[Federal Register Volume 59, Number 104 (Wednesday, June 1, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-13072]
[[Page Unknown]]
[Federal Register: June 1, 1994]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. NM-81, Special Conditions No. 25-ANM-84]
Special Conditions: Extended Range Operation of Boeing Model 777
Series Airplanes
AGENCY: Federal Aviation Administration, DOT.
ACTION: Final special conditions.
-----------------------------------------------------------------------
SUMMARY: These special conditions are issued for approval of the Boeing
Model 777 airplane for Extended Range Operation with Two-engine
Airplanes (ETOPS) without the prerequisite service experience currently
required for ETOPS approval. The manufacturer has requested that the
Model 777 airplane be found to be acceptable for ETOPS operation at the
time of type certification. Extended range operation of twin engine
airplanes is not envisioned by the airworthiness standards for
transport category airplanes, and has been determined to constitute a
novel of unusual feature. These special conditions contain the
additional safety standards that the Administrator considers necessary
to establish a level of safety equivalent to that provided by the
airworthiness standards for transport category airplanes.
EFFECTIVE DATE: July 1, 1994.
FOR FURTHER INFORMATION CONTACT:
Steven P. Clark, FAA, Seattle Aircraft Certification Office, Propulsion
Branch, ANM-140S, Transport Airplane Directorate, Aircraft
Certification Service, 1601 Lind Avenue SW., Renton, Washington 98055-
4056; telephone (206) 227-2679.
SUPPLEMENTARY INFORMATION:
Background
On June 18, 1990, the Boeing Commercial Airplane Group, P.O. Box
3707, Seattle, Washington 98124-2207, applied for a type certificate
for the new Model 777 airplane. The Model 777 is a long range,
transport category airplane powered by two Pratt & Whitney PW4000
series, Rolls-Royce Trent 800 series, or General Electric GE90 series
engines. The overall length of the Model 777 is 209 feet, the height is
61 feet, and the wingspan is 198 feet. The airplane has a seating
capacity, in a typical three class configuration of 305 to 328
passengers, or 375 to 400 passengers in a two class configuration. The
Model 777 has a maximum takeoff weight of 535,000 lbs., a maximum
landing weight of 445,000 lbs., a maximum operating altitude of 43,100
ft., and a range of 4,200 nautical miles in a two class configuration
or 6,600 nautical miles in a three class configuration.
Type Certification Basis
Under the provisions of Sec. 21.17, Boeing must show that the Model
777 airplane meets the applicable provisions of part 25, as amended by
Amendments 25-1 through 25-71. Boeing has also elected to comply with
most of part 25 as amended by Amendment 25-77. The type certification
basis for Model 777 is therefore part 25 through Amendment 25-77,
except for Sec. 25.571(e)(1), which remains at Amendment 25-71 level;
and parts 34 and 36, each as amended at the time of certification.
Boeing may also elect to comply with subsequent part 25 requirements to
facilitate operators' compliance with corresponding part 121
requirements. The certification basis also includes other special
conditions that are not relevant to these special conditions.
If the Administrator finds that the applicable airworthiness
regulations (i.e., part 25 as amended) do not contain adequate or
appropriate safety standards for the Model 777 airplane because of
novel or unusual design features, special conditions are prescribed
under the provisions of Sec. 21.16.
Special conditions, as appropriate, are issued in accordance with
Sec. 11.49 after public notice, as required by Secs. 11.28 and
11.29(b), effective October 14, 1980, and become part of the type
certification basis in accordance with Sec. 21.17(a)(2).
Model 777 Design Features
The structure of the Model 777 is generally of conventional design
and construction, but with considerable use of composite materials.
Elements of the primary structure (the fin and horizontal tail) are
constructed of composites, as are some elements of secondary structure,
including the elevators, rudders, flaps, spoilers, ailerons, engine
cowls, and main deck floor beams.
The Model 777 uses a combination of multiple computer channels and
redundant sensors that channel command signals to various control
surface actuators in response to programmed control laws. This control
architecture, referred to as fly-by-wire (FBW), provide closed loop
command to move servo-actuators for the elevators, ailerons, rudder,
spoilers, horizontal stabilizer, slats and flaps, and engine power
levers. In the unlikely event of simultaneous failure of all digital
computers or signaling, a direct control path from the pilot's
controllers to the surface actuators is provided through simple analog
circuitry.
Hydraulic power for the flight control system is provided by three
independent hydraulic systems. Functions are shared among these systems
to ensure airplane control in the event of loss of one or two systems.
The three systems are pressurized by variable displacement pumps. The
left and right hydraulic systems each have one pump driven by the
engine accessory gearboxes. In addition, the left and right systems
each have one electrically driven demand pump. The center system can be
pressurized by two electrically driven hydraulic pumps. This system
also has two air driven demand pumps, which use air from the airplane
pneumatic system. A ram air turbine (RAT) is also available to provide
hydraulic power for the primary flight controls served by the center
system.
Normal electrical power is supplied by two integrated drive
generators, one on each engine. An electrical generator powered by an
auxiliary power unit (APU) is also available. Backup electrical power
is available to selected airplane alternating current (AC) busses from
two variable speed, constant frequency generators, one of which is
mounted on each engine. The main direct current (DC) system can also
receive power from the backup generators. Primary power for the FBW
system is provided by dedicated permanent magnet generators in each of
the two backup generator units. The FBW system can alternately receive
power from the main DC system or the standby DC system. The standby DC
system is powered by a RAT-driven AC generator, which can provide a
source of standby electrical power that is not time limited. The RAT is
deployed automatically upon loss of all normal and backup AC power
sources. A manual deploy feature is available to the flightcrew should
the RAT fail to deploy automatically.
The engine control system consists of dual channel, full authority,
digital engine controls (FADEC) mounted on the fan case of each engine.
The (FADEC's are interfaced with the various airplane systems to
provide redundant control of the engines through a ``hard-wired''
throttle angle resolver system. In addition, the throttles move in
proportion to commanded changes in engine power, and in the event of a
total failure of the engine indicating and crew alerting system
(EICAS), analog rotor speeds are available to determine engine power
levels. Each FADEC provides gas generator control, engine limit
protection, power management, input to the thrust reverser system, and
engine parameter inputs for the flight deck displays.
Control inputs are made through conventional flight deck control
wheels, columns, and rudder pedals. The flight instruments are
displayed on six liquid crystal flat panel displays. Two flat panel
displays are mounted directly in front of both the pilot and copilot
and display primary flight instruments and navigational information.
The other two flat panel displays are located in the center of the
instrument panel and display engine parameters, warnings, and system
diagnostics.
The type design of the Model 777 contains novel or unusual design
features not envisioned by the applicable part 25 airworthiness
standards, including extended range operation with two-engine airplanes
and therefore special conditions are considered necessary.
Discussion
All two-engine airplanes operating under part 121 of the FAR are
required to comply with Sec. 121.161, which states, in pertinent part,
that ``Unless authorized by the Administrator * * * no certificate
holder may operate two-engine or three-engine airplanes * * * over a
route that contains a point farther than one hour flying time * * *
from an adequate airport.'' Advisory Circular (AC) 120-42A, Extended
Range Operation With Two-Engine Airplanes (ETOPS), provides an
acceptable means for obtaining FAA approval for two-engine airplanes to
operate over a route that contains a point farther than one hour flying
time from an adequate airport. The two basic objectives of this
Advisory Circular are to establish that the airplane and its supporting
systems are suitable for the extended range mission and that the
maintenance and procedures to be employed in conducting ETOPS
operations are adequate. This is accomplished by acquiring a
substantial amount of service experience during non-ETOPS operation and
then extensively evaluating this experience in the areas of systems
reliability, maintenance tasks, and operating procedures. When it is
determined that the appropriate reliabilities and capabilities have
been achieved, the airplane is found eligible to be considered for use
in ETOPS operation by an airline.
