So far
As described in FAR 121.161, commercial twinjet flight operations must remain within one hour of an adequate airport at all times, based on the aircraft's normal one-engine-inoperative cruise speed in still air. In order to utilize routes at greater distances from alternate fields, Part 121 airline operators must receive extended-range twin-engine operation (ETOPS) authority. Twinjets may be approved for 75-, 120-, or 180-minute ETOPS flights, based on criteria set forth in FAA Advisory Circular AC120-42A. Recently, Boeing's 777 aircraft was approved to fly Pacific ETOPS segments as much as 207 minutes from an adequate alternate airport under certain circumstances (although the majority of 777 Pacific ETOPS flights still must observe the 180-minute rule).
Aircraft manufacturers can seek ETOPS approval for Transport category twinjets certified under FAR Part 25. Certification is granted on a case-by-case basis for each specific aircraft type and engine model combination. Additionally, each U.S. airline operator intending to fly ETOPS flight segments must seek FAA approval to do so. Part 91 twinjet operators do not require ETOPS authority, although some long-range business jets like the Bombardier Global Express have been certified to ETOPS standards.
The current 60-minute rule for non-ETOPS twin-engine flights had its genesis in the mid-1930s, when airliners had propellers and engine reliability was not as good as it is today. Airline flights, regardless of the terrain over which they flew, had to remain within 100 miles of a suitable airport. Eventually this limitation was relaxed to one hour from a suitable airport, based in part on the perceived low risk of losing an aircraft due to independent, unrelated failure of both engines. This was (and is still) considered highly unlikely.
For years, ETOPS has been controversial. It remains so, with several airline pilot groups taking different sides over whether or not to support the latest ETOPS extension for the 777. The question remains: Is flying a modern twinjet on remote routes any less safe than using a three- or four-engine aircraft instead?
According to supporters, twinjet ETOPS flights are actually safer bets for a variety of reasons. Why? Technology improvements in both aircraft and engines, more subsystems redundancy for ETOPS aircraft, lower overall accident rates for newer twinjets, and specialized ETOPS operating and maintenance procedures that reduce the chance of having a serious malfunction in the first place.
The process by which the FAA grants ETOPS authority to aircraft manufacturers and operators is a rigorous one. The engines must have a demonstrated inflight service shutdown rate (IFSD) — an engine shutdown in flight for any reason — no greater than two to five shutdowns per 100,000 flight hours for the particular airframe installation. Each higher level of ETOPS authority requires a correspondingly better IFSD rate.
But it isn't only engine reliability that is considered in judging an aircraft ETOPS-worthy. The aircraft itself needs systems redundancy and reliability levels that are generally higher than for a non-ETOPS counterpart. Any imaginable systems failure or series of failures "not shown to be extremely improbable" must be protected against. Although this is a guiding principle in certifying all Transport category aircraft, the test of what is "extremely improbable" is more rigorous for ETOPS aircraft, and redundancy levels are higher.
For example, there must be three independent sources of AC electrical power, any one of which can supply critical electrical needs for the entire 75, 120, or 180 minutes of ETOPS divert time. Non-ETOPS twinjets remaining within one hour of a suitable alternate would require only two AC sources, plus a 30-minute emergency-power battery backup. Cargo fire detection and suppression systems must be capable of initially fighting a fire, then keeping it suppressed for the maximum allowable divert time (i.e., 180 minutes), plus another 15 minutes to allow for holding, shooting an approach, and landing. Other typical systems enhancements include increased passenger/crew oxygen supplies (should redundant cabin pressurization systems fail), more reliable avionics equipment, cooling, and auxiliary power units with better high-altitude cold-soaked start-and-run characteristics.
The aircraft operator must meet a host of additional ETOPS-specific requirements, including specialized crew training, maintenance procedures, and record keeping. The operator is usually required to amass a sufficient level of experience with a particular aircraft and engine type prior to using it on ETOPS flight segments. (A new design and test process used in certifying the 777 allowed some operators to bypass the operational experience requirements, letting them use the aircraft on ETOPS segments immediately upon delivery.)
But is all this enough to make an ETOPS flight as safe or safer than the same segment flown using a three- or four-engine jet? Boeing, the company most responsible for leading the charge for ETOPS, says yes, based on jet aircraft and engine technology improvements over older designs.
