Extended Operations (ETOPS) of Multi-Engine Airplanes

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 1, 21, 25, 33, 121, and 135

[Docket No. FAA-2002-6717; Amendment Nos. 1-55, 21-89, 25-120, 33-21, 121-329, 135-108]

RIN 2120-AI03

Extended Operations (ETOPS) of Multi-Engine Airplanes

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final rule.

SUMMARY:

This final rule applies to air carrier (part 121), commuter, and on-demand (part 135) turbine powered multi-engine airplanes used in extended-range operations. However, all-cargo operations in airplanes with more than two engines of both part 121 and part 135 are exempted from the majority of this rule. Today's rule establishes regulations governing the design, operation and maintenance of certain airplanes operated on flights that fly long distances from an adequate airport. This final rule codifies current FAA policy, industry best practices and recommendations, as well as international standards designed to ensure long-range flights will continue to operate safely. To ease the transition for current operators, this rule includes delayed compliance dates for certain ETOPS requirements.

DATES:

Effective date:

These amendments become effective February 15, 2007.

Compliance date:

Some sections of the final rule have a delayed compliance date as discussed in section VI of this document and provided in Table 2 of the appendix.

FOR FURTHER INFORMATION CONTACT:

For technical information on operational issues, contact Robert Reich, Flight Standards Service, Federal Aviation Administration, 800 Independence Ave., SW., Washington, DC 20591; telephone (202) 267-8166; facsimile (202) 267-5229; e-mail

Robert Reich@faa.gov.

For technical information on certification issues, contact Steve Clark, Transport Airplane Directorate, ANM-140S, 1601 Lind Ave., Renton, WA 98055; telephone (425) 917-6496; facsimile (425) 917-6590; e-mail

Steven.P.Clark@FAA.gov.

For legal information, contact Bruce Glendening, Office of the Chief Counsel, Division of Regulations, Federal Aviation Administration, 800 Independence Avenue, Washington, DC 20591; telephone (202) 267-3073; facsimile (202) 267-7971; e-mail

Bruce.Glendening@faa.gov.

SUPPLEMENTARY INFORMATION:

Availability of Rulemaking Documents

You can get an electronic copy using the Internet by:

(1) Searching the Department of Transportation's electronic Docket Management System (DMS) Web page at

http://dms.dot.gov/search

(2) Visiting the Office of Rulemaking's web page at

http://www.faa.gov/regulations_policies/rulemaking/recently_published.

(3) Accessing the Government Printing Office's Web page at

http://www.gpoaccess.gov/fr/index.html.

You can search comments in the docket by the name of the individual submitting or signing the comment. You may review DOT's complete Privacy Act statement in the

Federal Register

published on April 11, 2000 (Volume 65, Number 70; Pages 19477-78) or you may visit

http://dms.dot.gov.

Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires FAA to comply with small entity requests for information or advice about compliance with statutes and regulations within its jurisdiction. If you are a small entity and you have a question about this document, you may contact your local FAA official, or the person listed under

FOR FURTHER INFORMATION CONTACT.

You can find out more about SBREFA on the Internet at

http://www.faa.gov/regulations_policies/rulemaking/sbre_act

.

Glossary of Terms Used in This Final Rule

Technical terms used in this final rule are located in 14 CFR 1.2. Definitions used in the rule are found in sections 1.1 and 121.7, and appendix G to part 135 of the final rule language.

Table of Contents

I. Executive Summary

II. Summary of the FAA's Existing ETOPS Program

A. Airplane-Engine Type Design Approval

B. Operational Requirements

C. Polar Policy

III. Notice of Proposed Rulemaking To Codify and Expand Existing ETOPS Program

A. Development of the NPRM

B. Summary of the NPRM

C. Summary of Comments

IV. Safety Need for the Final Rule

A. Safety Risk Associated With ETOPS

B. Impact of ETOPS Requirements on Engine Reliability

C. Fuel Exhaustion

D. Cargo or Baggage Compartment Fire Suppression Requirements

E. Decompression Scenarios

F. Satellite-Based Voice Communications

V. Applicability of the Final Rule

VI. Delayed Compliance Dates and Grandfather Provisions

VII. In-Flight Shutdown Rates

VIII. Definition of ETOPS Significant System

IX. Airplane and Engine Certification Requirements

A. Transport Category Airplane Airworthiness Standards (Part 25)

1. General

2. Additional Airworthiness Requirements for Approval of an Airplane-Engine Combination for ETOPS (Part 25, Appendix K)

B. Engine Certification (Part 33)

1. Engine Design and Test Requirements for ETOPS Eligibility

2.Engine Instructions for Continued Airworthiness

C. ETOPS Reporting Requirements for Manufacturers (Part 21)

1. Early ETOPS: Reporting, Tracking, and Resolving Problems

2. Reliability of Two-Engine Airplanes

X. Operator Maintenance Requirements

A. Continuous Airworthiness Maintenance Program

B. Limitations on Dual Maintenance

C. Maintenance Actions

1. ETOPS pre-departure service check

2. Engine condition monitoring program

3. Oil consumption monitoring program

4. Verification procedures

5. Task identification

6. Configuration Maintenance and Procedures (CMP) Document

7. Training and documentation

D. Operator Reporting Requirements

XI. Operational Requirements (Part 121)

A. Route Limitations

B. ETOPS Alternate Airports

1. Determination of ETOPS alternate airports

2. Passenger recovery plans

3. Rescue and firefighting services (RFFS)

C. Crewmember and Dispatcher Training

D. Communication Requirements

E. Time-Limited System Planning and the Critical Fuel Scenario

F. Dispatch or Flight Release

1. Original dispatch or flight release, re-dispatch or amendment of dispatch or flight release

2. Dispatch release: U.S. flag and domestic operations

G. Engine Inoperative Landing

XII. ETOPS Authorization Criteria

A. ETOPS Approvals for Part 121 Operations—Airplanes With Two Engines

B. ETOPS Approvals for Part 121 Operations—Airplanes With More Than Two Engines

C. ETOPS Approvals for Part 135 Operations

D. Airplane Approvals in the North Polar and South Polar Areas

1. Part 121 operations

2. Part 135 operations

XIII. Comments on the Costs and Benefits of the Proposed Rule

XIV. Rulemaking Notices and Analyses

XV. Appendix of Tables

Table 1—Applicability of Final Rule

Table 2—Part 121 and Part 135 Operational Requirements Timetable

Table 3—Certification Requirements

Table 4—Comparison of Current ETOPS Guidance; Regulations Proposed by the NPRM; and Final Rule

Table 5—Design Requirement Objectives

Table 6—Part 25, Appendix K Revised Numbering

XVI. The Final Rule

I. Executive Summary

This rule is a result of the FAA's desire to review the current body of rules and guidance for extended-range flight operations and to codify a uniform set of regulations for airplane and engine design in parts 21, 25, and 33, and airplane operations in parts 121 and 135.

Extended operations, or ETOPS, for long-range international travel provide many benefits related to savings in time, fuel, and operational efficiencies. However, there are unique safety concerns associated with these operations. When one travels great distances from airports, the safety of these operations depends on the risk of critical loss of engine thrust, additional system failures during a diversion for any cause, the distance from an adequate airport used in a diversion, and the conditions encountered upon arrival at the diversion airport.

Part 121 domestic, U.S. flag, and supplemental rules have limited the amount of time two-engine airplanes could fly from an airport (14 CFR 121.161). In the past, the risks associated with longer flights were accepted as a function of the number of engines on an airplane and were based on the reliability of engines existing at the time the part 121 rules were initially issued. Airplanes with more than two engines had minimal part 121 regulatory guidance since engine and system redundancies reduce the safety risk associated with engine failures during diversions.

1

Current part 121 regulations for airplanes with more than two engines require adequate oxygen supplies to address emergencies (14 CFR 121.329), but do not explicitly require the operator to consider other risk mitigation measures, such as providing the extra fuel necessary to reach a diversion airport. Likewise, the FAA has regulated turbine-powered on-demand operations under separate part 135 guidance, which specifies performance criteria when an engine is inoperative but not any restrictions based on the potential distance from an airport. (See 14 CFR 135.381 and 135.383.) A lack of regulatory oversight in areas of equipment requirements and fuel planning for a maximum diversion creates a very real safety risk apart from engine reliability.

1

Airplanes with more than two engines are excluded from the section 121.161 requirement to remain within 60 minutes from an adequate airport. Section 121.193 is a requirement limiting all airplanes to 90 minutes from an airport unless they have the performance, after the failure of two engines, to land at an adequate airport. Section 121.329 requires all turbine powered airplanes to have enough supplemental oxygen after a decompression to “allow successful termination of the flight.” Section 121.565 requires only two engine airplanes to “land at the nearest suitable” airport after engine failure. For airplanes that have three or more engines the rule allows the pilot to proceed to an airport that he selects if, after consideration, he decides that proceeding to that airport is as safe as landing at the nearest suitable airport. Section 121.645 requires similar “normal” fuel carriage for all turbine-powered airplanes.

As engine reliabilities increased during the previous three decades, there had been increasing pressure from the airline industry for the FAA to recognize technological advances and allow part 121 two-engine airplanes to fly farther from airports than § 121.161 allowed. The FAA developed advisory circulars (AC 120-42, June 6, 1985; AC 120-42A, December 30, 1988) that provided guidance for the operation of part 121 two-engine airplanes beyond the regulatory limits.

2

These advisory circulars introduced the term “ETOPS” for these extended operations and addressed airplane and engine design aspects, maintenance programs, and operations. Under this guidance, ETOPS operations for part 121 two-engine airplanes are permitted to fly up to 180 minutes from an airport sufficient to accommodate a landing, provided certain criteria are met. The FAA Administrator thus authorizes qualified operators to engage in long-range operations in remote areas. As a result of the FAA's ETOPS programs, two-engine airplane operators can fly over most of the world other than the South Polar Region, a small section in the South Pacific, and the North Polar area under certain winter weather conditions.

2

Section 121.645 allows an operator to fly farther from an airport in a two-engine airplane if authorized by the FAA. The FAA granted such authorizations for Caribbean operations in the 1970's. Since the mid-1980's, the FAA has provided formal ETOPS guidance for part 121 operators on how to receive two-engine ETOPS authorization.

Operations under these programs have been highly successful. Although part 121 two-engine ETOPS have increased worldwide from less than 1,000 per

month

in 1985 to over 1,000 per

day

in 2004, engine reliability, as measured by the in-flight shutdown rate (IFSD rate), has improved to a point that is better than one-half the rates experienced in the 1980s.

With the growing success of the current ETOPS guidelines established for part 121 two-engine operators, the FAA recognized in the 1990s that we could no longer continue to administer this program as a special authorization under an operating rule. The FAA also recognized that there were certain aspects of the ETOPS guidelines not solely relevant to two-engine airplanes. Also during this period, the International Civil Aviation Organization (ICAO) established international standards requiring member states to define diversion time thresholds for all two-engine airplane operations. For the United States, this requirement includes airplanes operated under part 135. In addition, the airline industry requested the FAA develop standards extending the existing limit beyond which two-engine airplanes may operate.

The FAA tasked the Aviation Rulemaking Advisory Committee (ARAC) in June 2000 to codify the existing policies and practices to be applicable to all airplanes, regardless of the number of engines, by developing comprehensive ETOPS standards for 14 CFR parts 25, 33, 121, and 135, as appropriate. The FAA also tasked ARAC to develop ETOPS operational requirements for diversion times greater than 180 minutes up to whatever extent may be justified.

During this same period, the FAA developed guidance for polar operations. These operations became more commonplace with the opening up of Siberian airspace following the fall of the former Soviet Union. Although not defined as ETOPS, this guidance has been expanded in today's rule to include both the North and South Polar Areas and has been incorporated into the overall ETOPS rule package. Significantly, this aspect of the rule applies to all turbine-powered multi-engine operations including all-cargo operations.

Today's rule codifies and expands existing FAA policy and route authorizations for all part 121 two-engine airplanes conducting ETOPS beyond certain distances from an adequate airport. This final rule also extends most requirements previously applicable only to part 121 two-engine airplanes to a limited number of part 121 passenger-carrying three- and four-engine airplane operations and applies the same limitations to comparable part 135 operations. Significantly, this rule excludes the ETOPS maintenance requirements from the operation of airplanes with more than two engines in both part 121 and 135. The FAA has accepted the safety case that current

engine reliabilities and the level of engine redundancy on such airplanes is sufficient to protect such operations. The appendix has several charts and tables that demonstrate the interrelationship between the affected parts of Title 14, as well as their applicability and compliance schedules.

Under past ETOPS guidance, a part 121 operator of a two-engine airplane was required to use an airplane-engine combination approved for ETOPS. The manufacturer of the airplane obtained the ETOPS type design approval on behalf of the operator. Under today's rule (§ 121.162, G135.2.3), two-engine airplane-engine combinations already approved for ETOPS under previous FAA guidance can continue to be used in ETOPS operations under parts 121 and 135. No re-certification under the new § 25.1535 is required. Likewise, this rule allows airplanes with more than two engines manufactured within 8 years of when this rule becomes effective to be used in ETOPS operations without type design approval under the new § 25.1535. Airplanes with more than two engines manufactured more than 8 years after the effective date of this final rule must meet the certification requirements for airplane-engine combinations adopted today. Today's rule allows two-engine airplanes with existing type certificates to be approved for up to 180-minutes ETOPS without meeting requirements for fuel system pressure and flow, low fuel alerting, and engine oil tank design. These three provisions are new to this rule, and are not in the guidance previously used to approve two-engine airplanes for ETOPS.

The FAA is adopting a compliance schedule to allow an orderly transition to future safety requirements as the industry adjusts to the new, broader ETOPS operating criteria. We recognize that, in some cases, it is appropriate to permit existing airplanes to continue to operate under existing authorization. It is also appropriate in some cases to delay implementation of certain portions of the rule to minimize its economic impact. We are setting a 1-year compliance date for most requirements involving a set-up or installation program. In all cases when a delayed compliance date is established, we have determined that there is a minimal increase in safety benefit for implementing the rule immediately. In addition, the FAA has provided grandfather provisions for part 121 ETOPS operations using airplanes with more than two engines and for all ETOPS operations conducted under part 135.

The total anticipated costs of today's rule are estimated at $20.9 million over a 16-year period or $12.4 million, present value. The costs of the rule to part 121 operators and U.S. manufacturers of airplanes with more than two engines are estimated to be $7.7 million ($3.8 million, present value). Benefits to the rule are attributed to increased safety resulting from design, dispatch, and operational requirements. In addition, operators of two-engine airplanes may realize cost savings from decreased fuel requirements.

II. Summary of the FAA's Existing ETOPS Program

The requirements adopted today are based almost exclusively on the FAA's existing ETOPS program, with some additions. Accordingly, the FAA believes it helpful to discuss in some detail the existing guidance. As noted earlier, all airplanes operated under 14 CFR part 121 are required to comply with § 121.161. Unless otherwise authorized by the Administrator, this regulation limits the operation of two-engine airplanes to routes that contain a point no farther than 60 minutes flying time at an approved one-engine inoperative cruise speed in still air from an adequate airport. This restriction applies to all airplanes operating under this rule regardless of the terrain or area to be over flown.

The first deviations to § 121.161 were issued for 75-minutes ETOPS in the Caribbean Sea in 1977. In June of 1985, responding to an increasing desire by industry to obtain further deviations that would allow flights from the United States to Europe, the FAA issued Advisory Circular (AC) 120-42, which defined a process for obtaining authorization for ETOPS diversions up to 120 minutes. This AC was amended in 1988 with the publication of AC 120-42A, which expanded the maximum diversion period to no more than 180 minutes. This AC defined a process for obtaining three categories of ETOPS operational approval,

i.e.

