Why aren't quadjets required to remain controllable after a sudden, simultaneous failure of two engines on one side?

Question

For all multiengine jets, it must be possible to maintain directional control of the aircraft in the event of a sudden failure of one engine in flight, with the other(s) firewalled, down to not far above the 1-g landing-configuration stall speed, without having to bank more than five degrees away from the dead engine. For jets with three or more engines, the aircraft must, additionally, remain flyable if a second engine fails after the aircraft has been trimmed for one-out flight, but it is not required to cater to situations involving the simultaneous failure of two engines on the same side of the aircraft:

(b) It must be possible to make a smooth transition from one flight condition to any other flight condition without exceptional piloting skill, alertness, or strength, and without danger of exceeding the airplane limit-load factor under any probable operating conditions, including—

(1) The sudden failure of the critical engine;

(2) For airplanes with three or more engines, the sudden failure of the second critical engine when the airplane is in the en route, approach, or landing configuration and is trimmed with the critical engine inoperative; [14 CFR 25.143; regulations in other jurisdictions are similar. My emphasis, showing that, for the two-engine-out controllability demonstration on a plane with more than two engines, the airplane is allowed the chance to retrim for one-engine-out flight before the second engine is failed.]

However, it is easy to think of situations that could take out two engines on the same side of a quadjet¹ simultaneously, or very nearly so, and, indeed, a great many accidents of this type have occurred over the years (often as a result of uncontained engine rotor bursts [which are, to a degree, an inevitable part and parcel of the use of turbine engines on aircraft] or engine pylon failures [engine pylons walk a fine line between being too weak to carry the engine without fatigueing rapidly, and not being weak enough to allow the engine to safely break away in a crash or hard landing rather than tearing open the wings’ fuel tanks]), often with the additional insult of collateral damage (sometimes quite severe) to the aircraft’s flight controls and/or the structure and profile of the wing itself:

