[Federal Register Volume 68, Number 114 (Friday, June 13, 2003)]
[Proposed Rules]
[Pages 35335-35345]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-14992]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. NM81; Notice No. 25-03-04-SC]
Special Conditions: Boeing Model 777 Series Airplanes; Revision
to Special Conditions 25-ANM-84
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Notice of proposed special conditions.
-----------------------------------------------------------------------
SUMMARY: This action proposes to revise Special Conditions 25-ANM-84,
applicable to Boeing Model 777 series airplanes. The proposed special
conditions revise the extended range operations with two-engine
airplanes (referred to as ``ETOPS'') test requirements defined in the
existing special conditions. These revisions include changing the
airplane demonstration test requirement from a required 1000 flight
cycles to a demonstration of capability in ETOPS flight conditions, and
allowing more than one airplane to be used for the airplane
demonstration test. In addition, the FAA proposes to add post-test
inspection requirements for both the engine demonstration test and the
airplane demonstration test articles.
DATES: Comments must be received on or before July 28, 2003.
ADDRESSES: Comments on this proposal may be mailed in duplicate to:
Federal Aviation Administration, Transport Airplane Directorate,
Attention: Rules Docket (ANM-113), Docket No. NM81, 1601 Lind Avenue,
SW., Renton, Washington, 98055-4056; or delivered in duplicate to the
Transport Airplane Directorate at the above address. Comments must be
marked: Docket No. NM81. Comments may be inspected in the Rules Docket
weekdays, except Federal holidays, between 7:30 a.m. and 4 p.m.
FOR FURTHER INFORMATION CONTACT: Steve Clark, FAA, ETOPS Project
Manager, Seattle Aircraft Certification Office, Propulsion Branch, ANM-
140S, Transport Airplane Directorate, 1601 Lind Avenue, SW., Renton,
Washington, 98055-4056; telephone (425) 917-6496; facsimile (425) 227-
1180.
SUPPLEMENTARY INFORMATION:
Comments Invited
The FAA invites interested persons to participate in this
rulemaking by submitting written comments, data, or views. The most
helpful comments reference a specific portion of the special
conditions, explain the reason for any recommended change, and include
supporting data. We ask that you send us two copies of written
comments.
We will file in the docket all comments we receive, as well as a
report summarizing each substantive public contact with FAA personnel
concerning these special conditions. The docket is available for public
inspection before and after the comment closing date. If you wish to
review the docket in person, go to the address in the ADDRESSES section
of this preamble between 7:30 a.m. and 4 p.m., Monday through Friday,
except Federal holidays.
We will consider all comments we receive on or before the closing
date for comments. We will consider comments filed late if it is
possible to do so without incurring expense or delay. We may change
these special conditions in light of the comments we receive.
If you want the FAA to acknowledge receipt of your comments on this
proposal, include with your comments a pre-addressed, stamped postcard
on which the docket number appears. We will stamp the date on the
postcard and mail it back to you.
Background
Because of concerns over engine and airplane reliability, for many
years, 14 CFR 121.161 has generally prohibited operations of two-engine
airplanes on routes including segments that are more than one hour
flight time from a suitable airport. This regulation contains an
exception that allows such operations when specifically authorized by
the Administrator. These extended range operations with two-engine
airplanes are referred to as ETOPS. Advisory Circular (AC) 120-42A
describes a method for obtaining ETOPS authorization if an operator can
demonstrate sufficient engine and airplane reliability. This method is
based on a combination of various design features and operational and
maintenance procedures. The AC states that eligibility for 120-minute
ETOPS authorization is normally based on a showing of reliable
operation for a minimum of 250,000 engine hours of service in the world
fleet. Eligibility for 180-minute ETOPS authorization is normally based
on a showing of reliable operation for at least one year in 120-minute
ETOPS. The AC also describes an option for reducing the number of hours
of service if adequate compensating factors are identified to give a
reasonably equivalent database.
On May 18, 1994, the FAA issued Special Conditions Number 25-ANM-84
for the Boeing Model 777 airplane (59 FR 28234). These special
conditions define requirements for 180-minute ETOPS approval concurrent
with basic type certification of the airplane without the service
experience outlined in AC 120-42A that would normally be necessary.
These special conditions define additional safety standards that the
FAA considered necessary to establish a level of safety equivalent to
that provided by the airworthiness standards for non-ETOPS airplanes.
The current 777 ETOPS special conditions consist of five main
elements needed to provide adequate compensation for the service
experience normally required for 180-minute ETOPS eligibility described
in AC 120-42A. No single element is considered sufficient by itself,
but the FAA has found that the five elements combined provide an
acceptable substitute for actual airline service experience. The five
elements are:
1. Design for reliability.
2. Lessons learned.
3. Test requirements.
4. Demonstrated reliability.
5. Problem tracking system.
A description of each of these five elements is contained in the
preamble to the 777 ETOPS special conditions.
On December 13, 1999, Boeing Commercial Airplane Group applied for
an amendment to Type Certificate No. T00001SE to include the new Model
No. 777-200LR and 777-300ER airplanes. The Model No. 777-200LR, which
is a derivative version of the existing Model 777-200 series airplanes,
has the following differences from the 777-200:
[sbull] The wingspan is increased from 199 feet, 11 inches to 212
feet, 7 inches.
[sbull] Maximum intended takeoff weight is 750,000 pounds.
[sbull] It is capable of carrying from 301 to 440 passengers.
[sbull] It has provisions for overhead crew and attendant rest
areas.
[sbull] Its range capability will be up to 8,800 nautical miles
(16,298 kilometers).
[sbull] It has 110,100 pounds thrust GE90 engines.
[sbull] It has a supplemental electronic tail skid.
[sbull] It has provisions for up to 3 auxiliary fuel tanks in the
forward area of the aft cargo bay.
[[Page 35336]]
The 777-300ER, which is a derivative of the Model 777-300
airplanes, has the following differences from the Model 777-300:
[sbull] The wingspan is increased from 199 feet, 11 inches to 212
feet, 7 inches.
[sbull] Maximum intended takeoff weight is 750,000 pounds.
[sbull] It is capable of carrying from 359 to 550 passengers.
[sbull] It has provisions for overhead crew and attendant rest
areas.
[sbull] Its range capability will be up to 7,250 nautical miles
(13,427 kilometers).
[sbull] It has 115,300 pound thrust GE90 engines.
[sbull] It has a supplemental electronic tail skid.
[sbull] It has a semi-levered main landing gear.
Both models are currently approved under Type Certificate No. T00001SE.
For the Model 777-300ER and Model 777-200LR, Boeing has proposed
certain changes to the ETOPS special conditions in order to take into
account the experience from the original baseline Model 777 engine
programs and to eliminate any unnecessary burden from the airplane
demonstration testing required by paragraph (e)(7) of those special
conditions.
Type Certification Basis
Under the provisions of Sec. 21.101, Amendment 21-69, effective
September 16, 1991, for a change to a type certificate Boeing must show
that the Boeing Model 777 series airplane, as changed, continues to
meet the applicable provisions of the regulations incorporated by
reference in Type Certificate No. T00001SE or the applicable
regulations in effect on the date of application for the change. The
regulations incorporated by reference in the type certificate are
commonly referred to as the ``original type certification basis.'' The
regulations incorporated by reference in Type Certificate No. T00001SE
for the Boeing Model 777 series airplanes include 14 CFR part 25, as
amended by Amendments 25-1 through 25-82. The original type
certification basis is listed in Type Certificate Data Sheet No.
T00001SE.
If the Administrator finds that the applicable airworthiness
regulations (i.e., 14 CFR part 25) do not contain adequate or
appropriate safety standards for the Model 777 series airplanes because
of a novel or unusual design feature, special conditions are prescribed
under the provisions of Sec. 21.16.
In addition to the applicable airworthiness regulations and special
conditions, Boeing Model 777 series airplanes must comply with the fuel
vent and exhaust emission requirements of 14 CFR part 34 and the noise
certification requirements of 14 CFR part 36.
