPS
mission with the maximum diversion for which approval is sought, and
has achieved required airframe and propulsion system reliability based
upon fleet in-service experience.
Explanation
Proposed sub-section II(a) would codify part of the existing
approval process based on service experience, as contained in AC 120-
42A for two engine airplanes. This includes the most significant aspect
of this process, the propulsion system assessment contained in Appendix
1 of the advisory circular. The AC process is predicated on having a
sufficient amount of service
[[Page 64746]]
experience to give the FAA enough data to assess the overall
suitability of a two-engine airplane for ETOPS approval.
The AC type design assessment criteria are divided into two parts.
The first part defines specific system design capability and safety
objectives in order to provide a minimum design standard for airplanes
operating in ETOPS. This part of the AC criteria is addressed in
proposed section 25.1535(a) and (b), and section I of proposed part 25
appendix L.
The second part of the AC process is a review of in-service
problems and identification of appropriate corrective actions to
prevent problems that could have an adverse effect on ETOPS safety.
Part of this review is to establish that the airplane and propulsion
systems have an appropriate level of reliability to meet the safety
objectives defined in the AC. Appendix 1 of the AC defines an amount of
service experience that would normally be required in order to give a
sufficient database to evaluate propulsion system reliability. We are
proposing to address this second part of the AC type design assessment
process in sub-section II(b) of this notice.
II(a)(1) Required Service Experience
This paragraph would require that an applicant who desires to
obtain ETOPS type design approval using service experience conduct a
reliability review after accumulating 250,000 worldwide fleet engine
hours on the airplane and engine combination for which approval is
being sought. The number of hours could be reduced if adequate
compensating factors are identified which give a reasonable equivalent
database. A significant portion of the 250,000 engine hours would have
to be obtained on the candidate airplane.
Explanation
Proposed paragraph II(a)(1) would codify the service experience
eligibility criteria from paragraph a(1) of Appendix 1 of AC 120-42A.
II(a)(2) Propulsion System Assessment
Paragraph II(a)(2)(i) would require an applicant to conduct a
propulsion system assessment based on data collected from the entire
fleet of the specific airplane and engine combination for which
approval is sought. Paragraph II(a)(2)(ii) would require an applicant
to identify corrective actions to prevent future occurrences of engine
in-flight shutdowns or loss of thrust control.
Explanation
Paragraph II(a)(2)(i) would codify the reliability data base
criteria from paragraph b. of Appendix 1 of AC 120-42A. ARAC did not
include the reliability data base criteria in their proposed rule
draft, but did have it in their associated draft advisory material. In
paragraph 10(a)(iii) of the draft part 25 advisory circular, ARAC
stated ``A propulsion system assessment must be based on the following
data, collected from the entire fleet of the specific airplane/engine
combination type for which approval is sought* * *''. Since ARAC
clearly stated its intent that an applicant ``must'' conduct a
propulsion system assessment on the specific list that follows, and
based on the clear reference to the existing policy from Appendix 1 of
AC 120-42A, we have incorporated this section from the ARAC draft
advisory circular into proposed paragraph II(a)(2)(i) of this notice.
Paragraph II(a)(2)(ii) would codify the intent of the propulsion
system assessment criteria from paragraph 3 of Appendix 1 of AC 120-
42A. This is the so-called ``fix-all-problems'' requirement that has
been the practice for all ETOPS type design approvals that the FAA has
given using the service experience approval process defined in AC 120-
42A.
The corrective actions that the applicant identifies in compliance
with proposed paragraph II(a)(2) would be included in the approved
configuration, maintenance, and procedures (CMP) document as a
condition of the ETOPS approval.
II(a)(3) Airplane systems assessment
The applicant would have to show compliance with section 25.1535(a)
using available in-service reliability data for ETOPS significant
systems. The applicant would have to identify corrective actions to
prevent future occurrences of ETOPS significant system failures
occurring in service.
