Today I read again something about the Southwest Airlines Flight 1380 and the related engine failure resulting in one passenger being sucked out of the window. As I understood it was a fan blade out incident and normally the engine are certified for it.

Are the engines certified for all failure possible ?

If not what would be the most sever engine failure possible on modern engines ?


A good and interesting question! @MaximEck's answer has a lot of good points, which I will not repeat, but rather try to complement.

My credentials for this answer: I formerly worked at a large engine OEM and was personally involved in the certification of many different engine models.

First, I want to clarify the definition of "certified". I think there may be an implicit assumption in the question, and maybe MaximEck's answer too, that "certified" is synonymous with "tested". It is not. "Certified" merely means that the manufactured has proved to the FAA (or EASA, or whatever regulatory agency) that the engine complies with all the pertinent regulations. For some regulations, the manufacturer might show compliance by a full engine test, but for other regulations it might be by a component test, an analysis, or comparison to another certified engine.

For FAA, the necessary regulations are 14 CFR part 33 (https://www.ecfr.gov/cgi-bin/text-idx?node=pt14.1.33&rgn=div5)

For example, part 33.62 Stress analysis reads

A stress analysis must be performed on each turbine engine showing the design safety margin of each turbine engine rotor, spacer, and rotor shaft.

So, are rotor disks certified against disk burst? Yes they are. But they are certified by analysis, not necessarily by test. Now, the analysis here is extremely detailed. There may be a team of multiple people that spend years (years!) running the analysis to prove to the FAA that a given disk design is okay.

The other thing to clarify is a "contained" failure versus an "uncontained" failure. I think MaximEck was trying to get at this but said "certified" instead of "contained". A fan blade failure, if it does occur, is required to be contained, (and it is generally required to demonstrate that containment by test):

§33.94 Blade containment and rotor unbalance tests. (a) Except as provided in paragraph (b) of this section, it must be demonstrated by engine tests that the engine is capable of containing damage without catching fire and without failure of its mounting attachments when operated for at least 15 seconds, unless the resulting engine damage induces a self shutdown, after each of the following events:

(1) Failure of the most critical compressor or fan blade while operating at maximum permissible r.p.m. The blade failure must occur at the outermost retention groove or, for integrally-bladed rotor discs, at least 80 percent of the blade must fail.

There is no such containment requirement for disks (the simple reason is that containing a disk failure would require a structure so heavy that the airplane would not be able to fly... or at least not in any economically feasible way).

Now, we know, from MaximEck's answer that although extremely rare, it is not unheard of for disks to fail and bladeout events to be contained. There can be many reasons for this and I will not go into it here. But the fact that this does occasionally occur does not mean that the engines weren't certified to all applicable regulations.

To address some of the other points:

Are the engines certified for all failure possible ?

No. There are a number of possible failure conditions that are not covered by any regulations. These are, however, so exceedingly rare that you generally do not need to worry about them, although they are admittedly "possible".

For example, military engines are often required to pass a "live fire" test (https://apps.dtic.mil/dtic/tr/fulltext/u2/a528013.pdf), showing that they can survive even if you shoot bullets at them, but commercial engines are not. You can conceive of many possible failure scenarios when shooting at an aircraft, but since that is very rare for commercial engines, it's not covered.

If not what would be the most sever engine failure possible on modern engines ?

Fan blade out is generally considered to be the most severe contained failure possible on large commercial turbofan engines, with rotor disk burst being the most severe unconstrained failure.

  • $\begingroup$ "Failure of the most critical compressor or fan blade" I'm no jet engine expert, but aren't all the blades pretty darn critical? An unbalanced compressor or fan is a Bad Thing™ as they're not likely to be balanced with one missing. As a guy who was involved in this for many years, what does this really mean, since my take is obviously simplistic and uneducated? $\endgroup$ – FreeMan Oct 9 '20 at 17:16
  • $\begingroup$ @freeman, for a high bypass turbofan, the fan blades are MUCH bigger than all of the other blades, by one to two orders of magnitude. If you loose a compressor blade, yes that that will cause some unbalance. On something like a 777, the centrifugal unbalance force of one blade out (at redline speed) is about 350,000 pounds, which is more than half of the max takeoff weight of the plane (~750,000). $\endgroup$ – Daniel K Oct 9 '20 at 21:37
  • $\begingroup$ Ah, so that's "Failure of the most critical compressor blade or fan blade"... i.e. there are 1 or 2 compressors stages that are critical and fall into this section along with the fan and its blades. Correct? I'm sure this makes perfect sense to those well versed in the field, but I'm not that guy. $\endgroup$ – FreeMan Oct 10 '20 at 0:12
  • $\begingroup$ @FreeMan, yes if you meant circumferential direction, then yes they are all equal. The regulation is refer to stages. For a high bypass turbofan, usually the high pressure compressor and turbine stages are analyzed with computer simulation, but not tested. The fan is the most critical stage and is tested. For a low bypass turbo fan, the difference between the fan and 1st compressor stage is a lot smaller, and you may or may not determine the fan to be the worst case failure. $\endgroup$ – Daniel K Oct 10 '20 at 13:17
  • $\begingroup$ I think I'm more-or-less getting it now. Thanks for being patient... $\endgroup$ – FreeMan Oct 10 '20 at 13:39

Here are my initial finding so far, and I will add information that I find along the route:

There seems to be two types of engine failures. Tested and untested ones. The ones that the engine are certified for through test are the ones that are likely to happen in the fleet life. And therefore, the engine manufacturer must show that those kinds of failure will not put the life of the passenger at risk. The other are unexpected incident that shouldn't have happened and are certified through numerical analysis.

