[Federal Register Volume 59, Number 104 (Wednesday, June 1, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-13072]


[[Page Unknown]]

[Federal Register: June 1, 1994]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 25

[Docket No. NM-81, Special Conditions No. 25-ANM-84]

 

Special Conditions: Extended Range Operation of Boeing Model 777 
Series Airplanes

AGENCY: Federal Aviation Administration, DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for approval of the Boeing 
Model 777 airplane for Extended Range Operation with Two-engine 
Airplanes (ETOPS) without the prerequisite service experience currently 
required for ETOPS approval. The manufacturer has requested that the 
Model 777 airplane be found to be acceptable for ETOPS operation at the 
time of type certification. Extended range operation of twin engine 
airplanes is not envisioned by the airworthiness standards for 
transport category airplanes, and has been determined to constitute a 
novel of unusual feature. These special conditions contain the 
additional safety standards that the Administrator considers necessary 
to establish a level of safety equivalent to that provided by the 
airworthiness standards for transport category airplanes.

EFFECTIVE DATE: July 1, 1994.

FOR FURTHER INFORMATION CONTACT:
Steven P. Clark, FAA, Seattle Aircraft Certification Office, Propulsion 
Branch, ANM-140S, Transport Airplane Directorate, Aircraft 
Certification Service, 1601 Lind Avenue SW., Renton, Washington 98055-
4056; telephone (206) 227-2679.

SUPPLEMENTARY INFORMATION:

Background

    On June 18, 1990, the Boeing Commercial Airplane Group, P.O. Box 
3707, Seattle, Washington 98124-2207, applied for a type certificate 
for the new Model 777 airplane. The Model 777 is a long range, 
transport category airplane powered by two Pratt & Whitney PW4000 
series, Rolls-Royce Trent 800 series, or General Electric GE90 series 
engines. The overall length of the Model 777 is 209 feet, the height is 
61 feet, and the wingspan is 198 feet. The airplane has a seating 
capacity, in a typical three class configuration of 305 to 328 
passengers, or 375 to 400 passengers in a two class configuration. The 
Model 777 has a maximum takeoff weight of 535,000 lbs., a maximum 
landing weight of 445,000 lbs., a maximum operating altitude of 43,100 
ft., and a range of 4,200 nautical miles in a two class configuration 
or 6,600 nautical miles in a three class configuration.

Type Certification Basis

    Under the provisions of Sec. 21.17, Boeing must show that the Model 
777 airplane meets the applicable provisions of part 25, as amended by 
Amendments 25-1 through 25-71. Boeing has also elected to comply with 
most of part 25 as amended by Amendment 25-77. The type certification 
basis for Model 777 is therefore part 25 through Amendment 25-77, 
except for Sec. 25.571(e)(1), which remains at Amendment 25-71 level; 
and parts 34 and 36, each as amended at the time of certification. 
Boeing may also elect to comply with subsequent part 25 requirements to 
facilitate operators' compliance with corresponding part 121 
requirements. The certification basis also includes other special 
conditions that are not relevant to these special conditions.
    If the Administrator finds that the applicable airworthiness 
regulations (i.e., part 25 as amended) do not contain adequate or 
appropriate safety standards for the Model 777 airplane because of 
novel or unusual design features, special conditions are prescribed 
under the provisions of Sec. 21.16.
    Special conditions, as appropriate, are issued in accordance with 
Sec. 11.49 after public notice, as required by Secs. 11.28 and 
11.29(b), effective October 14, 1980, and become part of the type 
certification basis in accordance with Sec. 21.17(a)(2).

Model 777 Design Features

    The structure of the Model 777 is generally of conventional design 
and construction, but with considerable use of composite materials. 
Elements of the primary structure (the fin and horizontal tail) are 
constructed of composites, as are some elements of secondary structure, 
including the elevators, rudders, flaps, spoilers, ailerons, engine 
cowls, and main deck floor beams.
    The Model 777 uses a combination of multiple computer channels and 
redundant sensors that channel command signals to various control 
surface actuators in response to programmed control laws. This control 
architecture, referred to as fly-by-wire (FBW), provide closed loop 
command to move servo-actuators for the elevators, ailerons, rudder, 
spoilers, horizontal stabilizer, slats and flaps, and engine power 
levers. In the unlikely event of simultaneous failure of all digital 
computers or signaling, a direct control path from the pilot's 
controllers to the surface actuators is provided through simple analog 
circuitry.
    Hydraulic power for the flight control system is provided by three 
independent hydraulic systems. Functions are shared among these systems 
to ensure airplane control in the event of loss of one or two systems. 
The three systems are pressurized by variable displacement pumps. The 
left and right hydraulic systems each have one pump driven by the 
engine accessory gearboxes. In addition, the left and right systems 
each have one electrically driven demand pump. The center system can be 
pressurized by two electrically driven hydraulic pumps. This system 
also has two air driven demand pumps, which use air from the airplane 
pneumatic system. A ram air turbine (RAT) is also available to provide 
hydraulic power for the primary flight controls served by the center 
system.
    Normal electrical power is supplied by two integrated drive 
generators, one on each engine. An electrical generator powered by an 
auxiliary power unit (APU) is also available. Backup electrical power 
is available to selected airplane alternating current (AC) busses from 
two variable speed, constant frequency generators, one of which is 
mounted on each engine. The main direct current (DC) system can also 
receive power from the backup generators. Primary power for the FBW 
system is provided by dedicated permanent magnet generators in each of 
the two backup generator units. The FBW system can alternately receive 
power from the main DC system or the standby DC system. The standby DC 
system is powered by a RAT-driven AC generator, which can provide a 
source of standby electrical power that is not time limited. The RAT is 
deployed automatically upon loss of all normal and backup AC power 
sources. A manual deploy feature is available to the flightcrew should 
the RAT fail to deploy automatically.
    The engine control system consists of dual channel, full authority, 
digital engine controls (FADEC) mounted on the fan case of each engine. 
The (FADEC's are interfaced with the various airplane systems to 
provide redundant control of the engines through a ``hard-wired'' 
throttle angle resolver system. In addition, the throttles move in 
proportion to commanded changes in engine power, and in the event of a 
total failure of the engine indicating and crew alerting system 
(EICAS), analog rotor speeds are available to determine engine power 
levels. Each FADEC provides gas generator control, engine limit 
protection, power management, input to the thrust reverser system, and 
engine parameter inputs for the flight deck displays.
    Control inputs are made through conventional flight deck control 
wheels, columns, and rudder pedals. The flight instruments are 
displayed on six liquid crystal flat panel displays. Two flat panel 
displays are mounted directly in front of both the pilot and copilot 
and display primary flight instruments and navigational information. 
The other two flat panel displays are located in the center of the 
instrument panel and display engine parameters, warnings, and system 
diagnostics.
    The type design of the Model 777 contains novel or unusual design 
features not envisioned by the applicable part 25 airworthiness 
standards, including extended range operation with two-engine airplanes 
and therefore special conditions are considered necessary.

