12-30-88 AC 120-42A anyway which prejudices the final authority and responsibility of the pilot in command for the safe operation of the airplane.
g. Operations Specifications.
(1) An operator's two-engine airplane should not be operated on an extended range flight unless authorized by operations specifications approval (both maintenance and operations).
(2) Operations specifications for extended range operations should specifically include provisions covering at least the following:
(i) Part D should define the particular airframeengine combinations, including the current approved CMP standard required for extended range operation as normally identified in the AFM (paragraph 8.f.).
(ii) Authorized area of operation.
(iii) Minimum altitudes to be flown along planned and diversionary routes.
(iv) The maximum diversion time, at the approved oneengine inoperative cruise speed (under standard conditions in still air), that any point on the route the airplane may be from a suitable airport for landing.
(v) Airports authorized for use, including alternates, and associated instrument approaches and operating minima.
(vi) The approved maintenance and reliability program (ref. Appendix 4) for extended range operations including those items specified in the type design approved CMP standard.
(vii) Identification of those airplanes designated for extended range operation by make and' model as well as serial and registration numbers.
(viii) Airplane Performance Reference.
Operational Validation Flight. The operator should demonstrate, by means of an FAA-witnessed validation flight using the specified airframe-engine combination, that it has the competence and capability to safely conduct and adequately support the intended operation. (This is in addition to the flight test required for type design approval in Paragraph 8.d. (3)). The Director, Flight Standards Service, will determine the conditions for each operator's validation flight following a review on a caseby-case basis of the operator's experience and the proposed operation. The following emergency conditions should be Par 10 25
12-30-88 AC 120-42A demonstrated during the validation flight unless successful demonstration of these conditions has been witnessed by the FAA in an acceptable simulation prior to the validation flight:
(1) Total loss of thrust of one-engine; and total loss of engine-generated electrical power;
OR.
(2) Any other condition considered to be more critical in terms of airworthiness, crew workload, or performance risk.
i. Extended Range Operations Approval. Following a type design approval for extended range operations in accordance with paragraph 8 and satisfactory application of the criteria in paragraphs 9 and 10 and prior to the issuance of operations specifications, the operator's application, as well as, the rertificate-holding district office's principal inspectors' (Principal Maintenance Inspector, Principal Avionics Inspector, Principal Operations Inspector) recommendations and supporting data should be forwarded to the Director, Flight Standards Service, for review and concurrence. Following the review and concurrence by the Director, the operational validation flight should be conducted in accordance with any additional guidance specified in the review and concurrence. when the operational validation flight has been evaluated and found acceptable, an applicant may be authorized to conduct extended range operations with the specified airframe-engine combination. Approval to conduct ETOP is made by the issuance of operations specifications containing appropriate limitations.
CONTINUING SURVEILLANCE. The fleet average IFSD rate for the specified airframe-engine combination will continue to be monitored in accordance with Appendices 1 and 4. As with all other operations, the certificate-holding district office should also monitor all aspects of the extended range operations it has authorized to ensure that the levels of reliability achieved in extended range operations remain at the necessary levels as provided in Appendix 1, and that the operation continues to be conducted safely. In the event that an acceptable level of reliability is not maintained, significant adverse trends exist, or if significant deficiencies are detected in the type design or the conduct of the ETOPS operation, the certificate-holding district office should initiate a special evaluation, impose operational restriction, if necessary, and stipulate corrective action for the 26 Par 10
12-30-88 AC 120-42A operator to adopt, to resolve the problems in a timely manner. The certificate-holding district office should alert the Type Certification Office when a special evaluation is initiated and provide for their participation.
Can than I Sudial inthony o. Broderick Associate Administrator for Regulation and Certification Par 11 27
12-30-88 AC 120-42A Appendix 1 APPENDIX 1. PROPULSION SYSTEM RELIABILITY ASSESSMENT
1. ASSESSMENT PROCESS. In order to establish if a particular airframe-engine combination has satisfied the current propulsion system reliability requirements for extended range operations, thorough assessment will be conducted by a group of FAA specialists, the Propulsion System Reliability Assessment Board (PSRAB) utilizing all the pertinent propulsion system data and information available (includes the APU, if required).