Boeing has proposed that the Model 777 be approved for ETOPS
operation simultaneously with the issuance of the basic type
certificate. Procedures do not exist at this time for a finding of this
type. Because the timing of the proposed ETOPS type design approval for
the Model 777 airplane precludes use of the guidance given in AC 120-
42A regarding the accumulation of service experience, an alternative
method must be devised that will provide an adequate level of inherent
airplane reliability for the ETOPS mission under consideration for
approval. It is important to note that the requirements for
certification of the airplane regarding the design's suitability for
ETOPS operation, as described in these special conditions, relate to
type certification approval only. Advisory Circular 120-42A contains
guidance regarding operational and maintenance practices criteria that
must be met by the operator before ETOPS operations can be conducted.
It is incumbent upon the operator to apply for operational approval in
accordance with the guidance contained in AC 120-42A. Satisfaction of
the requirements of these special conditions does not constitute
operational approval.
Existing practices to achieve airplane certification safety
objectives have involved definition of performance requirements,
incorporation of safety margins, and prediction of failure
probabilities through analysis and test. However, historical evidence,
in general, indicates that a period of actual revenue service
experience is necessary to identify and resolve problems not observed
during the normal certification process. Successful achievement of this
experience has been a prerequisite for granting ETOPS type design
approval for a specific airplane engine combination. However, several
recent airplane engine combinations incorporating new or substantially
modified propulsion systems have demonstrated a high level of
reliability consistent with ETOPS operation upon entry into revenue
service. In addition, this high level of reliability was demonstrated
by the small number of problems encountered during basic certification
activity. These recent successful airplane and engine development and
certification programs led the FAA to consider it feasible that the
proposed development and certification activities of the Model 777
engine and airplane have the potential of providing a relatively
``mature'' product at the time of entry into revenue service.
Certification criteria for early ETOPS type design approval of the
Model 777 airplane is largely dependent upon a process that requires
demonstration of appropriate levels of reliability. This process is
designed to result in a level of airplane reliability that is
equivalent to the level of reliability previously found to be
acceptable based upon service experience. Since the early ETOPS
development process must have a means of measuring success, the
certification requirements in these special conditions focus on
defining a measurement process, as well as providing a feedback loop to
quickly resolve problems that may occur.
Existing ETOPS airplane/engine assessments conducted in accordance
with AC 120-42A focus on two main objectives: (1) preclude any failure
or malfunction that could result in diversion from intended flight; and
(2) protect the safety of the airplane and occupants during the
diversion. A diversion is precluded by ensuring high reliability of the
propulsion system and of all other systems important to ETOPS, and
resolution of all problems that compromise the safety of ETOPS flight.
Safety during the diversion is protected by high reliability of the
propulsion system and of those systems important to the diversion, and
resolution of all problems that compromise the safety of the diversion.
The early ETOPS approval criteria maintain this two-fold safety
concept.
The major elements of the early ETOPS type design approval process
defined in these special conditions include an ETOPS type design
assessment, additional analysis requirements, additional test
requirements, including 1000 flights on a complete airplane that
simulate actual airline operations, a problem tracking system, and a
reliability assessment that will be carried out by an FAA Reliability
Assessment Board. The Reliability Assessment Board will consist of
members from a broad spectrum of FAA offices, including FAA airplane
and engine certification offices, FAA aircraft evaluation groups for
both the engines and airplane, FAA maintenance and operational approval
offices, and FAA headquarters. The Reliability Assessment Board will
have a function similar to that currently carried out by the Propulsion
System Reliability Assessment Board, as defined in AC 120-42A, except
that the Reliability Assessment Board will have the responsibility to
review all of the relevant airplane systems in addition to the
propulsion system.
Design requirements and relevant service experience assessments are
required as part of the ETOPS type design assessment in order to define
appropriate design, test, analysis, or other manufacturing,
maintenance, or operational features necessary to comply with the
applicable airworthiness requirements, as well as to achieve the two-
fold ETOPS objectives (i.e., preclude and protect the diversion).
These special conditions require the frequency and type of failures
or malfunctions that occur during the airplane flight test program, and
the additional 1000-flight ETOPS test, to be consistent with the
frequency and type of failures or malfunctions that might occur on
certified 180-minute ETOPS airplanes. The ETOPS Reliability Assessment
Board will be responsible for evaluating these problems and their
solutions, and ultimately formulating a recommendation to the Manager,
Transport Airplane Directorate, regarding the adequacy of the 777 type
design for 180-minute ETOPS operation.
This determination will be based on a review of the circumstances
surrounding each failure or malfunction, the effectiveness of the
proposed corrective action, and the potential consequences of the event
on the continued safe operation of the airplane. In addition,
corrective actions must be identified and implemented prior to ETOPS
approval for all problems identified during the test program that could
affect the safety of ETOPS operations. These corrective actions must be
substantiated to be effective in eliminating both the specific problem
and any similar problems elsewhere in the design. These criteria will
continue to apply a ``fix all problems'' approach that is also the
basis for all ETOPS approvals made under AC 120-42A. In the event that
a problem is discovered after entry into passenger service that could
compromise the safety of the ETOPS mission, the FAA will, at its
option, use the Airworthiness Directive (AD) process, as provided by
part 39 of the FAR, to require corrective action.
Since the granting of a finding of ETOPS suitability concurrently
with the issuance of the airplane type certificate is not envisioned by
part 25 of the FAR, and since there is no appropriate guidance material
available for this project, the FAA has determined that this method of
finding ETOPS suitability is a ``novel and unusual'' feature within the
meaning of Sec. 21.16, and that therefore special conditions are
required.
Discussion of Comments
Notice of Proposed Special Conditions No. SC-93-3-NM for extended
range operation of the Boeing Model 777 series airplanes was published
in the Federal Register on May 5, 1993 (58 FR 26710).
Seven commenters responded to the proposed special conditions. Some
of the comments were of an editorial or clarifying nature and have been
incorporated where appropriate. A discussion of the remainder of the
comments follows.
General Comments
Two commenters are opposed to granting 180-minute ETOPS approval at
type certification without some kind of in-service experience.
The first commenter does not recommend any specific service
experience requirement. This commenter does, however, recognize that
the special conditions require some in-service experience to be
simulated prior to certification. This commenter's ``bottom line'' is
that this ``equivalent in-service experience'' must be a suitable
substitute for ``actual'' in-service experience. The second commenter
opposed to 180-minute ETOPS approval at type certification states that
120-minute ETOPS approval could be granted if all aspects of the
special conditions approval plan have been completed. This commenter
suggests that 180-minute ETOPS approval should be granted only after
the accumulation of 20,000 engine hours for derivative technology
powerplants, and 50,000 engine hours for new technology powerplants. It
appears that the commenter's rationale for this position results from
trying to balance the benefits of the lessons learned analyses, test
programs, and problem detection and resolution programs with the
limitations of those programs.
The FAA disagrees with the two commenters' position that some in-
service experience should be required for 180-minute ETOPS approval at
type certification. These special conditions consist of five main
elements that provide adequate compensation for the service experience
requirements previously used to establish 180-minute ETOPS eligibility.
No single element is sufficient by itself, but together, the five
elements provide an acceptable substitute for actual airline service
experience. Any limitations of specific special condition elements were
taken into account in the development of these special conditions. A
general description of the five elements follows:
First Element: Design for Reliability. Paragraph (c)(1) requires
that the propulsion system be designed to preclude failures and
malfunctions that could result in an engine inflight shutdown.
Propulsion systems on previous airplanes were designed and certified to
be ``fail-safe,'' in compliance with Sec. 25.901 of part 25; in other
words, any single failure, or probable combination of failures, would
not jeopardize continued safe flight and landing of the airplane.
