[4910-13]

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 1, 21, 25, 33, 121, 135

[Docket No. FAA-2002-6717; Notice No. 03-11]

RIN 2120-AI03

Extended Operations (ETOPS) of Multi-engine Airplanes

AGENCY:	Federal Aviation Administration (FAA), DOT.

ACTION:	Notice of proposed rulemaking (NPRM).

SUMMARY:  The FAA proposes to issue regulations governing the design,
maintenance, and operation of airplanes and engines for flights that go
beyond certain distances from an adequate airport.  This proposal would
extend some requirements that previously applied only to two-engine
airplanes to airplanes with more than two-engines.  The proposed rule
implements existing policy, industry best practices and recommendations,
and international standards to ensure that long-range flights will
operate safely.

DATES: Send your comments on or before January 13, 2004.

ADDRESSES:  You may submit comments to DOT DMS Docket Number

FAA-2002-6717 by any of the following methods:

Web Site:   HYPERLINK "http://dms.dot.gov"  http://dms.dot.gov  . Follow
the instructions for submitting comments on the DOT electronic docket
site.

Fax: 1-202-493-2251.

Mail:  Docket Management Facility; US Department of Transportation, 400
Seventh Street, SW., Nassif Building, Room PL-401, Washington, DC
20590-001.

Hand Delivery : Room PL-401 on the plaza level of the Nassif Building,
400 Seventh Street, SW., Washington, DC, between 9 am and 5 pm, Monday
through Friday, except Federal Holidays.

Federal eRulemaking Portal: Go to   HYPERLINK
"http://www.regulations.gov"  http://www.regulations.gov . Follow the
online instructions for submitting comments.

Instructions:  All submissions must include the agency name and docket
number or Regulatory Identification Number (RIN) for this rulemaking.
For detailed instructions on submitting comments and additional
information on the rulemaking process, see the Public Participation
heading of the Supplementary Information section of this document.  Note
that all comments received will be posted without change to   HYPERLINK
"http://dms.dot.gov"  http://dms.dot.gov  . including any personal
information provided.  Please see the Privacy Act heading under
Regulatory Notices.

Docket:  For access to the docket to read background documents or
comments received, go to   HYPERLINK "http://dms.dot.gov"
http://dms.dot.gov  at any time or to Room PL-401 on the plaza level of
the Nassif Building, 400 Seventh Street, SW., Washington, DC, between 9
am and 5 pm, Monday through Friday, except Federal Holidays

FOR FURTHER INFORMATION CONTACT:  Eric vanOpstal, Flight Standards
Service, Air Transportation Division, AFS-200, Federal Aviation
Administration, 800 Independence Avenue SW., Washington, DC 20591;
telephone<PHONE_NUMBER>; facsimile<PHONE_NUMBER>.

SUPPLEMENTARY INFORMATION:

Comments Invited.  The FAA invites interested persons to participate in
this proposed rulemaking by submitting written comments, data, or views.
 We also invite comments relating to the economic, environmental,
energy, or federalism impact that might result from adopting the
proposals in this document.  The most helpful comments reference a
specific portion of the proposal, explain the reason for any recommended
change, and include supporting data.  We ask that you send us two copies
of written comments.

We will file in the docket all comments we receive, as well as a report
summarizing each substantive public contact with FAA personnel
concerning this proposed rulemaking.  The docket is available for public
inspection before and after the comment closing date.  If you wish to
review the docket in person, go to the address in the ADDRESSES section
of this preamble between 9 a.m. and 5 p.m., Monday through Friday,
except Federal holidays.  You may also review the docket using the
Internet at the web address in the ADDRESSES section.

Before acting on this proposal, we will consider all comments we receive
on or before the closing date for comments.  We will consider comments
filed late if it is possible to do so without incurring expense or
delay.  We may change this proposal in light of the comments we receive.

If you want the FAA to acknowledge receipt of your comments on this
proposal, include with your comments a pre-addressed, stamped postcard
on which the docket number appears.  We will stamp the date on the
postcard and mail it to you.

Regulatory Notices

Privacy Act:  Anyone is able to search the electronic form of all
comments received into any of our dockets by the name of the individual
submitting the comment (or signing the comment, if submitted on behalf
of an association, business, labor union, etc.). You may review DOT's
complete Privacy Act Statement in the Federal Register published on
April 11, 2000 (Volume 65, Number 70; Pages 19477-78) or you may visit
HYPERLINK "http://dms.dot.gov"  http://dms.dot.gov .

Availability of Rulemaking Documents

You can get an electronic copy using the Internet by taking the
following steps:

(1) Go to the search function of the Department of Transportation's
electronic Docket Management System (DMS) web page
(http://dms.dot.gov/search).

(2) On the search page type in the last five digits of the Docket number
shown at the beginning of this notice.  Click on "search."

(3) On the next page, which contains the Docket summary information for
the Docket you selected, click on the document number of the item you
wish to view.

You can also get an electronic copy using the Internet through FAA's web
page at http://www.faa.gov/avr/arm/nprm/nprm.htm or the Federal
Register's web page at
http://www.access.gpo.gov/su_docs/aces/aces140.html.

You can also get a copy by submitting a request to the Federal Aviation
Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue
SW., Washington, DC  20591, or by calling<PHONE_NUMBER>.  Make sure to
identify the docket number, notice number, or amendment number of this
rulemaking.

Background

The Federal Aviation Administration (FAA) has long-standing regulations
that restrict the operations of two-engine air carrier airplanes
operated under part 121, Title 14 of the code of federal regulations (14
CFR).  Under current regulations these airplanes may not be operated on
routes that lie more than sixty minutes from an airport unless
authorized by the Administrator.  The premise for these restrictions was
that two-engine airplanes were less safe than three and four engine
airplanes particularly over very long distances.

History of ETOPS

In the 1980s, a new generation of very reliable, two engine airplanes
came into service and changed the underlying premise that restricted the
operations of these airplanes.  The airline industry sought to take
advantage of the improvements in reliability, range, and payload
capabilities that these new airplanes offered.  Beginning in 1985, the
FAA allowed air carriers to operate certain twin-engine airplanes on
routes that included points more than sixty-minutes from an adequate
airport under a formal program known as Extended Range Operation with
Two Engine Airplanes (“ETOPS”).  The regulatory basis of ETOPS was
the deviation authority contained in 14 CFR section 121.161.  With the
cooperation of the airlines, manufacturers, and other interested groups,
the FAA carefully controlled and monitored this new type of flight
operation.

Historical documents

Advisory Circulars 120-42 and 120-42A

In support of ETOPS, the FAA issued two Advisory Circulars (AC) 120-42
and 120-42A in 1985 and 1988 respectively.  These two AC documents have
been the basis for type design and operational practices for ETOPS to
date.  Initially, the FAA set a maximum approval of 120 minutes from an
airport for ETOPS.  During the nascent stage of ETOPS, air carriers
gained significant service experience; the safety and efficiency of
ETOPS became apparent.  In 1988, the FAA increased that approval to 180
minutes based on demonstrated safety record of these operations.

Deviation authority from section 121.161 prior to ETOPS

Since the 1970s, the FAA has authorized two-engine operations on routes
up to 75 minutes away from an airport exclusively in the Caribbean.
These were not considered ETOPS flights.  These flights were approved by
the FAA as deviations under section 121.161, but were authorized before
a formal ETOPS program was developed.  These deviations were approved
after a safety evaluation of the areas of operation, the airplanes, and
the operators conducting them.

207 minute ETOPS

In March 1999, the Air Transport Association (ATA) asked the FAA to
extend the 180-minute ETOPS authorization an additional fifteen percent
to 207-minutes.  The FAA published the ATA letter and asked for comments
(64 FR 22667, April 27, 1999).  Several commenters suggested that the
FAA should formalize ETOPS in the regulations rather than continuing to
rely on the deviation authority in section 121.161 and advisory
materials.  In January 2000, the FAA approved 207 minute ETOPS and
stated its intent to task an Aviation Rulemaking Advisory Committee
(ARAC) Working Group to study the issues and to recommend regulations
for ETOPS (65 FR 3522, January 21, 2000).  In this same notice, the FAA
solicited comments from the public on its decision to approve 207 minute
ETOPS.

Polar operations letter

The increasing use of Polar flights, while creating economic benefits,
has brought new challenges to extended operations such as climactic
extremes.  Due to these new challenges and to the increasing similarity
among all long-range operations, experience began to show that ETOPS
requirements and processes are generally applicable to all long-range
operations including those by three and four engine airplanes and would
improve their safety.

Harmonization with international standards

Related international activity

Two related activities should be noted.  First, the Joint Aviation
Authorities (JAA) of European nations has chartered a working group that
is also developing standards and guidance material for extended
operations.  In ongoing efforts of both the FAA and JAA to coordinate
regulatory requirements, one of the ARAC ETOPS Working Group tasks was
to “harmonize …standardized requirements across national boundaries
and regulatory bodies.”  Toward that end, there are representatives
who are members of both the ARAC ETOPS Working Group and the JAA Working
Group.  Also, the two groups met together twice in Europe to facilitate
joint action and harmonization.  Second, the International Civil
Aviation Organization (ICAO) Air Navigation Commission (ANC) Operations
Panel has decided to develop standards and recommended practices (SARPS)
for extended range operations.  In May of 2001, the ARAC ETOPS Working
Group held one of its meetings in Montreal, Quebec, Canada (ICAO’s
headquarters city) for the purpose of briefing members of the ANC and
ICAO Air Navigation Bureau staff.

ARAC ETOPS Working Group Task Statement

The FAA established the ARAC ETOPS Working Group through a notice in the
Federal Register at 65 FR 37447, dated June 14, 2000.  It was given the
following tasks:

1.  Review the existing policy and requirements found in Advisory
Circular (AC) 120-42A, applicable ETOPS special conditions, and policy
memorandums and notices, for certification and operational regulations
and guidance material for ETOPS approvals up to 180 minutes.

2.  Develop comprehensive ETOPS airworthiness standards for 14 CFR parts
25, 33, 121, and 135, as appropriate, to codify the existing policies
and practices.

3.  Develop ETOPS requirements for operations in excess of 180 minutes
up to whatever extent that may be justified.  Develop those requirements
such that incremental approvals up to a maximum may be approved.

4.  Develop standardized requirements for extended range operations for
all airplanes, regardless of the number of engines, including all
turbojet and turbopropeller commercial twin-engine airplanes (business
jets), excluding reciprocating engine powered commercial airplanes.
This effort should establish criteria for diversion times up to 180
minutes that is consistent with existing ETOPS policy and procedures.
It should also develop criteria for diversion times beyond 180 minutes
that is consistent with the ETOPS criteria developed by the Working
Group.

5.  Develop additional guidance and/or advisory material as the ARAC
finds appropriate.

6.  Harmonize such standardized requirements across national boundaries
and regulatory bodies.

7.  Any proposal to increase the safety requirements for existing ETOPS
approvals up to 207 minutes must contain data defining the unsafe
conditions that would warrant the safety requirements.

8.  The Working Group will provide briefings to the Transport Airplane
and Engine Issues group.

9.  The recommendations should consider the comments received as a
result of the April 27, 1999 and January 21, 2000 Federal Register
notices.

10. Within one year of publication of the ARAC task in the Federal
Register, submit recommendations to the FAA in the form of a proposed
rule.

Formation and membership of the ETOPS Working Group

Formation

Following the formal tasking notice in the Federal Register, the ARAC
organized an ETOPS Working Group.

Membership

The ETOPS Working Group consisted of over 50 representatives of U.S. and
foreign airlines, aircraft and engine manufacturers, pilots’ unions,
industry groups, air disaster support groups, and representatives from
the Joint Aviation Authority (JAA), International Civil Aviation
Organization (ICAO) and the FAA.

In accordance with the task statement and the Working Group’s work
plan approved by the ARAC Air Carrier Operations Issues Group on August
15, 2000, the Working Group reviewed existing ETOPS documents and
developed a risk assessment method for ETOPS and other long-range
flights.  The risk assessment method is comprised of three parts:  a
loss of thrust model; a system safety analysis using the FAR/JAR 25.1309
process; and an operational assessment assuring that pertinent
operational considerations are taken into account.

On the basis of the risk model and their review of long-range
operations, the Working Group used the following general concepts as the
basis for proposed regulations and advisory material.

Special considerations must be given for extended range flights to
prevent the need for a diversion and to protect the airplane and
passengers during the diversion when it cannot be prevented;

Airplanes must be designed and built for the intended mission

Airplanes must be designed, manufactured, and maintained at a level that
ensures the original reliability throughout the life of the airplane.

When engine reliability reaches a certain level, as measured by the In
Flight Shut Down (IFSD) rate (IFSD=0.01/1,000 hours), the risk of
independent failures leading to loss of all thrust is not significant
enough to require limiting the allowed time from an airport and other
limiting factors come into play.

For part 121 air carrier operations, ETOPS should be defined as flights
more than 60 minutes from an adequate airport for two-engine airplanes
and more than 180 minutes from an adequate airport for air carrier
airplanes with more than two engines.  For part 135 operations ETOPS
should be defined as flights more than 180 minutes from an adequate
airport.

Because of extreme climactic conditions certain ETOPS requirements
should be applied to Polar operations even if those operations would not
otherwise be considered ETOPS

Part 135 operations have unique considerations

Improvements in airplane engine and system reliability have reached a
point that they may no longer be the constraining factor on the
long-range flight operations.  The Working Group found, however, and the
FAA agrees, that it would be prudent for two-engine airplanes to remain
within 180 minutes of an adequate airport whenever possible.  There is a
positive correlation between risk and diversion length.  Thus the FAA
believes that diversion lengths should be kept to a minimum.

