34

There was recently an incident where the engine cowl of the starboard engine of a United Airline's Boeing 777 fell off during flight:

Photograph of the engine without the cover on the ground

All available articles seem to suggest it was 'sort' of an emergency and they did in fact do an emergency landing...

A United Airlines flight from San Francisco to Honolulu made an emergency landing Tuesday after an engine cover reportedly flew off mid-flight.

... with people even asked to brace for impact:

“They let us know that we had to brace for impact in case there was a rough landing,” she said.

It seems logical that the cowl coming off could be a sign of loss in structural integrity around the engine (also of the engine itself?).

Another issue could be ingestion of debris (especially near the engine inlet).

How hazardous is such a case of the engine cowl falling off?

Note: I do understand that a twin engine aircraft can continue flying after a single engine loss however due to the reduced performance an emergency landing would make sense.

J W
  • 16,570
  • 3
  • 60
  • 115
Kanchu
  • 927
  • 7
  • 14
  • It would not be good if it hit the tail, but once it's fallen off, the only issue I see is that reverse thrust cannot be used on that engine, it would have been shutdown and just windmilling. But I can't see that really qualifies as an "emergency" landing...? (Or does that mean reverse thrust cannot be used at all due to asymmetry)? – Penguin Feb 15 '18 at 09:50
  • 6
    "How hazardous.." I believe it's like in other circumstances where the exact cause and consequences are unknown: The only possible decision is to land in emergency. Further ground analysis will tell how hazardous it has been, from just an engine failure (safe) to the possibility of the engine falling in a turn and hurting the wing or the fuselage (most critical). – mins Feb 15 '18 at 11:26
  • Huh! Would they have shut down that engine ?? – Fattie Feb 15 '18 at 13:54
  • 32
    The part that fell off is called the engine cowl, the nacelle is the complete structure under the wing including the engine itself. – dasdingonesin Feb 15 '18 at 14:39
  • 12
    @Fattie like many of the news agencies you seem to be missing the fact that the engine also lost two fan blades, which is the most likely cause of the loss of casing. – Notts90 Feb 15 '18 at 14:51
  • 8
    That's not a nacelle. That's a cover. The nacelle basically is the engine, and when that departs, it often wrecks so much stuff it renders the plane unflyable. Here's another where TPHTF... – Harper - Reinstate Monica Feb 15 '18 at 20:42
  • 3
    @Harper The nacelle is the cover. The engine is inside the nacelle. What's missing in this photo is the entire front part of the nacelle, including the cowl. – TomMcW Feb 15 '18 at 21:53
  • Well, it's not great... – Lightness Races in Orbit Feb 16 '18 at 00:04
  • Regarding the discussion of nomenclature, geographic linguistic differences notwithstanding, the parts in question are parts of the engine cowl (which comprises part of the engine nacelle as a whole). Engine covers refer to "remove-before-flight" type protection equipment such as canvas covers. That being said, in the Media likes to use simple English to describe the cowl as a "cover" of the engine, which is it's function: the cowl covers the engine as part of the nacelle. – J W Feb 17 '18 at 20:16
  • 1
    Your question implies/infers that the aircraft merely shed a few non-critical parts. That's not a very accurate description of the event. Based on the missing fan blades, a more likely description is failure of at least one fan blade leading to collateral damage, including loss of the cowling. It's a pretty violent event - see https://www.youtube.com/watch?v=wcALjMJbAvU and https://www.youtube.com/watch?v=l8jgGoTc1Fc . That renders the engine inoperable, and for a 777 leaves you with only one good engine. – Anthony X Feb 17 '18 at 21:19
  • Whenever an engine fails in flight, there's no way to know how much collateral damage may have been done. Fuel leaks and uncontrollable fires become a distinct possibility. Best thing a crew can do is deem it an emergency and put the plane on the ground before a manageable situation turns into a disaster. – Anthony X Feb 17 '18 at 21:24
  • @Harper What do you mean by TPHTF? Google search returns this question and a book reference for "Two-Phase Heat Transfer Fluid", which I doubt is what you mean. – Skyler Apr 03 '18 at 15:35
  • 2
    @Skyler I mean The two-phase heat transfer fluid Hits The Fan. Except in this case it's believed to be solid waste discharge from the lav. I'll let you sit with that thought for a minute. So perhaps another word might go there. A four letter word I can't say here. A word often said when an engine falls off. – Harper - Reinstate Monica Apr 03 '18 at 15:40
  • Here is an extensive interview with the captain of the flight, discussing the various issues: https://www.youtube.com/watch?v=J7_lzeY23dI – sdenham Sep 09 '21 at 20:39

4 Answers4

77

I work in aero engine safety but not for the company that manufactured the engine in the event you mention.

