Why do uncontained engine failures still occur?

Question

One of the absolute requirements of an aircraft turbine engine (usually some sort of turbofan or turboprop) installation is that, in the event of a destructive failure of the engine, the engine cowling must be able to contain any and all fragments released in the process. In layman’s terms: engine blow up, engine parts stay in cowling. The cowling’s ability to contain an engine disintegration must be demonstrated in testing. All of this has been the case, without exception, for decades.

And, yet, uncontained engine failures continue to occur. As recently as October 2016, a 767’s engine exploded during takeoff. (Yes, I know about the one with the 737 earlier this year, but that one’s still under investigation, and, as such, off-topic until the NTSB releases their final report.)

Why is this? It can’t be for lack of testing capability, as the engine manufacturers can and do – indeed, are required by law to – blow up engines in their test stands to verify their inability to escape their cowlings, and causing an engine failure for such a purpose is ridiculously easy: wrap some detcord around a fan or turbine blade (to test against the engine throwing a blade), tie it to a fan or turbine disk (to test against one of the rotors seeing fit to come apart in flight), or wrap it around the engine shaft (to test against a shaft separation and consequent turbine overspeed and disintegration, LOT 007-style), run the engine up to full blast, and push the button. So why do engine cowlings still sometimes fail to contain rapid unplanned engine disassemblies?

Answer 1

One of the absolute requirements of an aircraft turbine engine (usually some sort of turbofan or turboprop) installation is that, in the event of a destructive failure of the engine, the engine cowling must be able to contain any and all fragments released in the process.

No, there is not. The requirement is that the engine cowling must be able to contain fragments released in case of a single blade failure.

If just a blade fails, it will often break more downstream, but as long as it is just blades breaking loose, the casing should be able to stop them and generally does.

However if the disk that holds the blades itself breaks, the energy is much higher and the cowling can't stop that. It is not really possible to make it strong enough to contain this as it would be too heavy for flight, so it is not a requirement.

All¹ the recent cases of uncontained engine failures were that the whole disk broke and left the engine in several large pieces.

---

¹ The Southwest flight 1380, B737 near Philadelphia on Apr 17th 2018 is a kind of exception. It was only a blade failure, but it was also initially contained. The blade that failed was actually stopped by the cowling. However then a secondary failure of the inlet cowling itself, well ahead of the fan, occurred and that was what caused the further damage and injury.

Answer 2

It's been pointed out that a single blade may be contained, but having a whole stage fail is an extremely high energy event. The high speed spool of a turbine engine is spinning at 10's of thousands of RPM. The energy in that system is too high to contain economically.

But you can't just have engines exploding and do nothing about it. As with any safety issue, it comes down to a negotiation between the manufacturer and the regulators. If the failure can't be contained, you have to mitigate the risk some other way.

Manufacturers look at how a failure is likely to occur and do their best to protect critical systems, either by routing them elsewhere or by shielding local areas. The FAA has published AC 20-128 to address this. It's particularly important that the other engine of a twin-engine aircraft is protected, as well as the hydraulic systems, and critical structure.

Uncontained failures are still taken pretty seriously by investigators, and they work to find answers so that future occurrences might be prevented.

Answer 3

To make it absolutely impossible would mean creating an engine casing so thick and heavy it'd make it pointless to have the engine in the first place as it would barely if at all be able to lift the engine casing, let alone the entire aircraft.

So compromises have to be made, and that means designing things where the chances of a blade detaching at high speed are minimised as much as possible unless other catastrophic events are also happening that would bring the aircraft down anyway.

That's always the case with engineering. The perfect solution for one set of requirements tends to lead to something that's impractical to say the least in reality, therefore you have to trade off something for something else and come up with a working solution that gets the job done within the parameters described and is the best possible solution everywhere else within budget (be it energy, cost, size, risk, or usually a combination of those).

That's why modern nuclear power stations are so large and have massively thick concrete domes over the reactors. That's not for any scenario that's likely to happen in real life, it's for the extremely remote chance that a large asteroid falls onto the dome, or someone flies a large aircraft into it at high speed.

For those things, weight and to a degree cost aren't really a factor in determining what can be built, so they go all out and can get the risk factor down to just about 0.

Can't do that in an aircraft where you're restricted severely by both weight and size and to a large degree cost as well (make it too costly and you no longer have a competitive product), and that's before even considering materials which mean that within the size and weight restrictions you can't get more than a certain strength no matter the cost.

Answer 4

All of the existing answers are very good, but let me try to answer a more abstract question: why do any accidents happen? For example

• It's a requirement that bridges don't fall down, and civil engineers know how to make bridges that don't fall down, but occasionally bridges do collapse.
• It's a requirement that cars be able to withstand crashes, and the car companies do know how to make cars safer, but occasionally people die in car crashes.
• It's a requirement that food be safe, and we know how to cook food to kill bacteria, but some people still get food poisoning.

The answer to all of these is basically the same as the answer to your question. There is an inherent risk in everything. Risks can be mitigated, but at a cost. The more you want to reduce the risk, the more expensive it becomes. Getting the risk down to absolutely zero would have an essentially infinite cost. For any given situation, at some point, somebody (either an individual consumer, or a government regulator, or just society in general) has decided that reducing the risk any further is not worth the increased cost. The cost-benefit tradeoff may not have been done consciously, but it has definitely been done.

For example, according to the CDC, about 3000 people die every year in the US from food poisoning. Given that the US population is about 300 million, you have a 1 in 100,000 chance of dying from food poisoning this year. If I told you that I could reduce your chance of dying from food poisoning to 1 in 1,000,000 but you have to pay \$50 for a hamburger from your favorite fast food joint, instead of \$5, would you do it? Probably not. The risk is already really low, and you'd rather spend that \$45 on something else. So you buy the \$5 hamburger and take your chances.

The cost benefit tradeoffs often change over time. If new technology evolves that allows risks to be reduced for less money, risk goes down. If the public demands a lower risk and is willing to pay more money for it (e.g. $50 hamburgers), then risk goes down.

Answer 5

Having worked in an engine overhaul shop for an airline for years I will add my 2 cents.

First, "cowling" is the wrong nomenclature. A "cowling" applies to the cover or surround of a fuselage mounted engine, although "cowling" is commonly used to refer to any engine cover.

The cowling, or nacelle, is not meant to contain anything, it is for aerodynamics and might contain possibly birds and similar injested debris *not going through the core engine"....... maybe.

It is the "Core engine case" that is designed to contain most departing parts under most conditions. Note I said "most", NOT "all". This is heavy metal like a car's engine "block" but of different metals. Generally, its the compressor/turbine blades that fail, and primarily from ingested debris (and fatigue) and forward broken blades moving aft through the core that takes out more blades. Think about it. The engine moves AIR, and in so doing the AIR is moving through rotating discs of blades and not much else. Its these blades and discs rotating at upwards of 30,000 rpms that can be damaged, come apart explosively and must be essentially contained in the core case in destructive tests.

The forward most blade or fan blade is really like a ducted prop. Should the parts holding it on or the shaft connecting it to a turbine blade/s fails, the fan can/WILL depart the a/c like a buzz saw taking off the entire inlet section forward of the blade and slicing through anything it contacts.

Either failure will occur explosively, scattering many small and large pieces at tremendous force in ALL directions, like a bomb. Nothing man builds can be perfect against the forces of nature, all the time.

I have seen A/C return with nothing but an empty nacelle where an engine was when the A/C departed. The A/C had holes in it all over the fuselage, wings etc. The entire core engine departed the airframe leaving a hollow nacelle!