Getting To Grips With ETOPS Vol I
Getting To Grips With ETOPS Vol I
Getting To Grips With ETOPS Vol I
1
Getting to Grips with ETOPS:
Certification and Approval
2
Getting to Grips with ETOPS: Table of Content
Certification and Approval
Table of Content
Table of contents
TABLE OF CONTENT ......................................................................................................................................3
1 FOREWORD ...........................................................................................................................................5
2 INTRODUCTION .....................................................................................................................................6
3
Getting to Grips with ETOPS: Table of Content
Certification and Approval
4.1 INTRODUCTION.................................................................................................................. 35
4
Getting to Grips with ETOPS: Foreword
Certification and Approval
1 FOREWORD
This “Getting to Grips with ETOPS” is divided into three volumes:
• Volume I: Certification and Approval, this very volume. Its main objective is to provide
recommendations that satisfy the Extended Twin OPerationS (ETOPS) operational, and
reliability requirements, in order for an airline to obtain the necessary approvals from the
presiding National Airworthiness Authorities.
• Volume II: The Flight Operations View. This volume expands on the specificities of
ETOPS flight operations, and describes the preparation, dispatch, and execution of an
ETOPS flight. Volume I provides an introduction to these specificities.
• Volume III: The Maintenance View. This last volume expands on the maintenance
aspects associated with ETOPS. Volume I provides an introduction to these specificities.
The purpose of this publication is to provide Operators with the Airbus interpretation of the
applicable ETOPS regulations, and of the associated guidelines, and recommendations.
If any deviation appears between the information provided in this brochure and that published
in the applicable reference documents (Configuration, Maintenance, and Procedures (CMP),
Aircraft Flight Manual (AFM), and Master Minimum Equipment List (MMEL)), the information
provided in CMP, AFM, and MMEL shall prevail at all times, unless otherwise stated by Airbus
ETOPS/EDTO group, and an agreement is obtained from the local regulatory authorities.
All recommendations comply with the current regulatory requirements, and are intended to
assist the Operators in maximizing the safety, and cost effectiveness of their ETOPS
operations.
All brochure holders and users are encouraged to forward their questions and suggestions to
the AIRBUS contacts of the “6.3 HOW CAN AIRBUS ASSIST YOU?” section.
5
Getting to Grips with ETOPS: Introduction
Certification and Approval
2 INTRODUCTION
2.1 BACKGROUND INFORMATION
ETOPS is an acronym that was created by the International Civil Aviation Organization (ICAO).
It was first used to describe the operation of a twin-engine aircraft over a route that contains a
point beyond a defined threshold from an adequate airport.
• This threshold is defined by the Operator’s National Airworthiness Authorities (NAA), and
is usually set to one hour (60 min) flying time, at the approved one-engine inoperative
cruise speed. A maximum diversion time is also introduced: It defines an area of
operation, along the intended route.
• An adequate airport is an airport, expected to be available, where the landing
performance requirements at the forecasted landing weight can be met. The airport also
has the necessary facilities and services like air traffic services, lighting, communications,
meteorological services, navigation aids, rescue and fire-fighting services, and at least
one appropriate instrument approach procedure usable by the aircraft.
6
Getting to Grips with ETOPS: Introduction
Certification and Approval
ETOPS regulations are applicable to routes over not only water, but also remote l, and areas
like Siberia or Africa at night.
Modern twin-jet aircraft are much more capable and reliable than aircraft from previous
generations. Their development has required the rewriting of some of the rules governing the
aviation world to take into account these new capabilities. The civil aviation regulatory
authorities have responded favorably to these technological and safety advances, and have
worked with the industry to create new sets of rules. The purpose of ETOPS is very clear: It is
to provide a very high level of safety while facilitating the use of twin-jet aircraft on routes that
were previously restricted to three and four-engine aircraft.
To operate an aircraft under ETOPS regulations, an airline must comply with all of the
following requirements:
• The aircraft model is approved for ETOPS by the NAA of the manufacturer, and this
approval has been validated by the NAA of the airline
• The aircraft used on that route are configured, maintained, and operated as per ETOPS
requirements
• The NAA of the airline has granted it an ETOPS operational approval.
ETOPS regulations and requirements are detailed in the following chapters.
2.2 HISTORY
Ever since aviation was born, Humans have tried to fly further and further away from their
departure points. The hundreds of yards of the Wright brothers have evolved, with time, into
thousands of nautical miles.
There is an extensive history in the evolution of the rules that led to ETOPS operations. These
operations are not as recent as one would think: The first one took place in 1919 when two
Britons, Captain J. ALCOCK, and Lieutenant A. W. BROWN, crossed the Atlantic, eastward, in
a twin-engine Vickers Vimy, eventually “landing ” in an Irish peat bog after a sixteen-hour flight.
7
Getting to Grips with ETOPS: Introduction
Certification and Approval
Notice how large these aircraft were: They were so huge that no runways existed at the time to
accommodate them, hence the need for seaplanes. But these behemoths would barely survive
WWII, and disappear soon after…
The Laté 631 was one of the last survivors. She had a wingspan of approximately 57 m, was
powered by 6 Wright R2600 (1 500 hp each), had an average Takeoff Weight (TOW) of 71 T,
and a range of 3 750 nm for a maximum of 46 passengers, and a crew of 5.
The seaplanes were replaced by slightly smaller, but more capable aircraft (Both in terms of
range, and payload), like the Douglas DC-4.
.
A Douglas DC-4 from American Airlines System
The initial "60-minute rule" was established in 1953. This rule applied to all types of aircraft,
regardless of their number of engines: All operations were restricted to an en-route area-of-
operation that was within 100 nm of an adequate airport. In those days, for many aircraft, 100
nm roughly corresponded to a 60-minute flying time with one engine inoperative. The rule
focused on the poor reliability of the piston engines that were available at the time. Its purpose
was to limit the required flying time to reach an alternate airport, and hence reduce the risk of a
catastrophe by lowering, to an acceptable level, the probability that all engines would fail. In
other words, the low reliability level of piston engines required that aircraft remain within 60
minutes of an adequate airport to ensure that, if one engine failed at any point along the route,
the aircraft could land before the remaining engine failed. But the rule was flexible: It
authorized operations beyond these 60 minutes, if a special approval was granted by the
administrator. This special approval was based on the Operator’s experience, the type of
terrain, the type of operations, and the performance of the aircraft to be used. There was no
regulatory upper limit to this special approval. This rule was also applied to three-engine
aircraft, until 1964.
