Browse: Departments   Dates   Agencies  

CFR Citation: 14 CFR Part 25

Docket ID: [Docket No. NM81; Notice No. 25-03-04-SC]

NOTICE: PROPOSED RULES

ACTION: Airworthiness standards:

DOCUMENT ACTION: Notice of proposed special conditions.

SUBJECT CATEGORY: Special Conditions: Boeing Model 777 Series Airplanes; Revision to Special Conditions 25-ANM-84

DATES: Comments must be received on or before July 28, 2003.

DOCUMENT SUMMARY: This action proposes to revise Special Conditions 25-ANM-84, applicable to Boeing Model 777 series airplanes. The proposed special conditions revise the extended range operations with twoengine airplanes (referred to as ``ETOPS'') test requirements defined in the existing special conditions. These revisions include changing the airplane demonstration test requirement from a required 1000 flight cycles to a demonstration of capability in ETOPS flight conditions, and allowing more than one airplane to be used for the airplane demonstration test. In addition, the FAA proposes to add posttest inspection requirements for both the engine demonstration test and the airplane demonstration test articles.

SUMMARY: Special conditions—; Boeing Model 777 series airplanes,

SUPPLEMENTAL INFORMATION

The FAA invites interested persons to participate in this rulemaking by submitting written comments, data, or views. The most helpful comments reference a specific portion of the special conditions, explain the reason for any recommended change, and include supporting data. We ask that you send us two copies of written comments.

We will file in the docket all comments we receive, as well as a report summarizing each substantive public contact with FAA personnel concerning these special conditions. The docket is available for public inspection before and after the comment closing date. If you wish to review the docket in person, go to the address in the ADDRESSES section of this preamble between 7:30 a.m. and 4 p.m., Monday through Friday, except Federal holidays.

We will consider all comments we receive on or before the closing date for comments. We will consider comments filed late if it is possible to do so without incurring expense or delay. We may change these special conditions in light of the comments we receive.

If you want the FAA to acknowledge receipt of your comments on this proposal, include with your comments a preaddressed, stamped postcard on which the docket number appears. We will stamp the date on the postcard and mail it back to you.

Background

Because of concerns over engine and airplane reliability, for many years, 14 CFR 121.161 has generally prohibited operations of twoengine airplanes on routes including segments that are more than one hour flight time from a suitable airport. This regulation contains an exception that allows such operations when specifically authorized by the Administrator. These extended range operations with twoengine airplanes are referred to as ETOPS. Advisory Circular (AC) 12042A describes a method for obtaining ETOPS authorization if an operator can demonstrate sufficient engine and airplane reliability. This method is based on a combination of various design features and operational and maintenance procedures. The AC states that eligibility for 120minute ETOPS authorization is normally based on a showing of reliable operation for a minimum of 250,000 engine hours of service in the world fleet. Eligibility for 180minute ETOPS authorization is normally based on a showing of reliable operation for at least one year in 120minute ETOPS. The AC also describes an option for reducing the number of hours of service if adequate compensating factors are identified to give a reasonably equivalent database.

On May 18, 1994, the FAA issued Special Conditions Number 25ANM84 for the Boeing Model 777 airplane (59 FR 28234). These special conditions define requirements for 180minute ETOPS approval concurrent with basic type certification of the airplane without the service experience outlined in AC 12042A that would normally be necessary. These special conditions define additional safety standards that the FAA considered necessary to establish a level of safety equivalent to that provided by the airworthiness standards for nonETOPS airplanes.

The current 777 ETOPS special conditions consist of five main elements needed to provide adequate compensation for the service experience normally required for 180minute ETOPS eligibility described in AC 12042A. No single element is considered sufficient by itself, but the FAA has found that the five elements combined provide an acceptable substitute for actual airline service experience. The five elements are:

1. Design for reliability.

2. Lessons learned.

3. Test requirements.

4. Demonstrated reliability.

5. Problem tracking system.

A description of each of these five elements is contained in the preamble to the 777 ETOPS special conditions.

On December 13, 1999, Boeing Commercial Airplane Group applied for an amendment to Type Certificate No. T00001SE to include the new Model No. 777200LR and 777300ER airplanes. The Model No. 777200LR, which is a derivative version of the existing Model 777200 series airplanes, has the following differences from the 777200:
[sbull] The wingspan is increased from 199 feet, 11 inches to 212 feet, 7 inches.
[sbull] Maximum intended takeoff weight is 750,000 pounds. [sbull] It is capable of carrying from 301 to 440 passengers. [sbull] It has provisions for overhead crew and attendant rest areas.
[sbull] Its range capability will be up to 8,800 nautical miles (16,298 kilometers).
[sbull] It has 110,100 pounds thrust GE90 engines.
[sbull] It has a supplemental electronic tail skid.
[sbull] It has provisions for up to 3 auxiliary fuel tanks in the forward area of the aft cargo bay.

