Turbine Pilot

How modern jets try to contain the rare uncontained engine failure

It was a few minutes after 7 a.m. on a sleepy Sunday morning. Continental Airlines Flight 1933, a Boeing 737-300 carrying 84 passengers and a crew of five, had just lifted off from Palm Beach International Airport (PBI) en route to Houston's George Bush Intercontinental Airport (IAH). As it neared 1,000 feet, shortly before a planned thrust reduction from takeoff to climb power, the otherwise normal takeoff suddenly transformed into a full-blown emergency. The pilots heard what Capt. Jim Walsh later described as a "huge thump," followed immediately by a severe vibration that wracked the airplane. This lasted for about five seconds before subsiding as quickly as it had begun.

Walsh, a veteran instructor pilot flying with new captain candidate Tom Horne (no, not AOPA Pilot's Tom Horne), thought for an instant that the Boeing had collided with another aircraft, or possibly an unseen radio tower. He looked outside for a place to put the jet down and decided that the beach was the best option. An instant later he realized the airplane was still flying, and he thought that they could make it back to the airport after all. Scanning the instrument panel and noting that gauges for the number-one engine had stopped responding, he came up with a new theory to explain the airliner's predicament: This being in southeastern Florida, a large bird had probably been ingested through the engine.

As it turned out, neither fowl play nor a collision with something more substantial was to blame for all the excitement. Instead, the gremlin bedeviling Flight 1933 was that most rare of jet aircraft emergencies—a so-called uncontained failure of an engine. In this case, a high-speed rotating turbine seal in the General Electric/ SNECMA CFM56-3B1 turbofan engine had fractured, initiating a rapid self-destruct sequence. In an instant, the 80-pound metal alloy disk transformed the normally reliable powerplant into a whirling dervish of destruction. High-velocity chunks of metal tore through the engine cowling. The entire thrust-reverser mechanism, weighing nearly 300 pounds, was thrown up and over the wing. It struck the aircraft's tail, damaging the main vertical stabilizer spar and wreaking additional havoc on the rudder and horizontal stabilizer.

Investigators believe that the departure of the thrust reverser from the engine was the likely cause of the severe vibration. Unbeknownst to the crew, the uncontained failure also had ruptured lines in the aircraft's "A" hydraulic system. This is one of three hydraulic systems used to power various flight controls, and fluid was gradually draining away as the aircraft maneuvered back toward the airport.

That the current failure had happened at all was extraordinary. In fact, it was the very first time in more than 65 million flight hours that this model engine had experienced an uncontained failure. One study of uncontained engine failures in the commercial transport fleet shows that they are rare across all commonly used jet engines. From 1962 through 1989, 15 very serious uncontained engine failures occurred. These so-called Category 4 events took place in the course of nearly 1.1 billion engine operating hours. Category 4 events are defined as those resulting in crash landings, critical or fatal injuries, or hull loss. To put them into perspective, these events make up just a tiny percentage of the total number of uncontained engine failures of all kinds that took place during the same period. In the vast majority of these events, engine parts exited through the rear of the engine, without doing further damage to the aircraft.

Another uncontained failure made headlines in 1996, when the left engine on a Delta Airlines McDonnell Douglas MD–88 came apart during takeoff from Pensacola, Florida. Two passengers died when fragments of the engine penetrated the fuselage. That failure was traced to a preexisting microscopic crack in the engine's fan hub. The Delta mishap, like the failure on Continental Flight 1933, was typical in terms of the phase of flight in which it occurred. According to one study that looked at uncontained jet engine failures during the period from 1966 through 1976, 55 percent took place prior to the first power reduction after takeoff.

Manufacturers clearly have an interest in doing everything possible to prevent uncontained failures in the first place. One way they do so is in the overall design of the engine. All jet aircraft engines go through a rigorous design process that includes extensive testing of each and every component part. According to a spokesperson for General Electric, this includes destructive testing that is intended to verify how the engine will perform under extreme conditions. For example, a blade-off test is accomplished during engine certification. This is performed by placing an explosive charge in the fan section of the engine. The charge is detonated while the engine is operating, causing fan blade pieces to be ingested into the engine's turbine stages. The engine must then be capable of being shut down in a controlled fashion, while damaged components remain contained within the cowling area or exit through the tailpipe. Bird ingestion tests are also performed with the same goals in mind.

But suppose such preventive measures are not good enough? Beyond designing the engine not to fail in the first place, engine and aircraft manufacturers also consider what might happen if an uncontained failure does occur. Engine cowlings, for example, are reinforced with containment rings. These aluminum or stainless steel reinforcements are designed to do as their name implies, contain rotating engine parts ejected when an engine self-destructs. The location of critical aircraft systems and components are planned in relation to the areas that fragments of an exploding engine will most likely hit. They are located so that a single large metal fragment or multiple smaller fragments can't, in theory at least, disable two or more redundant systems. Much of the decision making involved in where to place fuel or hydraulic lines, for example, involves theoretical considerations of fragment size, force, and impact area. It is presumed that the biggest piece that could exit the engine will be one-third the size of the largest rotating part installed. Based on this fragment size and the possible impact zone, an acceptable distance between critical components is determined.

Jet engine fire-extinguishing systems rely on supplying extinguishing agents within a fixed engine-compartment size, having a known air-exchange rate. Since a catastrophic uncontained failure of an engine may rupture the cowling, fire-extinguishing agents routed to the engine may no longer be effective in fighting a fire. Therefore, another design consideration is a reliable means of shutting off fuel and hydraulic fluid to the damaged engine. Fluid shutoff valves must be located away from the possible fragment impact areas so that they will continue to work following a failure. Likewise, if engine fragments could penetrate a fuel tank, the fuel leak paths that might result need to be determined. If leaking fuel could reach a source of ignition, such as hot brakes in a wheel well, an auxiliary power unit, or electrical connections, the aircraft design would need to be modified to protect against a resulting fire.

Did these design considerations help in the case of Continental Flight 1933? Compared with the fatal 1989 crash of a United Airlines DC–10 in Sioux City, Iowa, which lost all three of its hydraulic systems (something that was theoretically impossible, according to the design criteria for FAR Part 25 Transport category aircraft), only one of the three hydraulic systems on Flight 1933 was lost. This allowed for near-normal aircraft control throughout the successful return to landing at West Palm Beach. And even though the rudder and vertical stabilizer were seriously damaged when struck by the thrust reverser, sufficient control authority remained for the successful single-engine approach and landing. Fuel and hydraulic shutoff valves worked as advertised, and no fire resulted from the failure.

Luck played a role too. The large rotating turbine seal that failed in the first place departed the aircraft away from the fuselage, rather than toward it, where it might have caused more serious damage. The only rotating fragments that struck the fuselage were comparatively small, and none of these actually penetrated the aircraft skin. There were no fuel leaks, and no injuries to passengers or crew. Fortunately, there were no injuries to persons on the ground from falling engine parts either.

The NTSB determined the probable cause of the failure to be a manufacturing defect in a bolt hole that the engine maker did not detect because of inadequate inspection techniques.

In the final analysis, what might have progressed to a Category 4 uncontained engine failure turned out to be somewhat less serious. Walsh credits excellent crew teamwork and good airplane design for a happy ending to an unexpected and thankfully rare kind of jet engine failure.