A new report on long range flights may underplay the hazard of two or more engines lost to the same failure, and of the potential for electrical malfunctions to ignite fires that could spread before a safe landing could be carried out at a divert airfield.
The report is significant for its implications in a number of respects:
- It goes a long way toward cleaning up the regulatory and policy patchwork that has come to characterize ETOPS (extended range twin-engine operations),
- It places three and four-engine aircraft under many of the same protocols applied to twinjets for ETOPS flights, to include requiring fire suppression sufficient to cover the entire divert time,
- It places a new emphasis on protecting and evacuating passengers from remote, frigid airfields to which flights may be forced to divert and,
- It sets the clock ticking for the eventual application of special ETOPS-related procedures to on-demand charter operations, with an eight-year transition period.
The report is the product of a three-year effort by a government-industry-family group task force (see ASW, Dec. 23, 2002). It is not known when the task force’s findings will be translated into regulations, but a notice of proposed rulemaking is expected to be published for public comment in the next six months. If adopted, the actions called for in the report would mark the most significant change to ETOPS in nearly 20 years. The operative philosophy in the report is to “prevent” and “protect,” which is to say prevent the need for a diversion in the first place and, should it become necessary, protect the viability of a successful diversion. In other words, the philosophy is intended to avoid what some industry wags say the ETOPS acronym really stands for: engines turning or passengers swimming.
Given the global nature of ETOPS, the report’s regulatory changes portend an impact on foreign operators as well who are engaged in these long-range flights. ETOPS flights are now routine worldwide, being flown at the rate of some 1,000 per day by 92 carriers, according to Boeing [BA] statistics. The statistics include both Boeing and Airbus ETOPS-qualified airplanes. These twinjets now dominate the North Atlantic market and in the Pacific region, where ETOPS flights are even longer, twinjets are making up a greater share of flights heretofore dominated by three and four-engine jets.
March of progress
Twinjets, once restricted to flights within 60 minutes of a divert airfield, are now routinely flown 180 minutes from alternate airfields and the B777 twinjet has selective approval for 207-minute ETOPS (see ASW, Aug. 9, 1999, and April 3, 2000).
To conduct these twinjet operations, operators must demonstrate an in-flight shut down (IFSD) rate of .02 to.01/1,000 engine hours (i.e., 1-2 shutdowns every 100,000 hours of engine operation, the .02 rate required for 180-min. ETOPS and the .01 rate demonstrated by the fleet in recent years). Note that the probabilities here are couched in terms of engine hours, not flights. Assuming eight-hour twinjet flights (thus, 16 hours of engine operation per flight), at the .01 rate an engine shutdown would occur once in every 6,200 flights – or roughly one per week based on 1,000 ETOPS flights daily.
The ETOPS report maintains that this high level of demonstrated safety enables two things: (1) a realization that engine reliability is no longer the limiting factor for ETOPS, and (2) the low IFSD rate justifies increased diversion authority.
There is much in the data to support this contention, yet at the same time some cautionary observations are in order. Assume that engine failures are from independent causes, the shutdown rate is .02/1,000 engine hours, and the ETOPS divert threshold is three hours. According to Pierre Sprey, a statistical expert, in this case the probability of the second engine having to be shut down during the three-hour divert is on the order of 1.92 X 10-8, or about a 1.9 chance in 100 million hours of engine operation.
A different look at engine reliability
The probability of a second engine failure increases considerably if the reasons for shutdown are not independent. Assume in this case that just one out of every 1,000 engine shutdowns is for the same reason. Now, the probability of the second engine failing within three hours of the first shutdown is on the order of 32.019 x 10-6, or about 3.2 per 100,000 hours of engine operation. The likelihood is some 1,668 times greater of a second engine shutdown from a common mode failure than in the case of two independent failure mechanisms.
This example is instructive, as the farther a twinjet is from a divert airfield, the longer it must fly without suffering from a second engine failure. Should the second engine fail, there is no back-up.