Also in 1953, the ICAO Standing Committee on aircraft performance reviewed piston-engine
reliability data. The following chart, extracted from the committee report, provides the
probability of failure for piston engines vs. power at a constant engine speed of 1 000 rpm:
8
Getting to Grips with ETOPS: Introduction
Certification and Approval
FAILURE PROBABILITY
INCREASES WITH POWER
The chart indicates that the probability of failure increased with power: For an aircraft that
required 6 000 horsepower to complete a mission, a twin-engine aircraft had an engine failure
probability of 13.68 (2 x 6.84), while a four-engine aircraft had a failure probability of 8.12 (4 x
2.03).
Following this reliability review, the ICAO published a recommendation stating that a 90-minute
diversion time, at all engine operating speed, was acceptable for all aircraft. The more flexible
ICAO recommendation was selected by many non-US regulatory authorities, and many non-
US airlines started to operate their twin-engine aircraft under this rule. However, at that time,
four-engine aircraft were the queens of the sky, and twin-engine aircraft were mostly relegated
to short, and medium range operations.
9
Getting to Grips with ETOPS: Introduction
Certification and Approval
Therefore, for commercial operations, the twin-engine aircraft remained limited to the above-
mentioned 60-minute threshold. This era was also the beginning of the end of the big radials:
In the 1950s the first jet-powered commercial aircraft, like the de Havilland Comet, started
gracing the skies.
The operational experience acquired with these jet engines of the first generation, over the last
50 years, has demonstrated that they can achieve very high levels of reliability. Statistics
indicate that jet engines are much more reliable than piston engines, and propulsion-related
accidents have been significantly reduced when compared to piston-engine aircraft.
2.2.3 High-bypass Engines, and Wide-body Twin Aircraft
By the early 1980s, great advances had been made in the aircraft operational environment,
design reliability, and integrity. These advances were based on the highly satisfactory
experience of the first generation of jet engines, and the knowledge gained from the
operational introduction of the Pratt & Whitney JT9D, the General Electric CF6, and the Rolls-
Royce RB211 large high-bypass engines.
The Operators could see the advantage of operating their twin-jets in accordance with ICAO
rules, on routes where, by the old rules, they were forced to use three and four-engine aircraft.
One example of these new twin-jet aircraft was the A300B2/B4, that was also the first twin-aisle
10
Getting to Grips with ETOPS: Introduction
Certification and Approval
twin-jet aircraft, usable on routes up to 90-minute maximum diversion time, e.g. across the
Caribbean Sea or the Indian Ocean.
In addition, in these nearly 40 years, jet operations have demonstrated that, contrary to piston
engines, the failure probability of a jet engine is neither affected by the thrust nor by the size of
the engine. The failure rates of some of the large high-bypass engines are similar to the JT8D
failure rate, and are nearly ten times better than piston engines. Therefore, now, the probability
of an engine failure is higher on a quad-jet than on a twin-jet.
11
Getting to Grips with ETOPS: Introduction
Certification and Approval
Several other civil aviation regulatory authorities also published ETOPS criteria including the
Civil Aviation Administration (CAA) - UK, Direction Générale de l’Aviation Civile (DGAC) -
France, Transport Canada, Department of Transport (DOT) - Australia, and CAA - New
Zealand, during the same time period. Many other countries relied on the guidance provided in
the ETOPS amendments to ICAO Annex 6.
12
Getting to Grips with ETOPS: Introduction
Certification and Approval
The FAA published AC 120-42 "A" on December 30, 1988, that provided the criteria for 75-
minute, 120-minute, and 180-minute operations. On January 18, 1989, the FAA approved the
first 180-minute ETOPS operation. Since then, ETOPS operations have continuously
increased on the North Atlantic routes where, actually, more twin-jets are flying than tris or
quads, as well as on most long range routes across, and between the five continents.
In 1993, the European Joint Airworthiness Authorities (JAA) developed their own criteria,
Information Letter (IL) 20/Advisory Material Joint (AMJ) 120-42, that combined the best points
from the individual European rules, and from the FAA criteria.
13
Getting to Grips with ETOPS: Introduction
Certification and Approval
In 2007, the FAA published a new ExTended OPerationS (ETOPS) regulation, based on the
previous ETOPS, but also applicable to tris, and quads. The Civil Aviation Safety Authority
(CASA) from Australia then published a new regulation named Extended Diversion Time
Operations (EDTO), also applicable to tris, and quads. The ICAO followed soon after, and
created a special operations task force to make new recommendations, also taking into
account tris, and quads.
In 2010, based on the latest evolutions of the industry and the demonstrated safety of 180-
minute ETOPS, the European Aviation Safety Agency (EASA), that replaced the JAA,
published a new set of criteria, the Acceptable Means of Compliance (AMC) 20-6 Rev 2. This
AMC provides the criteria that Operators and Manufacturers should apply to get approvals for
diversion times exceeding 180 minutes (Also known as “Beyond 180 min”). AMC 20-6 Rev 2 is
applicable only to twin-jets, and is still applicable at the time this brochure is published.
These new ETOPS rules also clarify, and provide more formal definitions of exemptions like
the increase of the maximum diversion time to 207 min for NOrthern PACific (NOPAC)
operations.