[[Page 35336]]

The 777300ER, which is a derivative of the Model 777300 airplanes, has the following differences from the Model 777300: [sbull] The wingspan is increased from 199 feet, 11 inches to 212 feet, 7 inches.
[sbull] Maximum intended takeoff weight is 750,000 pounds. [sbull] It is capable of carrying from 359 to 550 passengers. [sbull] It has provisions for overhead crew and attendant rest areas.
[sbull] Its range capability will be up to 7,250 nautical miles (13,427 kilometers).
[sbull] It has 115,300 pound thrust GE90 engines.
[sbull] It has a supplemental electronic tail skid.
[sbull] It has a semilevered main landing gear.
Both models are currently approved under Type Certificate No. T00001SE.

For the Model 777300ER and Model 777200LR, Boeing has proposed certain changes to the ETOPS special conditions in order to take into account the experience from the original baseline Model 777 engine programs and to eliminate any unnecessary burden from the airplane demonstration testing required by paragraph (e)(7) of those special conditions.

Type Certification Basis

Under the provisions of Sec. 21.101, Amendment 2169, effective September 16, 1991, for a change to a type certificate Boeing must show that the Boeing Model 777 series airplane, as changed, continues to meet the applicable provisions of the regulations incorporated by reference in Type Certificate No. T00001SE or the applicable regulations in effect on the date of application for the change. The regulations incorporated by reference in the type certificate are commonly referred to as the ``original type certification basis.'' The regulations incorporated by reference in Type Certificate No. T00001SE for the Boeing Model 777 series airplanes include 14 CFR part 25, as amended by Amendments 251 through 2582. The original type
certification basis is listed in Type Certificate Data Sheet No. T00001SE.

If the Administrator finds that the applicable airworthiness regulations (i.e., 14 CFR part 25) do not contain adequate or appropriate safety standards for the Model 777 series airplanes because of a novel or unusual design feature, special conditions are prescribed under the provisions of Sec. 21.16.

In addition to the applicable airworthiness regulations and special conditions, Boeing Model 777 series airplanes must comply with the fuel vent and exhaust emission requirements of 14 CFR part 34 and the noise certification requirements of 14 CFR part 36.

Special conditions, as defined in Sec. 11.19, are issued in accordance with Sec. 11.38 and become part of the type certification basis in accordance with Sec. 21.101(b)(2), Amendment 2169, effective September 16, 1991.

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design feature, or should any other model already included on the same type certificate be modified to incorporate the same novel or unusual design feature, the special conditions would also apply to the other model under the provisions of Sec. 21.101(a)(1).

ETOPS Certification

All twoengine airplanes operating under 14 CFR part 121 are required to comply with Sec. 121.161, which states, in pertinent part, that ``Unless authorized by the Administrator * * * no certificate holder may operate twoengine airplanes * * * over a route that contains a point farther than one hour flying time * * * from an adequate airport.'' Advisory Circular (AC) 12042A, ``Extended Range Operation With TwoEngine Airplanes (ETOPS),'' provides an acceptable means for obtaining FAA approval for twoengine airplanes to operate over a route that contains a point farther than one hour flying time from an adequate airport. The two basic objectives of this advisory circular are to establish that the airplane and its supporting systems are suitable for the extended range mission and that the maintenance and procedures to be employed in conducting ETOPS operations are adequate. This is accomplished by acquiring a substantial amount of service experience during nonETOPS operation and then extensively evaluating this experience in the areas of systems reliability, maintenance tasks, and operating procedures. When it is determined that the appropriate reliabilities and capabilities have been achieved, the airplane is found eligible to be considered for use in ETOPS operation by an airline.

When Boeing was developing the Model 777 series airplane, it proposed that the Model 777 be approved for ETOPS operation simultaneously with the issuance of the basic type certificate. At that time procedures did not exist for a finding of this type. The proposed issuance of ETOPS type design approval at certification would have precluded using accumulation of service experience, as outlined in AC 12042A, as a means to meet ETOPS approval requirements. So an alternative method was devised that provided an adequate level of inherent airplane reliability for ETOPS. It is important to note that the requirements for certification of the airplane regarding the design's suitability for ETOPS operation, as described in those special conditions, relate to type certification approval only. Advisory Circular 12042A contains guidance regarding operational and maintenance practices criteria that must be met by the operator before ETOPS operations can be conducted. It is incumbent upon the operator to apply for operational approval in accordance with appropriate guidance issued by the FAA for such approvals. Satisfaction of the requirements of these special conditions does not constitute operational approval.

Special Conditions 25ANM84 contained the additional safety standards that the Administrator considered necessary to establish a level of safety equivalent to that provided by the airworthiness standards for transport category airplanes for nonETOPS airplanes. Experience with these special conditions since issuance has provided the FAA with additional data to justify a revision to those special conditions as described in this notice.

