Pontifications: Uncontained engine failures are rare but not unknown

By Scott Hamilton

April 23, 2018, © Leeham News: Last week’s engine malfunction on a Southwest Airlines Boeing 737-700 was another in a rare, but not unknown, uncontained engine anomaly in recent years.

All recent similar failures didn’t cause a loss of life or serious injuries if the passengers were evacuated. Unfortunately, this accident caused one fatality and seven injuries.

Let’s put the context to this issue.

It wasn’t a “crash”

Southwest’s pilots made a textbook emergency landing, despite holes in the fuselage, damage to the wing and a large portion of the engine cowling missing.

The pilots landed 30 knots faster than normal, with only five degrees of flaps instead of 30-40 degrees, cabin depressurization and an initial report to the cockpit that one passenger had been sucked out of the airplane when a window blew out.

The passenger was only partially ejected from the airplane. Passengers pulled her back in but were unable to save her life. She died from blunt force trauma to the head, neck and torso.

Despite all this, the accident wasn’t a “crash.” Three broadcast media called me wanting my take on this “crash.” One, perhaps not surprisingly, was Fox News network, which has a history of not getting its facts straight. (I declined to help Fox, given its history.)

Two others were Seattle broadcast media—one radio and one TV news operation, both of which should know better being in Boeing’s back yard. I helped these media understand the situation and provided context and history.

Previous incidents

The National Transportation Safety Board said that worldwide, there are about 3-4 uncontained engine failure per year.

Some of the higher profile failures include:

United Airlines, February 2018, over the Pacific

A United Airlines Boeing 777 was en route to Hawaii when an uncontained failure occurred. The airplane continued to Hawaii for a safe emergency landing. The engine was a PW4000 GE90.

Air France A380, September 2017, near Greenland

The Airbus A380, equipped with Engine Alliance GP7200 engines, suffered an uncontained failure in No. 4 engine. The airplane diverted to Goose Bay, Canada. The cause is still under investigation.

American Airlines, October 2016, Chicago O’Hare

This Boeing 767-300ER was speeding for takeoff when a disk on the No. 2 engine broke apart. The engine caught fire. The pilots, just seconds away from rotation, aborted the take-off. Passengers exited the aircraft in an emergency evacuation. Fire melted the right wing. A defective part was blamed. The engine was a GE CF6.

Southwest, August 2016, US Gulf Coast

This was eerily similar to last week’s incident. Like last week, the No. 1 engine blew apart, with the front of the cowling disintegrating very much like the flight last week. Metal fatigue of a blade was identified as a cause. Metal fatigue appears to be the cause of last week’s accident.

Qantas Airways, November 2010, Singapore

Shortly after take-off from Singapore, a Qantas Airways A380 Rolls-Royce engine had an uncontained failure. Parts below through the wing, damaging hydraulic lines and causing a fuel leak. The crew responded to more than 1,000 “faults” identified by the computer system before returning to Singapore. Then, the No. 1 engine would not shut down until drowned by the airport fire department. The incident became the subject of an hour-long TV program. Oil starvation was blamed for the failure.

American Airlines, 2006, Los Angeles

An American 767 had undergone maintenance when its engine blew up. The subsequent fire destroyed the aircraft. This was a CF-6 engine.

United Airlines, over Iowa, July 1989

Perhaps the most famous, and most spectacular uncontained failure was the No. 2 engine on a DC-10, United flight 232 from Denver to Chicago. The engine exploded at cruising altitude, destroying all hydraulic lines. Capt. Al Haynes and his crew, learning to fly an airplane with no controls by using engines only, landed at Sioux City (IA). There had been enough time for news crews to reach the airport before the airplane and there is famous television footage of the DC-10 cartwheeling down the runway after a wing dipped and caught the ground just before touchdown. There were nearly 300 people on board; 111 died in what otherwise would have been a total disaster had it not been for the piloting skills of the flight deck crew. This crash became a TV movie and the subject of air disaster TV shows.

The initial news report reversed the number of dead and survivors.

There are more, including a Delta Air Lines McDonnell Douglas MD-88 in which two people were killed when an uncontained failure occurred.

Lest one get the impression this happens “all the time,” it doesn’t, as noted above.

Reliable engines

The engines involved—the GE/CFM CFM 56 on the Southwest flights is perhaps the most reliable jet engine in aviation history. The model is the exclusive powerplant on the 737 and it powers perhaps 60% of the Airbus A320s. Its first use was on the Douglas DC-8 re-engining program in the 1970s and it’s been retrofitted on some Boeing KC-135 tankers.

The CF6, also by GE, powered virtually every wide-body airplane from the DC-10 through the 767 and early Airbus models. It, too, is highly reliable.

The Rolls-Royce and Engine Alliance engines on the A380 have proved reliable since entry into service in 2008.

Uncontained failures are scary and dangerous and can lead to destruction of the aircraft and deaths. But flying is still the safest mode of travel.

Getting on a CFM-powered 737 or A320 for your next airline flight isn’t something anyone should worry about.

116 Comments on “Pontifications: Uncontained engine failures are rare but not unknown

  1. The issue for me on this one is the similarity in how the cowling disintegrated. I am not sure it was uncontained if the cowling had remained intact.

    • The engine cowling is a flimsy piece of sheet metal and/or composite.
      it “contains” nothing much beyond a thrown wet towel.
      Containment is done by the reinforced structural shroud around the fan resp. the core engine casing.

      • Looking at some pictures: Did the fan blade eject out of the front of the engine? ( fan case/shroud looks intact )
        or is the main damage to the engine core?

      • I’m with Tim on that – the air intake cowl is sturdy enough to protect its own anti-ice system from a birdstrike and quite sufficiently stiff and heavy enough to rip the horizontal stabilizer off the aircraft if it were to collide with it.

        That would be game over.

        Since this appears to have happened in a previous fan blade failure event, I think this aspect of the incident and the design should be investigated.

