12-30-88 AC 120-42A Appendix 2 APPENDIX 2. THE FAA FAIL-SAFE DESIGN CONCEPT FAA FAIL-SAFE DESIGN CONCEPT. The FAR Part 25 airworthiness standards are based on, and incorporate, the objectives, and principles or techniques, of the fail-safe design concept, which considers the effects of failures and combinations of failures in defining a safe design. The following basic objectives pertaining to failures apply:
In any system or subsystem, the failure of any single element, component, or connection during any one flight (brake release through ground deceleration to stop) should be assumed, regardless of its probability. Such single failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure conditions.
b. Subsequent failures during the same flight, whether detected or latent, and combinations thereof, should also be assumed, unless their joint probability with the first failure is shown to be extremely improbable.
2. FAIL-SAFE PRINCIPLES AND/OR TECHNIQUES. The fail-safe design concept uses the following design principles or techniques in order to ensure a safe design. The use of only one of these principles or techniques is seldom adequate. A combination of two or more is usually needed to provide a fail-safe design; i.e., to ensure that major failure conditions are improbable and that catastrophic failure conditions are extremely improbable.
a. Designed Integrity and Quality. Including Life Limits, to ensure intended function and prevent failures.
b. Redundancy or Backup Systems to enable continued function after any single (or other number of) failure(s); e.g., two or more hydraulic systems, flight control systems, etc.
c. Isolation of Systems, Components, and Elements so that the failure of one does not cause the failure of another. Isolation is also termed independence.
d. Proven Reliability so that multiple, independent failures are unlikely to occur during the same flight.
e. Failure Warning or Indication to provide detection.
Par 1 1
AC 120-42A 12-30-88 Appendix 2
f. Flightcrew Procedures for use after failure detection, to enable continued safe flight and landing by specifying crew corrective action.
g • Checkability: the capability to check a component's condition.
h. Designed Failure Effect Limits, including the capability to sustain damage, to limit the safety impact or effects of a failure.
i. Designed Failure Path to control and direct the effects of a failure in a way that limits its safety impact.
j. Margins or Factors of Safety to allow for any undefined or unforeseeable adverse conditions.
k. Error-Tolerance that considers adverse effects of foreseeable errors during the airplane's design, test, manufacture, operation, and maintenance.
2 Par 2
12-30-88 AC 120-42A Appendix 3 APPENDIX 3. SUITABLE EN ROUTE ALTERNATE AIRPORTS
1. GENERAL.
One of the distinguishing features of two-engine extended range operations is the concept of a suitable en route alternate airport being available to which an airplane can divert after a single failure or failure combinations which require a diversion.
Whereas most two-engine airplanes operate in an environment where there is usually a choice of diversion airports available, the extended range airplane may have only one alternate within a range lictated by the endurance of a particular alrirame system le.9• argo iire suppressant), or by the approved maximum diversion time for that route.
b. It is, therefore, important that any airport designated as an en route alternate has the capabilities, services, and facilities to safely support that particular airplane, and that the weather conditions at the time of arrival provide a high assurance that adequate visual references are available upon arrival at decision height (DH) or minimum descent altitude (MDA), and that the surface wind conditions and corresponding runway surface conditions are within acceptable limits to permit the approach and landing to be safely completed with an engine and/or systems inoperative.
2. ADEQUATE AIRPORT. As with all other operations, an operator desiring any route approval should show that it is able to satisfactorily conduct scheduled operations between each required airport other than that route or route segment. Operators should show that the facilities and services specified in FAR Section 121.97 through 121.107 for domestic and flag air carriers (FAR Sections 121.113 through 121.127 for supplemental air carriers and commercial operators) are available and adequate for the proposed operation. For the purpose of this advisory circular, in addition to meeting Part 121 requirements of the FAR, those airports which meet the provisions of Part 139 and those foreign airports which are determined to be equivalent to the provisions of subparts D and E of FAR Part 139 for that particular airplane are considered to be adequate airports.
3. SUITABLE AIRPORT. For an airport to be suitable for the purpose of this advisory circular, it should have the capabilities, services, and facilities necessary to designate it as an adequate airport, and have weather and field conditions at the time of the particular operation which provide a high assurance that an approach and landing can be safely completed with an engine and/or systems inoperative in the event that a diversion to the en route alternate becomes necessary, Due to the natural variability of weather conditions with time as well as the Par 1 1
AC 120-42A 12-30-ỡỡ Appendix 3 need to determine the suitability of a particular en route airport prior to departure, the en route alternate weather minima for dispatch purposes are generally higher than the weather.
necessary to initiate an instrument approach. This is necessary to assure that the instrument approach can be conducted safely if the flight has to divert to the alternate airport. Additionally, since the visual reference necessary to safely complete an approach and landing is determined, among other things, by the accuracy with which the airplane can be controlled along the approach path by reference to instruments and the accuracy of the ground-based instrument aids, as well as the tasks the pilot is required to accomplish to maneuver the airplane so as to complete the landing, the weather minima for nonprecision approaches are generally higher than for precision approaches.
