For all multiengine jets, the rudder is required to be large enough to allow directional control of the aircraft to be maintained in the event of a sudden failure of one engine, with the other(s) firewalled, down to not far above the 1-g landing-configuration stall speed, without having to bank more than five degrees away from the dead engine. For jets with three or more engines, the aircraft must, additionally, remain flyable if a second engine fails after the aircraft has been trimmed for one-out flight, but it is not required to cater to situations involving the simultaneous failure of two engines on the same side of the aircraft.
However, it is easy to think of situations that could take out two engines on the same side of a quadjet1 simultaneously, or very nearly so, and, indeed, a great many accidents of this type have occurred over the years (often as a result of uncontained engine rotor bursts [which are, to a degree, an inevitable part and parcel of the use of turbine engines on aircraft] or engine pylon failures [engine pylons walk a fine line between being too weak to carry the engine without fatigueing rapidly, and not being weak enough to allow the engine to safely break away in a crash or hard landing rather than tearing open the wings’ fuel tanks]), often with the additional insult of collateral damage (sometimes quite severe) to the aircraft’s flight controls and/or the structure and profile of the wing itself:
- AF030 (747-100, August 1970): The #3 engine suffered an uncontained turbine rotor burst due to excessive and abnormal wear resulting from improper engine assembly. Turbine fragments were ingested by engine #4, damaging it beyond repair; fortunately, it did continue to operate until shut down after a safe landing.
- LO007 (Il-62, March 1980): The #2 engine suffered an uncontained turbine rotor burst due to the failure of a defective engine shaft aggravated by insufficient maintenance. Turbine disc fragments, ejected at high speed, shot into and destroyed the #1 engine (and also the #3 engine, located on the opposite side of the fuselage), and also disabled critical flight controls, causing the aircraft to enter an uncontrollable dive and crash; however, had the ejected fragments taken a slightly different trajectory, leaving the flight-control linkages intact, the loss of engine power would have been the most pressing concern.2
- LO5055 (Il-62M, May 1987): As in the previous case, the #2 engine suffered an uncontained turbine rotor burst due to an engine shaft failure (this time due to the failure of an improperly-assembled shaft bearing), which also disabled the #1 engine. Unlike in the previous case, the aircraft was able to maintain flight for a considerable length of time before flight-control damage, aggravated by a rapidly-spreading fire, caused a loss of control and a crash; had the aircraft managed to reach an airport, the loss of engine power could have caused considerable handling difficulties.
- UA811 (747-100, February 1989): The aircraft suffered an explosive decompression due to an uncommanded opening and separation of the forward cargo door, resulting from the door having (unbeknownst to the crew or ground personnel) become partially unlatched on the ground, due to one or more short circuits in the door’s wiring combined with a weak and ineffective safety mechanism which failed to prevent the latch mechanism from rotating almost to the fully-unlatched position. Cabin debris, pieces of aircraft structure, and nine passengers separated from the aircraft, considerable portions of which were ingested by the #3 and #4 engines, causing catastrophic3 damage to both engines (immediately destroying the #3 engine’s ability to produce thrust, and critically damaging the #4 engine and setting it on fire) and forcing the flightcrew to shut both engines down; fortunately, the flightcrew were able to land the aircraft safely without additional fatalities, despite major structural damage to the aircraft, the unavailability of the #3 and #4 engines, and an asymmetric flap configuration resulting from debris damage to the pneumatic duct powering the right outboard krueger flaps.
- CI358 (747-200, December 1991): The #3 engine and pylon separated from the aircraft due to the fatigue failure of the midspar pylon-to-wing attachment fittings. The separated engine/pylon combination then struck the #4 engine, causing it to separate as well; the flightcrew lost control of the aircraft while attempting to return to the airport for an emergency landing, and it crashed.