  2. The disitegration of the inlet is strange. Historically there has been losses of inlets mainly due to snapping on the bolts attaching it to the Engine front flange. Normally solved with longer bolts and bolt spacers.
    But these 2 SWA cases are different with the inlet collapsing in front of its aft flange and the inlet containment. The inertia load from the blade impact into its containment case in addition the high torque imposed by the rest of the fanblades rubbing into the abradable strip put a high axial and angular acceleration onto the inlet. Flying at top of climb the airspeed is pretty high and in combination of these interia loads fom the blade-out thru the inlet aft flange could be enough for the inlet honeycomb structure to collapse?

  3. I remember a local station reporting on the crash of a Beechcraft “Banana”. Ugh.

    • Funny, that makes me think of the Piasecki H-21 Shawnee, the “flying banana”!

      • Saw a whole Squadron of those fly into Northway Alaska back in the latter 50s.

        Bad weather, they could see the ground but you sure could not see them (fog)

        12 or 16 one after another, pretty exciting for a Weather Reporting station and Border cross check in (50miles from the AK/Canada Border)

        Stuck for a few days until it lifted. Happy kids.

        Ironically we also had a Beachcraft Banana come in with its gear up. Not much damage but ruined the guys day.

    • Well, it’s something, even if “a day late, and a dollar short”. I would still say both EASA and the FAA are really lagging on the ETOPS issue for RR Trent 1000 Cs. Looking at the situation, as safety and certification agencies, how do they justify more than 60 minutes ETOPS, and, maybe, no ETOPS, particularly after the resonance issue’s been raised on single engine operation? How do they “get away with” what look like token actions? Hello, LATAM’s not grounding all its 787-8s, and sending them 6,000 miles away for storage and eventual repair for the fun of it!

      • There used to be rules on IFSD rates to keep ETOPS rating. The 767 with PW4000 Engines way back was getting close. The T1000-C is still pretty far from that old limit of 0.02/1000FH so if it was not for the IPC blade vibration issue a one Engine out Power level it would have kept its ETOPS rating. RR should pretty easy move the harmonics out of that rpm range, historically that has been done with cutting off a tip corner of the blade. That reduces mass at radius and moves the vibration mode up in frequency. That operation could in theory be done on-wing with in situ borescope blending after certification of the mod.

  4. To complement the ‘operational’ aspects which you describe, including the good job by the pilots : on the design side, the aircraft should be designed so that an uncontained engine failure will not bring the aircraft down. Or more exactly, all safety critical functions should continue to be operative.

    This is done via a layered defense system. Obviously, the first line of defense is the engine maker, who should ensure that a/ failures do not happen and b/ if they do, then they are contained
    If an uncontained failure happens (and they do, as you say), then the fragmentation is simulated. Any equipment/structure/harness/duct/pipe located on a potential impact trajectory (in the wing or fuselage) and having a critical function shall be either shielded, relocated out of harm’s way, or segregation/redundancy strategies shall be put in place to limit and contain the damage and consequences to the aircraft.

    This is a strong constraint on e.g. fuel tank design. To my knowledge, it is also a requirement which was missed by Mitsubishi, which led to a re-design of vulnerable harnesses

    The same methodology (called Particular Risk Analysis) is used for any similar event involving fragments and debris : bird strike, wheel failure…

    Of course the requirement is for survival of the complete aircraft. Tragically in this case, there is not much that can be done to guarantee survivability at any given passenger seat.
    And of course, the method is limited by how the event is modeled. Even if the analysis was performed on Concorde (not sure it was done way back then), it’s likely the complete sequence of events following the wheel burst (including the hydraulic ram effect in the fuel tank) would not have been anticipated and simulated.
    That being said, the loss of an aircraft after a single burst event is very unlikely.

    • A heavy disk burst is unstoppable by all practical means. We have been lucky with so few disk bursts have hit the fuselage. So the only way forward are material testing, cut ups, NDT and life limits. The turbine disk materials today are of forged powder metal with very small critical crack lengths, less than 1mm in some cases.

  5. Has anyone got any idea how many cracked but not broken fan blades have been discovered?Had the FAA actually got round to issuing the AD before someone died,we would have the figures to judge the level of risk.
    Ofcouse, its almost impossible to talk about risk with the general public,especially lawyers and the media.Any risk whatsoever will be turned in hindsight into blame.

  6. Amazing your bias is in full display with Fox News – what would have been a good piece was tarnished by petty comments

    • @Joe: My criticism isn’t confined to Fox News.

      I’ve been openly critical of CNN’s aviation coverage, notably on MH370, and especially of its reliance on Scary Mary. CNN International dropped me as a contributor as a result. I gave a blistering reviw of Al Jazjeera English’s “expose” of Boeing on the 787. It Al Jazerra America stopped calling me as a talking head as a result.

      • I also do not think a commendatory on inept and in the case of Fox clearly and deliberately biased reporting is the polar opposite of petty.

        Trump does not watch it because it tells the truth.

        • Some people here even repeat the false news that ANA is ‘replacing all its 787 engines’
          They were replacing part of the engine blades during maintenance over a 3 year period.

          • I corrected my commentary to replacing ALL blades, which seems to be the general consensus of the reporting on the ANA Trent engine problems in mid 2016.

          • Replacing ‘all turbine’ blades. You have to be able to spot something that ‘doesnt seem right’
            Someone even quoted a badly written AW story about and ‘extra inch’ each side on the new Embraer E2 jets. They have some good qualities but finding an extra inch each side didnt seem credible. I traced that back to the original AW story which quoted an Embraer exec on the ‘extra inch headroom’. It was about the overhead bins. Now that is plausible

    • @Joe

      The take on Fox News worldwide is not a particularly positive one. The developed world in general is far to the left of the American spectrum. As a result, many of the views espoused by the Fox News network appear questionable at best and absolutely bonkers and batshit crazy at worst. There is probably a general cross spectrum consensus among those people who’ve heard of Fox News worldwide, that while splendid entertainment, Fox News cannot legitimately be called a news organisation. It’s not seen as an actual news service as much as a constantly spouting opinion piece. Few people outside America would accept any fact reported on Fox News unless it’s first been verified by a real news service like the BBC. Outside the US it would be hard for someone to be taken seriously if they made a statement about a recent news event and used Fox News as their source of information, as it’s seen as the unofficial extreme right wing broadcasting and propaganda arm of the GOP. Hence, Fox News is seen by many wordwide as the single greatest embodiment of everything that is wrong with America.

