Advisory U.S. Department of Transportation Circular Federal Aviation Administration Subject: EXTENDED RANGE OPERATION Date: 12/30/88 AC No: 120-42A WITH TWO-ENGINE AIRPLANES Initiated by: AFS-210/ Change:
(ETOPS) ANM-270 PURPOSE. This advisory circular (AC) states an acceptable means, but not the only means, for obtaining approval under FAR Section 121.161 for two-engine airplanes to operate over a route that contains a point farther than one hour flying time at the normal one-engine inoperative cruise speed (in still air) from an adequate airport. Specific criteria are included for deviation of 75 minutes, 120 minutes or 180 minutes from an adequate airport.
2. CANCELLATION. AC 120-42, Extended Range Operation With Two- Engine Airplanes, dated June 6, 1985, is canceled.
3. RELATED FAR SECTIONS. Sections 21.3, 25.901, 25.903, 25.1309,
33.19, 33.75, 121.161, 121.197, 121.373, 121.565, and 121.703 of the Federal Aviation Regulations (FAR).
4. DEFINITIONS.
a. Airport.
(1) Adequate. For the purpose of this AC, an adequate airport is an airport certified as an FAR Part 139 airport or is found to be equivalent to FAR Part 139 safety requirements.
(2) Suitable. For the purpose of this AC, a suitable airport is an adequate airport with weather reports, or forecasts, or any combination thereof, indicating that the weather conditions are at or above operating minima, as specified in the operation specifications, and the field condition reports indicate that a safe landing can be accomplished at the time of the intended operation.
Auxiliary Power Units (APU). A gas turbine engine intended. for use as a power source for driving generators, hydraulic pumps, and other airplane accessories and equipment and/or to provide compressed air for airplane pneumatic systems.
(1) An essential APU installation provides the bleed air and/or mechanical power necessary for the dispatch of a transport category airplane for operations other than extended range operations with two-engine airplanes.
AC 120-42A 12-30-88
(2) An APU installation which is intended to serve as one of the three or more independent alternating current (AC) electrical power sources required for extended range operations provides the bleed air or mechanical power necessary for the safe flight of a two-engine transport category airplane approved for extended range operation under a deviation from FAR Section 121.161 and is designed and maintained to provide a level of reliability necessary to perform its intended function.
c. STOPS Configuration Maintenance and Procedures (CMP) Standard. The particular airplane configuration minimum requirements including any special inspection, hardware life ' limits, Master Minimum Equipment List (MMEL) constraints, and maintenance practices found necessary by the FAA to establish the suitability of an airframe-engine combination for extended range operation.
d. Engine. The basic engine assembly as supplied by the engine manufacturer.
e. Extended Range Operations. For the purpose of this AC, extended range operations are those flights conducted over a route that contain a point further than one hour flying time at the approved one-engine inoperative cruise speed (under standard conditions in still air) from an adequate airport.
f. Extended Range Entry Point. The extended range entry point is the point on the aircraft's outbound route which is one-hour flying time at the approved single-engine inoperative cruise speed (under standard conditions in still air) from an adequate airport.
g. Fail-Safe. A design methodology upon which the FAR Part 25 airworthiness standards are based. It requires the effect of failures and combination of failures to be considered in defining a safe design. (Refer to Appendix 2 for a more complete definition of fail-safe design concepts.)
h. In-flight Shutdown (IFSD). When an engine ceases to function in flight and is shutdown, whether self-induced, crew initiated or caused by some other external influence (i.e., IFSD or all causes; for example: due to flameout, internal fallure.
crew-initiated shutoff, foreign object ingestion, icing, inability to obtain and/or control desired thrust, etc.).
i. System. A system includes all elements of equipment necessary for the control and performance of a particular major function. It includes both the equipment specifically provided for the function in question and other basic equipment such as that necessary to supply power for the equipment operation.
(1) Airframe System. Any system on the airplane that is not a part of the propulsion system.