Special conditions, as defined in Sec. 11.19, are issued in
accordance with Sec. 11.38 and become part of the type certification
basis in accordance with Sec. 21.101(b)(2), Amendment 21-69, effective
September 16, 1991.
Special conditions are initially applicable to the model for which
they are issued. Should the type certificate for that model be amended
later to include any other model that incorporates the same novel or
unusual design feature, or should any other model already included on
the same type certificate be modified to incorporate the same novel or
unusual design feature, the special conditions would also apply to the
other model under the provisions of Sec. 21.101(a)(1).
ETOPS Certification
All two-engine airplanes operating under 14 CFR part 121 are
required to comply with Sec. 121.161, which states, in pertinent part,
that ``Unless authorized by the Administrator * * * no certificate
holder may operate two-engine airplanes * * * over a route that
contains a point farther than one hour flying time * * * from an
adequate airport.'' Advisory Circular (AC) 120-42A, ``Extended Range
Operation With Two-Engine Airplanes (ETOPS),'' provides an acceptable
means for obtaining FAA approval for two-engine airplanes to operate
over a route that contains a point farther than one hour flying time
from an adequate airport. The two basic objectives of this advisory
circular are to establish that the airplane and its supporting systems
are suitable for the extended range mission and that the maintenance
and procedures to be employed in conducting ETOPS operations are
adequate. This is accomplished by acquiring a substantial amount of
service experience during non-ETOPS operation and then extensively
evaluating this experience in the areas of systems reliability,
maintenance tasks, and operating procedures. When it is determined that
the appropriate reliabilities and capabilities have been achieved, the
airplane is found eligible to be considered for use in ETOPS operation
by an airline.
When Boeing was developing the Model 777 series airplane, it
proposed that the Model 777 be approved for ETOPS operation
simultaneously with the issuance of the basic type certificate. At that
time procedures did not exist for a finding of this type. The proposed
issuance of ETOPS type design approval at certification would have
precluded using accumulation of service experience, as outlined in AC
120-42A, as a means to meet ETOPS approval requirements. So an
alternative method was devised that provided an adequate level of
inherent airplane reliability for ETOPS. It is important to note that
the requirements for certification of the airplane regarding the
design's suitability for ETOPS operation, as described in those special
conditions, relate to type certification approval only. Advisory
Circular 120-42A contains guidance regarding operational and
maintenance practices criteria that must be met by the operator before
ETOPS operations can be conducted. It is incumbent upon the operator to
apply for operational approval in accordance with appropriate guidance
issued by the FAA for such approvals. Satisfaction of the requirements
of these special conditions does not constitute operational approval.
Special Conditions 25-ANM-84 contained the additional safety
standards that the Administrator considered necessary to establish a
level of safety equivalent to that provided by the airworthiness
standards for transport category airplanes for non-ETOPS airplanes.
Experience with these special conditions since issuance has provided
the FAA with additional data to justify a revision to those special
conditions as described in this notice.
Discussion of the Proposed Special Conditions
Boeing has requested the FAA to revise certain parts of the test
requirements of Special Conditions 25-ANM-84 defined in paragraph (e).
The FAA has concurred that some changes are justified based on an
analysis of previous experience applying those special conditions to
the original three engine types approved for installation on the Model
777 airplane. The specific changes to those requirements and the
justification for each proposed change are discussed below.
Paragraph (e)(6) Engine Demonstration Test
The FAA has concluded from a review of in-service experience of the
Model 777 series airplanes that the 3000-cycle engine and propulsion
system test required by paragraph (e)(6) of Special Conditions 25-ANM-
84 provides an adequate opportunity to discover cyclic-related failure
modes associated with the design, provided that an adequate post-test
evaluation is conducted to find conditions that could result in an
inflight shutdown, power
[[Page 35337]]
loss, or inability to control engine thrust. An FAA review of the test
data from the 3000-cycle tests for the three original engine types
installed on the Model 777 series airplanes has shown that most of the
early in-service 777 engine failure modes could have been discovered
had Boeing and the engine manufacturers conducted a more thorough
teardown inspection and analysis of the 3000-cycle test engine and
propulsion system hardware. Part conditions noted in the teardown
inspection reports for the three baseline 777 engine types did later
occur in service, and they resulted in engine inflight shutdowns or
airplane diversions. Because the specific condition of those 3000-cycle
test parts had been characterized as minor deviations from normal
however, no specific investigations into how they might progress in
service had been required as a prerequisite for ETOPS approval.
Special Conditions 25-ANM-84 currently do not require a post-test
teardown inspection. However, all three engine companies, in
cooperation with Boeing, conducted post-test teardown inspections on
the original baseline engines installed on the Model 777 series
airplanes based on their own experience of what would constitute an
adequate evaluation. In order to provide a consistent standard for a
post-test evaluation of the 3000-cycle test hardware, the FAA is
proposing a change to paragraph (e)(6) to require a complete teardown
inspection of the engine and airplane nacelle test hardware after
completion of the test. The inspection must include an analysis of any
abnormal conditions found. The analysis must consider the possible
consequences of similar occurrences in service to determine if they
might become sources of engine inflight shutdowns, power loss, or
inability to control engine thrust. The intent of this change to
paragraph (e)(6) is to require further design analysis to catch
potential sources of engine inflight shutdowns or diversions.
For similar reasons, we are proposing to add a new subparagraph
(e)(7)(v) to require a post-test external and internal visual
inspection of the airplane demonstration test engines and propulsion
system hardware. An analysis of the inspection results must identify
any potential sources of engine inflight shutdown. Appropriate
corrective actions must be performed in accordance with the provisions
of the special conditions.
Boeing proposed to delete the word complete from the description of
the airplane nacelle package required for the 3000-cycle test. The
rationale for this proposed change was that without the term complete,
it is still understood that the test is intended to be a propulsion
system test inclusive of the engine buildup items, but some allowance
is made for configuration differences necessary to accommodate the test
setup. The FAA is concerned that, without this qualifier, it is not
clear what nacelle hardware must be installed for this test. It could
be misinterpreted in such a way that, for instance, a functioning
thrust reverser need not be installed. Therefore, the FAA has concluded
that the word complete must remain in the requirement. However, we
agree with Boeing that those configuration differences associated with
test instrumentation and test stand interfaces with the engine nacelle
package may be excluded, and we propose to add that qualification to
the requirement in order to clarify this intent.
Paragraph (e)(7) Airplane Demonstration Test
Number of Test Airplanes: Boeing has proposed a change to paragraph
(e)(7) to allow the use of more than one airplane to comply with the
airplane demonstration test requirement (three test airplanes for the
current Model 777-300ER program). Boeing's justification includes the
argument that using multiple airplanes is an enhancement to the ETOPS
validation program that takes into account airplane-to-airplane
variation. The value of obtaining ETOPS data on multiple airplanes
versus one is the increased sample size. The FAA agrees that increasing
the number of test airplanes in the airplane demonstration test would
provide a better evaluation of airplane-to-airplane variability. The
limited experience obtained during the airplane demonstration test
program is not really sufficient to evaluate end-of-life wear-out
failure modes, so accumulating all of the time and cycles on one
airplane is not really necessary. The main program schedule benefit
from using multiple flight test airplanes is that testing can be
completed in a shorter period. The FAA is proposing a change to
paragraph (e)(7) to require that one or more airplanes must complete
the airplane demonstration test required by that paragraph.
Capability Demonstration vs. Reliability Demonstration: The 1000-
cycle airplane demonstration test requirement was developed with the
intent of exposing the airplane to the conditions where the greatest
numbers of inflight shutdowns occur. Most inflight shutdowns occur
during takeoff and climb. The failure modes associated with these
takeoff- and climb-related shutdowns tend to be cyclic in nature for a
couple of reasons.\1\ For failure modes where the risk of failure
increases with engine thrust, the takeoff portion of the flight is most
critical. Failure modes that occur due to improper maintenance or
engine servicing, for instance loss of engine oil due to improper
assembly of an oil tube connection, also tend to occur early in the
flight. A larger number of airplane flights increases the exposure to
these types of failures. Therefore, the FAA considered a cyclic test to
be the most appropriate airplane validation test for the original 777
ETOPS special conditions. However, as stated above, we now consider
that the 3000-cycle engine and propulsion system test required by
paragraph (e)(6) provides an adequate opportunity to discover cyclic-
related failure modes associated with the design when the test hardware
goes through an appropriate level of post-test teardown and inspection.