STANDARD EN ROUTE ALTERNATE AIRPORT WEATHER MINIMA. The following are established for flight planning and dispatch purposes with two-engine airplanes in extended range operations. These weather minima recognize the benefits of precision approaches, as well as the increased assurance of safely completing an instrument approach at airports which are equipped with precision approaches o at least two separate runways, (two separate landing suriaces).
i particular airport may be considered to be a suitable airport for flight planning and dispatch purposes for extended range operations if it meets the criteria of Paragraph 3 of this Appendix and has one of the following combinations of instrument approach capabilities and en route alternate airport weather minima:
a. A Single Precision Approach:
Ceiling of 600 feet and a visibility of 2 statute miles or a ceiling of 400 feet and a visibility of 1 statute mile above the lowest authorized landing minima; whichever is higher.
b. Two or More Separate Precision Approach Equipped Runways:
Ceiling of 400 feet and a visibility of 1 statute miles or a ceiling of 200 feet and a visibility of 1/2 statute mile above the lowest authorized landing minima; whichever is higher.
c. Non-precision approach (es):
Ceiling of 800 feet and a visibility of 2 statute miles or a ceiling of 400 feet and a visibility of 1 statute mile above the lowest authorized landing minima; whichever is higher.
5. LOWER THAN STANDARD EN ROUTE ALTERNATE AIRPORT WEATHER MINIMA.
Lower than standard en route alternate airport weather minima may be considered for approval for certain operators on a case-bycase basis by the Director, Flight Standards Service, at suitably equipped airports for certain airplanes which have the certificated capability to safely conduct Category II and/or Category III approach and landing operations after encountering any failure 2 Par 3
12-30-88 AC 120-42A Appendix 3 condition in the airframe and/or propulsion systems which would result in a diversion to an en route alternate airport. Subsequent failures during the diversion, which would result in the loss of the capability to safely conduct and complete Category Il and/or Category III approach and landing operations, should be shown to be improbable. The certificated capability of the airplane should be evaluated considering the approved maximum diversion time. Lower than standard en route alternate weather minima may be considered at suitably equipped airports, if appropriate, for those airplanes which have these approved capabilities considering the established maximum diversion time.
6. EN ROUTE ALTERNATE SUITABILITY IN FLIGHT. The suitability of an en route alternate airport for an airplane which encounters a situation inflight which necessitates a diversion, including the provisions of FAR Section 121.565, while en route on an extended range operation is based on a determination that the airport is still suitable for the circumstances, and the weather and field conditions at that airport will permit an instrument approach to be initiated and a landing completed.
Par 5
12-30-88 AC 120-42A Appendix 4 APPENDIX 4. 75, 120, and 180 MIN. ETOPS MAINTENANCE
REQUIREMENTS
1. GENERAL. The maintenance program for airplanes used in 75-, 120-, and 180-minute ETOPS should contain the standards, guidance, and direction necessary to support the intended operations.
Maintenance personnel involved in affecting this program should be made aware of the special nature of ETOPS and have the knowledge, skills and ability to accomplish the requirements of the program.
a. ETOPS Maintenance Program.
(1) Airplane Suitability. The airframe-engine combination being submitted for ETOPS consideration will be reviewed by the FAA, Propulsion System Reliability Assessment Board (PSRAB) and the responsible type certificate holding office. The FAA will review data accrued by the world fleet and the operator from operation of ETOPS candidate airplanes to help establish the operator's capability to conduct ETOPS operations. This candidate airplane should meet the requirements of Paragraph 9 of this advisory circular. The FAA will review data on the airframe-engine combination and identify any conditions that exist which could prevent safe operation.
NOTE: The candidate airplane for a 75-minute diversion time is not required to have achieved a predetermined number of hours or in-flight shutdown rate for this assessment.
(2) Maintenance Program. The basic maintenance program for the airplane being considered for ETOPS is the continuous airworthiness maintenance program currently approved for that operator, for the make and model airframe-engine combination. This program should be reviewed by the PMI to ensure that it provides an adequate basis for development of a supplemental ETOPS maintenance program. ETOPS maintenance requirements will be expressed in, and approved as, supplemental requirements. This should include maintenance procedures to preclude identical action being applied to multiple similar elements in any ETOP critical system (e.g., fuel control change on both engines). This relates to common cause concerns identified in Appendix 1, Paragraph 2. (d).