That second failure can happen. On March 4, 2001, a United Airlines [UAL] B767 twinjet momentarily lost power on both engines during climb on a flight from Hawaii to California. The crew restarted the engines and immediately returned to Hawaii (see ASW, April 23, 2001). Five months later an Air Transat A330 twinjet lost power to both engines from fuel starvation and the crew was forced to glide the airplane more than 100 miles to a deadstick landing in the Azores (see http://www.iasa.com.au/aftermath.htm). The causes are under investigation by U.S. and Portuguese authorities respectively, but in both instances the loss of all engine power can be attributed to a combination of common causes.
Even if 999 out of 1,000 engine shutdowns are from independent causes, the 1 out of 1,000 case involving a common cause shows a failure rate well short of the realm of “improbable” or “extremely improbable.” Indeed, one could argue that the truly serious cases of IFSD are more likely to be correlated. Taking this sobering perspective, the implications transcend twinjets. Correlated engine failures are as threatening to a four-engine B747 or A340 as they are for a B767 or A330 twinjet.
One way to gauge the risk of independent versus correlated engine shutdowns is to build a more complete picture. ETOPS approval is based primarily on the IFSD rate, but there are many cases where the engines aren’t shut down but are throttled back to idle power. The IFSD rate provides only a partial picture. To get to the bottom of engine reliability, two rates may need to be tracked: (1) the IFSD rate, and (2) the IFSD rate plus the flight idle rate.
Having said this, the study’s main point about the great increase in engine reliability seems about right. According to the report, half of all the diversions are for non- technical reasons (e.g., passenger illness, air rage, etc.). Of the remaining diversions, half of them result from technical/system failures that are not engine related. Hence, in the grand scheme, only one out of four diversions stems from an engine problem.
By this logic, non-engine failures are now as important as engine failures when it comes to the overall safety of ETOPS flights. One could argue that the non-engine failures now warrant equal emphasis and attention.
You’re on fire
Consider the danger of in-flight smoke and fire. The effects can compound rapidly, leading to total loss of control. In many cases, the time from initial detection of smoke to loss of the aircraft is in the range of tens of minutes, not the 3-4 hours to a divert airfield envisioned for ETOPS flights. Because of the rapidity of dire consequence, following the fatal 1998 in-flight fire of a Swissair MD-11 pilots throughout the industry were enjoined to land immediately in the event of smoke and/or fire.
In the ETOPS report, a fire in the fuselage is considered independent of an engine failure. This assumption may be overly optimistic, given that a fire in the fuselage could burn through wiring bundles and engine controls, if not through the outer hull.
And fire, searing its way through vital electrical, hydraulic and pneumatic systems, implies cascading failures from a common cause by definition. The report does not call for greater separation and segregation of critical electrical and other systems for ETOPS flights. Yet, as one pilot observed, more three and four-engine aircraft have been lost from uncontained and uncontrollable in-flight fires than twinjets have been lost to dual engine failure.
Time sensitivity
In-flight smoke incidents occur on average once every 8,750 hours, according to sources. Based on this frequency, pilots flying ETOPS routes are more likely to face a smoke event than a failed engine. Airplanes are not certified to cope with dense, continuous smoke (see ASW, Oct. 21, 2002). Paul Halfpenny, a retired aerospace engineer and former vice chairman of the National Academy of Sciences (NAS) Committee on Airline Cabin Safety, observed that a small fire can quickly lead to a dramatic reduction in the ability to see cockpit instruments and controls. Halfpenny calculated that a small fire reduces cockpit vision to about 3.7 inches even at maximum cockpit ventilation. Emergency depressurization would increase the visibility, but only for about 45 seconds (while the pressure equalizes). If the fire is not extinguished and the smoke continues to be generated, the pilots may not be able to see vital instruments or see out the windscreen to safely land the airplane.
The impact of continuous smoke on pilot vision would be felt early in the course of a three-hour divert.
