After the most recent spectacular engine failure with United flight 328 from Denver to Honolulu, a prior incident with a sister ship with the same engine type in 2018, caused by the same failure mode, it is maybe a good time to reflect on certification standards.
Fan blade failures are a relatively common event and usually end up without injuries to aircraft occupants, although not always. Large commercial aircraft are certified to fly safely and perform certain manoeuvres with one engine operative. This is all contained in the applicable aircraft and engine certification codes.
But let's look at whether these certification codes cover the elements of fan blade failure events that occurred in recent years.
Rotor bursts is a category of failure with potential catastrophic consequences and consequently are required to be mitigated to a likelihood of occurrence of 10.E-9, in other words once in a billion flight hours. Refer to certification code section FAR 33.75 (below in blue).
Fan blade failures, as part of of rotor burst events consequently are allowed less likely than that.
All current turbo fan engine types have suffered fan blade failures, among which CFM56-7B, Rolls Royce Trent 700, Pratt & Whitney 4000 series.
"(3) The applicant must show that hazardous engine effects are predicted to occur at a rate not in excess of that defined as extremely remote (probability range of 10−7 to 10−9 per engine flight hour). Since the estimated probability for individual failures may be insufficiently precise to enable the applicant to assess the total rate for hazardous engine effects, compliance may be shown by demonstrating that the probability of a hazardous engine effect arising from an individual failure can be predicted to be not greater than 10−8 per engine flight hour. In dealing with probabilities of this low order of magnitude, absolute proof is not possible, and compliance may be shown by reliance on engineering judgment and previous experience combined with sound design and test philosophies."
In recent events we have seen, that in the cascade of failures following a fan blade separation, some elements are not covered by certification codes;
Parts breaking loose from the aircraft (not limited to engine parts), potentially endangering the integrity of the aircraft itself and people and property on the ground
Excessive aerodynamic asymmetry and drag, caused by nacelle parts breaking loose and departing the aircraft, In itself causing degraded aircraft performance with one engine operative, compared to one engine inoperative book values.
Excessive vibration for prolonged periods of time caused by windmilling of the damaged fan rotor, potentially causing further damage to the aircraft
Loss of effectiveness of fire suppression system due to loss of fire containment parts of the nacelle.
Secondary damage to engine indication and control systems, resulting in crew's inability to correctly assess the status of the aircraft.
Lets look at the applicable certification codes.
Commercial Gas Turbine Engine Certification Codes
Commercial gas turbine engines are certified against 14 CFR Part 33 (commonly annotated as FAR 33).Remember; power-plants are type certificated products!
EASA certification codes are in CS-E.
The certification codes contain comprehensive code for general design and construction requirements, for the engine itself as well as its subsystems such as lubrication, bleed air, cooling and control systems. Some compliance elements can be demonstrated by analyses but a large number have to be demonstrated by tests:
Section 33.83; Vibration test
Section 33.84; Engine Overtorque tests
Section 33.85; Calibration tests
Section 33.87; Endurance tests
Section 33.88; Engine Overtemperature tests
Section 33.89; Operation tests
Section 33.90; Initial Maintenance and Inspection tests
Section 33.91; Engine system and componen tests
Section 33.92; Rotor Locking tests
Section 33.93; Tear down inspection
Section 33.94; Blade containment and Rotor Unbalance tests
Section 33.97; Thrust reversers
Of obvious interest in these cases is FAR 33.94, Blade containment and Rotor unbalance tests. Below the literal content of this section (current amendment level):
§33.94 Blade containment and rotor unbalance tests.
(a) Except as provided in paragraph (b) of this section, it must be demonstrated by engine tests that the engine is capable of containing damage without catching fire and without failure of its mounting attachments when operated for at least 15 seconds, unless the resulting engine damage induces a self shutdown, after each of the following events:
(1) Failure of the most critical compressor or fan blade while operating at maximum permissible r.p.m. The blade failure must occur at the outermost retention groove or, for integrally-bladed rotor discs, at least 80 percent of the blade must fail.
(2) Failure of the most critical turbine blade while operating at maximum permissible r.p.m. The blade failure must occur at the outermost retention groove or, for integrally-bladed rotor discs, at least 80 percent of the blade must fail. The most critical turbine blade must be determined by considering turbine blade weight and the strength of the adjacent turbine case at case temperatures and pressures associated with operation at maximum permissible r.p.m.