(i) ETOPS related tasks should be identified on the operator's routine work forms and related instructions.
(ii) ETOPS related procedures, such as involvement of centralized maintenance control, should be clearly defined in the operators program.
(iii) An ETOPS service check should be developed tais beck aid be accomplished and ghettom.
Par 1 1
AC 120-42A 12-30-88 Appendix 4 by an ETOPS qualified maintenance person immediately prior to an ETOPS flight.
of operation (defined in Appendix 5). i Appendi ght in a benton dred for the
(iv) Log books should be reviewed and documented as appropriate to ensure proper MEL procedures, deferred items, maintenance checks and that system verification procedures have been properly performed.
ETOPS Manual. The operator should develop a manual for use by personnel involved in ETOPS. This manual need not be inclusive but should at least reference the maintenance programs and other requirements described by this advisory circular, and clearly indicate where they are located in the operator's manual system. All ETOPS requirements, including supportive programs, procedures, duties, and responsibilities, should be identified and subJect to revision control. This manual should be submitted to the certificate-holding office 60 days before implementation of ETOPS flights.
(4) Oil Consumption Program. The operator's oil consumption program should reflect the manufacturer's recommendations and be sensitive to oil consumption trends.
should consider the amount of oil added at the departing ETOPS stations with reference to the running average consumption; i.e., the monitoring must be continuous up to, and including, oil added at the ETOPS departure station. If oil analysis is meaningful to this make and model, it should be included in the program. If the APU is required for ETOPS operation, it should be added to the oil consumption program.
Engine Condition Monitoring. This program should describe the parameters to be monitored, method of data collection and corrective action process. The program should reflect manufacturer's instructions and industry practice. This monitoring will be used to detect deterioration at an early stage to allow for corrective action before safe operation is effected.
The program should ensure that engine limit margins are maintained so that a prolonged single-engine diversion may be conducted without exceeding approved engine limits (i.e., rotor speeds, exhaust gas temperatures) at all approved power levels and expected environmental conditions. Engine margins preserved through this program should account for the effects of additional engine loading demands (e.g., anti-ice, electrical, etc.) which may be required during the single-engine flight phase associated with the diversion. (See Paragraph 8b(2) (iv).)
2 Par 1
12-30-88 AC 120-42A Appendix 4
(6) Resolution of Airplane Discrepancies. The operator should develop a verification program or procedures should be established to ensure corrective action following an engine shutdown, primary system failure, adverse trends or any prescribed events which require verification flight or other action and establish means to assure their accomplishment. A clear description of who must initiate verification actions and the section or group responsible for the determination of what action is necessary should be identified in the program. Primary systems, like APU, or conditions requiring verification actions should be described in the operators ETOPS maintenance manual.
(7) Reliability Program. An ETOPS reliability program should be developed or the existing reliability program supplemented. This program should be designed with early identification and prevention of ETOPS related problems as the primary goal. The program should be event-orientated and incorporate reporting procedures for significant events detrimental to ETOPS flights. This information should be readily available for use by the operator and FAA to help establish that the reliability level is adequate, and to assess the operator's competence and capability to safely continue ETOPS. The FAA certificate-holding district office should be notified within 72 hours of events reportable through this program.
(i) Besides the items required to be reported by Section 21.3 and 121.703 of the FARs, the following items should also be included:
(A) In-flight shutdowns.
(B) Diversion or turnback.
(C) Uncommanded power changes or surges.
(D) Inability to control the engine or obtain desired power.
(E) Problems with systems critical to ETOPS.
(F) Any other event detrimental to ETOPS.
(ii) The report should identify the following.
(A) Airplane identification (type and N-Number).
(B) Engine identification (make and serial number).
(C) Total time, cycles, and time since last shop visit.
Par 1
AC 120-42A 12-30-88 Appendix 4 (D) For systems, time since overhaul or last inspection of the discrepant unit.
(E) Phase of flight.
(F) Corrective action.
(8) Propulsion System Monitoring. Firm criteria should be established as to what action is to be taken when adverse trends in propulsion system conditions are detected. When the propulsion system IFSD (computed on a 12-month rolling average) exceeds . 05/1000 engine hours for a 120-minute operation, or exceeds .03/1000 engine hours for a 180-minute operation, an immediate evaluation should be accomplished by the operator and certificateholding district office with consultation of the PSRAB. A report of problems identified and corrective actions taken will be forwarded to the Director, Flight Standards Service. With advice of the PSRAB, additional corrective action or operational restriction may be recommended.