Discussion of the Proposed Special Conditions

Boeing has requested the FAA to revise certain parts of the test requirements of Special Conditions 25ANM84 defined in paragraph (e). The FAA has concurred that some changes are justified based on an analysis of previous experience applying those special conditions to the original three engine types approved for installation on the Model 777 airplane. The specific changes to those requirements and the justification for each proposed change are discussed below. Paragraph (e)(6) Engine Demonstration Test

The FAA has concluded from a review of inservice experience of the Model 777 series airplanes that the 3000cycle engine and propulsion system test required by paragraph (e)(6) of Special Conditions 25ANM 84 provides an adequate opportunity to discover cyclicrelated failure modes associated with the design, provided that an adequate posttest evaluation is conducted to find conditions that could result in an inflight shutdown, power
[[Page 35337]]
loss, or inability to control engine thrust. An FAA review of the test data from the 3000cycle tests for the three original engine types installed on the Model 777 series airplanes has shown that most of the early inservice 777 engine failure modes could have been discovered had Boeing and the engine manufacturers conducted a more thorough teardown inspection and analysis of the 3000cycle test engine and propulsion system hardware. Part conditions noted in the teardown inspection reports for the three baseline 777 engine types did later occur in service, and they resulted in engine inflight shutdowns or airplane diversions. Because the specific condition of those 3000cycle test parts had been characterized as minor deviations from normal however, no specific investigations into how they might progress in service had been required as a prerequisite for ETOPS approval.

Special Conditions 25ANM84 currently do not require a posttest teardown inspection. However, all three engine companies, in cooperation with Boeing, conducted posttest teardown inspections on the original baseline engines installed on the Model 777 series airplanes based on their own experience of what would constitute an adequate evaluation. In order to provide a consistent standard for a posttest evaluation of the 3000cycle test hardware, the FAA is proposing a change to paragraph (e)(6) to require a complete teardown inspection of the engine and airplane nacelle test hardware after completion of the test. The inspection must include an analysis of any abnormal conditions found. The analysis must consider the possible consequences of similar occurrences in service to determine if they might become sources of engine inflight shutdowns, power loss, or inability to control engine thrust. The intent of this change to paragraph (e)(6) is to require further design analysis to catch potential sources of engine inflight shutdowns or diversions.

For similar reasons, we are proposing to add a new subparagraph (e)(7)(v) to require a posttest external and internal visual inspection of the airplane demonstration test engines and propulsion system hardware. An analysis of the inspection results must identify any potential sources of engine inflight shutdown. Appropriate corrective actions must be performed in accordance with the provisions of the special conditions.

Boeing proposed to delete the word complete from the description of the airplane nacelle package required for the 3000cycle test. The rationale for this proposed change was that without the term complete, it is still understood that the test is intended to be a propulsion system test inclusive of the engine buildup items, but some allowance is made for configuration differences necessary to accommodate the test setup. The FAA is concerned that, without this qualifier, it is not clear what nacelle hardware must be installed for this test. It could be misinterpreted in such a way that, for instance, a functioning thrust reverser need not be installed. Therefore, the FAA has concluded that the word complete must remain in the requirement. However, we agree with Boeing that those configuration differences associated with test instrumentation and test stand interfaces with the engine nacelle package may be excluded, and we propose to add that qualification to the requirement in order to clarify this intent.

Paragraph (e)(7) Airplane Demonstration Test

Number of Test Airplanes: Boeing has proposed a change to paragraph (e)(7) to allow the use of more than one airplane to comply with the airplane demonstration test requirement (three test airplanes for the current Model 777300ER program). Boeing's justification includes the argument that using multiple airplanes is an enhancement to the ETOPS validation program that takes into account airplanetoairplane variation. The value of obtaining ETOPS data on multiple airplanes versus one is the increased sample size. The FAA agrees that increasing the number of test airplanes in the airplane demonstration test would provide a better evaluation of airplanetoairplane variability. The limited experience obtained during the airplane demonstration test program is not really sufficient to evaluate endoflife wearout failure modes, so accumulating all of the time and cycles on one airplane is not really necessary. The main program schedule benefit from using multiple flight test airplanes is that testing can be completed in a shorter period. The FAA is proposing a change to paragraph (e)(7) to require that one or more airplanes must complete the airplane demonstration test required by that paragraph.

Capability Demonstration vs. Reliability Demonstration: The 1000 cycle airplane demonstration test requirement was developed with the intent of exposing the airplane to the conditions where the greatest numbers of inflight shutdowns occur. Most inflight shutdowns occur during takeoff and climb. The failure modes associated with these takeoff and climbrelated shutdowns tend to be cyclic in nature for a couple of reasons.\1\ For failure modes where the risk of failure increases with engine thrust, the takeoff portion of the flight is most critical. Failure modes that occur due to improper maintenance or engine servicing, for instance loss of engine oil due to improper assembly of an oil tube connection, also tend to occur early in the flight. A larger number of airplane flights increases the exposure to these types of failures. Therefore, the FAA considered a cyclic test to be the most appropriate airplane validation test for the original 777 ETOPS special conditions. However, as stated above, we now consider that the 3000cycle engine and propulsion system test required by paragraph (e)(6) provides an adequate opportunity to discover cyclic related failure modes associated with the design when the test hardware goes through an appropriate level of posttest teardown and inspection. \1\ Data provided to the Aviation Rulemaking Advisory Committee (ARAC) ETOPS Working Group confirm that the inflight shutdown rate during the takeoff flight phase is on the order of 6 to 16 times the fleet average inflight shutdown rate and during the climb phase is 2.5 to 4.5 times the fleet average.