Explanation
The first part of this paragraph would codify the intent of
paragraph 8(c)(1) of AC 120-42A for those ETOPS significant airplane
systems addressed in proposed Sec. 25.1535(a). This AC paragraph
states that the analysis and demonstration of airframe and propulsion
system failure effects and reliability provided by the applicant should
be based on in-service experience and the longest diversion time for
the airplane.
The second part of proposed paragraph II(a)(3) is an extension of
the ``fix-all-problems'' approach used in the propulsion system
assessment that we are proposing in paragraph II(a)(2). For all
airplanes approved using the policy contained in AC 120-42A, the FAA
has required an applicant to define effective corrective actions for
all in-service problems known to result in, or potentially result in,
airplane diversions. The FAA has required this in order to enter ETOPS
service with the highest quality airplane. An applicant rarely
considers known system failure conditions to be acceptable occurrences
in service that they account for in their system failure analyses
submitted for compliance with section 25.1309. Therefore, this fix all
problems approach is appropriate in reassessing compliance with the
applicable airworthiness requirements of proposed section 25.1535(a).
The corrective actions that the applicant identifies in compliance
with proposed paragraph II(a)(3) would be included in the approved
configuration, maintenance, and procedures (CMP) document as a
condition of the ETOPS approval.
II(a)(4) In-Flight Shutdown (IFSD) Rates
This proposed paragraph defines propulsion system reliability
standards for three levels of ETOPS type design approval.
(i) For operations up to 120 minutes: a rate of approximately 0.05
or less per 1,000 fleet engine hours with a CMP intended to bring the
rate down to 0.02.
(ii) For operations up to 180 minutes: a rate of approximately 0.02
or less per 1,000 engine hours with an existing 120 minute CMP
standard, or new or additional CMP requirements that have been
demonstrated to achieve this in-flight shutdown rate.
(iii) For operations greater than 180 minutes: a rate of
approximately 0.01 or less per 1,000 engine hours with an existing 120
minute or 180 minute CMP standard, or new or additional CMP
requirements that have been demonstrated to achieve this in-flight
shutdown rate.
Explanation
This proposed paragraph would codify the propulsion system
reliability standards from Appendix 1 of AC 120-42A. In addition, we
are proposing to add the reliability standard of 0.01 per 1,000 engine
hours for ETOPS greater than 180 minutes that ARAC proposed in their
recommended draft ETOPS rule.
The original ARAC recommendation refers to ``target threshold'' or
``target'' rate. These terms do not adequately define what would
constitute an acceptable or unacceptable in-flight shutdown rate for
showing compliance with this proposed requirement. The FAA has similar
concerns about the term ``approximately'' as used in this
[[Page 64747]]
proposal, but this term is in the existing AC 120-42A policy and has
been applied successfully since issuance of the AC. Therefore, the FAA
has tentatively chosen to retain the term ``approximately'' as used in
the existing AC policy in this proposed rule.
We have added the qualifier ``or less'' to the proposed in-flight
shutdown rate requirement. Without this term, the rule could be
interpreted to mean that the in-flight shutdown rate ``must'' be the
approximate value specified. We clearly do not intend that an applicant
with an in-flight shutdown rate well below the requirement would not be
in compliance with the rule. We have added this additional qualifier in
order to clarify this intent.
The original ARAC recommendation for operations up to 120 minutes
was written in the following manner: ``with a required list of
corrective actions that would result in continuing improvement toward
an IFSD rate of 0.02 per 1000 fleet engine-hours.'' We have added ``in
the CMP document'' in order to clarify where the list of corrective
actions must be contained.
For the proposed requirements for both operations up to 180 minutes
and operations greater than 180 minutes we have added a provision that
considers the effect that existing or new CMP standards have on
compliance with the required in-flight shutdown rate. In the past, we
granted ETOPS approvals using a 180-minute CMP standard developed from
the 120 minute ETOPS CMP documents. This has occurred when the
applicant has substantiated, through service experience, additional
requirements that would achieve the desired in-flight shutdown rate for
those airplanes incorporating the additional requirements. The added
provision proposed in this notice is a statement of existing practice
for granting 180-minute ETOPS approval where the 120-minute standard
had to be modified. This notice proposes to codify this existing
practice into the rule as noted above.