, guidance for 75-minute ETOPS (based on the earlier Caribbean approvals), 120-minute ETOPS, and 180-minute ETOPS. The AC 120-42A guidance contains a two-fold approval process: a type design approval of the airplane-engine combination and an operational approval consisting of ETOPS maintenance, flight dispatch, and crew training elements. The ETOPS maintenance program also incorporates supplemental processes to the non-ETOPS continuous airworthiness maintenance program (CAMP).

The original guidance for extended range operations with two-engine airplanes in AC 120-42 allowed for an increase of up to 15 percent above the 120-minute limit (138-minute ETOPS). This provision was eliminated with the release of the guidance in AC 120-42A providing for operations up to 180 minutes.

However, recognizing a need for ETOPS diversion authority between 120 and 180 minutes, the FAA reinstated the 138-minute provision by issuing policy letter EPL 95-1 in 1994. In March of 2000, at the request of the industry, the FAA issued ETOPS Policy Letter EPL-20-1, “207-minute ETOPS Operation Approval Criteria”. This document provided a similar 15 percent increase in the 180-minute maximum diversion time,

i.e.

, 207 minutes. However, this approval was limited to ETOPS operators flying in the North Pacific and only when weather or airport conditions did not permit normal 180-minute ETOPS flights.

The basic principles expressed throughout this body of guidance are that (1) the design of the airplane and its systems must be acceptable for the safe conduct of the intended operation, and (2) the operator must have the requisite experience and ability to maintain and operate the airplane at the required level of reliability and competence. The design standards and operational processes for ETOPS were designed to prevent circumstances that could cause an engine in-flight shutdown or otherwise cause a diversion and to protect the safety of a diversion if one does occur.

A. Airplane-Engine Type Design Approval

Since the introduction of AC 120-42, airplane-engine combinations have had to be approved by the FAA before ETOPS flights could be conducted. The type design approval of airplanes for ETOPS under AC 120-42 and -;42A involves a two-part process. First, the FAA determines that airplane systems meet certain design standards for safe operations during an airplane diversion. One criterion for approval is that a candidate airplane have at least three independent electrical generators. Another criterion is that a required auxiliary power unit (APU) can start after the airplane has been at high altitude for several hours (cold-soaked) and can run reliably for the remainder of the flight. There are other criteria governing airplane systems such as cargo compartment fire suppression, communication, navigation, flight control, wing and engine ice protection, cabin pressurization, and cockpit and

cabin environment. System safety analyses have to show that expected system failures will not prevent safe landing at a diversion airport. Systems with time limited capabilities, such as the cargo compartment fire suppression system, need to have the capacity to support a maximum length diversion, including a 15-minute allowance for a hold or go-around at the diversion airport.

3

3

For a 180-minute ETPOS approval, these time-limited systems would have a 195-minute capacity to meet this requirement.

The second part of the approval process is an evaluation of engine in-flight shutdowns and other significant airplane system failures that have occurred while the airplane-engine combination has been in service. The candidate airplane-engine combination should accumulate at least 250,000 engine-hours of service experience for a meaningful evaluation, although the AC allows a lower number of hours with adequate compensating factors. An assessment of the causes of these in-flight shutdowns and other significant failures leads to a list of corrective actions that will prevent future occurrences of these events for similar causes. This list of corrective actions is contained in a configuration, maintenance, and procedures (CMP) document. The CMP document also contains minimum equipment requirements that come out of the airplane systems assessment from the first part of the process.

4

4

The CMP document is an extension of the airplane type for an ETOPS approval. An operator wishing to fly an airplane in ETOPS has to comply with the CMP document as a condition for obtaining its operational approval.

AC 120-42A utilizes a relative risk model to support the expansion of maximum ETOPS diversion time for up to 180 minutes. This relative risk model is based on an airplane-engine combination maintaining a target IFSD rate at or below 0.02 per 1,000 engine-hours, which the model shows would allow a safe ETOPS flight for a 180-minute diversion. An applicant for ETOPS approval under this method has to show that the candidate airplane-engine combination has achieved this in-flight shutdown (IFSD) rate before the FAA will grant a 180-minute ETOPS approval. However, an applicant may also get an ETOPS approval for 120-minute ETOPS if the candidate airplane-engine combination IFSD rate is approximately 0.05 per 1,000 engine hours. For an IFSD rate that meets this standard, but is above the 0.02 for 180-minute ETOPS approval, the FAA conducts an assessment of the causes of in-flight shutdowns in the same manner as under AC 120-42, including the incorporation of corrective actions into a CMP document. The applicant must show that the incorporation of these corrective actions will bring the IFSD rate down to the target 0.02 level. After a year in service operating in 120-minute ETOPS, an airplane-engine combination is eligible for an expansion of its approval up to 180 minutes.

Once an ETOPS approval is granted, the FAA monitors the propulsion system IFSD rate of the world fleet to make sure that it remains at or below the target rate. If the IFSD rate for a particular airplane-engine combination in the world fleet goes above the target rate, the FAA asks the airplane and engine manufacturers what corrective actions they are taking to bring the rate below the target level. If, in our review of the manufacturer's corrective actions we determine that an unsafe condition exists, we may issue an airworthiness directive (AD) to correct the unsafe condition. We may also issue an AD to withdraw an ETOPS approval, or to require several corrective actions for causes that individually do not constitute an unsafe condition, but in the aggregate create an IFSD rate that is unacceptably high. In such cases, an operator's ETOPS approval may be predicated on compliance with the AD.

With the introduction of the Boeing Model 777, the FAA introduced a new method for an applicant to obtain an ETOPS type design approval without the service experience required for an approval under AC 120-42A. This method is known as the “early ETOPS” approval process.

The early ETOPS process takes a systems approach to the development of an airplane and engine. Without service experience to identify design flaws that could lead to in-flight shutdowns or diversions, an applicant must demonstrate that the design flaws on previously designed airplanes are not present in the new airplane. The applicant must also consider how the maximum length flight and diversion affect the design and function of airplane systems to ensure that they have the capability and reliability for safe ETOPS flight.

Rigorous ground and flight tests are required to demonstrate that the airplane-engine combination can successfully support an ETOPS program, including validation of maintenance procedures for systems whose failures could lead to an engine in-flight shutdown or a diversion. An enhanced problem reporting and resolution system identifies and corrects significant problems before the airplane is certified. After approval, this same system remains in place during the early service period to identify and correct such problems before they can lead to additional in-flight shutdowns and diversions.

B. Operational Requirements

AC 120-42A requires that each operator demonstrate its ability to maintain and operate the airplane so as to achieve the necessary reliability and to train its personnel to achieve competence in ETOPS. The operational approval to conduct ETOPS is made via amendment to the operator's operations specifications. Operator approval is based on the following levels of operator in-service experience:

1. 75-minute ETOPS—no minimum level required.

2. 120-minute ETOPS—12 consecutive months of operational experience with the airplane-engine combination listed in its application.

3. 180-minute ETOPS—12 consecutive months of operational experience at 120-minute ETOPS with the airplane-engine combination listed in its application.

4. 207-minute ETOPS—hold current approval for 180-minute ETOPS.

These in-service requirements can be reduced, or equivalent in-service experience can be substituted, based on a review by the FAA. The reduction of operator in-service requirements is called “accelerated ETOPS” and the substitution of equivalent experience is called “simulated ETOPS.” As a minimum, an ETOPS validation flight or flights must be completed prior to FAA approval. Guidance for both of these approval mechanisms are contained in draft appendices to the AC 120-42A.

5

5

Although the AC was never officially revised to include these appendices, the FAA has approved operators for ETOPS using the draft policy.

Certain operational requirements are also placed on the operator. The most prominent requirement is for the operator to plan airplane routings and to dispatch airplanes so as to remain within the approved diversion distance from adequate airports.

6

Further, these adequate airports must have certain required weather minimums both at dispatch and during the flight and must have minimum levels of rescue and fire fighting services (RFFS). The operator must have programs in place to monitor the conditions at these airports during ETOPS and have a methodology to provide the flight crew with this data.

The operator must also have a methodology to calculate the fuel and oil supply for the “critical fuel scenario.”

7

Further, the operator must provide in its operations manual airplane performance data to support both this critical fuel requirement and any other area of operations calculations in their operations manual.

6

“Adequate airport” is a new definition that codifies various references in current regulatory language and practice. It defines the minimum requirements for sufficiency based on the landing limitations contained in 121.197 and the airport requirements of part 139.

7

AC 120-42A describes this scenario as any combination of engine failure and decompression at the most critical (furthest) distance from the airports used to plan the flight.

AC 120-42A also provides guidance on airplane system redundancy levels appropriate for ETOPS. An operator's Minimum Equipment List (MEL) based on this guidance may be more restrictive than the Master Minimum Equipment List (MMEL) when considering the kind of operation proposed and equipment and service problems unique to the operator. The FAA has established criteria for MMEL based on this guidance and the ETOPS approval level. Operational dispatch of an ETOPS flight is based on these criteria.

8

8

Some examples of the increasing requirements of the MMEL for ETOPS approvals are (1) ETOPS beyond 120 minutes requires three generators; (2) ETOPS beyond 180 minutes requires SATCOM equipment, an engine-out auto land system, an auto throttle system, a fuel quantity indicating system, and minimum requirements for fuel cross feed and fuel boost pump electrical power.

Since the quality of maintenance and reliability programs can have an appreciable effect on the reliability of the propulsion system and the airframe systems required for ETOPS, AC 120-42A requires a two-engine airplane operator to have a maintenance and reliability program sufficient to maintain a satisfactory level of airplane systems reliability for the particular airplane-engine combination. The elements of such a program are contained in an ETOPS-approved CAMP. This CAMP begins with a basic CAMP that is approved for use in non-ETOPS operation, which is then supplemented for ETOPS with:

1. An ETOPS maintenance document,

2. An ETOPS pre-departure service check,

3. Dual maintenance procedures,

4. Verification procedures for corrective action to ETOPS significant systems,

5. ETOPS task identification,

6. Centralized maintenance control procedures,

7. ETOPS parts control program,

8. An airplane reliability program,

9. Propulsion system monitoring,

10. Engine condition monitoring program,

11. Oil consumption monitoring program,

12. An APU in-flight start program, if APU in-flight start capability is required for ETOPS,

13. Maintenance training for ETOPS, and

14.A system to ensure compliance with the minimum requirements set forth in the CMP document or the type design document for each airframe and engine combination.

C. Polar Policy

In February 2001, in response to several U.S. carriers' plans to conduct polar operations with two-engine airplanes, the FAA developed a “Polar Policy Letter.” This policy letter documented the requirement for airlines to develop necessary plans in preparation for polar flights and identified the necessary equipment and airplane configuration requirements for all airplanes regardless of the number of engines. The FAA's intent in issuing the policy letter was to establish a process that can be applied uniformly to all applicants for polar route authority.

This policy letter placed the following requirements on the operator:

1. Defined area of application,

2. Enhanced facilities requirements for ETOPS alternate airports,

3. Passenger recovery plan for diversion airports used to support operations,

4. A fuel freeze strategy,

5. Enhanced MEL requirements to include emergency medical kits and crew foul weather gear,

6. Consideration of solar flare,

7. Polar specific crew and dispatcher training,

8. MEL requirements similar to those for operations beyond 180-minute ETOPS, and

9. A validation flight prior to approval.

III. Notice of Proposed Rulemaking To Codify and Expand Existing ETOPS Program

A. Development of the NPRM

In response to FAA's tasking, the ARAC formed an ETOPS working group consisting of more than 50 representatives of U.S. and foreign airlines, aircraft and engine manufacturers, pilot unions, industry groups and airline accident family support groups, as well as representatives from the Joint Aviation Authority (JAA), ICAO, and the FAA.

After 2 years, the ETOPS working group produced a draft notice of proposed rulemaking (NPRM), advisory material, and a proposed preamble discussion to explain how the working group arrived at its recommendations. The ARAC presented the ETOPS working group final product to the FAA as a consensus document, which the FAA published, largely unchanged, as an NPRM on November 14, 2003 (68 FR 64730).

Among the recommendations were:

• Given the current reliability of part 121 two-engine airplanes, successful ETOPS processes should be expanded to allow two-engine ETOPS throughout the world.

• A comprehensive ETOPS rule should include all part 121 and part 135 airplanes used in specific long-range operations regardless of the number of engines.

• The term ETOPS should be retained, but its definition should be changed to “extended operations” to highlight its application to all extended airplane operations.

The ARAC ETOPS working group recognized that although engine reliability has improved significantly, diversions are sometimes necessary for reasons unrelated to engine performance, such as onboard fire, medical emergency or cabin decompression. Ensuring availability of en-route alternate airports, adequate fire fighting capabilities at these airports, and fuel planning to account for decompression are sound operational practices for all airplanes. Likewise, limits on an airplane's maximum allowable diversion time for certain time-limited systems (

e.g.

, cargo fire suppression) that were applied to two-engine airplanes under the existing AC guidance should also apply to airplanes with more than two engines. Accordingly, ARAC recommended adding certain safety requirements to long-range operations for parts 121 and 135 independent of the number of engines on an airplane.

B. Summary of the NPRM

The NPRM proposed an expansion of ETOPS for part 121 two-engine airplanes and implementation of consistent ETOPS requirements for airplanes flying beyond 180 minutes from an adequate airport. The NPRM addressed three specific areas: airplane and engine design and reporting requirements (parts 21, 25, and 33), air carrier operations and maintenance (part 121), and commuter and on-demand operations and maintenance (part 135). The NPRM also proposed definitions in part 1 for terms used in these three areas.

The two main objectives of the proposed airplane and engine design requirements were to prevent failures that result in airplane diversions and to protect the safety of diversions when

they do occur. The proposed airplane and engine design requirements fell into five categories:

1. Designing to reliably provide functions necessary for safe ETOPS flights.

2. Eliminating sources of airplane diversions that occurred in current or past designs.

3. Ground and flight testing.

4. Reporting and correcting design problems.

5. Demonstrating reliability.

The airplane design requirements in part 25 were further divided into three parts: those applicable to all airplanes; those applicable to two-engine airplanes only; and those applicable to airplanes with more than two engines. Within each of the two latter parts, an applicant could choose to certify its airplane using existing service experience with the candidate airplane-engine combination, by conducting more thorough analysis and testing to certify a new airplane-engine combination without service experience (early ETOPS method) or through a combination of the two. Table 5 in the appendix summarizes how today's rule meets these design objectives from the NPRM.

Requirements specifically applicable to engines to make them eligible for installation on an ETOPS airplane were proposed for part 33. Only engines intended for installation on two-engine airplanes being certified for ETOPS, using the early ETOPS method in part 25 were contemplated under the proposed engine test requirements.

The NPRM proposed part 121 amendments to codify current two-engine ETOPS guidance, including the designation of areas where the ETOPS rule would apply. It also proposed additional communications requirements; fire-fighting capabilities necessary at an ETOPS alternate airport; a recovery plan for caring for stranded passengers; utilization of an expanded ETOPS CAMP; airplane system performance requirements; and additional training and reporting requirements for crewmembers and dispatchers.