ARAC ETOPS Working Group Concept General Observations

As already noted, the working group acknowledged that the reliability of
aircraft engines and systems has improved to the point that it may not
be limiting to the operation.  The Working Group recommended that
two-engine airplanes should be approved in many cases for 180-minutes
ETOPS and ETOPS beyond 180 minutes may be appropriate in some
situations.  The Working Group recommended that airplanes with more than
two engines should be approved for ETOPS beyond 180-minutes in many
cases.  Even though engine reliability has significantly improved,
diversions are sometimes necessary for reasons that are unrelated to the
number of engines on an aircraft and their reliability, such as
passenger illness or other occurrences.

Regarding extended range operations by jet-powered airplanes under part
135, FAA policy for many years has permitted such flights up to 180
minutes from an airport, without additional ETOPS-like requirements.
Operational experience has validated that policy, and the Working Group
proposal continues existing policy and provides for flights with longer
diversion times with appropriate additional requirements.

Regarding extended range operations by air carrier airplanes with more
than two engines, those flights have been conducted without any
ETOPS-like requirements since the air carrier jet era began.  The
Working Group’s proposals would ensure the continued safety of those
flights by adding requirements in areas that are not dependent upon the
number of engines on the airplane, such as cargo fire protection
duration.

The ETOPS Working Group has proposed regulations and guidance material
in three specific areas:  Type Design (Parts 25 and 33); Part 121
Operations; and Part 135 Operations.

General Discussion of the Proposal

FAA approach to the ARAC recommendations

In developing this proposal the FAA has accepted ARAC recommendations
without change where possible.  The FAA made changes for clarity, to
correct for incomplete ARAC recommendations, to ensure that requirements
are legally sufficient, and to make improvements in style of
presentation.  The FAA provides explanation in this notice for any
substantial differences with the ARAC recommendation.

General issues

Terminology - Extended Operations (ETOPS)

This proposal has two primary objectives: (1) To create new regulations
and amend existing regulations for the design, maintenance, and
operation of aircraft used in ETOPS; thus far ETOPS has been allowed by
the FAA’s discretionary authority and supported by an Advisory
Circular and; (2) To apply the lessons learned from ETOPS to all
airplanes that are operated in Extended Operations (ETOPS) regardless of
the number of engines.  The acronym ETOPS would apply to all airplanes
in Extended Operations and not just twin-engine airplanes.  These rules
would apply equally to airplanes operating over oceanic areas or routes
entirely over land.

Risk model

Item 3 of the ARAC tasking was to “develop ETOPS requirements for
operations in excess of 180 minutes up to whatever extent that may be
justified.”  At the early ARAC ETOPS Working Group meetings, the FAA
presented a new risk model for assessing risk on an ETOPS flight.  The
new approach for assessing the overall risk of critical thrust loss on
an ETOPS flight considers such factors as the length of the flight and
engine reliability in addition to the more traditional maximum diversion
time.

The ARAC ETOPS Working Group adopted the FAA’s proposed risk model and
further developed it to apply it to three and four engine airplanes.  It
did this by including the corresponding engine failure rate that would
be required to achieve an equivalent risk of critical thrust loss due to
independent failures on three and four engine airplanes.  We will now
summarize the risk model used in the development of this proposed rule.

The basic premise that the FAA used in developing its risk model is that
ETOPS service experience is excellent and that any changes to allow
further expansion of ETOPS need to preserve this record.  With this
premise in mind, the basic objective is to define a risk model that
would allow an expansion of two engine airplane operations to use the
same routes as three and four engine airplanes with no substantial
change in the overall risk.

Currently, we manage dual engine shut down risk on two engine airplanes
by limiting the maximum allowable diversion distance and requiring a low
engine in-flight shutdown rate.  This is a one-dimensional risk model in
that with a constant in-flight shutdown rate, the existing ETOPS
requirements and policy consider only the maximum distance that an
operator may plan a route from an enroute diversion airport.  It assumes
that there is a constant risk during the course of a flight with no
consideration of how the actual diversion times vary along the track as
different alternate airports come into and out of range of the airplane.
 This approach also does not consider the increase in overall risk that
is created by increasing an airplane’s range, and thus time aloft, by
adding fuel.  Further, this model provides no means to assess the effect
on overall risk with changes with engine failure rates.  Actual ETOPS
involve continuously changing distances to alternates.  Current ETOPS
limits on maximum diversion time don’t represent real world risk
because diversions can occur anywhere along the track, not just at the
maximum point.  The new ETOPS risk model adopted for the development of
this new proposed rule is based on the introduction of a “two
dimensional” model to replace the “one dimensional” maximum
diversion time/distance model currently in use.

The new ETOPS Exposure Index is a simplified form of several risk
equations that have been developed over the past forty years.  All share
similar characteristics.  The ARAC ETOPS Working Group compared several
different mathematical representations for allowable risk versus engine
failure rate.  Each showed that an engine failure rate on the order of
0.01 per 1,000 engine flight hours was adequate to allow diversion times
for two engine airplanes that for all practical purposes could be
considered as unrestricted.

The new risk model consists of a comparative risk index based on a
combination of range, average diversion distance, and engine failure
rate.  Independent cause dual engine shut down risk is driven by the
footprint area of the route multiplied by the engine failure rate (E)
squared.  The footprint area is defined as the route length (L)
multiplied by the average diversion distance (D).  Note that the engine
shut down rate is squared to account for loss of first engine and then
loss of second engine.  Therefore, we define “ETOPS Exposure Index”
(EEI) as a function of:

Footprint Area (Route Length x Average Diversion Distance) (L x D) and

E2 (Engine Failure Rate Squared)

				EEI=LxDxE2

The ETOPS Exposure Index can be used as an evaluation tool to assess
risk of ETOPS operations due to independent engine failure causes.
Assuming the following values for each of the terms of the equation:

Route Length = 5500 nautical miles,

Average Diversion Distance for 180 minute ETOPS = 800 nautical miles,
and

Engine failure rate at the current required level = 0.02 shutdowns/1,000
engine-hours or 50,000 hours time between shutdowns.

The EEI would then be:

			EEI = 5500 x 800 x 0.022 = 1760

With the ETOPS Exposure Index fixed at this level, longer flights and
greater maximum diversion distances can be offset by decreased engine
failure rate.  In other words, as E becomes smaller, L and/or D can
increase appropriately. An engine failure rate of one-half the current
requirement (E = 0.01/1,000 engine-hours) would allow a four times
increase in “footprint” area.

EEI =    L   x   D  x   E2

EEI = 5500 x 800 x 0.022 = 1760

equals

EEI = 5500 x 3200 x 0.012 = 1760

equals

EEI = 11,000 x 1600 x 0.012 = 1760

In other words, with an engine failure rate that is one-half the current
requirement for 180 minute ETOPS we could allow four times the average
diversion distance or a combination of increased route length and
average diversion distance with no change in the current ETOPS risk.

For a two engine airplane, engine failure rate has the biggest impact on
ETOPS risk because the factor is squared.  A reduction in the engine
failure rate has a large impact on the size of an allowable footprint
area for the same risk.  Using the ETOPS Exposure Index concept with a
reduction in the engine failure rate standard allows the development of
ETOPS rules for two engine airplanes that minimize restrictions on
airline operations while maintaining the current excellent ETOPS safety
record.

Current in-service engines are capable of achieving better than 100,000
hours time between shutdowns (.01/1,000 engine-hours), or double the
current ETOPS reliability standard.  This represents two in-flight
shutdowns in the entire life of a typical transport airplane.  It is not
reasonable to expect that two in-flight shutdowns due to independent
causes in the entire life of a typical transport airplane would occur on
the same flight.

With an IFSD rate of 0.01/1,000 hours, the probability of complete loss
of thrust due to independent failures will be sufficiently low so that
the main focus of long-range operational safety can be on reducing the
possibility of other risk factors.

We emphasize that this risk model represents a good tool for evaluating
the risk of critical thrust loss due to “independent” failure
causes.  The biggest threat to long-range operational safety continues
to be the loss of thrust from multiple engines resulting from:

Common Cause Multiple Failures

Cascading Multiple Failures

Fuel Exhaustion

These threats are common to all long-range operations, regardless of the
number of engines on the airplane.

Examples of common cause multiple failure events:

Eastern Airlines L1011 nearly lost all engines after improper
installation of engine magnetic chip detectors.

B-747 volcanic ash cloud encounter during volcanic eruption in Alaska -
All engines severely damaged by ash.

Example of potential cascading failure:

Worn-out second engine fails after application of higher power following
failure of first engine

Examples of Fuel Exhaustion events:

Air Canada 767 - No power landing into Gimli, Canada

Air Transat A330 - No power landing in the Azores

Sources of Common Cause and Cascading Failures:

Common Design Faults

Hardware

Software

Environmental Exposures

Weather

Volcanic Ash Clouds

Bird Strikes

High Intensity Radiated Fields (HIRF)

Lightning

Simultaneous Maintenance on More than One Engine

Contaminated Fuel

Sources of Fuel Exhaustion:

Operational Errors

Fuel System Mismanagement

Fuel Loading Errors

Misleading Fuel Quantity Indications

Misleading Fuel Loading Procedures particularly during a non-normal
(MEL) dispatch

Constant awareness of potential sources of common cause failures,
cascading failures, and fuel exhaustion is the key to continued
long-range operational safety.  This awareness, growing from operating
experience, is the basis for continued ETOPS safety.  ETOPS safety
enhancements focus on defining methods to prevent potential threats
caused by known sources.

Examples of Common Cause/Cascading Failure Prevention Strategies:

1. No single person performing simultaneous engine maintenance or
servicing

2. Conservative fuel loading requirements

3. Intense rain/hail ingestion engine design requirements

4. Constant adherence to established ETOPS procedures without exception

5. Robust engine condition monitoring program

The FAA incorporated prevention strategies for these types of failures
into airworthiness requirements and ETOPS policy as we learned of them.
This proposal would codify those prevention strategies for known sources
of common cause, cascading and fuel exhaustion failures that have not
been incorporated into the regulations.

The ARAC ETOPS Working Group also looked at how the new risk model could
be applied to airplanes with more than two engines.  For these types of
airplanes, the working group had to decide what a critical loss of
thrust was in order to determine the impact that engine failure rate
would have on overall risk.  For a two-engine airplane, the risk model
assumes that a loss of both engines is a critical thrust loss.  This is
because there is a general expectation that the result of such an
occurrence would be a catastrophic loss of the airplane; though there
are examples of safe landings following the loss of both engines.  The
working group applied a similar approach to define a critical thrust
loss for airplanes with more than two engines.

The operating rules contained in 14 CFR Part 121 have minimum
performance requirements with two engines inoperative for airplanes that
have more than two engines.  Using this as a guide, the working group
assumed that critical thrust loss for both three and four engine
airplanes would be three engines.  If three engines fail on either kind
of airplane, there is a general expectation that the result would be a
catastrophic loss of the airplane.  In other words, the risk model
assumes the fourth engine on a four-engine airplane provides no
additional safety benefit compared to the loss of all engines on a
three-engine airplane.  As is the case for two-engine airplanes, there
are examples where a flight crew was able to safely land a four-engine
airplane following the loss of three of the engines.  However, the ETOPS
risk model makes the conservative assumption that this would result in
loss of the airplane.

This assumption for three and four engine airplanes changes the risk
model equations so that for these types of airplanes, the probability of
the loss of three engines would be much more remote than the loss of
both engines on a two engine airplane.  Under this assumption there is a
higher probability of losing three engines on a four-engine airplane
than on a three-engine airplane.  The following example illustrates the
concept.  A three-engine and a four-engine airplane are in-flight.  Both
airplanes suffer the loss of two-engines due to independent causes but
can reach a diversion airport.  However the loss of an additional engine
for either airplane at this point would be catastrophic for the
airplane.  The three-engine airplane has a single engine that could
possibly fail while the four-engine airplane has two engines that could
possibly fail.  In this unlikely situation, the four-engine airplane is
at greater risk because the probability of experiencing an engine
failure event increases with the number of engines.  Assuming that the
engine failure rate is the same for each type of airplane, a four-engine
airplane would have twice the probability of losing one of the two
remaining engines than the three-engine airplane would have of losing
the one remaining engine.

Using the available risk model equations with these considerations, the
ARAC ETOPS Working Group determined that the in-flight shutdown rate for
a three engine airplane would be approximately 0.2 shutdowns per 1,000
engine-hours to have an equivalent risk of critical thrust loss compared
to at two engine airplane with an in-flight shutdown rate of 0.01 per
1,000 engine-hours.  On a four-engine airplane, the equivalent in-flight
shutdown rate would be 0.1 per 1,000 engine-hours.

Because these rates are so high compared to the failure rates currently
achieved by today’s turbine engines, the FAA does not consider it
necessary to specify in-flight shutdown rates for three and four engine
airplanes other than as part of an operator’s propulsion system
monitoring program.  Under these programs, the operator must notify the
FAA and take corrective action if these rates are exceeded.

In-flight Shutdown (IFSD) rate

Propulsion system monitoring is vital to ensure safe ETOPS flights.  A
propulsion system monitoring program is intended to detect adverse
trends, to identify potential problems, and to establish criteria for
when corrective action may be necessary.  The certificate holder would
have to ensure that its ETOPS airplanes have In-Flight Shutdown (IFSD)
rates commensurate with the world fleet’s operation for that airplane
type.  Propulsion system monitoring at the operator level has been
accomplished via the guidance of AC 120-42A which defined specific IFSD
rates for ETOPS.

Propulsion system problems and IFSD may be caused by type design
deficiencies, ineffective maintenance or operational procedures.  It is
very important to identify the root cause of events so that appropriate
corrective action may be determined.  The diverse causes of propulsion
system problems require different solutions.  For example, type design
problems may affect the world fleet of aircraft.  If an individual
certificate holder experiences a problem caused by a type design issue,
it may not be appropriate for the FAA to reduce or withdraw the
particular operator’s ETOPS authority.  However, maintenance or
operational problems may be wholly, or partially, the responsibility of
the certificate holder.  If a certificate holder has an unacceptable
IFSD rate risk attributed to maintenance or operational practices, then
action carefully tailored to that certificate holder may be required.