---------------------------------------------------------------------------
\1\ Data provided to the Aviation Rulemaking Advisory Committee
(ARAC) ETOPS Working Group confirm that the inflight shutdown rate
during the takeoff flight phase is on the order of 6 to 16 times the
fleet average inflight shutdown rate and during the climb phase is
2.5 to 4.5 times the fleet average.
---------------------------------------------------------------------------
For inflight shutdowns where improper maintenance is a main causal
factor, the 1000-cycle airplane demonstration test provides multiple
opportunities for these types of failures to occur. However, the
maintenance procedure validation program required by paragraph (d)(2)
is intended to minimize the probability of these occurrences. The
airplane demonstration test airplane provides opportunities to
demonstrate those maintenance tasks associated with the normal
operation of the airplane. The FAA considers that these demonstrations
can be accomplished in fewer than 1000 cycles.
Although the fewest inflight shutdowns occur during cruise, this is
the phase of flight that is most important to an ETOPS operation.
Traditionally, the FAA and industry have avoided trying to
differentiate between those inflight shutdowns that may occur during
cruise from those that would only occur in a non-ETOPS environment. The
main reason for this approach in existing ETOPS policy is that by
correcting all causes of inflight shutdowns, the overall integrity of
the propulsion system is assured. Since adequate cyclic exposure would
be evaluated by an enhanced 3000-cycle engine demonstration test, as
proposed for paragraph (e)(6) of these special
[[Page 35338]]
conditions, the FAA has concluded that the airplane validation program
should emphasize exposure to the cruise phase of flight. During the
three 1000-cycle tests conducted for the original 777 engine
installation certification programs, only 91 of the total 1000 cycles
were of durations of two hours or more. Since the intent of paragraph
(e)(7) is to simulate an actual airline operation, this would better be
accomplished through longer duration flight cycles. Long duration
flight exposure provides additional confidence in the design against
those cruise-related failure modes that cannot be evaluated in a cyclic
test environment. Such failure modes could include freezing of
entrapped water condensation or binding of propulsion system
components, neither of which would likely occur in a sea level test
facility.
Based on these considerations, the FAA has determined that the
airplane demonstration test requirement should be refocused on those
conditions that are most prevalent in an ETOPS operating environment.
Those conditions include long flights to a variety of airports with
broad variations of airport elevation, temperature, and humidity. It is
also important that these flights expose the airplane to several
enroute climbs, such as may occur with a fully loaded 777-300ER on a
long-range flight, and a number of single engine diversions. As such,
the FAA proposes that the airplane demonstration test requirement of
paragraph (e)(7) be revised to more clearly state the objectives of the
test program. Those objectives include demonstrations that the
aircraft, its components, and equipment are capable of and function
properly during long-range operations and airplane diversions,
including engine-inoperative diversions. This change in focus
constitutes a significant departure from the original purpose of the
1000-cycle airplane demonstration test requirement, as discussed in the
preamble to special conditions 25-ANM-84.
Reliability of 777
In order to further justify this change in philosophy for the
airplane demonstration test requirement from being a demonstration of
``reliability'' to a demonstration of ``capability,'' the FAA reviewed
the original intent of Special Conditions 25-ANM-84, as documented in
the preamble to those special conditions. The purpose of this review
was to assess whether the assumptions we made in justifying the special
conditions are still valid, or whether they should be revised based on
ETOPS certification experience since their issuance in June 1994.
In the preamble to Special Conditions 25-ANM-84, the FAA stated
that: ``existing practices to achieve airplane certification safety
objectives have involved definition of performance requirements,
incorporation of safety margins, and prediction of failure
probabilities through analysis and test. However, historical
evidence, in general, indicates that a period of actual revenue
service experience is necessary to identify and resolve problems not
observed during the normal certification process. Successful
achievement of this experience has been a prerequisite for granting
ETOPS type design approval for a specific airplane engine
combination. However, several recent airplane engine combinations
incorporating new or substantially modified propulsion systems have
demonstrated a high level of reliability consistent with ETOPS
operation upon entry into revenue service. In addition, this high
level of reliability was demonstrated by the small number of
problems encountered during basic certification activity.'' Based on
these successful airplane and engine development and certification
programs, the special conditions were designed to ``result in a
level of airplane reliability that is equivalent to the level of
reliability previously found to be acceptable based upon service
experience.''
The basic premise behind the engine and airplane demonstration
tests required by paragraphs (e)(6) and (e)(7) of the special
conditions was that those tests would provide a final validation of an
``inherent'' level of reliability that was the product of an enhanced
design and test process. This is similar to the purpose of the function
and reliability testing required by Sec. 21.35(b)(2). The FAA's
expectation for these tests was that no significant failures would
occur. The probability of significant design failures occurring on a
one-airplane flight test is so low that if any DO occur, that would be
indicative of a design that is not suitable for ETOPS approval. This
expectation is contained in the ``type and frequency'' requirement of
special conditions paragraph (h)(1). Statistical reliability studies
have shown that a much larger database would be required to validate a
design's true reliability with a significant degree of confidence.
No major engine failures occurred during the 1000-cycle airplane
demonstration tests for any of the three engine types certified on the
Model 777 series airplane, although several engine design problems were
discovered during other certification testing that affected the start
and conduct of those tests. The Reliability Assessment Board (RAB)
evaluated each of these design problems in compliance with paragraph
(g) of the special conditions, and found the 777 to be suitable for
ETOPS type design approval with the incorporation of corrective actions
identified in Appendix 1 of the RAB final recommendation reports for
the three engine types. There were hardware similarities between
engines with the original certified thrust ratings and follow-on
higher-thrust-rated engines, and the FAA certified each of those
follow-on engine derivatives for ETOPS in consideration of those
hardware similarities. The FAA accepted the original baseline engine
test programs as showing compliance to the 3000-cycle propulsion system
ground test and 1000-cycle airplane demonstration test requirements for
the follow-on derivative engines. Although the 3000-cycle and 1000-
cycle tests were not repeated for those follow-on derivative engines,
Boeing and the engine companies completed reduced ground and flight
test demonstrations tailored to the design changes being introduced in
compliance with the ``Test Features'' requirement of special conditions
paragraph (c)(4). Therefore, the follow-on engine derivatives are not
included in this analysis of the 1000-cycle airplane demonstration test
requirement.
The Boeing Model 777-200 series airplane powered by Pratt & Whitney
PW4077 engines was approved for ETOPS on May 30, 1995 and entered
service in June 1995. By all accounts, it was a very successful new
model introduction. This was followed by ETOPS approval of the 777-200
powered by General Electric GE90-77B and Rolls-Royce RB211-Trent 877-17
engines in October 1996. The inflight shutdown (IFSD) rate for all
three engine types was zero for at least the first year in service. The
Pratt & Whitney PW4000 reached a peak 12-month rolling average engine
IFSD rate of .018/1000 hours in October 1996. The General Electric GE90
reached a peak of .021 for one month in July 1998 and the Rolls-Royce
Trent reached a peak of .016 in December 1997. Although the inflight
shutdown rates stayed within the allowable .02/1000 hour standard for
180-minute ETOPS, significant design problems were discovered on each
engine type after ETOPS approval.
