Special Conditions: Extended Range Operation of Boeing Model 777 Series Airplanes

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 25

[Docket No. NM-81, Special Conditions No. 25-ANM-84]

Special Conditions: Extended Range Operation of Boeing Model 777

Series Airplanes

AGENCY: Federal Aviation Administration, DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for approval of the Boeing

Model 777 airplane for Extended Range Operation with Two-engine

Airplanes (ETOPS) without the prerequisite service experience currently

required for ETOPS approval. The manufacturer has requested that the

Model 777 airplane be found to be acceptable for ETOPS operation at the

time of type certification. Extended range operation of twin engine

airplanes is not envisioned by the airworthiness standards for

transport category airplanes, and has been determined to constitute a

novel of unusual feature. These special conditions contain the

additional safety standards that the Administrator considers necessary

to establish a level of safety equivalent to that provided by the

airworthiness standards for transport category airplanes.

EFFECTIVE DATE: July 1, 1994.

FOR FURTHER INFORMATION CONTACT:

Steven P. Clark, FAA, Seattle Aircraft Certification Office, Propulsion

Branch, ANM-140S, Transport Airplane Directorate, Aircraft

Certification Service, 1601 Lind Avenue SW., Renton, Washington 98055-

4056; telephone (206) 227-2679.

SUPPLEMENTARY INFORMATION:

Background

On June 18, 1990, the Boeing Commercial Airplane Group, P.O. Box

3707, Seattle, Washington 98124-2207, applied for a type certificate

for the new Model 777 airplane. The Model 777 is a long range,

transport category airplane powered by two Pratt & Whitney PW4000

series, Rolls-Royce Trent 800 series, or General Electric GE90 series

engines. The overall length of the Model 777 is 209 feet, the height is

61 feet, and the wingspan is 198 feet. The airplane has a seating

capacity, in a typical three class configuration of 305 to 328

passengers, or 375 to 400 passengers in a two class configuration. The

Model 777 has a maximum takeoff weight of 535,000 lbs., a maximum

landing weight of 445,000 lbs., a maximum operating altitude of 43,100

ft., and a range of 4,200 nautical miles in a two class configuration

or 6,600 nautical miles in a three class configuration.

Type Certification Basis

Under the provisions of Sec. 21.17, Boeing must show that the Model

777 airplane meets the applicable provisions of part 25, as amended by

Amendments 25-1 through 25-71. Boeing has also elected to comply with

most of part 25 as amended by Amendment 25-77. The type certification

basis for Model 777 is therefore part 25 through Amendment 25-77,

except for Sec. 25.571(e)(1), which remains at Amendment 25-71 level;

and parts 34 and 36, each as amended at the time of certification.

Boeing may also elect to comply with subsequent part 25 requirements to

facilitate operators' compliance with corresponding part 121

requirements. The certification basis also includes other special

conditions that are not relevant to these special conditions.

If the Administrator finds that the applicable airworthiness

regulations (i.e., part 25 as amended) do not contain adequate or

appropriate safety standards for the Model 777 airplane because of

novel or unusual design features, special conditions are prescribed

under the provisions of Sec. 21.16.

Special conditions, as appropriate, are issued in accordance with

Sec. 11.49 after public notice, as required by Secs. 11.28 and

11.29(b), effective October 14, 1980, and become part of the type

certification basis in accordance with Sec. 21.17(a)(2).

Model 777 Design Features

The structure of the Model 777 is generally of conventional design

and construction, but with considerable use of composite materials.

Elements of the primary structure (the fin and horizontal tail) are

constructed of composites, as are some elements of secondary structure,

including the elevators, rudders, flaps, spoilers, ailerons, engine

cowls, and main deck floor beams.

The Model 777 uses a combination of multiple computer channels and

redundant sensors that channel command signals to various control

surface actuators in response to programmed control laws. This control

architecture, referred to as fly-by-wire (FBW), provide closed loop

command to move servo-actuators for the elevators, ailerons, rudder,

spoilers, horizontal stabilizer, slats and flaps, and engine power

levers. In the unlikely event of simultaneous failure of all digital

computers or signaling, a direct control path from the pilot's

controllers to the surface actuators is provided through simple analog

circuitry.

Hydraulic power for the flight control system is provided by three

independent hydraulic systems. Functions are shared among these systems

to ensure airplane control in the event of loss of one or two systems.

The three systems are pressurized by variable displacement pumps. The

left and right hydraulic systems each have one pump driven by the

engine accessory gearboxes. In addition, the left and right systems

each have one electrically driven demand pump. The center system can be

pressurized by two electrically driven hydraulic pumps. This system

also has two air driven demand pumps, which use air from the airplane

pneumatic system. A ram air turbine (RAT) is also available to provide

hydraulic power for the primary flight controls served by the center

system.

Normal electrical power is supplied by two integrated drive

generators, one on each engine. An electrical generator powered by an

auxiliary power unit (APU) is also available. Backup electrical power

is available to selected airplane alternating current (AC) busses from

two variable speed, constant frequency generators, one of which is

mounted on each engine. The main direct current (DC) system can also

receive power from the backup generators. Primary power for the FBW

system is provided by dedicated permanent magnet generators in each of

the two backup generator units. The FBW system can alternately receive

power from the main DC system or the standby DC system. The standby DC

system is powered by a RAT-driven AC generator, which can provide a

source of standby electrical power that is not time limited. The RAT is

deployed automatically upon loss of all normal and backup AC power

sources. A manual deploy feature is available to the flightcrew should

the RAT fail to deploy automatically.

The engine control system consists of dual channel, full authority,

digital engine controls (FADEC) mounted on the fan case of each engine.

The (FADEC's are interfaced with the various airplane systems to

provide redundant control of the engines through a ``hard-wired''

throttle angle resolver system. In addition, the throttles move in

proportion to commanded changes in engine power, and in the event of a

total failure of the engine indicating and crew alerting system

(EICAS), analog rotor speeds are available to determine engine power

levels. Each FADEC provides gas generator control, engine limit

protection, power management, input to the thrust reverser system, and

engine parameter inputs for the flight deck displays.

Control inputs are made through conventional flight deck control

wheels, columns, and rudder pedals. The flight instruments are

displayed on six liquid crystal flat panel displays. Two flat panel

displays are mounted directly in front of both the pilot and copilot

and display primary flight instruments and navigational information.

The other two flat panel displays are located in the center of the

instrument panel and display engine parameters, warnings, and system

diagnostics.

The type design of the Model 777 contains novel or unusual design

features not envisioned by the applicable part 25 airworthiness

standards, including extended range operation with two-engine airplanes

and therefore special conditions are considered necessary.

Discussion

All two-engine airplanes operating under part 121 of the FAR are

required to comply with Sec. 121.161, which states, in pertinent part,

that ``Unless authorized by the Administrator * * * no certificate

holder may operate two-engine or three-engine airplanes * * * over a

route that contains a point farther than one hour flying time * * *

from an adequate airport.'' Advisory Circular (AC) 120-42A, Extended

Range Operation With Two-Engine Airplanes (ETOPS), provides an

acceptable means for obtaining FAA approval for two-engine airplanes to

operate over a route that contains a point farther than one hour flying

time from an adequate airport. The two basic objectives of this

Advisory Circular are to establish that the airplane and its supporting

systems are suitable for the extended range mission and that the

maintenance and procedures to be employed in conducting ETOPS

operations are adequate. This is accomplished by acquiring a

substantial amount of service experience during non-ETOPS operation and

then extensively evaluating this experience in the areas of systems

reliability, maintenance tasks, and operating procedures. When it is

determined that the appropriate reliabilities and capabilities have

been achieved, the airplane is found eligible to be considered for use

in ETOPS operation by an airline.