II(a)(5) Airplane Flight Test Requirements
This paragraph would require a flight test to validate the adequacy
of the airplane's flying qualities, performance, and the flight crew's
ability to deal with engine inoperative and non-normal worst case
system failure conditions expected to occur in service.
Explanation
This paragraph would codify the intent of paragraph 8(d)(3) of AC
120-42A. The original ARAC proposed paragraph stated that the proposed
flight test would validate ``non-normal worst case probable system
failure conditions.'' This proposed wording would not adequately
reflect how the FAA has applied the AC paragraph being codified.
The term ``probable'' as used in the original ARAC proposal would
have a specific meaning within the type certification community. As
defined by Advisory Circular 25.1309-1A, probable failures are those
anticipated to occur one or more times during the entire operational
life of each airplane. Probable failures would most likely only include
significant single failures, or more frequent double failures. However,
we have required applicants for ETOPS type design approval under AC
paragraph 8(d)(3) to demonstrate multiple failure conditions that are
much less frequent in service, such as
(i) the loss of all normal electrical power;
(ii) flight controls powered by an emergency backup hydraulic
source; and
(iii) loss of normal flight instruments.
These types of failure conditions would be expected to occur during
the life of a fleet of airplanes, but not necessarily on each airplane.
We believe that ARAC may have intended to include these failure
conditions by using the qualifying term ``worst case'' in their
proposal, however, we are not confident that it would be interpreted
correctly with the wording as ARAC proposed. We have deleted the word
``probable'' and replaced it with system failure conditions ``expected
to occur in service'' in the proposed rule. This clarification more
accurately reflects how the FAA has applied the paragraph 8(d)(3) of AC
120-42A.
II(b) Early ETOPS Method
This part of section II defines requirements that an applicant
would have to comply with to certify an airplane for ETOPS without
first accumulating the service experience that would be required in
section II(a).
Explanation
This section would codify the early ETOPS process defined in the
Boeing Model 777 ETOPS special conditions 25-ANM-84 for two engine
airplanes. These special conditions defined requirements that allowed
the FAA to approve the Boeing Model 777 airplane for ETOPS without the
service experience normally expected under the policy in AC 120-42A.
The intent of this proposed sub-section of Appendix L is to define
requirements that would allow the FAA to grant ETOPS approval
concurrent with the original type certification of an airplane.
II(b)(1) Relevant Experience Assessment
The applicant would have to identify specific corrective actions
taken on the airplane design to address relevant design, manufacturing,
operational and maintenance problems experienced on previously
certified part 25 airplanes manufactured by the applicant. Specific
corrective actions would not be required if the nature of the problem
is such that it would not have a significant impact on the safety or
reliability of the system. The proposed rule would require that this
assessment include the relevant experience of supplier provided ETOPS
Group 1 significant systems and similar or identical equipment utilized
on aircraft built by other manufacturers.
Explanation
This proposed rule would codify paragraph (c)(2) of the Boeing
Model 777 ETOPS special conditions 25-ANM-84. The term ``relevant
experience'' as used in the proposed rule means the design,
manufacturing, operational or maintenance problems that have, or could
have, resulted in the types of occurrences that would be included in
propulsion system and airplane system assessments conducted in
accordance with a service experience based ETOPS approval process
proposed in section II(a).
The intent of this proposed requirement is to take advantage of
service experience on other airplane types built by the applicant as
much as is practical. This relevant experience assessment is in lieu of
service experience on the actual airplane to be approved and is a major
compensating factor for that direct service experience.
One of the five key elements of the early ETOPS process on the
Boeing Model 777 was the ``relevant experience assessment,'' or
``lessons learned.'' Simply stated, the intent is for the applicant to
review the failures on previous airplane/engine combinations, and
assure that the causes of those failures are mitigated. While simple in
concept, the execution of this assessment is significant in scope. One
of the most significant aspects of this proposed rule is that an
applicant with no previous transport category manufacturing experience
would not be eligible to receive early ETOPS approval. The FAA
considers the relevant experience assessment as elemental to the early
ETOPS process. Without the ability to perform this assessment including
lessons learned on manufacturing and engineering processes, the FAA
could not
[[Page 64748]]
confidently grant an early ETOPS approval.