Additionally, the FAA proposed other requirements for part 135 operations conducted beyond 180 minutes from an airport. The proposed part 135 amendments were similar to part 121 but recognized the differing regulatory history and nature of part 135 operations. For example, the fire and rescue equipment required at diversion airports for part 121 operations would not be required for part 135 operations since these operations are irregular and few in number.

Although most current air carrier operations can be conducted within 180 minutes flying time from an adequate airport, there are certain remote and demanding routes where diversion times greater than 180 minutes are required to reach an adequate en-route alternate airport. Knowing that all operators flying routes with greater than 180-minute diversion times would experience the same operating demands, the FAA proposed an ETOPS program to regulate flights in remote areas, which would benefit part 121 three- and four-engine airplanes and all part 135 airplane operations, regardless of the number of engines. The NPRM provided a public comment period to end on January 13, 2004. In response to requests, the FAA extended the comment period to March 15, 2004 (69 FR 551; January 6, 2004).

C. Summary of Comments

More than 50 commenters representing foreign regulatory bodies, associations, manufacturers, and foreign and U.S. operators responded to the NPRM. In general, the comments supported the work of the ARAC and agreed with the framework of the NPRM.

However, commenters took issue with the economic summary of the NPRM and its stated cost benefits. They believed, and we now agree, that these benefits were based on the incorrect premise that the operations proposed to be regulated as ETOPS for part 121 three- and four-engine and all part 135 airplanes were previously restricted and consequently would provide new opportunities to the industry. In addition, many of the commenters disputed specific provisions of the proposal. In most cases, those who disagreed are operators or manufacturers of three- and four-engine airplanes, or part 135 operators. Currently, these operators and manufacturers are not subject to any ETOPS safety provisions such as en-route alternate planning, time-critical systems analysis (e.g., cargo fire suppression), and the more rigorous ETOPS maintenance program. They expressed a strong opinion that 35 years of experience shows such rules are unnecessary, cost-prohibitive, and add nothing to aviation safety. The FAA also received detailed comments on satellite communications, certification standards, engine monitoring, fuel requirements, maintenance requirements and passenger recovery plans—all related ultimately to additional costs for operators. The FAA has mitigated many of these costs with extended compliance dates as shown in Table 2 of the appendix to this document. In addition, we have decided against adopting the ETOPS maintenance program for airplanes with more than two engines and have excluded all-cargo operations aboard airplanes with more than two engines from all aspects of the rule other than the minimal requirements for safe operation in the North and South polar areas for part 121 operations and the North polar area for part 135 operations. We justify the safety need for applying this rule to airplanes with more than two engines in section IV of this preamble. A more detailed discussion of the commenters' recommended changes, a number of which the FAA adopt today, is provided in the substantive discussion of this final rule.

In addition, some commenters provided extensive comments and suggestions on the risk of smoke and fire in ETOPS operations and asked the FAA to establish smoke detection standards. However, smoke in the cockpit issues are beyond the scope of this proposal. Since the issues raised by these commenters introduce new safety requirements, the FAA may consider them for future rulemaking, but will not discuss them further here.

Several commenters, including the JAA, National Air Carrier Association (NACA) and the Civil Aviation Authority of the United Kingdom (UK CAA), recommended use of the acronym “LROPS”—meaning “Long Range Operations”—for three- and four-engine ETOPS, to avoid confusion, particularly for those operations beyond 180-minutes diversion time. The FAA has decided to use the single term, “extended operations,” or ETOPS, for all affected operations regardless of the number of engines on the airplane. As discussed in the NPRM, the ARAC had determined that the use of a single term would be less confusing than two separate terms that govern the same types of operations. We agree with this assessment and believe any confusion created by expanding the term to three- and four-engine airplanes will be short-lived.

IV. Safety Need for the Final Rule

A. Safety Risks Associated With ETOPS

The FAA believes that operations of all long-range passenger-carrying airplanes, regardless of the number of engines, need a viable diversion airport in the case of an onboard fire, medical emergency, or loss of cabin pressure. Ensuring availability of diversion airports, adequate fire fighting coverage at these airports, passenger recovery plans, and fuel plans for the diversion

are sound operational practices for all airplanes. Likewise, all airplane time-critical systems should account for the maximum allowable diversion and worst-case scenarios. Many commenters to the NPRM disagreed with this fundamental premise and questioned why new regulations should be imposed on operations that have been safely flown without any regulatory restrictions.

In response to these comments, the FAA has reviewed the historic data for past long range operations and has come to several conclusions.

First, the operating environment for certain long-range operations has changed significantly in the past 35 years. In the past, most operations conducted under part 121 and part 135 have flown over routes that remain within a reasonable distance from adequate airports. As technology has increased the range and endurance of all airplanes, operators are increasingly flying over regions of the world that both are less likely to be served by sizable airports and present extreme weather conditions. Some of the airports that would support a diversion are over 180 minutes away from the airplane during some portion of the flight, the previous limit for two-engine ETOPS. While the frequency of long-range operations is increasing, the aviation infrastructure to support these operations in remote areas of the world is decreasing. The U.S. military has abandoned long-standing diversion airports in the Aleutians and Pacific such as Adak and Wake Islands. In addition, Canada no longer provides financial support for its airports. At the same time, opening up of North Polar routes has resulted in an increase in operations over a particularly harsh and remote environment. The aviation industry expects that with increased route authority for two-engine airplanes and increasing use of polar routes, by 2010 there will be 39,000 flights a year over the four current Polar routes alone. In 2004, U.S. operators conducted 1,600 flights over these routes. Conservative industry estimates are that the number of these flights by U.S. operators will double by 2010. In the Southern Pacific and Atlantic Oceans and the Antarctic area, only a few routes are being flown today, mostly by non-U.S. carriers. The industry estimates that by 2010 there will be 3,200 flights per year in these areas. Transport Canada stated that operations over the Canadian Arctic rose from 85,000 in 1999 to 142,000 in 2004 and predicts a 7% yearly increase in these operations.

Second, in-service data shows that all airplanes, regardless of the number of engines, occasionally divert for reasons unrelated to engine failure. Since most operations are conducted over areas of robust infrastructure where the crew usually has numerous choices in airports, most diversions are not problematic. The same cannot be said for diversions over remote areas of the world, particularly in light of operational infrastructure changes that have eroded the basic safety net upon which long-range operations of all types of airplanes have come to rely.

In its development of proposed new regulations for expanded part 121 two-engine operations, ARAC recommended extending the authority of these two-engine airplanes to operate on routes that are greater than 180 minutes from an airport. The additional operational challenges of these more remote routes are equally demanding of all airplanes, regardless of the number of engines, and include such issues as extremes in terrain and climate, as well as limited navigation and communications infrastructure. Support of a necessary diversion and subsequent recovery in such areas demand added training, expertise, and dedication from all operators. Therefore ARAC concluded that there is a need to address these issues for all airplanes flying in these areas. ARAC recommended that some of the same ETOPS guidance developed for part 121 two-engine airplanes be applied to common elements of all airplane operations, both part 121 and part 135. The FAA agrees that such issues are relevant to all operations but is unable to justify the cost of this rule for all-cargo operations in airplanes with more than two engines and has accepted this recommendation only for passenger carrying operations.

As a result, the same limited geographic areas that would cover greater than 180-minute two-engine ETOPS would also be applicable to part 121 and part 135 passenger-carrying operations in three- and four-engine airplanes and all part 135 two-engine airplanes under this rule. Operations in these very limited areas are the only ones the FAA intends to regulate for these airplanes. All long-range operations could benefit from an ETOPS program. However, we believe, as do some commenters, the increased systems redundancy of the three- and four-engine airplane operating less than 180 minutes is sufficient to maintain acceptable levels of risk associated with engine failure at a distance far from an adequate airport. We also believe imposing new regulatory guidance on part 135 two-engine airplanes below this threshold would impose costs on these operations that cannot be justified. However, for the limited case of operations beyond 180 minutes from an adequate airport, we are convinced these operations must meet the minimum requirements of this rule.

The whole premise of ETOPS has been to prevent a diversion and, if one were to occur, to have programs in place that protect the diversion. ETOPS demands that propulsion systems are designed and tested to ensure an acceptable level of in-flight shutdown risk, and it demands that other airplane systems are designed and tested to ensure their reliability. Maintenance practices must be adopted to monitor the condition of the engines and take aggressive steps to resolve problems with airplane systems and engines, thus minimizing the potential for procedural and human errors that could lead to a diversion.

However, despite the best design, testing, and maintenance practices, situations may occur which require an airplane to divert. Regardless of whether the diversion is for technical (airplane systems or engines related) or non-technical reasons, there must be a flight operations plan in place to protect both crew and passengers during that diversion. Such a plan may include ensuring pilots are knowledgeable about diversion airport alternatives and weather conditions at those airports; pilots have the ability to communicate with the airline's dispatch office and air traffic control; and airplanes have sufficient fuel to divert to the alternate airport. Under the ETOPS “preclude and protect” concept, various failure scenarios also need to be considered by the operator. The best available options are then provided to the pilot before and during the flight.

Unlike the ETOPS guidance provided for two-engine airplanes, there has been no regulatory framework governing the long-range operations airplanes with more than two engines. For example, in emergencies such as loss of cabin pressure, current regulations require adequate oxygen supplies but do not require the operator to consider the amount of extra fuel necessary to reach a diversion airport. An analysis by Boeing shows that between 1980 and 2000, 33 of the 73 cruise depressurization events occurred on airplanes with more than two engines. A study conducted by this manufacturer using a modern four-engine aircraft carrying normal route planning fuel reserves raises issues about the adequacy of the current fuel planning requirements in the event of a diversion. Accordingly, the FAA finds there is a need for all passenger-carrying operations beyond 180 minutes from an

adequate airport to adopt the same “preclude and protect” concept contained in the two-engine ETOPS rules for all types of operations.

Part 135 operations are subject to the same types of causal factors resulting in accidents as large transport operations are under part 121. Therefore, the FAA is applying the same safety provisions required for part 121 operators to part 135 operators in these limited operations.

The FAA also recognizes the need to respond to the ICAO Annex 6 requirement for states to establish ETOPS thresholds for all two-engine turbine powered airplanes, including on-demand operations. Unlike other ICAO member states, the U.S. recognizes several categories of air carrier operations and has never imposed ETOPS rules on operators that conduct non-scheduled flights with “business jets.” The FAA is adopting these amendments for part 135 two-engine operations and passenger operations using airplanes with more than two engines in recognition that these operations are very similar to part 121 operations in terms of both the types of airplane used and the particular long-range routings. The FAA believes the rule is a legitimate and necessary step to harmonize with international aviation standards.

B. Impact of ETOPS Requirements on Engine Reliability

ETOPS design and maintenance requirements have contributed greatly to the reliability of the engines used in two-engine airplanes and appear to have had some impact on engines used in three- and four-engine airplanes. Applying these requirements to all airplanes that fly long distances from airports would improve the reliability of all engines. However we agree with many commenters that the current level of engine reliability coupled with the engine and system redundancy on airplanes with more than two engines is sufficient to protect the operation from critical loss of thrust. Consequently there is no requirement for an ETOPS maintenance program for ETOPS on airplanes with more than two engines.

Operators and manufacturers of airplanes with more than two engines have benefited from improvements in engine safety resulting from ETOPS requirements for airplanes with two engines.

9

Prior to ETOPS, we considered a 0.02 IFSD rate the best rate the industry could achieve. Since ETOPS began in 1985, the IFSD rates have improved to 0.01 or lower, half of what we previously thought possible. This overall improvement in the IFSD rate for all airplanes was a result of design improvements and aggressive maintenance programs introduced by the engine and airplane manufacturers to correct in-service events to maintain the world fleet IFSD rate below the ETOPS maximum.

9

Operators of three- and four-engine airplanes have benefited from the engine reliability improvements introduced into the same engine models that are also used on two-engine airplanes in ETOPS. Because of industry lease pool arrangements, there is a very strong industry incentive to maintain all engines to the ETOPS standard so that they can be swapped easily from non-ETOPS to ETOPS fleets.

C. Fuel Exhaustion

In 1983, a U.S.-manufactured two-engine airplane (foreign operator) made a no power landing at an airport in North America that was caused by an inadequate amount of fuel being loaded on the airplane for the flight.

In August 2001, a foreign manufactured two-engine airplane (foreign operator) made a no-power landing at an airport in the Eastern Atlantic, due to the fact that the flight crew was unaware of a fuel leak that resulted in a critical amount of fuel being leaked overboard.

Both of these airplane types are used in long-range passenger service in U.S. operations. Due to the similarity of the operating environment, it is the FAA's view that these particular incidents could have occurred in U.S. operations and, therefore, we view them as viable data points. We were extremely lucky that both airplanes in these instances made safe landings. The low fuel alerting requirement in the ETOPS rule will prevent low fuel quantity problems from becoming accidents on ETOPS flights. The low fuel alert will tell the flight crew when the quantity of fuel available to the engines falls below the level required to fly to the destination airport. The alert must be given while there is still enough fuel remaining to safely complete a diversion.

D. Cargo or Baggage Compartment Fire Suppression Requirements

The historical rate of occurrence of in-flight cargo and baggage compartment fires is approximately 1 × 10

−7

per flight hour.

10

This rate translates to about one cargo fire per 10 million flight hours. The FAA Seattle Aircraft Certification Office received five reports of cargo or baggage compartment fires for the period 1999 to 2004. In-flight fires can be particularly hazardous. The cargo and baggage compartment fire suppression system requirement will ensure all ETOPS airplanes whose cargo or baggage compartments require fire suppression systems will have systems capable of putting out fires and suppressing re-ignition for the longest duration diversion for which the airplane is approved.

10

Boeing analysis drawing from Boeing and other industry sources. Boeing presented this analysis to the ARAC ETOPS Working Group.

E. Decompression Scenarios

Most estimates for the probability of decompression on a commercial airplane are on the order of 1 × 10

−6

or 1 × 10

−7

per flight hour. Airbus, in a recent exemption request for the A380 stated in comments to the docket that there have been nearly 3,000 depressurization events since 1959.

11

It notes the probability of decompression due to the pressurization system alone to be in the order of 3.5 × 10

−6

per flight hour (3.5 decompression events per million flights). Boeing has provided a sample of depressurization events on Boeing airplanes from 1980 to 2000. Their sample shows 33 of 73 events occurred on three- and four-engine aircraft. Two-engine ETOPS requirements have always required those operations to flight plan their fuel requirements for a “critical fuel scenario.” This requirement has been codified into the new approval process in this rule.

11

Docket No. 20139, January 21, 2005.

Unlike ETOPS guidance for two-engine airplanes, there is no existing regulatory framework governing the long-range operations of airplanes with more than two engines other than the requirements of 14 CFR 121.193, which only governs the operation up to 90 minutes from an airport. The only rule governing decompression on a these airplanes addresses oxygen supplies and not fuel necessary for a successful diversion (14 CFR 121.329). The regulation does not require the operator of an airplane with more than two engines to check the conditions at possible diversion airports where the flight might terminate or check for fuel sufficiency.

Boeing conducted a study using a modern four-engine airplane carrying normal route planning fuel reserves. On any route that is 16 hours long, if a four-engine airplane has a major decompression anywhere in the cruise phase between approximately 7.25 hours to 12.5 hours, the airplane will not have sufficient fuel to descend and cruise at 10,000 ft and reach its point of origin or destination. A similar calculation for a 10-hour flight shows that between the 4.5 to 7.5 hours into the flight that same airplane would not have enough fuel to be able to continue

to its destination or turn back to its origination airport. Without a suitable airport at which to land, the results would be catastrophic. Under today's final rule, 14 CFR 121.646 now covers this omission and requires three- and four-engine operators flying more than 90 minutes to have enough fuel to fly to an adequate airport. The rule also extends ETOPS requirements on their operations that are greater than 180 minutes from an airport.

