Why are the rudders of quadjets sized to accommodate for a sudden failure of a single engine, rather than two on one side?

Question

For all multiengine jets, the rudder is required to be large enough to allow directional control of the aircraft to be maintained in the event of a sudden failure of one engine, with the other(s) firewalled, down to not far above the 1-g landing-configuration stall speed, without having to bank more than five degrees away from the dead engine. For jets with three or more engines, the aircraft must, additionally, remain flyable if a second engine fails after the aircraft has been trimmed for one-out flight, but it is not required to cater to situations involving the simultaneous failure of two engines on the same side of the aircraft.

However, it is easy to think of situations that could take out two engines on the same side of a quadjet¹ simultaneously, or very nearly so, and, indeed, a great many accidents of this type have occurred over the years (often as a result of uncontained engine rotor bursts [which are, to a degree, an inevitable part and parcel of the use of turbine engines on aircraft] or engine pylon failures [engine pylons walk a fine line between being too weak to carry the engine without fatigueing rapidly, and not being weak enough to allow the engine to safely break away in a crash or hard landing rather than tearing open the wings’ fuel tanks]), often with the additional insult of collateral damage (sometimes quite severe) to the aircraft’s flight controls and/or the structure and profile of the wing itself:

• AF030 (747-100, August 1970): The #3 engine suffered an uncontained turbine rotor burst due to excessive and abnormal wear resulting from improper engine assembly. Turbine fragments were ingested by engine #4, damaging it beyond repair; fortunately, it did continue to operate until shut down after a safe landing.
• LO007 (Il-62, March 1980): The #2 engine suffered an uncontained turbine rotor burst due to the failure of a defective engine shaft aggravated by insufficient maintenance. Turbine disc fragments, ejected at high speed, shot into and destroyed the #1 engine (and also the #3 engine, located on the opposite side of the fuselage), and also disabled critical flight controls, causing the aircraft to enter an uncontrollable dive and crash; however, had the ejected fragments taken a slightly different trajectory, leaving the flight-control linkages intact, the loss of engine power would have been the most pressing concern.²
• LO5055 (Il-62M, May 1987): As in the previous case, the #2 engine suffered an uncontained turbine rotor burst due to an engine shaft failure (this time due to the failure of an improperly-assembled shaft bearing), which also disabled the #1 engine. Unlike in the previous case, the aircraft was able to maintain flight for a considerable length of time before flight-control damage, aggravated by a rapidly-spreading fire, caused a loss of control and a crash; had the aircraft managed to reach an airport, the loss of engine power could have caused considerable handling difficulties.
• UA811 (747-100, February 1989): The aircraft suffered an explosive decompression due to an uncommanded opening and separation of the forward cargo door, resulting from the door having (unbeknownst to the crew or ground personnel) become partially unlatched on the ground, due to one or more short circuits in the door’s wiring combined with a weak and ineffective safety mechanism which failed to prevent the latch mechanism from rotating almost to the fully-unlatched position. Cabin debris, pieces of aircraft structure, and nine passengers separated from the aircraft, considerable portions of which were ingested by the #3 and #4 engines, causing catastrophic³ damage to both engines (immediately destroying the #3 engine’s ability to produce thrust, and critically damaging the #4 engine and setting it on fire) and forcing the flightcrew to shut both engines down; fortunately, the flightcrew were able to land the aircraft safely without additional fatalities, despite major structural damage to the aircraft, the unavailability of the #3 and #4 engines, and an asymmetric flap configuration resulting from debris damage to the pneumatic duct powering the right outboard krueger flaps.
• CI358 (747-200, December 1991): The #3 engine and pylon separated from the aircraft due to the fatigue failure of the midspar pylon-to-wing attachment fittings. The separated engine/pylon combination then struck the #4 engine, causing it to separate as well; the flightcrew lost control of the aircraft while attempting to return to the airport for an emergency landing, and it crashed.
• Trans-Air Service, reg. 5N-MAS (707-300C, March 1992): The #3 engine and pylon separated from the aircraft due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to insufficient inspection requirements. The separated engine/pylon combination then struck the #4 engine, causing it to separate and igniting a wing fire; the flightcrew managed to land safely (although the aircraft ran off the side of the runway during the last part of the rollout), but the aircraft was written off.
• TAMPA, reg. HK360 (707-300C, April 1992): As in the previous case, the #3 engine and pylon separated from the aircraft (this time shortly after takeoff, during initial climbout) due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to insufficient inspection requirements. Although the separated engine/pylon combination again impacted the #4 engine, the latter engine, fortunately, did not separate from the aircraft, which landed safely and was later repaired and returned to service.⁴
• LY1862 (747-200, October 1992): Similarly to the CI358 case, the #3 engine and pylon separated from the aircraft due to the fatigue failure of the midspar pylon-to-wing attachment fittings, this time due, in part, to a design defect in the fusepins holding the fittings together, which rendered the fusepins susceptible to accelerated fatigue cracking. Again, the separated engine/pylon combination struck the #4 engine, knocking it off as well; additionally, a large section of the leading edge of the right wing was torn away and the aircraft’s hydraulic systems were damaged. Control of the aircraft was lost during an attempted emergency approach and landing, causing it to crash.
• QF32 (A380-800, November 2010): The #2 engine suffered an uncontained turbine rotor burst due to heat damage from an oil fire resulting from the fatigue failure of an improperly-manufactured engine oil pipe. Ejected turbine disc fragments damaged the aircraft’s primary and secondary flight controls, ignited a fire in a wing fuel tank (which self-extinguished before the aircraft’s safe landing), and severed the control cables for the #1 engine, preventing the flightcrew from changing the engine’s power setting or shutting it down; had the fragments been released onto different trajectories, they could instead have struck the #1 engine pylon and severed the engine’s main fuel line, causing the engine to flame out due to fuel starvation, or been ingested into the #1 engine, damaging or destroying its ability to produce thrust.
• Omega 70, reg. N707AR (707-300B modified as an aerial-refuelling tanker, May 2011): The #2 engine and pylon separated from the aircraft just after liftoff due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to a prior erroneous maintenance-log entry which indicated that the fatigue-prone fittings used on the aircraft had been replaced with fittings not requiring frequent inspection for fatigue cracking. The separated engine/pylon combination then struck the #1 engine, inflicting damage which effectively disabled the engine (although it did continue to run, albeit ineffectually); the flightcrew rejected the takeoff, but the aircraft overran the runway and was destroyed, primarily by fire (although all three flightcrew members were able to evacuate safely before the fire spread to the cockpit).