A study of pilot reports of in-flight smoke and fire events was completed recently by Jim Shaw, an airline pilot who serves as a safety expert with the Air Line Pilots Association (ALPA). Shaw formerly served as manager of ALPA’s In-Flight Fire Team. In a review of service difficulty reports (SDRs) for 2001, Shaw found that pilots were making precautionary landings at an average rate of about one every day and a half. While Shaw’s SDR database search did not focus on ETOPS flights particularly, but all flights, his findings are clearly relevant to extended-range operations.
Passenger health problems are another time sensitive aspect affecting ETOPS flights. Joan Sullivan Garrett, chief executive officer of Tempe, Ariz.-based MedAire, said the time to divert “really comes into play when there is a life-threatening medical emergency.”
Her company provides real-time medical support and advice to client airlines by providing doctors on call to advise flight crews of what to do when faced with in-flight medical situations.
Last year, Garrett said, some 10,000 medical emergencies occurred among 42 client airlines. Fully half of these cases, she added, were “about halfway into the flight.” To be sure, these were not all ETOPS flights, but the event pattern clearly has implications for divert times, and MedAire has handled emergencies on long flights from Southeast Asia to England.
Of interest, only 10 percent of the cases involved coronary events. Flight crews dealt last year with a range of emergencies, from strokes to miscarriages. But consider coronary problems. Garrett described a “thrombolitic window” where there is about 60 minutes from “door-to-needle.” Immediate assistance can be rendered in the air, notably in terms of emergency defibrillators and first aid to relieve chest pain, but “clot busters” need to be carefully administered in a hospital setting.
Based on one pilot’s account of a coronary emergency on a B777 flight from Los Angeles to London, the imperative to land for emergency medical treatment can be considerable (see ASW, Feb. 26, 2001).
However, Garrett said, “Sometimes it’s better to continue the flight if there isn’t an adequate medical facility at the alternate airfield.” Now, she added, “Some airlines are having to defend themselves in court about why they did not divert.”
She said more passenger education may be in order, with an advisory printed on the back of the passenger’s ticket cautioning that in the event of a medical emergency the airplane may not be able to land.
Even if passengers understand that the standard of airborne medical care will be limited, Garrett said the airlines need to upgrade the current level of equipment and training. As an example, better emergency oxygen equipment is sorely needed. An emergency oxygen bottle with just a two-liter capacity may be wholly insufficient for flights with long divert times. Garrett said airplanes built in the 1990s are carrying 40-year old technology. Operators of large airplanes, such as the B747-400 and the coming A380 double-decker, may need to include an emergency medical technician (EMT) as part of the cabin staff. As the number of passengers increases, the likelihood of an in-flight medical emergency also rises.
The growing number of air rage incidents does not appear to be a consideration in extending ETOPS divert times, either. Some cases of serious passenger assaults on aircrew have occurred on long range flights (see ASW, Jan. 22, 2001).
Coronaries and conflicts aside, if non-engine related technical issues constitute half of the machine-related breakdowns, what is the increase in their severity with another hour’s flying time to a divert airfield? Fire can spread. Toxic smoke can thicken.
Given that these human and equipment elements constitute three-quarters of the flight diverts, they may warrant more weight in the ETOPS policy matrix.
These are just some of the high points in a report that raises numerous issues critical to the safety of ETOPS flights (see Salient Issues below).
(ASW note: the ETOPS report may be viewed at http://www1.faa.gov/avr/arm/aracexrangerecommendation.cfm?nav=6. If this link does not work, the report can be reached by going to http://www.faa.gov, and navigating through the Regulation and Rulemaking homepage to Rulemaking Committees – ARAC, then to Tasks & Recommendations, to Air Carrier Operations, and scrolling down to Extended Range Operations of Airplanes – ETOPS)
Some Salient Issues
Captain’s decision-making
The report: “At the most critical point of an ETOPS enroute diversion there is no other choice as to the diversion airport.” (Emphasis added, p.30 of the report)
However, the report also says, “When operating a two engine airplane with one engine inoperative, none of the following factors may be considered sufficient justification to fly beyond the nearest suitable airport:
The fuel supply is sufficient to fly beyond the nearest suitable airport.
Passenger accommodation other than passenger safety.