For inflight shutdowns where improper maintenance is a main causal factor, the 1000cycle airplane demonstration test provides multiple opportunities for these types of failures to occur. However, the maintenance procedure validation program required by paragraph (d)(2) is intended to minimize the probability of these occurrences. The airplane demonstration test airplane provides opportunities to demonstrate those maintenance tasks associated with the normal operation of the airplane. The FAA considers that these demonstrations can be accomplished in fewer than 1000 cycles.

Although the fewest inflight shutdowns occur during cruise, this is the phase of flight that is most important to an ETOPS operation. Traditionally, the FAA and industry have avoided trying to differentiate between those inflight shutdowns that may occur during cruise from those that would only occur in a nonETOPS environment. The main reason for this approach in existing ETOPS policy is that by correcting all causes of inflight shutdowns, the overall integrity of the propulsion system is assured. Since adequate cyclic exposure would be evaluated by an enhanced 3000cycle engine demonstration test, as proposed for paragraph (e)(6) of these special
[[Page 35338]]
conditions, the FAA has concluded that the airplane validation program should emphasize exposure to the cruise phase of flight. During the three 1000cycle tests conducted for the original 777 engine installation certification programs, only 91 of the total 1000 cycles were of durations of two hours or more. Since the intent of paragraph (e)(7) is to simulate an actual airline operation, this would better be accomplished through longer duration flight cycles. Long duration flight exposure provides additional confidence in the design against those cruiserelated failure modes that cannot be evaluated in a cyclic test environment. Such failure modes could include freezing of entrapped water condensation or binding of propulsion system components, neither of which would likely occur in a sea level test facility.

Based on these considerations, the FAA has determined that the airplane demonstration test requirement should be refocused on those conditions that are most prevalent in an ETOPS operating environment. Those conditions include long flights to a variety of airports with broad variations of airport elevation, temperature, and humidity. It is also important that these flights expose the airplane to several enroute climbs, such as may occur with a fully loaded 777300ER on a longrange flight, and a number of single engine diversions. As such, the FAA proposes that the airplane demonstration test requirement of paragraph (e)(7) be revised to more clearly state the objectives of the test program. Those objectives include demonstrations that the aircraft, its components, and equipment are capable of and function properly during longrange operations and airplane diversions, including engineinoperative diversions. This change in focus constitutes a significant departure from the original purpose of the 1000cycle airplane demonstration test requirement, as discussed in the preamble to special conditions 25ANM84.

Reliability of 777

In order to further justify this change in philosophy for the airplane demonstration test requirement from being a demonstration of ``reliability'' to a demonstration of ``capability,'' the FAA reviewed the original intent of Special Conditions 25ANM84, as documented in the preamble to those special conditions. The purpose of this review was to assess whether the assumptions we made in justifying the special conditions are still valid, or whether they should be revised based on ETOPS certification experience since their issuance in June 1994.

In the preamble to Special Conditions 25ANM84, the FAA stated that: ``existing practices to achieve airplane certification safety objectives have involved definition of performance requirements, incorporation of safety margins, and prediction of failure probabilities through analysis and test. However, historical evidence, in general, indicates that a period of actual revenue service experience is necessary to identify and resolve problems not observed during the normal certification process. Successful achievement of this experience has been a prerequisite for granting ETOPS type design approval for a specific airplane engine
combination. However, several recent airplane engine combinations incorporating new or substantially modified propulsion systems have demonstrated a high level of reliability consistent with ETOPS operation upon entry into revenue service. In addition, this high level of reliability was demonstrated by the small number of problems encountered during basic certification activity.'' Based on these successful airplane and engine development and certification programs, the special conditions were designed to ``result in a level of airplane reliability that is equivalent to the level of reliability previously found to be acceptable based upon service experience.''

The basic premise behind the engine and airplane demonstration tests required by paragraphs (e)(6) and (e)(7) of the special conditions was that those tests would provide a final validation of an ``inherent'' level of reliability that was the product of an enhanced design and test process. This is similar to the purpose of the function and reliability testing required by Sec. 21.35(b)(2). The FAA's expectation for these tests was that no significant failures would occur. The probability of significant design failures occurring on a oneairplane flight test is so low that if any DO occur, that would be indicative of a design that is not suitable for ETOPS approval. This expectation is contained in the ``type and frequency'' requirement of special conditions paragraph (h)(1). Statistical reliability studies have shown that a much larger database would be required to validate a design's true reliability with a significant degree of confidence.

No major engine failures occurred during the 1000cycle airplane demonstration tests for any of the three engine types certified on the Model 777 series airplane, although several engine design problems were discovered during other certification testing that affected the start and conduct of those tests. The Reliability Assessment Board (RAB) evaluated each of these design problems in compliance with paragraph (g) of the special conditions, and found the 777 to be suitable for ETOPS type design approval with the incorporation of corrective actions identified in Appendix 1 of the RAB final recommendation reports for the three engine types. There were hardware similarities between engines with the original certified thrust ratings and followon higherthrustrated engines, and the FAA certified each of those followon engine derivatives for ETOPS in consideration of those hardware similarities. The FAA accepted the original baseline engine test programs as showing compliance to the 3000cycle propulsion system ground test and 1000cycle airplane demonstration test requirements for the followon derivative engines. Although the 3000cycle and 1000 cycle tests were not repeated for those followon derivative engines, Boeing and the engine companies completed reduced ground and flight test demonstrations tailored to the design changes being introduced in compliance with the ``Test Features'' requirement of special conditions paragraph (c)(4). Therefore, the followon engine derivatives are not included in this analysis of the 1000cycle airplane demonstration test requirement.