Beyond a certain level of commonality, past experience may not be
relevant to a new design. This is particularly true where a specific
design feature that contributed to problems in previous airplanes is
not a part of the new airplane design. However, the demonstration of
the applicability of past experience to the new design is inherent in
the relevant experience assessment.
This proposed rule would require that the applicant identify
corrective actions taken to preclude similar problems from occurring on
the new airplane. Removal from the design of a system, sub-system, or
component that has had problems in the past may be an acceptable
corrective action, as long as it precludes similar problems from
occurring.
Where new technology is introduced, the lessons learned assessment
becomes impractical, as there is no previous experience with this
technology. While this is true, there may still be applicable relevant
experience. For example, an applicant's previous experience with new
technology introductions may lead to changes in manufacturing and
quality control processes. Further, lessons learned of general
applicability can be introduced into the new technology design, such as
a general design practice to prevent cross-connector installation.
II(b)(2) Propulsion System Design
II(b)(2)(i) Engine ETOPS Eligibility
This paragraph would require that the engines to be installed on
the airplane be approved for ETOPS eligibility in accordance with
proposed new section 33.200.
Explanation
Proposed new section 33.200 would require that an engine intended
for a two engine ETOPS airplane that does not have the service
experience required by part 25, section II(a), would have to comply
with certain requirements. The ARAC proposed rule draft did not
specifically state that the engines installed in an early ETOPS
airplane must be certified in accordance with section 33.200. We have
corrected that oversight in this notice.
We intend that section II(b) of this notice apply to all new
airplanes and engines. We have considered the possibility that an
applicant may install an already certified engine with existing service
experience onto a new airplane. In this case, the combined service
experience and early ETOPS approval method of proposed section II(c)
would provide a way of certifying this type of mixed configuration.
II(b)(2)(ii) Design To Preclude In-Flight Shutdowns
The applicant would have to design the propulsion system to
preclude failures and malfunctions that could result in an engine in-
flight shutdown. In addition, the applicant would have to substantiate
compliance with this requirement by analysis, test, in-service
experience on other airplanes, or other means that the propulsion
system will minimize failures and malfunctions with the objective of
achieving the following in-flight shutdown rates:
(i) 0.02 or less per 1,000 engine fleet hours for 180 minute ETOPS
or less;
(ii) 0.01 or less per 1,000 engine fleet hours for ETOPS beyond 180
minutes.
Explanation
ARAC provided the following justification for this proposed rule.
``This rule section requires that the propulsion system be designed to
preclude failures and malfunctions that could result in an engine in-
flight shutdown. Propulsion systems on previous airplanes were designed
and certified to be ``fail-safe,'' in compliance with section 25.901 of
part 25; in other words, any single failure, or probable combination of
failures, would not jeopardize continued safe flight and landing of the
airplane. Because safe flight following an engine shutdown is required
by part 25, preventing engine in-flight shutdowns has not been a major
design objective on some previous airplane designs. The additional
design requirement in this section to preclude failures and
malfunctions that could result in an engine in-flight shutdown has an
enormous effect on propulsion system reliability in that normal design
decisions must now consider whether a failure or malfunction might
result in an engine in-flight shutdown. The method of compliance to
this section may vary from applicant to applicant, but the intent
remains--all design features of the propulsion system must preclude
shutdowns or power losses. This intent is also captured in the proposed
part 33 rule.''
We agree with the justification that ARAC provided. The ``design to
preclude failures and malfunctions that could result in an engine in-
flight shutdown'' is one of the most important features of the early
ETOPS special conditions that we required for the Boeing Model 777
airplane. The FAA had a similar justification for this requirement in
the preamble to those special conditions. However, the proposed rule
that ARAC recommended did not clearly