2.2.7 Development of Modern ETOPS Aircraft
The success of ETOPS operations, the safety benefits associated with the ETOPS-led
designs, and the large economic benefits provided to ETOPS Operators have had a powerful
effect on the design of all modern twin-jets. Thanks to ETOPS operations, it is now
economically feasible to build very large twin-jets. These new aircraft, like the Airbus A330 and
the Airbus A350XWB, have even better safety features, and higher operating performances
than comparable tris, and quads. In addition, these new aircraft have a better range than
previous generations and can operate on Polar routes and routes in some remote areas of the
southern hemisphere. In fact, these new aircraft have been the driving force behind the new
“Beyond 180 min” rule.
14
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
3 ETOPS REGULATIONS
3.1 OBJECTIVES AND CONCEPT
3.1.1 Objectives
The main objectives of the initial ETOPS rules, back in 1985, were:
• “Ensure an overall level of operational safety consistent with that of modern three-,
and four-engine aircraft”
The design of an ETOPS twin-jet must ensure that the operation of the said twin-jet is, at
least, as safe as a tri- or a quad-jet used on the same route. Let us use the engines as an
example.
Aircraft engines do not only produce thrust. They are also a source for the electrical,
hydraulic, and pneumatic systems of the aircraft. Here are two aircraft designed without
any ETOPS constraints:
15
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
In order to comply with ETOPS requirements, the twin-jets are equipped with an
additional electrical generator to cope with the possible loss of an engine. This additional
generator can be the generator of the APU:
But ETOPS does not cover only the electrical system: Other aircraft systems are
designed to comply with ETOPS requirements. They are:
o The FIRE system (ATA 26)
o The FUEL system (ATA 28)
o The HYDRAULIC system (ATA 29)
o The ANTI-ICE system (ATA 30)
o The PNEUMATIC system (ATA 36), etc.
In addition, ETOPS-capable aircraft have more reliable, and/or redundant systems:
o The engines, and the APU are continuously monitored by maintenance teams,
in order to assess their reliability
o The fire system does not cover only the engines or the APU: The cargo holds
also have a dedicated fire protection that can control a fire for the entire
duration of the diversion, plus an additional 15 minutes
o These reliabilities and redundancies minimize the crew workload, even in the
case of a failure.
However, these redundancies have one drawback: The consequence of a simultaneous
maintenance error on parallel systems can affect safety.
ETOPS do not address only the design of aircraft systems. These regulations also take
the following operational considerations into account:
o The flight crew must always know the weather conditions at each alternate
airport along the route
o There must be sufficient fuel onboard, at departure, to reach an alternate
airport, even if the worst scenario unfolds.
16
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
3.1.2 Concept
These objectives are still in force today. In order to satisfy them, the ETOPS concept,
implemented nearly 30 years ago, has not changed. It can be summarized by the following
words: Preclude, and protect the diversion.
• Preclude
In order to ensure the highest level of safety for operations, diversions have to be
precluded, as much as possible. To preclude diversions, aircraft manufacturers and
Operators must apply both of the following:
o First, the manufacturer must design a reliable aircraft. As already mentioned,
the design includes not only the airframe, but also the engines, and aircraft
systems. This reliable aircraft design must minimize the occurrence of failures.
This is demonstrated by the manufacturer, with the ETOPS Type Design &
Reliability Approval (Certification) of the aircraft.
o Second, the Operator must maintain this high level of reliability via the following
actions:
The implementation of specific maintenance precautions, and of
conservative practices, like avoiding simultaneous maintenance actions
on parallel systems
The demonstration of its readiness to operate under ETOPS regulations.
These actions are necessary to grant the ETOPS Operational Approval to the
Operator.
• Protect
If a diversion cannot be avoided, it must be performed in the safest way possible. This is
also achieved in two steps:
o First, the manufacturer must implement the systems and functions required to
ensure a safe diversion and a safe landing.
The manufacturer must ensure a high level of performance for these systems, in
both normal and degraded modes of operation, and demonstrate this
performance to obtain the ETOPS Type Design & Reliability Approval
(Certification) of the aircraft.
o Second, the Operator must be able to cope with adverse operating conditions,
by having operational plans in place, to protect the passengers and crew.
The Operator must demonstrate this ability, in order to obtain the ETOPS
Operational Approval.
Both ETOPS Type Design & Reliability, and ETOPS Operational approvals are necessary to
operate under ETOPS regulations.
3.1.3 ETOPS Significant Systems
For ETOPS, some aircraft systems are very important, in order to preclude and protect the
diversion. They are called ETOPS significant systems. ETOPS regulations define significant
systems, as follows:
• Systems for which a failure may affect the safety of an ETOPS flight (Preclude)
• Systems that must be operative to ensure a safe flight and a safe landing, in the case of a
diversion (Protect).
In fact, the same wording “ETOPS significant systems” is used to cover three different cases:
• Systems that require precautions to avoid multiple maintenance errors
• Systems that require a specific reliability monitoring for ETOPS
• Systems for which a failure must be reported to the Authorities, for safety reasons.
17
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
The Airbus approach is to take into account these three different types of systems:
• Maintenance significant systems, are systems for which it is necessary to apply
specific precautions to avoid multiple human errors (e.g. on these systems, the same
mechanics should not perform a maintenance task on two channels at the same time,
unless a dual verification is performed). This list of maintenance significant system is also
taken into account in the frame of ETOPS Service Check or verification program definition
• ETOPS significant systems, are systems that require an ETOPS reliability monitoring
(Monitoring of the failure rate trend)
• ETOPS report items, are the occurrences related to ETOPS significant systems, for
which the Authorities want a periodic reporting and analysis (Event-oriented reporting of
in-service ETOPS occurrences).
ETOPS significant systems are further categorized into two groups, called Group 1, and Group
2. These groups were introduced both in the new EASA and FAA ETOPS regulations, in
association with the “ETOPS significant system” list.
• Group 1: The identification of ETOPS Group 1 systems is related to the assessment of
the consequence of an engine failure. Therefore, Group 1 systems are typically specific to
twin-engine aircraft compared to four-engine aircraft.
• Group 2: Group 2 systems are usually common to two, three, and four-engine aircraft.