The Boeing Model 777200 series airplane powered by Pratt & Whitney PW4077 engines was approved for ETOPS on May 30, 1995 and entered service in June 1995. By all accounts, it was a very successful new model introduction. This was followed by ETOPS approval of the 777200 powered by General Electric GE9077B and RollsRoyce RB211Trent 87717 engines in October 1996. The inflight shutdown (IFSD) rate for all three engine types was zero for at least the first year in service. The Pratt & Whitney PW4000 reached a peak 12month rolling average engine IFSD rate of .018/1000 hours in October 1996. The General Electric GE90 reached a peak of .021 for one month in July 1998 and the RollsRoyce Trent reached a peak of .016 in December 1997. Although the inflight shutdown rates stayed within the allowable .02/1000 hour standard for 180minute ETOPS, significant design problems were discovered on each engine type after ETOPS approval.

During the first two years after ETOPS approval of each engine type on the Model 777 series airplanes, the FAA was concerned that the design problems being discovered may have indicated a failure of the early ETOPS process to identify those failure modes before they occurred in service. Some failure modes had the potential to result in inflight shutdowns had they occurred under different circumstances or had they not been detected during maintenance for
[[Page 35339]]
unassociated reasons. A summary of the actual problem reports for these inflight shutdowns and other events, which were submitted in compliance with paragraph (f) of these special conditions, is contained in Table 1. Had every one of those events resulted in an engine inflight shutdown, the resulting IFSD rates for each engine type would have been significantly higher. Boeing, the engine manufacturers, the FAA, and other regulatory authorities worked together to prevent additional inflight occurrences of these failure types. The actual inflight shutdown rates prove that these early inservice problems were successfully managed to maintain the safety of 777 ETOPS operations worldwide.
Table 1 EE1

Date occurred i> Engine type Affected system Event description 10/1/1995............ 101 PW................... ENGINEOIL PUMP........... Airplane diversion due to low oil quantity. Engine not shut down, but oil quantity indication went to zero. Related to LP01 problem. 5/19/1996............ 179 PW................... ENGINE..................... Takeoff aborted due to EGT exceedance. A loose Bnut was found on the PS3 line to the 2.95 bleed valve, which caused erratic operation. 5/30/1996............ 181 PW................... ENGINE..................... Air turnback due to high oil consumption. Oil wetness noted and corrected from previous flights. Consumption continued to be high. 8/24/1996............ 233 PW................... ENGINE..................... IFSDInflight shutdown due to low oil pressure indication. Plastic shipping cap was left in the LPO1 oil line during installation as part of fleet upgrade. 10/5/1996............ 254 PW................... ENGINE..................... IFSDEngine was shut down due to low oil quantity and low oil pressure. Loose main oil line at filter housing. Repeat of oil line shipping cap problem. 10/11/1996........... 261 PW................... ENGINE..................... Air turnback. Engine experienced high vibration during cruise. Vibration indication exceeded EICAS ``Popup'' level at 4.06. 3/26/1997............ 385 PW................... ENGINE..................... Twelve quarts of oil lost after a series of training flights due to a leak of an oil line to the fuel/oil cooler. Oil loss took place over approximately 3 hours of flight time. 2/24/1997............ G65 GE................... ENGINE GEARBOX............. Air turnback due to loss of right backup generator followed by engine oil filter EICAS message. Root cause was a failed gearbox backup generator pad bearing. 11/4/1997............ G84 GE................... ENGINE..................... IFSDEngine experienced a power loss during approach. A restart attempt was unsuccessful. Root cause was a sticking bypass valve in the hydromechanical unit (HMU). 11/9/1997............ G87 GE................... ENGINE..................... Flight crew heard a surge toward the end of the takeoff roll and tower reported seeing flames from the engine. At 600 feet, the engine surged again. The flight crew reduced power and returned to the airport. 3/12/1998............ G96 GE................... ENGINE..................... Pilot heard a bang and a tower reported fire from the tailpipe after power was set for takeoff. The takeoff was aborted. Metal was found in the tailpipe. 6/22/1998............ G108 GE................... ENGINE..................... IFSDAfter takeoff, the pilot received low oil pressure and low oil quantity indications. The pilot shut down the engine. Two of four oil filter cover bolts were loose due to inserts pulling out of the filter housing casting. 7/1/1998............. G110 GE................... ENGINE..................... IFSDUncommanded engine inflight shutdown during cruise at flight level 370. Flight crew noted a rapid loss of oil pressure and N2. Root cause was a Number 3 bearing failure. 7/22/1998............ G112 GE................... ENGINE..................... IFSDDuring cruise, EICAS indication of low oil quantity. Pilot shut down the engine. Oil filter housing cover bolts were over torqued resulting in stripped threads in the oil filter housing inserts. 11/20/1998........... G120 GE................... IDG installation........... IFSDCrew started return to departure airport due to indication of complete oil loss. Engine was subsequently shut down when oil pressure dropped to 10 psi. The integrated drive generator (IDG) packing was damaged during installation. 10/11/1996........... R63 RR................... ENGINERADIAL DRIVE SHROUD Flight diverted after crew observed right engine oil quantity loss approx. 5 hours into flight. Found cracked upper radial drive shroud. 10/11/1996........... R64 RR................... ENGINEFUEL NOZZLE........ Fuel found leaking from Zone 2 during investigation of R63 oil loss. Source of fuel leak was a cracked weld on the No. 24 fuel nozzle (top dead center). 10/25/1996........... R65 RR................... ENGINERADIAL DRIVE SHROUD After engine shutdown at the gate, the right engine oil quantity indicated 9 qts. Upper radial drive shroud found cracked. 11/12/1996........... R67 RR................... ENGINE..................... ``ENGINE OIL PRESS R'' EICAS message displayed after landing. Engine shut down. Oil pump drive shaft found sheared. 1/26/1997............ R91 RR................... ENGINESTEP ASIDE GEARBOX. Low oil quantity caused by crack in step aside gearbox housing approximately 4 to 5 inches long. 5/24/1997............ R109 RR................... ENGINE..................... Engine was shut down on takeoff following high power surge. Subsequent borescope inspection revealed HPC rotor 1 blade failure caused by foreign object damage that was consistent with blade damage noted on 5/20/97 inspection. 7/7/1997............. R112 RR................... ENGINE..................... Aircraft diversion caused by excessive oil leakage due to incorrectly installed lower bevel box Oring seal following radial drive shaft replacement. 7/26/1997............ RR................... ENGINE..................... Aircraft diversion due to high oil consumption. Not related to step aside gearbox housing cracking problem. [[Page 35340]]
9/16/1997............ R113 RR................... ENGINE..................... IFSDEngine shutdown at 400 feet after takeoff due to high pressure compressor failure. Reliability of 737NG