Discussion

    All two-engine airplanes operating under part 121 of the FAR are 
required to comply with Sec. 121.161, which states, in pertinent part, 
that ``Unless authorized by the Administrator * * * no certificate 
holder may operate two-engine or three-engine airplanes * * * over a 
route that contains a point farther than one hour flying time * * * 
from an adequate airport.'' Advisory Circular (AC) 120-42A, Extended 
Range Operation With Two-Engine Airplanes (ETOPS), provides an 
acceptable means for obtaining FAA approval for two-engine airplanes to 
operate over a route that contains a point farther than one hour flying 
time from an adequate airport. The two basic objectives of this 
Advisory Circular are to establish that the airplane and its supporting 
systems are suitable for the extended range mission and that the 
maintenance and procedures to be employed in conducting ETOPS 
operations are adequate. This is accomplished by acquiring a 
substantial amount of service experience during non-ETOPS operation and 
then extensively evaluating this experience in the areas of systems 
reliability, maintenance tasks, and operating procedures. When it is 
determined that the appropriate reliabilities and capabilities have 
been achieved, the airplane is found eligible to be considered for use 
in ETOPS operation by an airline.
    Boeing has proposed that the Model 777 be approved for ETOPS 
operation simultaneously with the issuance of the basic type 
certificate. Procedures do not exist at this time for a finding of this 
type. Because the timing of the proposed ETOPS type design approval for 
the Model 777 airplane precludes use of the guidance given in AC 120-
42A regarding the accumulation of service experience, an alternative 
method must be devised that will provide an adequate level of inherent 
airplane reliability for the ETOPS mission under consideration for 
approval. It is important to note that the requirements for 
certification of the airplane regarding the design's suitability for 
ETOPS operation, as described in these special conditions, relate to 
type certification approval only. Advisory Circular 120-42A contains 
guidance regarding operational and maintenance practices criteria that 
must be met by the operator before ETOPS operations can be conducted. 
It is incumbent upon the operator to apply for operational approval in 
accordance with the guidance contained in AC 120-42A. Satisfaction of 
the requirements of these special conditions does not constitute 
operational approval.
    Existing practices to achieve airplane certification safety 
objectives have involved definition of performance requirements, 
incorporation of safety margins, and prediction of failure 
probabilities through analysis and test. However, historical evidence, 
in general, indicates that a period of actual revenue service 
experience is necessary to identify and resolve problems not observed 
during the normal certification process. Successful achievement of this 
experience has been a prerequisite for granting ETOPS type design 
approval for a specific airplane engine combination. However, several 
recent airplane engine combinations incorporating new or substantially 
modified propulsion systems have demonstrated a high level of 
reliability consistent with ETOPS operation upon entry into revenue 
service. In addition, this high level of reliability was demonstrated 
by the small number of problems encountered during basic certification 
activity. These recent successful airplane and engine development and 
certification programs led the FAA to consider it feasible that the 
proposed development and certification activities of the Model 777 
engine and airplane have the potential of providing a relatively 
``mature'' product at the time of entry into revenue service. 
Certification criteria for early ETOPS type design approval of the 
Model 777 airplane is largely dependent upon a process that requires 
demonstration of appropriate levels of reliability. This process is 
designed to result in a level of airplane reliability that is 
equivalent to the level of reliability previously found to be 
acceptable based upon service experience. Since the early ETOPS 
development process must have a means of measuring success, the 
certification requirements in these special conditions focus on 
defining a measurement process, as well as providing a feedback loop to 
quickly resolve problems that may occur.
    Existing ETOPS airplane/engine assessments conducted in accordance 
with AC 120-42A focus on two main objectives: (1) preclude any failure 
or malfunction that could result in diversion from intended flight; and 
(2) protect the safety of the airplane and occupants during the 
diversion. A diversion is precluded by ensuring high reliability of the 
propulsion system and of all other systems important to ETOPS, and 
resolution of all problems that compromise the safety of ETOPS flight. 
Safety during the diversion is protected by high reliability of the 
propulsion system and of those systems important to the diversion, and 
resolution of all problems that compromise the safety of the diversion. 
The early ETOPS approval criteria maintain this two-fold safety 
concept.
    The major elements of the early ETOPS type design approval process 
defined in these special conditions include an ETOPS type design 
assessment, additional analysis requirements, additional test 
requirements, including 1000 flights on a complete airplane that 
simulate actual airline operations, a problem tracking system, and a 
reliability assessment that will be carried out by an FAA Reliability 
Assessment Board. The Reliability Assessment Board will consist of 
members from a broad spectrum of FAA offices, including FAA airplane 
and engine certification offices, FAA aircraft evaluation groups for 
both the engines and airplane, FAA maintenance and operational approval 
offices, and FAA headquarters. The Reliability Assessment Board will 
have a function similar to that currently carried out by the Propulsion 
System Reliability Assessment Board, as defined in AC 120-42A, except 
that the Reliability Assessment Board will have the responsibility to 
review all of the relevant airplane systems in addition to the 
propulsion system.
    Design requirements and relevant service experience assessments are 
required as part of the ETOPS type design assessment in order to define 
appropriate design, test, analysis, or other manufacturing, 
maintenance, or operational features necessary to comply with the 
applicable airworthiness requirements, as well as to achieve the two-
fold ETOPS objectives (i.e., preclude and protect the diversion).
    These special conditions require the frequency and type of failures 
or malfunctions that occur during the airplane flight test program, and 
the additional 1000-flight ETOPS test, to be consistent with the 
frequency and type of failures or malfunctions that might occur on 
certified 180-minute ETOPS airplanes. The ETOPS Reliability Assessment 
Board will be responsible for evaluating these problems and their 
solutions, and ultimately formulating a recommendation to the Manager, 
Transport Airplane Directorate, regarding the adequacy of the 777 type 
design for 180-minute ETOPS operation.
    This determination will be based on a review of the circumstances 
surrounding each failure or malfunction, the effectiveness of the 
proposed corrective action, and the potential consequences of the event 
on the continued safe operation of the airplane. In addition, 
corrective actions must be identified and implemented prior to ETOPS 
approval for all problems identified during the test program that could 
affect the safety of ETOPS operations. These corrective actions must be 
substantiated to be effective in eliminating both the specific problem 
and any similar problems elsewhere in the design. These criteria will 
continue to apply a ``fix all problems'' approach that is also the 
basis for all ETOPS approvals made under AC 120-42A. In the event that 
a problem is discovered after entry into passenger service that could 
compromise the safety of the ETOPS mission, the FAA will, at its 
option, use the Airworthiness Directive (AD) process, as provided by 
part 39 of the FAR, to require corrective action.
    Since the granting of a finding of ETOPS suitability concurrently 
with the issuance of the airplane type certificate is not envisioned by 
part 25 of the FAR, and since there is no appropriate guidance material 
available for this project, the FAA has determined that this method of 
finding ETOPS suitability is a ``novel and unusual'' feature within the 
meaning of Sec. 21.16, and that therefore special conditions are 
required.

Discussion of Comments

    Notice of Proposed Special Conditions No. SC-93-3-NM for extended 
range operation of the Boeing Model 777 series airplanes was published 
in the Federal Register on May 5, 1993 (58 FR 26710).
    Seven commenters responded to the proposed special conditions. Some 
of the comments were of an editorial or clarifying nature and have been 
incorporated where appropriate. A discussion of the remainder of the 
comments follows.