Availability of maintenance / repair resource.” (Pages 169 & 223)
Comments: The draft report may not leave sufficient discretion to the captain, faced with a deteriorating situation, to decide whether he should or must continue to the enroute alternate. There could be situations where it may be preferable to fly an extra hour on the remaining engine to an on-track alternate, because it may offer better weather enroute and at the divert destination. If the weather is looking bad at the originally planned divert airfield, the captain may be loath to go there, particularly if he is unfamiliar with it and the airplane is significantly disabled.
The report: It notes that in a dire emergency a landing may have to be made at an unmanned or abandoned airfield.
Comment: The point about unmanned or abandoned airfields helps to make the point that landing at a field much closer than the planned enroute ETOPS alternate may be preferable.
The report: “The weather conditions at the time of arrival should provide high assurance that adequate visual references are available upon arrival at decision height (DH) or minimum descent altitude (MDA), and the surface wind conditions and corresponding runway surface conditions must be within acceptable limits to permit the approach and landing to be safely completed with an engine and/or systems inoperative.” (P. 204)
Comments: There appears to be nil stipulation about a diversion airport being ATC/Tower-manned (or able to be on short notice) – nor any terminal weather observation needing to be derived from a ground observer at said airport. It is also quite possible that an airplane arriving at its alternate can only extend (free-fall) and not then later retract its gear (in the event of a weather-induced missed approach).
Captain/dispatcher flight planning
The report: “Due to the natural variability of weather conditions with time, as well as the need to determine the suitability of a particular enroute alternate prior to departure, such requirements are higher than the weather minimums required to initiate an instrument approach. This is necessary to assure that the instrument approach can be conducted safely if the flight must divert to an alternate airport.” (P. 47) It also says, “14 CFR 121.631 should be modified to address weather conditions required at designated ETOPS alternates while a flight is en- route. This regulation is consistent with the standards of AC 120-42A.” (P. 48) (Cont’d on p. 6)
Comments: How many captains or dispatchers will have the gumption to cancel out (or even delay and upset schedules) if the only available enroute alternate’s weather looks shaky – as long as destination weather looks clear? In other than ETOPS, it’s not a problem because cargo can be off-loaded and more fuel loaded. But this may not be an option for two-engine ETOPS. The treatment elsewhere (p. 169) does not make it any clearer – except to say that if the alternate closes, the crew should pick another one in flight.
The report:“14 CFR 121.631 should be modified to address weather conditions required at designated ETOPS alternates while a flight is enroute. This regulation is consistent with the standards of AC 120-42A.” (P. 48) Comment: Same reservations as above – fine in theory, but will it be seen in practice? Or will an unknown risk be accepted instead (as subtle pressure is applied on captains to cooperate)?
System reliability
The report: “Failure modes that occur due to improper maintenance or engine servicing, e.g. loss of engine oil due to improper assembly of an oil tube connection, also tend to occur early in the flight.” (P. 19)
Comment: May not be a valid assumption. The loss of oil in both engines on a Malaysia Airlines B777 flight Dec. 4, 1999, occurred hours into the flight. Singapore Airlines had a similar B777 incident a few days later with one engine.
The report: “In-flight shutdown (IFSD):When an engine ceases to function in flight and is shutdown, whether self-induced, crew initiated or caused by some other external influence (i.e., IFSD for all causes; for example: due to flameout, internal failure, crew initiated shutoff, foreign object ingestion, icing, inability to obtain and/or control desired thrust, etc.).” (P. 60)
Comments: The prevalent practice of idling an engine for a turn-back or continue scenario (rather than shutting it down, say for a chip detector light or low oil pressure as would normally be the case in non-ETOPS operations) is apparently not frowned upon as any sort of attempt to “fudge” the IFSD statistics. Later found at page 62, subparagraph (5)(iii) but still not reflected in IFSD statistics (just in a “record returns” report). See also page 108, paragraph 10(a)(iii), for non-mention of idling an engine as an evaluation parameter. And of course idling an engine allows it to support pressurization, de-icing and electric generation while at the same time providing a minor residual thrust which would not be the case if an engine was shut down. But, the big thing about just “idling” an engine is that flight can be completed as planned. Normally if a chip detector illuminates, a precautionary shutdown would be in order. By idling, a “hit” can be avoided on the IFSD statistics – but at the potential risk of increasing the chance of a catastrophic or uncontained failure. Things to think about.