2 Par 4
12-30-88 AC 120-42A
(2) Propulsion System. The airplane propulsion system includes: each component that is necessary for propulsion;
components that effect the control of the major propulsion units;
and components that effect the safe operation of the major
5. DISCUSSION. To be eligible for extended range operations, the specified airframe-engine combination should have been certificated to the airworthiness standards of transport category airplanes and should be evaluated considering the concepts in Paragraph 7, evaluated considering the type design considerations in Paragraph 8, evaluated considering in-service experience discussed in Paragraph 9, and evaluated considering the continuing airworthiness and operational concepts outlined in Paragraph 10.
General. All two-engine airplanes operated under Part 121 are required to comply with FAR 121.161.
Section 121.161 states, (in pertinent part), that unless otherwise authorized by the Administrator, based on the character of the terrain, the kind of operation, or the performance of the airplane to be used, no certificate holder may operate two-engine or three-engine airplanes (except a three-engine turbine powered airplane) over a route that contains a point farther than one hour flying time (in still air at normal cruising speed with one-engine inoperative) from an adequate airport." It is significant to note that this rule is applicable to reciprocating, turbopropeller, turbojet, and turbofan airplanes transiting oceanic areas or routes entirely over land.
b. Background. Although FAR 121.161 requirements evolved during the era of piston-engine airplanes and these requirements are currently applied to turbine-powered airplanes which have significantly better reliability, experience has shown the present rule to be effective and yet flexible enough in its application to accommodate significant improvements in technology. Until recently, little consideration had been given to reexamining the viability of extending the permissible operating range of twoengine turbine powered airplanes, by granting credit for improved reliability due to the limited range/payload capabilities of most of the existing generation of two-engine turbine-powered airplanes.
However, some of the new generation airplanes have a range/payload capability equivalent to many previous generation three- and fourengine airplanes. The demonstrated range/payload capabilities of the new generation airplanes, including their provisions for achieving a higher degree of reliability, clearly indicate there is a need to recognize the capabilities of these airplanes and to establish the conditions under which extended range operations with these airplanes can be safely conducted over oceanic and/or desolate land areas.
Par 4
AC 120-42A 12~30-88
121.161 Historical Basis. FAR Section 121.161 has an extensive historical basis which began as early as 1936. The rule 'in effect in 1936 required the applicant to show, prior to obtaining approval for the operation, that intermediate fields, available for safe takeoff and landings, were located at least at 100 mile intervals along the proposed route. This restriction applied to all airplanes operating under this rule regardless of the terrain or area overflown. Throughout the evolution of the current 121.161 the following factors have remained constant:
The rule has always applied to all areas of operation and has not been limited to overwater operation.
(2) Any additional restrictions imposed or, alternatively, any deviations granted to operate in excess of the basic requirements were based on a finding by the Administrator that adequate safety would be provided in the proposed operation when all factors were considered. This finding was never limited to engine reliability alone.
The airports used in meeting the provisions of the rule must be adequate for the airplane used (i.e., available for safe landings and takeoff with the weights authorized), and In granting a deviation from the time restriction, the Administrator considers the character of the terrain, the kind of operation and the performance of the aircraft, etc.
6. APPLICABILITY. Since large transport category airplanes are certificated in consideration of the operating rule, FAR section 121.161, any consideration for deviation from this operating rule for two-engine airplanes necessitates an evaluation of the type design to determine suitability of that particular airframe-engine combination for the intended operation. This circular provides guidance for obtaining type design, continued airworthiness and operations approval for those two-engine transport category airplanes intended for use in extended range operations. The issuance of this AC is not intended to alter the status of deviations previously approved in accordance with FAR Section 121.161. Although many of the criteria in this AC may be currently incorporated into an operator's approved program for other airplanes or route structures, the unique nature of extended range operations with two-engine airplanes necessitates an evaluation of these operations to ensure that the approved programs are effective. To the extent that changes in the airplane's type design, continued airworthiness, or the operations program are involved as a result of this evaluation, they are approved through the normal approval processes.
7. CONCEPTS. Although it is self-evident that the overall safety of an extended range operation cannot be better than that provided by the reliability of the propulsion systems, some of the factors 4 Par 5
12-30-88 AC 120-42A related to extended range operations are not necessarily obvious.