General Comments

    Two commenters are opposed to granting 180-minute ETOPS approval at 
type certification without some kind of in-service experience.
    The first commenter does not recommend any specific service 
experience requirement. This commenter does, however, recognize that 
the special conditions require some in-service experience to be 
simulated prior to certification. This commenter's ``bottom line'' is 
that this ``equivalent in-service experience'' must be a suitable 
substitute for ``actual'' in-service experience. The second commenter 
opposed to 180-minute ETOPS approval at type certification states that 
120-minute ETOPS approval could be granted if all aspects of the 
special conditions approval plan have been completed. This commenter 
suggests that 180-minute ETOPS approval should be granted only after 
the accumulation of 20,000 engine hours for derivative technology 
powerplants, and 50,000 engine hours for new technology powerplants. It 
appears that the commenter's rationale for this position results from 
trying to balance the benefits of the lessons learned analyses, test 
programs, and problem detection and resolution programs with the 
limitations of those programs.
    The FAA disagrees with the two commenters' position that some in-
service experience should be required for 180-minute ETOPS approval at 
type certification. These special conditions consist of five main 
elements that provide adequate compensation for the service experience 
requirements previously used to establish 180-minute ETOPS eligibility. 
No single element is sufficient by itself, but together, the five 
elements provide an acceptable substitute for actual airline service 
experience. Any limitations of specific special condition elements were 
taken into account in the development of these special conditions. A 
general description of the five elements follows:
    First Element: Design for Reliability. Paragraph (c)(1) requires 
that the propulsion system be designed to preclude failures and 
malfunctions that could result in an engine inflight shutdown. 
Propulsion systems on previous airplanes were designed and certified to 
be ``fail-safe,'' in compliance with Sec. 25.901 of part 25; in other 
words, any single failure, or probable combination of failures, would 
not jeopardize continued safe flight and landing of the airplane. 
Because safe flight following an engine shutdown is required by part 
25, preventing engine inflight shutdowns has not been a major design 
objective on previous airplane designs. The additional design 
requirement in these special conditions to preclude failures and 
malfunctions that could result in an engine inflight shutdown has an 
enormous effect on propulsion system reliability in that normal design 
decisions must now consider whether a failure or malfunction might 
result in an engine inflight shutdown.
    Second Element: Lessons Learned. Paragraph (c)(2) requires the 
airplane to be designed to prevent problems that have resulted in 
inflight shutdowns or diversions on previous airplanes (lessons 
learned). This process focuses on eliminating specific known failure 
causes from the new airplane design to allow some margin for unforeseen 
failure causes without having a detrimental effect on overall airplane 
and propulsion system reliability.
    Third Element: Test Requirements. Testing required by paragraph 
(c)(4) must prove the effectiveness of design features incorporated 
into the new airplane to prevent problems that have resulted in 
inflight shutdowns or diversion on previous airplanes. This validates 
that the specific lessons learned fixes work. The extensive validation 
testing of the Model 777 required by paragraph (e) of these special 
conditions, including the 3000-cycle engine test and 1000-cycle 
airplane test, is designed to discover basic design flaws to a much 
greater extent than has ever been undertaken in any previous airplane 
development program. This includes testing to substantiate the 
suitability of any technology new to the applicant. The environmental 
conditions (hot and cold temperatures, high vibration, etc.) to which 
the engines and airplane will be exposed during this testing will allow 
the FAA the opportunity to observe the integrity of the airplane design 
under conditions that have taken a fleet of airplanes years to 
accumulate. Ninety-nine percent of problems resulting in inflight 
shutdowns have occurred within 3,000 cycles on airplanes that have been 
evaluated under the provisions of AC 120-42A. Based on this, the FAA 
has determined that, after completing the airplane and engine testing 
defined in these special conditions, sufficient experience will have 
been gained to reveal virtually all potential causes of inflight 
shutdowns.
    Fourth Element: Demonstrated Reliability. Paragraph (h)(1) requires 
that, for the engine and airplane systems, the number and types of 
failures that occur during the airplane flight test program and the 
1000 flight cycle ETOPS test must be consistent with the number and 
types of failures or malfunctions that would be expected to occur on 
presently certified 180-minute ETOPS airplanes. This requirement gives 
the FAA assurance that the overall design maturity is at a level 
expected of current in-service ETOPS airplanes.
    Fifth Element: Problem Tracking System. Paragraph (f) requires that 
problems that could impact the safety of ETOPS operations occurring 
during airplane development and certification testing must have proven 
fixes incorporated into the design before the airplane may be approved 
for ETOPS operations. All such problems occurring after the airplane 
begins ETOPS operations must be promptly reported in order that the FAA 
may require appropriate corrective actions. This requirement ensures 
that the risk of additional occurrences of any unforeseen failures that 
could affect the safety of ETOPS operations is low.
    The second commenter opposed to 180-minute ETOPS approval without 
some in-service experience also states that any deficiency in 
compliance with the approval plan should result in some lesser level of 
approval from that sought. This position is consistent with these 
special conditions. Paragraph (h)(2) specifies that if the corrective 
action for unplanned engine shutdown or loss of thrust, or any problem 
that jeopardizes the safety of an airplane diversion, occurring during 
airplane flight testing, requires a major system redesign, this would 
be cause for delayed ETOPS type design approval, or approval for 
reduced single engine diversion time.
    The same commenter also suggests changes to several paragraphs of 
these special conditions. The FAA has reviewed these suggested changes 
and considers that they are equivalent to the FAA wording and do not 
clarify the requirements. Therefore, they have not been adopted.
    A third commenter does not directly oppose the concept of ETOPS 
approval at the time of airplane type certification, but suggests that 
the special conditions should depart from the existing AC 120-42A 
policy only where warranted by the experience of previous ETOPS 
programs. Starting with this premise, the commenter then identifies 
specific problem areas with the proposed special conditions.
    First, the commenter questions the FAA's assessment that several 
airplane engine combinations incorporating new or substantially 
modified propulsion systems have demonstrated a high level of 
reliability consistent with ETOPS operation upon entry into revenue 
service. The commenter states that there is no single example of a 
completely new product (airplane and engine) that achieved stable 
reliability consistent with 180-minute ETOPS at entry into service, and 
that only those products with a high level of similarity to previous 
designs actually achieved this level of reliability.
    The FAA disagrees with this commenter's distinction between ``new'' 
and ``derivative'' engines. There has been much discussion within the 
industry about gaining some service experience credit for derivative 
engines versus totally new designs in the application of the service 
experience criteria of AC 120-42A. However, the industry has never been 
able to agree on a standard by which to differentiate between 
derivative and new engine designs. In a sense, every engine to be 
developed since the first turbine engines were introduced are 
derivatives of previous designs. Each new engine type has benefited 
from the engine manufacturer's experiences with earlier models. 
Successful design features are kept and improved upon while 
unsuccessful ones are taken out of new designs. As a result, the FAA is 
not depending on whether the engines are, or are not, derivative in 
applying the requirements of these special conditions. The requirements 
apply equally in either case.
    The FAA's assessment was based on a review of new propulsion system 
installations since the beginning of ETOPS operations in 1985. As an 
example, the only completely new two-engine airplane now in ETOPS 
service to be certified since ETOPS operations began is the Airbus 
A320. A review of the propulsion system reliability of the CFM56-5 
series engine installation on the A320, as measured by a 13-month 
rolling average of the inflight shutdown (IFSD) rate, indicates an IFSD 
rate of 0.14/1000 engine hours four months after airplane entry into 
service. The IFSD rate, 0.02 for 180-minute ETOPS operations as defined 
in AC 120-42A, is not achieved until 16 months after entry into 
service.
    At first glance, it appears that the A320 airplane did not exhibit 
an acceptable ETOPS propulsion system reliability until a substantial 
amount of service experience had been accumulated. A closer look at the 
data, however, reveals that there were only two inflight shutdowns in 
the first two years of revenue service. By the time the first inflight 
shutdown dropped out of the 12-month rolling average IFSD rate, the 
accumulation of engine fleet operating hours had reduced the rate to 
below the 0.02 standard for 180-minute ETOPS operation. The rate has 
been stable below that mark ever since. This clearly indicates that the 
A320 airplane with CFM56-5 engines achieved the high standard of 
propulsion system reliability at the time of type certification that 
led the FAA to consider defining a process that would have demonstrated 
the attributes of a relatively mature product at the time of entry into 
