On the evening of 1 February 1985, a Trans World Airlines Boeing 767 pushed back at Boston's Logan Airport, bound for Paris. To the passengers it was an ordinary red-eye. It was anything but. Sixteen TWA pilots had been through special training for this route, including simulator sessions for an emergency landing at Sondrestromfjord, a lonely strip in Greenland. Eleven observers from the Federal Aviation Administration were sitting in the cabin, watching everything. And somewhere past the Canadian coast, TWA Flight 810 did something no American twin-engine airliner had ever legally done: it kept flying east until the nearest usable runway was far beyond the old limit.

Every twinjet ocean crossing you have ever taken — and today that is nearly all of them — descends from that one flight. The rulebook that made it possible goes by five letters: ETOPS. Officially, Extended-range Twin-engine Operations Performance Standards. Unofficially, as generations of pilots will tell you with a grin: Engines Turn Or Passengers Swim.

The Sixty-Minute Straitjacket

To understand why that Boston-Paris flight was radical, you have to go back to the age of pistons. Aero engines of the 1930s and 40s were magnificent, temperamental machines that quit with depressing regularity. In 1936 US regulators ruled that airliners had to stay within 100 miles of an adequate airport. By 1953 this had evolved into the famous 60-minute rule: a twin-engine airliner could never be more than one hour, at single-engine speed, from a place to land. Aircraft with three or four engines got a longer leash, on the sensible logic that they carried more spares.

The rule drew an invisible fence across the map. The North Atlantic, the Pacific, the polar wastes — all effectively off-limits to twins. That is why the golden age of long-haul belonged to machines with engines to spare: the Boeing 707 and 747, the DC-8, and later the three-engined DC-10 and L-1011, for which the 60-minute rule was waived in 1964. Twins flew the short stuff. Oceans were for quads and trijets.

By the late 1970s, though, the logic was crumbling. The new generation of high-bypass turbofans was proving vastly more reliable than the piston engines the rule had been written for. Airbus was already flying its twin-engine A300 across stretches of the Atlantic and Indian Oceans under a more lenient 90-minute ICAO recommendation. And at Boeing, an engineer-executive named Dick Taylor — later nicknamed the father of ETOPS — began asking the FAA an awkward question: if the engines almost never fail, why are we still planning as if they always do?

Wendover Productions explains how ETOPS lets small planes cross big oceans.

The FAA's first answer was not subtle. When Taylor approached Administrator J. Lynn Helms in 1980 about an exemption for the new 767, Helms produced one of the great lines in aviation regulatory history.

Hell, as it turned out, froze over in about five years. Boeing and the engine makers buried the regulator in reliability data. The statistics were hard to argue with: engine shutdowns had become so rare that a twin was overwhelmingly likely to complete any crossing without drama, and if one engine did quit, the other — an entirely independent machine — had no reason to follow it. In 1985 the FAA issued Advisory Circular 120-42, allowing suitably prepared twins to fly 120 minutes from an alternate. TWA's 767s were first through the door, and the economics were immediate: the 767 burned about 7,000 pounds less fuel per hour than the three-engined L-1011 it replaced on the Paris run.

Earning the Right to Be Alone

What made ETOPS work was that it was never a simple permission slip. It is a certification regime with teeth, and it bites in two places. First, the aircraft-and-engine combination must earn type approval: demonstrated redundancy in electrics, hydraulics and communications, and an in-flight shutdown rate better than roughly 1 per 20,000 engine-hours for ETOPS-120, 1 per 50,000 for ETOPS-180, and 1 per 100,000 beyond that. Second, each individual airline must earn operational approval — special maintenance programmes, trained crews and dispatchers, validation flights on the actual routes.

The details verge on the obsessive, which is precisely the point. Time-limited systems have to outlast the worst case: the cargo-hold fire suppression, for instance, must keep working for the full length of the longest possible diversion, with a margin on top. Airlines typically arrange maintenance so that the same technician does not perform the same task on both engines before an ETOPS departure — because the nightmare scenario is not two random failures, it is one human error faithfully duplicated on the left and right side of the wing.

The system proved itself quickly. In 1988 the FAA extended the limit to 180 minutes, and ETOPS-180 opened about 95 percent of the earth's surface to twins. The Boeing 777 was designed for this world from the outset and, in a first, entered service in 1995 already ETOPS-180 approved. The trijets never recovered. Within two decades the 747 and A380 were on their way out too, elbowed aside by twins that could fly anywhere the giants could, on far less fuel.

When It Actually Happens

So what does an ETOPS diversion look like in practice? Long before departure, dispatchers select alternates along the route — windswept names like Keflavik, Gander, Halifax and Cold Bay — and calculate equal-time points, the spots where it becomes quicker to press on to the next haven than to turn back to the last one. If an engine fails mid-ocean, the crew flies a rehearsed script: secure the engine, drift down to single-engine altitude, turn for the alternate the plan has already chosen. The remaining engine is certified, quite literally, to run alone for the entire distance — five and a half hours or more on the newest jets.

And because a diversion does not end at touchdown, the rules even require a passenger recovery plan: proof that an airline can shelter, feed and move several hundred people who have just landed unexpectedly on a sub-Arctic island, and get them onward within about 48 hours. A little airstrip with a windsock will not do.

The record shows both how well this works and why the paranoia stays justified. In 2001, Air Transat Flight 236 — an A330, its fuel bleeding away through a fractured line — ran both engines dry over the Atlantic and glided 65 nautical miles to a dead-stick landing at Lajes in the Azores, saving all 306 aboard. It was a fuel-system failure rather than the independent double engine failure ETOPS guards against, but it is the reason diversion airports exist where they do.

Engines Turn or Passengers Swim?

Which brings us back to the joke. The backronym has been around almost as long as the rules, and pilots have heard it more times than they can count. Ken Hoke, a retired 757 and 767 captain who spent years crossing the Pacific under ETOPS rules, offers the standard flight-deck verdict.

He is right about the water, and it is the detail most people miss. ETOPS is not an over-water rule; it is a distance-from-runways rule. There are overland routes across Siberia, the Sahara and the Australian outback that demand ETOPS planning, and bits of ocean that need none at all. The sea is incidental. The loneliness is the point.

How lonely are we allowed to get? In 2007 the FAA scrapped the hard 180-minute ceiling and allowed approvals out to an aircraft's design limit. The Airbus A330 got ETOPS-240 in 2009. In December 2011 the Boeing 777 was cleared for ETOPS-330, and the first revenue flight under that authority — Air New Zealand, Auckland to Buenos Aires — followed in December 2015. The 787 received its own ETOPS-330 ticket in May 2014. And the current benchmark belongs to the Airbus A350, certified by EASA in October 2014 — before it had even entered service — for up to 370 minutes: more than six hours, or some 2,500 nautical miles, from the nearest runway on one engine. That covers virtually the entire planet, the South Pole excepted.

Real Engineering on the Boeing 787 — the jet built from the outset for a 330-minute leash.

Somewhere, one suspects, it is a very cold day indeed. The twins fly everywhere now. The passengers, forty-one years on, have yet to swim.

Sources: Wikipedia, FAA Advisory Circular 120-42B, EASA, Boeing, AeroSavvy, Admiral Cloudberg