Because safe flight following an engine shutdown is required by part
25, preventing engine inflight shutdowns has not been a major design
objective on previous airplane designs. The additional design
requirement in these special conditions to preclude failures and
malfunctions that could result in an engine inflight shutdown has an
enormous effect on propulsion system reliability in that normal design
decisions must now consider whether a failure or malfunction might
result in an engine inflight shutdown.
Second Element: Lessons Learned. Paragraph (c)(2) requires the
airplane to be designed to prevent problems that have resulted in
inflight shutdowns or diversions on previous airplanes (lessons
learned). This process focuses on eliminating specific known failure
causes from the new airplane design to allow some margin for unforeseen
failure causes without having a detrimental effect on overall airplane
and propulsion system reliability.
Third Element: Test Requirements. Testing required by paragraph
(c)(4) must prove the effectiveness of design features incorporated
into the new airplane to prevent problems that have resulted in
inflight shutdowns or diversion on previous airplanes. This validates
that the specific lessons learned fixes work. The extensive validation
testing of the Model 777 required by paragraph (e) of these special
conditions, including the 3000-cycle engine test and 1000-cycle
airplane test, is designed to discover basic design flaws to a much
greater extent than has ever been undertaken in any previous airplane
development program. This includes testing to substantiate the
suitability of any technology new to the applicant. The environmental
conditions (hot and cold temperatures, high vibration, etc.) to which
the engines and airplane will be exposed during this testing will allow
the FAA the opportunity to observe the integrity of the airplane design
under conditions that have taken a fleet of airplanes years to
accumulate. Ninety-nine percent of problems resulting in inflight
shutdowns have occurred within 3,000 cycles on airplanes that have been
evaluated under the provisions of AC 120-42A. Based on this, the FAA
has determined that, after completing the airplane and engine testing
defined in these special conditions, sufficient experience will have
been gained to reveal virtually all potential causes of inflight
shutdowns.
Fourth Element: Demonstrated Reliability. Paragraph (h)(1) requires
that, for the engine and airplane systems, the number and types of
failures that occur during the airplane flight test program and the
1000 flight cycle ETOPS test must be consistent with the number and
types of failures or malfunctions that would be expected to occur on
presently certified 180-minute ETOPS airplanes. This requirement gives
the FAA assurance that the overall design maturity is at a level
expected of current in-service ETOPS airplanes.
Fifth Element: Problem Tracking System. Paragraph (f) requires that
problems that could impact the safety of ETOPS operations occurring
during airplane development and certification testing must have proven
fixes incorporated into the design before the airplane may be approved
for ETOPS operations. All such problems occurring after the airplane
begins ETOPS operations must be promptly reported in order that the FAA
may require appropriate corrective actions. This requirement ensures
that the risk of additional occurrences of any unforeseen failures that
could affect the safety of ETOPS operations is low.
The second commenter opposed to 180-minute ETOPS approval without
some in-service experience also states that any deficiency in
compliance with the approval plan should result in some lesser level of
approval from that sought. This position is consistent with these
special conditions. Paragraph (h)(2) specifies that if the corrective
action for unplanned engine shutdown or loss of thrust, or any problem
that jeopardizes the safety of an airplane diversion, occurring during
airplane flight testing, requires a major system redesign, this would
be cause for delayed ETOPS type design approval, or approval for
reduced single engine diversion time.
The same commenter also suggests changes to several paragraphs of
these special conditions. The FAA has reviewed these suggested changes
and considers that they are equivalent to the FAA wording and do not
clarify the requirements. Therefore, they have not been adopted.
A third commenter does not directly oppose the concept of ETOPS
approval at the time of airplane type certification, but suggests that
the special conditions should depart from the existing AC 120-42A
policy only where warranted by the experience of previous ETOPS
programs. Starting with this premise, the commenter then identifies
specific problem areas with the proposed special conditions.
First, the commenter questions the FAA's assessment that several
airplane engine combinations incorporating new or substantially
modified propulsion systems have demonstrated a high level of
reliability consistent with ETOPS operation upon entry into revenue
service. The commenter states that there is no single example of a
completely new product (airplane and engine) that achieved stable
reliability consistent with 180-minute ETOPS at entry into service, and
that only those products with a high level of similarity to previous
designs actually achieved this level of reliability.
The FAA disagrees with this commenter's distinction between ``new''
and ``derivative'' engines. There has been much discussion within the
industry about gaining some service experience credit for derivative
engines versus totally new designs in the application of the service
experience criteria of AC 120-42A. However, the industry has never been
able to agree on a standard by which to differentiate between
derivative and new engine designs. In a sense, every engine to be
developed since the first turbine engines were introduced are
derivatives of previous designs. Each new engine type has benefited
from the engine manufacturer's experiences with earlier models.
Successful design features are kept and improved upon while
unsuccessful ones are taken out of new designs. As a result, the FAA is
not depending on whether the engines are, or are not, derivative in
applying the requirements of these special conditions. The requirements
apply equally in either case.
The FAA's assessment was based on a review of new propulsion system
installations since the beginning of ETOPS operations in 1985. As an
example, the only completely new two-engine airplane now in ETOPS
service to be certified since ETOPS operations began is the Airbus
A320. A review of the propulsion system reliability of the CFM56-5
series engine installation on the A320, as measured by a 13-month
rolling average of the inflight shutdown (IFSD) rate, indicates an IFSD
rate of 0.14/1000 engine hours four months after airplane entry into
service. The IFSD rate, 0.02 for 180-minute ETOPS operations as defined
in AC 120-42A, is not achieved until 16 months after entry into
service.
At first glance, it appears that the A320 airplane did not exhibit
an acceptable ETOPS propulsion system reliability until a substantial
amount of service experience had been accumulated. A closer look at the
data, however, reveals that there were only two inflight shutdowns in
the first two years of revenue service. By the time the first inflight
shutdown dropped out of the 12-month rolling average IFSD rate, the
accumulation of engine fleet operating hours had reduced the rate to
below the 0.02 standard for 180-minute ETOPS operation. The rate has
been stable below that mark ever since. This clearly indicates that the
A320 airplane with CFM56-5 engines achieved the high standard of
propulsion system reliability at the time of type certification that
led the FAA to consider defining a process that would have demonstrated
the attributes of a relatively mature product at the time of entry into
revenue service. The A-320 airplane achieved this high level of
reliability even without the five-element certification program to
ensure reliability that is required by these special conditions.
The same commenter also questions the FAA's statement in the
proposed special conditions that a high standard of propulsion system
reliability on several recently certified airplane engine combinations
was evidenced during basic certification by a small number of problems
encountered. The commenter states that there is no clear relationship
between the number of problems that may be encountered during
certification tests and the reliability level for ETOPS in such areas
as engine IFSD rates, electronic generator failure rates, and failure
rates of other ETOPS significant systems and components. The commenter
goes on to state that the reliability levels required for ETOPS are too
high for direct statistical demonstration during a test program with a
sufficient level of confidence.
The FAA agrees with this commenter's assessment of the statistical
confidence achieved by certification testing alone. The FAA did not
intend to imply that a small number of problems occurring during type
certification in any way demonstrates a statistically significant
sample from which to base a failure rate calculation with a high degree
of confidence. The correlation referred to by the FAA is that, relative
to other airplane programs, the occurrence of a higher number of basic
design problems during type certification testing generally has
resulted in a higher number of problems occurring after the airplane
entered service. Those airplanes with the best propulsion system
reliability after entry into service have also, in general, encountered
fewer design problems during the type certification program.