The FAA does not use IFSD rate as the sole means to determine a
certificate holder’s ETOPS authority.  The FAA considers the 12-month
rolling average standard that occurs for a mature fleet after the
commencement of ETOPS.  A high IFSD rate could be due to the limited
number of engine operating hours used as the denominator for the rate
calculation or a small fleet.  The effect may be an IFSD rate jump well
above the standard rate due to a single IFSD event.  The underlying
causes for such a jump in the rate will have to be considered by the
Administrator.  Conversely, there may be occasions when a single ETOPS
event may warrant corrective action even though the overall IFSD rate is
not exceeded.  In such a case, the cause would be certificate holder
specific and may require changes to their operational, dispatch or
maintenance procedures.

Configuration, maintenance, and procedures (CMP) document

The use of a CMP document has been in the ETOPS criteria from AC 120-42,
and later 120-42A, from the very first ETOPS airplane approvals.  The
CMP document defines airplane and propulsion system design
configurations, maintenance procedures, and operational procedures
required to comply with the ETOPS requirements that are not already a
part of the original type design approved by the original issuance of
the airplane and engine type certificates.

The CMP document is comprised of service bulletins, service letters,
maintenance manual references, and other pertinent documents which
define the alterations, maintenance or operational requirements and
limitations that the FAA requires to make an airplane type design
suitable for ETOPS.  The CMP is an amendment to the airplane type design
defined in 14 CFR 21.31.  The initial CMP approval, as a change to the
type design, is analogous to other type design approvals for specific
operations such as Category III autoland approval for autopilot systems
that could involve design changes to a previously certified system.

After ETOPS approval, the CMP may be modified by any airworthiness
directives (ADs) issued in accordance with part 39 that supersede
existing CMP requirements.  CMP document requirements will not increase
except by AD.

Misconceptions about the criteria for revising CMP documents generated
some of the biggest discussions in the ARAC ETOPS Working Group
meetings.  The FAA approved airplanes for ETOPS under the original AC
120-42 between 1985 and 1989 without a defined propulsion system
reliability standard.  The approach used in AC 120-42 to assess the
suitability of an airplane-engine combination for ETOPS was to use a
“fix all problems” approach.  This process involved identifying the
causes of propulsion system problems in service on the candidate
airplane and including identified corrective actions into an approved
CMP document as a condition for ETOPS approval.  This was an ongoing
process and the FAA conducted regular reviews to determine additional
corrective actions as new problems occurred in service.  As a result,
the FAA routinely required the airplane manufacturer to revise the CMP
documents during this period.

The “fix all problems” approach to airplane propulsion system
assessment was carried over into the revised AC 120-42A at the end of
1988, and continues on in this notice in proposed part 25 Appendix L
paragraph II(a)(ii).  However, revision A of the AC added a propulsion
system reliability standard as a provision for ETOPS type design
approval that did not exist in the original AC.  With an established
propulsion system reliability standard, the FAA now had a gauge to
monitor the safety of the approved ETOPS fleet without a need to
continually update the CMP as new problems occurred.  Also, several
ETOPS operators began objecting to the FAA requiring them to continually
upgrade existing ETOPS approved airplanes without any input to the
changes being required.

The FAA recognized that our previous practice of requiring upgrades to
already approved airplanes without prior public review created an undue
burden on operators.  As a result, the FAA changed its approval process
for revisions to CMP documents.  The FAA documented this change in an
internal memorandum signed by the managers of the Transport Airplane
Directorate, and the Engine and Propeller Directorate on April 3, 1990.
In that memo, the directorate managers noted that the AC gave them the
responsibility for the continuing airworthiness of the type design CMP
standard and that the CMP should not be changed unless the reliability
of the airplane-engine combination is not achieving or maintaining the
reliability objective, or some other unsafe condition arises.  As with
any type design, the FAA permits manufacturers and operators to
incorporate minor changes and routine enhancements by service bulletins
or production design changes.  However, the FAA will not mandate such
enhancements in a revision to the CMP standard.  The memo concludes by
stating that the Transport Airplane and the Engine and Propeller
Directorates plan to use the AD process to control the continuing
airworthiness type design requirements of the ETOPS CMP standard.

As a result of the joint memo, the FAA established strict guidelines for
CMP revisions to ensure that the requirements of the basic CMP standard
originally approved for an airplane-engine combination are not increased
without going through the AD process.

The FAA approves revisions to an airplane’s CMP document for the
following reasons:

1. When incorporating the CMP standard for a newly approved
airplane-engine combination into an existing CMP document.

2. When correcting errors in previous revisions.

3. When ADs are issued that supersede existing CMP requirements.

4. When approving optional alternatives to existing requirements.

5. When mandating changes to the CMP by an AD.

The FAA aircraft certification offices have used these guidelines since
issuance of the joint memo to approve CMP revisions.  Because operators
had already complied with several revisions to previously approved CMP
documents in force at the time the FAA issued the new CMP guidelines,
the FAA worked with the airlines and the manufacturers to establish
“baseline” CMP requirements for each ETOPS approved airplane-engine
combination.  The affected operators agreed to ensure that all of the
requirements of these baseline CMPs are incorporated into their ETOPS
fleets.  Thereafter, the new CMP revision guidelines would be the
standard way of making subsequent revisions.

Summary of the proposed changes

The following chart summarizes which operations would be affected by the
proposed rule changes:

	Current requirements	Proposed Rule

	Up to 60 minutes	Beyond 60 minutes	Up to 60 minutes	Beyond 60 min up to
180 minutes	Beyond 180 minutes

Part 121 two engine	Section 121.161 applies	Advisory material and policy
letters	No change	Would apply (Would codify previous practice)	Would
apply

Part 121 more than two engine	No current regulation	No current
regulation	No change	No change	Would apply

Part 135	No current regulation	No current regulation	No change	No change
Would apply

	The chart below summarizes ETOPS regulations before and after the
proposed changes.

	Under current advisory circulars and policy	Under the proposed
regulation

Proposed ETOPS requirement	Twins	More than two engines	Part 135
operations	Twins	More than two engines	Part 135 operations

Applicability	More than 60 minutes from an adequate airport	Does not
apply to turbine engine airplanes.	Does not apply	More than 60 minutes
from an adequate airport	More than 180 minutes from an adequate airport
More than 180 minutes from an adequate airport

Terminology	ETOPS (Extended Operations for Two Engine Airplanes)	ETOPS
does not currently apply to turbine engine airplanes with more than two
engines	ETOPS does not currently apply to part 135 operations	ETOPS
(Extended Operations)	ETOPS (Extended Operations)	ETOPS (Extended
Operations)

Maximum permissible distance from an adequate airport	207 minutes	Not
regulated	180 minutes	240 minutes with certificate holder approval,

beyond 240 minutes with route specific approval	To maximum system
limitation	240 minutes

Cargo fire suppression	Diversion limit plus 15 minutes	Not required	Not
required	Diversion limit plus 15 minutes.	Diversion limit plus 15
minutes (6 year compliance period)	Not required

Rescue and fire fighting service capability	ICAO category 4 	Not
required	Not required	ICAO category 4 up to 180 min, ICAO category 7
beyond 180 min	ICAO category 7	Not required

Passenger recovery plan	Required for polar operations	Required for polar
operations	Required for polar operations	Required	Required	Required

Engine reliability standards	IFSD rates:

0.02/1000 hrs for 180 min,

0.19/1000 hrs for 207 min	None	None	IFSD rates:

0.05/1000 hrs for 120 min,

0.02/1000 hrs for 180 min,

0.01/1000 hrs for > 180 min	IFSD rates:

0.2/1000 hrs for 3 engine airplanes,

0.1/1000 hrs for 4 engine airplanes	Not specified

Areas of designated ETOPS applicability	Polar	Polar	Polar	Applies
Applies	Applies

Time-limited systems	Per type design approval limit for the airplane (up
to 207 min).	No requirement	No requirement	Specified in part 25,
Appendix L	Specified in part 25, Appendix L	Specified in part 25,
Appendix L

Dispatch weather requirements for alternate	Applies	No requirement	No
requirement	Applies	Applies	Applies

ETOPS maintenance program	Required	No requirement	No requirement
Required	Required	Required

Communication capabilities	SATCOM required for 207 min ETOPS	No
requirement	No requirement	Additional com required. SATCOM beyond 180
min..	Additional com required. SATCOM beyond 180 min..	Additional com
required. SATCOM beyond 180 min..

Section-by-Section Discussion of the Proposal

We begin the discussion by clarifying the term “ETOPS”.  Since its
inception eighteen years ago, the term “ETOPS” has described
extended-range operations of two-engine air carrier airplanes under a
deviation from 14 CFR 121.161.  The term has gained broad acceptance
among operators and regulators throughout much of the world.

This proposal would create regulatory requirements for extended
operations for all air carrier airplanes.  As described previously, the
thresholds for applicability would vary by the number of engines and
type of operation.  In its deliberations, the Working Group stated that
it struggled with the question of whether to use a new term to describe
the operations of airplanes beyond 180 minutes from an adequate airport.
 Early on, the Working Group considered and agreed to the term
“LROPS” which stands for Long Range Operations to describe flights
beyond the 180-minute threshold.  However, as their efforts progressed
the Working Group found that the use of two terms (ETOPS and LROPS) for
two-engine airplanes flying beyond 60 minutes and 180 minutes from an
airport quickly became awkward and cumbersome.  Further, the Working
Group members representing the maintenance community expressed great
concern that the introduction of the LROPS term would needlessly create
confusion among the maintenance community and would also require
painstaking and potentially expensive revisions to numerous maintenance
manuals and programs.  In order to avoid any potential confusion, the
Working Group recommended the use of the term ETOPS for all air carrier
extended range operations irrespective of the number of engines.

The FAA strongly agrees with this recommendation.  The FAA also believes
that the addition of a new term could needlessly create confusion.
Further it would potentially dilute the intent of this proposal, which
is to codify existing ETOPS standards and procedures and to extend those
concepts to airplanes with more than two-engines.  The FAA believes that
the introduction of a new term could be misinterpreted as creating a new
operational concept as opposed to the extension of an existing one.

The proposed amendments to the Type Design Rules 14 CFR parts 25 and 33
and supporting advisory material are a consolidation of requirements
taken from AC 120-42A, the 777 Special Conditions, and JAA Information
Leaflet (IL) 20.  The materials contained in the proposed Airplane Type
Design Rule (Part 25) and AC are a compilation of the existing
AC120-42A, 777 Special Condition, and JAA IL20.

The following discussion takes each of the Rule sections and attempts to
capture all of the comments and discussion from the ARAC activities.

Part 1

Section by section discussion of the proposed changes to part 1

Section 1.1 - General Definitions

The proposed definitions were adopted directly from the ARAC
recommendation.  This proposal would establish three different
definitions of ETOPS in three significant ways.  In each case, the
acronym would stand for “extended operations” for all airplanes
regardless of the number of engines.  The definition would vary in part
121, however, depending on whether the airplane involved has two engines
or more than two engines.  This proposal also would introduce ETOPS into
part 135 for the first time, where ETOPS would have a third definition.
The FAA believes the remainder of the proposed definitions for section
1.1 are self-explanatory.

Part 21

The amendments to part 21 would create reporting requirements for the
holders of type certificate for two-engine ETOPS airplanes and ETOPS
eligible engines.  This would require type certificate holders to
closely monitor the performance of their products to ensure their
continuing reliability.  These amendments would also ensure that the FAA
is kept apprised of any existing or potential problems in a timely
manner.

Section by section discussion of the proposed changes to part 21

Proposed New Section 21.4 - ETOPS Reporting Requirements.

This proposal would add a new regulation consisting of two parts, Early
ETOPS Problem Reporting & Tracking for all ETOPS airplanes, and ETOPS
Operational Service Reliability Reporting for two-engine airplanes.

Explanation.

1. Reporting for all ETOPS airplanes.  The proposed rule is a
codification of what the FAA considers to be one of the essential and
objective elements of the early ETOPS Special Conditions (SC) for the
B777 aircraft; specifically as they pertain to problem tracking and
reporting.  The FAA accepts the ARAC recommendation and proposes it as a
new section 21.4.  Section 21.4 would require the type certificate
holder to establish an early ETOPS problem reporting system.  The
proposed system would contain a means for the prompt identification of
those problems that could impact the safety of ETOPS operations in order
that they may be resolved in a timely manner.  The system would also
contain the process for the timely notification to the responsible FAA
office of all relevant problems encountered, and identification of
corrective actions deemed necessary and provide for appropriate FAA
review of all planned corrective actions.  The system would be in place
for the first 250,000 engine-hours of fleet operating experience after
the airplane enters service.

For two-engine ETOPS airplanes the system would remain in effect beyond
250,000 engine-hours of fleet operating experience until the fleet has
demonstrated a specified and stable IFSD rate consistent with the
approved diversion time of the aircraft.  For the service period, this
system would define the sources and content of in-service data that will
be made available to the type certificate holder in support of the
problem tracking system.  The content of the data provided would include
the data necessary to evaluate the specific cause of all service events
reportable under section 21.3(c) of part 21, in addition to any other
failure or malfunction that could affect the safety of ETOPS operation.
Ten event occurrences, specifically defined with respect to reliable,
safe ETOPS operation that would require reporting are defined in the
proposal.

2. Reporting for two engine ETOPS airplanes. Paragraph (b)(1) of the
proposed section 21.4 would require engine and airplane manufacturers to
report periodically on the reliability of their two-engine airplane
fleets.  Reporting would include: IFSD events, IFSD rates, and ETOPS
fleet statistics.  This reporting may be combined with the reporting
required by section 21.3.  The proposed rule also would require the
identification of cause and appropriate corrective action to assure
reliable, safe ETOPS operations.