Given the many scenarios which could lead to a simultaneous or near-simultaneous failure of two ipsilateral engines on a quadjet, why are quadjet rudder systems only required to cater for the yawing moment from one engine failure at a time, rather than being required to be sized to counteract the yawing moment from the sudden simultaneous failure of two ipsilateral engines?

---

¹: For trijets, the thrust asymmetry produced by a failure of one lateral engine is the same as that produced by the simultaneous failure of one lateral engine and the centerline engine (in the latter case, the net thrust vector is offset twice as far from the aircraft’s centerline as in the former case, but the magnitude of the net thrust along said vector is half as great), while civil jet aircraft with more than four engines are extremely rare.

²: Early Il-62s also suffered from a rash of incidents where both engines on one side were shut down as a result of false engine-fire warnings, with the resulting thrust imbalance causing severe control difficulties; later modifications to the aircraft largely fixed this problem, but it did recur at least once (for reasons unknown) on the later Il-62M version, resulting in a fatal crash (SU411, July 1982).

³: Catastrophic for the engines, that is, not for the aircraft as a whole (as is obvious, given that the aircraft landed safely and was later repaired and returned to service, and that all of the occupants who were not sucked out of the aircraft in the initial decompression survived).

⁴: The information in the second sentence of this entry is not present in the NTSB report linked for that entry; it is, however, included, as background information, in the report linked for the entry for Omega 70 lower down.

Answer 1

Loss of two engines on one side on four-engine aircraft is taken into account in the design of the aircraft.

I'm not sure where the notion came from that a four-engine airplane can't handle two engine failures on the same side, but it's untrue. In fact, on each of my captain checkrides in four engine airplanes, from piston to turbojets such as the 747, 2-engine operation, with two out on one side, is standard and required.

Loss of two engines on one side is a hand full, not because of insufficient rudder, but because of loss of performance, and changes in systems, as well as fuel asymmetry, etc.

The rudder on the 747 is several stories high; there's a lot of surface there.

Speed, flap setting, and runway options change with two engines out, particularly with a crosswing.

Another consideration with loss of engines on the same side on large airplanes is that aileron input may be required as well as rudder, and with large deflections, typically flight spoilers also deploy, increasing drag and decreasing performance.