During the first two years after ETOPS approval of each engine type
on the Model 777 series airplanes, the FAA was concerned that the
design problems being discovered may have indicated a failure of the
early ETOPS process to identify those failure modes before they
occurred in service. Some failure modes had the potential to result in
inflight shutdowns had they occurred under different circumstances or
had they not been detected during maintenance for
[[Page 35339]]
unassociated reasons. A summary of the actual problem reports for these
inflight shutdowns and other events, which were submitted in compliance
with paragraph (f) of these special conditions, is contained in Table
1. Had every one of those events resulted in an engine inflight
shutdown, the resulting IFSD rates for each engine type would have been
significantly higher. Boeing, the engine manufacturers, the FAA, and
other regulatory authorities worked together to prevent additional
inflight occurrences of these failure types. The actual inflight
shutdown rates prove that these early in-service problems were
successfully managed to maintain the safety of 777 ETOPS operations
worldwide.
Table 1
----------------------------------------------------------------------------------------------------------------
EE-1 Engine type Affected system Event description
----------------------------------------------------------------------------------------------------------------
10/1/1995............ 101 PW................... ENGINE--OIL PUMP........... Airplane diversion due
to low oil quantity.
Engine not shut down,
but oil quantity
indication went to
zero. Related to LP01
problem.
5/19/1996............ 179 PW................... ENGINE..................... Takeoff aborted due to
EGT exceedance. A loose
B-nut was found on the
PS3 line to the 2.95
bleed valve, which
caused erratic
operation.
5/30/1996............ 181 PW................... ENGINE..................... Air turnback due to high
oil consumption. Oil
wetness noted and
corrected from previous
flights. Consumption
continued to be high.
8/24/1996............ 233 PW................... ENGINE..................... IFSD--Inflight shutdown
due to low oil pressure
indication. Plastic
shipping cap was left
in the LPO1 oil line
during installation as
part of fleet upgrade.
10/5/1996............ 254 PW................... ENGINE..................... IFSD--Engine was shut
down due to low oil
quantity and low oil
pressure. Loose main
oil line at filter
housing. Repeat of oil
line shipping cap
problem.
10/11/1996........... 261 PW................... ENGINE..................... Air turnback. Engine
experienced high
vibration during
cruise. Vibration
indication exceeded
EICAS ``Pop-up'' level
at 4.06.
3/26/1997............ 385 PW................... ENGINE..................... Twelve quarts of oil
lost after a series of
training flights due to
a leak of an oil line
to the fuel/oil cooler.
Oil loss took place
over approximately 3
hours of flight time.
2/24/1997............ G-65 GE................... ENGINE GEARBOX............. Air turnback due to loss
of right backup
generator followed by
engine oil filter EICAS
message. Root cause was
a failed gearbox backup
generator pad bearing.
11/4/1997............ G-84 GE................... ENGINE..................... IFSD--Engine experienced
a power loss during
approach. A restart
attempt was
unsuccessful. Root
cause was a sticking
bypass valve in the
hydromechanical unit
(HMU).
11/9/1997............ G-87 GE................... ENGINE..................... Flight crew heard a
surge toward the end of
the takeoff roll and
tower reported seeing
flames from the engine.
At 600 feet, the engine
surged again. The
flight crew reduced
power and returned to
the airport.
3/12/1998............ G-96 GE................... ENGINE..................... Pilot heard a bang and a
tower reported fire
from the tailpipe after
power was set for
takeoff. The takeoff
was aborted. Metal was
found in the tailpipe.
6/22/1998............ G-108 GE................... ENGINE..................... IFSD--After takeoff, the
pilot received low oil
pressure and low oil
quantity indications.
The pilot shut down the
engine. Two of four oil
filter cover bolts were
loose due to inserts
pulling out of the
filter housing casting.
7/1/1998............. G-110 GE................... ENGINE..................... IFSD--Uncommanded engine
inflight shutdown
during cruise at flight
level 370. Flight crew
noted a rapid loss of
oil pressure and N2.
Root cause was a Number
3 bearing failure.
7/22/1998............ G-112 GE................... ENGINE..................... IFSD--During cruise,
EICAS indication of low
oil quantity. Pilot
shut down the engine.
Oil filter housing
cover bolts were over-
torqued resulting in
stripped threads in the
oil filter housing
inserts.
11/20/1998........... G-120 GE................... IDG installation........... IFSD--Crew started
return to departure
airport due to
indication of complete
oil loss. Engine was
subsequently shut down
when oil pressure
dropped to 10 psi. The
integrated drive
generator (IDG) packing
was damaged during
installation.
10/11/1996........... R-63 RR................... ENGINE--RADIAL DRIVE SHROUD Flight diverted after
crew observed right
engine oil quantity
loss approx. 5 hours
into flight. Found
cracked upper radial
drive shroud.
10/11/1996........... R-64 RR................... ENGINE--FUEL NOZZLE........ Fuel found leaking from
Zone 2 during
investigation of R-63
oil loss. Source of
fuel leak was a cracked
weld on the No. 24 fuel
nozzle (top dead
center).
10/25/1996........... R-65 RR................... ENGINE--RADIAL DRIVE SHROUD After engine shutdown at
the gate, the right
engine oil quantity
indicated 9 qts. Upper
radial drive shroud
found cracked.
11/12/1996........... R-67 RR................... ENGINE..................... ``ENGINE OIL PRESS R''
EICAS message displayed
after landing. Engine
shut down. Oil pump
drive shaft found
sheared.
1/26/1997............ R-91 RR................... ENGINE--STEP ASIDE GEARBOX. Low oil quantity caused
by crack in step aside
gearbox housing
approximately 4 to 5
inches long.
5/24/1997............ R-109 RR................... ENGINE..................... Engine was shut down on
takeoff following high
power surge. Subsequent
borescope inspection
revealed HPC rotor 1
blade failure caused by
foreign object damage
that was consistent
with blade damage noted
on 5/20/97 inspection.
7/7/1997............. R-112 RR................... ENGINE..................... Aircraft diversion
caused by excessive oil
leakage due to
incorrectly installed
lower bevel box O-ring
seal following radial
drive shaft
replacement.
7/26/1997............ -- RR................... ENGINE..................... Aircraft diversion due
to high oil
consumption. Not
related to step aside
gearbox housing
cracking problem.
[[Page 35340]]
9/16/1997............ R-113 RR................... ENGINE..................... IFSD--Engine shutdown at
400 feet after takeoff
due to high- pressure
compressor failure.
----------------------------------------------------------------------------------------------------------------
Reliability of 737NG
As part of the process of reviewing existing methods for ETOPS
approval, the FAA also analyzed data from the initial in-service period
for Boeing Models 737-600, 737-700, and 737-800 powered by CFM56-7
engines. As a group, these variants of the 737 were referred to as the
737 Next Generation, or ``737NG.'' Even though early ETOPS special
conditions were not issued, the 737NG was chosen for this analysis
because it followed an ETOPS approval process program that was very
similar to what Boeing is proposing for the 777-300ER. Several months
after entry into service, however, the 737NG did not exhibit an
acceptable level of propulsion system reliability for ETOPS approval.
Early ETOPS special conditions were intended to identify a design not
suitable for ETOPS approval prior to type certification.
Boeing proposed in 1994, prior to the 777's type certification,
that the 737NG be certified as an early ETOPS airplane in a manner
similar to the 777, but without all of the testing required in the 777
special conditions. Since the success of the 777 program was still an
unknown at the time of Boeing's request for the 737NG, the FAA did not
agree to Boeing's proposed changes to the airplane demonstration test
requirement. Early ETOPS special conditions for the 737NG were never
issued. Even so, Boeing proceeded with those elements of the 777
special conditions that the company had proposed to accomplish. These
included the relevant experience assessment, design requirements
assessment, 3000-cycle propulsion system ground test, and enhanced
problem reporting and resolution.
Although the FAA never issued special conditions for the 737NG
program, we agreed that the elements from the 777 special conditions
that Boeing did accomplish justified a reduction in the service
experience normally required for ETOPS type design approval, as
outlined in AC 120-42A. Boeing presented the following information in
support of its request for a reduction in service experience required
for ETOPS certification.
[sbull] ``Design involved lessons learned, similar to 777 Early
ETOPS process.
