When the first of Qantas’s ultra-long-range A350s lifted off from Toulouse this month, it revived a question the industry settled long ago but rarely explains: how is an aircraft with only two engines permitted to fly for hours over open ocean, hundreds of miles from the nearest runway? Aviation Explained looks at the rule that made it possible — and at why almost every new airliner now has just two engines.
The rule that shaped the jet age
For much of aviation history, the answer was simple: it wasn’t. Under a long-standing American regulation often called the ‘sixty-minute rule’, a twin-engine aircraft had to remain within sixty minutes’ flying time of a suitable airport. The logic was straightforward. If one of only two engines failed, the other had to carry the aircraft safely to the ground, and regulators were unwilling to gamble that it could do so across a vast, runway-free expanse of water. Three- and four-engine aircraft were exempt, and so, for decades, the great oceanic routes belonged almost exclusively to the Boeing 747, the DC-10 and their four- and three-engine contemporaries.
How ETOPS works
What changed was not daring but evidence. As high-bypass turbofan engines grew dramatically more reliable, manufacturers could demonstrate — statistically, and over millions of flight hours — that the probability of losing both engines had become vanishingly small. In 1985 this culminated in the first ETOPS approval: Extended-range Twin-engine Operational Performance Standards. A Boeing 767 was cleared to cross the North Atlantic on a route that never took it more than 120 minutes from a diversion airport.
The number is the heart of the system. An ETOPS-180 rating, granted to most long-haul twins, means the aircraft may operate up to 180 minutes — at its single-engine cruise speed — from an adequate alternate. Later approvals stretched that envelope to 330 and even 370 minutes, enough to reach virtually anywhere on the planet. Crucially, the rating is not a property of the airframe alone. It is earned through a demanding package of conditions: proven engine reliability, redundant electrical and hydraulic systems, a cargo fire-suppression capacity that must outlast the longest possible diversion, and maintenance procedures strict enough that the same technician may not service both engines on the same visit. Each flight must also be planned around designated en-route alternates and carry the fuel to reach them.
Why it matters today
The consequences have been profound. Once a twin could fly anywhere, the economic case for additional engines collapsed: two power plants burn markedly less fuel than four, and fuel is an airline’s largest variable cost. The four-engine airliner, embodied by the 747 and the A380, has been quietly retired from most fleets, displaced by efficient twins such as the 777, the 787 and the A350. What had once seemed an iron law of safety — that more engines must mean greater security — was replaced by a subtler principle: two exceptionally reliable engines, governed by rigorous rules, are both safer and cheaper than four.
That is precisely the shift behind this month’s headline. The A350 Qantas is preparing for non-stop Sydney–London services is, in the end, a direct descendant of that 1985 Atlantic crossing — proof of how far an idea, once accepted, can travel. (Pilots, characteristically, reduced the whole regime to a wry backronym: ETOPS, they say, stands for ‘Engines Turn Or Passengers Swim’.)
Think about it
Prefer to write? Pick one or two of these questions and write a short answer — make a point, give a reason, and add an example or detail from the article (point → reason → example).
- The article suggests that ‘more engines means safer’ has been replaced by ‘two very reliable engines plus strict rules’. Do you find that trade-off persuasive, and why might some passengers still feel uneasy about it?
- ETOPS depends as much on maintenance discipline and data as on the aircraft itself. What vulnerabilities does that introduce, and how might an airline guard against them?
- The retirement of four-engine types such as the 747 and A380 is now well advanced. What is gained, and what is lost, when the industry standardises almost entirely on twins?
- Diversion-time limits have crept outward from 60 to 370 minutes. Is there a point at which ‘extended’ becomes ‘too far’?
If you wrote an answer, check it before you reveal the suggested answers:
- Is your main point clear in the first sentence?
- Did you give a reason, backed by evidence or an example drawn from the article?
- Are your sentences linked (because, however, for example) rather than left as a list?
- Capital letters, full stops and spelling checked?
These are model answers — one good response each, not the only one. Compare them with your own thinking.
- The case rests on evidence rather than nerve: engine reliability grew until “the probability of losing both engines had become vanishingly small,” and the rating is earned through redundant systems, fire suppression that must “outlast the longest possible diversion” and split-technician maintenance — so “two exceptionally reliable engines, governed by rigorous rules, are both safer and cheaper than four.” Unease persists because the reassurance is statistical and abstract, while the felt risk is concrete — being “hundreds of miles from the nearest runway” over open ocean — and ‘more engines’ remains an intuitive safety signal that data alone does not dispel.
- Because the rating “is not a property of the airframe alone” but rests on maintenance discipline and demonstrated data, the exposure is human and procedural: a maintenance lapse, or reliability figures that no longer reflect an ageing fleet, could erode the margin invisibly. The article names one built-in guard — “the same technician may not service both engines on the same visit,” so a single error cannot disable both — and the wider defence is the regime’s strictness: “designated en-route alternates,” mandated diversion fuel, and continuous reliability monitoring so the statistical case is re-earned, not assumed.
- The gain is chiefly economic: “two power plants burn markedly less fuel than four, and fuel is an airline’s largest variable cost,” which is why efficient twins “such as the 777, the 787 and the A350” have displaced the 747 and A380. What is lost is harder to price — fleet and route diversity, the very-large-capacity aircraft the A380 represented, and the intuitive redundancy of four engines. The article frames the shift as trading “an iron law of safety” for “a subtler principle” — efficiency bought with a narrower variety and a thinner physical margin.
- In practice the envelope already nears its natural ceiling: limits have stretched to “330 and even 370 minutes, enough to reach virtually anywhere on the planet,” so distance itself is no longer the binding constraint. A defensible ‘too far’ line is where the supporting conditions stop scaling — a 370-minute diversion still demands fire suppression that can “outlast the longest possible diversion” plus the fuel and alternates to match; once any of those cannot keep pace, the time limit has outrun its safeguards. So it is better judged by whether the conditions remain demonstrably met than by a fixed number of minutes.
Now improve your answer. Compare it with the suggested answer — that is one good response, not the only one — then redraft yours to make the point or the evidence stronger.
This shift is exactly what made the news this month, when Qantas flew the first of its ultra-long-haul A350s built for non-stop Sydney–London routes.
CEFR Level C1 / ICAO Level 6