The article that follows was something I wrote in 2001 as a check airman for my fellow ATA Airlines Lockheed 1011 pilots operating internationally and overwater. It is based on Part 121 and the ATA Airlines General Operating Manual (GOM), but I have added explanations in brackets as necessary where a reference might not be clear to a non-ATA pilot. It will be of interest mainly to transport pilots flying three and four engine aircraft, but I hope others will find it interesting and useful as well. September 17, 2007.

Equal Time Point Considerations

I’ve been taking check rides from Tom Hopp [a former Eastern Airlines captain and check airman, now an ATA simulator check airman and examiner] for almost my entire career at ATA. We both started at ATA within two weeks of each other, and he’s been lying in wait for me ever since. No matter how many times I have put myself at his mercy, he always seems to come up with something new to trip me up. The last time he had me in his sights though, I thought it would be different. I had a notebook full of surprises from previous check rides, and I was there for a simple SVT where he tells you in advance what he’s going to do, and virtually the order in which he will do it: a normal takeoff, an all engine non-precision approach, a rejected takeoff, an engine failure past V1 but before V2 followed by a two engine approach to a go-around, loss of the second engine on down wind with a single engine approach and landing. We had already done the non-precision approach and rejected takeoff, so their wasn’t much mystery about what was coming next: an engine failure just past V1. I pushed the throttles up, reminded myself that there was no law that said he couldn’t give me another rejected takeoff but heard and saw nothing coming up on V1, worked hard on tracking the centerline knowing full well what was about to happen, heard “V1, rotate”, waited for someone to say, “Engine failure,” but heard nothing. I glanced down at the engine gauges, but they were all normal, heard, “Positive rate,” said, “Gear up,” and then just sat there, trying figure out what was going on, feet spring loaded but with nothing to shoot at. Dead silence. We went through 300 or 400 hundred feet, and I finally decided he either wants to see another non-precision approach, or else maybe we’re going to do an all engine autoland or PAR, but what we’re clearly not doing is a “V1 cut.” Then it happened: “Engine failure.” Only now I had no center line. All I had was an attitude indicator which was slowing rolling, a flight director that was telling me to steer left, an airspeed indicator that was showing a slow deceleration, and an altimeter that was no longer climbing. My instinctive response was to bank into the good engine, which was wrong, didn’t work well at all, then I remembered my feet but forgot to get rid of the bank, wrong again, and Tom Hopp had done it to me again. I’m sure he thought it was real funny. The engine is supposed to fail at V1 while you can still see the centerline. We all know that, we train for it, we prepare for it, and just because Eastern had engines fail at points other than V1 doesn’t mean we have to train that way here.

But it’s the FAA that really got me into the mess. The FAA wants to see engine failures tested at the most critical point from a performance point of view, and that is directly after decision speed with the aircraft as low, slow, and dirty as it can get. The assumption is that if both the airplane and the pilot can handle the worst case situation, then anything after that doesn’t need to be tested. But while that may be the most critical point from a performance point of view, it isn’t necessarily the most critical point from a handling point view, as I demonstrated. That point comes with an engine failure low and slow, to be sure, but also without any visual references and by surprise. And by analogy, the same holds true for ETPs—Equal Time Points—which is why I have indulged in this rather lengthy introduction. We compute and plot an ETP for the most critical performance situation enroute—the simultaneous failure of two engines—knowing full well that that is almost certainly never going to happen, while somewhat overlooking situations which can and do happen where the ETP is a critical factor in the decision making process. One is a regulatory, theoretical, worse-case scenario, carefully computed and plotted and prepared for but seldom having any real world value, and the others are all the things that actually happen that are not very carefully anticipated or prepared for. So let’s start with what the regs say and require, the worst case scenario, and build from there.

Some basics. ETP’s are a product of Part 121, and specifically that subsection that details the enroute limitations for transport category turbine powered aircraft certificated after August 29, 1959. That’s us. The first limitation deals with one engine inoperative, and basically says you have to be able to clear all terrain after the failure enroute of one engine. That’s normally not a problem for those of us lucky enough to be flying the three motor jobs, but is for the 757 guys Tom Hopp beats up on now. The second enroute limitation is for two engines inoperative. Note that in neither case does it matter how many engines you start with. The more the better, but even if you have six engines, you still have to meet the enroute limitations requirement for the failure of one and two engines (it’s just easier if you have more).