They are not concerned by the additional requirements related to reliability
demonstration, because it is considered that the basic type certification exercise
adequately covers the need. Nevertheless, the consequence of the failure of a Group 2
system would still require to be addressed in the frame of the reliability (And maturity)
demonstration for ETOPS, and any required corrective action could be mandated further
to an assessment of the impact of the concerned system failure on the safety of the flight.
Note: Due to the fact that additional requirements apply to Group 1 systems, this classification is only necessary for
the aircraft manufacturer when conducting the ETOPS reliability demonstrations for an Early ETOPS approval
(See 3.2.2 - ETOPS TYPE DESIGN, AND RELIABILITY APPROVAL - Process, here-below). The objective of
these demonstrations is to validate the reliability of the aircraft at entry into service, in accordance with the early
ETOPS certification process. These reliability demonstrations are required only for ETOPS Group 1 systems.
• For aircraft certified by the FAA before 2007 (e.g. A320, A310, B737, B767, etc.), aircraft
manufacturers should apply AC120-42A. From February, 15, 2007, AC120-42A has been
replaced by the FAA PART 21, 25, and 33 certification rules.
• ICAO Airworthiness manual 9760, and ICAO Standard And Recommended Practices
(SARPs) Annex 8 include additional guidelines.
18
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
In addition, ETOPS certifications granted before the publication of newer ETOPS operational
criteria remain valid. This is further detailed in the regulations themselves. For example, EASA
AMC 20-6 Rev 2, in chapter 1 - section 1, states:
Note: Once granted, the ETOPS Type Design & Reliability Approval can be revoked: An ETOPS Reliability Tracking Board
(ETOPS RTB) performs a continuous monitoring of the reliabilities of aircraft systems, APU and engines. If the
reliabilities do not reach the Airworthiness Authorities expectations, the maximum diversion time can be reduced, or the
ETOPS certification revoked. (Refer to chapter 4: ETOPS RELIABILITY TRACKING BOARD.)
Aircraft manufacturers must obtain the ETOPS Type Design & Reliability Approval before
Operators can apply for the ETOPS Operational Approval.
3.2.2 Process
The manufacturer must demonstrate the compliance of the candidate aircraft with of all the
design provisions, and reliability objectives of the applicable ETOPS rules.
• Design: The certifying Airworthiness Authorities conduct a design review of the aircraft,
based on the certification documents provided by the aircraft manufacturer. They publish
the result of their investigation in a document called Design Compliance Findings.
• Reliability: The ETOPS RTB is initiated during the flight tests of the candidate aircraft. Its
members come from the authorities and from the aircraft, and engine manufacturers. The
purpose of the ETOPS RTB is to review the service data of the aircraft, and amend the
ETOPS requirements of the aircraft, if necessary. The ETOPS RTB continues after the
certification of the aircraft is obtained.
An aircraft manufacturer can obtain the ETOPS certification in one of the following two ways:
• Via an in-service approval, that requires some engine-operation experience on the
candidate aircraft:
o For the EASA: Up to 100 000 engine hours
o For the FAA: Up to 250 000 engine hours.
• Via an early ETOPS approval:
o It enables the aircraft manufacturer to obtain an ETOPS certification with very
little or no previous experience
o It is a process-based approach, that requires extensive maturity, and reliability
demonstrations with the candidate aircraft, for example:
Ground tests: Engines, and APU endurance bench tests (3 000 cycles)
Specific flight tests, with the following scenarios:
• Maximum duration flights
• Maximum duration flights with One Engine Inoperative (OEI),
with simulated diversion scenarios
• Flights performed in degraded system configurations (e.g. single
electrical generator, single engine bleed, etc.)
• Operations and reliability demonstrations.
Lessons learned analysis: The manufacturer demonstrates that the new
aircraft design takes into account previous program Airworthiness
Directives (ADs)
Technical Transfer Analysis: The new aircraft design must take
advantage of technology transfers and experience gained from previous
programs, etc.
o This process involves a close monitoring, by the Authorities, of the reliability
demonstrations.
19
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
The next chapter describes the above-mentioned design requirements and explains the EASA
and FAA differences.
3.2.3 Design Requirements
3.2.3.1 Human Factors and Safety Analyses
The manufacturer must demonstrate that the crew workload is minimized under failure
conditions, for the maximum diversion time/distance. Since the flight crew workload may
increase during a diversion, an assessment is made to ensure that the safety of the flight does
not require more than average piloting skills or crew coordination.
Flight test campaigns are then performed to validate this acceptable flight crew workload, and
the adequacy of the flight crew procedures (Normal, abnormal, and emergency procedures).
The following are examples of flight test scenarios, that combine flights with one engine
inoperative, and system failure simulations:
• Diversion in electrical emergency configuration
• Emergency descent to, and diversion at, Flight Level (FL) 100 or to the Minimum Safety
Altitude (MSA)
• Failure of the autopilot and autothrust, etc.
Safety analyses (Functional Hazard Analyses (FHAs) and System Safety Analyses (SSAs) are
reviewed to define the maximum permissible diversion time. The corresponding time limitation
of the Most Time Limited System (MTLS), other than the Cargo Fire Suppression System, is
then published in the Flight Manual.
The following rule provides the relationship between the maximum permissible diversion time,
and the time limitation of the MTLS:
20
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
sufficient electrical power, in order to ensure the safety of the flight and landing, even
under adverse operating conditions
• In the case of “Beyond 180 min” ETOPS operations:
o For the EASA: A fourth generator is required, unless the aircraft manufacturer
can demonstrate that the loss of the three independent sources is extremely
improbable
o For the FAA: A fourth generator is required to power one cross-feed valve, and
one fuel boost pump in each tank.