      • As a side point but a good piece of aviation journalism, a business news organisation has looked back at the flight records of a Bombardier executive jet (tail number N443PR) to see exactly how many ‘nights’ the plane and the beauty pageant proprietor it was carrying spent in Moscow 5 years ago.

      • I fully concur. Murdoch has done a great disservice to our democracy. IMO, Scott’s comments re Fox News are well justified.

  7. I must admit that since the 2016 incidents,I have,rather pointlessly been trying to avoid seats that I considered to be in the line of fire.This is now proven to be harder than I thought. It’s not noticeable that anyone else is doing this,or maybe the extra legroom makes up for the risk.

    • Don’t give them any ideas. “And that’ll be a $20 fee for our new Decreased Risk, Economy Plus, Plus Seating”. LOL

    • What I wonder about is are the larger windows on aircraft like the A350 and 787 large enough for passengers to fit through easily?

      Kind of a disturbing thought even if the chances of it happening are tiny.

      • I wonder whether the passenger who was “sucked” out was wearing her seat belt at all, or wearing it but loosely. This is not meant to blame her, just a question. It seems like being “sucked half way out” would be very difficult (impossible?) with the seat belt firmly secured.

        • I think without a shoulder belt it would be quite possible (likely) to be sucked through the window in a case like that.

      • As i flew United’s initial (read: very heavy 787s) with the worse ‘weekend at the beach’ plastic seats even in front… somehow the thought crossed my mind once or twice:

        I could get sucked up fast through these big ones!

        (never flew the a350 but am sure i’d have that feeling too).

        Also hated the fact at night you could not ‘close’ them. The darker only mode let 50% of the light through. Very annoying on long flights where you try to have your surroundings as dark as possible.

  8. Question about the causualty: Did the victim die as first reported due to sharpnell like fragments or due to injuries she got during the depressurization of the cabin?

    As she most likely didnt use her seatbelt, there would be an easy use of security systems to prevent this if the later was the case.

    Thx for letting me know, I could not find something offical.

    • @Sash, reports I saw indicated she had her seat belt loosely buckled. Autopsy IDd cause of death as blunt force trauma to head, neck and torso.

      • When in my seat, my seat belt is always snugged up.

        CAT primarily but I don’t want to be going anywhere for any other reason either.

        Frankly it should be required. An object moving at 450 MPH is not the place to fine out the laws of inertia.

        A loose lap belt with motion allows an energy build up that a tight one does not.

        All that should be part of the instructions. An aircraft is not a boat floating gently alone on a lake.

        • If she did not have it on, she should have been sucked out. No chance otherwise. But probably loose, yes:
          – Otherwise, she would have been glued to her seat…at most her head would have pro-tubed.
          – It would have allowed her to slide but the belt found a ‘hook’ position to retain her enough. Humans would not have been able to hold on to her without a belt.
          And the poor lady probably ‘flapped’ hard against the fuselage until enough folks could retract here. At that speed, the trauma from such ‘flapping’ must have been extremely severe (‘energy buildup’ as @TW expresses)

          Not a happy thought. Godspeed to heaven!

          • ” Humans would not have been able to hold on to her without a belt.”

            Actually they would, see British Airways Flight 5390. When a cockpit window failed the Captain was sucked more than halfway out. A male flight attendant was able to hold him all the way through the landing. Amazingly he suffered only a few broken bones and frostbite.

  9. An important event not noted by Scott was the crash of a British Midland 737 where a CFM56 shed a fan blade , I think at top of climb, and with the resultant high vibration and poor layout of engine instruments the crew shut down the wrong engine. On final approach, when they raised power the already damaged engine failed and aircraft crash landed short of the runway with heavy , but not total, loss of life. Refer to Kegworth disaster. Might have been a -5 rather than a -7.

    • Hello Herb,

      The British Midland 737 involved in the accident at Kegworth was a 737-400. Mr. Hamilton was listing uncontained failures, and I’m pretty sure the fan blade fragments were contained in this incident. This tragic accident was the result of shutting down a good engine and trying to fly on an engine missing a fan blade, not the result of damage outside the engine compartment from a fan blade failure.

      See below.

      “The Kegworth air disaster occurred when a Boeing 737-400 crashed on to the embankment of the M1 motorway near Kegworth, Leicestershire, England, while attempting to make an emergency landing at East Midlands Airport on 8 January 1989.

      British Midland Flight 92 was on a scheduled flight from London Heathrow Airport to Belfast Airport, when a fan-blade broke in the left engine, disrupting the air conditioning and filling the flight deck with smoke. The pilots believed that this indicated a fault in the right engine, since earlier models of the 737 ventilated the flight-deck from the right, and they were unaware that the 400 used a different system. The crew mistakenly shut down the good engine, and pumped more fuel into the malfunctioning one, which burst into flames. Of the 126 people aboard, 47 died and 74 sustained serious injuries.

      The inquiry attributed the blade fracture to metal fatigue, caused by heavy vibration in the newly upgraded engines, which had only been tested in the laboratory and not under representative flight conditions.”


      • More on 737-400’s and fan blades.

        “One issue that led to accidents with the CFM56-3C engine was the failure of fan blades. This mode of failure led to the Kegworth air disaster in 1989, which killed 47 people and injured 74 more. After the fan blade failed, the pilots mistakenly shut down the wrong engine, resulting in the damaged engine failing completely when powered up for the final approach. Following the Kegworth accident, CFM56 engines fitted to a Dan-Air 737-400 and a British Midland 737-400 suffered fan blade failures under similar conditions; neither incident resulted in a crash or injuries.[66] After the second incident, the 737-400 fleet was grounded.