• AF030 (747-100, August 1970): The #3 engine suffered an uncontained turbine rotor burst due to excessive and abnormal wear resulting from improper engine assembly. Turbine fragments were ingested by engine #4, damaging it beyond repair; fortunately, it did continue to operate until shut down after a safe landing.
• LO007 (Il-62, March 1980): The #2 engine suffered an uncontained turbine rotor burst due to the failure of a defective engine shaft aggravated by insufficient maintenance. Turbine disc fragments, ejected at high speed, shot into and destroyed the #1 engine (and also the #3 engine, located on the opposite side of the fuselage), and also disabled critical flight controls, causing the aircraft to enter an uncontrollable dive and crash; however, had the ejected fragments taken a slightly different trajectory, leaving the flight-control linkages intact, the loss of engine power would have been the most pressing concern.²
• LO5055 (Il-62M, May 1987): As in the previous case, the #2 engine suffered an uncontained turbine rotor burst due to an engine shaft failure (this time due to the failure of an improperly-assembled shaft bearing), which also disabled the #1 engine. Unlike in the previous case, the aircraft was able to maintain flight for a considerable length of time before flight-control damage, aggravated by a rapidly-spreading fire, caused a loss of control and a crash; had the aircraft managed to reach an airport, the loss of engine power could have caused considerable handling difficulties.
• UA811 (747-100, February 1989): The aircraft suffered an explosive decompression due to an uncommanded opening and separation of the forward cargo door, resulting from the door having (unbeknownst to the crew or ground personnel) become partially unlatched on the ground, due to one or more short circuits in the door’s wiring combined with a weak and ineffective safety mechanism which failed to prevent the latch mechanism from rotating almost to the fully-unlatched position. Cabin debris, pieces of aircraft structure, and nine passengers separated from the aircraft, considerable portions of which were ingested by the #3 and #4 engines, causing catastrophic³ damage to both engines (immediately destroying the #3 engine’s ability to produce thrust, and critically damaging the #4 engine and setting it on fire) and forcing the flightcrew to shut both engines down; fortunately, the flightcrew were able to land the aircraft safely without additional fatalities, despite major structural damage to the aircraft, the unavailability of the #3 and #4 engines, and an asymmetric flap configuration resulting from debris damage to the pneumatic duct powering the right outboard krueger flaps.
• CI358 (747-200, December 1991): The #3 engine and pylon separated from the aircraft due to the fatigue failure of the midspar pylon-to-wing attachment fittings. The separated engine/pylon combination then struck the #4 engine, causing it to separate as well; the flightcrew lost control of the aircraft while attempting to return to the airport for an emergency landing, and it crashed.
• Trans-Air 671, reg. 5N-MAS (707-300C, March 1992): The #3 engine and pylon separated from the aircraft due to a failure, during an encounter with severe turbulence, of the pylon attachment fittings resulting from fatigue damage that went undetected due to insufficient inspection requirements. The separated engine/pylon combination then struck the #4 engine, causing it to separate and producing a fuel leak which ignited a wing fire during approach; the flightcrew managed to land safely (although the aircraft ran off the side of the runway during the last part of the rollout), but the aircraft was damaged beyond repair by fire.
• TAMPA, reg. HK360 (707-300C, April 1992): As in the previous case, the #3 engine and pylon separated from the aircraft (this time shortly after takeoff, during initial climbout) due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to insufficient inspection requirements. Although the separated engine/pylon combination again impacted the #4 engine, the latter engine, fortunately, did not separate from the aircraft, which landed safely and was later repaired and returned to service.⁴
• LY1862 (747-200, October 1992): Similarly to the CI358 case, the #3 engine and pylon separated from the aircraft due to the fatigue failure of the midspar pylon-to-wing attachment fittings, this time due, in part, to a design defect in the fusepins holding the fittings together, which rendered the fusepins susceptible to accelerated fatigue cracking. Again, the separated engine/pylon combination struck the #4 engine, knocking it off as well; additionally, a large section of the leading edge of the right wing was torn away and the aircraft’s hydraulic systems were damaged. Control of the aircraft was lost during an attempted emergency approach and landing, causing it to crash.
• AF4590 (Concorde, July 2000): During takeoff, the aircraft's left main landing gear ran over an item of debris shed by a prior aircraft, causing one of its tyres to burst; ejected tyre debris impacted the aircraft, severing electrical wiring in the landing-gear bay and (indirectly) rupturing a fuel tank, with the escaping fuel then being ignited either by arcing from the severed wiring or by contact with high-temperature engine components. The #1 and #2 engines both surged and lost thrust due to ingestion of superheated gasses (as well as, for the #1 engine, ingestion of tyre debris), but partially recovered (the #1 engine much more rapidly than the #2 engine) before surging again due to renewed superheated-gas ingestion; following the second surge, the #1 engine again recovered to near-normal operation, but the #2 engine was shut down due to a fire warning. The loss of engine thrust, combined with the inability to retract the aircraft's landing gear (resulting from tyre-debris impact damage to the left main landing gear doors), left the aircraft unable to gain speed or altitude, and the ongoing wing fire progressively damaged the left wing, eventually liberating fragments of aircraft structure which were ingested by the #1 engine, causing a final surge and irrecoverable loss of thrust. The final loss of thrust from the #1 engine, combined with progressive fire damage to the left wing's flight controls, caused a rapid roll and yaw to the left; the flightcrew attempted to compensate by reducing thrust on the #3 and #4 engines, but were unable to prevent a loss of control, and the aircraft crashed.
• CU201 (Il-62M, April 2008): The #2 engine suffered an uncontained rotor failure for reasons not stated (what is it with Il-62 #2 engines?). Ejected fragments damaged the fuel lines to the #1 engine, forcing it, too, to be shut down, and igniting a fire; the flightcrew made a successful emergency landing, but the aircraft was damaged beyond economical repair.
• QF32 (A380-800, November 2010): The #2 engine suffered an uncontained turbine rotor burst due to heat damage from an oil fire resulting from the fatigue failure of an improperly-manufactured engine oil pipe. Ejected turbine disc fragments damaged the aircraft’s primary and secondary flight controls, ignited a fire in a wing fuel tank (which self-extinguished before the aircraft’s safe landing), and severed the control cables for the #1 engine, preventing the flightcrew from changing the engine’s power setting or shutting it down; had the fragments been released onto different trajectories, they could instead have struck the #1 engine pylon and severed the engine’s main fuel line, causing the engine to flame out due to fuel starvation, or been ingested into the #1 engine, damaging or destroying its ability to produce thrust.
• Omega 70, reg. N707AR (707-300B modified as an aerial-refuelling tanker, May 2011): The #2 engine and pylon separated from the aircraft just after liftoff due to a failure of the pylon attachment fittings resulting from fatigue damage that went undetected due to a prior erroneous maintenance-log entry which indicated that the fatigue-prone fittings used on the aircraft had been replaced with fittings not requiring frequent inspection for fatigue cracking. The separated engine/pylon combination then struck the #1 engine, inflicting damage which effectively disabled the engine (although it did continue to run, albeit ineffectually); the flightcrew rejected the takeoff, but the aircraft overran the runway and was destroyed, primarily by fire (although all three flightcrew members were able to evacuate safely before the fire spread to the cockpit).