On Airbus twin-engine aircraft, the electrical generation is ensured by:
• On A300/A310, A318/A319/A320/A321, and A330 family aircraft:
o Two engine-driven Integrated Drive Generators (IDGs)
o One APU-driven generator (APU GEN)
o One hydraulically-driven Constant Speed Motor/Generator (CSM/G) (Also called
Emer Gen or St, and-by Gen) supplied by the main hydraulic circuit (Green or
blue depending on the aircraft family)
• On the A350:
o Four engine-driven Variable Frequency Generators (VFGs) (That represent the
three independent electrical sources)
o One APU GEN.
The four generators are independent versus any single cause event (local fire,
mechanical damage, uncontained engine failure, etc.) In addition, thanks to the four
independent sources:
o There is no need to start the APU in ETOPS area,
o The dispatch with the APU inoperative may be permitted (MMEL) .
21
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
22
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
• The effect of turbulences, and negative load factors on engine operation must be
evaluated if:
o The fuel boost-pumps are not powered (e.g. limitation in CSM/G configuration),
or
o The loss of all fuel boost-pumps is not classified as “extremely improbable”.
A320 family aircraft are the only Airbus twin-engine aircraft for which a loss of all
fuel boost-pumps is not classified as “extremely improbable”. Flight tests were
performed in order to demonstrate the gravity feeding capabilities of the A320
family aircraft.
In addition, for “Beyond 180 min” ETOPS operations, the FAA requires that:
• An alert appears to inform the flight crew when the available fuel quantity to the engines
goes below the required fuel quantity to fly to the destination. The alert must be triggered
when there is sufficient remaining fuel to safely complete a diversion. It must also
account for abnormal fuel management or transfer between tanks, and possible loss of
fuel.
On the Airbus twins that are qualified for “Beyond 180 min” ETOPS operations, the
following alerts satisfy the above-mentioned FAA requirements:
o A “FUEL FU/FOB DISCREPANCY” ECAM alert. This alert is triggered if there is
a difference between the initial Fuel On-Board (FOB) and the sum of the current
FOB, and Fuel Used (FU). It indicates a possible fuel leak.
o An FMS low fuel alert. This alert is triggered when the Estimated Fuel On-Board
(EFOB) at destination (DEST EFOB) is strictly below the minimum fuel required
to reach the destination (MIN DEST FOB).
By default, MIN DEST FOB is equal to the sum of the alternate (ALTN) and
FINAL fuel quantities (MIN DEST FOB = ALTN + FINAL).
A normal A330 FUEL PRED page that displays the MIN DEST FOB
23
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
The EXTRA fuel quantity is equal to the difference between the DEST EFOB,
and MIN DEST FOB fuel quantities (EXTRA = DEST EFOB - MIN DEST FOB).
Therefore, the alarm is triggered when the EXTRA fuel quantity is negative.
Note: When the alarm is triggered, the remaining fuel quantity is sufficient to complete a diversion.
24
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
• On the A330:
The aircraft is equipped with three independent hydraulic circuits: The GREEN, BLUE
and YELLOW circuits. In normal operations, each engine pressurizes two circuits:
o Engine 1 pressurizes the GREEN and BLUE circuits
o Engine 2 pressurizes the GREEN and YELLOW circuits.
25
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
If one engine fails, only one circuit is lost: e.g. in the case of Engine 1, the BLUE circuit is
lost. The following diagram indicates what are the systems affected by the loss of the
BLUE hydraulic circuit.
Due to the fact that all critical items have a minimum of two hydraulic power sources, only
a few items are lost:
o Flight control system: Only one pair of spoilers (2 and 3) is lost on each wing. All
the other flight controls have multiple power sources
o Brake system: The alternate braking and the parking brake are lost
o Engines: Engine 1 thrust reverser is lost (Only for Rolls Royce and Pratt &
Whitney engines).
This means that the failure of one engine does not cause any loss of critical
items.
26
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
• On the A350:
The aircraft is equipped with two independent hydraulic circuits: The GREEN, and
YELLOW circuits. In normal operations, each engine pressurizes both circuits.
If one engine fails, no circuit is lost, as each circuit is pressurized by two Engine-Driven
Pumps (EDPs), one per engine.
27
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
Notes: 1) The EASA, and the FAA state that a weather radar is necessary, if icing conditions can be encountered.
This weather radar is not required to be available if the aircraft is powered by its CSM/G.
2) The effects of ice accretion on unprotected surfaces must be accounted for (Fuel, performances, etc.)
The manufacturer must demonstrate that the pneumatic system complies with the following
design requirement.
If the aircraft is in electrical emergency configuration, during a diversion with one engine
inoperative, the bleed system must remain operative:
• The cross-bleed valve, and one Bleed Monitoring Computer (BMC) are kept powered
• All detectors (pressure, temperature, overheat, leak, etc.) and valve positions are
maintained
• The pneumatic valve closure behavior remains unchanged.
Note: Parts of this requirement are derived from ATA 21, and ATA 30 requirements. For additional information, please refer to
the above-mentioned ATA chapters.
28
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
Notes: 1) The IFSD target rates depend on the maximum authorized diversion time:
• 0.05/1 000 engine hours for ETOPS 120 min
• 0.02/1 000 engine hours for ETOPS 180 min
• 0.01/1 000 engine hours for “Beyond 180 min” ETOPS.
2) The IFSD target rates are computed, based on world-fleet data, on a 12-month rolling average.
3.3.1 Applicability
The Operator is responsible for obtaining the ETOPS Operational Approval, that is granted by
the Operator’s local NAA. The ETOPS criteria of this local NAA may be different from the
EASA or FAA ones. In order to obtain the ETOPS Operational Approval, the Operator has to
demonstrate its compliance with these requirements. This impacts the entire Operator’s
organization (i.e. flight operations, and maintenance).
But what ETOPS requirements should Operators apply?
Operators should apply the ETOPS requirements that are valid at the time of application for
approval, i.e. as of September 2014:
• For EU-OPS Operators (EASA): AMC 20-6 Rev 2, Chapter III “OPERATIONAL
APPROVAL CONSIDERATIONS”
• For FAR 121 Operators (FAA): AC 120-42B, Chapters 4 & 5
• For CAA Operators: CAP 513
• For DGAC Operators: CTC 20
• For TC Operators: TP6327, etc.