For example, cargo compartment fire suppression/containment capability could be a significant factor or operational/maintenance practices may invalidate certain determinations made during the airplane type design certification, or the probability of system failures could be a more significant problem than the probability of propulsion system failures. Although engine reliability is a critical factor, it is not the only factor which should be seriously considered in evaluating extended range operations. Any decision relating to extended range operation with two-engine airplanes should also consider the probability of occurrence of any condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions.
The following is provided to define the concepts for evaluating extended range operations with two-engine airplanes. This approach ensures that two-engine airplanes are consistent with the level of safety required for current extended range operations with three and four-engine turbine powered airplanes without unnecessarily restricting operation.
a. Airframe System. A number of airframe systems have an effect on the safety of extended range operations; therefore, the type design certification of the airplane should be reviewed to ensure that the design of these systems are acceptable for the sate conduct of the intended operation.
b. Propulsion System. A review of the historical data (1978 through 1988) for transport aviation two-engine turbofan powered large commercial airplanes indicates that the current safety record, as exemplified by the world accident rate (airworthiness causes), is sustained in part by a propulsion system IFSD rate of only about .02/1000 hours. Although the quality of this safety record is not wholly attributable to the IFSD rate, it is believed that maintaining an IFSD rate of that order is necessary to not adversely impact the world accident rate from airworthiness causes.
Upon further review of the historical data base and in consideration of the required safety of extended range operation, it is necessary that the achieved performance and reliability of the airplane should be shown to be sufficiently high. When considering the impact of increasing diversion time, it must be shown that the operation can be conducted at a level of reliability resulting in no adverse change in risk.
c. Maintenance Reliability Program Definition. Since the quality of maintenance and reliability programs can have an appreciable effect on the reliability of the propulsion system and the airframe systems required for extended range operation, an assessment should be made of the proposed maintenance and reliability program's ability to maintain a satisfactory level of airplane systems reliability for the particular airframe-engine combination.
5 Par 7
12-30-88 AC 120-42A Maintenance and Reliability Program Implementation.
Following a determination that the airframe systems and propulsion systems are designed to be suitable for extended range operations, an indepth review of the applicant's training programs, operations, and maintenance and reliability programs should be accomplished to show ability to achieve and maintain an acceptable level of systems reliability to safely conduct these operations.
e. Human Factors. System failures or malfunctions occurring during extended range operations could affect flightcrew workload and procedures. Although the demands on the flightcrew may increase, an assessment should be made to ensure that exceptional piloting skills or crew coordination are not required.
f. Approval Basis. Each applicant (manufacturer or operator as appropriate) for extended range approval should show that the particular airframe-engine combination is sufficiently reliable.
Systems required for extended range operations should be shown by the manufacturer to be designed to a fail-safe criteria and should be shown by the operator to be continuously maintained and operated at levels of reliability appropriate for the intended operation.
Type Design ETOPS Approval. Preceding the type design approval, the applicant should show that the airframe and propulsion systems for the particular airplane can achieve a sufficiently high level of reliability in service so that safe extended range operations may be conducted. The achievement of the required level of propulsion system reliability is determined in accordance with Appendix 1. (See Paragraph 9.a.) Evidence that the type design of the airplane is suitable for extended range operations is normally reflected by a statement in the FAA-approved Airplane Flight Manual (AFM) and Type Certificate Data sheet or Supplemental Type Certificate (See Paragraph 8.), which specifies the CMP standard requirements for suitability.
(2) Inservice Experience. It is also necessary for each operator desiring approval for extended range operations to show that it has obtained sufficient maintenance and operations experience with that particular airframe-engine combination to safely conduct these operations. (See.Paragraph 9.b.)
(3) Operations Approval. The type design approval does not reflect a continuing airworthiness or operational approval to conduct extended range operations. Therefore, before approval, each operator should demonstrate the ability to maintain and operate the airplane so as to achieve the necessary reliability and to train its personnel to achieve competence in extended range operations. The operational approval to conduct extended range operations is made by amendment to the operator's operations specifications (see Paragraph 10) which includes requisite items provided in the AFM.