        At the time it was not mandatory to flight test new variants of existing engines, and certification testing failed to reveal vibration modes that the fan experienced during the regularly performed power climbs at high altitude. Analysis revealed that the fan was being subjected to high-cycle fatigue stresses worse than expected and also more severe than tested for certification; these higher stresses caused the blade to fracture. Less than a month after grounding, the fleet was allowed to resume operations once the fan blades and fan disc were replaced and the electronic engine controls were modified to reduce maximum engine thrust to 22,000 lbf (98 kN) from 23,500 lbf (105 kN).[67] The redesigned fan blades were installed on all CFM56-3C1 and CFM56-3B2 engines, including over 1,800 engines that had already been delivered to customers.[5]”


        I am tempted to say that those who don’t know or fail to learn from history are doomed to repeat it, but I suspect that it is more complex than that, the new engine versions presently having fan blade problems (I’m thinking primarily of Rolls Trents) probably did get substantial amounts of inflight testing.

        • RR routinely sends new Engines to Arnold Army Test center to do simulated altitude testing under controlled conditions to discover these types of vibration modes. No such test facility in Western Europe yet.

  10. Back in the day one of the industry’s “dirty little secrets” was a persistent problem with “black market”, counterfeit parts.

    Has this “secret” been completely eradicated?

  11. Scott, you have listed uncontained engine anomalies. How frequently are there these kind of “anomalies” that ARE contained?

    In other words, are there many catastrophic engine failures where the engine debris is contained or are such failures extremely rare (yes I know they are extremely rare in any event) but when they do, are they typically overwhelming the shrouds and other containment devices?

    • @Bruce: NTSB wasn’t asked this question and I don’t know.

    • This uncontained failure on the GE90 engine of a British Airways 777 at Las Vegas on Sept 8 2015 ( should be added to Scotts list at top) is described by initial NTSB report ( no final one yet, quelle surprise) as :

      “Engine examination revealed that a portion of the stage 8-10 spool in the high-pressure compressor (HPC) section had failed, liberating fragments that breached the engine case and cowling.”

      This should not happening for compressor section let alone the higher energy turbine sections.

      I remember the focus at the time was about passengers evacuating with their carry on luggage as a ‘big problem’. Im sure GE was happy with that focus.

      • Here is the NTSB report of the later American Airlines 767 (Oct 28 2016) uncontained failure at Chicago.
        ‘​The National Transportation Safety Board determines that the probable cause of this accident was the failure of the high-pressure turbine (HPT) stage 2 disk, which severed the main engine fuel feed line and breached the right main wing fuel tank”

        A turbine disk failure is seen as the hardest ‘if not impossible to contain’ failure.
        This later accident report is complete but still waiting on the earlier GE90 compressor failure that should have been contained.

  12. And the whole world decided that ETOPS was a good idea and as a result we have almost an exclusively twin engined fleet. Perhaps having 3, 4 or 5 engines had some benefit after all.

    • Every twin engined plane certified can fly on one engine.
      In the days of the 4 engine ‘reciprocating era’ the US Coast Gurad would station a vessel between Hawaii and West coast to assist planes with 2 or more engines out.
      They would have said at the time , 4 engines arent enough give us 6!

      As an aside, interesting story about some new evidence found for disappearance of Pan Am flight 7 in same location

    • Hello Sowerbob,

      Regarding: “Perhaps having 3, 4 or 5 engines had some benefit after all.”

      Past engine failure rates and accident rates are known, as are engine failure rates for engine types with a few years of service history. From this data, one can calculate whether the twin engine ETOPS aircraft of today are more, less, or equally as safe as the four engine long range aircraft of previous decades. Those who can remember reading about multiple major airline accidents per year in the 1960’s will know how these calculations turn out. For those who can’t remember back that far, see below.

      “In the past, concerns about flight safety focused first and foremost on the reliability of propulsion systems. When ocean-spanning commercial flight operations began after World War II, that narrow focus was appropriate in light of the limited reliability of piston engines. During the 1940s and 1950s, in fact, piston engine–related events were the predominant cause of airliner accidents and contributed to a worldwide fleet hull-loss accident rate that was some 60 times higher than today’s.

      The limited reliability of piston engines led to an operating restriction being placed on two-engine airplanes 50 years ago. The intent of the so-called 60-Minute Rule of 1953 (U.S. Federal Aviation Regulation [FAR] 121.161) was to bar two-engine propeller airplanes, such as the Douglas DC-3, from flying extended routes then more safely served by four-engine propeller types, such as the DC-4. That piston-era operating restriction remains in effect at the time of this writing.

      During the late 1950s, however, the transition to turbine power brought about a quantum leap in propulsion system reliability. Engine reliability has continued to improve in the jet age, so much so that today’s high-bypass-ratio fanjet engines are at least 50 times more reliable than the large piston engines that inspired the 60-Minute Rule.

      By the 1970s, advancing technology had set the stage for two-engine, turbine-powered airplanes to safely exceed the 60-min operating restriction. The result was ETOPS, which began in 1985 with 120-min diversion authority and the requirement for an average engine in-flight shutdown (IFSD) rate of just 0.05 per 1,000 engine-hours. With 180-min ETOPS authority, which followed in 1988, an even more stringent reliability target of just 0.02 IFSDs per 1,000 engine-hours was specified.

      In this way, ETOPS drove manufacturers and operators alike to pursue dramatic gains in propulsion system reliability. The industry met this challenge and bettered it. During the past few years, in fact, the average IFSD rate of the worldwide 180-min ETOPS fleet has typically been at or below 0.01 IFSDs per 1,000 engine-hours — twice the reliability required for such operations. So profound has this trend been that propulsion reliabilities unachievable just 15 years ago are today routine in the modern twinjet fleet.

      In light of these advances, and because the safety and reliability of two-engine airplanes equal or exceed those of three- or four-engine airplanes, the industry no longer views propulsion system reliability as the primary safety and reliability concern in extended operations. Instead, current rulemaking recognizes that a variety of airplane systems and operational issues (e.g., cargo fire suppression capability, weather conditions and facilities at alternate airports) are relevant to overall safety and reliability on routes with the potential for an extended diversion.”