F. Satellite-Based Voice Communications

The use of SATCOM is a new requirement that applies only to ETOPS conducted beyond 180-minutes. Other available communication systems in use (VHF, HF voice, and datalink) all have significant limitations. The range of very high frequency (VHF) radio is limited to line-of-sight distances, typically less than 200 miles at high altitude. High frequency (HF) radio works at the longer distances from transmitting and receiving stations associated with ETOPS flights, but is subject to unreliable voice quality and loss of signal. This is particularly true during periods of intense solar flare activity.

Datalink capability (both HF and SATCOM) is limited by message length and ability to clearly state the issue or message. A bigger limitation on datalink is the full attention required by the flight crew to interact with a small and compactly designed keypad. The device is difficult to use without error during turbulence and airplane maneuvering. Its use also requires crew coordination and verification of message content. This is extremely distracting during a time that requires the pilot's focused attention on a problem at hand. In comparison, the use of SATCOM voice allows clear and immediate conversation that can quickly convey the situation and needs for the flight.

In March 2004 during a period of intense solar flare activity, a certification test flight was aborted because the crew could not communicate with air traffic using the HF radio. The purpose of this flight test was to simulate an airplane failure condition that made SATCOM unavailable and was conducted in a part of the world beyond the range of normal VHF radio signals. The test pilot decided the safety risk was too high to continue the flight test without his ability to communicate the airplane's position with air traffic control. This situation is similar to one an airline crew would face under similar solar conditions during a flight in areas outside the range of normal line-of-sight VHF radio in an airplane not equipped with SATCOM. The requirement for satellite-based voice communications adopted today will ensure that ETOPS flight crews will be able to communicate emergency situations with air traffic control or their airline during an ETOPS flight.

V. Applicability of the Final Rule

This final rule is applicable to all “extended operations (ETOPS)” as now defined. These are long-range operations beyond certain distances from adequate airports. Specifically they are: (1) Two-engine airplanes operated under part 121 when more than 60 minutes from an adequate airport; (2) passenger-carrying airplanes with more than two engines operated under part 121 when more than 180 minutes from an adequate airport; and (3) flight operations of all two-engine transport category turbine powered airplanes and all passenger-carrying transport category turbine powered airplanes with more than two engines under part 135 when more than 180 minutes from an adequate airport. Because of the harsh and remote environments of the Polar areas, portions of this rule are also applicable to all airplane operations in those areas, although these operations are not classified as ETOPS.

Today's rule imposes a requirement for a passenger recovery plan for certain operations of all U.S. flag and supplemental passenger operators. The rule also affects manufacturers of both airplanes and engines used in ETOPS by mandating certain certification standards for their manufacture. Should the manufacturers choose not to meet the new requirements of parts 25 and 33, their products could not be used for ETOPS operations.

12

12

Because of the potential benefits associated with the superior design of airplane-engine combinations demonstrated under the existing ETOPS certification programs, the FAA has decided to extend those requirements to the airplanes with more than two engines should the manufacturer wish to market these airplanes as suitable for ETOPS operation. The FAA anticipates the cost associated with this requirement ultimately will result in greater engine reliability at a very low cost. This is because these requirements are optional and will not take effect for such airplanes within the next 8 years.

Current ETOPS guidance only covers part 121 two-engine operations between 60 and 180 minutes from adequate airports. This rule codifies current guidance up to 180 minutes and is expanded to include unlimited two-engine operations in certain parts of the world. We have responded to certain comments to the NPRM by enlarging the geographic area defined for the current 207-minute approval and the geographic area defined for the new 240-minute ETOPS approval.

In keeping with the ARAC recommendation, the rule applies certain elements of current part 121 two-engine ETOPS guidance to operations in remote and demanding areas of the world, defined by flights more than 180 minutes from an adequate airport, of part 121 passenger-carrying airplanes with more than two engines and to comparable part 135 operations using turbine-powered airplanes. Many commenters to the original NPRM expressed concern over the cost of the rule and the difficulty in its application. Where the FAA determined that no reduction in safety would occur, we made changes from the NPRM. For example, the passenger recovery plan requirements are applicable only to part 121 ETOPS operations beyond 180 minutes from an airport or in the Polar areas and are no longer applicable to cargo operations. Similarly, such plans are only applicable to part 135 passenger operations in the North Polar Region. Likewise, we have eliminated ETOPS requirements for part 121 operations using airplanes with more than two engines operating at less than 180 minutes from an adequate airport in the Polar Regions. We have also excluded all-cargo operations of airplanes with more than two engines in both part 121 and part 135 from the ETOPS requirements of the rule.

Many commenters were concerned that airplanes they were currently using in operations that would be covered under the ETOPS rule would have to be re-certified when the new rule becomes effective. That is not our intent. A new § 25.3 has been created specifying the applicability of the new airworthiness standards to airplanes with existing type certificates on the effective date of the rule, or to airplanes for which an application for an original type certificate was submitted before the effective date. A new § 121.162 has been created delineating the airworthiness standards required for airplanes to be used in part 121 ETOPS. Appendix G, paragraph G135.2.3, has been revised to make the requirements applicable to all airplanes operated under that part similar to the requirements in § 121.162 for airplanes with more than two engines. Table 4 in the appendix compares the applicability of both the NPRM and the final rule to current guidelines.

VI. Delayed Compliance Dates and Grandfather Provisions

In this final rule the FAA has adopted a compliance schedule that will ease the

burden of compliance and make the rule less costly. Airplane-engine combinations that have been previously approved for ETOPS can continue to be used in those operations without re-certification. Manufacturers of two-engine airplanes who seek type design approval for ETOPS after the effective date of the rule must meet certain requirements based on whether they request approval for ETOPS up to and including 180 minutes, or beyond 180 minutes. For type design approvals of 180 minutes or less, two-engine airplanes with existing type certificates are exempted from the fuel system pressure and flow requirements, low fuel alerting, and oil engine tank design requirements. These three requirements are beyond what has been required under AC 120-42A.

For airplanes with more than two engines, the new airplane certification requirements found in part 25 applies only to airplane-engine combinations that are manufactured more than 8 years after the effective date of this rule.

Likewise, the operational requirements under part 121 have delayed compliance dates. Some requirements, such as dispatch, weather minimums and fuel supply, are already required by either regulation or ETOPS approvals and may require minimum adjustment to an operator's ETOPS program within 30 days of publication of today's rule. For requirements that take additional planning and implementation time—such as SATCOM, training and passenger recovery plans—the FAA established a 1-year extended compliance period. Cargo fire suppression may present a retrofit requirement for airplanes with more than two engines, and so the FAA is allowing 6 years to meet this requirement. Some requirements proposed in the NPRM have been eliminated. Passenger recovery plans are not required for part 121 ETOPS of 180 minutes or less or for all-cargo operations. For part 135 operations, passenger recovery plans are only required in the North Polar Region. An ETOPS maintenance program is not required for passenger airplanes with more than two engines operated in ETOPS, and the ETOPS requirements are not applicable to all-cargo operations in airplanes with more than two engines in either part 121 or part 135.

Because part 135 operators will have limited ETOPS operations, the FAA has decided to grandfather from today's rule all part 135 airplanes manufactured up to 8 years from the effective date of the rule. For purposes of airworthiness requirements, part 135 operators may use these airplanes in ETOPS without certification under § 25.1535. This is a change from the NPRM, which proposed grandfathering only those airplanes that were on an operator's operations specifications up to 8 years after the rule. Under the NPRM, they would then have had to remain on the operator's operations specifications to continue to operate ETOPS.

To meet the operational requirements, the FAA has allowed a delayed compliance date of 1 year for part 135 operators to meet the North Polar, passenger recovery, and training requirements of the final rule. For cargo fire suppression, the final rule allows 8 years for currently approved part 135 ETOPS operators to comply.

Tables 2 and 3 of the appendix present these delayed compliance dates.

VII. In-Flight Shutdown Rates

A 12-month rolling average IFSD rate is the primary measuring tool the FAA uses to determine if an airplane-engine combination has acceptable propulsion system reliability before approving it for ETOPS. It is also used to monitor the health of a fleet of existing ETOPS approved airplanes in service. A 12-month rolling average IFSD rate is calculated by dividing the number of in-flight shutdowns that occur in an airplane fleet by the total number of engine-hours

13

that accumulate in that fleet during the same 12-month period. Each month, the number of in-flight shutdowns and engine-hours from the same month 12 months earlier are dropped from the calculation and replaced by the number of IFSD's and engine-hours in the current month. In this way, the resulting IFSD rate “rolls” from one month to the next.

13

An engine-hour is an operating hour accumulated on each engine installed on an airplane. Similarly, an airplane-hour is an operating-hour accumulated on an airplane independent of the number of engines installed. For example, one airplane-hour on a four-engine airplane would correspond to four engine-hours (one engine-hour for each engine.)

The manufacturer of an airplane approved for ETOPS and the manufacturer of the engines installed on that airplane monitor the IFSD rate of all airplanes and engines of that type, whether or not those airplanes and engines are operated on ETOPS routes. Today's rule refers to these airplanes as the “world fleet.” Operators of that airplane-engine combination monitor the IFSD rate of only the airplanes and engines in their fleet. In-flight shutdown rates are discussed in several parts of the rule. Section 1.1 defines “in-flight shutdown,” which an operator or manufacturer uses, for ETOPS purposes only, to determine which in-service occurrences count in the calculation of an IFSD rate.

Part 25, appendix K identifies the IFSD rate limits that a two-engine airplane must remain at or below in order to receive an ETOPS type design approval.

Paragraph 21.4(b)(2) identifies IFSD rate limits for airplanes approved for ETOPS in service. The manufacturer of an airplane approved for ETOPS and the manufacturer of the engines installed on that airplane must issue service information to the operators of that airplane-engine combination, as appropriate, to maintain the world-fleet IFSD rate at or below the regulatory limit. Operators may incorporate this service information as part of their reliability program to maintain the IFSD rate of their fleet at or below the world-fleet limits.

Paragraph 121.374(i)(1) identifies the IFSD rate limits that prompt an investigation into whether there are any common cause or systemic problems in an operator's ETOPS program that are contributing to the high IFSD rate. The operator must report the results of its investigation and any necessary corrective action it is taking to the FAA. The IFSD rates specified in this paragraph are higher than the world-fleet rates in recognition that this action is taken only after the operator's normal reliability program fails to maintain the operator's rate at or below the world-fleet IFSD rate objective.

Several factors may cause in-flight shutdowns that contribute to an operator's IFSD rate exceeding the world-fleet rate. First, there may be causes of in-flight shutdowns for which the manufacturer has not issued service information. There may be existing service information available to prevent causes of in-flight shutdowns that the operator has not yet incorporated into its fleet. An operator may have unique maintenance or operational procedures that unknowingly cause in-flight shutdowns. Finally, an operator may experience a higher IFSD rate for no known reason other than statistical chance.

Another factor affecting an operator's IFSD rate is the numerical effect that a single in-flight shutdown has on the rate of a small fleet of airplanes. An IFSD rate of 0.01 per 1,000 engine-hours results in an in-flight shutdown approximately once every 100,000 engine-hours. A fleet of 100 two-engine airplanes operating an average of 10 hours a day would accumulate 2,000 engine-hours per day or 730,000 engine-hours in 12 months. This fleet of airplanes could experience seven in-

flight shutdowns during that 12-month period and still have an IFSD rate below the 0.01 limit. A 10-airplane fleet of the same type operated in the same manner would accumulate only 73,000 engine-hours in a 12-month period. One in-flight shutdown on the 10-airplane fleet would result in an IFSD rate of 0.014, which is above the 0.01 limit. Thus, one in-flight shutdown on an operator of a small fleet of airplanes can place their fleet above the limit. To further compound the impact of fleet size, an in-flight shutdown that occurs in June of one year continues to count in the IFSD rate until the next June. A single in-flight shutdown would place the operator of the 10-airplane fleet above the 0.01 limit for an entire year.

This one factor showing the magnified effect an in-flight shutdown has on the IFSD rate of a small fleet has generated the most concern from both the manufacturers and operators since AC 120-42A introduced IFSD rates into the ETOPS standard. They are concerned the FAA, or other airworthiness authorities, will adopt an FAA ETOPS standard that improperly uses IFSD rates in the rule to revoke the ETOPS authority of an operator who experiences in-flight shutdowns due to causes beyond its control, simply because its rate exceeds the allowable limit. Many comments to the NPRM were in some way connected to reducing the number of occurrences that count toward the IFSD rate, or in lessening the regulatory effect of a rate that exceeds the limit.

The FAA will not revoke an existing ETOPS operational approval solely because of a high IFSD rate. The operating rules require the operator to investigate the cause of each in-flight shutdown and report to the FAA any corrective actions it is taking to prevent future occurrences. Only after additional in-flight shutdowns in the operator's fleet cause the FAA to believe the operator's corrective actions are insufficient to reduce the IFSD rate below the limit, will the FAA investigate taking further action. During this subsequent investigation, we will consider how a small fleet, even with successful corrective actions, may need up to a year to reduce the IFSD rate to below the required limit. However, if we determine that a series of in-flight shutdowns is caused by a common cause or systemic problem in the operator's ETOPS program, we may reduce the maximum allowable diversion time or revoke the ETOPS approval until we are satisfied that the operator has corrected the problem.

The FAA received several comments on the proposed IFSD rate requirements. Continental Airlines (Continental) and United Airlines (United) were concerned that the definition of in-flight shutdown, as proposed, would cause certain events to count against their IFSD rate even if the engine was not actually shut down by the flightcrew. Continental also stated that the proposed definition does not address modern engine auto-relight capability in which an engine flameout is detected by the engine control and an engine re-start is initiated automatically without any flightcrew action.

The FAA finds these concerns have merit. We have revised the NPRM definition of in-flight shutdown to clarify our intent and address these commenters' concerns. First, we have replaced “in-flight” with “when an airplane is airborne” which more clearly indicates that a condition for an in-flight shutdown is that the airplane is in the air (wheels not touching the ground). There has been some disagreement in the past about whether an engine failure that occurs during the takeoff roll should be considered an in-flight shutdown. This change clarifies our intent that the airplane must be in the air.

We have clarified that an in-flight shutdown includes a situation when a flight crew member cycles the engine start control, however briefly, even if the engine operates normally for the remainder of the flight. This clarification addresses confusion over events that have occurred in service where a pilot has cycled the engine start control switch to re-establish normal engine operation following a compressor stall that causes the engine to not respond to throttle changes. Some have argued that such events, even though the engine was temporarily shut down, should not be counted in the IFSD rate because normal engine operation was reestablished and the engine operated normally for the remainder of the flight.

We agree that an engine control system that performs this cycling as part of its normal design without any flight crew action should not be counted as an in-flight shutdown. The engine control system is performing a function that the engine was certified to perform. Accordingly, we have specifically excluded this type of “auto-relight” function from the revised definition.

We have also excluded from the revised definition the situation where an engine does not achieve desired thrust, but is not shutdown. There have been such events in service where some have argued that they should be counted as an in-flight shutdown because the engine does not produce usable thrust for the remainder of the flight. Historically, we have not counted these “loss of thrust control” events as in-flight shutdowns because the engines were not physically shutdown by the flight crew. All of these changes to the definition of in-flight shutdown are consistent with our past interpretations under AC 120-42A.