The report: “Systems whose failure would result in excessive crew workload or have operational implications or significant detrimental impact on the flight crew’s or passengers’ physiological well being for an ETOPS diversion (e.g., flight control forces that would be exhausting for a maximum ETOPS diversion, or system failures that would require continuous fuel balancing to ensure proper CG, or a cabin environmental control failure that could cause extreme heat or cold to the extent it could incapacitate the crew or cause physical harm to the passengers).” (Page 61, subparagraph (vii) under ETOPS Group 2 Systems)
Comment: Not mentioned here, but the B767 and B757 in particular have had many instances of trapped water freezing within control runs and causing severe locked controls or out-of-trim conditions that were only relieved by a period spent flying below the altitude at which freezing conditions prevailed.
In-flight fire
The report:“The AC [advisory circular] allows applicants to use an all engines operative speed, since the probability of a cargo fire plus an engine out is less than extremely improbable.” (P. 13)
Comment: May be an unduly optimistic assumption, since an uncontained failure throws hot metal, possibly into a cargo hold – is addressed but left unresolved in this statement later in the report, “An uncontained engine failure is a single event that could cause an in-flight shutdown and a cargo fire, however, for the uncontained event to cause a cargo compartment fire, the cargo compartment liner integrity would be compromised and therefore adequate Halon concentration cannot be guaranteed regardless of the duration of capability.” (P. 100)
The report: It assumes that loss of electrical power is solely a matter of failed generators. (P. 13)
Comments:The document does not address the situation wherein the crew needs to very quickly shut down all but flight essential systems [ideally connected to a Flight Essential Bus -FEB] in order to stop rapid propagation of an electrical fire. Because the FEB items will not usually permit continued flight in IMC [instrument meteorological conditions], two options then remain in IFR [instrument flight rules] flight – in the absence of an FEB:
1. Restore electrical power [thus rekindling the fire].
2. Maintain VFR flight [may not be possible due weather/night/both].
Because of the daily number of in-flight smoke and/or fire events, not to consider the emergency shutdown of all but flight essential electrical systems may be seen in some quarters as cavalier. What guidance is given to crews facing a Swissair Flight 111 (1998, Halifax) or Air Canada Flight 797 (1983, Cincinnati) fire problem?
The report: Sufficient cargo hold fire suppressant must be provided to cover the divert time plus 15 minutes. (P. 46)
Comments: It is significant that this requirement applies to all aircraft, regardless of the number of engines. Presently, three and four engine aircraft are not required to have fire suppression for the time they are away from an alternate landing field. Twinjets are required to have cargo bay firefighting for the entire ETOPS portion of the flight. In this respect, the report brings three and four engine jets up to the same standard as twinjets.
The use of Halon must be phased out, per international agreement as part of the campaign against “greenhouse gases” and their contribution to global warming. The industry is now searching for a suitable alternative to Halon, to include water misting. Whatever replaces Halon must have the same suppressant qualities or all the ETOPS calculations will need complete reworking. It remains to be seen if water misting can last as long as Halon without a weight penalty (e.g., the water required).
The report: “The reliability and system architecture of modern twin engine airplanes have begun to meet or exceed the capabilities of current 3-4 engine long range airplanes and it was believed that all long range airplanes, regardless of the number of engines, needed a viable diversion airport in the case of onboard fire[emphasis added], medical emergency or catastrophic decompression. This is especially important considering that routes over remote areas of the world are uniquely challenging to the operation.” (P. 49)
Comment: There is a vast difference between a suppressed fire in a cargo hold and an onboard electrical fire. This was recognized and was being addressed by the Swissair MD-11 Modification Plus program (see ASW, July 30, 2001). In this report, the hazard seems to be all packaged together as one single consideration of onboard fire. There seems to be a disavowal of dense continuous smoke in an airplane requiring the electrical system to be shut down to minimum flight essential systems in order to control a propagating (and escalating) electrical fire.