The most extreme scenario in the tested failure category seems to be the fan blade out. The unbalance created by losing a fan blade creates huge vibrations and breaking torque when the fan rubs against the casing. In addition to that, the compressor is stalled so you have backward flow in the engine and huge ball of fire coming out. (see this video).

To obtain the engine certification, the manufacturer must demonstrate during a dedicated test that all broken blades remain in the engine and that no heavy parts will exit either in direction of the aircraft or fall to the ground. Sadly, it doesn’t work as expected and recently two CFM56-7B have had FBO event that didn’t end as well as planned. Southwest Airlines Flight 3472 and 1380.

enter image description here

Now the untested failure options. Two different examples came during my search, rotor disc rupture and engine loss. Both should never happen but cannot be mitigated if they happen and that's why they cannot be certified.

Let’s start with the American Airlines Flight 191, which engine number one was lost during takeoff. Whereas it is not the engine that failed but the fixations, the consequences where tragic.

Secondly the rotor disk rupture. This time it is not the blades (fan turbine or compressor) that fell off but the whole disk retaining them that fails. This seems mostly due to manufacturing defect with crack propagation not detected during maintenance. The kinetic energy of those disk is such that it would require a tank shield to prevent them from escaping from the engine which weight would be horrendous. Sadly, they are more example of those:

Delta Air Lines Flight 1288 (MD-88, the NTSB determined the most probable cause of the accident was a fracture in the left engine's front compressor fan hub)

Engine fail DAL 1288

National Airlines Flight 27 and United Airlines Flight 232 (DC-10 Tail engine fan disk rupture leading to flight control losses, loss of cabin pressure and passenger sucked out)

Recovered fan disk UAL 232

Qantas Flight 32 (A380, turbine disk disintegrated, causing extensive damage to the nacelle, wing, fuel system, landing gear, flight controls, engine controls, and a fire in a fuel tank that self-extinguished)

Turbine fail Quantas32

Air France 88 (A380, Fan disk failure. The examination determined that the hub failure was caused by a low cycle fatigue cracking process which originated in the part’s subsurface. 21 month later a 150kg piece of the engine was located 4 meters below the snow and was recovered in Greenland.)

enter image description hereenter image description here

  • 1
    $\begingroup$ If severity in your context requires doing major damage to the airframe, then this Air France A388 flight does not qualify, even if the engine failure is catastrophic: avherald.com/h?article=4af15205/0008&opt=0 $\endgroup$ – Jpe61 Oct 5 '20 at 20:40
  • 2
    $\begingroup$ Btw, the Aviation Herald article has some nice pics, always nice to have nice pics... $\endgroup$ – Jpe61 Oct 5 '20 at 20:41
  • 3
    $\begingroup$ Na that definitely does count to me... a 2.5m fan falling from the sky should not happen... And everyone loves nice pics ^^ $\endgroup$ – MaximEck Oct 5 '20 at 20:44
  • 1
    $\begingroup$ " A 150kg piece of the engine was located 4 meters below the snow and was recovered." Imagine that rotating at 3000RPM and boom going through the wing or the main frame... Very lucky indeed. But that is kind of correlated to the increase of safety, every incident we witness is a major one as all small flaws have been eliminated through testing and certification. (except 737 max, but I think it is gonna be the safest plane when it will resume flying) $\endgroup$ – MaximEck Oct 5 '20 at 21:05
  • 3
    $\begingroup$ @Jpe61 If a propeller blade detaches, there is nothing at all to contain it, unlike a turbofan where the engine casing will always take out some of the energy in the debris. I once saw a nice picture of a C130 which had lost a prop blade. There was a nice blade-shaped hole in the exit door on one side of the fuselage where the blade went in, and a similar hole in the exit door on the other side where it came out again. Luckily, the accident happened on the ground and there was nobody inside at the time. $\endgroup$ – alephzero Oct 6 '20 at 2:35

To paraphrase the above answers, the most serious failure is an uncontained failure.

The fan receives most attention for certification. The shroud is supposed to contain a failure of the fan. Much effort goes into this.

However it's possible that the failure mode may be so serious that the shroud doesn't contain the failure. SWA1380 was an example of this as was UA232. Other examples exist. In the case of UA232, the failure was traced to a defect in the titanium billet used to manufacture the fan that went undiscovered for years until it failed.

Whilst the fan receives most attention (for good reasons) other failures can happen.

In the case of British Airtours 28M, a combustor can inside the engine failed, causing a fire during the takeoff roll. Although the flight crew reacted promptly and even 'parked' the plane near to firefighters, many lives were lost. This was a turbojet engine rather than a turbofan but the failure mode exists for either type.

In the instance of Quantas QF32 the failure wasn't of a fan disk but a turbine disk. An incorrectly manufactured oil pipe failed and sprayed oil into the engine's 'hot section'. The resulting fire overheated the disk which then disintegrated and likewise caused an uncontained failure.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.