United, American Airlines (American), and Continental all said that the IFSD rates contained in various parts of the rule were inconsistent. United suspects that some of the rates are based on the individual operator's rates and others are based on the world fleet rates. American and Continental requested further clarification as to why the rates in § 121.374 were different from those in part 25, appendix K. American also said there is no guidance or timeline to establish when or if the 120-minute initial rate of 0.05 will be reduced down to 0.02.

The Air Line Pilots Association (ALPA) commented that since the IFSD rates are a benchmark by which a regulator must manage an operator's performance and measure its success, the critical issue is what number above this rate will the FAA use to manage in-flight shutdowns. ALPA asked what the consequence of such a process would be?

The FAA agrees that the NPRM created confusion with how IFSD rates are used for propulsion system reliability monitoring. We have revised the rule to clarify the differences in the various sections of the type design and operating rules that address IFSD rates.

Part 25, appendix K, K25.2, defines the world-fleet IFSD rates that a two-engine airplane would have to achieve before it could receive an ETOPS type design approval based on service experience. As noted by Boeing, calculation of this rate is not based solely on ETOPS operations. There are no comparable IFSD rate requirements for airplanes with more than two engines in K25.3 of appendix K. Because of the greater number of engines per airplane, the corresponding rates for these airplanes would be so high that we were concerned we may inadvertently encourage a lower standard than is already normally achieved without a specific IFSD rate requirement.

The NPRM proposed that IFSD rates for the purpose of obtaining type design approval for ETOPS would be approximate rates. This terminology came from AC 120-42A, which had been successfully applied to those airplanes currently used in ETOPS. However, for the purposes of a final rule, such terminology does not convey

that a candidate airplane-engine combination must be at or below these IFSD rates before the FAA would grant an ETOPS type design approval. We recognize that there are circumstances where a candidate airplane-engine combination may be slightly above the regulatory limit, but because of factors such as the small fleet size effect discussed earlier, we may determine that the rate meets the intent of the rule. Therefore, we have revised K25.2.1(b) of this final rule to say that the world-fleet must be at or below the limit unless otherwise approved by the FAA.

14

14

Boeing had suggested the FAA merely specify the IFSD rate as approximate. Such a qualifier results in an ambiguous regulation. The FAA believes that it can retain the desired flexibility by approving, on a case-by-case basis, those IFSD rates that exceed the regulatory cap because of unique circumstances.

K25.2.2(b)(2) of appendix K, requires an applicant for Early ETOPS approval to design an airplane's propulsion system to minimize failures and malfunctions so as to achieve the same IFSD rate objectives as apply to airplanes with service experience.

Paragraph 21.4(b)(2) defines IFSD rates for airplanes that have received ETOPS type design approval. These rates are requirements that apply to airplane and engine manufacturers, and they are used to monitor the reliability of the world fleet in service.

Additionally, the world-fleet IFSD rate applies to operators who must show the FAA that they have the ability to achieve and maintain these rates before the FAA will grant approval to conduct ETOPS. This requirement comes from AC 120-42A, paragraph 10(b) and is now codified in the final rule in part 121, Appendix P, section I, paragraph (a). (Note that the FAA proposed this appendix as Appendix O in the NPRM. Because an Appendix O was adopted in a separate final rule after the ETOPS NPRM was issued, the FAA is adopting proposed Appendix O as Appendix P in this final rule.)

The IFSD rates in § 121.374 are for an individual operator's propulsion system monitoring program. They were derived from AC 120-42A, Appendix 4, and were recommended by the ARAC. These rates are slightly higher than those for the world fleet required elsewhere in the rule. Although operators are required to investigate the cause of each in-flight shutdown in order to maintain their fleet IFSD rate at or below the level required for the world fleet, these higher rates provide a trigger for when the operator must do a comprehensive review of its operations to determine if there are any common cause or systemic errors contributing to the high rate.

The IFSD rate required to obtain type design approval for 120-minute ETOPS in part 25 is 0.05 per 1,000 engine-hours or less. However, unless the IFSD rate is 0.02 or less, the manufacturer must provide a list of corrective actions in the CMP document specified in K25.1.6 of Appendix K that, when taken, would result in a rate of 0.02 per 1,000 engine-hours or less.

15

15

The NPRM did not clearly state in proposed paragraph 21.4(b)(2) that a reduction in the IFSD rate from 0.05 to 0.02 for 120-minute ETOPS was linked to compliance with a CMP document that was required as a condition for an airplane's ETOPS approval. We have revised the language of this paragraph to clarify this intent.

The Air Transport Association (ATA) concurs with the IFSD rate requirements for two-engine airplanes under the propulsion system monitoring requirements in § 121.374(i) as they simply codify the existing ETOPS policy and guidance. However, it objects to including IFSD rate standards for three- and four-engine airplanes. The ATA stated that the proposed rate threshold for these airplanes is significantly higher than the current IFSD rates of the industry. It also says that the existing reliability programs and reporting requirements of § 121.703 has provided a safe and reliable system for these airplanes.

The FAA agrees that the IFSD rates identified in § 121.374(i) are significantly higher for three- and four-engine airplanes than for airplanes with two-engines. These rates were the result of applying established risk models and an analysis of the probability of losing a critical number of engines on airplanes with three and four engines.

We also agree that the industry is achieving IFSD rates that are significantly lower than the threshold rates in § 121.374(i). However, if an operator of a three- or four-engine airplane were to actually have a rate higher than the threshold, this provision will aid the FAA and the operator in determining if there are any common cause or systemic errors contributing to the high IFSD rate.

JAA and the UK CAA believe that the 0.01 IFSD rate standard for greater than 180-minute ETOPS should apply to 207-minute approval in the North Pacific as well. Airbus makes a similar comment, but they also suggest that for the 207-minute exception-based operation, the 0.01 rate should be applied in a similar manner to 120-minute ETOPS: That is, start out with an initial rate of 0.02 with a CMP standard that results in a rate of 0.01.

The FAA disagrees that the 0.01 per 1,000 engine-hours IFSD rate requirement should be applied to the specific exception based 207-minute ETOPS approval. This operation is fundamentally a 180-minute operation. The 207-minute allowance is only permitted when the alternate airports normally available within 180 minutes diversion time are not available for a particular flight in the North Pacific area of operations. The baseline airplane requirement for 207-minute ETOPS is a 180-minute type design approval.

The JAA and UK CAA comment that the IFSD rate targets should not be specified in part 21 as it creates an immediate non-compliance in case of an excessive rate, particularly early in the life of an airplane. As discussed earlier, this rule only requires a type certificate holder to issue service information, as appropriate, to maintain the world-fleet IFSD rate at or below the limit. Paragraph 21.4(b)(2) does not apply to an Early ETOPS airplane until the world fleet has accumulated a minimum of 250,000 engine-hours. Accordingly, these commenters' concern about an immediate non-compliance in the early life of an airplane is unwarranted.

The JAA and UK CAA also comment the FAA proposal for diversion times greater than 180 minutes has a fixed IFSD rate requirement unrelated to the maximum approved diversion time, whereas the JAA criteria provide a curve of IFSD rate target from 0.014 to 0.01 per 1000 flight hours for diversion times ranging from 3 to 10 hours.

The FAA requirements are intended to eliminate propulsion system reliability as a consideration from the maximum diversion time capability of the airplane. Only the most time-limiting airplane system capability will determine the maximum diversion time capability for a two-engine airplane under the new requirements for airplanes certified for ETOPS greater than 180 minutes in part 25. The FAA's risk model, discussed in detail in the NPRM, established that the probability of complete loss of thrust due to independent failures with an IFSD rate for two-engine airplanes of 0.01 per 1000 engine-hours would be sufficiently low that the main focus of long-range operational safety should be on reducing the possibility of other risk factors. This approach eliminates the need to re-evaluate an airplane-engine combination's propulsion system reliability each time the applicant seeks to increase the airplane's approved maximum diversion time.

Dassault comments that there are no IFSD rate requirements for airplanes that will be operated under part 135. Thus, they posited that appendix K should be revised to say that the minimum IFSD rates only apply to

airplanes that will be used in part 121 operations. Dassault's comment was made with respect to the Early ETOPS method of approval of Appendix K. However, this comment has equal applicability for airplanes certified for ETOPS using the service experience or combined service experience and Early ETOPS methods.

We disagree with Dassault's position. At the time an airplane receives a type certificate, the FAA cannot determine what rules an airplane will be operated under throughout its service life. Part 25 airworthiness standards apply equally to all airplanes receiving part 25 type certificates regardless of the operating part they will be flown under.

Boeing commented that the term “IFSD” in the rate implies that only “flight” hours should be used as the denominator for the statistic. Boeing recommends changing how the rate is based from “engine-hours” to “engine

flight

hours.” To do as Boeing suggests would constitute a change in the way IFSD rates have been calculated since ETOPS began in 1985. The FAA discussed whether to calculate the IFSD rate calculations using engine flight-hours when the IFSD rate definition was established in 1985. At that time, the industry had already established methods for tracking engine-hours, and the FAA did not want to create an additional burden on the industry by requiring it to track engine-flight hours for the purpose of calculating an IFSD rate for ETOPS. Given the historical method of calculation is well understood, we have decided against adopting Boeing's suggestion.

Boeing also recommended replacing the word “operations” with “type design approval” for each IFSD rate listed in K25.2.1(b) of Appendix K. Boeing stated that part 25 pertains to type design approval and using the word “operations” could create unnecessary confusion with the operational approvals granted under parts 121 and 135. We agree and have made this change as Boeing recommended.

The NPRM proposed a new paragraph 21.4(c), which defined what actions the FAA would take if the world-fleet IFSD rate were exceeded. General Electric (GE) stated that section 21.4(c) is inconsistent with AC 39-8, which stated that any IFSD rate less than 2 × 10

−4

per cycle is not an unsafe condition. We disagree with GE. AC 39-8 provides general policy the FAA Engine and Propeller Directorate uses as a guideline for determining whether an unsafe condition exists for engines used in all types of airplane operations. Since it is advisory in nature, this policy is subject to change.

Proposed paragraph 21.4(c) stated the FAA will review the IFSD rate to determine if an unsafe condition exists. The FAA will review all in-service problems to determine if an unsafe condition exists and may issue ADs as necessary to correct each unsafe condition found. If each individual cause for an in-flight shutdown does not constitute an unsafe condition, the FAA has the discretion to determine that a high IFSD rate by itself constitutes an unsafe condition and may issue an AD mandating a revised CMP document containing several corrective actions that collectively will bring the IFSD rate back down to a safe level. Because the FAA already has this discretionary authority, proposed paragraph 21.4(c) is unnecessary and has been withdrawn from this final rule.

VIII. Definition of ETOPS Significant System

Boeing, Airbus, and ALPA had comments on the proposed definitions of ETOPS significant systems, ETOPS Group 1 systems, and ETOPS Group 2 systems.

Boeing stated that the definition of ETOPS significant systems should be revised to add “extended” before “diversion” at the end of the first sentence to clarify that ETOPS significant systems relate to extended diversions of ETOPS flights, not any length diversion. ALPA recommended deleting the last part of the definition of ETOPS significant systems “based on the relationship to the number of engines, or to continued safe engine operation” since the definition of ETOPS significant systems make this redundant. Boeing recommended deleting the parenthetical examples from the definition of ETOPS Group 1 systems. They felt that the examples could be confusing or misinterpreted for designs where these systems may not be associated with the number of engines. Airbus commented that the NPRM introduced definitions for ETOPS Group 1 and ETOPS Group 2 systems, but did not use them anywhere in the proposed rule. It recommended the FAA withdraw these two definitions.

The FAA agrees that the definition of ETOPS significant systems needs clarification. We agree with the recommended changes from Boeing and ALPA for the reasons they cited. We have made these changes in the final rule.

Airbus is correct that nowhere in the NPRM was ETOPS Group 2 significant systems used. However, the term “ETOPS group 1 significant systems” was used in several places in the NPRM, including the problem reporting requirements for Early ETOPS airplanes in paragraph 21.4(a) and the relevant experience assessment required for Early ETOPS two-engine airplanes in K25.2.2(a) of Appendix K. The generic term “ETOPS significant systems” is also used in several places, including paragraph 21.4(a) and the time limited systems requirement of K25.1.3(c).

We looked at whether we could eliminate the group 2 definition and combine the group 1 definition with the basic ETOPS significant system definition. However, there is a sufficient difference between the group 1 systems, whose design depends on the number of engines on the airplane, and the other ETOPS significant systems, such as a cargo fire suppression system, whose design does not depend on the number of engines, but whose failure or malfunctioning could adversely affect the safety of extended operations. We could not eliminate this broader class of ETOPS significant systems from the rule, nor could we include these systems in those requirements that only apply to the group 1 systems without increasing the burden of those requirements. Even though “ETOPS group 2 significant systems” is not used in the rule, we have decided to keep this term for completeness. We have revised the definition to clarify that an ETOPS group 2 system is any ETOPS significant system that is not a group 1 system.

IX. Airplane and Engine Certification Requirements

A. Transport Category Airplanes Airworthiness Standards (Part 25)

As proposed in the NPRM, we are adding a new § 25.1535 to part 25 as a general requirement for manufacturers seeking ETOPS type design approval. The FAA decided against adopting a new subpart into part 25 because ETOPS approval is an optional certification for manufacturers. The NPRM contained three provisions under this section. These included showing compliance with part 25 requirements considering the maximum mission time and longest diversion time, considering crew workload and operational implications and the flight crew's and passengers' physiological needs following system failures, and complying with the requirements of a new part 25 appendix. The specific airworthiness requirements applicable to ETOPS type design approval are contained in that appendix.

16

16

The first two provisions, contained in subparagraphs (a) and (b) of § 25.1535 in the NPRM, are also specific airworthiness requirements that are

more appropriately located in new appendix K. In this final rule, we have re-identified these subparagraphs as paragraphs K25.1 and K25.1.2.

1. General

Today's rule adopts a regulatory scheme that airplane manufacturers must follow to receive ETOPS type design approval. Airplanes with existing type certificates at the time this rule becomes effective are exempted from some or all of the new part 25 requirements (see § 25.3).

17

The inclusion of type design requirements and reliability validation methods in the rule has been objected to by the JAA and the UK CAA. They state a regulatory approach is too prescriptive and does not allow any flexibility for alternative reliability methods. These commenters add that the design materials are already included as objective requirements in Title 14 of the Code of Federal Regulations. Further, they state that the reliability validation process should be included as interpretive material to be agreed upon at the time of application.

17

The FAA believes the accommodation to existing type certificate designs should relieve the concerns raised by NACA regarding the economic impracticability of the new requirements for existing airplane designs, a concern shared by the FAA.

The FAA understands that the European Aviation Safety Agency (EASA) may be taking a different approach in overseeing ETOPS design criteria. We believe JAA's and UK CAA's comments reflect this philosophy. The type design requirements and reliability validation methods adopted today are the result of nearly 20 years of successful experience in certifying airplanes for ETOPS. However, most of this experience comes from the two major transport airplane manufacturers in the world today. As ETOPS has grown, and now with the new operating requirements expanding ETOPS to part 135 airplanes, we expect many more manufacturers to apply for ETOPS type design approval.

The type design requirements contained in this rule provide a consistent standard of proven ETOPS type design approval methods for the new applicants. This will ensure that all manufacturers use the same methods as used successfully in previous ETOPS approvals the FAA granted under AC 120-42A and the Boeing Model 777 ETOPS special conditions.

