2. Trends and Statistical Observations

Figure "Classification of safety risks" According to Refs. 2-3 and 2-4, damage and flaws that threaten engine safety can be categorized into three groups with specific characteristics. The diagram shows a typical example of each of these three categories.

Potential Hazard:

• Total, possibly dangerous loss of thrust during flight (in one or more engines, Fig. "Blade fracture")
• Danger of main rotor parts bursting
• Danger of external fires (outside of the engine)
• Damage that causes loads that are far greater than those intended for the design
• Risk of unintended thrust reversal
• Loss of the engine`s regulating capacity (in order to shut down)
• Unacceptable number of affected machines
• Cases with similar consequences

Incident:

• An incident during aircraft operation that makes further normal flight operation impossible, which was caused by the engine, its system, or related components.

Accident:

• Death or injury of persons (whether or not directly involved in flight operation)
• Severe damage to or loss of an aircraft
• Damage to the property of third persons

Figure "Fail safe" In the diagram above, typical examples are given for the terms that describe the safety-relevant behavior of parts.

Example for “failsafety”:
Modern engine compressors, especially in the fan, are designed in such a way that a blade failure will not result in engine damage that could endanger the aircraft. This means primarily that no blade fragments or other engine parts may escape from the engine housing as a result of consequential damages, and also means that any resulting imbalances must be brought under control. The term used to describe this behavior is “containing”, and is usually accomplished by special constructive measures that strengthen the housing. These measures are referred to as the engine`s “containment”.

Example for fail safe (1):
These are typically flaws that are acceptable in a specified area and do not threaten flight safety throughout the predicted time span. This type of flaw includes thermal fatigue cracks in turbine stator vanes if crack progress slows and is therefore safely controllable.

Example for fail safe (2):
Turbine intake stator vanes can also serve as an example in this case. These parts are subject to extremely high temperatures and, if necessary, damage such as delamination of protective coatings, local overheating, and crack initiation can be safely monitored through boroscopic inspections.

Example for fail safe (3):
This includes the behavior of parts that still operate safely at low loads, despite having recognized damage. For example, if an operating error or a regulator malfunction overheats a turbine disk within specific limits given by the manufacturer, it must be replaced, but may not fail catastrophically before replacement.

Example for fail safe (4):
If a turbine shaft fails, the turbine can no longer power the compressor. This can cause the turbine to accelerate to dangerous overspeed in a fraction of a second (runaway rotor). In this case, bursting or unallowable axial offset of the rotor must be avoided. Therefore, various constructive measures are taken to prevent this from occurring. It is important that overspeed RPM are kept within certain limits, which can be achieved with an aerodynamic configuration that does not allow uncontrollable overspeed, along with sufficiently burst-resistant disks and/or deceleration of the rotor through targeted contact with the stator assembly (Fig. "Intermeshing principle").

Figure "Effects of failures" (Refs. 2-10 and 2-16): The JAA has undertaken a failure classification and probability assessment (failures per flight hour) for large cargo aircraft in the JAR 25. 1309. The defining characteristics used for this were the effects of damage or failures on the aircraft and the passengers, as well as the probability of an incident occurring during one flight hour.

Catastrophic:
Failure Conditions which would prevent continued safe flight and landing

Hazardous:
Failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be:

• a large reduction in safety margins or functional capabilities; or
• physical distress or a higher workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or
• serious or fatal injury to a relatively small proportion of the occupants.

Major:
Failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example

• a significant reduction in safety margins or functional capabilities;
• a significant increase in crew workload or in conditions impairing crew efficiency, or
• discomfort to occupants, possibly including injuries.

Minor:
Failure conditions which would not significantly reduce airplane safety and which involve crew actions that are well within their capabilities. Minor failure conditions may include, for example:

• a slight reduction in safety margins or functional capabilities.
• a slight increase in crew workload, such as routine flight plan changes, or
• some inconvenience to occupants.

Probable Failure Conditions:
Those anticipated to occur one or more times during the entire operational life of each airplane.

Improbable Failure Conditions:
Remote:Unlikely to occur to each airplane during its total life but which may occur several times when considering the total operational life of a number of airplanes of the type.
Extremely remote: Unlikely to occur when considering the total operational life of all airplanes of the type, but nevertheless has to be considered as being possible.
Extremely Improbable Failure Conditions:
Those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type.

