ATM Modernization, Business & GA, Commercial, Military

Safety: ETOPS Revisited

By David Evans | March 1, 2003

Electrically related in-flight fires may be a greater threat to the safety of long-range flights than engine failures. A new report on extended twin-engine operations (ETOPS) marks a major effort to rationalize a regulatory patchwork dating back at least to 1985. The report may aggrieve operators of three- and four-engine air transport aircraft, as it requires them to incorporate sufficient in-flight fire suppression to handle the longest diversion to an alternate airport–the same requirement applied to twin-engine airliners.

The currently approval standard for 180-minute ETOPS (i.e., three hours to an alternate airfield on one engine) is 0.02 shutdowns per 1,000 hours of engine operation. That’s an in-flight shutdown (IFSD) rate of one every 50,000 hours. Many of the world’s 92 ETOPS operators are achieving 0.01 shutdowns per 1,000 hours or, for twinjets on eight-hour ETOPS flights (accumulating 16 hours of total engine time per flight), an average IFSD of one every 6,200 flights.

The advisory committee report maintains that this high level of demonstrated safety sets the stage for flights with longer planned diversion times, from 240 minutes to virtually "unrestricted" ETOPS. Some cautionary observations are in order, however.

Consider, for example, the hazard of in-flight smoke and fire, where the effects can compound, rapidly leading to total loss of control. Often the time from initial smoke detection to loss of the aircraft from fire is in the range of tens of minutes–not three or four hours, as are allowed for an ETOPS diversion. Fire, searing its way through vital electrical, hydraulic and pneumatic systems, implies cascading failures from a common cause. In-flight smoke events reportedly occur, on average, once every 8,700 hours. Pilots therefore are about 5,000 times more likely to face a smoke event than a failed engine.

Paul Halfpenny, a retired aerospace engineer and former vice chairman of the National Academy of Sciences (NAS) Committee on Airline Cabin Safety, observed that a small fire could quickly diminish the ability to see cockpit instruments and controls. He calculated that such a fire could reduce vision to less than 4 inches (10.2 cm) even at maximum cockpit ventilation. The impact of continuous smoke on pilot vision–and on pilot anxiety–would be felt early in the course of a three-hour diversion.

The ETOPS report propounds a safety doctrine of "preclude" and "protect," i.e., first, prevent the need for a diversion, and then, should a diversion become necessary, protect vital systems for safe landing. For the hazard posed by smoke and fire, a number of suggestions come to mind:

  • Cockpit visibility–For all new aircraft designs, the report suggests requiring cockpit ventilation that will allow vision in the face of dense and continuous smoke. The present certification standard calls for ceasing the smoke generation and then, with fans, clearing a cockpit filled with smoke in three minutes. In many cases, the smoke locating, isolating and suppressing procedures take longer, not to mention that fires do not conveniently burn out in three minutes. To displace smoke, the Emergency Vision Assurance System (EVAS) comes to mind. It’s a clear plastic bag, custom-fitted to snug up against the instrument panel and windscreen. After it is inflated, pilots can press their smoke goggles against the bag for surprisingly good vision.

  • Electrical redundancy–The report asserts that aircraft systems, including avionics, "should have the ability to operate acceptably following failures in the cooling system or electrical power systems." Fair enough, but the statement is a bit indeterminate. The report’s electrical generator redundancy criteria are solely a matter of failed generators. For example, twin-engine jets must have three generators, and one of those can be the auxiliary power unit (APU). The report devotes considerable attention to being able to start the APU in flight, all the way up to the airplane’s service ceiling. Not all APUs can do this, so it might be prudent to insist that all APUs be qualified for in-flight operations, irrespective of the number of engines on the airplane. In addition, the ram air turbine, sometimes referred to as the air-driven generator, might be considered a "go/no-go item" for ETOPS.

  • Electrical switching–Electrical bus-tie relays could be included in the definition of Group 1, ETOPS-significant systems. These systems contribute significantly to safety in the event of an engine failure and divert. The bus-tie relay switches loads between engine-driven generators and the APU generator, if it is on line. The bus-tie relay should be considered as a separate stand-alone device. Sources say a redundancy backup is built into some airplanes–but not all of them.