We also disagree that the airworthiness standard contained in appendix K does not allow any flexibility for alternative reliability methods. If an applicant chooses to pursue validation methods different from those in appendix K, the applicant may do so under § 21.21(b)(1).

Dassault stated that parts of the proposal, such as the requirement for an independent electrical power source for fuel boost pumps and cross-feed valve actuation, would impose a system architecture. Dassault notes that the goal of a requirement should be to set safety objectives rather than drive airplane systems design.

We agree with Dassault's basic premise that the goal of a requirement should be objective rather than prescriptive. We have made every effort to define objective requirements whenever possible except where existing experience dictates that a specific design requirement is necessary to provide an acceptable level of safety.

18

18

The particular section mentioned in Dassault's comment codifies a provision of the 207-minute ETOPS policy letter EPL 20-1. As stated in the preamble to the NPRM, loss of normal electrical power to the boost pumps is the primary cause of the loss of fuel system boost pressure. The FAA finds it necessary to include this requirement in order to address this specific cause of loss of fuel boost pressure on airplanes being certified for greater than 180 minute ETOPS. Paragraph K25.1.4(a) defines the basic objective for the fuel system design. Changes to this rule in response to Boeing comments on that provision provide a less restrictive requirement while maintaining the basic objective.

Dassault also stated that the NPRM lacked information that normally would be part of an advisory circular. It recommended the FAA publish the advisory circular and then reopen the comment period. We have decided against delaying this rule until after publication of an advisory circular on the proposed rule. Since the advisory circular defines an acceptable method of compliance, but not the only method, it is not a necessary element of the rule. Dassault will have an opportunity to comment on the associated advisory circular under a separate notice of availability.

2. Additional Airworthiness Requirements for Approval of an Airplane-Engine Combination for ETOPS (Part 25, Appendix K)

The NPRM proposed adding a new appendix K, which defines specific airworthiness requirements for type certification of an airplane for ETOPS. The appendix is divided into three parts. Section K25.1 is applicable to all airplanes, K25.2 is applicable to airplanes with two engines, and K25.3 is applicable to airplanes with more than two engines.

The NPRM divided the appendix into three sections I, II, and III. Paragraphs of each section were labeled sequentially as (a), (b), (c), and so on. This numbering system led to confusion on how to refer to paragraphs from different sections with the same number. In this final rule, we have reorganized the paragraph numbering to include the applicable section in the paragraph number. This renumbering more clearly identifies which section of the appendix a particular paragraph is in.

Appendix K—Design Requirements (K25.1)

We moved paragraphs (a) and (b) from proposed § 25.1535 in the NPRM to K25.1 as these are design requirements that an applicant must comply with for all airplane-engine combinations proposed for ETOPS type design approval. The following discussion of comments refers to the designation of these paragraphs in the final rule.

Boeing stated that the ARAC proposal did not discuss how system safety assessments are conducted for ETOPS. Boeing points out that the JAA's draft Notice of Proposed Amendment (NPA) addresses how to conduct system safety assessments for group 1 versus group 2 systems and recommends the FAA include similar information in its guidance material. Boeing recommends the FAA acknowledge in the preamble that the system safety assessments are different for group 1 and group 2 systems and reference the JAA's draft NPA.

Boeing is correct that ARAC did not discuss how airplane system safety assessments are to be conducted for ETOPS. However, we disagree with Boeing that there should be a difference between Group 1 and Group 2 systems. Section K25.1 simply requires an applicant to comply with the requirements of part 25 considering the maximum flight time and the longest diversion time for which the applicant seeks approval. Airplane safety assessments would be covered under the specific objectives of §§ 25.901(c) and 25.1309 considering these additional factors.

The FAA has already established a body of policy for showing compliance with these sections. These policies do not differentiate between systems whose design depends on the number of engines from those that do not. Boeing did not provide any justification for treating relevant system failure conditions for ETOPS assessment differently just because they are associated with Group 2 systems. The main impact that ETOPS will have on airplane safety assessments is a potential increased hazard when considering the long range and diversion distances associated with an ETOPS flight. The purpose of conducting the airplane safety

assessments required by §§ 25.901(c) and 25.1309 are to evaluate the airplane for potentially hazardous safety conditions that are not specifically addressed elsewhere in the rule.

Boeing also provides suggested language for system safety assessments to be included in the ETOPS advisory circular. That language is not relevant to the specific safety objective of paragraph K25.1.1. However, Boeing will have an opportunity to comment on the part 25 ETOPS AC under a separate notice of availability.

Although paragraph K25.1.1 would require an applicant to consider the flight crew's and passengers' physiological needs following failures during a maximum length diversion, Transport Canada is concerned about the introduction of new technologies such as onboard oxygen generating systems. These systems would allow flight with a depressurized cabin at altitudes in excess of 15,000 feet, which would require less fuel for diversions on ETOPS flights because airplanes do not use as much fuel at higher altitudes.

Transport Canada stated that the NPRM does not adequately address the potential physiological problems for crewmembers or passengers associated with continued exposure to higher altitudes even if breathing 100 percent oxygen. Therefore, Transport Canada recommends the FAA revise the appendix to include a maximum decompression profile altitude, such as 18,000 feet.

We agree that Transport Canada's comment has merit, but is beyond the scope of this rulemaking project, which was to codify existing ETOPS standards and certain ARAC recommendations. The FAA is investigating specific policy or future regulations for the certification of onboard oxygen generating systems. When we receive an application for approval of such a system, we will apply this policy as interpretation of existing regulations or introduce special conditions if appropriate.

Appendix K—Operation in icing conditions (K25.1.3(a))

The NPRM proposed that an ETOPS airplane must be certified for flight in icing conditions in accordance with § 25.1419, which is otherwise optional. In addition, the NPRM proposed that the ice protection systems must be capable of continued safe flight and landing at engine inoperative and decompression altitudes in icing conditions, and the applicant show the unprotected areas of the airplane would not collect a load of ice that would make the airplane uncontrollable or create too much drag to safely complete a diversion in icing conditions.

Only ALPA supported the proposed requirements for operation in icing conditions without change. New World Jet stated the manufacturer already demonstrates that its airplanes can operate in icing conditions and questions why the proposal would be different from normal requirements.

Although airplanes are regularly certified for flight into known icing conditions under § 25.1419, part 25 does not require that certification in order to be granted a type certificate. Paragraph K25.1.3(a)(1) of today's rule makes certified flight into known icing conditions a prerequisite for ETOPS approval. The other part of paragraph K25.1.3(a)(2) addresses the unique aspects of operation in icing conditions during an ETOPS flight not now covered in a basic part 25 evaluation of flight into icing conditions.

Boeing agrees the FAA needs to codify the icing criteria in AC 120-42A, paragraph 8(b)(11). However, Boeing is concerned the proposed requirement could create confusion with respect to compliance with § 25.1419 and the operational fuel planning requirements in parts 121 and 135. Boeing recommends the rule be rewritten to a single requirement stating, “The airplane must be able to safely conduct an ETOPS diversion in icing conditions.”

The FAA does not believe paragraph K25.1.3(a) will create confusion with respect to compliance with the basic § 25.1419 icing regulation and the operational fuel planning requirements in parts 121 and 135. In addition to applying to airplane manufacturers under part 25, rather than operators under parts 121 or 135, the objectives of paragraph K25.1.3.(a), including § 25.1419, are different from the fuel planning requirements of parts 121 and 135. The part 25 requirements establish that an airplane can operate safely in icing conditions that could be encountered during an ETOPS flight. The operational requirements ensure enough fuel is onboard to safely complete a flight along a route with known icing conditions. In order to establish safe operation, the manufacturer must define the most critical ice accumulation that may occur on the airplane. This accumulation usually also results in the highest fuel usage. Thus, it is likely the airplane manufacturer will use the testing and analysis performed for compliance with paragraph K25.1.3(a) to develop the performance data an operator will need for compliance with the fuel planning requirements of parts 121 and 135.

The JAA and UK CAA state the terms “load of ice” and “too much drag” in the proposed appendix are not appropriate language for regulatory material because they lack precision. Airbus recommends the FAA withdraw the proposed requirement because this issue is not unique to ETOPS and would be more appropriately addressed under a general rulemaking action.

We agree the proposed paragraphs lacked normal regulatory precision. We also agree with Boeing that the intent of AC 120-42A was to ensure the airplane would continue to be airworthy, considering the exposure to potential icing conditions during an ETOPS diversion at engine-inoperative or decompression altitudes.

The NPRM proposed requirements to meet this objective, but did not clearly state that continued safe flight and landing at engine inoperative and decompression altitudes in icing conditions applies to all of the flight phases during an ETOPS diversion, including a 15-minute hold. The NPRM also did not define the icing conditions to consider during each of these flight phases.

In § 25.1419, safe operations with ice accretions on the protected and unprotected areas are considered, but not specifically mentioned. The FAA has revised this final rule to more clearly state which flight phases and associated icing conditions must be considered during an ETOPS diversion. Paragraph K25.1.3(a)(2), requires that the airplane must be able to safely conduct an ETOPS diversion with the most critical ice accretion resulting from:

(A) Icing conditions encountered at an altitude that the airplane would have to fly following an engine failure or cabin decompression; and

(B) A 15-minute hold in the continuous maximum icing conditions of Appendix C with a liquid water content factor of 1.0.

(C) Ice accumulated during approach and landing in Appendix C icing conditions.

This new paragraph makes the rule language similar to § 25.1419 while adding the icing conditions encountered during an altitude-limited diversion to those factors currently evaluated under § 25.1419.

Boeing, Dassault, and Airbus all state additional guidance for this rule is needed in an associated advisory circular. Dassault and Airbus stated the NPRM would require analytical and flight testing to assess the impact of ice accumulation. The commenters add that without guidance material describing the assessment, they cannot comment

properly on this section. Airbus also adds that it is inappropriate for the FAA to define a critical test parameter in an advisory circular.

As discussed above, the FAA has revised this final rule to clarify the flight phases and associated icing conditions to consider during an ETOPS diversion. The FAA disagrees that the associated guidance material is necessary to properly comment on the proposal. Airbus rightfully notes that it is inappropriate for the FAA to define a critical test parameter in an advisory circular, and the FAA is not doing that. Rather, the advisory circular merely will describe an acceptable method for showing compliance with the new rule.

The rule as revised stands on its own merit. The second and third provisions of the revised paragraph K25.1.3(a)(2) are based on Appendix C icing conditions that are currently evaluated for compliance with § 25.1419. There is currently no accepted industry standard for icing conditions that may be encountered during an altitude-limited diversion due to an engine failure or cabin decompression. Until such an industry standard is developed and accepted by the FAA, each applicant will have to propose an acceptable method for showing compliance with this requirement.

Airbus stated that the preamble does not indicate why the FAA increased the severity of the certification standards and does not relate the increase to a clearly documented service event or safety problem that has occurred. Nor does the economic impact assessment compare the cost of the proposed type design assessment to the expanded safety benefit. Airbus stated the FAA proposed to reduce the contribution of icing in the ETOPS fuel reserve calculations compared with the reserves required by current ETOPS criteria as a result of the CASP II

19

icing research program that ARAC extensively used to show that prolonged substantial icing was virtually impossible during a diversion. On the other hand, Airbus pointed out that the type design rule seems to assume that extremely severe icing beyond the level covered by normal certification criteria may be encountered during engine inoperative diversions at decompression altitudes. Thus, Airbus posited that the proposed type design rule appears to contradict the operating rule, which excludes significant prolonged icing.

19

The Atmospheric Environment Service (AES) of Canada with support from the National Research Council (NRC) of Canada conducted the Second Canadian Atlantic Storms Program (CASP II) out of St. John's, Newfoundland during the period of January 16 through March 16, 1992. The objective of this program was to study the icing climatology off the east coast of Canada to provide better short term, severe weather forecasting for the area around the Hibernia Oil Fields and the cod fishing ground in the Grand Banks. ARAC used the data from this research to evaluate the severity and extent of icing conditions that may be encountered during an ETOPS diversion.

We have not increased the severity of part 25 certification standards as indicated by Airbus' comments. ETOPS approvals accomplished in accordance with AC 120-42A have included conditions that were not previously considered during a part 25 certification program. This rule codifies the existing ETOPS policies and practices. Consequently, the part 25 regulations address the ETOPS-related issues that were addressed in previous ETOPS approvals. The FAA has determined that the current policies applied to approve airplanes for ETOPS have provided an acceptable level of safety. This rule simply codifies these policies.

The FAA does not agree that the type certification and operating rules are contradictory. Previous ETOPS type design approvals have included an evaluation of the drag effects of conservative ice accumulations on airplane surfaces. The FAA determined that this conservatism, combined with the operational fuel reserves resulting from the original ETOPS icing fuel planning requirements, has been excessive. The NPRM proposed to reduce the fuel reserves required for ETOPS operational dispatch on the assumption that the fuel consumption used for fuel planning would be based upon the conservative ice shapes used during the type certification of the airplane.

The Final Regulatory Evaluation includes the overall cost to comply with the proposed rulemaking and the overall benefit of the rule. The ETOPS icing requirements define additional conditions that an applicant must consider when showing compliance with § 25.1419 to certify an airplane for flight in icing. The maximum ice accretion on an airplane during an ETOPS diversion will be compared to the maximum accretion from other icing conditions used for icing certification to determine the most critical ice shapes to demonstrate during certification flight testing. The applicant will also likely use these ice shapes to define fuel consumption in icing conditions that the operators will use for ETOPS fuel planning.

Airbus indicates that the rule seems to assume the airplane will encounter “extreme severe icing” during a diversion. This interpretation of the proposed amendment is incorrect. The rule requires an applicant consider icing conditions expected to occur at the altitudes an airplane would fly during a maximum length diversion with an inoperative engine or depressurized cabin. The rule merely requires the consideration that the airplane may be at altitudes conducive to icing for extended distances. The FAA does not consider this to be extremely severe icing, although the resulting ice accumulations may be greater than that resulting from traditional compliance with § 25.1419.

We acknowledge the CASP II icing research that Airbus cites showing that prolonged substantial icing is virtually impossible during a diversion. However, the CASP II data only covers a limited part of the globe in the North Atlantic region. Since a significant future growth is forecast for ETOPS in the Arctic, Antarctic and Southern oceanic areas, we are concerned about the ice accumulation that may occur during altitude-limited diversions in those areas.

As we indicated above, each applicant will have to propose an acceptable method for showing compliance with the icing requirements. The applicant may use whatever data at its disposal to justify the icing conditions used to determine the most critical ice accretion during an altitude limited diversion.

Dassault recommends the FAA not go beyond already established certification standards, in particular the maximum three inches of ice in the JAA's proposed Advisory Circular Joint (ACJ) 25.1419. Dassault's proposal would impose a specific design requirement in this rule. In keeping with our overall objective of basing regulations on the safety objectives, instead of driving airplane design, we are not adopting Dassault's recommendation. Each applicant will have to propose an acceptable method for determining the ice thickness to be evaluated in order to meet the overall objectives of the requirement.

The British Air Line Pilots Association (BALPA) notes that an auxiliary power unit could be susceptible to icing during prolonged exposure to icing conditions while on the ground. BALPA is concerned that running the APU in flight during prolonged icing conditions may result in surging or failure and loss while the APU is being used as a critical power source. As a result, BALPA recommends the FAA amend the rule to require an APU to continue to function in icing conditions.