6 Par 7
12-30-88 AC 120-42A
(4) Continuing Airworthiness. From time to time, the FAA may require that the type design CMP standard be revised to correct subsequent problems that impede the achievement of the required level of reliability. The FAA will initiate action as necessary to require a CMP standard revision to achieve and maintain desired level of reliability and, therefore, safety of the extended range operation. CMP standards in effect prior to revision will no longer be considered suitable for continued extended range operation.
8. TYPE DESIGN APPROVAL CONSIDERATION. When a two-engine type design airplane is intended to be used in extended range operations, a determination should be made that the design features are suitable for the intended operation. In some cases modifications to systems may be necessary to achieve the desired reliability. The essential airframe systems and the propulsion system for the particular airframe-engine combination should be shown to be designed to a fail-safe criteria and through service experience it must be determined that it can achieve a level of reliability suitable for the intended operation.
Request for Approval. An airplane manufacturer or other civil airworthiness authorities requesting a determination that a particular airframe-engine combination is a suitable type design for extended range operation, should apply to the cognizant type certificate holding aircraft certification office. An operator should apply similarly, except through their certificate holding office. The responsible aircraft certification office will then initiate an assessment of the airframe-engine combination in accordance with Paragraphs 8, 9, and Appendix 1 of this AC.
b. Criteria. The applicant should conduct an evaluation of failures and failure combinations based on engineering and operational consideration as well as acceptable fail-safe methodology. The analysis should consider effects of operations with a single engine, including allowance for additional stress that could result from failure of the first engine. Unless it can be shown that equivalent safety levels are provided or the effects of failure are minor, failure and reliability analysis should be used as guidance in verifying that the proper level of fail-safe design has been provided. The following criteria are applicable to the extended range operation of airplanes with two engines:
(1) Airframe systems should be shown to comply with Section 25.1309, of the Federal Aviation Regulations, Amendment 25-41.
The propulsion systems should be shown to comply with Section 25.901, of the Federal Aviation Regulations, Amendment 25-40.
Par 7
12-30-88 AC 120-42A
(i) Engineering and operational judgment applied in accordance with the guidance outlined in Appendix 1 should be used to show that the propulsion system can achieve the desired level of reliability. This determination of the propulsion system reliability is derived from a world-fleet data base containing all IFSD events, all significant engine reliability problems, and available data on cases of significant loss of thrust, including those where the engine failed or was throttled-back/shut down by the pilot. This determination should take due account of the approved maximum diversion time and rectification of identified engine design problems, as well as events where in-flight starting capability may be degraded.
(il) Contained engine failure, cascading failures, consequential damage or failure of remaining systems or equipment should be assessed in accordance with Section 25.901 of the FARS.
(iii) In addition to the flightcrew fuel management discussed in Paragraph 10.e. (2) (vii), a means should be provided to alert the flightcrew of a low-fuel quantity condition. The alert should commence at a total fuel quantity available condition equivalent to no less than one-half hour operation at maximum continuous power.
It should be shown during type design evaluation that adequate engine limit margins exist (i.e., rotor speed, exhaust gas temperatures) for conducting extended duration singleengine operation during the diversion at all approved power levels and in all expected environmental conditions. This assessment should account for the effects of additional engine loading demands
(e.g., anti-ice, electrical, etc.) which may be necessary during the single-engine flight phase associated with the diversion.
(Reference Appendix 4, Paragraph 1a (5).)
(3) The safety impact of an uncontained engine failure should be assessed in accordance with Sections 25.903, 33.19, and
33.75 of the FAR.
The APU installation, if required for extended range operations, should meet the applicable Part 25 provisions (Subpart E - Powerplant Provisions, through Amendment 25-46) and any additional requirements necessary to demonstrate its ability to perform the intended function as specified by the FAA following a review of the applicant's data. If a certain extended range operation may necessitate in-flight start and run of the APU, it must be substantiated that the APU has adequate reliability for that operation.