Boeing has proposed that the Model 777 be approved for ETOPS

operation simultaneously with the issuance of the basic type

certificate. Procedures do not exist at this time for a finding of this

type. Because the timing of the proposed ETOPS type design approval for

the Model 777 airplane precludes use of the guidance given in AC 120-

42A regarding the accumulation of service experience, an alternative

method must be devised that will provide an adequate level of inherent

airplane reliability for the ETOPS mission under consideration for

approval. It is important to note that the requirements for

certification of the airplane regarding the design's suitability for

ETOPS operation, as described in these special conditions, relate to

type certification approval only. Advisory Circular 120-42A contains

guidance regarding operational and maintenance practices criteria that

must be met by the operator before ETOPS operations can be conducted.

It is incumbent upon the operator to apply for operational approval in

accordance with the guidance contained in AC 120-42A. Satisfaction of

the requirements of these special conditions does not constitute

operational approval.

Existing practices to achieve airplane certification safety

objectives have involved definition of performance requirements,

incorporation of safety margins, and prediction of failure

probabilities through analysis and test. However, historical evidence,

in general, indicates that a period of actual revenue service

experience is necessary to identify and resolve problems not observed

during the normal certification process. Successful achievement of this

experience has been a prerequisite for granting ETOPS type design

approval for a specific airplane engine combination. However, several

recent airplane engine combinations incorporating new or substantially

modified propulsion systems have demonstrated a high level of

reliability consistent with ETOPS operation upon entry into revenue

service. In addition, this high level of reliability was demonstrated

by the small number of problems encountered during basic certification

activity. These recent successful airplane and engine development and

certification programs led the FAA to consider it feasible that the

proposed development and certification activities of the Model 777

engine and airplane have the potential of providing a relatively

``mature'' product at the time of entry into revenue service.

Certification criteria for early ETOPS type design approval of the

Model 777 airplane is largely dependent upon a process that requires

demonstration of appropriate levels of reliability. This process is

designed to result in a level of airplane reliability that is

equivalent to the level of reliability previously found to be

acceptable based upon service experience. Since the early ETOPS

development process must have a means of measuring success, the

certification requirements in these special conditions focus on

defining a measurement process, as well as providing a feedback loop to

quickly resolve problems that may occur.

Existing ETOPS airplane/engine assessments conducted in accordance

with AC 120-42A focus on two main objectives: (1) preclude any failure

or malfunction that could result in diversion from intended flight; and

(2) protect the safety of the airplane and occupants during the

diversion. A diversion is precluded by ensuring high reliability of the

propulsion system and of all other systems important to ETOPS, and

resolution of all problems that compromise the safety of ETOPS flight.

Safety during the diversion is protected by high reliability of the

propulsion system and of those systems important to the diversion, and

resolution of all problems that compromise the safety of the diversion.

The early ETOPS approval criteria maintain this two-fold safety

concept.

The major elements of the early ETOPS type design approval process

defined in these special conditions include an ETOPS type design

assessment, additional analysis requirements, additional test

requirements, including 1000 flights on a complete airplane that

simulate actual airline operations, a problem tracking system, and a

reliability assessment that will be carried out by an FAA Reliability

Assessment Board. The Reliability Assessment Board will consist of

members from a broad spectrum of FAA offices, including FAA airplane

and engine certification offices, FAA aircraft evaluation groups for

both the engines and airplane, FAA maintenance and operational approval

offices, and FAA headquarters. The Reliability Assessment Board will

have a function similar to that currently carried out by the Propulsion

System Reliability Assessment Board, as defined in AC 120-42A, except

that the Reliability Assessment Board will have the responsibility to

review all of the relevant airplane systems in addition to the

propulsion system.

Design requirements and relevant service experience assessments are

required as part of the ETOPS type design assessment in order to define

appropriate design, test, analysis, or other manufacturing,

maintenance, or operational features necessary to comply with the

applicable airworthiness requirements, as well as to achieve the two-

fold ETOPS objectives (i.e., preclude and protect the diversion).

These special conditions require the frequency and type of failures

or malfunctions that occur during the airplane flight test program, and

the additional 1000-flight ETOPS test, to be consistent with the

frequency and type of failures or malfunctions that might occur on

certified 180-minute ETOPS airplanes. The ETOPS Reliability Assessment

Board will be responsible for evaluating these problems and their

solutions, and ultimately formulating a recommendation to the Manager,

Transport Airplane Directorate, regarding the adequacy of the 777 type

design for 180-minute ETOPS operation.

This determination will be based on a review of the circumstances

surrounding each failure or malfunction, the effectiveness of the

proposed corrective action, and the potential consequences of the event

on the continued safe operation of the airplane. In addition,

corrective actions must be identified and implemented prior to ETOPS

approval for all problems identified during the test program that could

affect the safety of ETOPS operations. These corrective actions must be

substantiated to be effective in eliminating both the specific problem

and any similar problems elsewhere in the design. These criteria will

continue to apply a ``fix all problems'' approach that is also the

basis for all ETOPS approvals made under AC 120-42A. In the event that

a problem is discovered after entry into passenger service that could

compromise the safety of the ETOPS mission, the FAA will, at its

option, use the Airworthiness Directive (AD) process, as provided by

part 39 of the FAR, to require corrective action.

Since the granting of a finding of ETOPS suitability concurrently

with the issuance of the airplane type certificate is not envisioned by

part 25 of the FAR, and since there is no appropriate guidance material

available for this project, the FAA has determined that this method of

finding ETOPS suitability is a ``novel and unusual'' feature within the

meaning of Sec. 21.16, and that therefore special conditions are

required.

Discussion of Comments

Notice of Proposed Special Conditions No. SC-93-3-NM for extended

range operation of the Boeing Model 777 series airplanes was published

in the Federal Register on May 5, 1993 (58 FR 26710).

Seven commenters responded to the proposed special conditions. Some

of the comments were of an editorial or clarifying nature and have been

incorporated where appropriate. A discussion of the remainder of the

comments follows.

General Comments

Two commenters are opposed to granting 180-minute ETOPS approval at

type certification without some kind of in-service experience.

The first commenter does not recommend any specific service

experience requirement. This commenter does, however, recognize that

the special conditions require some in-service experience to be

simulated prior to certification. This commenter's ``bottom line'' is

that this ``equivalent in-service experience'' must be a suitable

substitute for ``actual'' in-service experience. The second commenter

opposed to 180-minute ETOPS approval at type certification states that

120-minute ETOPS approval could be granted if all aspects of the

special conditions approval plan have been completed. This commenter

suggests that 180-minute ETOPS approval should be granted only after

the accumulation of 20,000 engine hours for derivative technology

powerplants, and 50,000 engine hours for new technology powerplants. It

appears that the commenter's rationale for this position results from

trying to balance the benefits of the lessons learned analyses, test

programs, and problem detection and resolution programs with the

limitations of those programs.

The FAA disagrees with the two commenters' position that some in-

service experience should be required for 180-minute ETOPS approval at

type certification. These special conditions consist of five main

elements that provide adequate compensation for the service experience

requirements previously used to establish 180-minute ETOPS eligibility.

No single element is sufficient by itself, but together, the five

elements provide an acceptable substitute for actual airline service

experience. Any limitations of specific special condition elements were

taken into account in the development of these special conditions. A

general description of the five elements follows:

First Element: Design for Reliability. Paragraph (c)(1) requires

that the propulsion system be designed to preclude failures and

malfunctions that could result in an engine inflight shutdown.

Propulsion systems on previous airplanes were designed and certified to

be ``fail-safe,'' in compliance with Sec. 25.901 of part 25; in other

words, any single failure, or probable combination of failures, would

not jeopardize continued safe flight and landing of the airplane.

Because safe flight following an engine shutdown is required by part

25, preventing engine inflight shutdowns has not been a major design

objective on previous airplane designs. The additional design

requirement in these special conditions to preclude failures and

malfunctions that could result in an engine inflight shutdown has an

enormous effect on propulsion system reliability in that normal design

decisions must now consider whether a failure or malfunction might

result in an engine inflight shutdown.