Maintenance Training. The maintenance training program should focus on the special nature of ETOPS. This program should be included in the normal maintenance training program.
goal of this program is to ensure that all personnel involved in ETOPS are provided the necessary training so that the ETOPS programs are properly accomplished and to emphasize the special nature of ETOPS maintenance requirements. Qualified maintenance personnel are those that have completed the operator's extended range training program and have satisfactorily performed extended range tasks under the direct supervision of a FAA certificated maintenance person; who has had previous experience with maintaining the particular make and model aircraft being utilized under the operator's maintenance program.
ETOPS Parts Control. The operator should develop a parts control program that ensures the proper parts and configuration are maintained for ETOPS. The program includes verification that parts placed on ETOPS airplanes during parts borrowing or pooling arrangements, as well as those parts used aiter repair or overhaul, maintain the necessary ETOPS configuration for that airplane.
4 Par 1
12-30-88 AC 120-42A Appendix 5 APPENDIX 5. ETOPS OPERATIONAL PROGRAM CRITERIA GENERAL. Paragraphs 10.a. through 10.h. of this AC detail the criteria for operational approval of extended range operations with a maximum diversion time of 120 minutes to an en route alternate (at approved single-engine inoperative cruise speed). This appendix serves the function of differentiating the criteria for approval of operations less than 120 minutes (75 minutes) and beyond 120 minutes (180 minutes). For approval of 75-minute operations, not all of the requirements of the basic AC need necessarily be met. For approval of 180 minute operations, all of the requirements of the basic AC must be met along with the requirements identified in the Appendix as necessary for 180-minute operations.
2. 75-MINUTE OPERATION. Deviations to Section 121.161 of the FAR were granted to conduct 75-minute ETOPS in the Western Atlantic Caribbean Sea in 1977. Due to the benign nature of the area of operation, the criteria for type design, maintenance, and operational programs were less stringent than that contained in AC 120-42. Experience has shown that operations have been conducted safely and successfully since that time. In 1987, deviation to FAR Section 121.161 was granted to conduct 75-minute ETOPS in the North Atlantic. Due to more demanding area of operations, maintenance and operational programs which met the criteria of AC 120-42 were applied. The Type Design ETOP approval criteria were not required; however, the airframe-engine combination was reviewed prior to approval. Operations have been conducted successfully. The criteria detailed below are the basis for evaluating different areas of operation and requirement for approving 75-minute operation.
a. Benign Area of Operation. To be defined as a benign area of operation, the following considerations should apply:
(1) Numerous adequate airports.
A high level of reliability and availability are required of communications, navigation, and ATC services and facilities.
(3) Prevailing weather conditions are stable and generally do not approach extremes in temperature, wind, ceiling, and visibility.
b. Criteria for Deviation to Operate in a Benign Area of Operation.
(1) Type Design. The airframe-engine combination should be reviewed to determine if there are any factors which would effect safe conduct of operations. Type design ETOP approval criteria are not necessarily required.
Par 1 1
AC 120-42A 12-30-88 Appendix 5
(2) Maintenance programs should follow the guidance in Appendix 4 for 75-minute programs.
(3) Operational Programs.
(i) Minimum Equipment List. Provision of the FAA MMEL, excluding "Extended Range" provisos, apply.
(ii) Dispatch limitations. Flight should be operated at a weight that permits the flight, at approved one-engine inoperative cruise speed and power setting, to maintain flight altitude at or above the Minimum En route Altitude.
C. Demanding Area of Operation. A demanding area of operations for the purpose of 75-minute approval has one or more of the following characteristics:
1h with temperate (1) Weather. Prevailing weather conditions can approach extremes in winds, temperature, ceiling, and visibility for protracted periods of time.
(2) Alternates. Adequate airports are not numerous.
(3) Due to remote or overwater area, a high level of reliability and availability of communications, navigation, and ATC facilities services may not exist.
d. Criteria for Deviation to Operate in a Demanding Area of Operation Type Design. The airframe-engine combination should be reviewed to determine any factors which could effect safe operations in the demanding area of operations. Type design ETOP approval criteria are not necessarily required.
(2) Maintenance programs should be instituted which follow the guidance in Appendix 4 for 120-minute operation.
(3) Operation programs should be instituted which follow the guidance contained in this AC for 120-minute programs.
3. 180-MINUTE OPERATION. Each operator requesting approval to conduct extended range operations beyond 120 minutes should have approximately 12 consecutive months of operational inservice experience with the specified ETOPs configured airframe-engine combination in the conduct of 120-minute operations.
substitution of inservice experience which is equivalent to the actual conduct of 120 operators will be established by the Director, Flight Standards Service, on a case-by-case basis. Prior to approval, the operator's capability to conduct operations and implement effective ETOP programs in accordance with the criteria detailed in Paragraph 10 of this advisory circular will be 2 Par 2