Even without the statistical confidence the commenter is referring
to, experience has also shown that, in general, predictions of mature
component reliability made in analyses for showing compliance with the
safety assessment requirements Sec. 25.1309 of the FAR have been
conservative when compared with the actual achieved reliability in
service. In most cases, the types of problems that prevent a system or
component from achieving the predicated, mature level of reliability
have been basic design or manufacturing deficiencies that could have
been detected if extensive enough testing had been accomplished during
development and certification prior to entry into service. Random type
failures have not been a major contributor to unreliability. Therefore,
the FAA is confident that a design will achieve a high level of
reliability based on development and certification test results,
provided the testing is thorough in evaluating all potential failure
sources. The special conditions' relevant experience, analysis, and
test requirements define the methods that must be used to accomplish a
thorough evaluation of failure sources.
The same commenter states that the quantitative objectives for
engine inflight shutdown rate from AC 120-42A do not appear in the
special conditions. The commenter recommends that these objectives be
retained and compliance shown using a rational method that provides a
sufficient level of confidence.
As stated above, the FAA does not consider the testing to be
accomplished during the certification program to provide a
statistically significant sample from which to calculate a failure rate
with a high degree of confidence. Based on this assessment, a rational
method for calculating an inflight shutdown rate that provides a
sufficient level of confidence does not appear to be achievable. As
discussed above, experience has shown that failure rate calculations
can provide misleading information when used for testing and as a
performance indicator of a limited number of units. As designed, the
special conditions provide for assessment of demonstrated reliability
in conjunction with oversight of corrective action, as well as overall
performance, to make the eligibility assessment. This more
comprehensive approach is more meaningful as an overall safety
assessment process and permits the applicant to correct any
discrepancy, rather than just delay the program. Therefore, the FAA did
not include a quantitative inflight shutdown rate requirement in the
special conditions. Specific evaluation of each problem and
corresponding corrective action by the Reliability Assessment Board
will provide confidence that appropriate corrective action is taken for
each problem uncovered during testing.
Another commenter is concerned that a significant increase in drag
would occur during a single engine diversion with a failed engine that
has a locked rotor compared to a windmilling engine, due to a further
reduction of mass flow through the inlet. This commenter suggests that
ETOPS operational stability and control and extended range performance
be based on wind tunnel test data, obtained at high Reynolds number,
over the complete engine-inoperative flight envelope, with locked
engine rotor airflow accurately represented.
The FAA considered the effects of a locked engine rotor on a single
engine diversion during the development of the existing approval
criteria defined in Advisory Circular 120-42A. The AC lists several
factors that must be considered when planning how much fuel is required
to dispatch an airplane for ETOPS operations. These include current
forecast winds and meteorological conditions along the expected flight
path, operation of ice protection systems and performance loss due to
ice accretion on the unprotected surfaces of the airplane, operation of
auxiliary power units, loss of airplane pressurization, an approach
followed by a missed approach and subsequent approach and landing,
navigational accuracy, and air traffic control constraints. Additional
contingency fuel reserves are added to account for errors in wind
forecasts, and deterioration of cruise fuel mileage from that provided
the performance planning data. The FAA considered the addition of a
``locked rotor'' condition to be overly conservative and that any
increase in drag would be adequately covered by existing fuel reserve
requirements for ETOPS operations. Any effect that a locked engine
rotor may have on airplane stability and control is a basic airplane
airworthiness issue, and is covered as part of the basic 777 airplane
certification program. Therefore, the FAA has concluded that a locked
engine rotor is being adequately addressed without the need to change
the ETOPS special conditions.
One commenter states that the special conditions do not address the
conditions for approval of future design variants (e.g., higher thrust
ratings or major engineering design changes that result in new engine
model designations). This commenter expects the requirements to be
different for later design changes in terms of test and assessment
methods. While the FAA agrees that the test and assessment methods will
be different for later design changes, the FAA does not agree that it
is necessary to define specific requirements for future design
variants. These special conditions address the initial certification of
an airplane for ETOPS operations without the prerequisite service
experience defined in Advisory Circular 120-42A. Upon issuance, these
special conditions become a part of the airplane type certification
basis for ETOPS type design approval. Future changes in design must
meet the applicable requirements of these special conditions. However,
the scope of specific test conditions and assessment methods used for
particular design changes may differ from the initial ETOPS assessment
program. This would depend on the degree of commonality with the
existing approved design and how much credit for service experience the
new design may be given. The methods to be used to show compliance with
the special conditions requirements will be approved as part of the
certification process. This process will be similar to what is
currently done for existing approved ETOPS airplanes to determine if
service experience is necessary before a design change becomes eligible
for ETOPS operations.
This same commenter is concerned about the process to control and
administer the airplane configuration, maintenance, and operational
procedures pertinent to the ETOPS approval. This commenter is concerned
about a statement at the end of the discussion section of the notice
that appears to imply that the ETOPS configuration, maintenance, and
procedures (CMP) document revision process is replaced by the
airworthiness directive (AD) process. The FAA does not agree. The CMP
document is a product of the ETOPS approval process defined in AC 120-
42A. It defines the airplane configuration and any maintenance or
operational procedures, beyond the baseline airplane definition, that
are necessary to safely operate an airplane in an ETOPS operation. The
need for the CMP document originated when airplanes approved under the
AC guidance were not originally certified in consideration of the ETOPS
mission. With a new airplane designed and certified in accordance with
these special conditions, it is expected that a CMP document would
contain very few items, since it is the intent of the manufacturer to
build only ETOPS eligible airplanes. However, it is possible that the
Reliability Assessment Board may require interim problem corrective
actions to be incorporated as a condition for ETOPS approval, until
final corrective actions become available several months after the
airplane enters service. These conditional configuration requirements
would need to be defined in a CMP document. In response to problems
occurring after the airplane enters service, additional items may be
added to the CMP in order to define an airplane configuration that may
be used by 777 ETOPS operators to maintain acceptable system
reliability in accordance with the existing CMP revision process
identified in paragraphs 8g and 8h of AC 120-42A. The CMP document does
not replace the AD process referred to by the commenter. Any problems
occurring in service that would significantly affect the safety of an
ETOPS operation will result in an AD being issued. The AD may reference
a CMP document revision that defines the required configuration, but it
does not have to.
Engine Assessment
One commenter recommends that the procedures for an engine
condition monitoring program, required by paragraph (b)(2), should
consider 200 minutes operation at maximum continuous thrust, followed
by 5 minutes at inflight takeoff or go-around thrust. The commenter's
rationale for this recommendation is that guidance for the maximum
thrust required for a single engine diversion should be specified and
that a realistic diversion thrust requirement should be padded by 20
minutes above the specified maximum diversion time. The FAA does not
agree. Traditional engine condition monitoring programs are designed to
determine if maximum takeoff thrust can be achieved. The intent of the
validated condition monitoring program required by paragraph (b)(2) is
to provide a means to determine when an engine is no longer capable of
achieving maximum continuous thrust within approved engine limits. The
duration that the thrust would be available is not a consideration in
this requirement, only that adequate thrust would be available. Based
on current experience with engine deterioration rates, the engine
certification requirements contained in part 33 of the FAR demonstrate
that maximum continuous thrust will be available for any conceivable
diversion time. It is not intended that the condition monitoring
program identified in paragraph (b)(2) be able to predict impending
failure conditions. Therefore, paragraph (b)(2) is adopted as proposed.
Design Requirements Assessment
One commenter states that paragraph (c)(1) of the special
conditions only refers to the design requirements of part 25 and ``does
not call up the design requirements in AC 120-42A, paragraphs 8b(7),
(8), (9), (10), and (11).'' The FAA infers from this comment that the
commenter desires that the AC paragraphs noted above be incorporated in
the special conditions. The FAA agrees that the AC criteria are
important; however, the advisory circular provides policy guidance for
obtaining ETOPS approval for already certified two-engine airplanes.