Second Element: Lessons Learned. Paragraph (c)(2) requires the

airplane to be designed to prevent problems that have resulted in

inflight shutdowns or diversions on previous airplanes (lessons

learned). This process focuses on eliminating specific known failure

causes from the new airplane design to allow some margin for unforeseen

failure causes without having a detrimental effect on overall airplane

and propulsion system reliability.

Third Element: Test Requirements. Testing required by paragraph

(c)(4) must prove the effectiveness of design features incorporated

into the new airplane to prevent problems that have resulted in

inflight shutdowns or diversion on previous airplanes. This validates

that the specific lessons learned fixes work. The extensive validation

testing of the Model 777 required by paragraph (e) of these special

conditions, including the 3000-cycle engine test and 1000-cycle

airplane test, is designed to discover basic design flaws to a much

greater extent than has ever been undertaken in any previous airplane

development program. This includes testing to substantiate the

suitability of any technology new to the applicant. The environmental

conditions (hot and cold temperatures, high vibration, etc.) to which

the engines and airplane will be exposed during this testing will allow

the FAA the opportunity to observe the integrity of the airplane design

under conditions that have taken a fleet of airplanes years to

accumulate. Ninety-nine percent of problems resulting in inflight

shutdowns have occurred within 3,000 cycles on airplanes that have been

evaluated under the provisions of AC 120-42A. Based on this, the FAA

has determined that, after completing the airplane and engine testing

defined in these special conditions, sufficient experience will have

been gained to reveal virtually all potential causes of inflight

shutdowns.

Fourth Element: Demonstrated Reliability. Paragraph (h)(1) requires

that, for the engine and airplane systems, the number and types of

failures that occur during the airplane flight test program and the

1000 flight cycle ETOPS test must be consistent with the number and

types of failures or malfunctions that would be expected to occur on

presently certified 180-minute ETOPS airplanes. This requirement gives

the FAA assurance that the overall design maturity is at a level

expected of current in-service ETOPS airplanes.

Fifth Element: Problem Tracking System. Paragraph (f) requires that

problems that could impact the safety of ETOPS operations occurring

during airplane development and certification testing must have proven

fixes incorporated into the design before the airplane may be approved

for ETOPS operations. All such problems occurring after the airplane

begins ETOPS operations must be promptly reported in order that the FAA

may require appropriate corrective actions. This requirement ensures

that the risk of additional occurrences of any unforeseen failures that

could affect the safety of ETOPS operations is low.

The second commenter opposed to 180-minute ETOPS approval without

some in-service experience also states that any deficiency in

compliance with the approval plan should result in some lesser level of

approval from that sought. This position is consistent with these

special conditions. Paragraph (h)(2) specifies that if the corrective

action for unplanned engine shutdown or loss of thrust, or any problem

that jeopardizes the safety of an airplane diversion, occurring during

airplane flight testing, requires a major system redesign, this would

be cause for delayed ETOPS type design approval, or approval for

reduced single engine diversion time.

The same commenter also suggests changes to several paragraphs of

these special conditions. The FAA has reviewed these suggested changes

and considers that they are equivalent to the FAA wording and do not

clarify the requirements. Therefore, they have not been adopted.

A third commenter does not directly oppose the concept of ETOPS

approval at the time of airplane type certification, but suggests that

the special conditions should depart from the existing AC 120-42A

policy only where warranted by the experience of previous ETOPS

programs. Starting with this premise, the commenter then identifies

specific problem areas with the proposed special conditions.

First, the commenter questions the FAA's assessment that several

airplane engine combinations incorporating new or substantially

modified propulsion systems have demonstrated a high level of

reliability consistent with ETOPS operation upon entry into revenue

service. The commenter states that there is no single example of a

completely new product (airplane and engine) that achieved stable

reliability consistent with 180-minute ETOPS at entry into service, and

that only those products with a high level of similarity to previous

designs actually achieved this level of reliability.

The FAA disagrees with this commenter's distinction between ``new''

and ``derivative'' engines. There has been much discussion within the

industry about gaining some service experience credit for derivative

engines versus totally new designs in the application of the service

experience criteria of AC 120-42A. However, the industry has never been

able to agree on a standard by which to differentiate between

derivative and new engine designs. In a sense, every engine to be

developed since the first turbine engines were introduced are

derivatives of previous designs. Each new engine type has benefited

from the engine manufacturer's experiences with earlier models.

Successful design features are kept and improved upon while

unsuccessful ones are taken out of new designs. As a result, the FAA is

not depending on whether the engines are, or are not, derivative in

applying the requirements of these special conditions. The requirements

apply equally in either case.

The FAA's assessment was based on a review of new propulsion system

installations since the beginning of ETOPS operations in 1985. As an

example, the only completely new two-engine airplane now in ETOPS

service to be certified since ETOPS operations began is the Airbus

A320. A review of the propulsion system reliability of the CFM56-5

series engine installation on the A320, as measured by a 13-month

rolling average of the inflight shutdown (IFSD) rate, indicates an IFSD

rate of 0.14/1000 engine hours four months after airplane entry into

service. The IFSD rate, 0.02 for 180-minute ETOPS operations as defined

in AC 120-42A, is not achieved until 16 months after entry into

service.

At first glance, it appears that the A320 airplane did not exhibit

an acceptable ETOPS propulsion system reliability until a substantial

amount of service experience had been accumulated. A closer look at the

data, however, reveals that there were only two inflight shutdowns in

the first two years of revenue service. By the time the first inflight

shutdown dropped out of the 12-month rolling average IFSD rate, the

accumulation of engine fleet operating hours had reduced the rate to

below the 0.02 standard for 180-minute ETOPS operation. The rate has

been stable below that mark ever since. This clearly indicates that the

A320 airplane with CFM56-5 engines achieved the high standard of

propulsion system reliability at the time of type certification that

led the FAA to consider defining a process that would have demonstrated

the attributes of a relatively mature product at the time of entry into

revenue service. The A-320 airplane achieved this high level of

reliability even without the five-element certification program to

ensure reliability that is required by these special conditions.

The same commenter also questions the FAA's statement in the

proposed special conditions that a high standard of propulsion system

reliability on several recently certified airplane engine combinations

was evidenced during basic certification by a small number of problems

encountered. The commenter states that there is no clear relationship

between the number of problems that may be encountered during

certification tests and the reliability level for ETOPS in such areas

as engine IFSD rates, electronic generator failure rates, and failure

rates of other ETOPS significant systems and components. The commenter

goes on to state that the reliability levels required for ETOPS are too

high for direct statistical demonstration during a test program with a

sufficient level of confidence.

The FAA agrees with this commenter's assessment of the statistical

confidence achieved by certification testing alone. The FAA did not

intend to imply that a small number of problems occurring during type

certification in any way demonstrates a statistically significant

sample from which to base a failure rate calculation with a high degree

of confidence. The correlation referred to by the FAA is that, relative

to other airplane programs, the occurrence of a higher number of basic

design problems during type certification testing generally has

resulted in a higher number of problems occurring after the airplane

entered service. Those airplanes with the best propulsion system

reliability after entry into service have also, in general, encountered

fewer design problems during the type certification program.

Even without the statistical confidence the commenter is referring

to, experience has also shown that, in general, predictions of mature

component reliability made in analyses for showing compliance with the

safety assessment requirements Sec. 25.1309 of the FAR have been

conservative when compared with the actual achieved reliability in

service. In most cases, the types of problems that prevent a system or

component from achieving the predicated, mature level of reliability

have been basic design or manufacturing deficiencies that could have

been detected if extensive enough testing had been accomplished during

development and certification prior to entry into service. Random type

failures have not been a major contributor to unreliability. Therefore,

the FAA is confident that a design will achieve a high level of

reliability based on development and certification test results,

provided the testing is thorough in evaluating all potential failure

sources. The special conditions' relevant experience, analysis, and

test requirements define the methods that must be used to accomplish a

thorough evaluation of failure sources.