(5) Extended duration, single-engine operations should not require exceptional piloting skills and/or crew coordination.
Considering the degradation of the performance of the airplane type with a single-engine inoperative, the increased flightcrew workload, and the malfunction of remaining systems and equipment, 8 Par 8
12-30-88 AC 120-42A the impact on flightcrew procedures should be minimi.ed.
Consideration should also be given to the effects of continued flight with an engine and/or airframe system inoperative on the flightcrew's and passengers' physiological needs (for example, temperature control).
It should be demonstrated for extended duration single-engine operation, that the remaining power (electrical, nydraulic, pneumatic) will continue to be available at levels necessary to permit continued safe flight and landing, and to provide those services necessary for the overall safety of the passengers and crew. Unless it can be shown that cabin pressure can be maintained on single-engine operation at the altitude necessary for continued flight to a suitable airport, oxygen should be available to sustain the passengers and crew for the maximum diversion time.
(7) In the event of any single failure, or any combinatio:
of failures not shown to be extremely improbable, it should be shown that electrical power is provided for essential flight instruments, warning systems, avionics, communications, navigation, required route or destination guidance equipment, supportive systems and/or hardware and any other equipment deemed necessary for extended range operation to continue safe flight and landing at a suitable airport. Information provided to each pilot should be of sufficient accuracy for the intended operation.
(8) Three or more reliable, independent alternating current (AC) electrical power sources should be available.
minimum, each electrical source should be capable of powering the items specified in Paragraphs 8.c.(4) and 8.c. (7). If one or more of the required electrical power sources are provided by an APU, hydraulic system, or ram air turbine, the following criteria apply as appropriate:
The APU when installed, should meet the criteria in Paragraph 8.b. (4).
(ii) The hydraulic power source should be reliable.
To achieve this reliability, it may be necessary to provide two or more independent energy sources (e.g., bleed air from two or more pneumatic sources).
(iii) Ram air turbine (RAT) deployment should be demonstrated to be sufficiently reliable in deployment and use.
The RAT should not require engine dependent power for deployment.
(9) It should be shown that adequate status monitoring information and procedures on all critical systems are available for the flightcrew to make pre-flight, in-flight go/no-go and diversion decisions.
Par 8 9
12-30-88 AC 120-42A Extended range operations are not permitted with time-related cargo fire limitations less than the approved maximum diversion time in still air conditions (including an allowance for 15 minutes holding and an approach and landing) determined by considering other relevant failures, such as an engine inoperative, and combinations of failures not shown to be extremely improbable.
Airframe and propulsion ice protection should be shown to provide adequate capability (aircraft controllability, etc.) for the intended operation. This should account for prolonged exposure to lower altitudes associated with the engineout diversion, cruise, holding, approach and landing.
Although a hardware/design solution to a problem is preferred, if scheduled maintenance, replacement, and/or inspection are utilized to obtain type design approval for extended range operation, then the specific maintenance information should be easily retrievable and clearly referenced and identified in an appropriate maintenance document.
c. Analysis of Failure Effects and Reliability.
General. The analysis and demonstration of airframe and propulsion system failure effects and reliability provided by the applicant should be based on inservice experience as required by Paragraph 9, and the expected longest diversion time for extended range routes likely to be flown with the airplane. If it is necessary in certain failure scenarios to consider less time due to time-limited systems, the next lower time of 75 or 120 minutes will be established as the approved diversion time.
(2) Propulsion Systems.
An assessment of the propulsion systems reliability for particular airframe-engine combinations should be made in accordance with Appendix 1.
(ii) The analysis should consider:
(A) Effects of operation with a singlepropulsion system (i.e. high-power demands, bleed requirements, etc.) and include probable damage that could result from failure of the first engine.
of fuel for propulsion system operation (i.e. crossfeed valve failures, fuel mismanagement, ability to distinguish and isolate leaks, etc.).
(C) Effects of other failures, external conditions, maintenance and crew errors that could jeopardize the operation of the remaining propulsion system should be examined.