      • As a followup to the good info by AP_R heres a story about some of the detailed testing ‘on the rig’ to get the Leap A/B 180 mins Etops
        ““The testing required for this approval is in some of the most grueling conditions to which an engine would ever be subjected. To start, the engine is deliberately unbalanced to a level that no airline would ever be allowed to operate for even one hour,” said Francois Bastin, executive vice president of CFM. “Then, in this unbalanced state with very high vibrations, it is run for 3,000 consecutive flight cycles (a simulated take-off and landing sequence). We ran this engine in a way that it will never see in commercial service. Once the testing is complete, the engine is entirely disassembled to the piece-part level and laid out on tables for the regulatory agencies to inspect. ”

        • Having said that there have been issues which for the ever fortunate CFM go away very quickly.
          “Boeing resumes 737 MAX test flights after brief grounding”
          “CFM had said flaws in the forging of a disc inside the engine could have led to cracks.
          Boeing grounded the fleet late last week, and announced it on Wednesday, just days before it planned to deliver its first 737 MAX 8 to an airline…..Boeing spokesman Doug Alder said regulators supported the resumption of flights.”

          Of course they did.!

      • More on engine reliability now vs. the good old days, from an 11-9-2010 article in “The Australian” that is mostly about some then recent failures of Trent engines on A380’s. A inflight shutdown rate of .00002 per 1000 hours is equivalent to 1 per 50 million hours.

        “Engines have also become more reliable: the in-flight shutdown rate has gone from 0.89 per 1000 hours for the piston-driven 1950s Boeing Stratocruiser to 0.0002 per 1000 hours for the Boeing 777-300ER.

        “In the old days we used to pull an engine every 500 hours on the 747s,” says University of NSW aviation expert Peter Marosszeky.

        “The JT-9s at that stage were not as well designed mechanically and also the material technology wasn’t there. Then the redesign of the engines altered all that. Now we have engines that literally stay on the wing for in excess of 40,000 hours, and that’s a remarkable shift in the paradigm for these engines. They are very reliable.”

        All this, as Qantas chief executive Alan Joyce points out, makes the explosive failure of a relatively new Trent 900 on a two-year-old aircraft all the more mystifying.”


        • I was suspicious of the inflight shutdown rate of 1 per 50 million hours for 777-300ER’s cited in the article that I referenced above, so I did some checking around. A GE press release issued in April 2014 on the occasion of GE90’s, which are used on many 777’s, reaching 40 million flight hours of service claims a less optimistic but still impressive inflight shutdown rate of .001 (I assume per thousand hours) which would be 1 per million hours or a total of 40 for the 40 million GE90 flying hours that had been accumulated to that date. See excerpt and link below.

          “The GE90-115B engine has a dispatch reliability rate of 99.98% and an engine-caused, in-flight shutdown rate of 0.001. This means an airline pilot will likely operate a GE90-115B-powered Boeing 777 for an entire career without experiencing an engine-caused shutdown in flight.”


      • Hi AP

        I don’t think we should necessarily be slapping ourselves on the back just because things are better than in the past. What I was trying to get at was that the redundancy argument has been skewed towards allowing twins at the expense of quads by requiring ETOPS for all aircraft. That argument seemed to suggest that it was just as likely for all engines to fail or for the loss of one engine to impact equally on all aircraft. In the circumstances we are seeing that is plainly not the case.

        When a twin loses one engine on a long sector with no divert and then has problems with the second and comes down what will be said then? The classic ‘black swan’ argument that it does not happen is evidenced as false by looking at the arguments supporting nuclear power where once in a millennia outcomes occur every 15 years or so.

  13. Scott, the UAL engine failure was a 777-200 registered N768UA. It had PW4000 engines, not GE90s.

  14. Do the FAA collect and actually use enough data ?Do airlines report every crack in a fan blade.Can the FAA tell you the failure rate of every component of every sub type?The engine makers will have this information,but does it fall away as engines get older or get maintained by someone else?This is medium data,so it must be fairly easy to do,but do they?
    RR is forever sullied in my eyes for shameful quality control that allowed the Qantas failure to happen,really disgraceful.

  15. Hmmm…

    Metal blades and fatigue failure – sort of go together, especially for parts that are under such high centrifugal stresses during operation. It is a matter of when, not if a failure can occur. As long as the design and manufacture takes that into account, and frequent inspections are made, metal rotating blades should be safe enough.

    A question for Scott: One of the advantages quoted for CFRP blades is that they are relatively immune to fatigue failure. Have they operated long enough and has enough experience been built up to support this claim? If so, it is possible, now that CFRP blade technology is quite mature, we may see CFRP fan blades in all future engines!?

    • I think the initial GE90 had a life limit on the fan blades similar to helicopter carbon rotor blades, don’t know if it is still there?

    • There have been no fatigue issues with the GE90 CFRP blades. They are a bit thicker than Ti blades which is not optimal for the last third of the blades where the flow is supersonic. The GE90 blades are also hand lay-up of some 200 layers, so slow and expensive to produce. But this is now fixed with Resin injection into a fan blade mold with a 3D structure of dry fiber placed in the mold (actually not completely dry, the 3D form of the fiber is constructed with a thin termoplastic coating on the fibers which keep them tacked in their shape during the resin inflow).

      So fan blades will be predominately CFRP with high volume models done with Resin injection in blade molds. Safran and Rolls-Royce have developed these techniques. The GE hand lay-up will be used for low volume engines like GE9X.

      For higher temp environments the CFRP doesn’t work, there CMC has a future role. GE has run CMC turbine blades in stationary power gas turbines, there it’s easy to observe them and change if necessary. GE tested the CMC parts it now introduces in the LEAP and GE9X in the stationary gas turbines as well, so it has experience on CMC in both stationary and rotating parts. So CMC will come in seals, stationary parts like nozzles, combustor liners, shrouds and then migrate to rotating parts. The principal advantage is a lower cooling requirement and lighter weight.

  16. This is a bit more nuanced though the regs state it should not happen.

    This was not an un- contained fan blade failure.

    It was the disintegration of the front cowling as a result of ht fan blade chewing it up that lead to the fragments flying into the airframe.

    • We don’t really know yet what exactly caused the engine inlet to disintegrate.