As part of the process of reviewing existing methods for ETOPS approval, the FAA also analyzed data from the initial inservice period for Boeing Models 737600, 737700, and 737800 powered by CFM567 engines. As a group, these variants of the 737 were referred to as the 737 Next Generation, or ``737NG.'' Even though early ETOPS special conditions were not issued, the 737NG was chosen for this analysis because it followed an ETOPS approval process program that was very similar to what Boeing is proposing for the 777300ER. Several months after entry into service, however, the 737NG did not exhibit an acceptable level of propulsion system reliability for ETOPS approval. Early ETOPS special conditions were intended to identify a design not suitable for ETOPS approval prior to type certification.

Boeing proposed in 1994, prior to the 777's type certification, that the 737NG be certified as an early ETOPS airplane in a manner similar to the 777, but without all of the testing required in the 777 special conditions. Since the success of the 777 program was still an unknown at the time of Boeing's request for the 737NG, the FAA did not agree to Boeing's proposed changes to the airplane demonstration test requirement. Early ETOPS special conditions for the 737NG were never issued. Even so, Boeing proceeded with those elements of the 777 special conditions that the company had proposed to accomplish. These included the relevant experience assessment, design requirements assessment, 3000cycle propulsion system ground test, and enhanced problem reporting and resolution.

Although the FAA never issued special conditions for the 737NG program, we agreed that the elements from the 777 special conditions that Boeing did accomplish justified a reduction in the service experience normally required for ETOPS type design approval, as outlined in AC 12042A. Boeing presented the following information in support of its request for a reduction in service experience required for ETOPS certification.
[sbull] ``Design involved lessons learned, similar to 777 Early ETOPS process.
[sbull] ``APU most thoroughly tested in Allied Signal historymore than 3000cycle ground test, including hot/cold exposure.
[sbull] ``Propulsion system subjected to 3000cycle ground test, intentionally unbalanced, with three 180minute diversion cycles. [sbull] ``Flight testing included a Southwest Airlines 50cycle demonstration, using airline crews and maintenance. During the Function and Reliability testing, 61 ETOPS cycles were conducted with three single engine 180minute diversions.
[sbull] ``A proposed ETOPS problem tracking and resolution system, similar to that used on the 777 that will remain in effect until the fleet attains 250,000 engine fleet hours.''