[sbull] ``APU most thoroughly tested in Allied Signal history--more
than 3000-cycle ground test, including hot/cold exposure.
[sbull] ``Propulsion system subjected to 3000-cycle ground test,
intentionally unbalanced, with three 180-minute diversion cycles.
[sbull] ``Flight testing included a Southwest Airlines 50-cycle
demonstration, using airline crews and maintenance. During the Function
and Reliability testing, 61 ETOPS cycles were conducted with three
single engine 180-minute diversions.
[sbull] ``A proposed ETOPS problem tracking and resolution system,
similar to that used on the 777 that will remain in effect until the
fleet attains 250,000 engine fleet hours.''
In its analysis of the 737NG approval process, the FAA noted that
these program elements, at the time, had been accomplished with good
results. The engines and airplane system had performed well during the
test programs, with results comparable to the 777 test fleet (all
engines). The in-service 737NG airplanes had achieved a 98.96% dispatch
reliability rate after 45 days in service, better than any previous
Boeing airplane. Boeing's proposal included an accumulation of 15,000
fleet engine hours of service experience before requesting ETOPS
approval. At that time, there would be three airplanes with more than
1000 flight cycles, the total 737NG fleet would have accumulated more
than 20,000 flight cycles, and the high-time airplane/engines would
have more than 2000 flight cycles. During the 737 NG approval process,
the FAA concurred with Boeing's proposal to require 15,000 hours of
service experience based on the following:
[sbull] ``The FAA has agreed to the concept that ETOPS at entry
into service can be achieved by appropriate design and testing as
evidenced by the 777 special conditions, which have now been validated
through actual service experience,
[sbull] ``The 737NG/CFM56-7B airframe/engine configuration is a
derivative/evolution of the existing 737-300/400/500 which through
extensive service experience has demonstrated exceptional reliability,
and, is approved for 120-minute ETOPS,
[sbull] ``Except for the lack of a dedicated 1000-cycle ETOPS test
program, design and testing of the 737NG/CFM56-7B mirrors what was done
on the 777 to satisfy Early-ETOPS approval.
[sbull] ``The additional 15,000 engine hour in-service evaluation
plus the fact that three 180-minute single engine diversions were
performed during Function and Reliability testing more than compensates
for the omission of a 1000-cycle test,
[sbull] ``The satisfactory performance of the 737NG/CFM56-7B
airframe/engine configuration during the certification testing, and
[sbull] ``The proven ability of Boeing to satisfactorily manage
ETOPS airworthiness of the 777 fleet in the face of problems
encountered in service. The 737NG proposal includes a problem tracking
and resolution system that will remain in effect for a full 250,000
engine hours.''
The Model 737-700 was the first variant of the 737NG to enter
service, in December 1997. Section 4.2 of the FAA-approved 120-minute
ETOPS Airplane Assessment Report for the 737-700, Boeing Document
Number D033A003, Revision B, states that the Model 737-700 was
designed, manufactured, and tested for extended range operations at
entry into service. The following additional supporting statements were
also made.
a. ``The 737-700 airplanes have been designed and manufactured
based on regimented application of lessons learned from other ETOPS
program experience as well as the in-service experience of earlier 737
models.
b.``The 737-700 airplane was subjected to a rigorous test program
as described in following paragraphs. Production equivalent equipment
where appropriate, was used to support test objectives. Equipment was
production equivalent as defined at the time of the test.''
No significant propulsion system design problems occurred during
any of the testing described above. Two inflight shutdowns did occur
during certification flight testing. One was caused by an indication
fault within the electronic engine control that was corrected with a
simple software change. The other was caused by an inappropriate flight
test condition.
[[Page 35341]]
Boeing stated in the 737-700's 120-minute ETOPS Airplane Assessment
Report that the fleet reached the 15,000-hour mark during the month of
April 1998. At that time, there had been no inflight shutdowns in
service. However, on May 9, 1998, before the FAA had completed its
assessment of the airplane for ETOPS approval, the first inflight
shutdown occurred. A second inflight shutdown occurred during the month
of May, and the fleet exceeded the accepted 120-minute ETOPS standard
of .05 inflight shutdowns per 1000 engine hours. Three inflight
shutdowns occurred in June 1998, and one in July 1998. The peak
inflight shutdown rate during this period was .085/1000 hours at the
end of June 1998, which clearly did not meet the minimum standard for
ETOPS type design approval.
The six engine inflight shutdowns were caused by three different
failure root causes. Boeing and CFMI, the engine manufacturer,
undertook aggressive actions to correct each of these design problems
as they occurred. The high rate of fleet hourly accumulation during
this period, however, resulted in new ETOPS reportable events occurring
faster than the known problems could be corrected. This delayed FAA
consideration of the 737-700 for ETOPS approval until the problems were
brought under control. A consequence of the high rate of fleet hourly
accumulation was that, with no additional inflight shutdowns, the
inflight shutdown rate decreased rapidly and was within the ETOPS type
design approval standard by the end of 1998. The FAA approved the 737-
600/-700/-800 (737NG) for 120-minute ETOPS approximately one year after
entry into service with over 300,000 engine-hours of service experience
and an inflight shutdown rate of .020/1000 hours.
Conclusions From Comparison of 777 and 737NG
In comparing the 737NG experience with that of the 777, the FAA
observes that there is a fleet hourly accumulation rate above which
aggressive problem management to qualify for early ETOPS certification
may become resource prohibitive. Therefore, when certifying an
airplane/engine combination that will be entering service with a high
production rate resulting in a rapid accumulation of engine hours,
manufacturers may find it more cost-effective to use the service
experience criteria of AC 120-42A than to follow the rigorous
requirements of the early ETOPS process.
As stated earlier, the 777 ETOPS special conditions were designed
to ``result in a level of airplane reliability that is equivalent to
the level of reliability previously found to be acceptable based upon
service experience.'' As previously noted, the current 777 ETOPS
special conditions consist of five main elements needed to provide
adequate compensation for the service experience normally required for
180-minute ETOPS eligibility described in AC 120-42A. No single element
is considered sufficient by itself, but the FAA has found that the five
elements combined provide an acceptable substitute for actual airline
service experience. The five elements are:
1. Design for reliability.
2. Lessons learned.
3. Test requirements.
4. Demonstrated reliability.
5. Problem tracking system.
Even though the overall objective is a level of airplane and
propulsion system reliability that is equivalent to that achieved
through service experience, we considered the uncertainty of actually
achieving that goal in the development of these special conditions. The
first three elements focus on designing an airplane to eliminate
sources of engine inflight shutdowns and diversions to the greatest
practical extent. This is accomplished by an overall design philosophy
to preclude sources of engine inflight shutdowns and diversions using
the manufacturer's experience with earlier designs to identify
successful and unsuccessful design features. The additional testing
required by the special conditions focuses on exposing the design to
conditions that in the past have contributed to engine failures, such
as high engine vibration or repeated exposure to humid and inclement
weather on the ground followed by long-range operation at the extreme
cold temperatures at high altitude. These design and test elements do
not assure a level of reliability that is equivalent to that based on
service experience. Instead, they result in an acceptable level of
inherent design reliability from which we can successfully manage ETOPS
fleet safety once the airplane enters service.
The fourth element, ``demonstrated reliability,'' provides the FAA
with a standard by which to judge a design against existing ETOPS-
approved airplanes. This gives the FAA a standard from which to
withhold ETOPS approval from airplanes that experience significant
failures during certification testing, demonstrating that they are not
suitable for ETOPS. However, it does not by itself guarantee that
designs showing no significant failures during flight testing will have
adequate reliability for ETOPS.
To manage fleet safety after ETOPS approval, we rely on the fifth
element of the ETOPS special conditions. Paragraph (f) of the special
conditions requires a problem tracking system for the prompt
identification of those problems that could impact ETOPS safety. The
FAA uses this enhanced problem reporting system to work with the
airplane and engine manufacturers to aggressively manage and correct
significant design problems identified after ETOPS approval. This
requirement is the ``catch-all'' for those design flaws that are not
caught by the other special conditions elements during airplane design
and testing.