      • However CFMI/GE most likley has the FEM models ready with Engine installed into the pylon and with the whole nacelle modelled. An Ansys software package analysis with its Fluent and DYNA 3D options on should be able to model the event and see the combination of aero and structures loads onto the inlet, millisecond by millisecond to show the NTSB on the USAF Museum Imax theater in full resolution. DYNA 3D will even show broken off pieces hitting the Aircraft.
        The mighty Ansys software package on a supercomputer can even model the woman in the seat next to the broken window and will show the loads she had to endure but is overdoing it, unless there will be new regulations on seat belts, the present ones reminds me of the one in my 1970 Cadillac Coupe de Ville mid front sofa, far away from the WRC rally car safety harnesses.

      • “We don’t really know yet what exactly caused the engine inlet to disintegrate.”
        Fatigue failure of one of the front fan blades led to damage of the surrounding cowl is the simple answer

        • We know how it started and ended but the milliseconds in between are important. Is it enough to inspect and remove fan blades with indications or are there other issues that need to be solved, like Engine inlet collapse certification requirements at 500kn?

    • Where are their stories on the GP7000, GE90 PW4000 and CF6 uncontained blade failures.

        • After the initial reports it all goes quiet….

          AW commentators and US trade regulatory bodies went along with Boeings ‘lawfare’ against Bombardier ( which you didnt join) which was on the flimsiest grounds until on appeal finally the ’emperor was declared to have no clothes’

          Now the FAA has a slew of US wide body and CFM56 engine ‘containment’ issues on its plate and yet is able to move its bureaucratic backside with haste only when it comes to RR ?

          • The EASA was first with EASA AD 2018-0084, the FAA just copied as per the present rules.
            One can ask what influence Airline executives/fleet planners should have on AD’s as most lack detailed engineering knowledge and only can complain that it cost too much and will take much longer time to implement than suggested.
            Maybe a FAA/EASA AD commentors qualification education/test is needed to speed up the AD process and get better input.

  17. “not surprisingly, was Fox News network, which has a history of not getting its facts straight.” – Our President attacks news channels needlessly and I don’t see where it helps this article and instead it shows bias. Fox News has been the #1 News network for 16 consecutive years, I don’t think it’s due to them being untrustworthy.

    That said, we live in a day where local and national news seem to be more about the spin than about reporting the news. I don’t watch news anymore for exactly this reason and instead rely on news sources such as your own. I think it’s more helpful to correct the media spin than to spout unsupported statements against it.

      • I understand throwing Christians to the Lions was quite popular back in the days of Rome as well.

        Of course it all depends on who the audience is as to how that is perceived.

        All real news organizations fail to deliver intelligent product at times, often regularly. They are not techs, mechanics or geeks.

        However, when a news origination veers into being “entertainment” and or a propaganda machine then it is no more new or reality than the Apprentice was.

        One is part of the reality that you need to be reasonably well informed to sort out the real in depth issues.

        The other is deliberate twisting of reality. Very entertaining to some, but its not news. Equally scripted and a pre determined outcome as Survivor.

      • Please excuse Tom/Joe… they live in a world where vacuous sensationalism is the norm and are baffled the world is not necessarily like that…really.

        But hypocrisy is not fatal. Look, they are number one !! 🙂 16 jolly years in a row!!

    • Hi Tom,

      just out of curiosity, where did you get your information that Fox News has been the #1 News network for 16 consecutive years?

      Thanks in advance.

      • Its what in US is called ‘cable news’ even though they arent all on ‘cables’ anymore. The audience numbers are tiny compared to main networks.
        Other ‘cable’ news networks are MSNBC and CNN. But lifestyle networks like Home and Garden TV are in top 10 now

  18. I think we’re now experiencing severe “dynamic tension” between the drive for maximum operating efficiencies and safety—in two areas. First, I’m wondering if the safety margins are eroding, as a/c manufacturers are pressed for another (and another) 20% improvement in operating efficiency in each succeeding, new generation of aircraft—mostly falling on the shoulders and backs of the jet turbine engine manufacturers. And, second, we’ve got the airlines taking aircraft out past 50,000 cycles, and their turbines reaching how many tens of thousands of cycles on the wing? Enough. Maybe it’s time to start “dialing back”, allowing the balance to tip more towards safety. And this seems all the more reasonable to me, in a world of general airline profitability and ancillary fees!

    • We’ve also reached an age of unprecedented safety, and pax. I wouldn’t say the needle has bent too far to efficiency, just that expectations are perfection, or damn near, today. Something like 4.6 billion pax since the last major us airline fatality.

      • I’d second that. We are not there yet, by a good margin. Lest we’d be falling off the sky like FW “Stukas” (Ju 87).

    • I’m unable to find the tail or line number for the aircraft in the 2016 SW incident but have seen it described as 16 year old. Were these aircraft delivered close together? Manufacturing flaw seems plausible, for CFM’s sake. Of course, if the whole NG fleet turns out to be effected once it reaches 30000 cycles there is going to be some work involved.
      More worrying is the failure of the containment ring to prevent the blade escaping forward. On a previous thread one poster pointed out that engine makers define this to be as small as possible, naturally enough. Can this problem apply to Leap? What are the consequences if CFM are found to have defined the ring too narrowly on the Leap, I imagine they used the same methodology if unless they had a reason to change? A big delay in new deliveries, at a minimum.

      • Planes with high cycles almost certainly dont have the engines they were delivered with and in any case different sections of the turbofan are replaced or have different maintenance history. A part thats life expired my be replaced with another one with only part life left or maybe a new one.

        Theres complex rules about which parts are interchangeable within some series but not others.

        Like the passengers, you want all the engine parts you took off with to arrive together.

    • I wonder how much of the design work from these companies has been outsourced over the past few years.

  19. Hopefully this doesn’t slow down development of the CFM6-1Ax for the NMA-6x 🙂

    • I dont think we are going to get a new engine with 20% efficiency gains( 15% on wing by the time extra weight and more drag from bigger fan are counted) over the previous generation anymore.

      • I think you are right about that. The way I see the NMA is that it fills a need for a size, rather than much of a gain in economics. In the way that the A321 is very popular as a larger size option over the 737-8 or 9, if the NMA provides only similar economics, the larger size could be the main draw to rightsize some routes.

        • Last comments I’ve seen from BA say they only aim to equal narrow body economics.