Engineering and operational judgment supported by the relevant statistics will be used to determine current propulsion system reliability. The findings of the specialist group will be included in the FAA Airplane Assessment Report.
a. Service Experience. To provide a reasonable indication of airplne propulsion system reliability trends and to reveal problem areas, a certain amount of service experience will be required.
general, extended range airframe-engine combination reliability assessments concern two major categories; those supporting up to 120 minutes maximum diversion time operations and those support operations beyond 120 minutes maximum diversion times. A special case-by-case operational approval may be granted for 75-minute diversion routes and require limited evaluation of service.
experience at the time of the application.
(1) Operations up to 120 Minutes. Normally, accumulation of at least 250,000 engine hours in the world fleet will be necessary before the assessment process can produce meaningful results. This number of hours may be reduced if adequate compensating factors are identified which give a reasonable equivalent data base as established by the PSRAB. Where experience on another airplane is applicable to a candidate airplane, a significant portion of the 250,000 hours experience should normally be obtained by the candidate airplane. In the event that a particular engine is derived from an existing engine, the required operational experience is subject to establishing the degree of hardware commonality and operating similarities.
(2) Operations beyond 120 Minutes (180 minutes).
Suitability to operate the airplane beyond 120 minutes will not be considered until operational experience in 120 minute extended range service clearly indicates further credit is appropriate.
This would generally include at least one year of service experience with an ETOP configured fleet at 120-minute operation corresponding high level of demonstrated propulsion system reliability.
75-Minute Operation Authorization. In this category, service experience of the airframe-engine combination may be less than the 250,000 hours as provided in subparagraph a (1).
It must be shown that sufficient favorable experience has been accumulated, demonstrating a level of reliability appropriate for Par 1 1
Par 1 transport-turbo fan powered airplane. The service experience of service records of an established large fleet of twin-engine civil model has been constructed. The risk model is based upon the known that the risks of increased diversion times are acceptable, a risk Risk Management and the Risk Model. In order to assure (7) Additional data as specified by the PSRAB. (6) IFSD rate based on a 6- and 12-month rolling average. components that affect reliability. Mean time between failure of propulsion system population (age distribution). Total engine hours and cycles and engine hour en route diversions chargeable to the propulsion system. (includes those induced by maintenance or crew error) and (3) Dispatch delays, cancellations, aborted takeoffs causes for unscheduled engine removal. months), removal summary, time history of removal rate and primary (2) Unscheduled engine removal rate (accumulated 6 and 12 attained. all occurrences where control or desired thrust level was not In addition, similar information should be provided for shutdown. circuite their to ta vendise of free ground configuration and modification history, engine position, (engine and airplane model and serial number), engine including flameout. The list should provide identification in flight for all causes (excluding normal training events) (1) A list of all engine shutdown events both ground and These data should include:' to help determine the impact on propulsion system reliability. descriptions, qualifications, and any pertinent details necessary manufacturer. Data so provided should include all event completeness; i.e., engine manufacturer, operator, and airplane approval, data should be provided from various sources to ensure cases. In support of applications for extended range type design available; however, additional data may be required in certain to maximize the use of existing sources and kinds of data generally world-fleet data and information are required. The PSRAB intends diversion time, for extended range type design approval, certain system reliability, consideration of the proposed maximum Reliability Data Base. To adequately assess propulsion the Director, Flight Standards Service. 75-minute authorization following review on a case-by-case basis by Advisory Circular, a particular operator may receive a special 75-minute extended range operation. As detailed earlier in the Appendix 1 AC 120-42 A 12-30-88
12-30-88 AC 120-42A Appendix 1 this "base fleet" has been very satisfactory and reflective of a high level of safety in its propulsion systems. It has achieved an average in-flight shutdown rate of approximately .02/1000 hours for a 10-year period while flying predominately on routes conforming to the requirements of FAR Section 121.161 (i.e., flight paths within 60 minutes flying time from a adequate airport).
(1) The risk of engine failure during a single-engine diversion event is directly related to the diversion flight time and the propulsion system reliability or IFSD rate. This assumes the failure of the first engine, which causes the diversion, is unrelated to the probability of failure of the second engine during the diversion. Common cause or related failure modes will be discussed in Paragraph 1(d). The product of IFSD rate and and identified as (AT). For the base fleet of .02/1000 IFSD rate diversion time can be designated as a risk factor for the diversion (-02/1000) in rate and 60 minutes maximum diversion, (AT) would be (.02/1000) (60).