The first in-service inflight shutdown of the 737-700 variant of
the 737NG did not occur until the fleet had accumulated approximately
30,000 engine-hours. The FAA could not have expected that a complete
1000-cycle airplane demonstration test would have had a better chance
of discovering the types of problems that occurred in service on the
737NG than the nearly 30,000 hours accumulated on multiple airplanes
and engines prior to the first inflight engine shutdown. While
significant propulsion system failures occurring during type
certification testing, including the additional testing required by the
ETOPS special conditions, may indicate that a design is not yet ready
to enter ETOPS service, the 737NG experience shows that the reverse
cannot be stated with a significant degree of confidence. A lack of
significant failures during certification testing does not in itself
assure an ETOPS-suitable design at entry into service.
The 777 experience shows that a relatively small fleet can be
managed successfully during the initial service period based on the
data provided by the enhanced problem tracking system required by
special conditions paragraph (f). The 737NG experience shows that a
larger fleet may require a much more resource-intensive fleet
management program. However, had the 737NG received its ETOPS approval
as originally proposed prior to its first inflight shutdown in service,
the problem reporting system that Boeing had in place gave the FAA
timely identification of the problems causing inflight shutdowns so
that we could have required appropriate corrective action through the
airworthiness directive process to maintain ETOPS safety. Such
airworthiness directives could have required the operators to
incorporate design changes prior to
[[Page 35342]]
further ETOPS flight or withdrawn ETOPS approval.
Since we cannot be certain that an airplane approved for ETOPS
under the special conditions will have the same maturity at original
type certification as an airplane that we have approved based on
service experience, our experience with the 777 and 737NG confirms that
the five elements of the special conditions, in conjunction with the
FAA's normal safety oversight processes, adequately compensate for that
uncertainty.
The changes we propose for the engine demonstration test and the
airplane demonstration test, including enhanced post-test inspection
requirements, are intended to address our experience with the existing
ETOPS special conditions, which identified several shortcomings in the
original test requirements. We are proposing these changes to more
clearly focus the testing on the objective of exposing the engines and
airplane to those operating conditions that give us the best chance of
identifying underlying major design flaws that could jeopardize ETOPS
safety in service. These proposed changes would provide a better
evaluation of the design than the existing requirements, including the
1000-cycle airplane flight test as previously conducted.
The FAA therefore proposes to change the purpose of the airplane
demonstration test requirement of paragraph (e)(7) from being a
demonstration of reliability to a demonstration of airplane capability
under the types of ETOPS operational and diversion scenarios being
proposed in this notice. The requirements of that airplane
demonstration test have been changed accordingly.
Aged Engine Requirement
In response to Boeing's request, the FAA is proposing to delete
paragraph (e)(7)(ii), which currently requires the installation of the
engine and propulsion system from the 3000-cycle engine demonstration
test required by paragraph (e)(6), or another suitable aged engine, on
the 1000-cycle demonstration test airplane for a minimum of 500 cycles.
Boeing provided the following information in support of its request for
deleting the aged engine requirement:
Review of the aged engine data from the baseline 777 program showed
that the nature of the findings, which occurred on the aged engines,
was not related to the aging of the engines. The findings were related
to the variation that occurs during manufacturing, assembly, etc. This
lesson learned on the aged engines is consistent for each engine
manufacturers' baseline 777 ETOPS test program.
The lack of findings related to the aging of an engine in the ETOPS
flight test program has been demonstrated three times. Based on this
consistent demonstration, there is no further need to maintain the
requirement for an aged engine in the flight test program.
Additionally, flying more airplane/engine combinations will provide
increased opportunities for evaluating potential problem areas.
Boeing reported nine events (EE-1 Reports) which occurred during
the ``aged'' engine portions of the 1000-cycle tests for the three
baseline engine types, with an explanation of why the aged engine
requirement was not necessary in order to identify each failure. Boeing
stated that the lack of any EE-1 reports from the post-test inspections
is an indication that there were no significant findings from the aged
engine testing.
FAA Analysis of Boeing's Proposal: The original intent of the aged
engine requirement was to expose the 3000-cycle test engine, or
equivalent, to inflight conditions that cannot be simulated in a ground
test environment. This would further validate the propulsion system
design out to an age beyond 3000 cycles. Boeing data available at the
time the ETOPS special conditions were developed indicated that 95% of
all new significant failure modes occur on airplane propulsion systems
with 3000 cycles or less. That concept is still valid. The lack of
specific findings on the aged engine during the 1000-cycle airplane
validation test only confirms the validity of the Reliability
Assessment Board's conclusion that those baseline 777 engine
installations were suitable for 180-minute ETOPS. A number of
significant events during the 1000-cycle test program would have
jeopardized that conclusion.
The question that the FAA considers to be more relevant is whether
or not a greater benefit would come from a more thorough teardown
inspection and analysis of the 3000-cycle test engine and propulsion
system hardware than from this additional level of validation. In this
regard, the FAA agrees with Boeing that other test articles may provide
sufficient experience to uncover the majority of age-related problems
independent of the additional exposure provided by the 1000-cycle test
inflight exposure.
In consideration of the need to perform a detailed analysis of the
3000-cycle test engine and the extra expense of using a parallel 3000-
cycle test engine as ``another suitable aged engine,'' the FAA agrees
that the requirement for installation of an aged engine on the ETOPS
test airplane can be eliminated provided significantly improved
processes are used to analyze the condition of the 3000-cycle test and
airplane demonstration test engines at the conclusion of these tests,
as being proposed for paragraph (e)(6).
Miscellaneous Amendments
We are also proposing the following revisions.
Re-identification of paragraph (e)(7)(iii) as (e)(7)(iv) and
revision of the requirement that the 1000-cycle test airplane be
operated and maintained using the recommended operations and
maintenance procedures to recognize that more than one test airplane
may be used.
Replacement of the reference to the ``1000-cycle ETOPS test'' with
``Airplane Demonstration Test'' in paragraph (g)(2) in order to be
consistent with the changes being proposed for paragraph (e)(7).
Replacement of the reference to the ``1000-flight-cycle ETOPS
test'' with ``Airplane Demonstration Test'' in paragraph (h)(1) in
order to be consistent with the changes being proposed for paragraph
(e)(7).
Applicability
As discussed above, these special conditions are applicable to
Boeing Model 777 series airplanes. Should The Boeing Company apply at a
later date for a change to the type certificate to modify any model
included on Type Certificate No. T00001SE to incorporate the same novel
or unusual design feature, the special conditions would apply to that
model as well under the provisions of Sec. 21.101(a)(1), Amendment 21-
69, effective September 16, 1991.
Conclusion
This action affects only certain novel or unusual design features
on Boeing Model 777 series airplanes. It is not a rule of general
applicability, and it affects only the applicant who applied to the FAA
for approval of these features on the airplane.
List of Subjects in CFR Part 25
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.
[[Page 35343]]
PART 25--AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES
The Proposed Special Conditions
Accordingly, the Federal Aviation Administration (FAA) proposes the
following revisions to Special Conditions 25-ANM-84 as part of the type
certification basis for Boeing Model 777 series airplanes. The existing
special conditions are printed in their entirety for clarity. Your
comments are invited on the proposed revisions: Sections (e)(6),
(e)(7), and the word substitutions in sections (g)(2) and (h)(1).