(b) Analysis based on rig testing, component testing, or service experience may be substitute for one of the engine tests prescribed in paragraphs (a)(1) and (a)(2) of this section if—
(1) That test, of the two prescribed, produces the least rotor unbalance; and
(2) The analysis is shown to be equivalent to the test.
(Secs. 313(a), 601, and 603, Federal Aviation Act of 1958 (49 U.S.C. 1354(a), 1421, and 1423); and 49 U.S.C. 106(g) Revised, Pub. L. 97-449, Jan. 12, 1983)
[Amdt. 33-10, 49 FR 6854, Feb. 23, 1984]
Below a video of such test. It is the most spectacular and expensive test in engine certification, as the test engine is turned into scrap metal after testing.
Obviously, the most critical blade is a fan blade and not a turbine blade given its weight hence energy release.
The pass criteria are:
The damaged engine must not break off its mounting for 18 seconds if the engine keeps operating after the blade release.
The engine must not catch fire after the blade release and contain the damage.
The circumstances in the real world are very different from these pass/fail tests;
A damaged engine can continue to windmill (with the associated excessive vibration) for hours if it fails on an ETOPS flight, with untested effects on the engine attachment structure.
The test specifies to "contain the damage" but does not indicate whether that contains production standard cowling and inlet parts. On many fan blade failure events the complete intake cowl departed the aircraft and left a perpendicular frontal aerodynamic surface, consequently creating massively disturbed airflow and increased aerodynamic drag around the failed engine. This affects the handling characteristics of the aircraft, engine-out en route drift down values and engine-out go around/climb performance. This is not flight tested during aircraft certification.
In addition, the failed engine on the Feb-2021 event did catch fire and continued to burn until final approach.
The 2018 B777 event caused engine wiring harnesses to sever which wiped out the engine indication system and consequently impeded the crew in assessing the status of the aircraft
A look a aircraft certification code. Large aircraft FAR 25:
There are many certification requirements that pertain to one engine inoperative operation.
In particular minimum take-off and climb performance is specified in section 25.121
En route engine out requirements are specified in 25.123.
Landing requirements specified in 25.125.
An interesting section is 25.251; Vibration and Buffeting (content below)
§25.251 Vibration and buffeting.
(a) The airplane must be demonstrated in flight to be free from any vibration and buffeting that would prevent continued safe flight in any likely operating condition.
(b) Each part of the airplane must be demonstrated in flight to be free from excessive vibration under any appropriate speed and power conditions up to VDF/MDF. The maximum speeds shown must be used in establishing the operating limitations of the airplane in accordance with §25.1505.
(c) Except as provided in paragraph (d) of this section, there may be no buffeting condition, in normal flight, including configuration changes during cruise, severe enough to interfere with the control of the airplane, to cause excessive fatigue to the crew, or to cause structural damage. Stall warning buffeting within these limits is allowable.
(d) There may be no perceptible buffeting condition in the cruise configuration in straight flight at any speed up to VMO/MMO, except that stall warning buffeting is allowable.
(e) For an airplane with MD greater than .6 or with a maximum operating altitude greater than 25,000 feet, the positive maneuvering load factors at which the onset of perceptible buffeting occurs must be determined with the airplane in the cruise configuration for the ranges of airspeed or Mach number, weight, and altitude for which the airplane is to be certificated. The envelopes of load factor, speed, altitude, and weight must provide a sufficient range of speeds and load factors for normal operations. Probable inadvertent excursions beyond the boundaries of the buffet onset envelopes may not result in unsafe conditions.
[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Amdt. 25-23, 35 FR 5671, Apr. 8, 1970; Amdt. 25-72, 55 FR 29775, July 20, 1990; Amdt. 25-77, 57 FR 28949, June 29, 1992]
This is clearly a section that was not addressing the loss of engine fairings, creating massive buffet that did impede the crew to control the aircraft in the 2018 B777 engine fan blade failure event.
In conclusion;
After recent engine fan blade failure events, it will have to be determined whether to take the route to safely contend with the cascading consequences of secondary damage to an aircraft, or to incorporate mitigation measures of blade out events into the certification requirements.
As regulators first step following the CFM56 failure was to make fan blades life limited parts, Rolls Royce already classified fan blades (and annulus fillers) as life limited, the expectation is that the landscape will move towards mitigation as opposed to contention with secondary damage.
However, his will be a complex decision to make and justify, and the safety recommendations from the NTSB will have to be a strong guidance to that decision.
Feel free to comment