The design criteria referred to by the commenter were developed to
allow approval of airplanes for which ETOPS types of operations were
not considered when they were originally certified to part 25
airworthiness standards. With one exception, existing part 25
airworthiness standards are sufficient to properly certify a new two-
engine airplane for ETOPS operation, as long as the ETOPS mission is
considered in applying these requirements for all anticipated dispatch
configurations. The purpose for the design requirements assessment of
paragraph (c)(1) of these special conditions is to define the specific
methods that will be used to show compliance with the part 25
airworthiness requirements when considering the ETOPS mission. These
methods may include additional design features, analyses, tests, or a
combination of the three. Depending on the system design, the specific
design criteria called out in AC 120-42A may not be necessary or
appropriate on a new airplane design.
The one exception to the airworthiness standards contained in part
25 that is necessary in order to certify an ETOPS suitable airplane is
a requirement to design the airplane to preclude failures or
malfunctions that could result in an engine inflight shutdown. Existing
propulsion system installation requirements are based on the ``fail-
safe'' concept. In other words, continued safe flight and landing are
assured after any single propulsion system failure. Propulsion system
reliability is not a major design consideration in existing
airworthiness standards because failures must be shown to be ``safe.''
ETOPS criteria are intended not only to ensure continued safe operation
after an engine inflight shutdown, but also to prevent the failure
condition that resulted in the shutdown. This additional requirement to
prevent engine inflight shutdowns was included in paragraph (c)(1) of
these special conditions. Based on these considerations, the special
conditions are adopted as proposed.
The commenter also refers to several new design features that were
considered during the development of the early ETOPS special condition,
and questions why they were not included in the final proposal.
Examples given include a 22,000 foot single engine cruise altitude, and
a specific list of electrical services to be powered in the backup
electrical configuration. As stated above, the FAA has determined that
the existing airworthiness standards defined in part 25 are sufficient
to properly certify a new two-engine airplane for ETOPS operation, as
long as the ETOPS operational mission is considered in finding
compliance. The FAA has also determined that including specific design
requirements such as the two examples cited above may be too
restrictive in defining what the applicant could do to comply with the
safety objectives of part 25. This might result in a design requirement
being imposed that is inappropriate because of a change in the airplane
design that was not considered in the development of that requirement.
However, as part of the requirements assessment, paragraph (c)(3) of
the special conditions requires the applicant to consider the types of
design features that the commenter is referring to, and to list those
specific design features that are included in the airplane design to
accommodate the ETOPS mission. The FAA therefore does not consider it
necessary to revise the special conditions.
Another commenter states that the design feature consideration for
fuel quantity indication to the flight crew in paragraph (c)(3)(i)(C)
should include alerts for abnormal fuel management or transfer between
tanks in addition to the other listed considerations. The FAA agrees
with this comment and has revised paragraph (c)(3)(i)(C) accordingly.
Relevant Experience Assessment
One commenter recommends that paragraph (c)(2) clearly indicate
that the relevant experience assessment shall include a demonstration
of the applicability of the past experience to the new design, at the
appropriate system, sub-system, or component level. The commenter
suggests that this demonstration may be based on an engineering
comparison at the appropriate level, but shall also be backed by
comparison testing where the design differences are significant. The
commenter supports this comment with the statement that there is
substantial evidence that beyond a certain level of difference between
the product that produced the past experience and the new product, the
``lessons learned'' assessment process ceases to be fully effective.
The FAA agrees that beyond a certain level of commonality, past
experience may not be relevant to the new design. This is particularly
true where a specific design feature that contributed to problems in
previous airplanes is not a part of the new airplane design. However,
the FAA does not concur that a change in the special conditions is
necessary to achieve the results desired by the commenter. The
demonstration of the applicability of past experience to the new design
is inherent in the relevant experience assessment. Paragraph (c)(2) of
the special conditions requires that corrective actions taken to
preclude similar problems from occurring on the new airplane must be
identified. Removal from the design of a system, sub-system, or
component that has had problems in the past may be an acceptable
corrective action, as long as it precludes similar problems from
occurring. In addition, paragraph (c)(4) requires the applicant to
define specific new or enhanced tests that will be used to assure
engine and airplane system design integrity. In complying with this
requirement, the tests derived from the relevant experience assessment
will be used to substantiate that effective corrective action has been
taken for each source of past problems.
This commenter also states that where new technology is introduced,
the lessons learned assessment becomes impractical, as there is no
previous experience with this technology. While the FAA agrees that
there will be no previous experience with a new technology, there may
still be applicable relevant experience. For example, an applicant's
previous experience with new technology introductions may lead to
changes in manufacturing and quality control processes. Further,
lessons learned of general applicability can be introduced into the new
technology design, such as a general design practice to prevent cross-
connector installation. The FAA has determined that the existing
special conditions requirements meet the intent of the commenter's
recommendation; therefore, the commenter's specific recommended change
has not been adopted.
The same commenter also states that the special conditions should
clearly indicate how much direct service experience shall be required
in the case of a completely new design utilizing technology new to the
manufacturer, for which no basis of relevant experience exists. The FAA
does not concur. As stated above, there may be applicable relevant
experience even for a completely new design incorporating new
technology. In addition, relevant experience is only one aspect of
these special conditions. It is not the only mechanism by which the
airplane would be assessed for ETOPS approval. Among the other
requirements, paragraph (e)(4) requires the applicant to conduct tests
to substantiate the suitability of new technology. The commenter's
recommended change therefore has not been adopted.
Additional ETOPS Test Requirements
One commenter recommends that the configuration requirements of
paragraph (e)(1) also apply to the testing defined in paragraph (c)(4).
The commenter's rationale for this recommendation is that the merits of
incorporating sufficient component interfacing to simulate actual
airplane installation interactions should justify expanding this
requirement to other critical ETOPS systems not specifically enumerated
in paragraph (e). The FAA appreciates the concerns expressed by the
commenter, but does not agree that this recommendation is practicable.
The scope of the testing covered under paragraph (c)(4) is such that
many of the new or enhanced tests may be done with prototype hardware
at the bench or component level early in the development program when
sufficient interfacing system hardware is not available. In accordance
with paragraph (c)(4), the applicant must define each test that will be
used to assure design integrity. The enhanced testing defined by this
paragraph will include the configuration proposed for certification and
sufficient interfacing system hardware and software to simulate the
actual airplane installation when it is necessary to accomplish this
goal. As for other critical ETOPS systems not specifically identified
in paragraph (e), the 3000-cycle engine and auxiliary power unit tests
and 1000-cycle airplane test will provide an adequate opportunity to
discover design problems with these systems.
1000-Cycle Airplane Test
One commenter questions the requirement to install either the 3000-
cycle test engine or another high-cycle engine for part of the 1000-
flight-cycle airplane test by stating that the rationale for the
requirement is unclear. This commenter considers that a complete strip
and inspection of the high-cycle engines to identify incipient problems
is a more effective way of establishing early ETOPS suitability, than
by inclusion in the flight program. This commenter goes on to say that
history has shown that new problems are more likely to be exhibited by
lower life engines rather than by mature engines, and the relevance of
potentially non-representative high life failures is not immediately
obvious.
The FAA does not concur with the commenter's assessment that any
failures on the 3000-cycle engine during the 1000-cycle airplane test
would be a non-representative high life failure. The 3000-cycle engine
is representative of a high-time engine that would exist if the AC 120-
42A criteria for operating experience for 180-minute ETOPS approval
were considered. The 3000-cycle ground test will not subject the engine
and engine-mounted airplane equipment to representative altitude
conditions that the FAA is concerned may impact overall reliability.
The reason for including the 3000-cycle test engine and its associated
propulsion system equipment, or another suitable high-cycle engine and
propulsion system, on the 1000-cycle airplane test vehicle is to expose
an ``aged'' engine to altitude effects not possible to achieve on a
ground test stand. Flight time with this aged engine will give the FAA
additional confidence that the results achieved during the ground
cyclic testing are representative of the actual airplane environment
that is used to assess propulsion system reliability for ETOPS type
design approval using the AC 120-42A criteria.