In addition to the airworthiness requirements of 14 CFR part 25,
the Model 777 airplane must comply with the following requirements in
order to be eligible for Extended Range Operation with Two-Engine
Airplanes (ETOPS) without the requisite operating experience specified
in Advisory Circular (AC) 120-42A:
(a) Introduction. An approved ETOPS Type Design Assessment Plan
covering the engine and each applicable airplane system must be
established. The specific methods that will be used to substantiate
compliance with the requirements of these special conditions must be
defined in the plan. Specific systems that will undergo the complete
analysis, testing, and development program tracking defined in
paragraph (c) of these special conditions must be identified. Other
airplane systems that may contribute to the overall safety of an ETOPS
operation, but that do not warrant the rigorous type design
requirements and relevant experience assessments defined in paragraph
(c) of these special conditions, must be identified and agreed to by
the FAA. Compliance must be shown for these other systems with all
provisions of these special conditions, except paragraph (c). In
showing compliance with these special conditions, tests and analyses
conducted to substantiate compliance with the basic airworthiness
standards of part 25 may be referenced, if applicable.
(b) Engine Assessment.
(1) The ETOPS eligibility of the engine must be determined
specifically for the airplane installation for which early ETOPS type
design approval is requested.
(2) Procedures for an engine condition monitoring program must be
defined and validated at the time of ETOPS type design approval. The
engine condition monitoring program must be able to predict when an
engine is no longer capable of providing, within certified engine
operating limits, the maximum thrust required for a single engine
diversion.
(c) ETOPS Type Design Assessment.
(1) Design Requirements Assessment. 14 CFR part 25, including
applicable amendments, defines most of the requirements necessary to
design an airplane that is suitable for ETOPS operation, as long as the
ETOPS mission is considered in applying these requirements for all
anticipated dispatch configurations. In addition to these requirements,
the propulsion system must be designed to preclude failures or
malfunctions that could result in an engine inflight shutdown. The
applicant must identify and list methods of compliance for each of the
applicable ETOPS requirements, including those specific part 25
requirements for which methods of compliance relative to the ETOPS
mission are different from those traditionally used for two-engine
airplanes. Paragraph (c)(3) of these special conditions lists certain
design feature categories that may be affected by a consideration of
the ETOPS mission in the design of these systems. The effects of the
applicable ETOPS requirements on the design of any of those design
feature categories listed in paragraph (c)(3) must be specifically
addressed by this assessment.
(2) Relevant Experience Assessment. For each system covered by the
ETOPS Type Design Assessment, there must be an assessment of the
relevant design, manufacturing, and operational problems experienced on
previous airplanes built by the applicant. The assessment must include
the applicable relevant service experience of vendor supplied systems
or, to the extent possible, the service experience of components on
aircraft built by other manufacturers. Specific corrective actions
taken to preclude similar problems from occurring on the new airplane
must be identified.
(3) Design Features.
(i) The applicant must define any design features implemented to
comply with the design requirements listed in paragraph (c)(1).
Consideration of the following design feature categories must be
specifically addressed:
(A) Airplane capabilities and capacities of the ETOPS mission;
(B) Fuel system integrity, including consideration of uncontained
main engine rotor burst and fuel availability as affected by cross-feed
capability and electrical power to pumps and other components;
(C) Fuel quantity indication to the flightcrew, including alerts
that consider the fuel required to complete the mission, abnormal fuel
management or transfer between tanks, and possible fuel leaks between
the tanks and the main engines;
(D) Communication systems for the ETOPS environment;
(E) Navigation systems for the ETOPS environment;
(F) Minimum single engine cruise altitude capability; and
(G) Failure tolerant designs of cockpit indicating systems or
avionics systems to prevent unnecessary airplane diversions.
(ii) The applicant must define the specific design features used to
address problems identified in the relevant service experience
assessment of paragraph (c)(2).
(4) Test Features. The applicant must define specific new tests, or
enhanced tests, that will be used to assure engine and airplane system
design integrity. These test features may be derived from the
requirements assessment of paragraph (c)(1) and the relevant service
experience assessment of paragraph (c)(2).
(5) Analysis Features. The applicant must define specific new
analyses, or enhanced analyses, that will be used to assure engine and
airplane system design integrity. These analysis features may be
derived from the requirements assessment of paragraph (c)(1) and the
relevant service experience assessment of paragraph (c)(2).
(6) Manufacturing, Maintenance, or Operational (Other) Features.
The applicant must define specific new, or enhanced, manufacturing
processes or procedures, and maintenance or operational procedures that
are being implemented to assure engine and airplane system integrity.
These ``other'' features may be derived from the requirements
assessment of paragraph (c)(1) of this section and the relevant service
experience assessment of paragraph (c)(2).
(d) Additional ETOPS Analysis Requirements.
(1) Performance and Failure Analyses. Engine and airplane
performance and failure analyses required for certification must be
expanded to consider ETOPS mission requirements, including exposure
times associated with a 180-minute single-engine diversion and a
subsequent 15-minute hold in the terminal airspace at the diversion
airport. Consideration must be given to crew workload and operational
implications of continued operation with failure effects for an
extended period of time. The rationale and all assumptions used in the
analyses must be documented, justified, and validated, including
maintenance interval and maintainability assumptions.
[[Page 35344]]
(2) Maintenance and Flight Operations Evaluation. The Type Design
Assessment Plan must contain a program to systematically detect and
correct problems occurring as a result of improper execution of
maintenance or flight operations. Corrective actions for any problems
found must be identified and implemented through the Problem Tracking
and Resolution System required by paragraph (f).
(3) Manufacturing Variability. The Type Design Assessment Plan must
contain a program to minimize potential manufacturing problems. The
plan should address early validation of tooling and procedures, as well
as any related problems, as identified in paragraph (c)(2). Corrective
actions for problems that impact the safe operation of the airplane
must be identified and implemented through the problem tracking and
resolution system required by paragraph (f).
(e) Additional ETOPS Test Requirements. As part of, or in addition
to, the testing identified in paragraph (c)(4), the following specific
test requirements apply:
(1) Configuration Requirements. All testing defined in paragraph
(e) must be conducted with the configuration proposed for
certification, and must include sufficient interfacing system hardware
and software to simulate the actual airplane installation.
(2) Completion of Applicable Failure Analyses. Failure analyses
required for ETOPS type design approval must be submitted to the FAA
prior to the start of the testing defined in paragraph (e).
(3) Vibration Testing. Vibration testing must be conducted on the
complete installed engine configuration to demonstrate that no damaging
resonances exist within the operating envelope of the engine that could
lead to component, part, or fluid line failures. The complete installed
engine configuration includes the engine, nacelle, engine mounted
components, and engine mounting structure up the strut to wing
interface.
(4) New Technology Demonstration Testing. Testing must be conducted
to substantiate the suitability of any technology new to the applicant,
including substantially new manufacturing techniques.
(5) Auxiliary Power Unit Demonstration Test. If requesting credit
for APU backup electrical power generation, one auxiliary power unit
(APU), of the type to be certificated with the airplane, must complete
3000 equivalent airplane operational cycles.
(6) Engine Demonstration Test. One engine of each type to be
certificated with the airplane must complete 3000 equivalent airplane
operational cycles. The engine must be configured with a complete
airplane nacelle package for this demonstration, including engine-
mounted equipment except for any configuration differences necessary to
accommodate test instrumentation and test stand interfaces with the
engine nacelle package. At completion of the engine demonstration test,
the engine and airplane nacelle test hardware must undergo a complete
teardown inspection. This inspection must be conducted in a manner to
identify abnormal conditions that could become potential sources of
engine inflight shutdown. An analysis of any abnormal conditions found
must consider the possible consequences of similar occurrences in
service to determine if they may become sources of engine inflight
shutdowns, power loss, or inability to control engine thrust. Any
potential sources of engine inflight shutdown identified must be
corrected in accordance with paragraph (g)(2).
(7) Airplane Demonstration Test. In addition to the function and
reliability testing required by 14 CFR 21.35(b)(2), for each engine
type to be certificated with the airplane, one or more airplanes must
complete flight testing which demonstrates that the aircraft, its
components, and equipment, are capable of and function properly during
long range operations and airplane diversions, including engine-
inoperative diversions.
(i) The flight conditions must expose the airplane to
representative operational variations based on the airplane's system
and equipment design and the intended use of the airplane including:
(A) Engine inoperative maximum length diversions to demonstrate the
airplane and propulsion system's capability to safely conduct a
diversion.
