Chapter 2 - Design Features and Criteria
2.1.1 A determination must be made that the design features for a new transport category type design aeroplane intended to be used in ETOPS are suitable for such operations. In the event that an existing aeroplane's operation is expanded to include ETOPS operations, a re evaluation of some design features may be necessary.
2.1.2 Modifications to some systems may be required to achieve the desired reliability. In both cases ETOPS significant systems and propulsion systems for the particular airframe engine combination must be shown to be designed to fail safe criteria and to have achieved a level of reliability suitable for the intended operation of the aeroplane.
2.2.1 Upon satisfactory completion of an engineering type design review and test program, which may include a Certification Flight Test evaluation, an ETOPS type design approval is issued. The Aircraft Flight Manual (AFM) or Supplement and Type Certificate (TC) or Supplemental Type Certificate (STC) must contain the following pertinent information:
a) Special limitations, including any limitations associated with operation of the aeroplane up to the maximum diversion time being approved;
b)The airborne equipment, installation, and flight crew procedures required for ETOPS operations;
c) Revision to the performance section including fuel consumption rates;
d) Markings or placards;
e) The maximum diversion time capability of the aeroplane for ETOPS as required by the Time Limited Systems of this manual in accordance with Subparagraph 525.1581(a)(2) of the Airworthiness Manual, Chapter 525; and
f) The following statement: "The type design reliability and performance of this airframe-engine combination has been evaluated in accordance with the "Safety Criteria for Approval of Extended Range (Twin Engine) Operations – TP 6327" and found suitable for (state maximum diversion time) ETOPS operations with the incorporation of the approved aeroplane configuration CMP standard contained in (state description or reference to a document containing the approved CMP standard). This finding does not constitute approval to conduct ETOPS."
2.3.1 The evaluation of failures and failure combinations must be based on engineering judgment and acceptable fail safe methodology. The analysis should consider effects of operations with one engine inoperative, including allowance for damage that could result from failure of the first engine. Unless it can be shown that equivalent safety levels are provided or the effects of failure are minor, failure and reliability analysis should be used as guidance in verifying that the proper level of fail-safe design has been provided.
2.3.2 AIRFRAME SYSTEMS (GENERAL)
a) Airframe systems must be shown to comply with section 525.1309 of the Airworthiness Manual, Chapter 525
b) Extended duration of single engine operations must not require exceptional piloting skills and/or crew coordination. Considering the resulting degradation of the performance of the aeroplane type with an engine inoperative, the increased flight crew workload and the malfunction of remaining systems and equipment, the impact on flight crew procedures must be minimized. Consideration must also be given to the effects of continued flight with an engine and/or airframe systems inoperative on the flight crew's and/or passengers' physiological needs.
2.3.3 PROPULSION SYSTEMS
a) The propulsion system must be shown to comply with section 525.901 of the Airworthiness Manual, Chapter 525
b) In order to maintain a level of safety, consistent with other aeroplane systems, it is necessary to have an acceptably low risk of double propulsion system failure for all design and operational related causes. This implies a relationship between propulsion system reliability and maximum approved diversion time.
c) It must be shown that the propulsion system reliability has reached an acceptable level for ETOPS as determined in accordance with Appendix A of this manual.
2.3.4 AUXILIARY POWER UNIT
If an APU is required to satisfy the type design criteria for ETOPS, the installation must meet:
1) The applicable Airworthiness Manual Chapter 525 requirements; and
2) Any additional requirements necessary to demonstrate its ability to perform the intended function, i.e. start reliability, altitude, bleed air capability etc...
2.3.5 COMMUNICATION, NAVIGATION AND BASIC FLIGHT INSTRUMENTS
It must be shown that, under all combinations of propulsion and/or airframe system failures, which are not extremely improbable, reliable communication, accurate and appropriate navigation, and basic flight instruments needed to comply with contingency procedures for ETOPS will be available.
2.3.6 CABIN PRESSURIZATION
a) A review of fail-safe redundancy features must show that the loss of cabin pressure is improbable under single engine conditions.
b) Aeroplane performance data must be provided to verify the ability for continued safe flight and landing after loss of cabin pressure and subsequent operation at a lower altitude.
c) Unless it can be shown that cabin pressure can be maintained during single engine operation at the altitude required for continued flight to a ETOPS alternate airport, oxygen must be available to sustain the passengers and crew for the maximum diversion time.
2.3.7 CABIN HEATING/COOLING
The air conditioning system must be capable of providing a reasonable cabin temperature in the event of any single or combination of failures not shown to be extremely improbable.
2.3.8 EQUIPMENT COOLING
The data must establish that the required electronic equipment for ETOPS has the ability to operate acceptably with an engine shut down. Additionally, adequate indication of the proper functioning of the cooling system must be verifiable if required, to assure system operation prior to dispatch.