The reg provides two ways to deal with the loss of two engines. The first is simple: don’t ever get more than 90 minutes, with all engines operating at cruising power, from a suitable airport. (“Suitable airport” is defined separately but basically requires that it have a runway long enough to land and have a 40 per cent margin above the minimum landing distance.) If you do that, you don’t have to be concerned with any performance limitations following the lose of two engines. This allows two engine aircraft to fly at all under Part 121, and allows the rest of us to fly most of the time without having to worry about what we’re going to do if we lose two engines—we land at the nearest suitable airport which should be no more than 90 minutes away. (Single engine speeds are slower than all engine speeds, so it could end up being a little more than 90 minutes away, but not by much.) I don’t know what those guys with two engines do when they lose two engines, and I hope I don’t ever find out.

The second part provides a way for aircraft with more than two engines to get further than 90 minutes from a suitable airport, but at a price, and that price is the ability to show that after the simultaneous failure of two engines at the most critical point—the farthest point away in terms of time—that the flight can still continue to a suitable airport, clearing all terrain and obstructions by 2000 feet, and arrive at least 1500 feet directly over the airport with at least 15 minutes fuel remaining (4000 pounds total in our case). Fuel dumping is allowed.

The most critical point is what we call the ETP—the Equal Time Point—that point along the route of flight where it takes just as much time, and therefore just as much fuel, to proceed forward to a suitable airport as it would to turn back to one. If there never were any wind, that would always be the halfway point, allowing for the four minutes or so it takes to turn around, but wind moves the ETP backwards with a tailwind and forwards with a headwind in ways we all learned to compute at Mark Barnard’s or Gene Freemen’s knee [ATA navigation instructors]. Now the ETP computation is done for us by dispatch, we dutifully plot it on our charts, and that’s pretty much the end of it, because if we lose an engine it will usually be pretty obvious which is the better course, turn back or continue, and if it’s not obvious, if we lose one close to the ETP, then that’s what it’s for, to help decide (but even there, with two still running, there is some “wiggle” room).

With the lose of one engine we know we will have to descend to a lower altitude, maybe as low as FL 190, and we know that our fuel burn will increase because of the inefficiency of flying on two engines at a lower altitude, but unless fuel was critically low prior to the engine failure, we will still probably have adequate fuel to reach a suitable airport even with one out: surprisingly enough, a well trimmed airplane flown at long range cruise doesn’t burn a whole lot more fuel with an engine out than it does with all engines operating. (But long range cruise at FL 190 will be slow—you can’t fly at FL 190 on two engines at Mach .84. Well, actually you can, but only for a little while.) Normal cruise at FL 350, 400,000 pounds gross weight, for instance, is 485 knots with a total fuel flow of 17733. Long range cruise at FL 190 (stabilizing altitude at 400,000 pounds), is 416 knots with a total fuel flow of 18126—slower with a slightly higher burn, as expected, but not significantly so. If you lost the engine with, say, two hours to go at normal cruise, it would take about 2 hours and 25 minutes at the lower altitude, increasing the burn from 35466 to 42234 pounds, a difference of about 7000 pounds. (Actually, it wouldn’t even be that much because I figured that based on a constant burn over the entire two hours and 25 minutes—I don’t have a flight planning computer handy—whereas in reality either the burn would drop or the speed increase as fuel burned off, as always. So 7000 pounds is on the high side in this case.) That’s a big hit, but this is a worst case scenario, and as I said, unless fuel was critical before the failure, you should be able to live with that. Go arounds and diversions to alternates might be jeopardized, but remember, you just lost an engine over water: declare an emergency, call ahead and get priority with a secure runway, and then shoot a coupled autoland approach to Cat III minimums if necessary. We know the airplane can do it. But it can’t fly without fuel. Take the go around or diversion out of play.