Parts falling off engines is Not Good. We worry about them hitting people below the aircraft. And as Koyovis mentions, losing the nacelle or portions thereof (looks like in this case it was the intake and fan cowling) can change the aeroelastic properties, thus inducing vibration, which is not comfortable for the passengers or crew (reducing their ability to do their jobs) and adds additional loads to other engine parts.

It is not true as mins states that the cause or consequences are unknown. The regulatory authorities require manufacturers to submit a detailed (thousands of pages long) Failure mode, effects, and criticality analysis (FMECA) that covers every part of the engine, what could go wrong, what the consequences could be, and what we are doing to make sure it won't go wrong or that the effects are minimized if they do. While I don't work on that engine, I am confident that structural failure and release of the intake is in the FMECA.

In my professional judgement, in the scale of failures affecting engines defined by the FAA (catastrophic, hazardous, major, minor), this failure would be major, due to a large part falling off the aircraft able to hit a person below, the reduction in safety margins caused by increased vibration, and the damage to critical parts (fan blade) from debris ingestion as mentioned in one of the other answers.

Since the fan blade was seriously damaged, the pilots likely shut down the engine (otherwise the vibration would have been insanely high). But as you mention a single engine shut down is not considered hazardous - we design for that situation. Nevertheless many pilots choose to land after a single engine shutdown.

moink
  • 835
  • 6
  • 7
  • 33
    One of the reasons of landing after a single engine shutdown is to prevent a dual engine shutdown. Which would be Bad. – Mast Feb 15 '18 at 14:37
  • 5
    Mast, agreed. Though we also calculate the probability of that happening, and they are very low (as required by the regulator) – moink Feb 15 '18 at 14:39
  • 5
    Nice answer! Welcome to Av.se, and thanks for the insider’s perspective on that. I wasn’t aware of the FMECA or how thorough the analysis there has to be. Good stuff! – Ralph J Feb 15 '18 at 15:47
  • 2
    "It is not true as mins states that the cause or consequences are unknown": Do you mean the pilots knew before landing what were the causes of the accident and what have been the exact impacts on the aircraft? I didn't look after this event, but I'd be surprised. If you mean defect/failure modes analysis during design, then yes, but that's not my point (and I guess nobody predicted the actual impacts of this Trent-900 accident during the design). – mins Feb 15 '18 at 18:29
  • I didn't work on the Trent 900 either, but it is definitely true that every time an oil pipe is mentioned in the FMECA, the risk of oil fire causing turbine overheat causing disc burst causing uncontained debris is mentioned. That particular cause of the oil pipe failure was likely not in the FMECA (since the FMECA considers as-designed parts and it was a quality issue, and I believe an unanticipated one at that) – moink Feb 15 '18 at 20:46
  • 1
    There's that one British Airways flight to London. Taking off at LAX, they lost an engine just past V1. They continued the takeoff and were able to land... at Manchester. – Harper - Reinstate Monica Feb 15 '18 at 20:50
  • 22
    @Mast - ...which is the old joke. Pilot comes on the PA multiple times saying, "An engine has failed, but we still have X engines left. Landing will be delayed by another 30 minutes.". When they are down to one engine, passenger says, "I sure hope that last engine doesn't go, or we'll be up here all night!" – T.E.D. Feb 15 '18 at 21:40
  • 1
    @Harper Do you know what flight you're referring to, as a full SEI flight from LAX you MAN is implausible. – TomMcW Feb 15 '18 at 21:42
  • 2
    @TomMcW yes, it's a 2-step process, first use a Boeing, and second, be British Airways. Seriously I used to think it was an urban legend but there are better sources than Snopes... The thing actually got investigated by AIB and FAA. The verdict was the same as the 707 aileron roll... "look, just don't do it again". – Harper - Reinstate Monica Feb 15 '18 at 23:00
  • @Harper Ahh. 747. SEI on a quad is a bit different. They do SEI ferry flights on those routinely, but with proper fuel planning. An impromptu SEI revenue flight... with passengers... over an ocean? That's pretty risky imho – TomMcW Feb 15 '18 at 23:44
  • @TomMcW Yeah, I thought it was a good idea up until about Halifax. A 3-engine 747 should be considered to have, like "ETOPS 15". I was figuring BA would have another 747 fly from London or NYC and meet it. – Harper - Reinstate Monica Feb 16 '18 at 00:08
  • How familiar with an FMECA would a typical pilot be? My guess is awareness of some basic failure modes at most, given the length you mention. – jpmc26 Feb 16 '18 at 02:57
  • 3
    I doubt pilots are aware of the FMECA. If a mitigation requires a pilot to do something, that will be in the engine manual and the operating procedures. The FMECA will clearly state what manual has it. And we try to avoid relying on pilots to fix our problems. – moink Feb 16 '18 at 15:44
  • @moink Is there any textbook on how you actually estimate probabilities for these types of failures? I’m a physicist and know probability theory but have no idea bow I’d apply it to engine parts. – user1997744 Feb 17 '18 at 10:20
  • @user19997744 there are handbooks for various components. for example for electronics the DoD uses MIL-HDBK-217F: RELIABILITY PREDICTION OF ELECTRONIC EQUIPMENT – Bageletas Feb 18 '18 at 00:22
  • @user1997744 There are lots of books on reliability engineering. You can also check out reliawiki: http://reliawiki.org/index.php/Main_Page For each part, we use either a simple #failures/hour or #failures/cycle, or fit a Weibull distribution to previous failures, or a lognormal crack-initiation/crack-propagation model for critical parts. We maintain models of these for engines in service and update them as service data comes in. For new products, we model it based on service data from similar parts in similar engines, or we use rig tests, engine tests, or supplier reliability data. – moink Mar 01 '18 at 13:07
15