This same commenter expresses concern that a complete teardown and
inspection of the high time engine will not be possible if it is
installed on the 1000-cycle test airplane. The FAA does not agree. A
complete teardown and inspection is planned for every engine and all
the engine-mounted airplane equipment subjected to the 3000-cycle test.
A teardown inspection is required in order for the Reliability
Assessment Board to assess the design suitability for ETOPS approval in
accordance with paragraph (g) of these special conditions. It was this
concern for obtaining meaningful teardown results from the 3000-cycle
test engine that prompted the FAA to allow another suitable high-cycle
engine to be installed on the 1000-cycle test airplane. In addition, an
airworthiness inspection will be performed on the high-time engine
prior to its installation on the airplane in order to ensure that the
engine complies with the maintenance manual acceptance limits for
continued operational service. Any problems found during the
airworthiness inspection will be reported in accordance with the
problem tracking system requirements, and necessary repairs will be
made prior to the engine's installation on the 1000-cycle test
airplane.
One commenter recommends that ``actual airline operation,'' as used
in paragraph (e)(7), ``be defined such that five percent of the 1000
flight cycles should be at altitudes and of duration typical of actual
ETOPS operations to ensure no adverse impact on any aircraft systems
and engines due to extended cold soaking, etc.'' The FAA agrees with
the commenter's assessment of the need for high altitude, long duration
flight cycles. However, the FAA does not concur with the commenter's
suggested change. The mix of flight cycles to be flown during the 1000
cycle test is based on an assessment of flight operating conditions
that have led to the types of problems that have occurred in service on
those airplane engine combinations that currently have 180-minute ETOPS
approval. The number of high altitude, long duration flight cycles that
will be flown for each of the engine types to be certified on the 777
airplane is a result of this assessment combined with additional flight
cycles that are necessary to validate airline operational readiness.
The FAA considers that the change proposed by the commenter would
unduly restrict the FAA in requiring development of an appropriate test
plan for the 1000 cycle test.
Another commenter recommends that the ``1000 cycle test should be
done using published maintenance manual criteria in lieu of unique
engineering allowances.'' The FAA concurs with this comment. It has
always been the FAA's intent that the 1000-cycle airplane would be
operated and maintained using the recommended operations and
maintenance manual procedures. This is to validate that operating and
maintenance procedures to be used during airline operations are correct
and will not lead to errors that may result in engine inflight
shutdowns or airplane diversions. Paragraph (e)(7) has been amended to
make this clarification. In addition, the paragraph has been
reorganized to more clearly state the requirements.
Problem Tracking System
One commenter recommends that any problem reported under the
problem tracking system must be under control within a maximum of 30
days. The FAA does not concur that the addition of a time limit is
necessary or appropriate. The proposed special conditions did not
specify a particular time interval by which all problems must be
``under control.'' The intent of the problem tracking system is to
provide a means by which the FAA will be promptly notified of problems
occurring on the design so that the FAA Reliability Assessment Board
can ensure that appropriate timely resolutions are implemented.
Depending on the severity of the problem, a more immediate response
than 30 days may be appropriate. For less severe problems, a slower
response may be allowable. In each case, the FAA Reliability Assessment
Board will determine the appropriate time interval for resolution of
all ETOPS significant problems identified by the problem tracking
system. Defining a specific time interval for problem resolution is too
restrictive and, therefore, the FAA has not adopted the commenter's
proposal in the final special conditions.
Reliability Assessment Board
One commenter is concerned that the proposed FAA Reliability
Assessment Board (RAB) might be over-represented by FAA engine
specialists. Specifically, the commenter would like the special
conditions to include references to systems, avionics, and flight
control representatives, as well as field inspectors, to help ensure a
balanced board makeup. The FAA does not concur that identifying
specific system specialists is appropriate. The purpose of the RAB is
to address the suitability of the entire airplane for ETOPS and not
just the propulsion system, as was the case with the Propulsion System
Reliability Assessment Board defined in AC 120-42A. As stated in the
preamble to the notice of these special conditions, the board will
consist of members from a broad spectrum of offices, including FAA
airplane and engine certification offices, FAA aircraft evaluation
groups for both the engines and airplane, FAA maintenance and
operational approval offices, and FAA headquarters. In addition to the
Seattle Aircraft Certification Office (Seattle ACO), the following
offices have been requested to support the RAB:
Los Angeles Aircraft Certification Office
Engine Certification Office
Flight Standards Air Transportation Division
Flight Standards Aircraft Maintenance Division
Flight Standards Technical Programs Division
Seattle Aircraft Evaluation Group
Boston Aircraft Evaluation Group
United Airlines FAA Certificate Management Office
(Pratt & Whitney engine installation only)
These special conditions define specific findings that the RAB must
make in order to determine that the 777 airplane is suitable for 180-
minute ETOPS operations. It is implicit in each of these findings that
FAA technical specialists be involved in the decision process. This is
in keeping with existing type certification practice. Therefore, naming
specific system specialties for RAB membership is not necessary.
Reliability Demonstration Acceptance Criteria
One commenter states that proposed paragraph (h)(1) implies a
direct relationship between the type and frequency of engine and
systems events occurring during the test program and the demonstrated
reliability of existing approved 180-minute ETOPS airplanes. This
commenter goes on to state that this paragraph could be interpreted as
a statement that a sample of 1000 flights is enough to produce a
statistical demonstration of reliability, and recommends adding wording
to the effect that ``flight test and laboratory test * * * are not used
to produce directly a measure of the reliability.'' The FAA infers from
this statement that the commenter does not consider the reliability
demonstration acceptance criteria of paragraph (h)(1) to provide a
statistically meaningful assessment of airplane reliability.
While the FAA agrees that the airplane flight test program and the
1000-flight-cycle ETOPS test referred to in paragraph (h)(1) will not
form a statistically significant sample from which to produce a direct
measurement of reliability, a statistical calculation of reliability is
not the intent of the requirement. As stated earlier, the occurrence of
a relatively high number of basic design problems during type
certification testing generally has resulted in a higher number of
problems occurring after the airplane enters service. Those airplanes
with the best propulsion system reliability after entry into service
have also, in general, encountered relatively few design problems
during the type certification program. Paragraph (h)(1), then, provides
a measurement of design maturity based on the experience from past
certification programs. The standard used to judge this maturity is the
type and frequency of failures occurring on already certified 180-
minute ETOPS airplanes. This is not to say that it is necessary to do a
direct comparison of failure rates system by system. In gross terms,
the FAA is expecting the 777 flight test airplanes to experience the
same kinds of problems at about the same frequency that are occurring
on ETOPS airplanes in revenue service. These special conditions define
the standard by which the suitability of the 777 airplane will be
assessed for ETOPS approval. The FAA does not consider it necessary to
state that the testing does not produce a direct measure of
reliability.
Demonstration of Compliance
One commenter recommends adding a new paragraph (i)(8) that would
read as follows: ``The accelerated engine cyclic endurance test program
of paragraph (f)(5) must be in place.'' The commenter's rationale for
this recommendation is that is it necessary to require timely program
startup and to ensure that the test engine cycles remain well ahead of
high-cycle revenue fleet engines. The FAA agrees with this comment and
has added a new paragraph (i)(7) to the special conditions. Previously
designated paragraph (i)(7) has been redesignated as paragraph (i)(8).
Miscellaneous Comments
One commenter notes that in the second sentence of paragraph (e)(6)
the word ``administration'' appears to be a typographical error that
should read ``demonstration.'' The commenter is correct and the final
special conditions are corrected as noted.
Some comments were received concerning compliance methods, although
these commenters did not recommend any changes to the special condition
requirements. These special conditions address the regulatory standards
to be applied in obtaining Early ETOPS approval. The means by which
compliance is demonstrated is not specifically addressed in this
action. The specific methods that Boeing will use to demonstrate
compliance with these special conditions will be approved as part of
the normal certification process. This will be accomplished by FAA
approval of the ETOPS type design assessment plan, required by
paragraph (a) of these special conditions.