Identifying this base fleet risk factor as (2T)*, other combinations of IFSD rates and diversion times can be ratioed to this base risk factor to determine ETOP relative risk, (AT)/(AT)".
For ETOP diversion times of 60 minutes and IFSD rates of .02/1000, the relative risk factor equals 1.0. This relationship is shown in Figure l.
RELATIVE .02/1000 BASELINE
RISK RATE
7)* TIME 1 HR FIGURE 1
(2) Extending this model to a family of IFSD rates and diversion times, Figure 2 depicts the relationship between diversion time, IFSD rate, and risk relative to the base fleet during the diversion:
. 05/1000
RELATIVE RISK .02/1000
T (HRS) FIGURE 2 Par 1 3
AC 120-42 A 12-30-88 Appendix 1
2. RELIABILITY LEVELS. As discussed in Paragraph 1, in order to ensure that risks associated with increased diversion times are acceptable, reliabilities of ETOP propulsion systems must be shown approach or equal those of the highly reliable base fleet of
• 02/1000 and the appropriate operational and maintenance requirements implemented (see Figure 3).
Operations up to 120 Minutes. The overall fleet reliability should approach or achieve that of the highly reliable base fleet following incorporation of the appropriate configuration maintenance and operational requirements. Propulsion system maturity rates have suggested that incorporation of propulsion system improvements following review of 250,000 hours service experience have yielded an approximate .03/1000 improvement in IFSI reliability. Given the IFSD objective of approximately .02/1000 hours and the potential improvement rate of .03/1000 hours, the extended range operation start threshold can be established at approximately .05/1000 hours (see Figure 3). It should be noted that this is threshold and specific circumstances in fleet reliability data such as confidence in problem resolution, types of failures, etc., could be relevant in establishing a start threshold other than .05/1000.
Operations Beyond 120 Minutes. The overall fleet reliability should achieve that of the highly reliable base fleet prior to approval. Only those airframe-engine combinations exhibiting the highest levels of overall reliability will be found satisfactory for this type of operation (see Figure 3). In addition, it will normally be a necessary prerequisite for these airplanes to have at least one year of satisfactory ETOP service involving 120 minutes or less operation under conditions of this
c. Reliability Targets-Summary. Utilizing the risk model, it can be shown that when progressing from the entry level required reliability to the target level reliability (achieved for 180 minutes), the overall risk is not adversely impacted considering respective increases in diversion time. (See Figure 3.)
4 Par 2
12-30-88 AC 120-42A Appendix 1 UP TO 120 AND BEYOND 120
MINUTE RELIABILITY TARGET . 05/1000 RELATIVE . 02/1000 RISK 2
TIME (HRS) FIGURE 3
d. Risk Model Corroboration with Analysis. As a check of the conservatism for reliability levels identified by the risk model, an analysis can be performed which, given certain assumptions, can corroborate the model targets and identify areas of importance where on-going design, operation, and maintenance vigilance must be continued. In the construction of such an analysis, it is assumed that the probability of total thrust loss on any given twin engine airplane flight is made up of those engine failure mechanisms which are independent events (e.g., left engine failure independent from right engine failure) and these engine failure events which are related to a common source (e.g., left and right engines fail as a result of a common or related event).
This may be shown as:
PIT = PrI + PTc (1) Prr = Total probability of complete thrust loss on any given flight.
Pr = Probability of complete thrust loss on flight due to independent causes.
Prc = Probability of complete thrust loss on flight due to common causes.
In determination of the probability of total thrust loss due to independent causes (Pri), International Civil Aviation Organization Report No. AN-WP/5593 titled Extended Range Operation of Twin-Engine Commercial Air Transport Aeroplanes,i dated February 15, 1984, contains an analytical assessment of inflight shutdown rate, flight time, and diversion time as equated Par 2 5
AC 120-42A 12-30-88 Appendix 1 to an observed assessment of commercial transport aircraft accidents worldwide for a recent several year period. This relationship, as derived in this study, is shown as:
IFSD Rate 10-° (.6 + .4T) (2) TY where: I = intended duration of flight Y = diversion time As an example, for a flight of seven hours and a diversion time of two hours, equation (2) identifies an IFSD of .05/1000 as necessary, while for a diversion time of three hours, .04/1000 is necessary to provide a level of probability supporting the reference world accident rate. As can be seen, the risk model identified in paragraph 1.c. of this Appendix requires an achieved IFSD rate of one half that calculated using the ICAO assessment.