- Trans-Air Service, reg. 5N-MAS (707-300C, March 1992): The #3 engine and pylon separated from the aircraft due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to insufficient inspection requirements. The separated engine/pylon combination then struck the #4 engine, causing it to separate and igniting a wing fire; the flightcrew managed to land safely (although the aircraft ran off the side of the runway during the last part of the rollout), but the aircraft was written off.
- TAMPA, reg. HK360 (707-300C, April 1992): As in the previous case, the #3 engine and pylon separated from the aircraft (this time shortly after takeoff, during initial climbout) due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to insufficient inspection requirements. Although the separated engine/pylon combination again impacted the #4 engine, the latter engine, fortunately, did not separate from the aircraft, which landed safely and was later repaired and returned to service.4
- LY1862 (747-200, October 1992): Similarly to the CI358 case, the #3 engine and pylon separated from the aircraft due to the fatigue failure of the midspar pylon-to-wing attachment fittings, this time due, in part, to a design defect in the fusepins holding the fittings together, which rendered the fusepins susceptible to accelerated fatigue cracking. Again, the separated engine/pylon combination struck the #4 engine, knocking it off as well; additionally, a large section of the leading edge of the right wing was torn away and the aircraft’s hydraulic systems were damaged. Control of the aircraft was lost during an attempted emergency approach and landing, causing it to crash.
- QF32 (A380-800, November 2010): The #2 engine suffered an uncontained turbine rotor burst due to heat damage from an oil fire resulting from the fatigue failure of an improperly-manufactured engine oil pipe. Ejected turbine disc fragments damaged the aircraft’s primary and secondary flight controls, ignited a fire in a wing fuel tank (which self-extinguished before the aircraft’s safe landing), and severed the control cables for the #1 engine, preventing the flightcrew from changing the engine’s power setting or shutting it down; had the fragments been released onto different trajectories, they could instead have struck the #1 engine pylon and severed the engine’s main fuel line, causing the engine to flame out due to fuel starvation, or been ingested into the #1 engine, damaging or destroying its ability to produce thrust.
- Omega 70, reg. N707AR (707-300B modified as an aerial-refuelling tanker, May 2011): The #2 engine and pylon separated from the aircraft just after liftoff due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to a prior erroneous maintenance-log entry which indicated that the fatigue-prone fittings used on the aircraft had been replaced with fittings not requiring frequent inspection for fatigue cracking. The separated engine/pylon combination then struck the #1 engine, inflicting damage which effectively disabled the engine (although it did continue to run, albeit ineffectually); the flightcrew rejected the takeoff, but the aircraft overran the runway and was destroyed, primarily by fire (although all three flightcrew members were able to evacuate safely before the fire spread to the cockpit).
Given the many scenarios which could lead to a simultaneous or near-simultaneous failure of two ipsilateral engines on a quadjet, why are quadjet rudder systems only required to cater for the yawing moment from one engine failure at a time, rather than being required to be sized to counteract the yawing moment from the sudden simultaneous failure of two ipsilateral engines?
1: For trijets, the thrust asymmetry produced by a failure of one lateral engine is the same as that produced by the simultaneous failure of one lateral engine and the centerline engine (in the latter case, the net thrust vector is offset twice as far from the aircraft’s centerline as in the former case, but the magnitude of the net thrust along said vector is half as great), while civil jet aircraft with more than four engines are extremely rare.
2: Early Il-62s also suffered from a rash of incidents where both engines on one side were shut down as a result of false engine-fire warnings, with the resulting thrust imbalance causing severe control difficulties; later modifications to the aircraft largely fixed this problem, but it did recur at least once (for reasons unknown) on the later Il-62M version, resulting in a fatal crash (SU411, July 1982).
3: Catastrophic for the engines, that is, not for the aircraft as a whole (as is obvious, given that the aircraft landed safely and was later repaired and returned to service, and that all of the occupants who were not sucked out of the aircraft in the initial decompression survived).
4: The information in the second sentence of this entry is not present in the NTSB report linked for that entry; it is, however, included, as background information, in the report linked for the entry for Omega 70 lower down.