Figure "Risk assessment procedure"

• High RPM
• High pressure
• High temperatures
• Special operating conditions

The above are all reasons that aircraft turbine engines have a risk potential that must not be neglected. Because these risks must be controlled, any damage or problems should be followed by conducting a repeatable risk assessment, which is the basis for further actions and their urgency.
The following are prerequisites for controlling risks:

• Recognizing problems
• Recognizing potential consequences
• Estimating frequency of damage
• Risk classification
• Measures for preventing damage

Problems are identified on basis of available experience. This involves all parts being entered into one document (e.g. “hazard analysis report) with regard to their possible failures, failure frequency, and consequences of these failures. Theoretical considerations as to the critical effects of damages and/or problems can enhance experience and are able to establish relevance to the specific engine type involved. Damages are usually categorized (CAT) according to the risk they present for operation and the aircraft. Typical damages in CAT 1, the highest danger category, include:

• High-energy occurrences that act outside of the engine. These include:
  • Fragments (e.g. of disks)
  • Darting flames (e.g. flames from the combustion chamber or titanium fires)
  • Explosions (e.g. dust explosions)

• Escaping or external fires such as:
  
  • Fuel fires
  • Oil fires
  • Titanium fires
• Contamination of the cabin air, i.e. the crew's oxygen supply
• Failure of the engine suspension
  
• High asymmetric thrust (e.g. due to problems with the thrust reverser)
• Thrust loss during critical flight maneuvers (e.g. rotation during start)

The frequency of damage in a classification (see also Figure "Effects of failures" re. JAR-25 for a typical passenger aircraft fleet) can be considerably different, depending on the size of the affected fleet, typical operating times, inspection intervals, etc. The frequency must be determined together with the responsible centers. The following can be helpful in this endeavor:

• Design and calculation
• Experience with other engine types
• Statistics
• Consideration of burn-in and wear-out effects (see Fig. "Increased risk following overhaul").

Possible further development of damages must be considered along with the relevant regulations for inspections and monitoring.
In a concrete case of damage, the Hazard Indices (HI) are determined as specific numbers as in table 1 (example). This phase, in which the damage modi are assigned to the indices, is especially dependent on experience and is usually beyond purely mathematical calculations.
If the risk assessment has been completed by assigning the hazard indices determined in table 1 to table 2, it will directly indicate the actions to be taken. The dark grey fields in table 2 indicate unacceptable risks. Light grey fields permit monitoring of the problem until it is permanently solved. This classification also determines the prescribed notification of the responsible authorities and operators.
The classification “isolated case” means that the failure rate is “improbable”, and no further measures must be taken. This classification only applies when all causes, relationships, and processes are completely and clearly understood. Unfortunately, most cases that are classified as being “isolated” are quite the opposite.
This type of risk assessment must be undertaken for every thinkable relevant failure mode. For example, if a type of damage can result in both shaft failure with oil fires as well as an uncontainable blade “haircut”, then both of these possibilities must be treated seperately in a risk assessment with a hazard indice calculation.
Determining hazard categories requires a great deal of experience and necessitates subjective estimations. This is a very delicate procedure in which safety is of foremost importance, but large economic risks and loss of prestige must also be considered.
Implementing corrective measures requires the following major steps:

• Determining and evaluating the causes based on a damage analysis (Fig. "Damage analysis").
• Eliminating the type of damage (e.g. through constructive changes)
• Reducing damage frequency (e.g. through inspections at certain intervals)
• Minimizing consequential damages (e.g. by installing a fire extinguishing system)

Figure "Hazard ratio" (Ref. 2-22): This picture shows the analysis of concrete, occurred incidents. Also the risk classification by the JAA (Fig. "Effects of failures") in minor, major, hazardous and catastrophic takes place corespondent actual incidents.

Instead in the following Hazard Levels are defined, rising from 0-5 for actual occurred incidents. They describe consequences for the aircraft, passengers and crew. The frequency to be expected is included in the Hazard Ratio. It indicates the likelihood of an incident in a certain Hazard Level.
The classification into so called Hazard Categories = CAT (Fig. "Risk assessment procedure"), from I - IV is carried out in the inverse sequence. Those are assigned the terms negligible, marginal, critical and catastrophic.
Hazard Level and Ratio can be helpful for an evaluation of the Hazard Categories “catastrophic (I)” and “critical (II)” for risk assessments correspondent the Hazard Index (Fig. "Risk assessment procedure").