The periodic reporting of the reliability required of the manufacturers
of engines and airplanes approved for ETOPS service would begin at the
introduction of the product into service and continue throughout its
product life.  The interval of the reporting would be more frequent
early in its product cycle and generally longer later in its product
service life, especially after the product has achieved maturity with
regard to engine reliability.  Reliability would be indicated by a
stable engine shutdown event rate at or below the target values.

Generally, early product service life reporting on a quarterly basis is
adequate, especially considering the fact that the manufacturers report
engine failure events as they occur under the requirements of section
21.3.  Event rates may fluctuate considerably early in the product’s
service life cycle because, although the fleet is growing in numbers of
engine-airplane combinations in service, the accumulation of engine
flight hours is generally slow.  Typically, event rates are not very
stable when the fleet cumulative time is less than 1 or 2 million engine
flight hours.  Therefore the focus should be on event occurrences, not
failure rates, with a small fleet typical of early service time.

After maturity (a stable engine shutdown event rate at or below the
target values) with a large fleet, reporting intervals continue on a
quarterly basis.  Regardless of fleet size, fleet age, and state of
maturity, engine failures are reported under the requirements of section
21.3.

3. Paragraph (b)(2) of the proposed Section 21.4 identifies world fleet
IFSD rate/reliability requirements.  The standards in section
21.4(b)(2)(i) are the IFSD rates compatible with the current FAA ETOPS
AC and Policy for operation up to 180 minutes (including North Pacific
operation).  The standard in section 21.4(b)(2)(ii) is an IFSD rate
compatible with operation beyond 180 minutes to 240 minutes and beyond,
as contained in the proposed Operational rule and guidance material.

As discussed in this proposed NPRM, an IFSD rate of 0.01/1,000 Engine
Flight Hours (EFH) is consistent with an extremely improbable risk of a
dual in-flight power loss from independent causes for a two-engine
airplane, even assuming a decision of practically unlimited duration.
The rates given are not operator specific, but rather apply across the
fleet of a given airplane-engine combination.

The FAA expects implementation of corrective action will maintain an
acceptable in-flight shutdown rate below the required levels.  This is
borne out by the current ETOPS fleet in-flight shutdown rates, which
have achieved and consistently maintained rates at or below 0.01 per
1,000 engine-hours.  If the normal airworthiness monitoring process is
not sufficient by itself to maintain an acceptable propulsion system
reliability for a particular airplane-engine combination, then the FAA
may require additional corrective actions, or reduce or withdraw the
ETOPS diversion authority as described in section 21.4(c), if the risk
of dual power loss is unacceptably high.  Before such action is taken,
however, the certificate holder and the FAA will assess the fleet-wide
risk based upon the risk model developed for ETOPS presented in this
preamble.

Part 25

Section by section discussion of the proposed changes to part 25

Proposed Change to Paragraph 25.857(c)(2) - Cargo fire suppression.

The proposed change to section 25.857(c)(2) would require that the
applicant furnish the certified time capability of a Class C cargo fire
suppression system in the Airplane Flight Manual (AFM) in accordance
with section 25.1581(a)(2).  The time capability of a system is the
maximum length of time a system can suppress a fire.

Explanation.

The proposed new section 121.633 and part 135, Appendix H, paragraph E
would specify that the time that an operator needs to fly to a planned
ETOPS alternate may not exceed the maximum time capability specified in
the Airplane Flight Manual for the airplane’s most time limited
system.  This change to section 25.857(c)(2) and a similar requirement
in the new Appendix L, section I, paragraph (e)(4) will ensure that the
Airplane Flight Manual provides the information that the operators will
need regarding the fire suppression system to comply with the operating
requirements.  The justification for these changes is further discussed
in the explanations for those proposed operating rules.

Proposed New Section 25.1535 - ETOPS Approval.

A proposed new section 25.1535 would prescribe the requirements for
obtaining ETOPS type design approval.

Explanation.

This new rule in the body of part 25 is effectively a pointer to a new
Appendix L, which sets out additional design, analysis and test
requirements for ETOPS type design approval.  This rule also requires
that in showing compliance with part 25 rules the applicant must
consider the maximum length ETOPS mission.  The applicant must also
consider the effects of airplane system failure on crew workload and
passenger physiological needs during a diversion of the maximum time
considered.  The system safety assessment required by section 25.1309 is
an example of a rule where the ETOPS mission profile would be considered
in an analysis to determine compliance.  The ETOPS mission profile
(including the maximum diversion time) could also affect the compliance
analysis for section 25.1011(b) concerning oil endurance, and section
25.571 governing structural fatigue and damage tolerance.

This proposed rule is crucial to ensure that throughout the airplane
design, the ETOPS mission profile is properly considered, and the
standard of compliance is high because of it.  The “ETOPS Scenario”
diagram and the ETOPS significant systems definition that would be
provided in the associated advisory circular for this rule are good
tools that system designers can use to assess all conditions although
they are not regulatory.  There are also additional requirements in
Appendix L to provide focus on those airplane systems that have,
historically, been important to ETOPS operations such as electrical
power, APU, and fuel systems.  The emphasis on these specific airplane
systems does not mean that these are the only airplane systems that are
important to ETOPS.  The section 25.1535 and Appendix L requirements
along with the advisory circular guidance for ETOPS significant systems
and the ETOPS mission profile provide the basis for assessing other
airplane systems for ETOPS approval.

Proposed new part 25 Appendix L – Extended Operations.

A proposed new appendix L to part 25 defines additional airworthiness
requirements for ETOPS approval.

Explanation.

Appendix L would codify the airworthiness standards unique to ETOPS from
Advisory Circular 120-42A, the Boeing 777 ETOPS special conditions, and
the 207-minute ETOPS Policy Letter EPL 20-01.  The requirements of
Appendix L would go beyond simply considering the ETOPS mission in
applying the basic part 25 requirements.

Since we would not require an applicant to comply with these ETOPS
requirements in order to receive a basic part 25 type certificate, we
decided that a separate appendix to part 25 would be the best location
for these additional requirements for ETOPS.

Appendix L Format.

Appendix L is organized into three sections.  Section I sets out design
requirements that all airplanes must comply with for ETOPS approval.
Section II prescribes specific requirements for two engine airplanes.
Section III prescribes specific requirements for airplanes with more
than two engines.

The proposed numbering system and organization of Appendix L is a
significant departure from the ARAC recommendation.  As an aid to
readers familiar with the original ARAC proposal, Tables 1 and 2
cross-reference the original Appendix L paragraph numbers recommended by
ARAC to the reorganized appendix proposed in this notice.

	Table 1

	Cross-Reference of ARAC Proposed and New Appendix L Paragraph Numbers

Original ARAC Proposal	New

L25.1

Appendix L	Applicability

L25.2	(a)	Section I	(a)

	(a)(i)	Section I	(a)(1)

	(a)(i)(1)	Section I	(a)(1)(i)

	(a)(i)(2)	Section I	(a)(1)(ii)

	(a)(ii)	Section I	(a)(2)

	(a)(ii)(1)	Section I	(a)(2)(i)

	(a)(ii)(2)	Section I	(a)(2)(ii)

	(a)(ii)(3)	Section I	(a)(2)(iii)

	(a)(iii)	Section I	(a)(3)

	(b)	Section I	(b)

	(b)(i)	Section I	(b)(1)

	(b)(i)(1)	Section I	(b)(1)(i)

	(b)(ii)	Section I	(b)(1)

	(b)(iii)	Section I	(b)(1)(ii)

	(b)(iv)	Section I	(b)(2)

	(b)(iv)(1)	Section I	(b)(2)(i)

	(b)(iv)(2)	Section I	(b)(2)(ii)

L25.3	(i)	Section II	(b)(1)

	(ii)	Section II	(b)(2)(ii)

	(iii)	Section I	(c)

L25.4

Section II, Section III

(a)	Section II, Section III	(a)

	(a)(i)	Section II, Section III	(a)(1)

	(a)(ii)	Section II, Section III	(a)(1)

	(a)(iii)	Section II 	(a)(2), (a)(3)

Section III	(a)(2)

	(a)(iv)	Section II	(a)(4)

	(a)(iv)(a)	Section II	(a)(4)(i)

	(a)(iv)(b)	Section II	(a)(4)(ii)

	(a)(iv)(c)	Section II	(a)(4)(iii)

	(a)(v)	Section II 	(a)(3)

Section III	(a)(2)

	(a)(vi)	Section II	(a)(5)

Section III	(a)(3)

	(a)(vii)	Section I	(d)

	(b)	Omit

(b)(i)	Section II	(b)(9)

Section III	(b)(6)

	(b)(i)(1)	Section II	(b)(4)

	(b)(i)(1)(a)	Section II	(b)(4)(i)

	(b)(i)(1)(b)	Section II	(b)(4)(ii)

	(b)(i)(2)	Section II	(b)(6)

	(b)(i)(2)	Section III	(b)(3)

	(b)(i)(3)	Section II	(b)(7)

	(b)(i)(3)	Section III	(b)(4)

	(b)(i)(3)(a)	Section II	(b)(7)(i)

Section III	(b)(4)(i)

	(b)(i)(3)(a)(i)	Section II	(b)(7)(i)(1)

Section III	(b)(4)(i)(1)

	(b)(i)(3)(a)(ii)	Section II	(b)(7)(i)(2)

Section III	(b)(4)(i)(2)

	(b)(i)(3)(a)(iii)	Section II	(b)(7)(i)(3)

Section III	(b)(4)(i)(3)

	(b)(i)(3)(a)(iv)	Section II	(b)(7)(i)(4)

Section III	(b)(4)(i)(4)

	(b)(i)(3)(a)(v)	Section II	(b)(7)(i)(5)

Section III	(b)(4)(i)(5)

	(b)(i)(3)(a)(vi)	Section II	(b)(7)(i)(6)

Section III	(b)(4)(i)(6)

	(b)(i)(3)(b)	Section II	(b)(7)(ii)

Section III	(b)(4)(ii)

	(b)(i)(3)(c)	Section II	(b)(7)(iii)

Section III	(b)(4)(iii)

	(b)(i)(3)(d)	Section II	(b)(7)(iv)

Section III	(b)(4)(iv)

	(b)(i)(3)(e)	Section II	(b)(7)(v)

Section III	(b)(4)(v)

	(b)(ii)	Section II	(b)(8)

Section III	(b)(5)

	(b)(ii)(a)	Section II	(b)(8)(i)

Section III	(b)(5)(i)

	(b)(ii)(b)	Section II	(b)(8)(ii)

Section III	(b)(5)(ii)

	(b)(ii)(c)	Section II	(b)(8)(iii)

Section III	(b)(5)(iii)

	(b)(ii)(d)	Section II	(b)(8)(iv)

Section III	(b)(5)(iv)

	(b)(iii)	Section II	(b)(3)

Section III	(b)(1)

	(c)	Section II, Section III	(c)

	(c)(i)	Section II, Section III	(c)(1)

	(c)(ii)	Section II, Section III	(c)(2)

L25.5

Section I	(e)(4)

	Table 2

	Cross-Reference of New and ARAC Proposed Appendix L Paragraph Numbers

New	Original ARAC Proposal

Appendix L	Applicability	L25.1

	Section I

L25.2

(a)	L25.2	(a)

	(a)(1)	L25.2	(a)(i)

	(a)(1)(i)	L25.2	(a)(i)(1)

	(a)(1)(ii)	L25.2	(a)(i)(2)

	(a)(1)(iii)	New

(a)(2)	L25.2	(a)(ii)

	(a)(2)(i)	L25.2	(a)(ii)1

	(a)(2)(ii)	L25.2	(a)(ii)(2)

	(a)(2)(iii)	L25.2	(a)(ii)(3)

	(a)(3)	L25.2	(a)(iii)

	(b)	L25.2	(b)

	(b)(1)	L25.2	(b)(i), (b)(ii)

	(b)(1)(i)	L25.2	(b)(i)(1)

	(b)(1)(ii)	L25.2	(b)(iii)

	(b)(2)	L25.2	(b)(iv)

	(b)(2)(i)	L25.2	(b)(iv)(1)

	(b)(2)(ii)	L25.2	(b)(iv)(2)

	(b)(3)	New

(c)	L25.3	(iii)

	(d)	L25.4	(a)(vii)

	(e)	New

(e)(1)	New

(e)(2)	New

(e)(3)	New

(e)(4)	L25.5

(e)(5)	New

	Section II

L25.4

(a)	L25.4	(a)

	(a)(1)	L25.4	(a)(i), (a)(ii)

	(a)(2)	L25.4	(a)(iii)

	(a)(3)	L25.4	(a)(iii), (a)(v)

	(a)(4)	L25.4	(a)(iv)

	(a)(4)(i)	L25.4	(a)(iv)(a)

	(a)(4)(ii)	L25.4	(a)(iv)(b)

	(a)(4)(iii)	L25.4	(a)(iv)(c)

	(a)(5)	L25.4	(a)(vi)

	(b)(1)	L25.3	(i)

	(b)(2)(i)	New

(b)(2)(ii)	L25.3	(ii)

	(b)(3)	L25.4	(b)(iii)

	(b)(4)	L25.4	(b)(i)(1)

	(b)(4)(i)	L25.4	(b)(i)(1)(a)

	(b)(4)(ii)	L25.4	(b)(i)(1)(b)

	(b)(5)	New

(b)(6)	L25.4	(b)(i)(2)

	(b)(7)	L25.4	(b)(i)(3)

	(b)(7)(i)	L25.4	(b)(i)(3)(a)

	(b)(7)(i)(1)	L25.4	(b)(i)(3)(a)(i)

	(b)(7)(i)(2)	L25.4	(b)(i)(3)(a)(ii)