29
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
However, contrary to the ETOPS Type Design & Reliability Approval, the Operator must take
into account, and apply, any update of the original regulation that may appear after the
approval is granted.
Here, again, this approval is subject to a continuous review by the local authority. This ensures
that the Operator achieves and maintains the desired quality levels.
3.3.2 Process
In order to obtain an ETOPS Operational Approval, the Operator must demonstrate that it
correctly manages the required ETOPS processes, i.e. in the fields of flight operations, and
maintenance.
The Operator must prepare the various documents required for the approval:
• The desired Maximum Diversion Time (MDT) that cannot be greater than the certified
maximum authorized ETOPS diversion time of the aircraft model/engine combination
• For the flight operations, an ETOPS manual that contains:
o The necessary ETOPS procedures
o The intended ETOPS area of operation, including the selected ETOPS routes
o The selectable alternate airports
o The recovery plans, if necessary
o The flight planning specificities, like:
The effects of some aircraft system failures on the available flight-time
(The Time Limited Systems (TLS))
A weather study on the intended routes, and selectable alternate
airports, etc.
o The in-flight procedures, also included in the operating manuals, and related to
the following subjects:
Communications,
Flight monitoring,
Decision-making process, to help the flight crew in the case of a
diversion, etc.
• For the maintenance:
o An ETOPS manual that contains:
All ETOPS maintenance procedures
The ETOPS maintenance plan, and the associated software
The ETOPS tasks identification.
o A monitoring program, that takes into account the oil consumptions of the
engines and of the APU, the recording of the in-flight start capabilities of the
APU, and the associated software
o A reliability monitoring program, and the associated software
o An occurrence reporting program, also with the associated software.
The following key personnel from the Operator must be nominated, trained, and be able to
acquire ETOPS experience:
• The ETOPS coordinator
• The check airmen
• The flight crews
• The cabin attendants, if a recovery plan exists
• The dispatchers
• The line maintenance crews.
This full training program must also be documented, and presented to the NAA.
Note that all documents subject to legal approval are signed and stamped by the NAA.
30
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
There are two methods to obtain the ETOPS Operational Approval: The in-service plan, and
the accelerated plan. The Operator selects one plan or the other, depending on its experience
and on the existing time constraints.
3.3.3 The In-Service Plan
This method was previously known as the “Conventional ETOPS”. In order to obtain the
ETOPS Operational Approval via this method, the Operator must have one to two years of in-
service experience with the specific aircraft model/engine combination. The in-service
experience limits the desired MDT, as follows:
• One year of non-ETOPS experience for up to 120 min approval
• One year of 120 min experience for up to 180/240 min approval
• Two years of 240 min experience for “Beyond 240 min” approval.
ETOPS
MDT
(Min)
BEYOND
240
180/240
150
120
90
60
NO ETOPS
0 1 2 3 4 EXPERIENCE
(Year)
The Operator must send an ETOPS application letter to its local NAA at least 3 months before
the planned date for the beginning of ETOPS operations. This letter shall include the following
Operator's ETOPS objectives:
• The intended routes
• The corresponding area of operations
• The desired Maximum Diversion Time
• The applicable fleet
• The planned date for the beginning of ETOPS operations, etc.
The judgment criteria to obtain the approval are simply based on the Operator's in-service
experience with the candidate aircraft model/engine combination. There are no special
strategies to prepare: An action plan will be needed only in case of non-compliance with one of
the NAA criteria.
31
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
ETOPS
MDT
(Min)
BEYOND
240
240
75
60
0 t 1 2 t 3 4 EXPERIENCE
(EIS) +2 years
(Year)
32
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
• In order to achieve 180-minute ETOPS at EIS, the Operator will have to perform
additional simulations, on top of what is needed for 120-minute ETOPS, to compensate
for the lack of required ETOPS experience for the in-service approval.
The Operator must send the ETOPS application letter to its NAA at least 6 months before the
planned date for the beginning of ETOPS operations. The accelerated plan requires a defined
strategy, because the Operator and its NAA must communicate, in order to specify the
compensating factors, and adapt the approval plan to the Operator's experience. The judgment
criteria to obtain the approval are based on facts, and engineering data provided by the
Operator. They are used to determine the ETOPS capability of the candidate aircraft
model/engine combination for the Operator.
3.3.5 Approval
The NAA creates an assessment team, in order to evaluate the Operator’s capability, for one
approval plan or the other. This team has inspectors and pilot-inspectors. These team
members are experts in the following fields:
• Flight Operations
• Maintenance
• Engineering
• Quality.
33
Getting to Grips with ETOPS: The ETOPS Regulations
Certification and Approval
The assessment team will review the data, and documents, called the ETOPS Operational
Compliance Documents, provided by the Operator. They contain:
• The required ETOPS manuals
• The experience records of both the maintenance and flight operations
• The implemented training programs
• The ETOPS simulation reports (If applicable)
• The self-audit reports (If applicable)
• The ETOPS proving-flight report (If applicable).
Based on the ETOPS Operational Compliance Documents and an audit report provided by the
assessment team, the NAA determines if the Operator complies with the ETOPS operational
requirements.
34
Getting to Grips with ETOPS: The ETOPS Reliability Tracking Board
Certification and Approval
As already mentioned, a reliability review process is initiated during the ETOPS Type Design &
Reliability Approval of the aircraft. This process carefully monitors the flight, and system tests
of the candidate aircraft. The manufacturer must demonstrate that various systems of the
aircraft, like the engines or the APU, are at, or above, a required level of reliability. In addition,
after they obtain the ETOPS Type Design & Reliability approval, the manufacturer must
continuously maintain the reliability level of the certified aircraft, via ETOPS Continued
Airworthiness.
The purpose of ETOPS Continued Airworthiness is to monitor the in-service experience that
the aircraft type has acquired since its ETOPS certification, to determine the reliability of the
aircraft systems, APU and engines. The collected data is analyzed by the manufacturer, and
the NAA during ETOPS Reliability Tracking Board (RTB) meetings.