Aviation is very safe due to the huge experience built up over the decades. Engine failures, as in the engine stops working, are accounted for in flight training and in aircraft design. Safety is in known circumstances, with very low tolerance for situations out of the norm as @corsiKa states.

But an engine cowling falling off is a structural failure, with unpredictable consequences:

  • What bit of the cowling breaks off?
  • What other parts of the structure do the broken off bits impact upon?
  • Are any of the engine cowling parts being sucked into the engines? In this case, it looks like they were.

A typical Level D Full Flight Simulator has about 300 failures which are part of the training curriculum of pilots. These are failures which can be handled by a determined procedure, as experience has shown. About fifty of these are engine malfunctions:

  • Engine starting: hot and hung starts, start valve failures, ignition failures.
  • Engine functioning: seizure, vibration, flameout, surge.
  • Systems: oil pressure, oil temperature, oil filter bypass, oil leak, fuel filter bypass, EEC normal mode, false EGT indication, thrust lever signal fail.
  • Thrust reverser: unlocked in flight, does not unlock after landing, lock sensors fail.

Note that by far most of these failures are of an engine function that stops working or does not start up when commanded. Only the vibration malfunction may be relevant to a structural failure like a fan blade broken off, but the vibration effects can be neatly calculated with physical modelling, in a predictable and determined way.

Due to the unpredictable nature of the engine cowling structural failure, there is a high degree of uncertainty as to what can and what cannot happen further once the cowling has fallen off; there are bits of structure flapping in the wind, there are vibrations caused by...what? The pilots can see failure effects on the instrumentation, but can be unaware of the exact situation. In the case of El Al 1862:

At 6:28:45 pm, the captain reported: "El Al 1862, lost number three and number four engine, number three and number four engine." ATC and the flight crew did not yet grasp the severity of the situation. Although the flight crew knew they had lost power from the engines, they did not see that the engines had completely broken off and that the wing had been damaged. The outboard engine on the wing of a 747 is visible from the cockpit only with difficulty and the inboard engine on the wing is not visible at all. Given the choices that the captain and crew made following the loss of engine power, the Dutch parliamentary inquiry commission that later studied the crash concluded that the crew did not know that both engines had broken away from the right wing.

Declaring an emergency in the case of the United B777 is fully justified. They are not falling out of the sky yet, but nobody knows for how long that will last...