	(b)(7)(i)(3)	L25.4	(b)(i)(3)(a)(iii)

	(b)(7)(i)(4)	L25.4	(b)(i)(3)(a)(iv)

	(b)(7)(i)(5)	L25.4	(b)(i)(3)(a)(v)

	(b)(7)(i)(6)	L25.4	(b)(i)(3)(a)(vi)

	(b)(7)(ii)	L25.4	(b)(i)(3)(b)

	(b)(7)(iii)	L25.4	(b)(i)(3)(c)

	(b)(7)(iv)	L25.4	(b)(i)(3)(d)

	(b)(7)(v)	L25.4	(b)(i)(3)(e)

	(b)(8)	L25.4	(b)(ii)

	(b)(8)(i)	L25.4	(b)(ii)(a)

	(b)(8)(ii)	L25.4	(b)(ii)(b)

	(b)(8)(iii)	L25.4	(b)(ii)(c)

	(b)(8)(iv)	L25.4	(b)(ii)(d)

	(b)(9)	L25.4	(b)(i)

	(c)	L25.4	(c)

	(c)(1)	L25.4	(c)(i)

	(c)(2)	L25.4	(c)(ii)

Section III

L25.4

(a)	L25.4	(a)

	(a)(1)	L25.4	(a)(i), (a)(ii)

	(a)(2)	L25.4	(a)(iii), (a)(v)

	(a)(3)	L25.4	(a)(vi)

	(b)(1)	L25.4	(b)(iii)

	(b)(2)	New

(b)(3)	L25.4	(b)(i)(2)

	(b)(4)	L25.4	(b)(i)(3)

	(b)(4)(i)	L25.4	(b)(i)(3)(a)

	(b)(4)(i)(1)	L25.4	(b)(i)(3)(a)(i)

	(b)(4)(i)(2)	L25.4	(b)(i)(3)(a)(ii)

	(b)(4)(i)(3)	L25.4	(b)(i)(3)(a)(iii)

	(b)(4)(i)(4)	L25.4	(b)(i)(3)(a)(iv)

	(b)(4)(i)(5)	L25.4	(b)(i)(3)(a)(v)

	(b)(4)(i)(6)	L25.4	(b)(i)(3)(a)(vi)

	(b)(4)(ii)	L25.4	(b)(i)(3)(b)

	(b)(4)(iii)	L25.4	(b)(i)(3)(c)

	(b)(4)(iv)	L25.4	(b)(i)(3)(d)

	(b)(4)(v)	L25.4	(b)(i)(3)(e)

	(b)(5)	L25.4	(b)(ii)

	(b)(5)(i)	L25.4	(b)(ii)(a)

	(b)(5)(ii)	L25.4	(b)(ii)(b)

	(b)(5)(iii)	L25.4	(b)(ii)(c)

	(b)(5)(iv)	L25.4	(b)(ii)(d)

	(b)(6)	L25.4	(b)(i)

	(c)	L25.4	(c)

	(c)(1)	L25.4	(c)(i)

	(c)(2)	L25.4	(c)(ii)

We discuss each paragraph of the proposed new Appendix L below.

Section I - Design Requirements.

I(a)  Airplane Systems.

I(a)(1)  Operation in icing conditions.

I(a)(1)(i).

ETOPS airplanes would have to comply with the requirements of section
25.1419 for operation in icing conditions.

Explanation.

Section 25.1419 sets out the requirements for certifying a transport
category airplane for flight into icing conditions.  This requirement is
optional in that an applicant may choose to not apply for approval in
icing conditions.  However, from a practical standpoint no one would
request certification of an airplane that did not meet this requirement.
 This proposed new regulation makes this approval mandatory for ETOPS
approval.

I(a)(1)(ii).

The airframe and propulsion system ice protection would have to be
capable of continued safe flight and landing at engine-inoperative and
decompression altitudes in icing conditions.  Following the loss of an
engine at cruising altitude, an airplane will drift down to a lower
(engine-inoperative) altitude.  A decompression altitude is an altitude
to which an airplane must descend following the loss of cabin pressure.
Decompression altitudes are 10,000 feet MSL and below.

Explanation.

This paragraph would codify AC 120-42A, paragraph 8(b)(11) for airframe
ice protection.  The applicant would have to demonstrate that the
airplane is capable of continued safe flight and landing at the
decompression altitudes.  This rule would require the applicant to
demonstrate to the FAA that the anti-icing systems on the airplane will
assure the airplane’s capability to continue to operate during a
worst-case diversion.  The ARAC Working Group recommended a standard
that would require the capability to safely divert if anti-icing cannot
be shown available for all scenarios.  This recommended standard tacitly
assumes that airplane ice protection is not necessarily required during
an ETOPS diversion.  We disagree with this recommendation.  Paragraph
8(b)(11) of AC 120-42A says that the airframe and propulsion ice
protection should be shown to provide adequate capability for the
intended operation.  The AC says that this should account for prolonged
exposure to lower altitudes associated with the engine-out diversion,
cruise, holding, approach and landing.  We do not interpret this
paragraph as allowing circumstances where anti-icing would not normally
be available during an ETOPS diversion.  An applicant would have to
address any failure conditions where the ice-protection systems would
not be available during an ETOPS diversion as part of the safety
analysis required by section 25.1309.

The preamble justification provided in the ARAC proposal stated that
this rule “will also require the applicant to demonstrate that the
non-heated (or “non-deiced”) areas of the airplane will not pick up
a load of ice that would make the airplane uncontrollable or create too
much drag to complete the diversion.”  This statement is consistent
with how the FAA has applied the criteria of AC 120-42A paragraph
8.(b)(11) for all airplanes certified using that policy.  However, the
ARAC recommendation did not include this specific provision.  We have
added this requirement into the proposed rule as a new paragraph
I(a)(1)(iii).  It is consistent with ARAC’s recommendation and
consistent with what has been standard ETOPS type certification practice
to consider the accumulation of ice on the non-heated or non-deiced
areas of the airplane.

The associated advisory material for this proposed requirement will
describe the conditions and assumptions that an applicant may use in
simulating a diversion icing environment for showing compliance with the
proposed rule.  The advisory material will also provide guidance for
developing analyses or testing that would justify not having to assume
that the entire diversion would be in icing conditions.

I(a)(2) Electrical Power Supply.

I(a)(2)(i) and (ii).

These paragraphs would establish reliability requirements for the
electrical power supply system on an ETOPS flight.

Explanation.

Paragraphs I(a)(2)(i) and (ii) are basically a restatement of section
25.1309 for the electrical power supply system in consideration of the
ETOPS mission.  We agree with the ARAC’s apparent intent that these
paragraphs, in conjunction with the new sections 25.1535(a) and (b),
codify paragraphs 8(b)(1), 8(b)(6), 8(b)(7) and 8(c)(4) of AC 120-42A
for the electrically powered ETOPS significant systems.  These
paragraphs establish the overall system safety objectives for these
systems in extended operations.

The proposed rule is not as explicit as AC 120-42A in stating the types
of functions that an applicant would need to consider in applying the
safety objectives of section 25.1309 for an ETOPS mission.  The general
philosophy of the proposed rule is to let the existing policy associated
with section 25.1309 compliance determine the design analysis for ETOPS.
 This philosophy is consistent with paragraph (c)(1) of the Boeing Model
777 ETOPS special conditions, which requires the applicant to comply
with part 25 with regards to the ETOPS mission.  Although we discuss
this regulatory philosophy here in reference to the specific electrical
power supply system requirements, it also applies to other ETOPS
significant systems that are not specifically addressed in the proposed
rule.

The FAA’s intent for paragraphs I(a)(2)(i) and (ii) is to assure that
the applicant properly focuses on electrical power redundancy and
reliability when considering ETOPS mission scenarios  in showing
compliance with section 25.1309.  On a two-engine airplane, the
potential lack of redundancy available for electrical power generation
makes this requirement especially important.  However, the new emphasis
is in paragraph (ii).  It will be up to the applicant to demonstrate
which functions would reduce the capability of the airplane or the
ability of the crew to cope with adverse operating conditions.  It is
not realistic, for instance, for an applicant to state that operating
for an extended period of time on suction feed would not reduce the
capability of the airplane to cope with adverse operating conditions
(for example, negative g or turbulence).  Additionally, the applicant
would have to determine what navigation and communication systems must
be powered by emergency generation sources during a worst case ETOPS
diversion.

I(a)(2)(iii).

This paragraph would require at least three independent electrical
generation sources for airplanes being certified for greater than 180
minutes.

Explanation.

Paragraph I(a)(2)(iii) would codify the three generator requirement of
paragraph 8.(b)(8) in AC 120-42A.  However, the ARAC recommendation only
applies this requirement to airplanes being certified for greater than
180-minute ETOPS.  The AC specifies three generators for any ETOPS
approval.  This specific requirement created much discussion within the
ARAC ETOPS Working Group.  Paragraph I(a)(2)(iii) as proposed in this
notice represents the compromise position that allowed working group
consensus.  The following paragraphs are the ARAC’s recommended
justification for this requirement.  The FAA is publishing them without
comment.

This topic is inextricably linked to the discussion about MMELs.  The
MMEL or Master Minimum Equipment List allows an airplane operator to fly
without equipment not on this fully functioning.  There is concern that
without a specific number of generators required in the rule, the MMEL
could strip away some of the redundancy required for long-range flight.
The arguments against a prescriptive number are generally as follows:

(1) Defining a number of generators would not assure proper system
reliability (for example, is it better to have three generators with a
Mean Time Between Failures (MTBF) of 20,000 hours each, or four
generators with an MTBF of 3,000 each?)

(2) Defining a number of generators would either artificially constrain
or give a “pass” to future airplane designs.  For instance, if a new
airplane had a system architectural need for 8 generating systems,
requiring three in the ETOPS rule would not assure an adequately safe
design.

(3) Trying to address the formation of the MMEL in Part 25 is
impractical and inconsistent with agreed- to policies for MMEL
development.

“Nonetheless, it was agreed that there should be a tie-in between the
analysis performed for Part 25 ETOPS approval and the analysis the
Flight Operations Evaluation Review Board (FOEB), who develop the MMEL,
used in determining dispatch criteria.  This is almost always the case
in today’s process, but formalizing the process would be a positive
step.

“Therefore, an additional paragraph has been added to the ETOPS
regulation to require a minimum number of electrical generators.  This
requirement codifies the existing AC 120-42A electrical generator
redundancy criteria.  The intent of this requirement is to ensure future
airplanes to be certified for ETOPS have an electrical generation system
architecture equivalent to the 737, 757, 767, 777 and A310, 320, A330
era airplanes.  Future airplane electrical system architectures may be
significantly different from today’s airplanes, but the architecture
must be equivalent from the perspective of robustness to independent
failure scenarios.”

I(a)(3) Time limited systems.

This paragraph would require that the applicant state the capability of
most time limiting ETOPS significant system in the airplane flight
manual.

Explanation.

As stated previously for the revised paragraph 25.857(c)(2), this
requirement would provide the information that the operators would need
to comply with the applicable operating requirements.  Advisory Circular
120-42A has two main categories of ETOPS approval (120 minutes and 180
minutes) based on demonstrated propulsion system reliability.  The ETOPS
approval, as stated in the airplane flight manual in currently approved
ETOPS airplanes, identifies the maximum approved diversion time based as
one of these two times.  In order to qualify for the ETOPS type design
approval, the applicant must design the airplane time-limited systems to
support this maximum approved diversion time with an additional 15
minutes capability to allow for airplane holding, approach and landing.

In the context of proposed paragraph I(a)(3), we do not consider the
propulsion system as a time-limited ETOPS significant system.  Proposed
Appendix L, section II(a), codifies the service experience method for
ETOPS approval from AC 120-42A.  Paragraph II(a)(4) of this section
defines the required world fleet in-flight shutdown rate with each level
of ETOPS operational approval.  In this particular case, the level of
ETOPS approval refers to the operational approval authority defined in
the operating rules, not the time-limited system capability required in
paragraph I(a)(3).

I(b) Propulsion system.

I(b)(1) Fuel System Design.

This paragraph would require design features to ensure that fuel
necessary to complete an ETOPS mission will be available at the flow and
pressure required for the engine, during a diversion for the longest
time being approved for the airplane.  The proposed rule includes a
requirement for alerts to the crew when the fuel available to the
engines falls below the level required to complete the mission which can
occur because of fuel mismanagement, abnormal transfer between tanks,
and fuel loss.

Explanation.

Fuel system design and the ability of the crew to properly deal with
fuel system malfunctions are arguably the most important issues facing
the designer of ETOPS airplanes.  The proposed rule (with corresponding
AC guidance) addresses the need for:

(1) Positive fuel pressure at the engine fuel pump (no suction feed);

(2) Fuel availability following system failures (no hidden/trapped fuel,
functional crossfeed valves, etc.); and

(3) Flight deck alerts when fuel available to the engines falls below
the level required to complete the mission.

The proposed requirements would codify the intent of paragraph
8.(b)(2)(iii) of AC 120-42A, paragraph (c)(3)(i)(C) of the Boeing 777
ETOPS special conditions, and items 7 and 8 of the type design
provisions of the 207 minute ETOPS Policy Letter EPL 20-1.