How often are these meetings held? The answer is based on the maturity of the aircraft type:
• For new aircraft types, the RTB meetings are held regularly, usually every 6 months
• For mature aircraft types (i.e. when the NAA states that the reliability indicators are
stable, and that sufficient experience has been accumulated), RTB meetings are
organized, on average, every two years. At the time of writing, the A300, and A310
family, the A320 family, and the A330 are considered as mature aircraft types. For these
aircraft, the RTB meetings are now held only when required (e.g. when a specific
reliability issue occurs, when a complex certification is faced, etc.), however, reliability
reports are produced on a regular basis.
4.2.1 Engines
• In order to maintain the ETOPS type certification of an aircraft model/engine
combination, the manufacturer must demonstrate that the IFSD rate of the world-wide
fleet (ETOPS, and non-ETOPS aircraft) remains below a given threshold. The threshold
depends on the granted Maximum Diversion Time:
o 0.05 IFSD rate per 1 000 engine hours for 120 min operations
o 0.02 IFSD rate per 1 000 engine hours for 180 min operations
o 0.01 IFSD rate per 1 000 engine hours for “Beyond 180 min” operations.
Note: The threshold is also used for the initial ETOPS certification of the aircraft model/engine combination.
35
Getting to Grips with ETOPS: The ETOPS Reliability Tracking Board
Certification and Approval
• The ETOPS regulations state that the Operators have to report their In-Flight Shut Down
(IFSD) rate on a regular basis. If this IFSD rate exceeds another defined threshold, the
NAA launch a technical review of the situation. This review may ultimately cause the
suspension of the Operator's ETOPS approval. This threshold also depends on the
Maximum Diversion Time granted:
o 0.05 IFSD rate per 1 000 engine hours for 120 min operations
o 0.03 IFSD rate per 1 000 engine hours for 180 min operations
o 0.02 IFSD rate per 1 000 engine hours for “Beyond 180 min” operations.
Note: If the fleet is too small to be statistically significant (i.e. less than 15 aircraft), the IFSD rate is only used as a
trending mechanism: This rate cannot be used as the only reason to suspend ETOPS operations. The
ETOPS operations are reviewed on an individual event basis.
4.3 OUTCOME
Following an RTB meeting, the ETOPS Configuration, Maintenance, and Procedures (CMP)
document may be revised:
• To include new aircraft models or aircraft modifications that affect ETOPS operations
• To mandate corrective actions
• To update existing corrective actions, etc.
Similar activities are led with the FAA (e.g. in the frame of the FAA ETOPS certification
exercises).
36
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
5 ETOPS DOCUMENTS
5.1 CONFIGURATION, MAINTENANCE AND PROCEDURES DOCUMENT
5.1.1 Introduction
The ETOPS approval is associated with the publication of an ETOPS Configuration,
Maintenance and Procedures (CMP) document. This CMP is certified by the Airworthiness
Authorities (EASA/FAA). For extended range operations, and in accordance with the
applicable operational rules, the CMP defines the following:
• The configuration of the airframe, engines and APU (Lists of Modifications and Service
Bulletins)
• The specific maintenance requirements
• The specific procedures
• The dispatch limitations.
Note: CMP data is also included in the following documentation:
• The MMEL (ETOPS dispatch restrictions)
• The AFM
• The FCOM (ETOPS procedures, single engine speed, ETOPS fuel scenario, etc.)
• The MPD (Specific check intervals for ETOPS)
• The IPC (P/N not approved for ETOPS).
37
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
The following describes the main difference between an EASA CMP and an FAA CMP:
• For the FAA, the original version of the CMP is frozen. Any subsequent revision required
by the reliability monitoring process is addressed via the publication of Airworthiness
Directives (ADs)
• For the EASA, the original version of the CMP is not frozen. CMP revisions can be
initiated each time there is a safety problem or if an evolution is necessary, due to
technical evolutions of the aircraft, modifications of rules or of document references, etc.
This implies that the EASA CMP is always up-to-date. Remember that the ETOPS
approval is not granted forever: it is submitted to a continuous monitoring of the in-
service reliability by the Airworthiness Authorities. This reliability monitoring may result in
changes to the ETOPS standards of the airframe, and/or engines (Service Bulletins,
maintenance actions or operational procedures mandated to restore the reliability).
This Getting to Grips brochure focuses on the EASA CMP.
38
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
39
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
40
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
The list of items included in a specific customized CMP document is provided in the
Table of Content of this customized CMP document.
41
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
42
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
Greater than 180 min Operations “Beyond 180 min” diversion time only
43
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
44
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
45
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
This ETOPS Significant System List is an Airbus recommendation: It is designed to help the
ETOPS Operators to create their own ETOPS Significant Systems list. For example, an
Operator may add other equipment that are deemed important for its ETOPS operations
(Either it is for safety, or for economical reasons). Conversely, an Operator may find the list too
conservative for some ATA chapters: In accordance with its own experience and internal
policies, this Operator can decide to slightly alleviate the content of the Airbus proposed list of
ETOPS Significant Systems.
46
Getting to Grips with ETOPS: The ETOPS Documents
Certification and Approval
47
Getting to Grips with ETOPS: ETOPS and AIRBUS
Certification and Approval
Airbus started working on extended range operations in the mid-seventies with several airlines.
These companies operated A300B2s, and B4s, under the 90-minute ICAO rule, over the North
Atlantic, the Bay of Bengal, and the Indian Ocean.
The first “real” Airbus ETOPS operations started in June 1985: Singapore Airlines started
operating the A310-200 in Asia. In April 1986, PanAm was the first Airbus customer to
inaugurate transatlantic revenue service with A310-200, and A310-300 aircraft. In less than
five years, more than 20 Operators joined the two pioneers in Airbus ETOPS operations.