In its analysis of the 737NG approval process, the FAA noted that these program elements, at the time, had been accomplished with good results. The engines and airplane system had performed well during the test programs, with results comparable to the 777 test fleet (all engines). The inservice 737NG airplanes had achieved a 98.96% dispatch reliability rate after 45 days in service, better than any previous Boeing airplane. Boeing's proposal included an accumulation of 15,000 fleet engine hours of service experience before requesting ETOPS approval. At that time, there would be three airplanes with more than 1000 flight cycles, the total 737NG fleet would have accumulated more than 20,000 flight cycles, and the hightime airplane/engines would have more than 2000 flight cycles. During the 737 NG approval process, the FAA concurred with Boeing's proposal to require 15,000 hours of service experience based on the following:
[sbull] ``The FAA has agreed to the concept that ETOPS at entry into service can be achieved by appropriate design and testing as evidenced by the 777 special conditions, which have now been validated through actual service experience,
[sbull] ``The 737NG/CFM567B airframe/engine configuration is a derivative/evolution of the existing 737300/400/500 which through extensive service experience has demonstrated exceptional reliability, and, is approved for 120minute ETOPS,
[sbull] ``Except for the lack of a dedicated 1000cycle ETOPS test program, design and testing of the 737NG/CFM567B mirrors what was done on the 777 to satisfy EarlyETOPS approval.
[sbull] ``The additional 15,000 engine hour inservice evaluation plus the fact that three 180minute single engine diversions were performed during Function and Reliability testing more than compensates for the omission of a 1000cycle test,
[sbull] ``The satisfactory performance of the 737NG/CFM567B airframe/engine configuration during the certification testing, and [sbull] ``The proven ability of Boeing to satisfactorily manage ETOPS airworthiness of the 777 fleet in the face of problems encountered in service. The 737NG proposal includes a problem tracking and resolution system that will remain in effect for a full 250,000 engine hours.''

The Model 737700 was the first variant of the 737NG to enter service, in December 1997. Section 4.2 of the FAAapproved 120minute ETOPS Airplane Assessment Report for the 737700, Boeing Document Number D033A003, Revision B, states that the Model 737700 was designed, manufactured, and tested for extended range operations at entry into service. The following additional supporting statements were also made.

a. ``The 737700 airplanes have been designed and manufactured based on regimented application of lessons learned from other ETOPS program experience as well as the inservice experience of earlier 737 models.

b.``The 737700 airplane was subjected to a rigorous test program as described in following paragraphs. Production equivalent equipment where appropriate, was used to support test objectives. Equipment was production equivalent as defined at the time of the test.''

No significant propulsion system design problems occurred during any of the testing described above. Two inflight shutdowns did occur during certification flight testing. One was caused by an indication fault within the electronic engine control that was corrected with a simple software change. The other was caused by an inappropriate flight test condition.

[[Page 35341]]

Boeing stated in the 737700's 120minute ETOPS Airplane Assessment Report that the fleet reached the 15,000hour mark during the month of April 1998. At that time, there had been no inflight shutdowns in service. However, on May 9, 1998, before the FAA had completed its assessment of the airplane for ETOPS approval, the first inflight shutdown occurred. A second inflight shutdown occurred during the month of May, and the fleet exceeded the accepted 120minute ETOPS standard of .05 inflight shutdowns per 1000 engine hours. Three inflight shutdowns occurred in June 1998, and one in July 1998. The peak inflight shutdown rate during this period was .085/1000 hours at the end of June 1998, which clearly did not meet the minimum standard for ETOPS type design approval.

The six engine inflight shutdowns were caused by three different failure root causes. Boeing and CFMI, the engine manufacturer, undertook aggressive actions to correct each of these design problems as they occurred. The high rate of fleet hourly accumulation during this period, however, resulted in new ETOPS reportable events occurring faster than the known problems could be corrected. This delayed FAA consideration of the 737700 for ETOPS approval until the problems were brought under control. A consequence of the high rate of fleet hourly accumulation was that, with no additional inflight shutdowns, the inflight shutdown rate decreased rapidly and was within the ETOPS type design approval standard by the end of 1998. The FAA approved the 737 600/700/800 (737NG) for 120minute ETOPS approximately one year after entry into service with over 300,000 enginehours of service experience and an inflight shutdown rate of .020/1000 hours.

Conclusions From Comparison of 777 and 737NG

In comparing the 737NG experience with that of the 777, the FAA observes that there is a fleet hourly accumulation rate above which aggressive problem management to qualify for early ETOPS certification may become resource prohibitive. Therefore, when certifying an airplane/engine combination that will be entering service with a high production rate resulting in a rapid accumulation of engine hours, manufacturers may find it more costeffective to use the service experience criteria of AC 12042A than to follow the rigorous requirements of the early ETOPS process.

As stated earlier, the 777 ETOPS special conditions were designed to ``result in a level of airplane reliability that is equivalent to the level of reliability previously found to be acceptable based upon service experience.'' As previously noted, the current 777 ETOPS special conditions consist of five main elements needed to provide adequate compensation for the service experience normally required for 180minute ETOPS eligibility described in AC 12042A. No single element is considered sufficient by itself, but the FAA has found that the five elements combined provide an acceptable substitute for actual airline service experience. The five elements are:

1. Design for reliability.

2. Lessons learned.

3. Test requirements.

4. Demonstrated reliability.

5. Problem tracking system.

Even though the overall objective is a level of airplane and propulsion system reliability that is equivalent to that achieved through service experience, we considered the uncertainty of actually achieving that goal in the development of these special conditions. The first three elements focus on designing an airplane to eliminate sources of engine inflight shutdowns and diversions to the greatest practical extent. This is accomplished by an overall design philosophy to preclude sources of engine inflight shutdowns and diversions using the manufacturer's experience with earlier designs to identify successful and unsuccessful design features. The additional testing required by the special conditions focuses on exposing the design to conditions that in the past have contributed to engine failures, such as high engine vibration or repeated exposure to humid and inclement weather on the ground followed by longrange operation at the extreme cold temperatures at high altitude. These design and test elements do not assure a level of reliability that is equivalent to that based on service experience. Instead, they result in an acceptable level of inherent design reliability from which we can successfully manage ETOPS fleet safety once the airplane enters service.

