Focus Turns to Engine Design for Air Safety
The jumbo jet had just lifted off when a flight deck indicator warned the crew that one of its three engines--No. 2, in the tail--was vibrating excessively. As soon as it was safe to do so, the crew eased back the throttle for that engine and watched the indicator. It returned to normal and stayed there.
Everything was normal. The no-smoking light was turned off, and flight attendants prepared to serve drinks to 203 passengers settling back for the four-hour trip.
But back in the tail, deep in the superheated recesses of that 7,000-pound No. 2 jet engine, a series of breakdowns was occurring beyond the view of passengers, crew or even cockpit indicators.
Hurled Like Shrapnel
Finally, the engine exploded. Nuts, bolts and turbine blades were hurled like shrapnel. Metal fragments punctured the back wall of the passenger cabin and one of the lavatories. The aft fuselage was blown open, disabling rudder pedal cables, electric wiring, some fuel lines and three hydraulic systems serving the tail wings, the movable horizontal stabilizers.
Fortunately, this Eastern Airlines jet--a Lockheed L-1011 with Rolls-Royce engines--still had an operating, though damaged, fourth hydraulic system. The crew was able to bring the giant plane back to a safe landing at New York’s Kennedy International Airport.
That was Sept. 22, 1981. It was not the first time, or the last, that an engine explosion damaged a jetliner.
In fact, over the past 20 years an average of about 25 engine explosions--or, what the industry calls “uncontained engine failures”--have occurred annually. More than 10% of those incidents caused significant damage to the structure of the aircraft.
But before July 19, when 111 died after an engine explosion crippled United Airlines Flight 232 over Iowa, industry leaders confident of redundant safeguards thought the odds of such a catastrophic failure were as low as 10 billion to 1.
It was hardly a public issue. Rarely had debate over engine containment problems risen beyond the obscure seminars and research papers of aeronautical scholars and engineers.
Even there, however, there were voices of warning. More than 10 years ago, Gordon L. Gunstone of Britain’s Civil Aviation Authority urged industry officials to work on design changes because, he said, jet engine explosions “happen too frequently for comfort.”
Improved Designs Urged
He said that since it is unrealistic to expect engines to operate flawlessly at all times, “the only valid solution” is for manufacturers to improve aircraft designs to make them increasingly invulnerable to crippling damage from what he called “this endemic disease” of engine bursts.
It wasn’t the loss of an engine that worried experts like Gunstone. Jets are designed to fly safely after losing an engine. But engine debris can punch holes in the passenger cabin, rupture fuel tanks and damage various control systems.
And Flight 232, for example, lost all three of its hydraulic lines, rendering useless the plane’s control system of flaps, slats and rudder.
Now, as safety investigators continue to search for the cause of that engine explosion, the industry is preparing for a more sweeping re-evaluation of protective designs.
“It would appear at this time that some action is appropriate,” Dale Warren, a McDonnell Douglas vice president, acknowledged days after the crash. He said engineers were studying various design changes that could include shields for vital systems or better methods for containing engine debris within the cowling.
More recently, Federal Aviation Administration chief James B. Busey formed a government-industry task force to investigate possible design changes. Ironically, the first day the task force met last week, the engine of a Northwest Airlines DC-10 blew up, forcing a safe emergency landing.
All of this design attention comes at an important time in the development of the next generation of jumbo jetliners. The MD-11, a bigger and longer-range version of the DC-10, is being developed at McDonnell Douglas and will be subject to FAA certification evaluation over the next two years.
“There’s no question the work of the task force will impact the certification process,” said FAA spokesman Dave Duff.
Company officials acknowledge that not only will the MD-11 have essentially the same hydraulic system that was wiped out by the engine blast on the United DC-10, but the new jumbo jet is designed to carry 2,000 gallons of jet fuel in the same horizontal stabilizer that was riddled with engine fragments.
“I’d want to look at that very, very closely,” said one aerospace safety expert.
A spokesman for McDonnell Douglas dismissed concern about the aft fuel tank, however, noting that all jumbo jets have fuel tanks in their wings, in close proximity to wing-mounted engines.
Fire Would Be Unlikely
“It’s no more dangerous to have that fuel tank in back than to have it in the wing,” said Don Hanson of McDonnell Douglas. And he said that at cruising altitudes, where the United engine explosion occurred, for example, a fire would be extremely unlikely.
“About all you’d get is a leak if a fragment went through that tank,” Hanson said.
Fire is of greater concern near the ground, however, and statistics compiled by U.S. and British aviation agencies show that nearly 90% of the engine explosions occur when the engines are under maximum stress--during takeoff and climb.
In 1985, a wing-mounted Pratt & Whitney engine on a British-operated Boeing 737 exploded on takeoff from Manchester, England, igniting the fuel tanks and killing more than 50 passengers. And in 1975, an Overseas National Airways DC-10 taking off at Kennedy Airport erupted in flames after a flock of birds was sucked into a wing engine. The engine exploded and dropped from the wing, rupturing fuel lines.
Commercial jet engines are wrapped in protective nacelle cowlings designed to help prevent foreign objects from striking the engine and to contain engine parts if they break off.
The General Electric CF6-6 engine that exploded on Flight 232 is typical of jumbo jet engines. Its perfectly balanced rotor assembly acts like a giant propeller--its 38 blades, each three feet long and weighing about 10 pounds, mounted around a 300-pound titanium disc, spin at 3,800 revolutions per minute. It sucks air into a series of compressor and combustion chambers, where it is burned with jet fuel and the exhaust pours out in the form of 40,000 pounds of thrust. Some of the engine parts are heated to a constant temperature of 1,500 degrees.