In March 1990, the A310-324 (PW4000 engines) was the first FADEC engine powered aircraft
to receive ETOPS approval by the FAA. At the same time, the A300B4-605R was the first
Airbus aircraft to get ETOPS approval for 180 minutes diversion time.
By the end of 1991, all A310, and A300-600 were approved for 180 minutes diversion time by
the French DGAC.
In September 1991, the A320 was the first fly-by-wire aircraft to be approved for ETOPS
operations with 120 minutes diversion time.
In April 1994, the A330-301 (CF6-80E1A2 engines) obtained the ETOPS Type Design
Approval from the JAA with 120-minute diversion time. This was the first new aircraft to receive
early ETOPS approval worldwide. In May 1994, Aer Lingus was the first Operator to
inaugurate ETOPS operations over the North Atlantic with this aircraft.
At the same time, the A300-600, equipped with CF6-80C2A5F engines (featuring FADEC),
obtained the ETOPS Type Design Approval (180-minute diversion time) from the JAA at entry
into service.
In 1996, the A330 obtained the ETOPS 180-minute Type Design Approval. At the same time,
the A319, and A321 joined the A320 with their ETOPS 120-minute approvals.
In 2009, the A330 became the first Airbus to be certified for “Beyond 180 min” ETOPS, that
approximately corresponds to 240 minutes.
In 2014, the A350XWB became the first Airbus to be certified for “Beyond 180 min” ETOPS at
EIS, that approximately corresponds to 370 minutes.
48
Getting to Grips with ETOPS: ETOPS and AIRBUS
Certification and Approval
Most Airbus twin-engine aircraft are currently approved for ETOPS. The following tables
provide the Maximum Diversion Time (MDT) for each certified aircraft model/engine
combination, for both the EASA and FAA. In these tables, 180 means that the combination is
certified for up to 180-min diversion time, and >180 means that the combination is certified for
“Beyond 180 min” diversion time.
6.2.1 A300 and A310 Family Aircraft
MDT MDT
Model Basic Intermix
EASA FAA
A300B4-620 JT9D-7R4 H1 - 180 -
A300C4-620 JT9D-7R4 H1 - 180 -
A300-600
A300B4-622 PW4158 - 180 -
PW
A300B4-622R PW4158 - 180 -
A300F4-622R PW4158 - 180 180
A300B4-601 CF6-80C2A1 - 180 -
A300B4-603 CF6-80C2A3 - 180 -
A300B4-605R CF6-80C2A5 - 180 180
A300-600
A300B4-605R CF6-80C2A5F - 180 -
GE
A300C4-605R/F CF6-80C2A5 - 180 -
A300F4-605R CF6-80C2A5F - 180 180
A300F4-608ST CF6-80C2A8 - 180 -
JT9D-7R4 E1 500
A310-221 JT9D-7R4 D1 180 180
JT9D-7R4 E1 600
JT9D-7R4 D1
A310-222 JT9D-7R4 E1 500 180 180
JT9D-7R4 E1 600
A310 JT9D-7R4 D1
A310-222/VAR100 JT9D-7R4 E1 500 180 -
PW JT9D-7R4 E1 600
JT9D-7R4 D1
A310-322 JT9D-7R4 E1 500 180 -
JT9D-7R4 E1 600
49
Getting to Grips with ETOPS: ETOPS and AIRBUS
Certification and Approval
Notes: 1) There are two ETOPS options on A318/A319/A320/A321 aircraft: 120-min, and 180-min ETOPS capabilities.
2) A318, A319, A320, and A321 aircraft are delivered in compliance with the 120-min or 180-min ETOPS configuration
standards, as applicable at time of delivery, only if the related option is selected by the Operator.
50
Getting to Grips with ETOPS: ETOPS and AIRBUS
Certification and Approval
CF6-80E1A4
A330-202 CF6-80E1A2 >180 180
CF6-80E1A4/B
CF6-80E1A4
A330-302 - >180 180
CF6-80E1A4/B
PW4170
A330-223F - 180 -
PW4168A-1D
A330 PW4164
A330-321 - >180 180
PW PW4164-1D
PW4168
A330-322 - >180 180
PW4168-1D
Trent 772B-60
A330-243 - >180 180
Trent 772C-60
Trent 772B-60
A330-243F - 180 -
Trent 772C-60
A330
RR A330-341 Trent 768-60 - >180 180
Trent 772B-60
A330-343 Trent 772-60 >180 180
Trent 772C-60
Notes: 1) All A330 aircraft are delivered in compliance with the 180-min ETOPS configuration standards (Basic aircraft
specification, as applicable at the time of delivery)
2) “Beyond 180 min” ETOPS capability is available as an option
Airbus has created a number of services, in order to assist its customers. These services
range from the usual training courses to consulting services. The following section describes
some examples of these services. Please contact your Airbus representative for additional
information about these services.
51
Getting to Grips with ETOPS: ETOPS and AIRBUS
Certification and Approval
etops-edto.support@airbus.com
52
Getting to Grips with ETOPS: ETOPS and AIRBUS
Certification and Approval
Airbus has created a dedicated ETOPS department. This department is responsible for:
• Acting as a source of expertise on all ETOPS matters, and advising, and/or providing
Operators or Authorities with training courses on ETOPS regulations, organization,
procedures, technical, flight operations and maintenance aspects
• Managing the ETOPS Type Design assessment process under the applicable rules (e.g.
EASA, FAA, etc.)
• Managing the ETOPS continued reliability assessment process
• Preparing the ETOPS Manuals for approval, validation, and publication (ETOPS CMP
document, ETOPS Compliance document, ETOPS Parts List, etc.)
• Preparing or validating Airbus communication, and training material on ETOPS
• Preparing, and implementing assistance programs for ETOPS (Candidate ) Operators to
obtain or restore their operational approval
• Acting on behalf of Airbus (or European industries) in ETOPS rulemaking processes of
all countries or international organizations (Particularly with the EASA, FAA and ICAO).
Information and ETOPS technical documents (Envelope CMPs, Parts Lists, etc.) are available
on AirbusWorld, via the following path:
53