Updates to failure-analysis processes and product designs are in the works to help ensure turbine engine failures do not pose unacceptable risks to passengers and systems. But lessons learned from several recent incidents suggest adding new, meaningful standards to certification regulations will prove challenging.

The facts confirmed so far by investigators probing the Feb. 20 inflight failure of the right, or No. 2, Pratt & Whitney PW4077 engine on a United Airlines 777-200 near Denver, point to a now-familiar set of circumstances (AW&ST March 8-21, p. 28). An engine/airframe combination certified more than two decades ago suffered an engine failure triggered by a fractured fan blade. In each of the recent incidents, the engine met its certification requirements for contained fan-blade-out (FBO) events: Fragments were not ejected through the engine’s containment ring or case toward the airframe or wings. Developing designs that keep engine failures contained has been industry’s key focus in its push to minimize risk to passengers, critical systems and fuel tanks. 

But in all four cases, damage caused by blade fragments hitting sections of the engine’s covering, or nacelle, triggered a series of events that caused large pieces of structure, including parts of engine inlets and fan cowls, to break away. All four aircraft involved—two PW4077-powered United 777-200s and two CFM International CFM56-7B-powered Southwest Airlines 737-700s—suffered fuselage damage. In the most serious event, Southwest Flight 1380 in April 2018, debris struck one of the 737’s windows and dislodged it, causing a rapid decompression and passenger fatality—the first for a U.S. scheduled passenger airline since 2009.

• Engine failure risks will never be eliminated
• Regulatory and product-development changes have lessened severity of risks

Each aircraft landed safely, thanks to what worked—the airframe and engine designs, underlying certification requirements and the pilots’ skills. But airframe damage, parts being shed from around the engine, and the Southwest accident’s passenger fatality suggest unacceptably high risks remain.

Correcting the fault that triggered all four failures—inadequate fan-blade inspection protocols—is in the works or, in the CFM56-7B fan-blade inspection’s case, already done. The FAA on Feb. 23 ordered immediate inspections of all PW4077 fan blades before further flight and will work with Pratt to determine adequate repeat intervals so that fatigue cracks are flagged before they pose a failure risk.

The NTSB determined the February 2018 failure of a PW4077 on a United 777-200 was caused by low-cycle fatigue cracking in a fan blade that Pratt failed to detect on multiple occasions. The board faulted Pratt’s inadequate training for failing to prepare its technicians.

Although the NTSB cautions that initial inspections did not confirm fatigue as the specific cause in the February 2021 blade failure, preliminary metallurgical findings from a scanning electron microscope examination at Pratt “identified multiple fatigue fracture origins on the interior surface of a cavity within the blade,” the board says.

The similarities in airframe-related damage in all four failures suggest a common link there as well—Boeing’s inability to quantify the potential damage resulting from a fan blade striking and deforming the fan case, creating a displacement wave. In both Southwest failures and the first United incident, the NTSB said load-path damage from displacement waves helped compromise the inlets and fan cowls, causing parts of them to break away.

“The high energy associated with the displacement wave peaks within the first few fan revolutions after the fan blade release, and the displacement wave continues until the impact energy dissipates,” the NTSB said in its final report on Southwest Flight 1380.

The 777-200 was certified in April 1995, while the 737-700 followed in August 1998, meaning the multiyear certification effort—including the airframe/engine integration analysis—took place 25-30 years ago. At that time, Boeing supplied inlets for some of the engine-failure tests, even though the regulations do not require them. The reason? The technology and computing power needed to capture and quantify a displacement wave did not exist. Assessing inlet damage following tests provided much-needed data to help validate designs.

“The physics of an FBO event have not changed, but our capability to assess that impact phase has increased substantially,” Boeing propulsion structures expert Torben Syberg said during a 2018 NTSB hearing on Southwest Flight 1380. “In the preliminary design phase, we’re able to inform the design by working with the engine [OEM] to understand what we refer to now, but we didn’t then, as a displacement wave that gets caused by that first blade that impacts the case.”

A heavier reliance on trial and error for previous-generation models such as the 737-700 meant frequent test failures and redesigns. During a 1994 rig test run to gather data on fan blade failures for CFM56-7 certification, a Boeing-supplied, production-representative inlet fitted to the engine was damaged significantly. Boeing ordered its supplier, now part of Raytheon Technologies’ Collins Aerospace unit, to redesign the inlet containment doubler and increase the inlet’s stiffness.