Given the many scenarios which could lead to a simultaneous or near-simultaneous failure of two ipsilateral engines on a quadjet, why are quadjets only required to demonstrate controllability if two ipsilateral engines fail one at a time (and there is sufficient intervening time for the aircraft to be retrimmed for three-engine flight), rather than being required to remain controllable even in the event of the sudden simultaneous failure of two ipsilateral engines?

---

¹: For trijets, the thrust asymmetry produced by a failure of one lateral engine is the same as that produced by the simultaneous failure of one lateral engine and the centerline engine (in the latter case, the net thrust vector is offset twice as far from the aircraft’s centerline as in the former case, but the magnitude of the net thrust along said vector is half as great), while civil jet aircraft with more than four engines are extremely rare.

²: Early Il-62s also suffered from a rash of incidents where both engines on one side were shut down as a result of false engine-fire warnings, with the resulting thrust imbalance causing severe control difficulties; later modifications to the aircraft largely fixed this problem, but it did recur at least once (for reasons unknown) on the later Il-62M version, resulting in a fatal crash (SU411, July 1982).

³: Catastrophic for the engines, that is, not for the aircraft as a whole (as is obvious, given that the aircraft landed safely and was later repaired and returned to service, and that all of the occupants who were not sucked out of the aircraft in the initial decompression survived).

⁴: The information in the second sentence of this entry is not present in the NTSB report linked for that entry; it is, however, included, as background information, in the report linked for the entry for Omega 70 lower down.

Answer 1

Loss of two engines on one side on four-engine aircraft is taken into account in the design of the aircraft.

I'm not sure where the notion came from that a four-engine airplane can't handle two engine failures on the same side, but it's untrue. In fact, on each of my captain checkrides in four engine airplanes, from piston to turbojets such as the 747, 2-engine operation, with two out on one side, is standard and required.

Loss of two engines on one side is a hand full, not because of insufficient rudder, but because of loss of performance, and changes in systems, as well as fuel asymmetry, etc.

The rudder on the 747 is several stories high; there's a lot of surface there.

Speed, flap setting, and runway options change with two engines out, particularly with a crosswing.

Another consideration with loss of engines on the same side on large airplanes is that aileron input may be required as well as rudder, and with large deflections, typically flight spoilers also deploy, increasing drag and decreasing performance.

If the question regards multiple engine failures during takeoff, one could take the question quickly to the point of diminishing returns by asking about various combinations of failures. Why wasn't sully able to continue with both engines out (obviously, no engines)...there can certainly occur events which preclude continued flight. For design certification criteria, addressing all of them, particularly those which are unrealistic, makes little sense.

Answer 2

The risk model used for aircraft design redundancy simply doesn't have to account for simultaneous multiple failures. Two engines on one side going south at the same time in a critical takeoff phase (usually engine failure between V1 and V2) is beyond the 1 in a billion probability threshold for catastrophic events, so the rudder system won't be required to cater to it.