2.3.9 CARGO COMPARTMENT
The cargo compartment design and fire protection system capability must be consistent with the following:
1) Design – The cargo compartment fire protection system integrity and reliability must be suitable for the intended operations considering fire detection sensors, liner materials, etc...;
2) Fire Protection – An analysis or test must be conducted to show, considering approved maximum diversion time (under standard conditions in still air), (including an allowance for 15 minutes holding and/or an approach and landing), that the ability of the system to suppress or extinguish fires is adequate to ensure safe flight and landing at a ETOPS alternate airport; and
3) Main deck Class B cargo compartments (as defined in the Airworthiness Manual, Chapter 525, Section 525.857), with volumes in excess of 200 cubic feet, are to be modified to a Class C configuration or equivalent.
2.3.10 ICE PROTECTION
Airframe and engine ice protection systems must be shown to provide adequate protection capability (aeroplane controllability, etc.) for the intended operation. This must account for prolonged exposure to lower altitudes associated with one-engine-inoperative diversion, cruise, holding, approach, missed approach and landing.
2.3.11 ELECTRICAL POWER
a) Three or more reliable and independent electrical power sources must be available, each capable of powering essential systems independently. If one or more of the required electrical power sources are powered by an APU, hydraulic system, or ram air turbine,
the following criteria apply as appropriate:
1) The APU, when installed, must meet the criteria in Subsection 2.3.4 of this manual;
2) The hydraulic power source must be reliable. To achieve this reliability, it may be necessary to provide two or more independent energy sources (e.g. bleed air from two or more pneumatic sources); and
3) Ram air turbine deployment must be demonstrated to be sufficiently reliable and not require main electrical or engine dependent power for deployment.
b) In the event of any single failure or combination of failures not shown to be extremely improbable, it must be shown that electrical power is capable of providing for:
1) Essential flight instruments, avionics, communications, navigation, supportive systems and any other equipment deemed necessary for ETOPS operations for continued safe flight and landing;
2) Crew cockpit information of sufficient accuracy for the intended operation; and
3) Instruments and equipment needed to allow the flight crew to cope effectively with adverse conditions.
2.3.12 HYDRAULIC POWER AND FLIGHT CONTROLS
a) Consideration of these systems may be combined, since many commercial aeroplanes have full hydraulically powered or "fly-by-wire" controls. For aeroplanes with these types of flight controls, evaluation of system redundancy must show that single failures or failure combinations not shown to be extremely improbable do not preclude continued safe flight and landing.
b) As part of this evaluation, the loss of any two hydraulic systems and any engine should be assumed to potentially occur unless it is established during failure evaluation that there are no sources of damage or the location of the damage sources are such that this failure condition will not occur.
2.3.13 TIME LIMITED SYSTEMS
For each ETOPS Significant System that is time limited, the system capability must be defined. The most limiting ETOPS Significant System capability must be stated in the Aircraft Flight Manual as per the requirements of Subsection 2.2.1 in this manual.
2.3.14 FUEL SYSTEM
The aeroplane fuel feed system must be able to supply fuel to the engine in accordance with sections 525.951 and 525.955 of the Airworthiness Manual, Chapter 525 for all fuel pump power supply failure configurations not shown to be Extremely Improbable. (i.e. the power supply to
the fuel boost pumps must be available for all power supply failure conditions not shown to be Extremely Improbable.) The fuel necessary to complete the ETOPS flight must be available to the operating engine(s) under any failure condition not shown to be Extremely Improbable.
(e.g. crossfeed valve failures, automatic fuel management system failures, etc...).
If suction feed (i.e. fuel feed without boost pumps operating) is considered to be a means by which normal fuel feed pressures can be maintained:
a) Testing should be performed covering worst-case cruise and diversion conditions, with respect to;
- Fuel grade and temperature;
- Thrust variations;
- Turbulence and Negative G forces;
- Fuel system components degraded within their approved maintenance condition; and
b) The unusable fuel quantity in the suction feed configuration should be used when calculating fuel reserve quantity.
2.3.15 MONITORING SYSTEMS
Adequate status monitoring information and procedures on all ETOPS significant systems are required to be available for the flight crew to make pre flight go/no go decisions and in-flight diversion decisions.
Adequate fuel quantity and fuel used information must be available to the flight crew, including alerts, and advisories, that consider the fuel required to complete the flight, abnormal fuel management or transfer between tanks, and possible fuel leaks in the tanks, the fuel lines and other fuel system components and the engines.
2.4.1 For aeroplanes for which ETOPS approval is required, the flight path, range performance and fuel flow must be determined at each weight, altitude and temperature within the operating limits established for the aeroplane. The flight path and range performance must be determined for each selected configuration with:
a) The critical engine inoperative;
b) The remaining engine at the available maximum continuous power or thrust;
c) The means for controlling the engine supplied air-conditioned air to ensure a reasonable cabin temperature; and
d) Consideration of the effects of icing on single engine performance.