So, you’ve lost an engine two hours out, but it’s under control and you have a plan that you are confident will get you to dry feet safely. Now, what if you lose another one. Oh boy. The first thing I would think of is that the odds of losing two engines within the space of two hours for unrelated reasons are about the same as for Ed McMahon meeting me on the ramp at Shannon. Therefore, if two can go, three can go, so at some point, in addition to briefing the senior flight attendant on the engine failures, I would instruct him or her to start preparing for ditching, as a precaution. It can’t hurt, it might end up being necessary, and the old military adage of a busy troop is a happy troop applies here. (“Happy” might be a stretch, but having something to focus on besides what just happened can only help.)

The first thing to do, obviously, is to go to max continuous power, IR [Increased Rating] if available, just like in the sim. It doesn’t matter if you are on downwind or at altitude, with one engine you need all the power it’s got. Trim for the yaw, get a drift down speed, trim for that, and declare an emergency if you haven’t already. Then start to think about your stabilized level off altitude. If this is a second failure following an earlier failure, then the ETP decision should already have been made: either you had already decided to turn back or you have been continuing on after the failure of the first engine. (While, in theory, ETP_1, ETP for one engine remaining, is not exactly the same as either ETP₂ or ETP₃, because of differences in the winds aloft for the respective cruising altitudes for each, in practice they will be very close to each other.) So once you have made a decision either to continue or to turn back, you are committed to it even if another one fails.

You knew fuel was going to be more critical after the failure of the first engine. Now, having lost another one, it can only be worse. Remember that all you were guaranteed prior to takeoff was 15 minutes of fuel overhead the airport after the simultaneous failure of two engines at the ETP. So if you lost one, and have stabilized at some lower, two engine cruise altitude, and have been flying there for awhile after having either turned around or continued on, your fuel situation would actually be worse than if they had both failed at once. But then again, you are not exactly at the ETP either—you have already covered some ground either going back or continuing on, which is much more important, and the further you are from the ETP the better. So the seriousness of the situation really depends on how close to the ETP the second failure occurred.

In any case, fuel is an issue, and probably the last thing you want to do at this point is to dump fuel, but that may be what you have to do. Remember that the regs allow for dumping fuel to meet the ETP requirement. If you are on a very long range flight, say New York to Athens, then you would still be very heavy over the Atlantic portion of the flight, so heavy that the stabilized level off altitude would be below sea level. That’s not good. You are a little bit between a rock and a hard place: if you hang on to the fuel, you should have more than enough to get across, but won’t be able to stop the descent. If you dump fuel, you’ll be able to level off above the water, but only because you just threw away a bunch of fuel you would love to still have. Obviously, you have no choice. It’s like those frustrating multiple choice questions where one answer is supposedly more correct than another. In this case, one of these choices is less bad than the other.

How do you know whether you need to dump or not? You could refer to the Performance section of the Aircraft Operating Manual, but my guess is with everything else going on—multiple check lists, frightened flight attendants and passengers (of course the three of you are still so cool all you’re thinking about is whether this is going to get you out of your next pairing), calls to Stockholm Radio for phone patches, and trying to figure out what caused two engines to quit and hope it is not something common to all three—hauling out the AOM from under the desk may not be the first thing you think of. The quick answer is on the flight plan. If dumping is required, it will say so in the ETP section, second line, which will look something like this:

KBWI/ETP BURNOFF 74691 MAGW 395600 DUMP 0.

MAGW is the maximum allowable gross weight at the ETP, and the number following DUMP is the amount of fuel that must be dumped at the ETP to reduce to that gross weight. The important number is the first one, MAGW, because you could be much heavier than that if your engine failures occurred early on during the crossing. It may say “0” after dump, but that assumes you got to the ETP before losing your second engine, didn’t put any extra fuel on, got your flight planned altitude, and so on. If you weigh more than the MAGW figure, you’re going to have to dump. You can check that number out by going to the Performance section, page 150, the Single Engine Driftdown/Cruise Climb Procedures. That chart starts with a weight of 373000 for ISA up to +9, and there is a note, number 2, that says that if aircraft weight exceeds that shown on the chart, then fuel jettisoning should be considered. However if you go to the two engine inoperative long range cruise charts on the pages that follow (page 154-164), there is a chart for cruise at 1000 feet, 390000 pounds, ISA to ISA +20. So after allowing for the burn drifting down to 1000 feet, you can see where a number like 395600 for maximum allowable gross weight comes from.