One comment concerns the process for an airline to receive early
ETOPS operational approval. Operational approval is not addressed by
these special conditions. As stated earlier, Advisory Circular 120-42A
contains guidance regarding operational and maintenance practices
criteria that must be met by the operator before ETOPS operations can
be conducted. Satisfaction of the requirements of these special
conditions does not constitute operational approval.
With the exception of the revisions noted above, the special
conditions for extended range operation of the Boeing Model 777
airplane are adopted as proposed.
Conclusion
This action affects only certain unusual or novel design features
on one model series of airplanes. It is not a rule of general
applicability and affects only the manufacturer who applied to the FAA
for approval of these features on the airplane.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation Safety, Federal Aviation Administration,
Reporting and recordkeeping requirements.
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. app. 1344, 1348(c), 1352, 1354(a), 1355,
1421 through 1431, 1502, 1651(b)(2); 42 U.S.C. 1857f-10, 4321 et
seq.; E.O. 11514; and 49 U.S.C. 106(g).
The Special Conditions
Accordingly, the following special conditions are issued as part of
the type certification basis for the Boeing Model 777 airplane:
In addition to the airworthiness requirements of part 25 of the
Federal Aviation Regulations (FAR), the Model 777 airplane must
comply with the following requirements in order to be eligible for
Extended Range Operation with Two-Engine Airplanes (ETOPS) without
the requisite operating experience specified in Advisory Circular
(AC) 120-42A:
(a) Introduction. An approved ETOPS Type Design Assessment Plan
covering the engine and each applicable airplane system must be
established. The specific methods that will be used to substantiate
compliance with the requirements of these special conditions must be
defined in the plan. Specific systems that will undergo the complete
analysis, testing, and development program tracking defined in
paragraph (c) of these special conditions must be identified. Other
airplane systems that may contribute to the overall safety of an
ETOPS operation, but that do not warrant the rigorous type design
requirements and relevant experience assessments defined in
paragraph (c) of these special conditions, must be identified and
agreed to by the FAA. Compliance must be shown for these other
systems with all provisions of these special conditions, except
paragraph (c). In showing compliance with these special conditions,
tests and analyses conducted to substantiate compliance with the
basic airworthiness standards of part 25 may be referenced, if
applicable.
(b) Engine Assessment.
(1) The ETOPS eligibility of the engine must be determined
specifically for the airplane installation for which early ETOPS
type design approval is requested.
(2) Procedures for an engine condition monitoring program must
be defined and validated at the time of ETOPS type design approval.
The engine condition monitoring program must be able to predict when
an engine is no longer capable of providing, within certified engine
operating limits, the maximum thrust required for a single engine
diversion.
(c) ETOPS Type Design Assessment.
(1) Design requirements Assessment. Part 25 of the FAR,
including applicable amendments, defines most of the requirements
necessary to design an airplane that is suitable for ETOPS
operation, as long as the ETOPS mission is considered in applying
these requirements for all anticipated dispatch configurations. In
addition to these requirements, the propulsion system must be
designed to preclude failures or malfunctions that could result in
an engine inflight shutdown. The applicant must identify and list
methods of compliance for each of the applicable ETOPS requirements,
including those specific part 25 requirements for which methods of
compliance relative to the ETOPS mission are different from those
traditionally used for two-engine airplanes. Paragraph (c)(3) of
these special conditions lists certain design feature categories
that may be affected by a consideration of the ETOPS mission in the
design of these systems. The effects of the applicable ETOPS
requirements on the design of any of those design feature categories
listed in paragraph (c)(3) must be specifically addressed by this
assessment.
(2) Relevant Experience Assessment. For each system covered by
the ETOPS Type Design Assessment, there must be an assessment of the
relevant design, manufacturing, and operational problems experienced
on previous airplanes built by the applicant. The assessment must
include the applicable relevant service experience of vendor
supplied systems or, to the extent possible, the service experience
of components on aircraft built by other manufacturers. Specific
corrective actions taken to preclude similar problems from occurring
on the new airplane must be identified.
(3) Design Features.
(i) The applicant must define any design features implemented to
comply with the design requirements listed in paragraph (c)(1).
Consideration of the following design feature categories must be
specifically addressed:
(A) Airplane capabilities and capacities of the ETOPS mission;
(B) Fuel system integrity, including consideration of
uncontained main engine rotor burst and fuel availability as
affected by cross-feed capability and electrical power to pumps and
other components;
(C) Fuel quantity indication to the flightcrew, including alerts
that consider the fuel required to complete the mission, abnormal
fuel management or transfer between tanks, and possible fuel leaks
between the tanks and the main engines;
(D) Communication systems for the ETOPS environment;
(E) Navigation systems for the ETOPS environment;
(F) Minimum single engine cruise altitude capability; and
(G) Failure tolerant designs of cockpit indicating systems or
avionics systems to prevent unnecessary airplane diversions.
(ii) The applicant must define the specific design features used
to address problems identified in the relevant service experience
assessment of paragraph (c)(2).
(4) Test Features. The applicant must define specific new tests,
or enhanced tests, that will be used to assure engine and airplane
system design integrity. These test features may be derived from the
requirements assessment of paragraph (c)(1) and the relevant service
experience assessment of paragraph (c)(2).
(5) Analysis Features. The applicant must define specific new
analyses, or enhanced analyses, that will be used to assure engine
and airplane system design integrity. These analysis features may be
derived from the requirements assessment of paragraph (c)(1) and the
relevant service experience assessment of paragraph (c)(2).
(6) Manufacturing, Maintenance, or Operational (Other) Features.
The applicant must define specific new, or enhanced, manufacturing
processes or procedures, and maintenance or operational procedures
that are being implemented to assure engine and airplane system
integrity. These ``other'' features may be derived from the
requirements assessment of paragraph (c)(1) of this section and the
relevant service experience assessment of paragraph (c)(2).
(d) Additional EOPS Analysis Requirements.
(1) Performance and Failure Analyses. Engine and airplane
performance and failure analyses required for certification must be
expanded to consider ETOPS mission requirements, including exposure
times associated with a 180-minute single-engine diversion and a
subsequent 15-minute hold in the terminal airspace at the diversion
airport. Consideration must be given to crew workload and
operational implications of continued operation with failure effects
for an extended period of time. The rationale and all assumptions
used in the analyses must be documented, justified, and validated,
including maintenance interval and maintainability assumptions.
(2) Maintenance and Flight Operations Evaluation. The Type
Design Assessment Plan must contain a program to systematically
detect and correct problems occurring as a result of improper
execution of maintenance or flight operations. Corrective actions
for any problems found must be identified and implemented through
the Problem Tracking and Resolution System required by paragraph
(f).
(3) Manufacturing Variability. The Type Design Assessment Plan
must contain a program to minimize potential manufacturing problems.
The plan should address early validation of tooling and procedures,
as well as any related problems, as identified in paragraph (c)(2).
Corrective actions for problems that impact the safe operation of
the airplane must be identified and implemented through the problem
tracking and resolution system required by paragraph (f).
(e) Additional ETOPS Test Requirements. As part of, or in
addition to, the testing identified in paragraph (c)(4), the
following specific test requirements apply:
(1) Configuration Requirements. All testing defined in paragraph
(e) must be conducted with the configuration proposed for
certification, and must include sufficient interfacing system
hardware and software to simulate the actual airplane installation.
(2) Completion of Applicable Failure Analyses. Failure analyses
required for ETOPS type design approval must be submitted to the FAA
prior to the start of the testing defined in paragraph (e).
(3) Vibration Testing. Vibration testing must be conducted on
the complete installed engine configuration to demonstrate that no
damaging resonances exist within the operating envelope of the
engine that could lead to component, part, or fluid line failures.