It is believed essential that the ETOPS IFSD rate provided by paragraph 1.c. of this Appendix be required considering the influence of common cause failure mechanisms (Prc) as well as the uncertainties associated with assumption identified in the ICAO Although there has been no suitable analytical models developed for assessment of the probability of complete thrust loss in flight due to common cause events (Prc), it is considered that by establishment of highly reliable propulsion systems through achievement of low in-flight shutdown rates, continual engine and airplane design monitoring for those potential common mode service difficulties, and vigilant maintenance and operational practices as identified in Appendices 4 and 5, risks associated with total thrust loss can be maintained at acceptable low levels (Figure 4).
AC 120-42
EFFECTS RISK
CONSTANT AIRPLANE RISK TIME FIGURE 4
e. Propulsion System Approval Considerations.
determination that a propulsion system is suitable per the assessment considerations of either of the two major categories is provided by the PSRAB. Table 1 identifies the constituent elements of the two major categories of approval considerations.
6 Par 2
12-30-88 AC 120-42A Appendix 1 Table 1.
Propulsion System Approval Considerations Up to 120 Minute Operation Greater Than 120 Minute Operation 250,000 engine hours (significant portion with experience candidate airplane).
o same plus at least additional one year with the approved extended range configured fleet.
achieve an IFSD of approximately .05/1000 (the objective is continuing improvement towards a rate of . 02/1000 hours) .
• Periodic review of propulsion system data and service experience, and revise the CMP standard as appropriate.
o achieve and maintain an IFSD of approximately .02/1000 hours.
o same - schedule for incorporation of CMP standards requirements, may be shorter.
ENGINEERING ASSESSMENT. The methodology to be used by the FAA in determining adequate propulsion system reliability will be a problem-oriented approach using fail-safe concepts, an assessment of the maturation of the propulsion system, the achieved level of IFSD rate, engineering and operational judgment and reliability analysis, and will consist of:
a . An analysis, on a case-by-case basis, of all significant failures, defects and malfunctions experienced in service (or during testing) for the airframe-engine combination being addressed. Significant failures are principally those causing or resulting in in-flight shutdown or flameout of the engine(s), but may also include unusual ground failures, uncommanded thrust reduction, and/or unscheduled removal of engines from the airplane.
In making the assessment, consideration will be given to the following:
(1) The type of engine, previous experience, similarity in hardware and operating characteristics with other engines, and the engine operating rating limit to be used with one-engine shutdown.
(2) The trends in cumulative and 6- and 12-month rolling average, updated quarterly, of in-ilight shutdown rates versus propulsion system flight hours and cycles.
(3) The effect of corrective modifications, maintenance, etc., on the possible future reliability of the propulsion system.
Par 2 7
AC 120-42A 12-30-88 Appendix 1
(4) Maintenance actions recommended and performed and their effect on engine and APU failure rates.
(5) The accumulation of operational experience which covers the range of environmental limitations likely to be encountered.
. Intended maximum flight duration and approved maximum diversion time.
b. An assessment of the corrective actions taken for each problem identified with the objective of verifying that the action is sufficient to correct the deficiency.
When each identified significant deficiency has a corresponding FAA-approved corrective action and when all corrective actions are satisfactorily incorporated and verified, the PSRAB determines that an acceptable level of reliability can be achieved. Statistical corroboration will also be utilized.
When foreign manufacturer's and/or operator's data are being evaluated, the respective civil airworthiness authorities will be offered the opportunity to participate. They will be briefed by the PSRAB during the proceedings and provided a copy of the final report for their review.
4. PSRAB FINDINGS. Once an assessment has been completed and the PSRAB has documented its findings, the FAA will declare whether or not the particular airframe-engine combination satisfies the relevant considerations of this Ac. Items recommended to qualify the propulsion system, maintenance requirements, and limitations will be included in the Airplane Assessment Report (Paragraph 8.e.).
5. ON-GOING FLEET MONITORING. In order to ensure that the desired level of reliability is maintained, the PSRAB will continuously monitor reliability data and periodically review its original findings. In addition the FAA document containing the CMP standard will be revised as necessary.
8 Par 3