10 Par 8
12-30-88 AC 120-42A Effect of inadvertent thrust reverser deployment, if not shown to be extremely improbable (includes design and maintenance).
(3) Hydraulic Power and Flight Control. Consideration of these systems may be combined, since many commercial airplanes have full hydraulically-powered controls. For airplanes with all flight controls being hydraulically powered, evaluation of hydraulic system redundancy should show that single failures or failure combinations not shown to be extremely improbable do not preclude continued safe flight and landing at a suitable airport. As part of this evaluation, the loss of any two hydraulic systems and any engine should be assumed to occur unless it is established during failure evaluation that there are no sources of damage or the location of the damage sources are such that this failure condition will not occur.
(4) Electrical Power. Electric power is provided to a small group of instruments and devices required for continued safe flight and landing, and to a much larger group of instruments and devices needed to allow the flightcrew to cope effectively with adverse operating conditions. Multiple sources (engine driven generators, APU's, etc.) should be provided to meet both the "continued safe flight and landing requirements" and the "adverse conditions requirements as amplified in AC 25.1309-1A. A review should be conducted of fail-safe and redundancy features supported by a statistical analysis considering exposure times established in Paragraph 8.c. (1).
(5) Equipment Cooling. The data should establish that the necessary electronic equipment for extended range operation has the ability to operate acceptably considering failure modes in the cooling system not shown to be extremely improbable. Adequate indication of the proper functioning of the cooling system should be demonstrated to ensure system operation prior to dispatch and during flight.
(6) Cargo Compartment. The cargo compartment design and fire protection system capability (if necessary) should be consistent with the following:
(i) Design. The cargo compartment fire protection system integrity and reliability should be suitable for the intended operation considering fire detection sensors, liner materials, etc.
Fire Protection. An analysis or tests should be conducted to show, considering approved maximum diversion in still air (including an allowance for 15-minute holding and/or approach and land), that the ability of the system to suppress or extinguish fires is adequate to ensure safe flight and landing at a suitable airport.
Par 8 11
AC 120-42A 12-30-88
(7) Communication, Navigation, and Basic Flight Instruments (Altitude, Airspeed, Attitude and Heading).
be shown that, under all combinations of propulsion and/or airframe system failures which are not extremely improbable, reliable communication, sufficiently accurate navigation, basic flight instruments, and any route and destination guidance needed to comply with contingency procedures for intended operation will be available to each pilot.
(8) Cabin Pressurization. A review of fail-safe and redundancy features should show that the loss of cabin pressure is improbable under single-engine operating conditions. FAA- approved airplane performance data should be available to verify the ability to continue safe flight and landing after loss of pressure and subsequent operation at a lower altitude.
(9) Cockpit and Cabin Environment. It should be shown that an adequate cockpit and cabin environment is preserved following all combinations of propulsion and electrical system failures which are not shown to be extremely improbable.
Assessment of Failure Conditions. In assessing the failsafe features and effects of failure conditions, account should be taken of:
(1) The variations in the performance of the system, the probability of the failure(s), the complexity of the crew action, and the type and frequency of the relevant crew training.
Factors alleviating or aggravating the direct effects of the initial failure condition, including consequential or related conditions existing within the airplane which may affect the ability of the crew to deal with direct effects, such as the presence of smoke, airplane accelerations, interruption of air-toground communication, cabin pressurization problems, etc.
A flight test should be conducted by the manufacturer and witnessed by the FAA type certificate holding office to validate expected airplane flying qualities and performance considering engine failure, electrical power losses, etc. The.
adequacy of remaining airplane systems and performance and flightcrew ability to deal with the emergency considering remaining flight deck information will be assessed in all phases of flight and anticipated operating conditions. Depending on the scope, content, and review, by the responsible FAA Aircraft Certification Office, of the manufacturer's data base, this flight test could be used as a means for approving the basic aerodynamic and engine performance data used to establish the airplane performance identified in Paragraph 10.d. (6).
FAA Airplane Assessment Report. The assessment of the reliability of propulsion and airframe systems for a particular
12. Par 8