The same commenter states that the quantitative objectives for

engine inflight shutdown rate from AC 120-42A do not appear in the

special conditions. The commenter recommends that these objectives be

retained and compliance shown using a rational method that provides a

sufficient level of confidence.

As stated above, the FAA does not consider the testing to be

accomplished during the certification program to provide a

statistically significant sample from which to calculate a failure rate

with a high degree of confidence. Based on this assessment, a rational

method for calculating an inflight shutdown rate that provides a

sufficient level of confidence does not appear to be achievable. As

discussed above, experience has shown that failure rate calculations

can provide misleading information when used for testing and as a

performance indicator of a limited number of units. As designed, the

special conditions provide for assessment of demonstrated reliability

in conjunction with oversight of corrective action, as well as overall

performance, to make the eligibility assessment. This more

comprehensive approach is more meaningful as an overall safety

assessment process and permits the applicant to correct any

discrepancy, rather than just delay the program. Therefore, the FAA did

not include a quantitative inflight shutdown rate requirement in the

special conditions. Specific evaluation of each problem and

corresponding corrective action by the Reliability Assessment Board

will provide confidence that appropriate corrective action is taken for

each problem uncovered during testing.

Another commenter is concerned that a significant increase in drag

would occur during a single engine diversion with a failed engine that

has a locked rotor compared to a windmilling engine, due to a further

reduction of mass flow through the inlet. This commenter suggests that

ETOPS operational stability and control and extended range performance

be based on wind tunnel test data, obtained at high Reynolds number,

over the complete engine-inoperative flight envelope, with locked

engine rotor airflow accurately represented.

The FAA considered the effects of a locked engine rotor on a single

engine diversion during the development of the existing approval

criteria defined in Advisory Circular 120-42A. The AC lists several

factors that must be considered when planning how much fuel is required

to dispatch an airplane for ETOPS operations. These include current

forecast winds and meteorological conditions along the expected flight

path, operation of ice protection systems and performance loss due to

ice accretion on the unprotected surfaces of the airplane, operation of

auxiliary power units, loss of airplane pressurization, an approach

followed by a missed approach and subsequent approach and landing,

navigational accuracy, and air traffic control constraints. Additional

contingency fuel reserves are added to account for errors in wind

forecasts, and deterioration of cruise fuel mileage from that provided

the performance planning data. The FAA considered the addition of a

``locked rotor'' condition to be overly conservative and that any

increase in drag would be adequately covered by existing fuel reserve

requirements for ETOPS operations. Any effect that a locked engine

rotor may have on airplane stability and control is a basic airplane

airworthiness issue, and is covered as part of the basic 777 airplane

certification program. Therefore, the FAA has concluded that a locked

engine rotor is being adequately addressed without the need to change

the ETOPS special conditions.

One commenter states that the special conditions do not address the

conditions for approval of future design variants (e.g., higher thrust

ratings or major engineering design changes that result in new engine

model designations). This commenter expects the requirements to be

different for later design changes in terms of test and assessment

methods. While the FAA agrees that the test and assessment methods will

be different for later design changes, the FAA does not agree that it

is necessary to define specific requirements for future design

variants. These special conditions address the initial certification of

an airplane for ETOPS operations without the prerequisite service

experience defined in Advisory Circular 120-42A. Upon issuance, these

special conditions become a part of the airplane type certification

basis for ETOPS type design approval. Future changes in design must

meet the applicable requirements of these special conditions. However,

the scope of specific test conditions and assessment methods used for

particular design changes may differ from the initial ETOPS assessment

program. This would depend on the degree of commonality with the

existing approved design and how much credit for service experience the

new design may be given. The methods to be used to show compliance with

the special conditions requirements will be approved as part of the

certification process. This process will be similar to what is

currently done for existing approved ETOPS airplanes to determine if

service experience is necessary before a design change becomes eligible

for ETOPS operations.

This same commenter is concerned about the process to control and

administer the airplane configuration, maintenance, and operational

procedures pertinent to the ETOPS approval. This commenter is concerned

about a statement at the end of the discussion section of the notice

that appears to imply that the ETOPS configuration, maintenance, and

procedures (CMP) document revision process is replaced by the

airworthiness directive (AD) process. The FAA does not agree. The CMP

document is a product of the ETOPS approval process defined in AC 120-

42A. It defines the airplane configuration and any maintenance or

operational procedures, beyond the baseline airplane definition, that

are necessary to safely operate an airplane in an ETOPS operation. The

need for the CMP document originated when airplanes approved under the

AC guidance were not originally certified in consideration of the ETOPS

mission. With a new airplane designed and certified in accordance with

these special conditions, it is expected that a CMP document would

contain very few items, since it is the intent of the manufacturer to

build only ETOPS eligible airplanes. However, it is possible that the

Reliability Assessment Board may require interim problem corrective

actions to be incorporated as a condition for ETOPS approval, until

final corrective actions become available several months after the

airplane enters service. These conditional configuration requirements

would need to be defined in a CMP document. In response to problems

occurring after the airplane enters service, additional items may be

added to the CMP in order to define an airplane configuration that may

be used by 777 ETOPS operators to maintain acceptable system

reliability in accordance with the existing CMP revision process

identified in paragraphs 8g and 8h of AC 120-42A. The CMP document does

not replace the AD process referred to by the commenter. Any problems

occurring in service that would significantly affect the safety of an

ETOPS operation will result in an AD being issued. The AD may reference

a CMP document revision that defines the required configuration, but it

does not have to.

Engine Assessment

One commenter recommends that the procedures for an engine

condition monitoring program, required by paragraph (b)(2), should

consider 200 minutes operation at maximum continuous thrust, followed

by 5 minutes at inflight takeoff or go-around thrust. The commenter's

rationale for this recommendation is that guidance for the maximum

thrust required for a single engine diversion should be specified and

that a realistic diversion thrust requirement should be padded by 20

minutes above the specified maximum diversion time. The FAA does not

agree. Traditional engine condition monitoring programs are designed to

determine if maximum takeoff thrust can be achieved. The intent of the

validated condition monitoring program required by paragraph (b)(2) is

to provide a means to determine when an engine is no longer capable of

achieving maximum continuous thrust within approved engine limits. The

duration that the thrust would be available is not a consideration in

this requirement, only that adequate thrust would be available. Based

on current experience with engine deterioration rates, the engine

certification requirements contained in part 33 of the FAR demonstrate

that maximum continuous thrust will be available for any conceivable

diversion time. It is not intended that the condition monitoring

program identified in paragraph (b)(2) be able to predict impending

failure conditions. Therefore, paragraph (b)(2) is adopted as proposed.

Design Requirements Assessment

One commenter states that paragraph (c)(1) of the special

conditions only refers to the design requirements of part 25 and ``does

not call up the design requirements in AC 120-42A, paragraphs 8b(7),

(8), (9), (10), and (11).'' The FAA infers from this comment that the

commenter desires that the AC paragraphs noted above be incorporated in

the special conditions. The FAA agrees that the AC criteria are

important; however, the advisory circular provides policy guidance for

obtaining ETOPS approval for already certified two-engine airplanes.

The design criteria referred to by the commenter were developed to

allow approval of airplanes for which ETOPS types of operations were

not considered when they were originally certified to part 25

airworthiness standards. With one exception, existing part 25

airworthiness standards are sufficient to properly certify a new two-

engine airplane for ETOPS operation, as long as the ETOPS mission is

considered in applying these requirements for all anticipated dispatch

configurations. The purpose for the design requirements assessment of

paragraph (c)(1) of these special conditions is to define the specific

methods that will be used to show compliance with the part 25

airworthiness requirements when considering the ETOPS mission. These

methods may include additional design features, analyses, tests, or a

combination of the three. Depending on the system design, the specific

design criteria called out in AC 120-42A may not be necessary or

appropriate on a new airplane design.