If anything goes wrong--from damaging bird strikes to defective materials or improper maintenance--the engine can be thrown out of balance and start to devour itself. Unless the crew gets enough advance warning from vibration or heat indicators, the engine is likely to blow apart.
Most engine failures occur when one or more of the turbine blades breaks. FAA rules require that the engine cowling be strong enough to contain one blade. Much of the engineering debate over the past decade has focused on whether the standard should be raised to a two- or three-blade containment standard.
But blades alone don’t usually pose the greatest threat. Flight 232, for example, lost its entire rotor assembly: several hundred pounds of engine metal.
Experts contend that no aircraft, even an armored fighter plane, could withstand the impact of a hurtling 300-pound jet engine disc without suffering serious structural damage.
“It’s like being hit with a 100-millimeter shell,” said Clyde Kizer, vice president for engineering and maintenance for the Air Transport Assn. in Washington.
‘Built Like a Tank’
Anthony J. Broderick, the FAA’s acting executive director for regulatory standards and compliance, said the plane would have to be built “like a tank” to take that kind of explosive force.
“There is no practical way to build to protect against the enormous release of energy in an uncontrolled fashion,” he said. “This appears to be a unique occurrence--one that every effort is made to prevent, but one that cannot be protected against by design.”
Nonetheless, some fairly radical design concepts have been discussed in the relative privacy of industry seminars over the years.
In 1975, at an international conference in Ankara, Turkey, for example, a team of British engineers proposed a redesigned three-engine jumbo jet in which baggage compartments would replace passenger areas between the wing engines. Passengers in first class would sit well forward of the engines and coach passengers safely aft.
The hypothetical configuration apparently was influenced by an accident two years earlier over New Mexico in which a wing-mounted engine on a National Airlines DC-10 exploded while cruising at 39,000 feet. Shrapnel struck the fuselage, punctured a window and caused a passenger to be hurled to his death when, in the explosive decompression, he was sucked out through the hole.
Deflection Devices
The same conference examined suggestions for strategically located deflection devices or armor in areas of the wings or fuselage most vulnerable to catastrophic impact.
And a 1977 report by a leading U.S. engineering group, the Society of Automotive Engineers, recommended that aircraft makers consider using lightweight, energy-absorbing materials as shields for critical components.
Design engineers say it is technically possible also to build an armored cowling that could contain a massive rotor burst. However, that would require adding about 50% to the weight of each engine, making the plane, at best, impractical to fly.
“We would have an engine of weight and handleability suitable for a power station but not for an aircraft,” wrote an engineering executive for Rolls-Royce in a research paper.
One problem facing engineers is that the causes of engine explosions vary so greatly. Foreign objects, like large birds, can bend or break turbine blades. Improper maintenance has contributed to a number of failures. The most common causes of significant disc failures are fatigue and defective materials, both of which are difficult to detect.
Periodic engine inspections are supposed to spot the earliest signs of stress or fatigue. A crack as small as 1/32 of an inch in any disc is sufficient to require instant replacement.
The GE engines on Flight 232 had a laboratory-tested life expectancy of 54,000 cycles (or takeoffs and landings). The FAA requires that all the GE engines be retired after one-third of that time, however. When it blew up over Iowa, the United engine was nearing its mandatory 18,000-cycle retirement, but its 15,503 cycles were still well short of a maximum life expectancy.
“We need to find out what flaw . . . occurred in Iowa to give rise to a fracture,” said the FAA’s Broderick. “It could have risen at the very beginning of the forging process or anywhere through the manufacturing or installation process or into the maintenance or service or, conceivably, from foreign object damage.
“That’s why it is critical to find those parts,” he said. “If we don’t find the parts, we cannot prove what happened.” GE is offering a total of more than a quarter of million dollars in rewards for engine fragments, ranging from the disc, which is the size of a “large truck tire,” to half-inch bolts.
What investigators already believe happened is that large chunks of hot engine debris blew through both the left and right horizontal stabilizers of Flight 232, knocking out two hydraulic lines on one side and the third backup line on the other. All hydraulic fluid was lost and, with it, virtually all control of the plane.
Room for Improvements
As pressure apparently mounts on aircraft makers to find ways to better protect vital systems on jetliners, many experts still believe there is room to improve engine design, manufacturing methods and maintenance practices to further reduce the incidence of uncontained failures.
Even England’s Gunstone, who said engines can’t be made perfect, scolded the industry for not putting more effort into making engines safer when he told an international conference:
“I think there is in all aircraft engine design a process of ‘brinksmanship.’ That is to say you push the design as far as you dare. Your constraints are economics, thrust, and so on, and you do not, unfortunately, apply all the knowledge which you’ve acquired from previous experience to making an engine or aircraft safer. You use some of it, but the rest goes into making it cheaper. It is a matter of some judgment as to where the proper balance lies.”
MD-11 PLAN FOR FUEL TANK IN TAIL
The MD-11, McDonnell Douglas’ stretched version of the DC-10 now being readied for certification by the FAA, is designed with basically the same hydraulic control system that was disabled by a DC-10 tail engine explosion last month. In addition, the longer range MD-11 incorporates a 2,000-gallon fuel tank under the rear engine. Industry and federal investigators are now re-evaluating designs in order to protect critical components from uncontained engine explosions.