The Hazard Levels are defined as following and assigned examples.

Level “0”, without consequence on the safety. It may correspond CAT-IV:

• In-flight shutdown (= IFSD) of only a single aeroengine during flight above 1000 meters above ground without consequences above the thrust loss.
  
• Failure contained inside the engine nacelle, only penetrating the aeroengine casing (uncontained).
• Smoke, vapors without impairment of the passengers as result of failures or malfunctions. To this belongs, that such an incident is covered by the design and the specifications in a manner, that no unsafe situations occur (Ill. 19.2-10 and Ill. 22.3.1-7).
  

Level “1”, Minor Consequences may be assigned to CAT III up to IV. They influence the safety not significantly (Fig. "Effects of failures").

• Escaping of fragments also from the aeroengine nacelle (uncontained nacelle damage) which is limited to to this respectively the region of the APU.
• Unintended power change up to an IFSD at a speed above „V1” (Fig. "Issues during takeoff I") and below1000 meters rest length of the runway.
• Temporary restricted, limited, sufficient durable (for the flight) corrigible malfunction of several aeroengines respectively systems. To this belongs extreme rain (Fig. "Impact on engine"), ice (Fig. "Internal ice formation") or volcano ash (Fig. "Volcanic ash").
• Heavy vibrations by unbalances above the approved/verified limits (Ill. 25.2.1-8, Ill. 25.2.1-9.1 and Ill. 25.2.1-9.2).
  

Level “2”, Significant Consequences can be assigned to CAT II up to III. To these belong

• Notches and indentations (nicks, dents) as well as small penetrations of a primary aircraft structure.
• Controlled fires in the region of a fire-extinguishing installation. A further criterion is, if the fire can further flash over to the airplane.
  
• Alarming (i.e. endangering the airplane) exit of a flammable liquid.
• Minor (Fig. "Effects of failures") malfunctions of an aeroengine or the APU more than 300 meters above ground. The aeroengine can stay shut down, without forcing a course diversion.
• Every start above a speed of 100 knots (185 km/h, high-speed takeoff).
• Separation of parts from the aeroengine region during flight. To this belong flaps of the thrust reverser and parts of the intake.
• Partial deploying of the thrust reverser during flight.
• Minor impairment of the crew and/or the passengers by smoke or toxic vapors which can lead to malfunctions or failures (Ill. 19.2-9).
  

Level “3”, Serious Consequences with a substantial damage of the airplane. To this belongs the primary structure, Function/ performance and flight qualities/properties. Replacement or repair are necessary. This level does not include damages of the aeroengine and its mounting.

• Damage of a second system which affects the safety of flight and landing.
• Puncture of fuel lines and -tanks with an overall size more than 6,25 cm².
• Damage of a second aeroengine, so that it loses noticeably thrust or forces the pilot to a thrust reduction.
• Uncontrollable fires which act at wings and fuselage or ignite there.
• Fast pressure drop in the cabin.
• Lasting thrust loss at more than one aeroengine.
• Inability to keep a hight of at least 300 meters above ground. Temporary outage of all aeroengines below 3300 meterns above ground.
• Every short time or lasting impairment, caused by an aeroengine. Typical causes are malfunctions of the thrust reverser or extreme vibrations.
• Smoke or vapours which affect the cockpit severe. To these (Ill. 22.3.1-7) are counted the clearness of display of the instruments.

Level “4”, Severe Consequences are forced landings, mostly in the terrain. Though the controllability may be limited present, but does no more allow the return to an alternate aerodrome.

• Loss of the airplane with persons on board.
• Heavy injuries and fatalities.