The one exception to the airworthiness standards contained in part

25 that is necessary in order to certify an ETOPS suitable airplane is

a requirement to design the airplane to preclude failures or

malfunctions that could result in an engine inflight shutdown. Existing

propulsion system installation requirements are based on the ``fail-

safe'' concept. In other words, continued safe flight and landing are

assured after any single propulsion system failure. Propulsion system

reliability is not a major design consideration in existing

airworthiness standards because failures must be shown to be ``safe.''

ETOPS criteria are intended not only to ensure continued safe operation

after an engine inflight shutdown, but also to prevent the failure

condition that resulted in the shutdown. This additional requirement to

prevent engine inflight shutdowns was included in paragraph (c)(1) of

these special conditions. Based on these considerations, the special

conditions are adopted as proposed.

The commenter also refers to several new design features that were

considered during the development of the early ETOPS special condition,

and questions why they were not included in the final proposal.

Examples given include a 22,000 foot single engine cruise altitude, and

a specific list of electrical services to be powered in the backup

electrical configuration. As stated above, the FAA has determined that

the existing airworthiness standards defined in part 25 are sufficient

to properly certify a new two-engine airplane for ETOPS operation, as

long as the ETOPS operational mission is considered in finding

compliance. The FAA has also determined that including specific design

requirements such as the two examples cited above may be too

restrictive in defining what the applicant could do to comply with the

safety objectives of part 25. This might result in a design requirement

being imposed that is inappropriate because of a change in the airplane

design that was not considered in the development of that requirement.

However, as part of the requirements assessment, paragraph (c)(3) of

the special conditions requires the applicant to consider the types of

design features that the commenter is referring to, and to list those

specific design features that are included in the airplane design to

accommodate the ETOPS mission. The FAA therefore does not consider it

necessary to revise the special conditions.

Another commenter states that the design feature consideration for

fuel quantity indication to the flight crew in paragraph (c)(3)(i)(C)

should include alerts for abnormal fuel management or transfer between

tanks in addition to the other listed considerations. The FAA agrees

with this comment and has revised paragraph (c)(3)(i)(C) accordingly.

Relevant Experience Assessment

One commenter recommends that paragraph (c)(2) clearly indicate

that the relevant experience assessment shall include a demonstration

of the applicability of the past experience to the new design, at the

appropriate system, sub-system, or component level. The commenter

suggests that this demonstration may be based on an engineering

comparison at the appropriate level, but shall also be backed by

comparison testing where the design differences are significant. The

commenter supports this comment with the statement that there is

substantial evidence that beyond a certain level of difference between

the product that produced the past experience and the new product, the

``lessons learned'' assessment process ceases to be fully effective.

The FAA agrees that beyond a certain level of commonality, past

experience may not be relevant to the new design. This is particularly

true where a specific design feature that contributed to problems in

previous airplanes is not a part of the new airplane design. However,

the FAA does not concur that a change in the special conditions is

necessary to achieve the results desired by the commenter. The

demonstration of the applicability of past experience to the new design

is inherent in the relevant experience assessment. Paragraph (c)(2) of

the special conditions requires that corrective actions taken to

preclude similar problems from occurring on the new airplane must be

identified. Removal from the design of a system, sub-system, or

component that has had problems in the past may be an acceptable

corrective action, as long as it precludes similar problems from

occurring. In addition, paragraph (c)(4) requires the applicant to

define specific new or enhanced tests that will be used to assure

engine and airplane system design integrity. In complying with this

requirement, the tests derived from the relevant experience assessment

will be used to substantiate that effective corrective action has been

taken for each source of past problems.

This commenter also states that where new technology is introduced,

the lessons learned assessment becomes impractical, as there is no

previous experience with this technology. While the FAA agrees that

there will be no previous experience with a new technology, there may

still be applicable relevant experience. For example, an applicant's

previous experience with new technology introductions may lead to

changes in manufacturing and quality control processes. Further,

lessons learned of general applicability can be introduced into the new

technology design, such as a general design practice to prevent cross-

connector installation. The FAA has determined that the existing

special conditions requirements meet the intent of the commenter's

recommendation; therefore, the commenter's specific recommended change

has not been adopted.

The same commenter also states that the special conditions should

clearly indicate how much direct service experience shall be required

in the case of a completely new design utilizing technology new to the

manufacturer, for which no basis of relevant experience exists. The FAA

does not concur. As stated above, there may be applicable relevant

experience even for a completely new design incorporating new

technology. In addition, relevant experience is only one aspect of

these special conditions. It is not the only mechanism by which the

airplane would be assessed for ETOPS approval. Among the other

requirements, paragraph (e)(4) requires the applicant to conduct tests

to substantiate the suitability of new technology. The commenter's

recommended change therefore has not been adopted.

Additional ETOPS Test Requirements

One commenter recommends that the configuration requirements of

paragraph (e)(1) also apply to the testing defined in paragraph (c)(4).

The commenter's rationale for this recommendation is that the merits of

incorporating sufficient component interfacing to simulate actual

airplane installation interactions should justify expanding this

requirement to other critical ETOPS systems not specifically enumerated

in paragraph (e). The FAA appreciates the concerns expressed by the

commenter, but does not agree that this recommendation is practicable.

The scope of the testing covered under paragraph (c)(4) is such that

many of the new or enhanced tests may be done with prototype hardware

at the bench or component level early in the development program when

sufficient interfacing system hardware is not available. In accordance

with paragraph (c)(4), the applicant must define each test that will be

used to assure design integrity. The enhanced testing defined by this

paragraph will include the configuration proposed for certification and

sufficient interfacing system hardware and software to simulate the

actual airplane installation when it is necessary to accomplish this

goal. As for other critical ETOPS systems not specifically identified

in paragraph (e), the 3000-cycle engine and auxiliary power unit tests

and 1000-cycle airplane test will provide an adequate opportunity to

discover design problems with these systems.

1000-Cycle Airplane Test

One commenter questions the requirement to install either the 3000-

cycle test engine or another high-cycle engine for part of the 1000-

flight-cycle airplane test by stating that the rationale for the

requirement is unclear. This commenter considers that a complete strip

and inspection of the high-cycle engines to identify incipient problems

is a more effective way of establishing early ETOPS suitability, than

by inclusion in the flight program. This commenter goes on to say that

history has shown that new problems are more likely to be exhibited by

lower life engines rather than by mature engines, and the relevance of

potentially non-representative high life failures is not immediately

obvious.

The FAA does not concur with the commenter's assessment that any

failures on the 3000-cycle engine during the 1000-cycle airplane test

would be a non-representative high life failure. The 3000-cycle engine

is representative of a high-time engine that would exist if the AC 120-

42A criteria for operating experience for 180-minute ETOPS approval

were considered. The 3000-cycle ground test will not subject the engine

and engine-mounted airplane equipment to representative altitude

conditions that the FAA is concerned may impact overall reliability.

The reason for including the 3000-cycle test engine and its associated

propulsion system equipment, or another suitable high-cycle engine and

propulsion system, on the 1000-cycle airplane test vehicle is to expose

an ``aged'' engine to altitude effects not possible to achieve on a

ground test stand. Flight time with this aged engine will give the FAA

additional confidence that the results achieved during the ground

cyclic testing are representative of the actual airplane environment

that is used to assess propulsion system reliability for ETOPS type

design approval using the AC 120-42A criteria.

This same commenter expresses concern that a complete teardown and

inspection of the high time engine will not be possible if it is

installed on the 1000-cycle test airplane. The FAA does not agree. A

complete teardown and inspection is planned for every engine and all

the engine-mounted airplane equipment subjected to the 3000-cycle test.