An ETOPS position paper published by the company in 1990 reviewed large piston-engine reliability data through the early 1950s, when the 60-minute rule was first formulated. It concluded that the probability of a large reciprocating engine failure increases exponentially as more power is extracted from an engine of a given size (operated at higher RPM), or as the size of the engine increases. For instance, a 3,500-horsepower engine would have a risk of failure nearly nine times that of a 1,000-hp engine. Thus, a transport aircraft design requiring a total of 6,000 hp would be safer if it used four 1,500-hp piston engines, instead of two 3,000 hp engines.
Worldwide airline accident data during the period 1946 through 1952 backs this up. Two-engine, piston-powered airliners experienced a propulsion-related accident rate that was 1.86 times higher than that of four-engine, piston-powered aircraft. Boeing concluded that for twin-engine, piston-powered transport aircraft, the 60-minute rule made sense.
The same Boeing report looked at 30 years of operational jet aircraft experience (1959 through 1989), and concluded that jets have altogether different safety dynamics. For one thing, jet engine size and power ratings have no discernable effect on engine failure rates. For another, overall jet engine failure rates are much lower than large piston-engine rates. Jet engine reliability was in fact shown to be 10 times better than that of large piston engines of the 1950s. More important, the total jet fleet propulsion-related accident rate was nearly 60 times better than the piston-powered airline fleet rate. (This is, in part, because crew procedures for dealing with an engine failure are simpler in a jet.)
Boeing also cited lower overall accident rates from all causes for twinjets produced since 1970, compared to either three- or four-engine jet aircraft. And newer twinjets such as the Airbus A310 or later-model Boeing 737s have accident rates that are only a small fraction of rates for first-generation four-engine jet transports such as the Boeing 707 or Douglas DC-8.
But jet engines still fail. Boeing pointed to a NASA study that looked at 513 worldwide jet aircraft accidents that occurred from 1966 through 1976. Of the total, 55 were attributed to powerplant malfunctions. From these were developed the probability models used to define the statistical risk of engine failure on ETOPS flights. How each engine malfunction led to an accident was important in assessing the ETOPS risk.
The most dangerous kind proved to be an uncontained engine failure that resulted in other aircraft damage. A whopping 75 percent (41) of all propulsion-related accidents fell into this category. This is significant, because for this category of accident, the more engines an airplane has, the higher its risk factor. For all two-, three-, and four-engine types combined, the chance of such a mishap was calculated on the order of two in 10 million. For twinjets alone, it was considerably lower.
The next biggest cause of engine- related accidents was an engine malfunction made worse by crew error. In these, a single malfunction that should not have caused an accident in the first place was worsened by the crew's response. The risk probability for this accident type was calculated as being one in 10 million.
Common-cause multiple engine failures, such as fuel starvation or weather-induced flameout of all engines, made up a distant third largest category. The chance of an accident's occurring from a common-cause loss of all engines was calculated to be far more remote, on the order of three in 100 million.
Especially relevant to ETOPS flights were accidents caused by failure of multiple engines due to independent, unrelated causes. Significantly, no two- or three- engine aircraft in the NASA study were lost for this reason. (In fact, the only two accidents found in this category during the entire first 30 years of jet transport operation involved four-engine aircraft.) The chance of this happening again during the ETOPS portion of a flight was calculated to be in the slim-to-none category, or somewhere between one in 100 million to one in one billion.
Boeing next looked at phase of flight. More than 80 percent of hull-loss accidents were associated with takeoff, approach, and landing, even though they accounted for only about 17 percent of a typical flight. Just five percent of accidents involved the more benign cruise phase, although it constitutes 60 percent of flight time. To further place it in context, the ETOPS portion of flight is often just a small part of the total cruise phase.
Boeing's arguments proved persuasive, but have they proved justified? Since 1985, when 767s first began North Atlantic ETOPS flights, reliability has hovered around 99.9 percent. Many crews have safely turned back or diverted for a variety of reasons, including engine failure. But many hundreds of thousands of ETOPS flights have operated without a hitch. No aircraft has been lost during the ETOPS phase of flight because of engine failure, and most North Atlantic airline flights today are routinely operated with twinjets. ETOPS, it can be said, has succeeded swimmingly.
Links to previous articles about ETOPS may be found on AOPA Online ( www.aopa.org/pilot/links/links9908.shtml).
Related Articles