There has been some discussion regarding newer generation airplanes
(B777) and their system architecture being the standard by which
operations beyond 180 minutes will be judged.  Currently, all transport
category aircraft are required to perform suction feed testing as part
of basic Part 25 certification, which requires the applicant to simulate
an all Alternating Current (AC) power loss at the highest altitude the
airplane is used in service (“service ceiling”).  The testing is
performed to demonstrate that in the event of an all AC power loss,
there is still ability (at some safe altitude) to re-start the engines
after flameout on suction feed and generate thrust to a safe landing.
This demonstration does not, however, provide any assurance that the
engines can operate on suction feed for the long duration diversion
times envisioned for ETOPS.  The engines are certified with a minimum
engine fuel pump inlet pressure limit of typically one-half pound per
square inch (0.5 psi) above the ambient air pressure, or the fuel vapor
pressure, whichever is higher.  Section 25.955 requires that the
airplane fuel system deliver fuel to the engine at this minimum pressure
for the maximum fuel flow required by the engine. Without the fuel boost
pressure, airplanes cannot comply with § 25.955.  The fuel system
design requirements proposed in this notice are intended to ensure that
continued operation on suction feed is not a practical possibility on
ETOPS airplanes.  Paragraph I(b)(1) would be applicable to all ETOPS
airplanes irrespective of the number of engines.

Loss of normal electrical power to the boost pumps is the primary cause
of the loss of fuel system boost pressure.  A specific fuel feed
capability requirement has been added for twin-engine ETOPS operations
beyond 180 minutes that is intended to address the concerns about loss
of fuel boost pressure raised in the development of the 207 minute ETOPS
policy.  The 207-minute policy included a provision to also address fuel
cross-feed capability following the failure of normal electrical power.
Proposed paragraph I(b)(1)(i) would require that the applicant design
the airplane fuel system with a fuel boost pump in each main tank and
the capability to operate at least one crossfeed valve by a back-up
electrical generation source other than the primary engine driven or APU
driven generators.  There is an exception in the proposed rule for fuel
system designs for situations when electrical power does not provide
required fuel boost pressure or crossfeed valve actuation.  Although
this is a specific design requirement applicable to two engine airplanes
for ETOPS beyond 180 minutes, the overall design objective underlying
paragraph I(b)(1) is applicable to all ETOPS airplanes.  The applicant
may use the same design features required by paragraph I(b)(1)(i) as
part of their compliance with paragraph I(b)(1) for airplanes not
specifically covered by this subparagraph.

The other possible source of the loss of fuel boost pressure is
mechanical failure of fuel system components.  These include pump
failures or performance degradation, valve failures, and plumbing
failures causing internal or external fuel leaks that result in
significant fuel pressure loss. Possible design alternatives to address
mechanical failures as a source of loss of fuel system boost pressure
are:

1. Redundancy (additional boost pumps, cross-feed valves, etc.)

2. Improved component reliability (including any instructions for
continued airworthiness necessary to maintain that level of reliability)

3. Enlarged main fuel tank capacity (to minimize the effect of loss of
boost pressure in other fuel tanks)

4. A time-limited engine fuel inlet pressure limit at which the engine
can demonstrate acceptable operation and integrity for the longest
diversion time for which the airplane manufacturer is requesting
approval.

Each of these design alternatives has advantages and disadvantages that
the manufacturer would need to consider in designing an airplane to
comply with the proposed rule.

We intend that the proposed paragraph I(b)(1) would preclude all causes
of loss of system boost pressure in extended operations.  This is
consistent with the overall safety objectives established by the part 25
airworthiness standards for potentially catastrophic failure conditions.

Proposed paragraph I(b)(1)(ii) would require flight deck alerts when the
fuel available to the engines falls below that required to complete the
mission.  The FAA’s intent is that the required flight deck alerts
would give flight crews clear warning of impending fuel exhaustion with
enough time to safely land the airplane before the condition becomes
critical.  As a minimum, the manufacturer would have to design the
flight deck alerts to address the types of failures or human errors that
have resulted in airline fuel exhaustion events in service.

Examples of fuel exhaustion events include an Air Canada Boeing 767 that
landed on an abandoned runway after both engines flamed out from fuel
exhaustion.  In this case, the normal low fuel alerts did not function
because of a fuel quantity indication system failure.  The fuel
exhaustion was caused by the crew not receiving a low fuel alert, in
combination with an unapproved airplane dispatch and a fueling error.
An Air Tran Airbus A330 landed in the Azores following flameout of both
engines caused by fuel exhaustion due to an unrecognized engine fuel
leak.  The AC provides guidance on critical fuel system alerts derived
from these types of fuel loss events that have occurred in the current
generation of aircraft.

I(b)(2) APU design.

If operation of an auxiliary power unit (APU) were needed to comply with
the ETOPS requirements, the applicant would have to demonstrate that the
APU has adequate reliability for that operation.  Also, if in-flight
start and run capability is necessary, the APU in-flight operating
envelope would have to extend to the maximum operating altitude of the
airplane or 45,000 feet, whichever is lower

Explanation.

The electrical system reliability standard contained in AC 120-42A
envisions three independent alternating current (AC) electrical
generators.  Besides the two engine driven generators, an auxiliary
power unit (APU) could drive a third generator to meet this standard.
Auxiliary power units are separately controlled small engines that are
installed on an aircraft to power services when the main aircraft
engines are not running.  Airlines normally use an airplane APU at the
gate to provide electrical power for onboard lighting and an air source
for the air conditioning system between flights.  Besides this normal
function, the FAA may allow an airline to use an APU powered electrical
generator during a revenue flight when a main engine generator is not
working.

The electrical system reliability requirements proposed in this notice
do not specifically require three independent generators except for
airplanes being certified for ETOPS diversion times greater than 180
minutes.  Current two engine aircraft that the FAA has approved for
ETOPS would only be able to comply with the proposed requirement for
electrical system reliability by having three independent generators.
Other required aircraft system functions also may be powered by an APU.
Proposed paragraph I(b)(2) of the rule would require that if the
applicant is going to rely on the APU for compliance with the ETOPS
requirements:

(1) The APU has to have adequate reliability; and

(2) If it must be started and run in-flight, the APU must demonstrate
that it has the capability to start and perform its intended function up
to the maximum operating altitude of the airplane, or 45,000 feet,
whichever is lower

The major reason for wanting high altitude APU in-flight start
capability is to avoid having flight level changes that would cause the
flight to have to cross through established flight track systems just to
start the APU.  Also, once the flight leaves the established track
system it can be very difficult, or impossible to re-enter the track
system, reducing the pilot’s flexibility to fly the optimum flight
plan.  Having an in-flight start capability up to 45,000 feet mitigates
these concerns.

“Adequate” reliability consumed much of the Working Group’s
discussion time during development of the rule.  This term can only be
placed in context by understanding the overall electrical and pneumatic
system architecture of the airplane.  For instance, if an applicant has
installed generators with inadequate reliability, their mean time
between failure (MTBF) may require an extremely reliable APU generator
in order to comply with the electrical system reliability objectives of
§ 25.1309.  This would drive the applicant into a significant APU
reliability demonstration program.  The reverse could also be true.  An
electrical system may have generators with an excellent MTBF of 100,000
hours with additional non-APU back-up sources.  In this case, the
“required” reliability of the APU would be less than for current
airplane electrical systems with APU driven generators.  However, the
applicant would have to present a convincing system level reliability
analysis backed by validated component reliability data before the FAA
would accept an assumption of lower APU reliability from that required
for today’s airplanes.

An APU has traditionally been used only to “back-up” the electrical
system, and the proposed new regulatory and advisory material focuses on
this function.  No current aircraft utilizes an APU to provide
“back-up” pneumatic system capability to meet ETOPS significant
system reliability standards.  However, the associated advisory circular
addresses the possible operational need for APU pneumatics on the ground
to power the cabin air conditioning system following an airplane
diversion.  If the APU is necessary as a bleed source to comply with
section 25.1309 or the new section 25.1535, the applicant would have to
define the operating envelope of where it can perform this intended
function.  The FAA requires this for any APU required function under the
existing airworthiness standards of part 25.  Currently most APUs can
only provide both bleed air and electrical power at lower cruise
altitudes, and cannot provide enough bleed air to power an air
conditioning pack at the airplane service ceiling.  The applicant would
have to fully account for the use of a “limited” ETOPS APU operating
envelope in substantiating compliance with section 25.1309 or section
25.1535.  In accounting for a limited APU operating envelope, the
applicant would have to address the operational implications, including
air traffic control, of having to descend to a lower altitude in order
to use the required APU function.

ARAC recommended the following language for paragraph I(b)(2).  “If
operation of the APU installation is required to comply with this
appendix, the applicant must…”  Except for the electrical system,
which has specific requirements in proposed Appendix L, all other
potential airplane system functions that could be powered by an APU are
addressed by the overall ETOPS requirement contained in section
25.1535(a).  Examples include the cabin pressurization and hydraulic
systems, which may be powered by an APU.  The ARAC recommended proposed
rule and preamble states the intent that this requirement should not be
limited to just electrical system reliability.  We have corrected this
oversight by replacing “this appendix” with section 25.1535 in
proposed paragraph I(b)(2).

I(b)(3) Engine oil tank design.

The engine oil filler cap design would have to comply with a proposed
change to section 33.71(c)(4), which will require oil tank cap designs
that prevent hazardous oil loss in the event of an oil tank cap
installation error.

Explanation.

See the proposed change to section 33.71(c)(4) for an explanation of the
reasons for this change.  We added paragraph I(b)(3) to Appendix L to
ensure that engines installed on ETOPS airplanes comply with the part 33
requirement.

I(c) Engine condition monitoring.

The applicant would have to define and validate, as required, an engine
condition monitoring process in accordance with part 33, Appendix A,
paragraph A33.4.

Explanation.

This requirement would codify paragraph a(5) of Appendix A of AC 120-42A
and paragraph (b)(2) of the Boeing Model 777 ETOPS special conditions.

With the propulsion system reliabilities existing on today’s long
range airplanes, the FAA is very concerned that the biggest threat to
ETOPS safety is the risk associated with common cause, cascading
failures and fuel exhaustion.  Several of the proposed requirements in
this notice would address these threats.  The engine condition
monitoring process requirement specifically addresses the potential of
additional engine failure or failures resulting from the increased
thrust or service demands on the remaining engine or engines.

Operators would be required, in the proposed changes to parts 121 and
135, to have an engine condition monitoring program as part of their
ETOPS maintenance program.  Paragraph I(c) of Appendix L and paragraph
A33.4 in part 33 would require the airplane and engine manufacturer to
provide the instructions necessary for an operator to develop this
program.

Since the potential for a catastrophic loss of thrust is greater on a
two engine airplane than on airplanes with more than two engines, this
proposed rule would require that the applicant validate the engine
condition monitoring process for use on two engine airplanes before
ETOPS approval.  For airplanes with more than two engines, the applicant
would need only to define the process.

I(d) Configuration, maintenance and procedures.

The applicant would have to identify configuration, maintenance, or
operational standards necessary to maintain appropriate reliability or
to obtain required capability for ETOPS in a Configuration, Maintenance,
and Procedures (CMP) document.

Explanation.

Paragraph I(d) of the proposed rule would codify material AC 120-42A.
All existing policy on revising CMP documents would remain in force
under the new rule.  This is discussed more fully previously under
general issues in the general discussion of the proposal.

I(e) Airplane flight manual.

This paragraph would specify certain information that the airplane
flight manual (AFM) must contain for ETOPS approval.

Explanation.

This proposed requirement would codify paragraph 8(f)(1) of AC 120-42A.
ARAC did not include this paragraph in their proposed rule draft.
However, there are provisions within the AC paragraph that the FAA has
required in all ETOPS type design approvals issued since 1985.  The
ETOPS approval statement contained in AC subparagraph 8(f)(1)(vi) is
particularly important as applicants have based their airplane flight
manual ETOPS approval statements on this wording.  We are proposing to
add the relevant provisions from AC paragraph 8(f)(1) into this notice
in order to maintain continuity with the historical AFM ETOPS
requirements.

The two provisions from AC 120-42A that we are not proposing to
incorporate directly into proposed paragraph I(e) are subparagraphs
8(f)(1)(iii) and (v).  Subparagraph 8(f)(1)(iii) addresses inclusion of
the performance data used to comply with the engine-inoperative
diversion criteria of the flight dispatch considerations in the
operational approval section of the advisory circular.  Contrary to this
advisory circular provision, the FAA has not required that the
performance data be included in the approved parts of the AFM and have
not included this provision in the proposed rule.  Subparagraph
8(f)(1)(v) asks for a description or reference to a document containing
the approved airplane configuration CMP standard.  The CMP document
identification has traditionally been included in the ETOPS approval
statement defined in subparagraph 8(f)(1)(vi) for ETOPS airplanes
approved under the existing policy.  Therefore, we have combined
subparagraphs 8(f)(1)(v) and 8(f)(1)(vi) from the AC into the new
proposed paragraph I(e)(5).

We are also proposing to add the original AFM requirement from the ARAC
proposal into paragraph I(e)(4).  This proposed requirement is not in AC
120-42A.  This proposed paragraph would require the applicant to define
the maximum ETOPS diversion time capability required by paragraph
I(a)(3) into the airplane flight manual in accordance with §
25.1581(a)(2),”Furnishing Information.”  This proposed requirement
provides a cross-reference to proposed paragraph I(a)(3), which would
require that the ETOPS capability defined by most limiting ETOPS
significant system capability be stated in the airplane flight manual.

Section II – Two Engine Airplanes.

In addition to the requirements of section I, an applicant for a two
engine airplane would have to also show compliance with one of three
proposed requirements of section II.

II(a) Service experience method.

The applicant would have to demonstrate that the airplane and engine
combination for which approval is sought has the required airplane and
propulsion system capability to safely conduct an ETOPS mission with the
maximum diversion for which approval is sought, and has achieved
required airframe and propulsion system reliability based upon fleet
in-service experience.

Explanation.

Proposed sub-section II(a) would codify part of the existing approval
process based on service experience, as contained in AC 120-42A for two
engine airplanes.  This includes the most significant aspect of this
process, the propulsion system assessment contained in Appendix 1 of the
advisory circular.  The AC process is predicated on having a sufficient
amount of service experience to give the FAA enough data to assess the
overall suitability of a two-engine airplane for ETOPS approval.