revenue service. The A-320 airplane achieved this high level of 
reliability even without the five-element certification program to 
ensure reliability that is required by these special conditions.
    The same commenter also questions the FAA's statement in the 
proposed special conditions that a high standard of propulsion system 
reliability on several recently certified airplane engine combinations 
was evidenced during basic certification by a small number of problems 
encountered. The commenter states that there is no clear relationship 
between the number of problems that may be encountered during 
certification tests and the reliability level for ETOPS in such areas 
as engine IFSD rates, electronic generator failure rates, and failure 
rates of other ETOPS significant systems and components. The commenter 
goes on to state that the reliability levels required for ETOPS are too 
high for direct statistical demonstration during a test program with a 
sufficient level of confidence.
    The FAA agrees with this commenter's assessment of the statistical 
confidence achieved by certification testing alone. The FAA did not 
intend to imply that a small number of problems occurring during type 
certification in any way demonstrates a statistically significant 
sample from which to base a failure rate calculation with a high degree 
of confidence. The correlation referred to by the FAA is that, relative 
to other airplane programs, the occurrence of a higher number of basic 
design problems during type certification testing generally has 
resulted in a higher number of problems occurring after the airplane 
entered service. Those airplanes with the best propulsion system 
reliability after entry into service have also, in general, encountered 
fewer design problems during the type certification program.
    Even without the statistical confidence the commenter is referring 
to, experience has also shown that, in general, predictions of mature 
component reliability made in analyses for showing compliance with the 
safety assessment requirements Sec. 25.1309 of the FAR have been 
conservative when compared with the actual achieved reliability in 
service. In most cases, the types of problems that prevent a system or 
component from achieving the predicated, mature level of reliability 
have been basic design or manufacturing deficiencies that could have 
been detected if extensive enough testing had been accomplished during 
development and certification prior to entry into service. Random type 
failures have not been a major contributor to unreliability. Therefore, 
the FAA is confident that a design will achieve a high level of 
reliability based on development and certification test results, 
provided the testing is thorough in evaluating all potential failure 
sources. The special conditions' relevant experience, analysis, and 
test requirements define the methods that must be used to accomplish a 
thorough evaluation of failure sources.
    The same commenter states that the quantitative objectives for 
engine inflight shutdown rate from AC 120-42A do not appear in the 
special conditions. The commenter recommends that these objectives be 
retained and compliance shown using a rational method that provides a 
sufficient level of confidence.
    As stated above, the FAA does not consider the testing to be 
accomplished during the certification program to provide a 
statistically significant sample from which to calculate a failure rate 
with a high degree of confidence. Based on this assessment, a rational 
method for calculating an inflight shutdown rate that provides a 
sufficient level of confidence does not appear to be achievable. As 
discussed above, experience has shown that failure rate calculations 
can provide misleading information when used for testing and as a 
performance indicator of a limited number of units. As designed, the 
special conditions provide for assessment of demonstrated reliability 
in conjunction with oversight of corrective action, as well as overall 
performance, to make the eligibility assessment. This more 
comprehensive approach is more meaningful as an overall safety 
assessment process and permits the applicant to correct any 
discrepancy, rather than just delay the program. Therefore, the FAA did 
not include a quantitative inflight shutdown rate requirement in the 
special conditions. Specific evaluation of each problem and 
corresponding corrective action by the Reliability Assessment Board 
will provide confidence that appropriate corrective action is taken for 
each problem uncovered during testing.
    Another commenter is concerned that a significant increase in drag 
would occur during a single engine diversion with a failed engine that 
has a locked rotor compared to a windmilling engine, due to a further 
reduction of mass flow through the inlet. This commenter suggests that 
ETOPS operational stability and control and extended range performance 
be based on wind tunnel test data, obtained at high Reynolds number, 
over the complete engine-inoperative flight envelope, with locked 
engine rotor airflow accurately represented.
    The FAA considered the effects of a locked engine rotor on a single 
engine diversion during the development of the existing approval 
criteria defined in Advisory Circular 120-42A. The AC lists several 
factors that must be considered when planning how much fuel is required 
to dispatch an airplane for ETOPS operations. These include current 
forecast winds and meteorological conditions along the expected flight 
path, operation of ice protection systems and performance loss due to 
ice accretion on the unprotected surfaces of the airplane, operation of 
auxiliary power units, loss of airplane pressurization, an approach 
followed by a missed approach and subsequent approach and landing, 
navigational accuracy, and air traffic control constraints. Additional 
contingency fuel reserves are added to account for errors in wind 
forecasts, and deterioration of cruise fuel mileage from that provided 
the performance planning data. The FAA considered the addition of a 
``locked rotor'' condition to be overly conservative and that any 
increase in drag would be adequately covered by existing fuel reserve 
requirements for ETOPS operations. Any effect that a locked engine 
rotor may have on airplane stability and control is a basic airplane 
airworthiness issue, and is covered as part of the basic 777 airplane 
certification program. Therefore, the FAA has concluded that a locked 
engine rotor is being adequately addressed without the need to change 
the ETOPS special conditions.
    One commenter states that the special conditions do not address the 
conditions for approval of future design variants (e.g., higher thrust 
ratings or major engineering design changes that result in new engine 
model designations). This commenter expects the requirements to be 
different for later design changes in terms of test and assessment 
methods. While the FAA agrees that the test and assessment methods will 
be different for later design changes, the FAA does not agree that it 
is necessary to define specific requirements for future design 
variants. These special conditions address the initial certification of 
an airplane for ETOPS operations without the prerequisite service 
experience defined in Advisory Circular 120-42A. Upon issuance, these 
special conditions become a part of the airplane type certification 
basis for ETOPS type design approval. Future changes in design must 
meet the applicable requirements of these special conditions. However, 
the scope of specific test conditions and assessment methods used for 
particular design changes may differ from the initial ETOPS assessment 
program. This would depend on the degree of commonality with the 
existing approved design and how much credit for service experience the 
new design may be given. The methods to be used to show compliance with 
the special conditions requirements will be approved as part of the 
certification process. This process will be similar to what is 
currently done for existing approved ETOPS airplanes to determine if 
service experience is necessary before a design change becomes eligible 
for ETOPS operations.
    This same commenter is concerned about the process to control and 
administer the airplane configuration, maintenance, and operational 
procedures pertinent to the ETOPS approval. This commenter is concerned 
about a statement at the end of the discussion section of the notice 
that appears to imply that the ETOPS configuration, maintenance, and 
procedures (CMP) document revision process is replaced by the 
airworthiness directive (AD) process. The FAA does not agree. The CMP 
document is a product of the ETOPS approval process defined in AC 120-
42A. It defines the airplane configuration and any maintenance or 
operational procedures, beyond the baseline airplane definition, that 
are necessary to safely operate an airplane in an ETOPS operation. The 
need for the CMP document originated when airplanes approved under the 
AC guidance were not originally certified in consideration of the ETOPS 
mission. With a new airplane designed and certified in accordance with 
these special conditions, it is expected that a CMP document would 
contain very few items, since it is the intent of the manufacturer to 
build only ETOPS eligible airplanes. However, it is possible that the 
Reliability Assessment Board may require interim problem corrective 
actions to be incorporated as a condition for ETOPS approval, until 
final corrective actions become available several months after the 
airplane enters service. These conditional configuration requirements 
would need to be defined in a CMP document. In response to problems 
occurring after the airplane enters service, additional items may be 
added to the CMP in order to define an airplane configuration that may 
be used by 777 ETOPS operators to maintain acceptable system 
reliability in accordance with the existing CMP revision process 
identified in paragraphs 8g and 8h of AC 120-42A. The CMP document does 
not replace the AD process referred to by the commenter. Any problems 
occurring in service that would significantly affect the safety of an 
ETOPS operation will result in an AD being issued. The AD may reference 
a CMP document revision that defines the required configuration, but it 
does not have to.