Koyovis
  • 61,680
  • 11
  • 169
  • 289
  • 6
    It's also safe because of a very low tolerance for activity out of the norm. Sure no one wants to be delayed because of the 2000 something safety checks before takeoff, one of those checks failed. I've even heard passengers say things like "I don't know why they bother, things rarely happen anyway" which just baffles the mind - they don't happen because of the zealous safety regulations. – corsiKa Feb 15 '18 at 16:01
  • 7
    "But an engine cowling falling off is unique." That's simply not true. – Dan Hulme Feb 15 '18 at 17:23
  • 1
    My biggest concern would be parts being sucked into the compressor and then the lack of a proper intake, so the engine will operate in very off-design conditions. Thrust will be lower and SFC higher, so the planned destination might not be reached. – Peter Kämpf Feb 15 '18 at 17:39
  • 5
    @Koyovis, Aviation Herald reports an average of three cowlings falling off a year. On an aviation scale, that's a fairly common occurrence. – Mark Feb 15 '18 at 23:52
  • 1
    @Mark They break off in unpredictable ways and with unpredictable consequences though. – Koyovis Feb 16 '18 at 00:00
  • @corsiKa: Right, things rarely happen because they bother. Such passengers are, frankly, stoopid. – Lightness Races in Orbit Feb 16 '18 at 00:07
11

It depends a bit on when it happens. For instance, American Airlines 191 suffered a complete engine loss (it literally fell off) during takeoff. It caused significant hydraulic damage and, due to retraction of the slats on the left wing, caused the airplane to roll over and crash. It's possible the same incident at a higher altitude would have been more recoverable.

The United incident happened at cruising altitude, and only involved the outer cover. The immediate threat is that the engine ingested debris. From pictures of the front, you can see it completely destroyed one fan blade and may have partially damaged another (the pilot likely shut it down, assuming the computer didn't automatically). The vibration in the airframe was likely a result of the loss of the aerodynamic parts in an asymmetric way (problematic but not life-threatening).

enter image description here

Ironically, this happening on a route to Hawaii meant the aircraft was ETOPS certified, meaning it is more fault tolerant for an engine failure like this.

The airplane-engine combination should maintain a target IFSD (In Flight Shut Down, defined as "When an engine ceases to function (when the airplane is airborne) and is shut down, however briefly, whether self induced, flightcrew initiated or caused by an external influence.") rate at or below 0.02 per 1,000 engine-hours for 180min ETOPS approval.

Machavity
  • 5,993
  • 2
  • 28
  • 57
  • 10
    Your answer assumes that the nacelle broke first, debris was ingested and then caused the loss of a fan blade. While that is possible, it is also entirely possible that the fan blade failed first and the resulting vibration caused the nacelle damage. Fan blade loss causes a LOT of vibration. – Daniel K Feb 16 '18 at 02:17
  • 4
    I'd argue that the nacelle did not break first because a single fan blade broke at the root (and damaged its neighbor) while the rest are fairly clean. Debris ingestion results in many fan blades having leading edge damage. – user71659 Feb 16 '18 at 18:24
  • 2
    Working closely with aerofoils and their manufacturers, I can say it looks a lot more likely the blade broke first and the nacelle damage is from the vibrations. As @user71659 says, there's only two blades with significant damage. The tips of other blades probably rubbed up against the casing as well because of the vibrations. – Notts90 Feb 16 '18 at 19:13
  • From the pictures online it looks like not just outer cover but inlets initial geometry that does initial compression was lost. That’s quite serious, see my answer for slightly more info ;) – Alexey Kamenskiy Feb 18 '18 at 09:44
3

Even though there is already accepted answer which is good I would like to add my 2. Source: Masters in gas turbine (jet) engines design.

This is extremely serious issue for a flight. The part that “fell off” is responsible for the air intake and initial compression (before it hits the first stage of compressor). Such change in geometry very likely to change intake pre-compression ratio and cause airflow to more turbulent, which is Not good for the first stage. Debris from the damage are guaranteed to damage first stage of compressor which is very dangerous as the first blade disk is the heaviest and therefore easiest to lose the balance and cause further damage to the engine.

The incident like this could potentially cause serious instability in engines rotor and send the first stage compressor disks flying through the cabin.

Thankfully in civil aviation there are many failsafe mechanisms that will automatically shutdown engine when specific conditions are met. Namely in this case I am very sure the engine was automatically shutdown by the critical level of vibration trigger.

Shutting down engine mid-flight in such situation is the only sane way to ensure that the further damage is not done, therefore all aircrafts designed in a way that allows for loss of up to 50% of engines. Thus in civil aviation medium and large capacity aircrafts are equipped with minimum of 2 engines.

However, even though flight could technically continue on remaining engines, single engine failure implies that there is a possible oversight in pre-post-flight checks, and the crew is required to perform emergency landing procedure in the nearest possible airport.

Worth noting that command to “brace for impact” may have nothing to do with real situation as it is standard procedure for emergency landing and does not constitute real possibility of rough landing.

Alexey Kamenskiy
  • 181
  • 2