  20. A.P.Robert
    Thanks for providing further information on Kegworth.

    • Isnt that avoiding the point ? That Southwest had been resisting a maintenance process on the front fan blades, that could have detected the hidden fatigue crack, and had been recommended by CFM and the FAA not long after the first failure 18 months ago.

      • There is something around that decision that will have lawyers circling like vultures

    • This article seems to suggest that the blade may not have necessarily missed the containment ring.A combination of deformation of the engine and attachment points and aerodynamic forces could be responsible.

      • Does not matter. Shrapnel from any source during an event is not supposed to impact the fuselage.

  21. Two completely different topics are a bit mixed up here: 1) FBO (fan blade off). Should be contained by design with Kevlar structure around inlet. Low energy due to low rotation speed and low outward velocity. Lots of videos on the internet from tests at engine manufacturer. Design issue for airframers is windmilling after FBO due to imbalance.
    2) UERF (uncontained engine rotor failure): disk rupture (not blades) of the high rpm engine shaft. Cannot be contained by design (acts like a buzzsaw) One piece is allowed to travel through aircraft and destroy systems without endangering safe flight. System design very complex due to trajectories (i.e. 4 engines aircraft). Qantas had 3 pieces hitting aircraft.

    • In Qantas case, 3 hit the wing.

      In any event, subsequent fragmentation of the inlet pierced the fuselage killing a passenger.

      That is not supposed to occur.

      I could be wrong but I believe the buzz saw is only allowed to hit the wing in one place and the fuselage not at all.

      • No passengers or crew on Qantas A380 were injured. Some falling debris damaged a house and car. I dont have the detailed report but there is no indication the fuselage was ruptured.

        • Hello dukeofurl and TransWorld,

          Regarding the detailed report for the 2010 Qantas A380 engine failure, see excerpts from and a link to the final ATSB report below. Those who believe that a lack of NTSB final reports for incidents involving GE engines in years 2015 and 2016 is evidence of some NTSB/GE conspiracy, might be interested to note that the ATSB final report for an incident on 11-4-10 was issued on 6-27-13, 2 years and 7 months after the incident.

          It is true that there were very fortunately no injuries to anyone on the aircraft or on the ground. It is also true that fuselage was not penetrated, although the fuselage skin, multiple windows, and the horizontal and vertical stabilizers were damaged by a shower of small debris. A diagram on page 181 of the report shows that of four large pieces of debris, one went downward from the engine and outboard, one went downward from the engine and skimmed the bottom of the fuselage, and two went upward from the engine, through the wing, and over the top of the fuselage. Had any of these 4 large debris pieces hit the pressurized portion of the fuselage, they likely would have punched through it just like two pieces punched through the wing. Is the fact that none of the damaged windows shattered due to the windows being more robust than on a 737 or to luck?

          From page xii:

          “The aircraft sustained significant impact damage to the left wing by fragments and debris from the UERF, and fuel was leaking from the damaged left wing fuel tanks.”

          After landing, fuel continued to leak from the left wing tank. The risk associated with this leak was minimised by the airport emergency services by applying large quantities of water and foam below the left wing while the aircraft’s engines were shut down.

          The No. 1 (outer left) engine continued to run following the normal shut-down procedure. Because of the still-running engine and leaking fuel on the left side, the passengers were disembarked via a set of stairs on the right side of the aircraft. The disembarkation was completed about 2 hours after the aircraft landed. Numerous unsuccessful attempts to shut down the No. 1 engine were made by the flight crew, maintenance engineers and the airport emergency services using different methods . The engine was finally shut down about 3 hours after the aircraft landed by pumping firefighting foam directly into the engine inlet.”

          “The aircraft sustained damage from a large number of disc fragments and associated debris. The damage affected the aircraft’s structure and a number of its systems.

          The ATSB found that a large fragment of the turbine disc penetrated the left wing leading edge before passing through the front spar into the left inner fuel tank and exiting through the top skin of the wing. The fragment initiated a short duration low intensity flash fire inside the wing fuel tank. The ATSB determined that the conditions within the tank were not suitable to sustain the fire.

          Another fire was found to have occurred within the lower cowl of the No. 2 engine as a result of oil leaking into the cowl from the damaged oil supply pipe. The fire lasted for a short time and self-extinguished.

          The large fragment of the turbine disc also severed wiring looms inside the wing leading edge that connected to a number of systems.

          A separate disc fragment severed a wiring loom located between the lower centre fuselage and body fairing. That loom included wires that provided redundancy (back –up) for some of the systems already affected by the severing of wires in the wing leading edge. This additional damage rendered some of those systems inoperative.

          The aircraft’s hydraulic and electrical distribution systems were also damaged, which affected other systems not directly impacted by the engine failure.”

          From page 7:
          “There were no reported injuries to the crew or passengers. There were no confirmed injuries to persons on Batam Island.”

          From pages 199 to 207:

          “The left side of the fuselage (Figures B24 and B25), from passenger door 2 left to the horizontal stabiliser, had impact damage from engine and airframe debris. Although the debris did not penetrate through the fuselage skin, that damage was considered significant and required repair prior to further flight.”

          Centre fuselage – section 15 damage
          • Three fuselage skin panels were damaged in section 15 (Figure B24 and Table B3) that damage included:
          • FR46-FR62, STGR6LH-STGR22LH, 39 items of impact damage (scratches, gouges and dents) and 6 windows damaged in that location.
          • FR46-FR62, STGR22LH-STGR39LH, 19 items of impact damage (scratches, gouges and dents) and 1 window damaged in that location.
          • FR62-FR74, STGR22LH-STGR39LH, 4 items of impact damage (scratches, gouges and dents) and 1 window damaged in that location.

          “The left side of the trimmable horizontal stabiliser leading edge (Figure B26) was damaged from engine and airframe debris at five locations along the leading edge (scratches, gouges and dents). Damage at that location required repair prior to flight.”

          “The left side of the vertical stabiliser (Figure B27) was damaged from engine and airframe debris at five locations along the leading edge (scratches). Damage at that location required repair prior to flight.”

          “The left wing leading edge substructure, droop nose flaps, composite skins and components in that area, between the number two engine and the fuselage (Figures B28-B30) were subject to significant impact forces. Although the damage incurred was significant, it was not considered to be major structural damage.”