The fourth element, ``demonstrated reliability,'' provides the FAA with a standard by which to judge a design against existing ETOPS approved airplanes. This gives the FAA a standard from which to withhold ETOPS approval from airplanes that experience significant failures during certification testing, demonstrating that they are not suitable for ETOPS. However, it does not by itself guarantee that designs showing no significant failures during flight testing will have adequate reliability for ETOPS.

To manage fleet safety after ETOPS approval, we rely on the fifth element of the ETOPS special conditions. Paragraph (f) of the special conditions requires a problem tracking system for the prompt identification of those problems that could impact ETOPS safety. The FAA uses this enhanced problem reporting system to work with the airplane and engine manufacturers to aggressively manage and correct significant design problems identified after ETOPS approval. This requirement is the ``catchall'' for those design flaws that are not caught by the other special conditions elements during airplane design and testing.

The first inservice inflight shutdown of the 737700 variant of the 737NG did not occur until the fleet had accumulated approximately 30,000 enginehours. The FAA could not have expected that a complete 1000cycle airplane demonstration test would have had a better chance of discovering the types of problems that occurred in service on the 737NG than the nearly 30,000 hours accumulated on multiple airplanes and engines prior to the first inflight engine shutdown. While significant propulsion system failures occurring during type certification testing, including the additional testing required by the ETOPS special conditions, may indicate that a design is not yet ready to enter ETOPS service, the 737NG experience shows that the reverse cannot be stated with a significant degree of confidence. A lack of significant failures during certification testing does not in itself assure an ETOPSsuitable design at entry into service.

The 777 experience shows that a relatively small fleet can be managed successfully during the initial service period based on the data provided by the enhanced problem tracking system required by special conditions paragraph (f). The 737NG experience shows that a larger fleet may require a much more resourceintensive fleet management program. However, had the 737NG received its ETOPS approval as originally proposed prior to its first inflight shutdown in service, the problem reporting system that Boeing had in place gave the FAA timely identification of the problems causing inflight shutdowns so that we could have required appropriate corrective action through the airworthiness directive process to maintain ETOPS safety. Such airworthiness directives could have required the operators to incorporate design changes prior to
[[Page 35342]]

further ETOPS flight or withdrawn ETOPS approval.

Since we cannot be certain that an airplane approved for ETOPS under the special conditions will have the same maturity at original type certification as an airplane that we have approved based on service experience, our experience with the 777 and 737NG confirms that the five elements of the special conditions, in conjunction with the FAA's normal safety oversight processes, adequately compensate for that uncertainty.

The changes we propose for the engine demonstration test and the airplane demonstration test, including enhanced posttest inspection requirements, are intended to address our experience with the existing ETOPS special conditions, which identified several shortcomings in the original test requirements. We are proposing these changes to more clearly focus the testing on the objective of exposing the engines and airplane to those operating conditions that give us the best chance of identifying underlying major design flaws that could jeopardize ETOPS safety in service. These proposed changes would provide a better evaluation of the design than the existing requirements, including the 1000cycle airplane flight test as previously conducted.

The FAA therefore proposes to change the purpose of the airplane demonstration test requirement of paragraph (e)(7) from being a demonstration of reliability to a demonstration of airplane capability under the types of ETOPS operational and diversion scenarios being proposed in this notice. The requirements of that airplane demonstration test have been changed accordingly.

Aged Engine Requirement

In response to Boeing's request, the FAA is proposing to delete paragraph (e)(7)(ii), which currently requires the installation of the engine and propulsion system from the 3000cycle engine demonstration test required by paragraph (e)(6), or another suitable aged engine, on the 1000cycle demonstration test airplane for a minimum of 500 cycles. Boeing provided the following information in support of its request for deleting the aged engine requirement:

Review of the aged engine data from the baseline 777 program showed that the nature of the findings, which occurred on the aged engines, was not related to the aging of the engines. The findings were related to the variation that occurs during manufacturing, assembly, etc. This lesson learned on the aged engines is consistent for each engine manufacturers' baseline 777 ETOPS test program.

The lack of findings related to the aging of an engine in the ETOPS flight test program has been demonstrated three times. Based on this consistent demonstration, there is no further need to maintain the requirement for an aged engine in the flight test program. Additionally, flying more airplane/engine combinations will provide increased opportunities for evaluating potential problem areas.

Boeing reported nine events (EE1 Reports) which occurred during the ``aged'' engine portions of the 1000cycle tests for the three baseline engine types, with an explanation of why the aged engine requirement was not necessary in order to identify each failure. Boeing stated that the lack of any EE1 reports from t

FOR FURTHER INFORMATION CONTACT Steve Clark, FAA, ETOPS Project Manager, Seattle Aircraft Certification Office, Propulsion Branch, ANM 140S, Transport Airplane Directorate, 1601 Lind Avenue, SW., Renton, Washington, 980554056; telephone (425) 9176496; facsimile (425) 227 1180.