A teardown inspection is required in order for the Reliability

Assessment Board to assess the design suitability for ETOPS approval in

accordance with paragraph (g) of these special conditions. It was this

concern for obtaining meaningful teardown results from the 3000-cycle

test engine that prompted the FAA to allow another suitable high-cycle

engine to be installed on the 1000-cycle test airplane. In addition, an

airworthiness inspection will be performed on the high-time engine

prior to its installation on the airplane in order to ensure that the

engine complies with the maintenance manual acceptance limits for

continued operational service. Any problems found during the

airworthiness inspection will be reported in accordance with the

problem tracking system requirements, and necessary repairs will be

made prior to the engine's installation on the 1000-cycle test

airplane.

One commenter recommends that ``actual airline operation,'' as used

in paragraph (e)(7), ``be defined such that five percent of the 1000

flight cycles should be at altitudes and of duration typical of actual

ETOPS operations to ensure no adverse impact on any aircraft systems

and engines due to extended cold soaking, etc.'' The FAA agrees with

the commenter's assessment of the need for high altitude, long duration

flight cycles. However, the FAA does not concur with the commenter's

suggested change. The mix of flight cycles to be flown during the 1000

cycle test is based on an assessment of flight operating conditions

that have led to the types of problems that have occurred in service on

those airplane engine combinations that currently have 180-minute ETOPS

approval. The number of high altitude, long duration flight cycles that

will be flown for each of the engine types to be certified on the 777

airplane is a result of this assessment combined with additional flight

cycles that are necessary to validate airline operational readiness.

The FAA considers that the change proposed by the commenter would

unduly restrict the FAA in requiring development of an appropriate test

plan for the 1000 cycle test.

Another commenter recommends that the ``1000 cycle test should be

done using published maintenance manual criteria in lieu of unique

engineering allowances.'' The FAA concurs with this comment. It has

always been the FAA's intent that the 1000-cycle airplane would be

operated and maintained using the recommended operations and

maintenance manual procedures. This is to validate that operating and

maintenance procedures to be used during airline operations are correct

and will not lead to errors that may result in engine inflight

shutdowns or airplane diversions. Paragraph (e)(7) has been amended to

make this clarification. In addition, the paragraph has been

reorganized to more clearly state the requirements.

Problem Tracking System

One commenter recommends that any problem reported under the

problem tracking system must be under control within a maximum of 30

days. The FAA does not concur that the addition of a time limit is

necessary or appropriate. The proposed special conditions did not

specify a particular time interval by which all problems must be

``under control.'' The intent of the problem tracking system is to

provide a means by which the FAA will be promptly notified of problems

occurring on the design so that the FAA Reliability Assessment Board

can ensure that appropriate timely resolutions are implemented.

Depending on the severity of the problem, a more immediate response

than 30 days may be appropriate. For less severe problems, a slower

response may be allowable. In each case, the FAA Reliability Assessment

Board will determine the appropriate time interval for resolution of

all ETOPS significant problems identified by the problem tracking

system. Defining a specific time interval for problem resolution is too

restrictive and, therefore, the FAA has not adopted the commenter's

proposal in the final special conditions.

Reliability Assessment Board

One commenter is concerned that the proposed FAA Reliability

Assessment Board (RAB) might be over-represented by FAA engine

specialists. Specifically, the commenter would like the special

conditions to include references to systems, avionics, and flight

control representatives, as well as field inspectors, to help ensure a

balanced board makeup. The FAA does not concur that identifying

specific system specialists is appropriate. The purpose of the RAB is

to address the suitability of the entire airplane for ETOPS and not

just the propulsion system, as was the case with the Propulsion System

Reliability Assessment Board defined in AC 120-42A. As stated in the

preamble to the notice of these special conditions, the board will

consist of members from a broad spectrum of offices, including FAA

airplane and engine certification offices, FAA aircraft evaluation

groups for both the engines and airplane, FAA maintenance and

operational approval offices, and FAA headquarters. In addition to the

Seattle Aircraft Certification Office (Seattle ACO), the following

offices have been requested to support the RAB:

Los Angeles Aircraft Certification Office

Engine Certification Office

Flight Standards Air Transportation Division

Flight Standards Aircraft Maintenance Division

Flight Standards Technical Programs Division

Seattle Aircraft Evaluation Group

Boston Aircraft Evaluation Group

United Airlines FAA Certificate Management Office

(Pratt & Whitney engine installation only)

These special conditions define specific findings that the RAB must

make in order to determine that the 777 airplane is suitable for 180-

minute ETOPS operations. It is implicit in each of these findings that

FAA technical specialists be involved in the decision process. This is

in keeping with existing type certification practice. Therefore, naming

specific system specialties for RAB membership is not necessary.

Reliability Demonstration Acceptance Criteria

One commenter states that proposed paragraph (h)(1) implies a

direct relationship between the type and frequency of engine and

systems events occurring during the test program and the demonstrated

reliability of existing approved 180-minute ETOPS airplanes. This

commenter goes on to state that this paragraph could be interpreted as

a statement that a sample of 1000 flights is enough to produce a

statistical demonstration of reliability, and recommends adding wording

to the effect that ``flight test and laboratory test * * * are not used

to produce directly a measure of the reliability.'' The FAA infers from

this statement that the commenter does not consider the reliability

demonstration acceptance criteria of paragraph (h)(1) to provide a

statistically meaningful assessment of airplane reliability.

While the FAA agrees that the airplane flight test program and the

1000-flight-cycle ETOPS test referred to in paragraph (h)(1) will not

form a statistically significant sample from which to produce a direct

measurement of reliability, a statistical calculation of reliability is

not the intent of the requirement. As stated earlier, the occurrence of

a relatively high number of basic design problems during type

certification testing generally has resulted in a higher number of

problems occurring after the airplane enters service. Those airplanes

with the best propulsion system reliability after entry into service

have also, in general, encountered relatively few design problems

during the type certification program. Paragraph (h)(1), then, provides

a measurement of design maturity based on the experience from past

certification programs. The standard used to judge this maturity is the

type and frequency of failures occurring on already certified 180-

minute ETOPS airplanes. This is not to say that it is necessary to do a

direct comparison of failure rates system by system. In gross terms,

the FAA is expecting the 777 flight test airplanes to experience the

same kinds of problems at about the same frequency that are occurring

on ETOPS airplanes in revenue service. These special conditions define

the standard by which the suitability of the 777 airplane will be

assessed for ETOPS approval. The FAA does not consider it necessary to

state that the testing does not produce a direct measure of

reliability.

Demonstration of Compliance

One commenter recommends adding a new paragraph (i)(8) that would

read as follows: ``The accelerated engine cyclic endurance test program

of paragraph (f)(5) must be in place.'' The commenter's rationale for

this recommendation is that is it necessary to require timely program

startup and to ensure that the test engine cycles remain well ahead of

high-cycle revenue fleet engines. The FAA agrees with this comment and

has added a new paragraph (i)(7) to the special conditions. Previously

designated paragraph (i)(7) has been redesignated as paragraph (i)(8).

Miscellaneous Comments

One commenter notes that in the second sentence of paragraph (e)(6)

the word ``administration'' appears to be a typographical error that

should read ``demonstration.'' The commenter is correct and the final

special conditions are corrected as noted.

Some comments were received concerning compliance methods, although

these commenters did not recommend any changes to the special condition

requirements. These special conditions address the regulatory standards

to be applied in obtaining Early ETOPS approval. The means by which

compliance is demonstrated is not specifically addressed in this

action. The specific methods that Boeing will use to demonstrate

compliance with these special conditions will be approved as part of

the normal certification process. This will be accomplished by FAA

approval of the ETOPS type design assessment plan, required by

paragraph (a) of these special conditions.