There is another interesting part to that note, and that is that it says that the path down to 15000 feet is not significantly affected at higher gross weights, and that if fuel dumping is required it should be delayed until 15000 feet and accomplished by 11000 feet, and that the dump rate is approximately 4500 pounds per minute. Even at the heaviest weights, you would still have quite a bit of drift down time remaining at 15000 feet—it will still be coming down, but much more slowly as it approaches its stabilized driftdown altitude, so you should have plenty of time to dump beginning then, and, having burned some coming down, would know with more precision how much remained to dump at that point.

So the old adage that the only time you have too much fuel is when you’re on fire isn’t exactly true. Too much fuel is a very real possibility following a second engine failure, depending, of course, on how much you started with and when the failures occurred. You have to get that weight down to where the airplane can maintain altitude on one engine, and that may mean having to dump fuel. You don’t have any other choice: you can’t very well toss passengers out, and while you might like to be able to dump bags or cargo, there isn’t any real good way to do that either. You can’t even dump the lavs. You’re stuck with everything you took off with except the fuel. Which is why fuel planning and watching your payload—your zero fuel weight—is so important anytime dumping is required to meet ETP requirements.

In fact, the GOM says that no additional fuel or payload may be added without coordination with dispatch. In other words, the captain may not add up to 6000 pounds of discretionary fuel as normally allowed if dumping is required. And he or she would be foolish to add payload above that flight planned, unless he traded it for less contingency fuel—fuel over the minimum. (If you aren’t sure why, read the preceding paragraph over again.) I’m not sure why the GOM doesn’t let us add fuel, up to 6000 pounds, as always—it just means more to dump if it comes to that—but I assume dispatch is just being very conservative. But whatever the reason, the simple fact is this: however unlikely it may be that you will simultaneously lose two engines exactly at the ETP, if you want to make sure you are legal you better check with dispatch before adding any extra fuel or payload. In practice, a little extra fuel or payload probably isn’t going to hurt you because you are almost certainly not going to lose two engines at the ETP. But if you’re paperwork is selected by a Fed for audit, look out. That would be a really stupid way to pick up a violation. And if you were unlucky enough to lose two at the ETP with more than flight planned payload, that would be a really bad way to end a career. Could be a very long, lonely retirement, assuming you were lucky enough to successfully ditch the thing, get in the rafts, and then survive long enough to be rescued. And with the kind of luck that got you in that mess, I wouldn’t count on that either. (Anyone want to go see “The Perfect Storm” again?)

So are there two or three simple lessons we can get out of this? I think so. One would be to remember that minimum fuel doesn’t just mean minimum fuel to reach your destination and alternate, it also means minimum fuel to reach a suitable airport after the loss of two engines at the ETP with 15 minutes of fuel remaining. The word “minimum” really takes on new meaning here.

Another is that if you do lose an engine, the farther you can get from the ETP before a second one fails, the better off you’re going to be.

And the third is don’t ever, ever put on more payload than you’re flight planned for unless you can reduce fuel by an equal amount, never of course reducing below minimum. Otherwise you may find yourself trying to figure out how to break into C1 and C2 [cargo bins] from the galley, open the doors from the inside, and shove everything out except yourself. I can’t wait to see what that logbook write-up might look like: “At 30 West simultaneously lost all power on engines 1 and 2. Unable to restart. On postflight found two cargo doors, all bags, and the Flight Engineer missing. No FIRM code. No other defects noted.” (And the info line for that week would begin again with, “Well, we had another rough week operationally…”). Just remember, if dumping is required, watch the payload. And dumping will be required anytime you lose two engines with a gross weight greater than that shown on the ETP section of the flight plan. That’s the long and the short of it.