Engine Assessment

    One commenter recommends that the procedures for an engine 
condition monitoring program, required by paragraph (b)(2), should 
consider 200 minutes operation at maximum continuous thrust, followed 
by 5 minutes at inflight takeoff or go-around thrust. The commenter's 
rationale for this recommendation is that guidance for the maximum 
thrust required for a single engine diversion should be specified and 
that a realistic diversion thrust requirement should be padded by 20 
minutes above the specified maximum diversion time. The FAA does not 
agree. Traditional engine condition monitoring programs are designed to 
determine if maximum takeoff thrust can be achieved. The intent of the 
validated condition monitoring program required by paragraph (b)(2) is 
to provide a means to determine when an engine is no longer capable of 
achieving maximum continuous thrust within approved engine limits. The 
duration that the thrust would be available is not a consideration in 
this requirement, only that adequate thrust would be available. Based 
on current experience with engine deterioration rates, the engine 
certification requirements contained in part 33 of the FAR demonstrate 
that maximum continuous thrust will be available for any conceivable 
diversion time. It is not intended that the condition monitoring 
program identified in paragraph (b)(2) be able to predict impending 
failure conditions. Therefore, paragraph (b)(2) is adopted as proposed.

Design Requirements Assessment

    One commenter states that paragraph (c)(1) of the special 
conditions only refers to the design requirements of part 25 and ``does 
not call up the design requirements in AC 120-42A, paragraphs 8b(7), 
(8), (9), (10), and (11).'' The FAA infers from this comment that the 
commenter desires that the AC paragraphs noted above be incorporated in 
the special conditions. The FAA agrees that the AC criteria are 
important; however, the advisory circular provides policy guidance for 
obtaining ETOPS approval for already certified two-engine airplanes. 
The design criteria referred to by the commenter were developed to 
allow approval of airplanes for which ETOPS types of operations were 
not considered when they were originally certified to part 25 
airworthiness standards. With one exception, existing part 25 
airworthiness standards are sufficient to properly certify a new two-
engine airplane for ETOPS operation, as long as the ETOPS mission is 
considered in applying these requirements for all anticipated dispatch 
configurations. The purpose for the design requirements assessment of 
paragraph (c)(1) of these special conditions is to define the specific 
methods that will be used to show compliance with the part 25 
airworthiness requirements when considering the ETOPS mission. These 
methods may include additional design features, analyses, tests, or a 
combination of the three. Depending on the system design, the specific 
design criteria called out in AC 120-42A may not be necessary or 
appropriate on a new airplane design.
    The one exception to the airworthiness standards contained in part 
25 that is necessary in order to certify an ETOPS suitable airplane is 
a requirement to design the airplane to preclude failures or 
malfunctions that could result in an engine inflight shutdown. Existing 
propulsion system installation requirements are based on the ``fail-
safe'' concept. In other words, continued safe flight and landing are 
assured after any single propulsion system failure. Propulsion system 
reliability is not a major design consideration in existing 
airworthiness standards because failures must be shown to be ``safe.'' 
ETOPS criteria are intended not only to ensure continued safe operation 
after an engine inflight shutdown, but also to prevent the failure 
condition that resulted in the shutdown. This additional requirement to 
prevent engine inflight shutdowns was included in paragraph (c)(1) of 
these special conditions. Based on these considerations, the special 
conditions are adopted as proposed.
    The commenter also refers to several new design features that were 
considered during the development of the early ETOPS special condition, 
and questions why they were not included in the final proposal. 
Examples given include a 22,000 foot single engine cruise altitude, and 
a specific list of electrical services to be powered in the backup 
electrical configuration. As stated above, the FAA has determined that 
the existing airworthiness standards defined in part 25 are sufficient 
to properly certify a new two-engine airplane for ETOPS operation, as 
long as the ETOPS operational mission is considered in finding 
compliance. The FAA has also determined that including specific design 
requirements such as the two examples cited above may be too 
restrictive in defining what the applicant could do to comply with the 
safety objectives of part 25. This might result in a design requirement 
being imposed that is inappropriate because of a change in the airplane 
design that was not considered in the development of that requirement. 
However, as part of the requirements assessment, paragraph (c)(3) of 
the special conditions requires the applicant to consider the types of 
design features that the commenter is referring to, and to list those 
specific design features that are included in the airplane design to 
accommodate the ETOPS mission. The FAA therefore does not consider it 
necessary to revise the special conditions.
    Another commenter states that the design feature consideration for 
fuel quantity indication to the flight crew in paragraph (c)(3)(i)(C) 
should include alerts for abnormal fuel management or transfer between 
tanks in addition to the other listed considerations. The FAA agrees 
with this comment and has revised paragraph (c)(3)(i)(C) accordingly.

Relevant Experience Assessment

    One commenter recommends that paragraph (c)(2) clearly indicate 
that the relevant experience assessment shall include a demonstration 
of the applicability of the past experience to the new design, at the 
appropriate system, sub-system, or component level. The commenter 
suggests that this demonstration may be based on an engineering 
comparison at the appropriate level, but shall also be backed by 
comparison testing where the design differences are significant. The 
commenter supports this comment with the statement that there is 
substantial evidence that beyond a certain level of difference between 
the product that produced the past experience and the new product, the 
``lessons learned'' assessment process ceases to be fully effective.
    The FAA agrees that beyond a certain level of commonality, past 
experience may not be relevant to the new design. This is particularly 
true where a specific design feature that contributed to problems in 
previous airplanes is not a part of the new airplane design. However, 
the FAA does not concur that a change in the special conditions is 
necessary to achieve the results desired by the commenter. The 
demonstration of the applicability of past experience to the new design 
is inherent in the relevant experience assessment. Paragraph (c)(2) of 
the special conditions requires that corrective actions taken to 
preclude similar problems from occurring on the new airplane must be 
identified. Removal from the design of a system, sub-system, or 
component that has had problems in the past may be an acceptable 
corrective action, as long as it precludes similar problems from 
occurring. In addition, paragraph (c)(4) requires the applicant to 
define specific new or enhanced tests that will be used to assure 
engine and airplane system design integrity. In complying with this 
requirement, the tests derived from the relevant experience assessment 
will be used to substantiate that effective corrective action has been 
taken for each source of past problems.
    This commenter also states that where new technology is introduced, 
the lessons learned assessment becomes impractical, as there is no 
previous experience with this technology. While the FAA agrees that 
there will be no previous experience with a new technology, there may 
still be applicable relevant experience. For example, an applicant's 
previous experience with new technology introductions may lead to 
changes in manufacturing and quality control processes. Further, 
lessons learned of general applicability can be introduced into the new 
technology design, such as a general design practice to prevent cross-
connector installation. The FAA has determined that the existing 
special conditions requirements meet the intent of the commenter's 
recommendation; therefore, the commenter's specific recommended change 
has not been adopted.
    The same commenter also states that the special conditions should 
clearly indicate how much direct service experience shall be required 
in the case of a completely new design utilizing technology new to the 
manufacturer, for which no basis of relevant experience exists. The FAA 
does not concur. As stated above, there may be applicable relevant 
experience even for a completely new design incorporating new 
technology. In addition, relevant experience is only one aspect of 
these special conditions. It is not the only mechanism by which the 
airplane would be assessed for ETOPS approval. Among the other 
requirements, paragraph (e)(4) requires the applicant to conduct tests 
to substantiate the suitability of new technology. The commenter's 
recommended change therefore has not been adopted.

Additional ETOPS Test Requirements

    One commenter recommends that the configuration requirements of 
paragraph (e)(1) also apply to the testing defined in paragraph (c)(4). 
The commenter's rationale for this recommendation is that the merits of 
incorporating sufficient component interfacing to simulate actual 
airplane installation interactions should justify expanding this 
requirement to other critical ETOPS systems not specifically enumerated 
in paragraph (e). The FAA appreciates the concerns expressed by the 
commenter, but does not agree that this recommendation is practicable. 
The scope of the testing covered under paragraph (c)(4) is such that 
many of the new or enhanced tests may be done with prototype hardware 
at the bench or component level early in the development program when 
sufficient interfacing system hardware is not available. In accordance 
with paragraph (c)(4), the applicant must define each test that will be 
used to assure design integrity. The enhanced testing defined by this 
paragraph will include the configuration proposed for certification and 
sufficient interfacing system hardware and software to simulate the 
actual airplane installation when it is necessary to accomplish this 
goal. As for other critical ETOPS systems not specifically identified 
in paragraph (e), the 3000-cycle engine and auxiliary power unit tests 
and 1000-cycle airplane test will provide an adequate opportunity to 
discover design problems with these systems.