The FAA agrees with BALPA that an APU could be susceptible to icing during prolonged exposure to icing conditions. The FAA evaluates APU

exposure to icing conditions during basic certification of the airplane for compliance with § 25.1093(b). This evaluation includes the ground operating condition, which historically has been the most severe operating environment for an APU in icing conditions. This finding correlates with the commenter's own experience. However, the FAA does not believe that a change to the rule is necessary. New section K25.1 will require an applicant to consider the ETOPS mission in showing compliance with the requirements of part 25. For an APU, this would include operation in icing conditions for compliance with the applicable part 25 APU icing requirements.

Airbus stated that three- and four-engine airplane service experience indicates that depressurization events almost never occur in cruise or during the ETOPS portion of the flight. It goes on to state that engine failures do not put three- and four-engine airplanes at icing altitudes. Airbus contends that there is no support for applying the type design rule to three- and four-engine airplanes.

Though uncommon, decompression events have occurred at cruise altitudes. Furthermore, most decompression events are independent of the number of engines on the airplane. Following decompression, it is common practice to descend to and maintain an altitude where supplemental oxygen is not required. This would result in operation of the airplane at altitudes where icing can occur.

The FAA agrees that the engine inoperative altitudes for three- and four-engine airplanes may place them above altitudes conducive to icing. This would mean that the engine inoperative diversion would not contribute to the most critical ice accretion that the applicant must consider for compliance with the rule. However, the applicant would still have to consider the ice accretion during a 15-minute hold, approach and landing as those phases of flight are relevant to all airplanes regardless of the number of engines.

Appendix K—Electrical power supply (paragraph K25.1.3(b))

The NPRM proposed requirements for airplane electrical system reliability, including a requirement that airplanes certified for ETOPS greater than 180 minutes must be equipped with at least three independent electrical generation sources.

The JAA and the UK CAA state that the second and third electrical system requirements proposed in the NPRM are objective requirements already covered in part 25 and JAR 25. The FAA agrees. These proposed paragraphs are essentially restatements of § 25.1309(b)(1) and (2), which are already required for ETOPS airplanes by new paragraph K25.1.1. These paragraphs are deleted from the final rule.

ALPA expressed concern that the proposal did not conform to the current standard of requiring three independent electrical power sources for all two-engine airplanes approved for ETOPS, including for diversion times less than 180 minutes. ALPA stated that ARAC was tasked with codifying current design and MMEL relief provisions for two-engine airplanes. ALPA expressed discomfort with the lack of justification in the NPRM for ignoring current requirements. ALPA also suggested that future three- and four-engine airplanes could be developed with fewer than three electrical power sources. ALPA proposed changes to the rule to ensure that all ETOPS airplanes covered by part 121 and two-engine airplanes covered by part 135 would comply with the three-generator requirement.

The FAA acknowledged in the NPRM that the three-generator requirement would apply only to airplanes being certified for greater than 180-minute ETOPS. AC 120-42A specifies three generators for any airplane approved for ETOPS under this guidance. However, the FAA also stated in the NPRM that the proposed requirement represented a compromise position that allowed ARAC consensus on the proposal. ALPA is the only organization to comment that the rule should apply to ETOPS approval of any two-engine airplane intended for part 121 operations, indicating general support for this compromise.

However, after further consideration, and in order to establish a consistent industry minimum standard for ETOPS, the FAA has revised paragraph K25.1.3(b) to require a minimum of three independent sources of electrical power for all airplanes being approved for ETOPS without regard to maximum diversion time. Manufacturers already have to comply with § 25.1309. The FAA has determined from service experience that a minimum of three electrical power sources is necessary to comply with the objectives of § 25.1309 when considering long ETOPS diversions. Paragraph K25.1.3(b) codifies the “three-generator” criteria of paragraph 8.(b)(8) of AC 120-42A.

20

20

Four commenters remarked that the three-generator requirement was too prescriptive. These commenters believe that the rule should allow the safety analyses to dictate the number of electrical power sources rather than specifying a number in the rule. We disagree that the rule is too prescriptive. This paragraph establishes a consistent industry minimum standard for ETOPS in keeping with the original objective of paragraph 8(b)(8) of AC 120-42A.

New World Jet commented that levels of risk are defined based upon systems design and failure rate and then compared to a determined level of acceptable risk for the operation to be conducted. If the risk is within an acceptable level, the aircraft should be allowed to operate at the specified number of minutes from an airport. The probability of an event associated with aircraft system failures, rather than the number of generators, should determine if an aircraft is qualified for a route.

The FAA agrees that the level of risk of a system failure should be commensurate with its effect on the safety of the airplane. The airplane system assessments required by § 25.1309 do exactly as New World Jet suggested. New section K25.1 would require an applicant to show compliance with this section considering the effects of a system failure during an ETOPS flight. The three generator requirement of paragraph K25.1.3(b) is an acknowledgement that electrical generator technology has not yet achieved a level of reliability that would allow an electrical system design with fewer than three generator sources and still meet the system safety objectives of § 25.1309 for ETOPS approval.

The JAA and the UK CAA stated that the JAA specifies what loads each electrical power source should be capable of powering in an Advisory Circular Joint. Since each new airplane may have unique electrically powered functions that are critical to continued safe flight and landing, the FAA is reluctant to specify a list of functions. The safety assessments required under § 25.1309 will determine what system functions must be powered by the three required electrical power sources. These assessments should consider the cumulative effect on airplane safety from the loss of seemingly unrelated airplane system functions resulting from the same loss of power.

The JAA and UK CAA add that for beyond 180-minute ETOPS, a fourth stand-by power source is needed, because it is unlikely that three power sources would meet the safety objectives associated with the total loss of electrical power. The FAA does not have any data to confirm a fourth stand-by electrical power source would be required to meet the safety objectives associated with the total loss of electrical power for diversion times

greater than 180 minutes. Accordingly, the FAA is comfortable in letting the safety analyses of § 25.1309 determine if additional power sources are required.

American Airlines asks whether a ram air turbine generator would be considered an alternative source of electrical generation for compliance with the rule or whether the APU is the only acceptable third independent source of power for a “legacy” aircraft like the Boeing Model 777. It further queries whether the determination of the three independent electrical generation sources is left to the discretion of the individual operators or the aircraft manufacturer.

The airplane manufacturer will decide what power sources constitute the three independent electrical power sources for compliance with paragraph K25.1.3(b). Any electrical power source that provides those airplane functions for continued safe flight and landing during an ETOPS diversion would qualify as one of the three independent sources of electrical power. Electrical power sources the FAA has accepted for meeting this requirement include generators powered by a ram air turbine (RAT), APU generators, or dedicated back-up generators driven by the main engines. Future airplanes may have other arrangements to meet this requirement.

Appendix K—Time-limited systems (K25.1.3(c)) and Airplane flight manual (K25.1.7(d))

The NPRM proposed to add a new requirement to existing § 25.857(c)(2) that would require an applicant to provide the certified time capability of a Class C cargo compartment fire suppression system in the airplane flight manual for ETOPS approval. One paragraph in the proposed appendix would have required an applicant to define each ETOPS significant system that is time-limited while a separate paragraph in that appendix would have required the airplane flight manual to contain the maximum diversion time capability of the airplane.

The JAA and the UK CAA commented that it is not clear whether the certified time capability of the cargo fire extinguishing system under the proposed § 25.857(c)(2) would be considered as a particular case or if it would be treated separately as additional time limited information under the proposed appendix. They also commented that the rule should indicate how to translate the maximum system capability into maximum diversion time.

The FAA agrees that the NPRM was unclear how proposed § 25.857(c)(2) and the two paragraphs of the proposed appendix are related to each other. We also agree that it was not clear how cargo and baggage compartment fire suppression system information and other limiting airplane systems' time-capability should be defined in the airplane flight manual. We have revised this final rule to state that the applicant must define the system time-capability of each ETOPS Significant System that is time-limited under appendix K (K25.1.3(c)). A time-limited cargo fire suppression system for any cargo or baggage compartments would be included under this requirement.

We have also revised the airplane flight manual requirement in paragraph K25.1.7(d) to require the operator to identify in the airplane flight manual the system time-capability for both the most limiting fire suppression system for any cargo or baggage compartment and the most limiting ETOPS Significant System other than fire suppression for cargo and baggage compartments. It is necessary to specify both times in the airplane flight manual because of how they are used in the operating rules to determine the maximum diversion time that an airplane may fly. We are withdrawing the proposed change to § 25.857(c)(2), because we have determined it is no longer needed and is potentially confusing.

The FAA likewise recognizes that the proposed paragraph on maximum diversion time capability for the flight manual was confusing. We did not intend to require the maximum diversion time capability be stated in the airplane flight manual. The maximum diversion time that an airplane may operate is controlled by the operating rules in parts 121 and 135. Our changes to this requirement in paragraph K25.1.7(d) described above clarify our original intent.

Boeing stated the FAA needs to issue advisory material to clarify the compliance methods for obtaining ETOPS approval of cargo compartments. Boeing recommended the FAA allow certification of any required changes using the policies and certification methodology in place at the time of original type certification of the airplane. Boeing also stated that compliance with the flight test requirements in § 25.855(h)(3) should be allowed based on data from the original certification flight tests of the airplane model being modified. Boeing added that additional flight testing should be required only if novel systems designs are used.

In its comment, Boeing seemed to be concerned about the certification of increased capacity cargo or baggage compartment fire suppression systems on currently certified airplanes. The requirements of the Changed Product Rule, § 21.101, will apply to the modification of currently certificated airplanes. The certification of time-limited cargo or baggage compartment fire suppression systems will be done in accordance with the applicable certification requirements, methods, and policy as determined through compliance with § 21.101.

Appendix K—Fuel system design (K25.1.4(a))

The NPRM proposed three requirements for an airplane fuel system design. The first would require that the system supply fuel to the engines at a pressure required by the engine type certificate for any failure condition not shown to be extremely improbable. The second would require one fuel boost pump in each tank and at least one crossfeed valve to be powered by a back-up electrical generation source other than the primary engine or APU driven generators. The third fuel system provision would require alerts to be displayed to the flight crew when the quantity of fuel falls below the level required to complete a flight.

Boeing stated the FAA has unintentionally proposed an increase to the safety requirements for existing ETOPS approvals. This section presented objective requirements but does not take into consideration the practical impact on fuel system design. Boeing noted the FAA's explanation in the NPRM suggests that there must always be a method for boosting the fuel pressure delivered to the engine beyond what is available from head pressure or fuel tank ram air rise. Boeing pointed out that with today's fuel boost pumps and their associated reliability, the standard design configuration of two fuel boost pumps per tank would not meet the intent of this section.

Boeing agreed it is important that fuel be available to the operating engine or engines at the pressure and flow required for safe operation. Boeing pointed out that the ARAC and the JAA working groups extensively discussed this issue and the intent of this requirement was to ensure the fuel boost pumps would function following all power supply failures not shown to be extremely improbable. Boeing stated ARAC found the two fuel boost pumps per tank configuration was satisfactory for any length ETOPS operation and determined adding boost pumps to a fuel tank would be detrimental and introduce additional complexity to the fuel system without any benefit. Boeing

stated the JAA's draft Notice of Proposed Amendment allows engine operation at negative fuel pressures (suction feed) provided appropriate criteria are met. Boeing disagreed with the NPRM and stated that not allowing suction feed is overly restrictive. Boeing also suggested rule language changes consistent with their comments including provisions for demonstrating suction feed operation.

We disagree with Boeing's proposal to limit consideration of loss of fuel boost pressure to only fuel pump power supply failures. The proposed rule stated a clear objective that the airplane fuel system must deliver fuel to the engines at the pressure and flow they require for any intended operation following airplane failure conditions that are not extremely improbable. These may include failures to more than just the fuel pump power supply.

This rule intentionally increases the safety standard from that applied to airplanes approved under the previous guidance. The FAA went to great lengths in the NPRM to explain the safety justification for this requirement. Section 25.1351(d) requires an applicant to show that an airplane can operate safely in visual flight rule weather conditions for at least 5 minutes with normal electrical power inoperative using the type fuel most likely to cause an engine flameout with the airplane initially at its maximum altitude. Airplane manufacturers show compliance with this requirement by demonstrating that an engine will start on suction feed following an expected engine flameout at this altitude. The reason this demonstration is required for a minimum of five-minutes is to give time for the flight crew to restore normal electrical power to the fuel boost pumps after engine restart.

Current regulations do not require applicants to demonstrate the engines will operate at negative pump inlet pressures (suction feed) for extended periods of time. The types of engine failure conditions that could result from suction feed operation fall into two categories, engine operating problems and mechanical failures. Engine operating problems could mean engine instability, permanent loss of thrust, or flameout. Mechanical failures to the engine pump would result in flameout and permanent loss of the engine for the remainder of the flight.

The FAA is aware of at least one engine pump failure that occurred on a test stand during a non-required demonstration of suction feed operation. A loss of fuel boost pressure to more than one engine during an ETOPS diversion on an airplane with engines with this kind of vulnerability could potentially result in the failure of multiple engines from the same cause. However, contrary to Boeing's comments, certifying an engine for extended suction feed operation is an acceptable option for complying with paragraph K25.1.4(a). In this case, the airplane manufacturer must design a fuel feed system to deliver fuel to the engine above a certified suction feed pump inlet pressure limit established for the engine under § 33.7. The engine manufacturer must demonstrate acceptable engine operation and integrity under part 33 in order to establish this suction feed limit.

The effect of today's rule is to ensure that the engines will always have fuel delivered at normal pump inlet pressure, or that the engines are certified to operate for the longest diversion time for which the airplane manufacturer is requesting approval at the lowest engine pump inlet pressure expected to occur during operation with the normal airplane fuel boost pumps inoperative. If an applicant chooses to use suction feed as a means to comply with this rule, it must demonstrate safe operation of the airplane in that configuration.

21

21

Boeing recommended rule changes that add certain conditions that an applicant must consider if suction feed is to be a means to comply with the rule. We agree that these conditions further clarify the meaning of the rule and have added them to the final rule as paragraph (1), (1)(i) and (1)(ii) with editorial changes to state the requirement in proper regulatory language. The following paragraphs proposed in the NPRM have been re-numbered sequentially.

When using suction feed to comply with this requirement, the Instructions for Continued Airworthiness developed in accordance with § 25.1529 must include procedures for maintaining the integrity of the fuel system plumbing. The purpose of these procedures is to prevent the introduction of air into the fuel feed lines during suction feed operation. Any air in the fuel feed lines can lead to flameout of a turbine engine.

Boeing recommends revising the proposed requirement for an alternative fuel boost pump power source to not limit it to a back-up electrical generator. Boeing stated that an acceptable design could be a four-generator system, all with equal capability. We agree with the intent of Boeing's comment that the back-up generator source required in proposed requirement could include a fourth main electrical generator instead of a back-up generator system. We have broadened the requirement of K25.1.4(a)(2) to state that for two-engine airplanes to be certified for ETOPS beyond 180 minutes, one fuel boost pump in each main tank and the actuation capability of at least one crossfeed valve must be capable of being powered by an independent electrical generation source other than the three required to comply with K25.1.3(b). This requirement does not apply if the required fuel boost pressure or crossfeed valve actuation is not provided by electrical power.

Dassault commented that it understands the FAA's intent for an automatic warning to clearly indicate to the flight crew what's wrong with the fuel system, but believes this is not the only way to achieve this goal. Dassault stated that pilot training and fully developed flightcrew procedures are another efficient way to achieve the same goal. Dassault pointed out that automatic fuel alerts would require flightcrew initialization before the flight. Dassault noted that the human error during this procedure is of the same order of magnitude as the application of procedures. Therefore, Dassault stated that adequate pilot training and procedures provide an equivalent means of compliance.