  • Electrical loading: "Power feeds a fire," the saying goes. The report does not address a situation in which the crew needs to quickly shut down all but the barest minimum of flight systems to stop an electrical fire’s rapid propagation. In this event, a previously unpowered and wholly integral circuit that powers a flight essential bus (FEB) may be useful on ETOPS-qualified, if not on all airplanes. Known as the "virgin bus," this concept emerged following the fatal 1998 crash of a Swissair MD-11. Absent the fallback redundancy afforded by a virgin bus, the crew might not be able to continue flight in instrument meteorological conditions (IMC). This leaves two options: restore electrical power and possibly rekindle or worsen the fire, or maintain visual flight rules (VFR), which may not be possible due to weather, time of day (night), or both.

  • Electrical segregation and separation–Low power signal data wires often join high-power circuits in the same wire bundles. Sometimes wiring for numerous flight-critical systems is run in the same bundle. In other cases, bundles are routed together. Swissair’s "Modification Plus" program, resulting from the 1998 crash, shows what can be done to separate wires for increased resistance to cascading electrical system failures (October 2001, page 59).

  • Fire suppression–The report addresses the need for fire detection and suppression in cargo holds for the full time of any necessary diversion, plus 15 minutes. It is difficult to believe that a cargo hold fire can be controlled and suppressed for three hours or more. A smoldering fire or arcing wires might burn through the walls of the cargo bay or even the outer hull, which in either case would mean loss of all fire-suppressing Halon (or other suppressant).

Three actions might increase the level of confidence in this area:

  1. Run maximum-diversion tests with a belly hold fire, in which the contents of passenger baggage include aerosol products. Aerosol products contain natural gases that, when heated to ignition temperature, can explode. Either fire suppression must be sufficient to prevent such "cook-offs," or passengers must be barred from packing aerosol products in their checked baggage.

  2. Increase the Halon concentration from 3 to 5 percent. The civil sector’s 3 percent standard is a minimal capability for fire suppression. Why not apply the military standard of a 5 percent Halon concentration for fire extinguishing?

  3. Provide a belly hold temperature monitor in the cockpit. This gives the pilots at least a rudimentary indication of the suppression system’s success in containing the fire.

  • Unprotected spaces–There are numerous dry bays and areas in the aircraft where fires can wreak their insidious damage. The electronics and equipment (E&E) bays on some aircraft have neither fire detection nor suppression. Both should be mandatory for ETOPS aircraft.

  • Inaccessible spaces–A "nursing home" doctrine could be applied to airliners. Because the mobility of elderly residents is restricted, every square inch of a nursing home must be covered by fire detecting and extinguishing systems. Passengers and flight crews are similarly restricted. Yet in 2003 the aircraft industry is building airplanes that carry more than 400 people and designing 550-passenger airplanes with no fire detection or suppression for hidden cockpit areas, avionics bays or enclosed cabin areas (save the lavatories). As an interim measure, operators should consider installing smoke detectors in inaccessible areas of the aircraft, including at each duct supplied by the air conditioning packs.

Ken Adams, a recently retired Delta Air Lines MD-11 captain, suggests also locating detectors evenly spaced and close to electrical wire, cable and bundle routings throughout the aircraft. This arrangement would give the crew "a much improved capability to isolate and eliminate the source of fire or smoke."

Adams offered another simple idea: Install access ports at potential fire areas in cabin sidewall and ceiling panels, and in the cockpit for access to spaces behind overhead and upright control and circuit breaker panels. These ports would facilitate the direct application of fire extinguishing agent to burning materials/electricals hidden from direct view or access.

Comes the first electrically related loss of an ETOPS airplane from an in-flight fire in the deeper trenches of the ocean, and these suggestions, considered excessively prudent now, could become minimally required overnight.

David Evans may be reached by e-mail at

Receive the latest avionics news right to your inbox

Curated By Logo