1000-Cycle Airplane Test

    One commenter questions the requirement to install either the 3000-
cycle test engine or another high-cycle engine for part of the 1000-
flight-cycle airplane test by stating that the rationale for the 
requirement is unclear. This commenter considers that a complete strip 
and inspection of the high-cycle engines to identify incipient problems 
is a more effective way of establishing early ETOPS suitability, than 
by inclusion in the flight program. This commenter goes on to say that 
history has shown that new problems are more likely to be exhibited by 
lower life engines rather than by mature engines, and the relevance of 
potentially non-representative high life failures is not immediately 
obvious.
    The FAA does not concur with the commenter's assessment that any 
failures on the 3000-cycle engine during the 1000-cycle airplane test 
would be a non-representative high life failure. The 3000-cycle engine 
is representative of a high-time engine that would exist if the AC 120-
42A criteria for operating experience for 180-minute ETOPS approval 
were considered. The 3000-cycle ground test will not subject the engine 
and engine-mounted airplane equipment to representative altitude 
conditions that the FAA is concerned may impact overall reliability. 
The reason for including the 3000-cycle test engine and its associated 
propulsion system equipment, or another suitable high-cycle engine and 
propulsion system, on the 1000-cycle airplane test vehicle is to expose 
an ``aged'' engine to altitude effects not possible to achieve on a 
ground test stand. Flight time with this aged engine will give the FAA 
additional confidence that the results achieved during the ground 
cyclic testing are representative of the actual airplane environment 
that is used to assess propulsion system reliability for ETOPS type 
design approval using the AC 120-42A criteria.
    This same commenter expresses concern that a complete teardown and 
inspection of the high time engine will not be possible if it is 
installed on the 1000-cycle test airplane. The FAA does not agree. A 
complete teardown and inspection is planned for every engine and all 
the engine-mounted airplane equipment subjected to the 3000-cycle test. 
A teardown inspection is required in order for the Reliability 
Assessment Board to assess the design suitability for ETOPS approval in 
accordance with paragraph (g) of these special conditions. It was this 
concern for obtaining meaningful teardown results from the 3000-cycle 
test engine that prompted the FAA to allow another suitable high-cycle 
engine to be installed on the 1000-cycle test airplane. In addition, an 
airworthiness inspection will be performed on the high-time engine 
prior to its installation on the airplane in order to ensure that the 
engine complies with the maintenance manual acceptance limits for 
continued operational service. Any problems found during the 
airworthiness inspection will be reported in accordance with the 
problem tracking system requirements, and necessary repairs will be 
made prior to the engine's installation on the 1000-cycle test 
airplane.
    One commenter recommends that ``actual airline operation,'' as used 
in paragraph (e)(7), ``be defined such that five percent of the 1000 
flight cycles should be at altitudes and of duration typical of actual 
ETOPS operations to ensure no adverse impact on any aircraft systems 
and engines due to extended cold soaking, etc.'' The FAA agrees with 
the commenter's assessment of the need for high altitude, long duration 
flight cycles. However, the FAA does not concur with the commenter's 
suggested change. The mix of flight cycles to be flown during the 1000 
cycle test is based on an assessment of flight operating conditions 
that have led to the types of problems that have occurred in service on 
those airplane engine combinations that currently have 180-minute ETOPS 
approval. The number of high altitude, long duration flight cycles that 
will be flown for each of the engine types to be certified on the 777 
airplane is a result of this assessment combined with additional flight 
cycles that are necessary to validate airline operational readiness. 
The FAA considers that the change proposed by the commenter would 
unduly restrict the FAA in requiring development of an appropriate test 
plan for the 1000 cycle test.
    Another commenter recommends that the ``1000 cycle test should be 
done using published maintenance manual criteria in lieu of unique 
engineering allowances.'' The FAA concurs with this comment. It has 
always been the FAA's intent that the 1000-cycle airplane would be 
operated and maintained using the recommended operations and 
maintenance manual procedures. This is to validate that operating and 
maintenance procedures to be used during airline operations are correct 
and will not lead to errors that may result in engine inflight 
shutdowns or airplane diversions. Paragraph (e)(7) has been amended to 
make this clarification. In addition, the paragraph has been 
reorganized to more clearly state the requirements.

Problem Tracking System

    One commenter recommends that any problem reported under the 
problem tracking system must be under control within a maximum of 30 
days. The FAA does not concur that the addition of a time limit is 
necessary or appropriate. The proposed special conditions did not 
specify a particular time interval by which all problems must be 
``under control.'' The intent of the problem tracking system is to 
provide a means by which the FAA will be promptly notified of problems 
occurring on the design so that the FAA Reliability Assessment Board 
can ensure that appropriate timely resolutions are implemented. 
Depending on the severity of the problem, a more immediate response 
than 30 days may be appropriate. For less severe problems, a slower 
response may be allowable. In each case, the FAA Reliability Assessment 
Board will determine the appropriate time interval for resolution of 
all ETOPS significant problems identified by the problem tracking 
system. Defining a specific time interval for problem resolution is too 
restrictive and, therefore, the FAA has not adopted the commenter's 
proposal in the final special conditions.

Reliability Assessment Board

    One commenter is concerned that the proposed FAA Reliability 
Assessment Board (RAB) might be over-represented by FAA engine 
specialists. Specifically, the commenter would like the special 
conditions to include references to systems, avionics, and flight 
control representatives, as well as field inspectors, to help ensure a 
balanced board makeup. The FAA does not concur that identifying 
specific system specialists is appropriate. The purpose of the RAB is 
to address the suitability of the entire airplane for ETOPS and not 
just the propulsion system, as was the case with the Propulsion System 
Reliability Assessment Board defined in AC 120-42A. As stated in the 
preamble to the notice of these special conditions, the board will 
consist of members from a broad spectrum of offices, including FAA 
airplane and engine certification offices, FAA aircraft evaluation 
groups for both the engines and airplane, FAA maintenance and 
operational approval offices, and FAA headquarters. In addition to the 
Seattle Aircraft Certification Office (Seattle ACO), the following 
offices have been requested to support the RAB:

Los Angeles Aircraft Certification Office
Engine Certification Office
Flight Standards Air Transportation Division
Flight Standards Aircraft Maintenance Division
Flight Standards Technical Programs Division
Seattle Aircraft Evaluation Group
Boston Aircraft Evaluation Group
United Airlines FAA Certificate Management Office
    (Pratt & Whitney engine installation only)

    These special conditions define specific findings that the RAB must 
make in order to determine that the 777 airplane is suitable for 180-
minute ETOPS operations. It is implicit in each of these findings that 
FAA technical specialists be involved in the decision process. This is 
in keeping with existing type certification practice. Therefore, naming 
specific system specialties for RAB membership is not necessary.

Reliability Demonstration Acceptance Criteria

    One commenter states that proposed paragraph (h)(1) implies a 
direct relationship between the type and frequency of engine and 
systems events occurring during the test program and the demonstrated 
reliability of existing approved 180-minute ETOPS airplanes. This 
commenter goes on to state that this paragraph could be interpreted as 
a statement that a sample of 1000 flights is enough to produce a 
statistical demonstration of reliability, and recommends adding wording 
to the effect that ``flight test and laboratory test * * * are not used 
to produce directly a measure of the reliability.'' The FAA infers from 
this statement that the commenter does not consider the reliability 
demonstration acceptance criteria of paragraph (h)(1) to provide a 
statistically meaningful assessment of airplane reliability.
    While the FAA agrees that the airplane flight test program and the 
1000-flight-cycle ETOPS test referred to in paragraph (h)(1) will not 
form a statistically significant sample from which to produce a direct 
measurement of reliability, a statistical calculation of reliability is 
not the intent of the requirement. As stated earlier, the occurrence of 
a relatively high number of basic design problems during type 
certification testing generally has resulted in a higher number of 
problems occurring after the airplane enters service. Those airplanes 
with the best propulsion system reliability after entry into service 
have also, in general, encountered relatively few design problems 
during the type certification program. Paragraph (h)(1), then, provides 
a measurement of design maturity based on the experience from past 
certification programs. The standard used to judge this maturity is the 
type and frequency of failures occurring on already certified 180-
minute ETOPS airplanes. This is not to say that it is necessary to do a 
direct comparison of failure rates system by system. In gross terms, 
the FAA is expecting the 777 flight test airplanes to experience the 
same kinds of problems at about the same frequency that are occurring 
on ETOPS airplanes in revenue service. These special conditions define 
the standard by which the suitability of the 777 airplane will be 
assessed for ETOPS approval. The FAA does not consider it necessary to 
state that the testing does not produce a direct measure of 
reliability.

Demonstration of Compliance

    One commenter recommends adding a new paragraph (i)(8) that would 
read as follows: ``The accelerated engine cyclic endurance test program 
of paragraph (f)(5) must be in place.'' The commenter's rationale for 
this recommendation is that is it necessary to require timely program 
startup and to ensure that the test engine cycles remain well ahead of 
high-cycle revenue fleet engines. The FAA agrees with this comment and 
has added a new paragraph (i)(7) to the special conditions. Previously 
designated paragraph (i)(7) has been redesignated as paragraph (i)(8).

Miscellaneous Comments

    One commenter notes that in the second sentence of paragraph (e)(6) 
the word ``administration'' appears to be a typographical error that 
should read ``demonstration.'' The commenter is correct and the final 
special conditions are corrected as noted.
    Some comments were received concerning compliance methods, although 
these commenters did not recommend any changes to the special condition 
requirements. These special conditions address the regulatory standards 
to be applied in obtaining Early ETOPS approval. The means by which 
compliance is demonstrated is not specifically addressed in this 
action. The specific methods that Boeing will use to demonstrate 
compliance with these special conditions will be approved as part of 
the normal certification process. This will be accomplished by FAA 
approval of the ETOPS type design assessment plan, required by 
paragraph (a) of these special conditions.
    One comment concerns the process for an airline to receive early 
ETOPS operational approval. Operational approval is not addressed by 
these special conditions. As stated earlier, Advisory Circular 120-42A 
contains guidance regarding operational and maintenance practices 
criteria that must be met by the operator before ETOPS operations can 
be conducted. Satisfaction of the requirements of these special 
conditions does not constitute operational approval.
    With the exception of the revisions noted above, the special 
conditions for extended range operation of the Boeing Model 777 
airplane are adopted as proposed.