The report: It addresses fire suppression in the cargo bays, but not the electronics and equipment [E&E] bay, most of which presently have neither fire detection nor suppression. The report refers to “system cooling” of ETOPS-essential communications, navigation and other electrical systems. (P. 93)
Apropos of cooling, the report says, “The equipment (including avionics) necessary for extended diversion times should have the ability to operate acceptably following failures in the cooling system or electrical power systems.” (P. 208, paragraph 2.b)
Comment: How would “system cooling” be achieved with a fire in the E&E bay?
The report: “Time-limited systems including such things as cargo fire suppression and oxygen if the ETOPS diversion is oxygen system duration dependent.” (P. 61.vi)
Comment: This section refers to the crew’s oxygen system, but what about the passengers?
The report: It suggests 240-minute and greater ETOPS. (P. 83)
Comment: It may be stretching credulity to believe that a cargo hold fire can be suppressed for four hours or more. A smoldering fire, which is what the term “suppressing” really means (not extinguishing), could well burn through the hull during such an extended period of time. In this event, all fire suppressant will be lost, not to mention the sudden inflow of outside air fanning the fire into a raging inferno.
Communications
The report: “Communications capabilities should be able to provide the flight crew with a clear, reliable and immediate link to both the ATC and company facilities. Such capability is crucial to support long-range operations in remote areas to support problem evaluation and preclude a diversion or to protect the aircraft and its passengers during the diversion.” (P. 29)
Comment: One could reasonably add the capability of transmitting DFDR [digital flight data recorder] and CVR/CCTV [cockpit voice recorder/closed circuit television] data via a SATCOM data-link would greatly enhance both incident and accident investigation. Comes the loss of the first ETOPS airplane in the deeper trenches of the ocean, and this capability might become a clearer requirement. Even a slightly offshore crash like Swissair Flight 111 left many of its secrets in the ocean depths. Nowadays, more than ever, the public may need to know, ‘Was it the airplane or was it terrorism?’ One would think that it would be in the operators’ and manufacturers’ interest to provide this system lest public confidence in two-engine ETOPS be ruined.
ETOPS-related systems
The report: Group I ETOPS-significant systems are those “related to the number of engines on the airplane or the consequences of an engine failure.” (P. 60, subparagraph (i) under Group 1 Systems) (Cont’d on p. 8)
Comments: One might have included the electrical bus-tie relay [which switches loads between engine driven generators and/or load-shares with the APU generator if that’s on-line]. On some airplanes there is redundancy backup but on others there’s not. Independent generators become redundant if the automatic switching is inoperative (see p. 64, section L25.2(a)(ii)). Much attention is paid in the report to high altitude APU starting reliability but far less mention is made of the needed reliability of the air driven generator [ADG], also known as the ram air turbine [RAT] on airplanes where in-flight APU is not an option (e.g., MD-11 trijet).
Personnel training
The report: “If the flight crew may be required to perform any ETOPS pre-departure service or maintenance checks prior to departure on a ETOPS flight from an airport lacking ETOPS-trained maintenance personnel, such items should be included in flight crew training program.” (P. 212)
Comment: Interesting proposition. Additionally, the draft report does not appear to contain any guidance for simulator training (to include ditching), for any special in-flight fire training, or for use of the hundreds of pounds of water-survival equipment carried on each ETOPS flight.
Other related issues
Flight management software: Little consideration seems to have been devoted in the report to the update status of flight management software as a key element in ETOPS safety, or to the provision of special software-driven capabilities to make the crew’s diversionary task/situational and geographical awareness that much easier. But bearing in mind how automatic systems can get one into trouble (Air Transat A330 fuel cross-transfer in 2001, Hapag Lloyd‘s A310 gear-down transit to fuel exhaustion in 2000, and Air New Zealand‘s navigational software-driven tragic encounter with Mt. Erebus in 1979 for instance), one would think it is a relevant concern (e.g. to not summarily approve an ETOPS passenger revenue flight after a fresh upgrade to the latest flight management system software release). The concern may be particularly applicable to high latitude and Polar operations.