The AC type design assessment criteria are divided into two parts.  The
first part defines specific system design capability and safety
objectives in order to provide a minimum design standard for airplanes
operating in ETOPS.  This part of the AC criteria is addressed in
proposed section 25.1535(a) and (b), and section I of proposed part 25
appendix L.

The second part of the AC process is a review of in-service problems and
identification of appropriate corrective actions to prevent problems
that could have an adverse effect on ETOPS safety.  Part of this review
is to establish that the airplane and propulsion systems have an
appropriate level of reliability to meet the safety objectives defined
in the AC.  Appendix 1 of the AC defines an amount of service experience
that would normally be required in order to give a sufficient database
to evaluate propulsion system reliability.  We are proposing to address
this second part of the AC type design assessment process in sub-section
II(b) of this notice.

II(a)(1) Required service experience.

This paragraph would require that an applicant who desires to obtain
ETOPS type design approval using service experience conduct a
reliability review after accumulating 250,000 worldwide fleet engine
hours on the airplane and engine combination for which approval is being
sought.  The number of hours could be reduced if adequate compensating
factors are identified which give a reasonable equivalent database.  A
significant portion of the 250,000 engine hours would have to be
obtained on the candidate airplane.

Explanation.

Proposed paragraph II(a)(1) would codify the service experience
eligibility criteria from paragraph a(1) of Appendix 1 of AC 120-42A.

II(a)(2) Propulsion system assessment.

Paragraph II(a)(2)(i) would require an applicant to conduct a propulsion
system assessment based on data collected from the entire fleet of the
specific airplane and engine combination for which approval is sought.
Paragraph II(a)(2)(ii) would require an applicant to identify corrective
actions to prevent future occurrences of engine in-flight shutdowns or
loss of thrust control.

Explanation.

Paragraph II(a)(2)(i) would codify the reliability data base criteria
from paragraph b. of Appendix 1 of AC 120-42A.  ARAC did not include the
reliability data base criteria in their proposed rule draft, but did
have it in their associated draft advisory material.  In paragraph
10(a)(iii) of the draft part 25 advisory circular, ARAC stated “A
propulsion system assessment must be based on the following data,
collected from the entire fleet of the specific airplane/engine
combination type for which approval is sought...”.  Since ARAC clearly
stated its intent that an applicant “must” conduct a propulsion
system assessment on the specific list that follows, and based on the
clear reference to the existing policy from Appendix 1 of AC 120-42A, we
have incorporated this section from the ARAC draft advisory circular
into proposed paragraph II(a)(2)(i) of this notice.

Paragraph II(a)(2)(ii) would codify the intent of the propulsion system
assessment criteria from paragraph 3 of Appendix 1 of AC 120-42A.  This
is the so-called “fix-all-problems” requirement that has been the
practice for all ETOPS type design approvals that the FAA has given
using the service experience approval process defined in AC 120-42A.

The corrective actions that the applicant identifies in compliance with
proposed paragraph II(a)(2) would be included in the approved
configuration, maintenance, and procedures (CMP) document as a condition
of the ETOPS approval.

II(a)(3) Airplane systems assessment.

The applicant would have to show compliance with section 25.1535(a)
using available in-service reliability data for ETOPS significant
systems.  The applicant would have to identify corrective actions to
prevent future occurrences of ETOPS significant system failures
occurring in service.

Explanation.

The first part of this paragraph would codify the intent of paragraph
8(c)(1) of AC 120-42A for those ETOPS significant airplane systems
addressed in proposed §25.1535(a).  This AC paragraph states that the
analysis and demonstration of airframe and propulsion system failure
effects and reliability provided by the applicant should be based on
in-service experience and the longest diversion time for the airplane.

The second part of proposed paragraph II(a)(3) is an extension of the
“fix-all-problems” approach used in the propulsion system assessment
that we are proposing in paragraph II(a)(2).  For all airplanes approved
using the policy contained in AC 120-42A, the FAA has required an
applicant to define effective corrective actions for all in-service
problems known to result in, or potentially result in, airplane
diversions.  The FAA has required this in order to enter ETOPS service
with the highest quality airplane.  An applicant rarely considers known
system failure conditions to be acceptable occurrences in service that
they account for in their system failure analyses submitted for
compliance with section 25.1309.  Therefore, this fix all problems
approach is appropriate in reassessing compliance with the applicable
airworthiness requirements of proposed section 25.1535(a).

The corrective actions that the applicant identifies in compliance with
proposed paragraph II(a)(3) would be included in the approved
configuration, maintenance, and procedures (CMP) document as a condition
of the ETOPS approval.

II(a)(4) In-flight shutdown (IFSD) rates.

This proposed paragraph defines propulsion system reliability standards
for three levels of ETOPS type design approval.

(i) For operations up to 120 minutes: a rate of approximately 0.05 or
less per 1,000 fleet engine hours with a CMP intended to bring the rate
down to 0.02.

(ii) For operations up to 180 minutes: a rate of approximately 0.02 or
less per 1,000 engine hours with an existing 120 minute CMP standard, or
new or additional CMP requirements that have been demonstrated to
achieve this in-flight shutdown rate.

(iii) For operations greater than 180 minutes: a rate of approximately
0.01 or less per 1,000 engine hours with an existing 120 minute or 180
minute CMP standard, or new or additional CMP requirements that have
been demonstrated to achieve this in-flight shutdown rate.

Explanation.

This proposed paragraph would codify the propulsion system reliability
standards from Appendix 1 of AC 120-42A.  In addition, we are proposing
to add the reliability standard of 0.01 per 1,000 engine hours for ETOPS
greater than 180 minutes that ARAC proposed in their recommended draft
ETOPS rule.

The original ARAC recommendation refers to “target threshold” or
“target” rate.  These terms do not adequately define what would
constitute an acceptable or unacceptable in-flight shutdown rate for
showing compliance with this proposed requirement.  The FAA has similar
concerns about the term “approximately” as used in this proposal,
but this term is in the existing AC 120-42A policy and has been applied
successfully since issuance of the AC.  Therefore, the FAA has
tentatively chosen to retain the term “approximately” as used in the
existing AC policy in this proposed rule.

We have added the qualifier “or less” to the proposed in-flight
shutdown rate requirement.  Without this term, the rule could be
interpreted to mean that the in-flight shutdown rate “must” be the
approximate value specified.  We clearly do not intend that an applicant
with an in-flight shutdown rate well below the requirement would not be
in compliance with the rule.  We have added this additional qualifier in
order to clarify this intent.

The original ARAC recommendation for operations up to 120 minutes was
written in the following manner: “with a required list of corrective
actions that would result in continuing improvement toward an IFSD rate
of 0.02 per 1000 fleet engine-hours.”  We have added “in the CMP
document” in order to clarify where the list of corrective actions
must be contained.

For the proposed requirements for both operations up to 180 minutes and
operations greater than 180 minutes we have added a provision that
considers the effect that existing or new CMP standards have on
compliance with the required in-flight shutdown rate.  In the past, we
granted ETOPS approvals using a 180-minute CMP standard developed from
the 120 minute ETOPS CMP documents.  This has occurred when the
applicant has substantiated, through service experience, additional
requirements that would achieve the desired in-flight shutdown rate for
those airplanes incorporating the additional requirements.  The added
provision proposed in this notice is a statement of existing practice
for granting 180-minute ETOPS approval where the 120-minute standard had
to be modified.  This notice proposes to codify this existing practice
into the rule as noted above.

II(a)(5) Airplane flight test requirements.

This paragraph would require a flight test to validate the adequacy of
the airplane’s flying qualities, performance, and the flight crew’s
ability to deal with engine inoperative and non-normal worst case system
failure conditions expected to occur in service.

Explanation.

This paragraph would codify the intent of paragraph 8(d)(3) of AC
120-42A.  The original ARAC proposed paragraph stated that the proposed
flight test would validate “non-normal worst case probable system
failure conditions.”  This proposed wording would not adequately
reflect how the FAA has applied the AC paragraph being codified.  	The
term “probable” as used in the original ARAC proposal would have a
specific meaning within the type certification community.  As defined by
Advisory Circular 25.1309-1A, probable failures are those anticipated to
occur one or more times during the entire operational life of each
airplane.  Probable failures would most likely only include significant
single failures, or more frequent double failures.  However, we have
required applicants for ETOPS type design approval under AC paragraph
8(d)(3) to demonstrate multiple failure conditions that are much less
frequent in service, such as

(i) the loss of all normal electrical power;

(ii) flight controls powered by an emergency backup hydraulic source;
and

(iii) loss of normal flight instruments.

These types of failure conditions would be expected to occur during the
life of a fleet of airplanes, but not necessarily on each airplane.  We
believe that ARAC may have intended to include these failure conditions
by using the qualifying term “worst case” in their proposal,
however, we are not confident that it would be interpreted correctly
with the wording as ARAC proposed.  We have deleted the word
“probable” and replaced it with system failure conditions
“expected to occur in service” in the proposed rule.  This
clarification more accurately reflects how the FAA has applied the
paragraph 8(d)(3) of AC 120-42A.

II(b) Early ETOPS method.

This part of section II defines requirements that an applicant would
have to comply with to certify an airplane for ETOPS without first
accumulating the service experience that would be required in section
II(a).

Explanation.

This section would codify the early ETOPS process defined in the Boeing
Model 777 ETOPS special conditions 25-ANM-84 for two engine airplanes.
These special conditions defined requirements that allowed the FAA to
approve the Boeing Model 777 airplane for ETOPS without the service
experience normally expected under the policy in AC 120-42A.  The intent
of this proposed sub-section of Appendix L is to define requirements
that would allow the FAA to grant ETOPS approval concurrent with the
original type certification of an airplane.

II(b)(1) Relevant experience assessment.

The applicant would have to identify specific corrective actions taken
on the airplane design to address relevant design, manufacturing,
operational and maintenance problems experienced on previously certified
part 25 airplanes manufactured by the applicant.  Specific corrective
actions would not be required if the nature of the problem is such that
it would not have a significant impact on the safety or reliability of
the system.  The proposed rule would require that this assessment
include the relevant experience of supplier provided ETOPS Group 1
significant systems and similar or identical equipment utilized on
aircraft built by other manufacturers.

Explanation.

This proposed rule would codify paragraph (c)(2) of the Boeing Model 777
ETOPS special conditions 25-ANM-84.  The term “relevant experience”
as used in the proposed rule means the design, manufacturing,
operational or maintenance problems that have, or could have, resulted
in the types of occurrences that would be included in propulsion system
and airplane system assessments conducted in accordance with a service
experience based ETOPS approval process proposed in section II(a).

The intent of this proposed requirement is to take advantage of service
experience on other airplane types built by the applicant as much as is
practical.  This relevant experience assessment is in lieu of service
experience on the actual airplane to be approved and is a major
compensating factor for that direct service experience.

One of the five key elements of the early ETOPS process on the Boeing
Model 777 was the “relevant experience assessment,” or “lessons
learned.”  Simply stated, the intent is for the applicant to review
the failures on previous airplane/engine combinations, and assure that
the causes of those failures are mitigated.  While simple in concept,
the execution of this assessment is significant in scope.  One of the
most significant aspects of this proposed rule is that an applicant with
no previous transport category manufacturing experience would not be
eligible to receive early ETOPS approval.  The FAA considers the
relevant experience assessment as elemental to the early ETOPS process.
Without the ability to perform this assessment including lessons learned
on manufacturing and engineering processes, the FAA could not
confidently grant an early ETOPS approval.

Beyond a certain level of commonality, past experience may not be
relevant to a new design.  This is particularly true where a specific
design feature that contributed to problems in previous airplanes is not
a part of the new airplane design. However, the demonstration of the
applicability of past experience to the new design is inherent in the
relevant experience assessment.

This proposed rule would require that the applicant identify corrective
actions taken to preclude similar problems from occurring on the new
airplane.  Removal from the design of a system, sub-system, or component
that has had problems in the past may be an acceptable corrective
action, as long as it precludes similar problems from occurring.

Where new technology is introduced, the lessons learned assessment
becomes impractical, as there is no previous experience with this
technology.  While this is true, there may still be applicable relevant
experience.  For example, an applicant's previous experience with new
technology introductions may lead to changes in manufacturing and
quality control processes.  Further, lessons learned of general
applicability can be introduced into the new technology design, such as
a general design practice to prevent cross-connector installation.

II(b)(2) Propulsion system design.

II(b)(2)(i) Engine ETOPS eligibility.

This paragraph would require that the engines to be installed on the
airplane be approved for ETOPS eligibility in accordance with proposed
new section 33.200.

Explanation.

Proposed new section33.200 would require that an engine intended for a
two engine ETOPS airplane that does not have the service experience
required by part 25, section II(a), would have to comply with certain
requirements.  The ARAC proposed rule draft did not specifically state
that the engines installed in an early ETOPS airplane must be certified
in accordance with section 33.200.  We have corrected that oversight in
this notice.

We intend that section II(b) of this notice apply to all new airplanes
and engines.  We have considered the possibility that an applicant may
install an already certified engine with existing service experience
onto a new airplane.  In this case, the combined service experience and
early ETOPS approval method of proposed section II(c) would provide a
way of certifying this type of mixed configuration.

II(b)(2)(ii) Design to preclude in-flight shutdowns.

The applicant would have to design the propulsion system to preclude
failures and malfunctions that could result in an engine in-flight
shutdown.  In addition, the applicant would have to substantiate
compliance with this requirement by analysis, test, in-service
experience on other airplanes, or other means that the propulsion system
will minimize failures and malfunctions with the objective of achieving
the following in-flight shutdown rates:

(i) 0.02 or less per 1,000 engine fleet hours for 180 minute ETOPS or
less

(ii) 0.01 or less per 1,000 engine fleet hours for ETOPS beyond 180
minutes

Explanation.