One comment concerns the process for an airline to receive early

ETOPS operational approval. Operational approval is not addressed by

these special conditions. As stated earlier, Advisory Circular 120-42A

contains guidance regarding operational and maintenance practices

criteria that must be met by the operator before ETOPS operations can

be conducted. Satisfaction of the requirements of these special

conditions does not constitute operational approval.

With the exception of the revisions noted above, the special

conditions for extended range operation of the Boeing Model 777

airplane are adopted as proposed.

Conclusion

This action affects only certain unusual or novel design features

on one model series of airplanes. It is not a rule of general

applicability and affects only the manufacturer who applied to the FAA

for approval of these features on the airplane.

List of Subjects in 14 CFR Part 25

Aircraft, Aviation Safety, Federal Aviation Administration,

Reporting and recordkeeping requirements.

The authority citation for these special conditions is as follows:

Authority: 49 U.S.C. app. 1344, 1348(c), 1352, 1354(a), 1355,

1421 through 1431, 1502, 1651(b)(2); 42 U.S.C. 1857f-10, 4321 et

seq.; E.O. 11514; and 49 U.S.C. 106(g).

The Special Conditions

Accordingly, the following special conditions are issued as part of

the type certification basis for the Boeing Model 777 airplane:

In addition to the airworthiness requirements of part 25 of the

Federal Aviation Regulations (FAR), the Model 777 airplane must

comply with the following requirements in order to be eligible for

Extended Range Operation with Two-Engine Airplanes (ETOPS) without

the requisite operating experience specified in Advisory Circular

(AC) 120-42A:

(a) Introduction. An approved ETOPS Type Design Assessment Plan

covering the engine and each applicable airplane system must be

established. The specific methods that will be used to substantiate

compliance with the requirements of these special conditions must be

defined in the plan. Specific systems that will undergo the complete

analysis, testing, and development program tracking defined in

paragraph (c) of these special conditions must be identified. Other

airplane systems that may contribute to the overall safety of an

ETOPS operation, but that do not warrant the rigorous type design

requirements and relevant experience assessments defined in

paragraph (c) of these special conditions, must be identified and

agreed to by the FAA. Compliance must be shown for these other

systems with all provisions of these special conditions, except

paragraph (c). In showing compliance with these special conditions,

tests and analyses conducted to substantiate compliance with the

basic airworthiness standards of part 25 may be referenced, if

applicable.

(b) Engine Assessment.

(1) The ETOPS eligibility of the engine must be determined

specifically for the airplane installation for which early ETOPS

type design approval is requested.

(2) Procedures for an engine condition monitoring program must

be defined and validated at the time of ETOPS type design approval.

The engine condition monitoring program must be able to predict when

an engine is no longer capable of providing, within certified engine

operating limits, the maximum thrust required for a single engine

diversion.

(c) ETOPS Type Design Assessment.

(1) Design requirements Assessment. Part 25 of the FAR,

including applicable amendments, defines most of the requirements

necessary to design an airplane that is suitable for ETOPS

operation, as long as the ETOPS mission is considered in applying

these requirements for all anticipated dispatch configurations. In

addition to these requirements, the propulsion system must be

designed to preclude failures or malfunctions that could result in

an engine inflight shutdown. The applicant must identify and list

methods of compliance for each of the applicable ETOPS requirements,

including those specific part 25 requirements for which methods of

compliance relative to the ETOPS mission are different from those

traditionally used for two-engine airplanes. Paragraph (c)(3) of

these special conditions lists certain design feature categories

that may be affected by a consideration of the ETOPS mission in the

design of these systems. The effects of the applicable ETOPS

requirements on the design of any of those design feature categories

listed in paragraph (c)(3) must be specifically addressed by this

assessment.

(2) Relevant Experience Assessment. For each system covered by

the ETOPS Type Design Assessment, there must be an assessment of the

relevant design, manufacturing, and operational problems experienced

on previous airplanes built by the applicant. The assessment must

include the applicable relevant service experience of vendor

supplied systems or, to the extent possible, the service experience

of components on aircraft built by other manufacturers. Specific

corrective actions taken to preclude similar problems from occurring

on the new airplane must be identified.

(3) Design Features.

(i) The applicant must define any design features implemented to

comply with the design requirements listed in paragraph (c)(1).

Consideration of the following design feature categories must be

specifically addressed:

(A) Airplane capabilities and capacities of the ETOPS mission;

(B) Fuel system integrity, including consideration of

uncontained main engine rotor burst and fuel availability as

affected by cross-feed capability and electrical power to pumps and

other components;

(C) Fuel quantity indication to the flightcrew, including alerts

that consider the fuel required to complete the mission, abnormal

fuel management or transfer between tanks, and possible fuel leaks

between the tanks and the main engines;

(D) Communication systems for the ETOPS environment;

(E) Navigation systems for the ETOPS environment;

(F) Minimum single engine cruise altitude capability; and

(G) Failure tolerant designs of cockpit indicating systems or

avionics systems to prevent unnecessary airplane diversions.

(ii) The applicant must define the specific design features used

to address problems identified in the relevant service experience

assessment of paragraph (c)(2).

(4) Test Features. The applicant must define specific new tests,

or enhanced tests, that will be used to assure engine and airplane

system design integrity. These test features may be derived from the

requirements assessment of paragraph (c)(1) and the relevant service

experience assessment of paragraph (c)(2).

(5) Analysis Features. The applicant must define specific new

analyses, or enhanced analyses, that will be used to assure engine

and airplane system design integrity. These analysis features may be

derived from the requirements assessment of paragraph (c)(1) and the

relevant service experience assessment of paragraph (c)(2).

(6) Manufacturing, Maintenance, or Operational (Other) Features.

The applicant must define specific new, or enhanced, manufacturing

processes or procedures, and maintenance or operational procedures

that are being implemented to assure engine and airplane system

integrity. These ``other'' features may be derived from the

requirements assessment of paragraph (c)(1) of this section and the

relevant service experience assessment of paragraph (c)(2).

(d) Additional EOPS Analysis Requirements.

(1) Performance and Failure Analyses. Engine and airplane

performance and failure analyses required for certification must be

expanded to consider ETOPS mission requirements, including exposure

times associated with a 180-minute single-engine diversion and a

subsequent 15-minute hold in the terminal airspace at the diversion

airport. Consideration must be given to crew workload and

operational implications of continued operation with failure effects

for an extended period of time. The rationale and all assumptions

used in the analyses must be documented, justified, and validated,

including maintenance interval and maintainability assumptions.

(2) Maintenance and Flight Operations Evaluation. The Type

Design Assessment Plan must contain a program to systematically

detect and correct problems occurring as a result of improper

execution of maintenance or flight operations. Corrective actions

for any problems found must be identified and implemented through

the Problem Tracking and Resolution System required by paragraph

(f).

(3) Manufacturing Variability. The Type Design Assessment Plan

must contain a program to minimize potential manufacturing problems.

The plan should address early validation of tooling and procedures,

as well as any related problems, as identified in paragraph (c)(2).

Corrective actions for problems that impact the safe operation of

the airplane must be identified and implemented through the problem

tracking and resolution system required by paragraph (f).

(e) Additional ETOPS Test Requirements. As part of, or in

addition to, the testing identified in paragraph (c)(4), the

following specific test requirements apply:

(1) Configuration Requirements. All testing defined in paragraph

(e) must be conducted with the configuration proposed for

certification, and must include sufficient interfacing system

hardware and software to simulate the actual airplane installation.

(2) Completion of Applicable Failure Analyses. Failure analyses

required for ETOPS type design approval must be submitted to the FAA

prior to the start of the testing defined in paragraph (e).

(3) Vibration Testing. Vibration testing must be conducted on

the complete installed engine configuration to demonstrate that no

damaging resonances exist within the operating envelope of the

engine that could lead to component, part, or fluid line failures.