The complete installed engine configuration includes the engine,
nacelle, engine mounted components, and engine mounting structure up
the strut to wing interface.
(4) New Technology Demonstration Testing. Testing must be
conducted to substantiate the suitability of any technology new to
the applicant, including substantially new manufacturing techniques.
(5) Auxiliary Power Unit Demonstration Test. If requesting
credit for APU backup electrical power generation, one auxiliary
power unit (APU), of the type to be certificated with the airplane,
must complete 3000 equivalent airplane operational cycles.
(6) Engine Demonstration Test. One engine of each type to be
certificated with the airplane must complete 3000 equivalent
airplane operational cycles. The engine must be configured with a
complete airplane nacelle package for this demonstration, including
engine-mounted equipment.
(7) Airplane Demonstration Test. For each engine type to be
certificated with the airplane, one complete airplane must complete
at least 1000 flight-cycles simulating an actual airline operation.
(i) The airplane must be exposed to representative environmental
variations within the normal expected airplane operational envelope
during the 1000 cycles.
(ii) The 3000-cycle test engine and propulsion system specified
in paragraph (e)(6) above, or another suitable high-cycle test
engine and propulsion system acceptable to the Administrator, must
be installed on the airplane for a minimum of 500 cycles during this
demonstration.
(iii) The 1000-cycle test airplane must be operated and
maintained using the recommended operations and maintenance manual
procedures.
(f) Problem Tracking System. An FAA-approved problem tracking
system must be established to address problems encountered on the
engine and airplane systems that could affect the safety of ETOPS
operations.
(1) The system must contain a means for the prompt
identification of those problems that could impact the safety of
ETOPS operations in order that they may be resolved in a timely
manner.
(2) The system must contain the process for the timely
notification to the responsible FAA office of all relevant problems
encountered, and corrective actions deemed necessary, in a manner
that allows for appropriate FAA review of all planned corrective
actions.
(3) The system must be in effect during the phases of airplane
development that will be used to assess early ETOPS eligibility, and
for at least the first 250,000 engine-hours of fleet operating
experience after the airplane enters revenue service. For the
revenue service period, this system must define the sources and
content of in-service data that will be made available to the
manufacturers in support of the problem tracking system. The content
of the data provided must include, as a minimum, the data necessary
to evaluate the specific cause of all service incidents reportable
under Sec. 21.3(c) of part 21, in addition to any other failure or
malfunction that could prevent safe flight and landing of the
airplane, or affect the ability of the crew to cope with adverse
operating conditions.
(4) Corrective actions for all problems discovered during the
development and certification test program that could affect the
safety of ETOPS operations, or the intended function of systems
whose use is relied upon to accomplish the ETOPS mission, must be
identified and implemented in accordance with paragraph (g)(2). If,
during the certification program, it is discovered that a fault has
developed that requires significant rework of manufacturing,
maintenance, and/or operational procedures, the FAA will review the
ETOPS suitability of the affected system and interfacing hardware
and identify any additional actions to be accomplished to
substantiate the corrective actions.
(5) For each engine type to be certificated with the airplane,
the system must include provisions for an accelerated engine cyclic
endurance test program that will accumulate cycles on one
representative production-equivalent propulsion system in advance of
the high-cycle revenue fleet engine. This test program will assist
the applicant and the FAA in identifying and correcting problems
before they occur in revenue service. This program must be in place
for, at a minimum, the first 250,000 engine-hours of fleet operating
experience after the airplane enters revenue service. The
representative production-equivalent propulsion system may, at the
manufacturer's discretion, be used for other fleet support
activities.
(g) Reliability Assessment Board.
(1) An FAA Reliability Assessment Board will be formed to
evaluate the suitability of the airplane for ETOPS approval and make
a recommendation to the Manager, Transport Airplane Directorate,
regarding the adequacy of the type design for 180-minute ETOPS
operation. The purpose of this board will be:
(i) To periodically review the development and certification
flight test program accomplishments from both type design and
operational perspectives;
(ii) To ensure that all specific problems, as well as their
implications on the effectiveness of the Early ETOPS process, are
resolved; and
(iii) To assess the design suitability for ETOPS. The board will
consider design, maintenance, manufacturing, and operational aspects
of the type design when finding suitability for ETOPS approval.
(2) The FAA Reliability Assessment Board will review and
evaluate the data from the problem tracking and resolution system to
establish compliance with the requirements of paragraph (h). The
board will evaluate the overall type design for ETOPS suitability as
demonstrated in flight test, and the 1000-cycle ETOPS test,
considering all resolutions of problems. The following suitability
criteria will be applied:
(i) Sources of engine shutdown/thrust loss, engine anomalies, or
airplane system problems that have a potential significant adverse
effect on in-service safety will be resolved.
(ii) Resolutions are identified for all items in paragraph (i)
with analysis and/or testing to show all resolutions are effective.
These resolutions may be accomplished through one or more of the
following categories:
Design change
Operating procedure revision
Maintenance procedure revision
Manufacturing change
(iii) The resolutions of paragraphs (i) and (ii) will be
incorporated prior to entry into service.
(iv) The engine shutdown history of the test program indicates
that the engine reliability of the configuration is suitable for the
ETOPS approval being considered.
(v) Where interim resolutions having operational impact are
defined, the cumulative effect must be determined to be acceptable.
(vi) System or component failures experienced during the program
are consistent with the assumptions made in the failure analyses.
(h) Reliability Demonstration Acceptance Criteria.
(1) For the engine and airplane systems, the type and frequency
of failures that occur during the airplane flight test program and
the 1000-flight-cycle ETOPS test must be consistent with the type
and frequency of failures or malfunctions that would be expected to
occur on presently certified 180-minute ETOPS airplanes. The
failures to be considered are those associated with system
components that conform to the type design requested for
certification. The Reliability Assessment Board will determine
compliance with this requirement based on an evaluation of the
problem reporting system data, considering system redundancies,
failure significance, problem resolution, and engineering judgment.
(2) Corrective action for any of the following classes of
problems occurring during the testing identified in paragraph (h)(1)
that requires a major system redesign would delay ETOPS type design
approval, or result in approval of a reduced single-engine diversion
time, unless corrective action has been substantiated to, and
accepted by, the FAA Reliability Assessment Board:
(i) Any source of unplanned inflight shutdown or loss of thrust.
(ii) Any problem that jeopardizes the safety of an airplane
diversion.
(3) The FAA Reliability Assessment Board must determine that the
suitability criteria of paragraph (g)(2) have been met.
(i) Demonstration of Compliance. In order to be eligible for
180-minute ETOPS type design approval, the following conditions
apply:
(1) The engine assessment has been completed and eligibility for
ETOPS operation has been approved by the FAA Engine Certification
Office.
(2) All design, manufacturing, maintenance, operational, and
other features necessary to meet the ETOPS requirements of paragraph
(c)(1), and to resolve the problems identified in paragraph (c)(2),
have been successfully implemented.
(3) The identified test and analysis features in paragraph
(c)(4) and (c)(5) have been shown to be effective in validating the
successful implementation of the features in paragraph (i)(2).
(4) The additional analysis requirements of paragraph (d) have
been completed and the results have been approved.
(5) The additional test requirements of paragraph (e) have been
successfully completed.
(6) All significant problems identified in accordance with
paragraph (f) have been resolved, and fixes substantiated to be
effective have been implemented.
(7) The accelerated engine cyclic endurance test program of
paragraph (f)(5) must be in place.
(8) Compliance with the reliability demonstration acceptance
criteria of paragraph (h) has been found by the Reliability
Assessment Board.
Issued in Renton, Washington, on May 18, 1994.
Ronald T. Wojnar,
Manager, Transport Airplane Directorate, Aircraft Certification
Service.
[FR Doc. 94-13072 Filed 5-31-94; 8:45 am]
BILLING CODE 4910-13-M