(B) Non-normal conditions to demonstrate the airplane's capability
to safely divert under worst case probable system failure conditions.
(C) Simulated airline operations including normal cruise altitudes,
step climbs, and maximum expected flight durations out of and into a
variety of departure and arrival airports.
(D) Diversions to worldwide airports representative of those
intended as operational alternates.
(E) Repeated exposure to humid and inclement weather on the ground
followed by long-range operation at normal cruise altitude.
(ii) The flight testing must validate expected airplane flying
qualities and performance considering engine failure, electrical power
losses, etc. The testing must demonstrate the adequacy of remaining
airplane systems and performance and flightcrew ability to deal with an
emergency considering remaining flight deck information following
expected failure conditions.
(iii) The engine-inoperative diversions must be evenly distributed
among the number of engines in the applicant's flight test program.
(iv) The test airplane(s) must be operated and maintained using the
recommended operations and maintenance manual procedures during the
airplane demonstration test.
(v) At completion of the airplane demonstration test, the test
engines and engine-mounted equipment must undergo a complete external
on-wing visual inspection. The engines must also undergo a complete
internal visual inspection. These inspections must be conducted in a
manner to identify abnormal conditions that could become potential
sources of engine inflight shutdowns. An analysis of any abnormal
conditions found must consider the possible consequences of similar
occurrences in service to determine if they may become sources of
engine inflight shutdowns. Any potential sources of engine inflight
shutdown that are identified must be corrected in accordance with
paragraph (g)(2).
(f) Problem Tracking System. An FAA-approved problem tracking
system must be established to address problems encountered on the
engine and airplane systems that could affect the safety of ETOPS
operations.
(1) The system must contain a means for the prompt identification
of those problems that could impact the safety of ETOPS operations in
order that they may be resolved in a timely manner.
(2) The system must contain the process for the timely notification
to the responsible FAA office of all relevant problems encountered, and
corrective actions deemed necessary, in a manner that allows for
appropriate FAA review of all planned corrective actions.
(3) The system must be in effect during the phases of airplane
development that will be used to assess early ETOPS eligibility, and
for at least the first 250,000 engine-hours of fleet operating
experience after the airplane enters revenue service. For the revenue
service period, this system must define the sources and content of in-
service data that will be made available to the manufacturers in
support of the problem tracking system. The content of the data
provided must include, as a minimum, the data necessary to evaluate the
specific cause of all service incidents reportable under Sec. 21.3(c)
of part 21, in addition to any other failure or
[[Page 35345]]
malfunction that could prevent safe flight and landing of the airplane,
or affect the ability of the crew to cope with adverse operating
conditions.
(4) Corrective actions for all problems discovered during the
development and certification test program that could affect the safety
of ETOPS operations, or the intended function of systems whose use is
relied upon to accomplish the ETOPS mission, must be identified and
implemented in accordance with paragraph (g)(2). If, during the
certification program, it is discovered that a fault has developed that
requires significant rework of manufacturing, maintenance, and/or
operational procedures, the FAA will review the ETOPS suitability of
the affected system and interfacing hardware and identify any
additional actions to be accomplished to substantiate the corrective
actions.
(5) For each engine type to be certificated with the airplane, the
system must include provisions for an accelerated engine cyclic
endurance test program that will accumulate cycles on one
representative production-equivalent propulsion system in advance of
the high-cycle revenue fleet engine. This test program will assist the
applicant and the FAA in identifying and correcting problems before
they occur in revenue service. This program must be in place for, at a
minimum, the first 250,000 engine-hours of fleet operating experience
after the airplane enters revenue service. The representative
production-equivalent propulsion system may, at the manufacturer's
discretion, be used for other fleet support activities.
(g) Reliability Assessment Board.
(1) An FAA Reliability Assessment Board will be formed to evaluate
the suitability of the airplane for ETOPS approval and make a
recommendation to the Manager, Transport Airplane Directorate,
regarding the adequacy of the type design for 180-minute ETOPS
operation. The purpose of this board will be:
(i) To periodically review the development and certification flight
test program accomplishments from both type design and operational
perspectives;
(ii) To ensure that all specific problems, as well as their
implications on the effectiveness of the Early ETOPS process, are
resolved; and
(iii) To assess the design suitability for ETOPS. The board will
consider design, maintenance, manufacturing, and operational aspects of
the type design when finding suitability for ETOPS approval.
(2) The FAA Reliability Assessment Board will review and evaluate
the data from the problem tracking and resolution system to establish
compliance with the requirements of paragraph (h). The board will
evaluate the overall type design for ETOPS suitability as demonstrated
in flight test, and the Airplane Demonstration Test, considering all
resolutions of problems. The following suitability criteria will be
applied:
(i) Sources of engine shutdown/thrust loss, engine anomalies, or
airplane system problems that have a potential significant adverse
effect on in-service safety will be resolved.
(ii) Resolutions are identified for all items in paragraph (i) with
analysis and/or testing to show all resolutions are effective. These
resolutions may be accomplished through one or more of the following
categories: Design change, Operating procedure revision, Maintenance
procedure revision, Manufacturing change.
(iii) The resolutions of paragraphs (i) and (ii) will be
incorporated prior to entry into service.
(iv) The engine shutdown history of the test program indicates that
the engine reliability of the configuration is suitable for the ETOPS
approval being considered.
(v) Where interim resolutions having operational impact are
defined, the cumulative effect must be determined to be acceptable.
(vi) System or component failures experienced during the program
are consistent with the assumptions made in the failure analyses.
(h) Reliability Demonstration Acceptance Criteria.
(1) For the engine and airplane systems, the type and frequency of
failures that occur during the airplane flight test program and the
Airplane Demonstration Test must be consistent with the type and
frequency of failures or malfunctions that would be expected to occur
on presently certified 180-minute ETOPS airplanes. The failures to be
considered are those associated with system components that conform to
the type design requested for certification. The Reliability Assessment
Board will determine compliance with this requirement based on an
evaluation of the problem reporting system data, considering system
redundancies, failure significance, problem resolution, and engineering
judgment.
(2) Corrective action for any of the following classes of problems
occurring during the testing identified in paragraph (h)(1) that
requires a major system redesign would delay ETOPS type design
approval, or result in approval of a reduced single-engine diversion
time, unless corrective action has been substantiated to, and accepted
by, the FAA Reliability Assessment Board:
(i) Any source of unplanned inflight shutdown or loss of thrust.
(ii) Any problem that jeopardizes the safety of an airplane
diversion.
(3) The FAA Reliability Assessment Board must determine that the
suitability criteria of paragraph (g)(2) have been met.
(i) Demonstration of Compliance. In order to be eligible for 180-
minute ETOPS type design approval, the following conditions apply:
(1) The engine assessment has been completed and eligibility for
ETOPS operation has been approved by the FAA Engine Certification
Office.
(2) All design, manufacturing, maintenance, operational, and other
features necessary to meet the ETOPS requirements of paragraph (c)(1),
and to resolve the problems identified in paragraph (c)(2), have been
successfully implemented.
(3) The identified test and analysis features in paragraph (c)(4)
and (c)(5) have been shown to be effective in validating the successful
implementation of the features in paragraph (i)(2).
(4) The additional analysis requirements of paragraph (d) have been
completed and the results have been approved.
(5) The additional test requirements of paragraph (e) have been
successfully completed.
(6) All significant problems identified in accordance with
paragraph (f) have been resolved, and fixes substantiated to be
effective have been implemented.
(7) The accelerated engine cyclic endurance test program of
paragraph (f)(5) must be in place.
(8) Compliance with the reliability demonstration acceptance
criteria of paragraph (h) has been found by the Reliability Assessment
Board.
Issued in Renton, Washington on June 4, 2003.
Kalene C. Yanamura,
Acting Manager, Transport Airplane Directorate, Aircraft Certification
Service.
[FR Doc. 03-14992 Filed 6-12-03; 8:45 am]
BILLING CODE 4910-13-P