If the question regards multiple engine failures during takeoff, one could take the question quickly to the point of diminishing returns by asking about various combinations of failures. Why wasn't sully able to continue with both engines out (obviously, no engines)...there can certainly occur events which preclude continued flight. For design certification criteria, addressing all of them, particularly those which are unrealistic, makes little sense.

Answer 2

The risk model used for aircraft design redundancy simply doesn't have to account for simultaneous multiple failures. Two engines on one side going south at the same time in a critical takeoff phase (usually engine failure between V1 and V2) is beyond the 1 in a billion probability threshold for catastrophic events, so the rudder system won't be required to cater to it.

Answer 3

It comes down to the requirements for the system design. The overall requirement to design a "safe" airplane is specified in 14 CFR 25.1309. The primary part of the section states:

§25.1309 Equipment, systems, and installations.

(a) The equipment, systems, and installations whose functioning is required by this subchapter, must be designed to ensure that they perform their intended functions under any foreseeable operating condition.

(b) The airplane systems and associated components, considered separately and in relation to other systems, must be designed so that—

(1) The occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable, and

(2) The occurrence of any other failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable.

The key is in (b)(1) that specifies the probability is "extremely improbable" which has been accepted to mean a probability of less than 1 x 10E-9/hour. To understand this better and how the applicant can demonstrate compliance we can refer to AC 25.1309-1A. From it we can find:

5. THE FAA FAIL-SAFE DESIGN CONCEPT. The Part 25 airworthiness standards are based on, and incorporate, the objectives, and principles or techniques, of the fail-safe design concept, which considers the effects of failures and combinations of failures in defining a safe design.

a. The following basic objectives pertaining to failures apply:

(1) In any system or subsystem, the failure of any single element, component, or connection during any one flight (brake release through ground deceleration to stop) should be assumed, regardless of its probability. Such single failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure conditions.

(2) Subsequent failures during the same flight, whether detected or latent, and combinations thereof, should also be assumed, unless their joint probability with the first failure is shown to be extremely improbable.

b. The fail-safe design concept uses the following design principles or techniques in order to ensure a safe design. The use of only one of these principles or techniques is seldom adequate. A combination of two or more is usually needed to provide a fail-safe design; i.e., to ensure that major failure conditions are improbable and that catastrophic failure conditions are extremely improbable.

The normal process used for performing the required analysis is to follow ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. (The actual document must be purchased from SAE.)

Without the actual Safety Analysis we can only estimate the numbers, but a generic analysis would follow this framework:

A single engine failure is assumed. This then generates the subsequent requirements for 'single engine out operations' to ensure continued safe flight when the engine failure occurs. This would include the requirements for rudder authority necessary when a single engine fails.
Even though a failure is assumed we need to estimate the probability. From Wikipedia:

The Federal Aviation Administration (FAA) was quoted as stating turbine engines have a failure rate of one per 375,000 flight hours...

and

The General Electric GE90 has an in-flight shutdown rate (IFSD) of one per million engine flight-hours.

Note: The IFSD includes precautionary engine shut downs, so the actual failure rate would be lower than the IFSD. IFSD does provide a reasonable upper bound for the failure rate.

From that we can estimate the failure rate as something between 1 and 3 x 10E-6. The failure rate for multiple independent failures is computed by multiplying the failure rates. If we accept the upper number of 3 x 10E-6, that would give us a probability for multiple engine failures of 9 x 10E-12 which would be considered extremely improbable and thus does not require further assessment or mitigation. Thus rudder design to handle two engines out is not required.

I don't have the numbers or any way to estimate them, but dependent failures are analyzed using the same methodology. You do the hazard analysis. You do the preliminary system safety assessment (PSSA) which includes a failure mode effect and criticality analysis (FMECA) which will identify all failure modes whether independent or dependent. From that you do a fault tree analysis (FTA) and determine the failure probability of all failure modes. The probability of each failure mode must meet the limit associated with the criticality of the fault.

Without trying to guess numbers, some percentage of engine failures (e.g. rotor burst) would be capable of triggering a critical secondary failure. And of those events, there is a probability that they will cause that secondary failure. That then is used to compute the probability of that critical failure occurring per hour. If that number meets the standard, no further mitigation is needed.

Realistically, I'd say that the B707 with the engines it had wouldn't meet the current standards. I can't say what standards were applied to the B747, but it wouldn't meet today's standard either. The A380 was developed to these standards (actually the EASA equivalents). But in any case, the certification authorities determined that the design met the required level of safety at the time.