It may even be the case that software could be written to enable a dispatcher to task-offload a crew by providing more useful and timely advice or information to a crew in extremis (thinking of the inability of the dispatcher to calculate the center of gravity for the pilots of Alaska Flight 261 while they were grappling with a stuck stabilizer and weighing their divert options). Envisioning a sort of Flight Simulator type software here, with a flight-following capability, the dispatcher would almost be along for the ride, so to speak, which indeed is alluded to in the report: “If this monitoring is done by the certificate holder, a reliable method of communication with the airplane must be readily available.” (P. 222)
Fuel feed system: The report says the fuel management system must include “the capability to cross feed fuel from one main tank to another for engine inoperative conditions.” (P. 103) The term “cross feed” may not be the most technically accurate. Movement of fuel from one tank to another is to “cross transfer.” Cross feed is to supply an engine with fuel from another tank not normally associated with it – and normally on the other side of the airplane.
Verification procedures: “Verification flights are accomplished after corrective action to a ETOPS significant system to identify potential human factors or mechanical errors prior to a ETOPS flight. Verification flights may be conducted on revenue flights provided that verification of the affected system is completed prior to the ETOPS Entry Point.” Comment: Didn’t do Air Transat much good. This quip aside, could an aircraft straight out of heavy maintenance – or even a “C” check – be immediately scheduled for an ETOPS mission? Verification flights seem only to be mentioned in the report in the context of “common cause human failure modes.” (P. 156)
ETOPS reporting requirements: “Any event that would jeopardize the safe flight and landing of the airplane on an ETOPS flight” (Page 63, subparagraph (5)(ix)). Comment: presumably this reporting requirement would include terrorist encounters (attempted hijacking) and disruptive passengers.
Regarding reporting, the report also states operators must periodically report their engine IFSD rates (p. 63). However, there does not appear to be a requirement for an ETOPS re-evaluation whenever a manufacturer stipulates an engine modification that obviously would effect both engines at the same time. The only mention of this situation is in the context of a change in engine architecture and the 3,000-cycle test for accelerated ETOPS approval (p. 129).
Aging aircraft. No mention is made in the report about how ETOPS requirements will be coordinated or “harmonized” with aging aircraft requirements (see ASW, Dec. 16, 2002).
(Note: Mr. John Sampson, who prepares the Accident & Incident table for this publication, contributed substantively to this analysis.)
ETOPS Philosophy
The basic concept of ETOPS is to preclude the diversion and, if a diversion is required, to protect that diversion.
Frequent diversions are precluded through rigorous design and disciplined maintenance processes and, for these few diversions that do occur, operational processes are in place to protect them. Assuming realistic circumstances, there is an en route alternate and fuel supply planned for diversion.
This concept should be applied to all turbine-powered airplanes in long range operations.
Source: Draft ETOPS report, p. 38
Smoke & Fire Events for 2001
Principal findings, review of service difficulty report (SDR) database:
- More than 990 smoke and fire events were reported for 2001. This number equates to 2.72 smoke or fire events per day.
- 41% of these events were “high temperature” and electrically related.
- In 24% of the cases, no precautionary procedures were reported, in contrast to fire extinguisher activation in 2% of the cases, engines shut down in 2% of the cases, etc.
- There were 258 unscheduled landings for the year, or about one every day and a half due to smoke/fire/fumes. There also were 342 flight interrupts, which include such things as a return to gate or aborted takeoff, which equates to nearly one per day.
- Of greater significance, about a third of the flight interrupts were of a high temperature nature, equating to about one flight interruption every three days with a higher level of risk.
- Approximately 78% of the high temperature events were related to electrical systems or components.
- Reports involving tripped circuit breakers being reset for systems with internal or external short circuits indicate that resets can be extremely hazardous. To this investigator, the frequency seemed much too high. Source: Shaw