Two years later, the redesigned inlet was included on a certification test. The failed blades were contained, helping validate Boeing’s work.

Advances in analytical modeling have changed the process. New computer models “enhance our capability to be able to understand the physics of the [blade] impact phase,” Syberg said during the 2018 hearing. “It’s helped us in that understanding, relying on predictions that are validated by [a] test [as] opposed to just waiting until you get the empirical data from the test.”

The changes provide automatic benefits for newer designs during product development. 

“In today’s programs, when we start collaborating and we’ve determined the engine manufacturers for a given program, in the definition of the requirements, one of the requirements is working together to understand this displacement wave,” Syberg said.

On older designs, the new modeling only comes into play when safety issues are identified. 

Boeing, responding to an NTSB recommendation that stemmed from the Southwest engine failures, is redesigning the CFM56-7B cowl (AW&ST Dec. 9-22, 2019, p. 38).

“We are working with Boeing to ensure that the corrective action, in the form of a design change, will address the most critical fan blade impact locations,” then-FAA Administrator Steve Dickson wrote in a March 2020 formal response to the NTSB.

Boeing has been working on revamped 777 cowls for about a year, The Wall Street Journal reported shortly after the Feb. 20 incident. Boeing declined to discuss the proposed changes.

Minimizing ancillary damage from engine failures caused by fractured rotating parts has been an industry priority for decades. Regulations governing engine airworthiness standards have required prevention of uncontained failures since their inception in 1965. In 1984, the FAA revised the regulations, contained in Part 33, and added blade-containment and rotor-unbalance tests to engine certification requirements. The FAA and Euro-pean Union Aviation Safety Agency regulations are largely harmonized.

The rules and related research, most notably an effort to collect and study engine-debris data from uncontained failures that began in 1996, have resulted in specific requirements for engine original equipment manufacturers—and data to justify them.

Airframe requirements under Part 25 are less specific, out of necessity. Despite the engine OEM requirements, airframe manufacturers must assume that uncontained engine failures will occur and develop their designs accordingly. 

Among the airframe requirements is a stipulation that the engine inlet and other major nacelle components cannot jeopardize safe operation of the aircraft following a “foreseeable single failure,” which includes broken fan blades. If a safety analysis shows parts will be shed, structural assessments must demonstrate the parts will not pose an unacceptable risk.

“Part 25 folks look at the potential of a blade release to be a probability of one—it will happen,” says Mike Borfitz, a former manager in the FAA’s Engine and Propeller Directorate. “The question is, what are you going to do about it? How do you prevent pieces from flying off the nacelle in a way that’s not going to become onerous?”

Concerned about the risks, the FAA tasked an industry working group with studying the issue. The group’s 2016 final report included several recommendations. Among them was modifying Advisory Circular (AC) 20-128A, which provides guidance on how airframe OEMs can minimize hazards caused by uncontained failures. 

The working group suggested expanding a section on “good design practices” that emphasizes redundancy and crack mitigation. It proposed adding “proper material selection” and “designs with stringer, frame, and rib sizing and spacing that result in a highly robust configuration that inherently minimizes the risk from uncontained engine fragments” to the guidance.

The FAA says it is “considering” the working group’s recommendations and “is working to amend the current guidance to address them.”

In 2018, an NTSB report on the 2016 uncontained failure of a GE CF6-80C2 onboard an American Airlines 767-300 recommended that the FAA update AC 20-128A, incorporating lessons from similar incidents in the two decades since the guidance was last updated. The agency told the NTSB last year that a revised draft is in the works.

“There is no practical way we can design fan blades to fail in a predictable way or in a guaranteed safe manner,” Borfitz says. “But the [engine] containment ring is there, Parts 25 and 33 hold hands to assure the structures of the engine and airplane can withstand damage and serious vibrations. The recent history of blade-out events has not demonstrated there is an imminent, catastrophic threat. But I’m in no position to say it will never happen.”

While recent events underscore that engine-failure risks will -never be eliminated, industry’s efforts have largely paid off. The failure of an engine designed after the first generation of late 1960s high-bypass turbofans has never triggered what regulators define as a “catastrophic” event, with multiple fatalities or loss of an aircraft.

“The system is doing exactly what it’s supposed to do,” Borfitz says. “It’s not pretty, and it’s chaotic, but it works.”