The complete installed engine configuration includes the engine,

nacelle, engine mounted components, and engine mounting structure up

the strut to wing interface.

(4) New Technology Demonstration Testing. Testing must be

conducted to substantiate the suitability of any technology new to

the applicant, including substantially new manufacturing techniques.

(5) Auxiliary Power Unit Demonstration Test. If requesting

credit for APU backup electrical power generation, one auxiliary

power unit (APU), of the type to be certificated with the airplane,

must complete 3000 equivalent airplane operational cycles.

(6) Engine Demonstration Test. One engine of each type to be

certificated with the airplane must complete 3000 equivalent

airplane operational cycles. The engine must be configured with a

complete airplane nacelle package for this demonstration, including

engine-mounted equipment.

(7) Airplane Demonstration Test. For each engine type to be

certificated with the airplane, one complete airplane must complete

at least 1000 flight-cycles simulating an actual airline operation.

(i) The airplane must be exposed to representative environmental

variations within the normal expected airplane operational envelope

during the 1000 cycles.

(ii) The 3000-cycle test engine and propulsion system specified

in paragraph (e)(6) above, or another suitable high-cycle test

engine and propulsion system acceptable to the Administrator, must

be installed on the airplane for a minimum of 500 cycles during this

demonstration.

(iii) The 1000-cycle test airplane must be operated and

maintained using the recommended operations and maintenance manual

procedures.

(f) Problem Tracking System. An FAA-approved problem tracking

system must be established to address problems encountered on the

engine and airplane systems that could affect the safety of ETOPS

operations.

(1) The system must contain a means for the prompt

identification of those problems that could impact the safety of

ETOPS operations in order that they may be resolved in a timely

manner.

(2) The system must contain the process for the timely

notification to the responsible FAA office of all relevant problems

encountered, and corrective actions deemed necessary, in a manner

that allows for appropriate FAA review of all planned corrective

actions.

(3) The system must be in effect during the phases of airplane

development that will be used to assess early ETOPS eligibility, and

for at least the first 250,000 engine-hours of fleet operating

experience after the airplane enters revenue service. For the

revenue service period, this system must define the sources and

content of in-service data that will be made available to the

manufacturers in support of the problem tracking system. The content

of the data provided must include, as a minimum, the data necessary

to evaluate the specific cause of all service incidents reportable

under Sec. 21.3(c) of part 21, in addition to any other failure or

malfunction that could prevent safe flight and landing of the

airplane, or affect the ability of the crew to cope with adverse

operating conditions.

(4) Corrective actions for all problems discovered during the

development and certification test program that could affect the

safety of ETOPS operations, or the intended function of systems

whose use is relied upon to accomplish the ETOPS mission, must be

identified and implemented in accordance with paragraph (g)(2). If,

during the certification program, it is discovered that a fault has

developed that requires significant rework of manufacturing,

maintenance, and/or operational procedures, the FAA will review the

ETOPS suitability of the affected system and interfacing hardware

and identify any additional actions to be accomplished to

substantiate the corrective actions.

(5) For each engine type to be certificated with the airplane,

the system must include provisions for an accelerated engine cyclic

endurance test program that will accumulate cycles on one

representative production-equivalent propulsion system in advance of

the high-cycle revenue fleet engine. This test program will assist

the applicant and the FAA in identifying and correcting problems

before they occur in revenue service. This program must be in place

for, at a minimum, the first 250,000 engine-hours of fleet operating

experience after the airplane enters revenue service. The

representative production-equivalent propulsion system may, at the

manufacturer's discretion, be used for other fleet support

activities.

(g) Reliability Assessment Board.

(1) An FAA Reliability Assessment Board will be formed to

evaluate the suitability of the airplane for ETOPS approval and make

a recommendation to the Manager, Transport Airplane Directorate,

regarding the adequacy of the type design for 180-minute ETOPS

operation. The purpose of this board will be:

(i) To periodically review the development and certification

flight test program accomplishments from both type design and

operational perspectives;

(ii) To ensure that all specific problems, as well as their

implications on the effectiveness of the Early ETOPS process, are

resolved; and

(iii) To assess the design suitability for ETOPS. The board will

consider design, maintenance, manufacturing, and operational aspects

of the type design when finding suitability for ETOPS approval.

(2) The FAA Reliability Assessment Board will review and

evaluate the data from the problem tracking and resolution system to

establish compliance with the requirements of paragraph (h). The

board will evaluate the overall type design for ETOPS suitability as

demonstrated in flight test, and the 1000-cycle ETOPS test,

considering all resolutions of problems. The following suitability

criteria will be applied:

(i) Sources of engine shutdown/thrust loss, engine anomalies, or

airplane system problems that have a potential significant adverse

effect on in-service safety will be resolved.

(ii) Resolutions are identified for all items in paragraph (i)

with analysis and/or testing to show all resolutions are effective.

These resolutions may be accomplished through one or more of the

following categories:

Design change

Operating procedure revision

Maintenance procedure revision

Manufacturing change

(iii) The resolutions of paragraphs (i) and (ii) will be

incorporated prior to entry into service.

(iv) The engine shutdown history of the test program indicates

that the engine reliability of the configuration is suitable for the

ETOPS approval being considered.

(v) Where interim resolutions having operational impact are

defined, the cumulative effect must be determined to be acceptable.

(vi) System or component failures experienced during the program

are consistent with the assumptions made in the failure analyses.

(h) Reliability Demonstration Acceptance Criteria.

(1) For the engine and airplane systems, the type and frequency

of failures that occur during the airplane flight test program and

the 1000-flight-cycle ETOPS test must be consistent with the type

and frequency of failures or malfunctions that would be expected to

occur on presently certified 180-minute ETOPS airplanes. The

failures to be considered are those associated with system

components that conform to the type design requested for

certification. The Reliability Assessment Board will determine

compliance with this requirement based on an evaluation of the

problem reporting system data, considering system redundancies,

failure significance, problem resolution, and engineering judgment.

(2) Corrective action for any of the following classes of

problems occurring during the testing identified in paragraph (h)(1)

that requires a major system redesign would delay ETOPS type design

approval, or result in approval of a reduced single-engine diversion

time, unless corrective action has been substantiated to, and

accepted by, the FAA Reliability Assessment Board:

(i) Any source of unplanned inflight shutdown or loss of thrust.

(ii) Any problem that jeopardizes the safety of an airplane

diversion.

(3) The FAA Reliability Assessment Board must determine that the

suitability criteria of paragraph (g)(2) have been met.

(i) Demonstration of Compliance. In order to be eligible for

180-minute ETOPS type design approval, the following conditions

apply:

(1) The engine assessment has been completed and eligibility for

ETOPS operation has been approved by the FAA Engine Certification

Office.

(2) All design, manufacturing, maintenance, operational, and

other features necessary to meet the ETOPS requirements of paragraph

(c)(1), and to resolve the problems identified in paragraph (c)(2),

have been successfully implemented.

(3) The identified test and analysis features in paragraph

(c)(4) and (c)(5) have been shown to be effective in validating the

successful implementation of the features in paragraph (i)(2).

(4) The additional analysis requirements of paragraph (d) have

been completed and the results have been approved.

(5) The additional test requirements of paragraph (e) have been

successfully completed.

(6) All significant problems identified in accordance with

paragraph (f) have been resolved, and fixes substantiated to be

effective have been implemented.

(7) The accelerated engine cyclic endurance test program of

paragraph (f)(5) must be in place.

(8) Compliance with the reliability demonstration acceptance

criteria of paragraph (h) has been found by the Reliability

Assessment Board.

Issued in Renton, Washington, on May 18, 1994.

Ronald T. Wojnar,

Manager, Transport Airplane Directorate, Aircraft Certification

Service.

[FR Doc. 94-13072 Filed 5-31-94; 8:45 am]

BILLING CODE 4910-13-M