Conclusion

    This action affects only certain unusual or novel design features 
on one model series of airplanes. It is not a rule of general 
applicability and affects only the manufacturer who applied to the FAA 
for approval of these features on the airplane.

List of Subjects in 14 CFR Part 25

    Aircraft, Aviation Safety, Federal Aviation Administration, 
Reporting and recordkeeping requirements.

    The authority citation for these special conditions is as follows:

    Authority: 49 U.S.C. app. 1344, 1348(c), 1352, 1354(a), 1355, 
1421 through 1431, 1502, 1651(b)(2); 42 U.S.C. 1857f-10, 4321 et 
seq.; E.O. 11514; and 49 U.S.C. 106(g).

The Special Conditions

    Accordingly, the following special conditions are issued as part of 
the type certification basis for the Boeing Model 777 airplane:
    In addition to the airworthiness requirements of part 25 of the 
Federal Aviation Regulations (FAR), the Model 777 airplane must 
comply with the following requirements in order to be eligible for 
Extended Range Operation with Two-Engine Airplanes (ETOPS) without 
the requisite operating experience specified in Advisory Circular 
(AC) 120-42A:
    (a) Introduction. An approved ETOPS Type Design Assessment Plan 
covering the engine and each applicable airplane system must be 
established. The specific methods that will be used to substantiate 
compliance with the requirements of these special conditions must be 
defined in the plan. Specific systems that will undergo the complete 
analysis, testing, and development program tracking defined in 
paragraph (c) of these special conditions must be identified. Other 
airplane systems that may contribute to the overall safety of an 
ETOPS operation, but that do not warrant the rigorous type design 
requirements and relevant experience assessments defined in 
paragraph (c) of these special conditions, must be identified and 
agreed to by the FAA. Compliance must be shown for these other 
systems with all provisions of these special conditions, except 
paragraph (c). In showing compliance with these special conditions, 
tests and analyses conducted to substantiate compliance with the 
basic airworthiness standards of part 25 may be referenced, if 
applicable.
    (b) Engine Assessment. 
    (1) The ETOPS eligibility of the engine must be determined 
specifically for the airplane installation for which early ETOPS 
type design approval is requested.
    (2) Procedures for an engine condition monitoring program must 
be defined and validated at the time of ETOPS type design approval. 
The engine condition monitoring program must be able to predict when 
an engine is no longer capable of providing, within certified engine 
operating limits, the maximum thrust required for a single engine 
diversion.
    (c)  ETOPS Type Design Assessment.
    (1) Design requirements Assessment. Part 25 of the FAR, 
including applicable amendments, defines most of the requirements 
necessary to design an airplane that is suitable for ETOPS 
operation, as long as the ETOPS mission is considered in applying 
these requirements for all anticipated dispatch configurations. In 
addition to these requirements, the propulsion system must be 
designed to preclude failures or malfunctions that could result in 
an engine inflight shutdown. The applicant must identify and list 
methods of compliance for each of the applicable ETOPS requirements, 
including those specific part 25 requirements for which methods of 
compliance relative to the ETOPS mission are different from those 
traditionally used for two-engine airplanes. Paragraph (c)(3) of 
these special conditions lists certain design feature categories 
that may be affected by a consideration of the ETOPS mission in the 
design of these systems. The effects of the applicable ETOPS 
requirements on the design of any of those design feature categories 
listed in paragraph (c)(3) must be specifically addressed by this 
assessment.
    (2) Relevant Experience Assessment. For each system covered by 
the ETOPS Type Design Assessment, there must be an assessment of the 
relevant design, manufacturing, and operational problems experienced 
on previous airplanes built by the applicant. The assessment must 
include the applicable relevant service experience of vendor 
supplied systems or, to the extent possible, the service experience 
of components on aircraft built by other manufacturers. Specific 
corrective actions taken to preclude similar problems from occurring 
on the new airplane must be identified.
    (3) Design Features. 
    (i) The applicant must define any design features implemented to 
comply with the design requirements listed in paragraph (c)(1). 
Consideration of the following design feature categories must be 
specifically addressed:
    (A) Airplane capabilities and capacities of the ETOPS mission;
    (B) Fuel system integrity, including consideration of 
uncontained main engine rotor burst and fuel availability as 
affected by cross-feed capability and electrical power to pumps and 
other components;
    (C) Fuel quantity indication to the flightcrew, including alerts 
that consider the fuel required to complete the mission, abnormal 
fuel management or transfer between tanks, and possible fuel leaks 
between the tanks and the main engines;
    (D) Communication systems for the ETOPS environment;
    (E) Navigation systems for the ETOPS environment;
    (F) Minimum single engine cruise altitude capability; and
    (G) Failure tolerant designs of cockpit indicating systems or 
avionics systems to prevent unnecessary airplane diversions.
    (ii) The applicant must define the specific design features used 
to address problems identified in the relevant service experience 
assessment of paragraph (c)(2).
    (4) Test Features. The applicant must define specific new tests, 
or enhanced tests, that will be used to assure engine and airplane 
system design integrity. These test features may be derived from the 
requirements assessment of paragraph (c)(1) and the relevant service 
experience assessment of paragraph (c)(2).
    (5) Analysis Features. The applicant must define specific new 
analyses, or enhanced analyses, that will be used to assure engine 
and airplane system design integrity. These analysis features may be 
derived from the requirements assessment of paragraph (c)(1) and the 
relevant service experience assessment of paragraph (c)(2).
    (6) Manufacturing, Maintenance, or Operational (Other) Features. 
The applicant must define specific new, or enhanced, manufacturing 
processes or procedures, and maintenance or operational procedures 
that are being implemented to assure engine and airplane system 
integrity. These ``other'' features may be derived from the 
requirements assessment of paragraph (c)(1) of this section and the 
relevant service experience assessment of paragraph (c)(2).
    (d) Additional EOPS Analysis Requirements.
    (1) Performance and Failure Analyses. Engine and airplane 
performance and failure analyses required for certification must be 
expanded to consider ETOPS mission requirements, including exposure 
times associated with a 180-minute single-engine diversion and a 
subsequent 15-minute hold in the terminal airspace at the diversion 
airport. Consideration must be given to crew workload and 
operational implications of continued operation with failure effects 
for an extended period of time. The rationale and all assumptions 
used in the analyses must be documented, justified, and validated, 
including maintenance interval and maintainability assumptions.
    (2) Maintenance and Flight Operations Evaluation. The Type 
Design Assessment Plan must contain a program to systematically 
detect and correct problems occurring as a result of improper 
execution of maintenance or flight operations. Corrective actions 
for any problems found must be identified and implemented through 
the Problem Tracking and Resolution System required by paragraph 
(f).
    (3) Manufacturing Variability. The Type Design Assessment Plan 
must contain a program to minimize potential manufacturing problems. 
The plan should address early validation of tooling and procedures, 
as well as any related problems, as identified in paragraph (c)(2). 
Corrective actions for problems that impact the safe operation of 
the airplane must be identified and implemented through the problem 
tracking and resolution system required by paragraph (f).
    (e) Additional ETOPS Test Requirements. As part of, or in 
addition to, the testing identified in paragraph (c)(4), the 
following specific test requirements apply:
    (1) Configuration Requirements. All testing defined in paragraph 
(e) must be conducted with the configuration proposed for 
certification, and must include sufficient interfacing system 
hardware and software to simulate the actual airplane installation.
    (2) Completion of Applicable Failure Analyses. Failure analyses 
required for ETOPS type design approval must be submitted to the FAA 
prior to the start of the testing defined in paragraph (e).
    (3) Vibration Testing. Vibration testing must be conducted on 
the complete installed engine configuration to demonstrate that no 
damaging resonances exist within the operating envelope of the 
engine that could lead to component, part, or fluid line failures. 
The complete installed engine configuration includes the engine, 
nacelle, engine mounted components, and engine mounting structure up 
the strut to wing interface.
    (4) New Technology Demonstration Testing. Testing must be 
conducted to substantiate the suitability of any technology new to 
the applicant, including substantially new manufacturing techniques.
    (5) Auxiliary Power Unit Demonstration Test. If requesting 
credit for APU backup electrical power generation, one auxiliary 
power unit (APU), of the type to be certificated with the airplane, 
must complete 3000 equivalent airplane operational cycles.
    (6) Engine Demonstration Test. One engine of each type to be 
certificated with the airplane must complete 3000 equivalent 
airplane operational cycles. The engine must be configured with a 
complete airplane nacelle package for this demonstration, including 
engine-mounted equipment.
    (7) Airplane Demonstration Test. For each engine type to be 
certificated with the airplane, one complete airplane must complete 
at least 1000 flight-cycles simulating an actual airline operation.
    (i) The airplane must be exposed to representative environmental 
variations within the normal expected airplane operational envelope 
during the 1000 cycles.
    (ii) The 3000-cycle test engine and propulsion system specified 
in paragraph (e)(6) above, or another suitable high-cycle test 
engine and propulsion system acceptable to the Administrator, must 
be installed on the airplane for a minimum of 500 cycles during this 
demonstration.
    (iii) The 1000-cycle test airplane must be operated and 
maintained using the recommended operations and maintenance manual 
procedures.
    (f) Problem Tracking System. An FAA-approved problem tracking 
system must be established to address problems encountered on the 
engine and airplane systems that could affect the safety of ETOPS 
operations.
    (1) The system must contain a means for the prompt 
identification of those problems that could impact the safety of 
ETOPS operations in order that they may be resolved in a timely 
manner.
    (2) The system must contain the process for the timely 
notification to the responsible FAA office of all relevant problems 
encountered, and corrective actions deemed necessary, in a manner 
that allows for appropriate FAA review of all planned corrective 
actions.
    (3) The system must be in effect during the phases of airplane 
development that will be used to assess early ETOPS eligibility, and 
for at least the first 250,000 engine-hours of fleet operating 
experience after the airplane enters revenue service. For the 
revenue service period, this system must define the sources and 
content of in-service data that will be made available to the 
manufacturers in support of the problem tracking system. The content 
of the data provided must include, as a minimum, the data necessary 
to evaluate the specific cause of all service incidents reportable 
under Sec. 21.3(c) of part 21, in addition to any other failure or 
malfunction that could prevent safe flight and landing of the 
airplane, or affect the ability of the crew to cope with adverse 
operating conditions.
    (4) Corrective actions for all problems discovered during the 
development and certification test program that could affect the 
safety of ETOPS operations, or the intended function of systems 
whose use is relied upon to accomplish the ETOPS mission, must be 
identified and implemented in accordance with paragraph (g)(2). If, 
during the certification program, it is discovered that a fault has 
developed that requires significant rework of manufacturing, 
maintenance, and/or operational procedures, the FAA will review the 
ETOPS suitability of the affected system and interfacing hardware 
and identify any additional actions to be accomplished to 
substantiate the corrective actions.
    (5) For each engine type to be certificated with the airplane, 
the system must include provisions for an accelerated engine cyclic 
endurance test program that will accumulate cycles on one 
representative production-equivalent propulsion system in advance of 
the high-cycle revenue fleet engine. This test program will assist 
the applicant and the FAA in identifying and correcting problems 
before they occur in revenue service. This program must be in place 
for, at a minimum, the first 250,000 engine-hours of fleet operating 
experience after the airplane enters revenue service. The 
representative production-equivalent propulsion system may, at the 
manufacturer's discretion, be used for other fleet support 
activities.
    (g) Reliability Assessment Board.
    (1) An FAA Reliability Assessment Board will be formed to 
evaluate the suitability of the airplane for ETOPS approval and make 
a recommendation to the Manager, Transport Airplane Directorate, 
regarding the adequacy of the type design for 180-minute ETOPS 
operation. The purpose of this board will be:
    (i) To periodically review the development and certification 
flight test program accomplishments from both type design and 
operational perspectives;
    (ii) To ensure that all specific problems, as well as their 
implications on the effectiveness of the Early ETOPS process, are 
resolved; and
    (iii) To assess the design suitability for ETOPS. The board will 
consider design, maintenance, manufacturing, and operational aspects 
of the type design when finding suitability for ETOPS approval.
    (2) The FAA Reliability Assessment Board will review and 
evaluate the data from the problem tracking and resolution system to 
establish compliance with the requirements of paragraph (h). The 
board will evaluate the overall type design for ETOPS suitability as 
demonstrated in flight test, and the 1000-cycle ETOPS test, 
considering all resolutions of problems. The following suitability 
criteria will be applied:
    (i) Sources of engine shutdown/thrust loss, engine anomalies, or 
airplane system problems that have a potential significant adverse 
effect on in-service safety will be resolved.
    (ii) Resolutions are identified for all items in paragraph (i) 
with analysis and/or testing to show all resolutions are effective. 
These resolutions may be accomplished through one or more of the 
following categories:

Design change
Operating procedure revision
Maintenance procedure revision
Manufacturing change

    (iii) The resolutions of paragraphs (i) and (ii) will be 
incorporated prior to entry into service.
    (iv) The engine shutdown history of the test program indicates 
that the engine reliability of the configuration is suitable for the 
ETOPS approval being considered.
    (v) Where interim resolutions having operational impact are 
defined, the cumulative effect must be determined to be acceptable.
    (vi) System or component failures experienced during the program 
are consistent with the assumptions made in the failure analyses.
    (h) Reliability Demonstration Acceptance Criteria. 
    (1) For the engine and airplane systems, the type and frequency 
of failures that occur during the airplane flight test program and 
the 1000-flight-cycle ETOPS test must be consistent with the type 
and frequency of failures or malfunctions that would be expected to 
occur on presently certified 180-minute ETOPS airplanes. The 
failures to be considered are those associated with system 
components that conform to the type design requested for 
certification. The Reliability Assessment Board will determine 
compliance with this requirement based on an evaluation of the 
problem reporting system data, considering system redundancies, 
failure significance, problem resolution, and engineering judgment.
    (2) Corrective action for any of the following classes of 
problems occurring during the testing identified in paragraph (h)(1) 
that requires a major system redesign would delay ETOPS type design 
approval, or result in approval of a reduced single-engine diversion 
time, unless corrective action has been substantiated to, and 
accepted by, the FAA Reliability Assessment Board:
    (i) Any source of unplanned inflight shutdown or loss of thrust.
    (ii) Any problem that jeopardizes the safety of an airplane 
diversion.
    (3) The FAA Reliability Assessment Board must determine that the 
suitability criteria of paragraph (g)(2) have been met.
    (i) Demonstration of Compliance. In order to be eligible for 
180-minute ETOPS type design approval, the following conditions 
apply:
    (1) The engine assessment has been completed and eligibility for 
ETOPS operation has been approved by the FAA Engine Certification 
Office.
    (2) All design, manufacturing, maintenance, operational, and 
other features necessary to meet the ETOPS requirements of paragraph 
(c)(1), and to resolve the problems identified in paragraph (c)(2), 
have been successfully implemented.
    (3) The identified test and analysis features in paragraph 
(c)(4) and (c)(5) have been shown to be effective in validating the 
successful implementation of the features in paragraph (i)(2).
    (4) The additional analysis requirements of paragraph (d) have 
been completed and the results have been approved.
    (5) The additional test requirements of paragraph (e) have been 
successfully completed.
    (6) All significant problems identified in accordance with 
paragraph (f) have been resolved, and fixes substantiated to be 
effective have been implemented.
    (7) The accelerated engine cyclic endurance test program of 
paragraph (f)(5) must be in place.
    (8) Compliance with the reliability demonstration acceptance 
criteria of paragraph (h) has been found by the Reliability 
Assessment Board.

    Issued in Renton, Washington, on May 18, 1994.
Ronald T. Wojnar,
Manager, Transport Airplane Directorate, Aircraft Certification 
Service.
[FR Doc. 94-13072 Filed 5-31-94; 8:45 am]
BILLING CODE 4910-13-M