ARAC provided the following justification for this proposed rule.
“This rule section requires that the propulsion system be designed to
preclude failures and malfunctions that could result in an engine
in-flight shutdown.  Propulsion systems on previous airplanes were
designed and certified to be "fail-safe," in compliance with section
25.901 of part 25; in other words, any single failure, or probable
combination of failures, would not jeopardize continued safe flight and
landing of the airplane.  Because safe flight following an engine
shutdown is required by part 25, preventing engine in-flight shutdowns
has not been a major design objective on some previous airplane designs.
 The additional design requirement in this section to preclude failures
and malfunctions that could result in an engine in-flight shutdown has
an enormous effect on propulsion system reliability in that normal
design decisions must now consider whether a failure or malfunction
might result in an engine in-flight shutdown.  The method of compliance
to this section may vary from applicant to applicant, but the intent
remains -- all design features of the propulsion system must preclude
shutdowns or power losses.  This intent is also captured in the proposed
part 33 rule.”

We agree with the justification that ARAC provided.  The “design to
preclude failures and malfunctions that could result in an engine
in-flight shutdown” is one of the most important features of the early
ETOPS special conditions that we required for the Boeing Model 777
airplane.  The FAA had a similar justification for this requirement in
the preamble to those special conditions.  However, the proposed rule
that ARAC recommended did not clearly state this intent.  We have
modified the original ARAC proposal to clarify this stated ARAC intent
and bring the proposed rule in line with the existing Boeing Model 777
ETOPS special conditions.

ARAC did not provide a specific justification for the proposed in-flight
shutdown rate analysis requirement.  Boeing has submitted such an
analysis under compliance with paragraph (c)(5) of the ETOPS special
conditions for the Model 777 airplane.  Paragraph (c)(5) of those
special conditions requires the applicant to define specific new
analyses that will be used to assure engine and airplane system design
integrity.  The addition of a predicted in-flight shutdown rate analysis
into this proposed rule would codify this method of compliance with the
Boeing ETOPS special conditions.

Since in-service experience does not exist on a new airplane, we have
also changed the ARAC proposed rule language for the in-flight shutdown
rate analysis to clarify that the in-service experience to be considered
in this analysis would be from other airplanes. Applicable service
experience would include the same basic engine design or other
propulsion system components on other airplanes manufactured by the
applicant, or by other manufacturers if the applicant has access to that
data and can substantiate its applicability to the new airplane design.

II(b)(3) Maintenance and operational procedures.

The applicant would have to validate all ETOPS significant systems
maintenance and operational procedures. Any problems found would have to
be tracked and resolved through the problem tracking system and
resolution system proposed in paragraph (II)(b)(8).

Explanation.

This proposed rule would codify the intent of paragraph (d)(2) of the
Boeing Model 777 ETOPS special conditions.  The special conditions
paragraph requires the applicant to have a program to systematically
detect and correct problems occurring as a result of improper execution
of maintenance and flight operations.  Boeing has complied with this
requirement by validating maintenance and operational procedures
important to the safety of ETOPS operations.  This proposed rule would
codify this method of compliance.

Human error continues to be a major cause of engine in-flight shutdowns
and forced airplane diversions.  The proposed maintenance validation
requirement, combined with the proposed requirement to operate and
maintain the test airplane during the airplane demonstrate test in
paragraph II(b)(7) using the recommended operations and maintenance
manual procedures, are part of the FAA’s overall regulatory objective
to minimize human errors in the ETOPS rule.  The FAA intends that the
proposed ETOPS type design requirements would result in an airplane
entering service with validated maintenance and operational procedures
that minimize the possibility of human error in ETOPS operations.

II(b)(4) Propulsion system validation test.

This paragraph would require the applicant for an early ETOPS airplane
to comply with the 3,000-cycle engine test in the proposed new
§33.200(c) with the installed engine configuration.  The test engine
would have to be configured with a complete airplane nacelle package,
including engine-mounted equipment except for any configuration
differences necessary to accommodate test stand interfaces with the
engine nacelle package.  At the conclusion of the test, the test
hardware would have to be:

(i) visually inspected in according to the applicant’s on-wing
inspection recommendations and limits; and

(ii) completely disassembled and inspected in accordance with the
service limits submitted in compliance with §25.1529.

Explanation.

Proposed paragraph II(b)(4) would codify paragraphs (e)(3) and (e)(6) of
the Boeing Model 777 ETOPS special conditions for the airplane
propulsion system installation.  These special conditions paragraphs
require vibration testing and a 3,000-cycle engine demonstration test on
the installed engine configuration.  The proposed §33.200(c) would
combine these two special conditions test requirements into one test
based on how Boeing complied with these paragraphs for the Model 777
airplane.

The original ARAC recommended rule draft proposed the following wording
for the first sentence of this paragraph: “The propulsion system for
which approval is being sought…” The FAA defines the airplane
propulsion system based on the definition of the powerplant installation
contained in § 25.901(a), which states:

“For the purpose of this part, the airplane powerplant installation
includes each component that—

(1) Is necessary for propulsion;

(2) Affects the control of the major propulsive units; or

(3) Affects the safety of the major propulsive units between normal
inspections or overhauls.”

The components and systems covered by the overall definition of
“propulsion system” include the fuel system and the engine and fuel
system flight deck controls.  We do not intend that the proposed
propulsion system validation test in paragraph II(b)(4) would include
any propulsion system components outside of the airplane nacelle
package.  We have made two changes to the original ARAC wording in order
to clarify the intended test configuration.  We have replaced
“propulsion system” with “installed engine configuration” in the
first sentence.  We have changed the second sentence to clarify that the
test engine must be configured with a complete airplane nacelle package,
including engine-mounted equipment except for any configuration
differences necessary to accommodate test stand interfaces with the
engine nacelle package.  These proposed changes are consistent with a
recent revision of the Boeing Model 777 ETOPS special conditions.

The Boeing Model 777 ETOPS special conditions did not originally require
a post-test teardown inspection.  However, all three-engine companies,
in cooperation with Boeing, conducted post-test teardown inspections on
the original baseline engines installed on the Model 777 series
airplanes based on their own experience of what would constitute an
adequate evaluation.

The FAA reviewed the data from the 3,000-cycle tests for the three
original engine types installed on the Model 777 and found that most of
the early in-service 777 engine failure modes could have been discovered
with additional inspection and analysis of the 3,000-cycle test engine
and propulsion system hardware.  Part conditions noted in the teardown
inspection reports for the three baseline 777 engine types did later
occur in service, and they resulted in engine in-flight shutdowns or
airplane diversions.

In order to provide a consistent standard for a post-test evaluation of
the 3,000-cycle test hardware, the FAA is proposing an enhanced
3,000-cycle test requirement in proposed paragraph II(b)(4) of Appendix
L and § 33.200(c).  The standard would require a complete teardown
inspection of the engine and airplane nacelle test hardware after
completion of the test.  The FAA intends that the enhanced teardown
inspection requirement for the 3,000-cycle test hardware would catch
potential sources of engine in-flight shutdowns or diversions.

An enhanced post-test teardown inspection requirement is part of a
revision to the Boeing Model 777 ETOPS special conditions that the FAA
developed for the Model 777-300ER program.  The ARAC ETOPS Working Group
had knowledge of our intent to revise the Model 777 ETOPS special
conditions in this manner as they developed their recommendations.

Even though paragraphs II(b)(4) and § 33.200(c) address the same
proposed post-test teardown inspection requirement, the wording for the
requirement in paragraph II(b)(4) is different from that in §
33.200(c).  The FAA considers that the intent of the proposed post-test
teardown and inspection requirement in parts 25 and 33 to be identical.
However, the specific language used in each part is tailored to the
unique aspects of the engine and airplane type certification processes
used to show compliance with this requirement.

See the discussion for the proposed new § 33.200(c) for a complete
explanation of the proposed 3,000-cycle engine test requirement.

Proposed paragraph II(b)(4) is largely a “pointer” to the proposed
requirements to perform an engine cyclic endurance test in part 33.  The
purpose of this paragraph in the rule is to assure that the entire
installed engine configuration (engine accessories, nacelle, thrust
reverser, etc.) is installed on the test vehicle during the part 33
testing.  Since the proposed part 33 requirement only covers the engine
type design, this proposed rule is necessary.

II(b)(5) New technology demonstration testing.

The applicant would have to conduct testing to demonstrate the
suitability of any technology new to the applicant.

Explanation.

This paragraph would codify paragraph (e)(4) of the Boeing Model 777
ETOPS special conditions.  The ARAC left this requirement from the
special conditions out of its recommended rule proposal, even though the
associated part 25 draft advisory circular provided with their
recommendation refers to this as a requirement.  We propose to add the
new technology demonstration testing requirement to the notice for
completeness.

II(b)(6) APU Validation Test.

This paragraph would require an applicant to complete a test consisting
of 3,000 equivalent airplane operational cycles on an auxiliary power
unit that the applicant uses to comply with the electrical power supply
system requirements of paragraph I(a)(2) of this proposed appendix.

Explanation.

This paragraph would codify paragraph (e)(5) of the Boeing Model 777
ETOPS special conditions.

As we stated in the section on APU design for proposed paragraph
I(b)(2), current twin engine airplanes approved for ETOPS only comply
with the proposed requirement for electrical system reliability
contained in this notice by having three independent electrical
generators.  On these airplanes, the third independent electrical
generator is normally powered by an auxiliary power unit.  To assure
that an APU would have the proper reliability at entry into service, the
proposed rule would require the applicant to conduct an APU endurance
test in a similar manner to that proposed in paragraph II(b)(4) for the
main engines.  The phrase “equivalent airplane operational cycles”
requires the applicant to test the APU in an environment that the APU
would be operating in an airline ETOPS operation. In most cases this
would include starting and operating the APU in extremely cold
temperatures representative of high altitude operation or ground
operations in extremely cold climates. This would also include operation
in high temperature environments, and with simulated pneumatic and
electrical loads.  Further amplification of the interpretation of
“equivalent airplane operational cycles” is found in the draft part
25 advisory circular.

II(b)(7) Airplane demonstration Test.

This paragraph would require the applicant to conduct an airplane flight
test to demonstrate that the airplane, its components and equipment are
capable of and function properly during ETOPS and ETOPS diversions. This
flight test may be coordinated with, but would not be in place of the
function and reliability flight testing required for compliance with §
21.35(b)(2).

The proposed requirement includes several conditions that the applicant
would have to comply with in conducting this test.  Among these are

(1) The flight test program would have to include:

(i) flights simulating actual ETOPS operation;

(ii) demonstration of maximum normal flight duration with maximum
diversions;

(iii) maximum time engine inoperative diversions;

(iv) non-normal conditions to demonstrate the airplanes capability to
safely; conduct an ETOPS diversion,

(v) diversions into representative operational diversionary airports;
and

(vi) repeated exposure to humid and inclement weather on the ground
followed by long-range operations at normal cruise altitude.

(2) The flight testing would have to validate the adequacy of the
airplane’s flying qualities, performance and the flight crew’s
ability to deal with adverse operating conditions.

(3) The engine-inoperative diversions would have to be evenly
distributed among the number of engines in the applicant’s flight test
program.

(4) The test airplane would have to be operated and maintained using the
recommended operations and maintenance manual procedures during the
test.

(5) At the completion of the test, the ETOPS Group 1 significant systems
would have to undergo an airplane visual inspection and the engines
would have to also undergo an internal gas path inspection.

Explanation.

This paragraph would codify the airplane demonstration test requirement
of paragraph (e)(7) of the Boeing Model 777 ETOPS special conditions.
The original version of the special conditions effective July 1, 1994
required the applicant to fly one complete airplane for at least 1,000
flight-cycles simulating an actual airline operation.

The FAA developed the 1,000-cycle airplane demonstration test
requirement with the intent of exposing the candidate airplane to the
conditions where the greatest numbers of in-flight shutdowns occur.
Most in-flight shutdowns occur during takeoff and climb.  Failures that
tend to occur only during certain portions of a flight are known as
“cyclic” failures.  An example of a cyclic failure would be a tire
failure where exposure to the high tire speeds that could lead to a tire
failure would only occur during takeoff or landing.  These are in
contrast to failures that are more likely to occur as components age,
which are known as “hourly” failures.  An example of an hourly
failure is an electric cooling fan failure where the fan runs
continuously to cool electronic components.

The failure modes associated with takeoff- and climb-related in-flight
shutdowns tend to be cyclic in nature for a couple of reasons.  In cases
where the loads and stresses on engine or airplane hardware increase as
engine power or thrust increases, the takeoff portion of the flight is
most critical.  Failure modes that occur due to improper maintenance or
engine servicing, for instance loss of engine oil due to improper
assembly of an oil tube connection, also tend to occur early in the
flight.  A larger number of airplane flights increases the exposure to
these types of failures.  Therefore, the FAA considered a cyclic type of
test to be the most appropriate airplane validation test for the
original 777 ETOPS special conditions.

Although the fewest in-flight shutdowns occur during cruise, this is the
phase of flight that is most important to an ETOPS operation.
Traditionally, the FAA and industry have avoided trying to differentiate
between those in-flight shutdowns that may occur during cruise from
those that would only occur in a non-ETOPS environment.  The main reason
for this approach in existing ETOPS policy is that by correcting all
causes of in-flight shutdowns, we gain confidence in the overall
integrity of the propulsion system design.  Since an enhanced
3,000-cycle engine demonstration test proposed for paragraph II(b)(4) of
Appendix L and §33.200(c) would provide adequate cyclic exposure, the
FAA has concluded that the airplane validation program should emphasize
exposure to the cruise phase of flight.

During the three 1,000-cycle tests conducted for the original 777 engine
installation certification programs, only 91 of the total 1,000 cycles
were of durations of two hours or more.  Since we intend for the
airplane demonstration test to simulate an actual airline operation,
this would better be accomplished through longer duration flight cycles.