          “The belly fairing and centre wing box structure (Figure B31) of the aircraft sustained significant damage from engine fragments. A smaller-sized, high-energy disc fragment penetrated the belly region of frame 51 (Figure B32 to Figure B36).”


          • More from the ATSB report on the 11-4-10 Qantas A380 uncontained engine failure. These excerpts are from the aircraft systems damage section on pages 207 to 231. Fortuantely enough systems remained operational to conduct a safe landing.

            “The debris from the engine failure directly damaged a number of systems, which in turn affected a number of other systems. Although some systems sustained direct mechanical damage, most of the affected systems were damaged through debris impact to the respective wiring looms. Two main wiring looms were impacted by debris; one running through the leading edge of the left wing, and the other in the belly fairing. This resulted in damage to about 650 wires in total (Figure B37 to Figure B51).”

            “As the electrical system was locked in the air mode, only APU generator A was available to supply power following the shutdown of engines No. 3 and 4. This resulted in only AC BUS 1 and the essential bus bar continuing to be supplied with AC power. This limited power source resulted in some flight deck display screens being lost and only the VHF 1 radio being available for use by the flight crew.”

            “Immediately after the uncontained failure, the following flight controls were inoperative:
            • all slats
            • all droop nose flaps
            • the left mid aileron
            • spoilers No. 4 and 6 on the left wing.

            As a result of the inoperative slats, the flight law changed from normal law to alternate law.115 Approximately 10 minutes later, coincident with the depressurisation of the Green hydraulic system, the following additional flight controls were unavailable:

            • the left and right outboard ailerons
            • spoilers No. 2 and 8 on the left wing
            • spoilers No. 2 and 8 on the right wing
            • spoiler No. 4 on the right wing.

            All trailing edge flaps, the elevators and the trimmable horizontal stabiliser and rudder control surfaces remained available for the duration of the flight.”

            “Wiring looms to the asymmetry position pickoff units and the wingtip power-off brakes were severed by engine debris. This damage affected the control and monitoring of the left wing slats. In addition the engine debris severed the left wing slat transmission. As a result the left wingtip power-off brakes automatically secured the slats and droop nose in the retracted position.”

            “In the event that Yellow or Green hydraulic power was not available to extend the landing gear, the crew were required to perform a gravity extension procedure. The depressurisation of the Green hydraulic system necessitated the extension of the landing gear by the flight crew using this procedure.”

            “Engine debris damage to the wiring looms affected the aircraft’s braking system as follows:

            • the body landing gear brakes remained in NORMAL mode
            • the right wing landing gear brakes reconfigured to ALTERNATE mode but without anti-skid protection
            • the left wing landing gear brakes lost pressure. As a result of this pressure loss there was no braking capability on the left wing landing gear.

            During the landing, the initially heavy braking by the crew was reduced as the landing roll progressed. Asymmetric braking during the landing resulted from the unavailability of the left wing landing gear brakes and caused the left body landing gear brakes to absorb significant energy. The maximum brake temperatures recorded on the left body landing gear, wheel 10 brake, exceeded 900 °C.

            The left main body gear wheel fuse plugs121 melted as brake temperature increased after the aircraft had come to a complete stop. As a result, the left body gear wheels 9, 10, 13 and 14 deflated.”

            “Damage to the fuel system resulted in:

            • the FQMS being disabled, with the consequential loss of the fuel jettison function.
            • fuel in the Left and Right Inner Tanks being unusable. The Right Inner Tank contained fuel and was physically capable of its transfer to a feed tank. However, system logic inhibited the manual transfer of fuel due to wiring damage to the LIT fuel pumps. The transfer inhibition was designed to prevent a fuel imbalance between wing tank pairs.
            • the Left and Right Mid Tanks being unusable; however, these tanks were empty for the entire flight.
            • the inability to transfer fuel from the Left Outer Tank using a manual Emergency Outer Tank Transfer function,122 fuel was transferred from the Right Outer Tank while fuel remained trapped in the Left Outer Tank. This function was controlled without any logic to prevent the asymmetric operation of outer tank transfer valves.
            • the restriction of the trim tank fuel transfer capability to the manual transfer of fuel to the inner feed tanks after the provision of a low fuel warning to the crew. Had the flight crew initiated this procedure, approximately half of the fuel in the trim tank would have been lost due to its transfer to the damaged Feed Tank 2.”

            “Severing of signal wires in the left wing leading edge and belly fairing of the aircraft contributed to the loss of control of the No. 1 engine LPSOV. This resulted in the inability to shut down that engine after the aircraft had landed at Changi Airport, Singapore. Although the leading edge wing damage was from major disc fragments, the damage to the belly fairing and its internal wiring was established to be from a smaller fragment.”

          • Hello Robert

            Thanks for posting that. An interesting read.

            You wrote: “Is the fact that none of the damaged windows shattered due to the windows being more robust than on a 737 or to luck?”

            One factor may be the elevation at which the incident happened. I noticed the aircraft levelled at about 7000 feet. Cabin pressure in a 380 is about 6000 feet. So forces due to the pressure differential would have be relatively low.

  22. Speaking of media misconceptions, the passenger wasn’t sucked out of the airplane, they were blown out, by the pressurized air inside the airplane. RIP.

    • Exactly, and a Hover is not sucking up dust, the dust is blown into the Hover by higher pressure air in the house….

  23. Considering the number of daily sorties flown the CFM’s shows amazing reliability. Maybe this is where the danger is that there is a believe that nothing can go wrong. “Even the fittest needs to go for check-ups”.

  24. I found most of the discussion on this thread to be interesting reading of several historical incidents of engine failure. I say most, because I’m not interested in the political/personal philosophy of life content. I go elsewhere for that. My comments are directed only to the fan blade failure problem. The goal should be no in service failure of that type, containment strategies should only be a backup strategy. Maybe that makes me Captain Obvious. There are already in place tools (statistical or deterministic) to arrive at the root cause(s) of the problem and propose a solution with reasonable confidence. The issue is who is responsible to force the expenditure of time and money. I think we all know the answer to that question.

Leave a Reply

Your email address will not be published. Required fields are marked *