UPS stated that an automatic warning is not necessary for three- and four-engine ETOPS airplanes because of their demonstrated safety and reliability. UPS pointed out that the rule seems to assume a two-crew airplane and does not take airplanes with three crewmembers into account. UPS added that compliance with this section would require extensive modifications to three- and four-engine airplanes to add flight management computers to provide the required alerts. It argued this burden is unjustified because there is no need for the automatic warning.

The FAA does not believe crew training and fuel management procedures are a long-term solution for the types of fuel exhaustion events the FAA is addressing with this requirement. Dassault's proposal in effect would not require anything not already done operationally. The low fuel alerting system will provide a safety net for major fuel loss events or fuel loading errors perhaps too difficult to detect by operational procedures alone, such as occurred in 2001 when an Air Transat A330 was forced to land in the Azores following an all engine flameout from fuel exhaustion.

However, we recognize some existing airplanes may have difficulty in complying with this requirement without substantial airplane system modifications. Also, older three-crew airplanes have a flight engineer who monitors fuel quantity throughout a long flight. The FAA considers this additional crewmember to be an

acceptable alternative to the automatic low fuel alerting for those airplanes.

In recognition of these concerns and the compensation that a flight engineer provides, the FAA has modified the rule to exempt existing airplanes from this requirement. However, all new two-crew airplanes, and two-crew airplanes with existing type certificates manufactured 8 years after the effective date of the rule must comply with this requirement.

Appendix K—APU design (K25.1.4(b))

When APUs are necessary for an airplane to comply with the ETOPS requirements, the NPRM proposed that these APUs have adequate reliability and be capable of starting and providing their required functions up to the maximum operating altitude of the airplane, but no higher than 45,000 feet.

Dassault, Air New Zealand, New World Jet, the JAA, and UK CAA questioned the proposed requirement to substantiate that the APU in-flight start envelope extends up to the maximum altitude of the airplane, but need not exceed 45,000 feet. Dassault, Air New Zealand, and New World Jet indicated that 45,000 feet was too high. The JAA and UK CAA commented the demonstration of APU starting should cover all altitudes for which the airplane is approved.

The ARAC ETOPS Working Group discussed whether required APUs on ETOPS airplanes should be capable of starting throughout the entire flight envelope. The FAA was concerned that an electrical generator failure should not force an ETOPS flight to a lower altitude in order to successfully start an APU. Doing so could create problems with other traffic on the same track in areas with limited communications capability. Also, the additional fuel consumed during a descent to start an APU and climb back to the assigned altitude could itself lead to a diversion later on in the flight if the remaining fuel reserves become too low. However, certain members of the working group stated that some part 25 airplanes were certified for altitudes above 50,000 feet and that it may not be possible to design an APU to start at those altitudes. The 45,000 foot minimum altitude start capability requirement is an acknowledgement of this possibility while still mandating a minimum start envelope that would keep any necessary altitude changes above the more densely traveled altitudes along these routes.

New World Jet commented that a need to start an APU at the maximum operating altitude is unlikely. Dassault stated that the need to start an APU in flight is likely to occur following an engine failure, which would result in an altitude substantially less than maximum certificated altitude. Dassault recommended changing the requirement to the one-engine inoperative maximum altitude. New World Jet commented that the 45,000-foot start requirement assumes that an airplane experiences a dual generator failure, is then unable to receive a clearance to descend and has to declare an emergency. They say that this scenario seems unlikely.

We disagree with these commenters. Dassault implies an APU would only be started in flight following an engine failure. More commonly, the APU is started following a main engine-driven generator failure. Generator failures may occur at any altitude that the airplane is certified to fly. Typical mean time between failures of main engine-driven generators is approximately 10,000 hours while the mean time between failures for engines on ETOPS airplanes operating under the existing 180-minute standard is 50,000 hours. For ETOPS approval on a two-engine airplane for greater than 180 minutes, the required engine reliability will be 100,000 hours between engine shutdowns. Therefore, an electrical generator will fail 5 to 10 times more frequently than an engine on the same ETOPS airplane. Additionally, the loss of two electrical generators in flight is not uncommon. Dassault's proposal would lower the existing level of safety compared to airplanes approved under the criteria of AC 120-42A, which have had APU start and run capability up to the maximum certificated altitude of the airplane.

Air New Zealand stated the APU on the Boeing 767, which is currently approved for ETOPS, is certified to start up to 35,000 feet, while the airplane maximum altitude is 43,100 feet. Air New Zealand's statement is in error. We required design changes to the 767 APU so that it would start up to 43,100 feet when we approved that airplane for 180-minute ETOPS. These design changes are required by the Boeing 767 ETOPS CMP document before that airplane may be flown on 180-minute ETOPS routes.

United expressed concern that an APU should only be required on airplanes with more than two engines to meet the design requirements if the APU is one of the three sources for back-up in-flight electrical power. The final rule does address United's concern. We have revised paragraph K25.1.4(b) to clarify that the APU reliability and starting requirements apply only if an APU is needed to comply with that appendix K.

Appendix K—Engine condition monitoring (K25.1.5)

The NPRM proposed that an applicant must develop procedures for engine condition monitoring in accordance with part 33, appendix A.

Transport Canada recommended the FAA eliminate the term “condition monitoring” because its use was discontinued in reliability centered maintenance and Maintenance Steering Group MSG-3, and contends there is an inherent safety risk associated with mixing terminologies and maintenance program development processes. Transport Canada recommended a harmonized and standardized approach for setting terminology and maintenance program requirements.

Transport Canada recommended substantial changes to the proposal to permit manufacturers, operators, and regulatory authorities to participate in a structured maintenance review board process for the development of an airplane ETOPS maintenance program and engine health assessment program.

Transport Canada made some interesting points, but they involve concepts that are beyond the scope of the proposed ETOPS rule, which was to codify the existing ETOPS standard contained in AC 120-42A. This advisory circular used the term “engine condition monitoring” which has been successfully applied since its inception. Transport Canada's other suggested changes would involve a level of integration that has never been used before. Although such an integrated approach is in the FAA's long term goals of improving safety, we do not want to compromise those future long-term goals by introducing such concepts into this rule without a much larger review in the context of that effort.

Appendix K—Configuration, maintenance, and procedures (CMP) (K25.1.6)

The NPRM proposed that any configuration, maintenance, and operational standards necessary to maintain appropriate reliability for ETOPS must be contained in a CMP document.

Transport Canada proposed eliminating the CMP document requirement and placing the information that would be contained in the CMP document into the illustrated parts catalog, the Instructions for Continued Airworthiness required by § 25.1529, or the airplane flight manual. It states a separate CMP document is duplicative for a new airplane being evaluated for ETOPS as part of a basic type certificate program.

The CMP document is an extension of the airplane type design definition described in § 21.31 as a prerequisite for the airplane being eligible for extended operations. FAA airworthiness inspectors use compliance with the CMP requirements to determine if an airplane may be added to a carrier's operations specifications.

Since the CMP requirements are a condition for the ETOPS approval, they have to be in an FAA approved document. The Instructions for Continued Airworthiness required by § 25.1529 must be accepted by the FAA, but are not approved. The illustrated parts catalog is a manufacturer document and is not even reviewed by the FAA. The airplane flight manual may contain ETOPS procedures since it is approved for issuance of the type certificate. However, the airplane flight manual would not contain the other information that would be included in a CMP document. Therefore, we are adopting paragraph K25.1.6 as proposed with editorial changes to make the rule easier to understand.

Appendix K—Two-engine airplanes (K25.2)

Section K25.2 defines the ETOPS design requirements applicable to two-engine airplanes. Three methods are provided for ETOPS certification. An applicant may assess a candidate airplane-engine combination already in service by a review of service experience gained on that airplane. If an airplane-engine combination has not yet been certified, an applicant may use the Early ETOPS method, which takes a systems approach to the design, testing, and monitoring of a new airplane-engine combination as a substitute for service experience. This method establishes more rigorous analysis and test requirements than for an airplane with existing service experience. If the candidate airplane-engine combination has some service experience, but not enough to use the service experience method, the applicant may substitute 15,000 engine-hours of world-fleet service experience in place of the rigorous airplane demonstration test required by the Early ETOPS method. All of the other Early ETOPS requirements would apply in this case.

Appendix K—Service experience method (K25.2.1)

After obtaining a minimum of 250,000 engine-hours of service experience, an applicant using the service experience method would conduct airplane and propulsion system assessments to evaluate the safety and reliability of those systems for ETOPS. A two-engine airplane must also meet minimum IFSD rate requirements and demonstrate by a flight test that it has the capability to safely conduct ETOPS flights for the maximum diversion time being assessed.

Boeing and GE commented that the proposed requirement to have corrective actions for all causes or potential causes of engine in-flight shutdowns or loss of thrust control occurring in service does not recognize that even engines with IFSD rates well below the rate required for ETOPS approval occasionally fail in service. While they agreed with the philosophy of the rule to correct causes of engine in-flight shutdowns or loss of thrust control, there are situations in service where no cause is identified or no technology is currently available to prevent future failures. They posited the FAA has accepted situations where industry did not have corrective actions for some causes if the IFSD rate was at an acceptable level without these corrective actions. They go on to state the intent of the ARAC proposal was to ensure an acceptable IFSD rate for the ETOPS approval being sought.

These commenters propose similar changes to address these concerns. Boeing proposes the causes of in-flight shutdowns and loss of thrust control be assessed and appropriate corrective actions be taken to ensure an appropriate IFSD rate will be maintained. GE proposes all causes or potential causes of engine IFSD or loss of thrust control must have corrective actions, unless it can be shown the rate of the causes or potential causes will not result in IFSD rates exceeding the requirement.

The FAA agrees the proposed rule needs clarification. Sometimes a corrective action is either not technologically feasible or cannot be determined because the root cause of the failure is unknown. We also agree we have accepted situations where industry did not have corrective actions for some causes or potential causes of in-flight shutdowns if the rate was at an acceptable level without these corrective actions. However, we disagree with commenters' proposed changes.

The commenters' proposed changes suggest that for an airplane with an existing IFSD rate above the maximum allowable for approval, the identification or development of corrective actions could stop at a point when the applicant predicts the IFSD rate would just meet the maximum allowable with incorporation of those corrective actions already identified or developed. The FAA found from airplanes approved using the guidance of AC 120-42A, Appendix 1, the basis for the proposed rule, that it is necessary to correct as many causes of in-flight shutdowns or loss of thrust control as possible at the time the applicant conducts the propulsion system assessment in order to offset unforeseen problems that would cause a higher IFSD rate in the future.

However, we want to be consistent with how we have required corrective actions for causes of engine in-flight shutdowns and loss of thrust control in past airplane ETOPS approvals. Therefore, we have revised paragraph K25.2.1(c)(2) to say that corrective actions are not required for events where the manufacturer is unable to determine a cause or potential cause, for events where it is technologically unfeasible to develop corrective actions, or where the world fleet IFSD rate already complies with the final IFSD rate required by paragraph K25.2.1(b) for the level of ETOPS approval being sought. However, the FAA emphasizes that we will respond to any cause of an engine in-flight shutdown or loss of thrust control that we determine to be an unsafe condition even if the IFSD rate meets the required rate. In such a case, we will issue an airworthiness directive (AD) requiring corrective action on all airplanes that may fail from the same cause. If the FAA determines an unsafe condition would exist only during the ETOPS portion of a flight, we would require the corrective action be specified in the CMP document as a condition for ETOPS approval of the airplane under the provisions of § 21.21(b)(2). That paragraph requires an airplane to have no feature or characteristic that makes it unsafe for the issuance of a type certificate. In addition, the FAA reiterates that an operator must comply with the provisions of the CMP document as a condition for ETOPS operational approval under part 121.

Boeing stated that the NPRM unintentionally requires a more comprehensive airplane systems assessment under the proposed service experience approval method than it does for the proposed Early ETOPS method. Boeing stated that assessing, providing corrective action for, and showing effectiveness of the corrective action as proposed in the NPRM creates an extraordinary amount of work if it includes all ETOPS significant systems, including Group 1 and Group 2 systems. Boeing recommends changing the requirement to apply the airplane systems assessment only to ETOPS group 1 significant systems.

The FAA acknowledges that the NPRM would have required a more

comprehensive airplane systems assessment under the service experience method than the comparable relevant experience assessment under the Early ETOPS method. The proposed service experience method would have required corrective actions for “all” causes or potential causes of ETOPS significant system failures while the Early ETOPS method would have required the applicant to identify specific corrective actions for “relevant” design, manufacturing, operational and maintenance problems. Also, the proposed Early ETOPS method relevant experience assessment would not require corrective actions if the nature of the problem is such that it would not significantly impact the safety or reliability of the system. This proposed requirement also defines what types of problems are “relevant” for this assessment.

Boeing is correct the FAA did not intend to create this inconsistency. The requirements for conducting assessments of the airplane systems for ETOPS should be similar when using either the service experience or the Early ETOPS method. The only difference between the two methods is that the data used under the service experience method would come from the candidate airplane-engine combination; whereas for the Early ETOPS method, the data would come from previously certified part 25 airplanes manufactured by the applicant. The FAA has changed the requirements for these two assessments to be similar in paragraphs K25.2.1(d) and K25.2.2(a) in this final rule.

Boeing comments that it may not be clear from the proposal that the flight test requirements are related specifically to ETOPS operations. Boeing stated that it is not necessary for every conceivable failure condition to be demonstrated. It says that the intent of the rule is to codify AC 120-42A, paragraph 8.d.(3), which was meant to focus on failures of ETOPS significant systems, primarily group 1 systems, or group 2 systems whose failure would be more hazardous during an ETOPS diversion. To clarify this intent, Boeing proposes changing the rule to state a flight test must be conducted to validate the adequacy of the airplane's flying qualities, performance, and the flight crew's ability to safely conduct an ETOPS diversion with engine inoperative and non-normal worst case ETOPS significant system failure conditions that are expected to occur in service.

The FAA agrees that the required flight test evaluation is related to safely conducting an ETOPS diversion. We also agree the intent of the flight test is to evaluate ETOPS significant systems. Any airplane system whose failure would be worse the farther an airplane is from a place to land would make the associated system an ETOPS significant system by definition. We have changed K25.2.1(e) as Boeing recommends. We have also revised the similar requirement for airplanes with more than two engines in paragraph K25.3.1(c) for consistency.

Appendix K—Early ETOPS method (K25.2.2)

The NPRM proposed an Early ETOPS approval method that takes a systems approach to the design, testing, and monitoring of a new airplane-engine combination. This method contains several elements designed to minimize the number of design, maintenance or operational problems that could result in engine in-flight shutdowns or diversions. This method also includes elements to demonstrate that the airplane systems have the capability to meet the operational requirements for ETOPS. An applicant using this method must evaluate problems that occurred on previous airplanes it has manufactured and describe how it will prevent these same problems from occurring on the new airplane. The applicant must design the propulsion system to preclude failures or malfunctions that could result in an in-flight shutdown. The applicant must validate all maintenance and operational procedures for ETOPS significant systems. There are ground and flight test requirements and a problem-tracking and resolution system requirement the FAA will use to evaluate the airplane prior to ETOPS approval. This problem-tracking and resolution system continues in accordance with new § 21.4(a) after an airplane receiving ETOPS approval under this method enters service. Finally, the rule defines reliability demon

This text is long and has been trimmed here. Open the source document for the complete record.