Level “5”, Catastrophic Consequences mean several fatalities with the loss of the aircraft (Fig. "Hazard ratio")

Figure "Level of safety" The values in the diagram were taken from Ref. 2-5. The top diagram shows the average probability of a fatality within the time span of an hour, depending on their age. This establishes the personal relationship that makes possible an estimation of individual cases. This also makes professionals more aware of the risk that they are influencing with technical decisions such as whether to allow further operation of aircraft with possible safety problems. The probability of a 50 year-old dying in a specific hour is roughly one in one million. Therefore, of one million 50 year-olds, one will probably die in this specific hour. This risk is roughly the same as the risk of dying in an aircraft accident in 1980. We can assume that this risk has decreased even further (Fig. "Damage statistics"). A long-term goal is to decrease this number by a factor of ten. However, the diagram indicates that this can only be achieved by a quantum leap in aircraft safety.
The bottom diagram compares the risks of different transport systems. As would be expected, road traffic fares poorly relative to the distance covered, and rail travel has an excellent record comparable to air travel. However, the time spent in a mode of transport can be relevant for the subjective feeling of safety, even if this way of viewing is admittedly problematic. From this standpoint, assuming that aircraft are ten times as fast as cars and trains, the risks of air travel are the highest, the risk in road traffic is only half as high, and that of rail travel is almost an order of magnitude lower.

Figure "Probability" (Ref. 2-18) shows the likelihood compared with lottery prizes of the drop-out of one from 100 possible aircraft components which can trigger an flight accident. Typical would be the fracture of a rotor disk. Its likelihood must be below 10^-9 (Fig. "Risk assessment procedure") to guarantee the likelihood of an airplane accident below 10^-7.

Figure "Chronological view" Every period in the development of turbine engine technology was plagued by specific problems. Typical examples include:
Early problems with gas vibrations in afterburners (Ref. 2-17) and contaminated fuel. The materials used for housings and rotors were usually steels that were not sufficiently resistant to corrosion. The housings of early generations of engines were welded designs made from many sheet metal parts, forged parts, and some cast parts. These were followed by housings made from large, milled forged sections. Today, engine housings are made largely from integral cast sections. All of these design principles have different specific weak points. The welded sheet-metal designs, for example, were susceptible to fatigue caused by aerodynamically-induced labyrinth vibrations. The desire to improve the life span and weight of these housings at ever-increasing degrees of efficiency (reduced fuel consumption) necessitated the introduction of new technologies. These had to make possible higher pressure gradients and total pressure ratios with correspondingly high compression temperatures in the compressors, as well as increases in the hot gas temperatures. This resulted in a tendency of increasing temperature levels of the engine components. In modern engines, hot gas temperatures in the front compressor are above the melting points of super alloys. However, complex cooling systems ensure sufficiently low component temperatures. The large temperature gradients that necessarily occur due to the cooling process led to corresponding high thermal fatigue stress. Thermal barriers were necessary to reduce the amount of cooling air and increase the life span of engine components. These new technologies also have specific problems such as coating delamination and erosion. The increasing component temperatures also led to an increase in problems such as oil fires in bearings. The high compressor pressures and compression temperatures also promote the ignition of titanium fires.

Figure "Early detection" An important factor in improving engine safety is early damage detection. This is usually accomplished through use of multiple monitoring technologies (Ref. 2-6). The diagram depicts the experiences of an operator in the 1970`s, when a shift was being made to fan engines with large bypass ratios (top of diagram). Since then, safety monitoring has continually improved. For example, data from flight operation is transmitted online to centers for processing. Today, due to the optimization of the technical requirements for this type of monitoring, e.g. through improvement boroscope capabilities, a large number of damages are discovered in time.
The percentage of operating data that are based on monitoring sensors has also increased (Figs. "Diagnosis" and "Monitoring and control"). These include vibrations and observation of engine efficiency/fuel consumption (overtemperatures, pressure, RPM).
It must also be remembered, however, that the sensor systems are relatively sensitive and fairly often cause engine shut-downs themselves (Fig. "Inflight shutdown rate").

Figure "Inflight shutdown rate" The number of inflight shut-downs per hour of flight (inflight shutdown rate), which is a measure of engine safety, has continually decreased throughout the years. Understandably, this decrease occurred in a steadily flattening curve. This shows, that improvements to an already high degree of engine safety became ever more difficult. It also indicates that the effort required for further safety improvements will increase exponentially. Most shut-downs occur due to failure of the monitoring sensors (Example "Faulty connectors") and maintenance errors (Refs. 2-7, 2-8, and 2-9). This shows the difficulty of decreasing the number of accidental shut-downs by increasing the number of sensors. Engine-conditional inflight shut-downs are engine shut-downs that occur due to engine failure. They only constitute a very small fraction of all engine shut-downs. However, further effort is still necessary in order to lower the absolute number of damages so far, that today`s levels are at least maintained. This is seen as being necessary in order to avoid the business-damaging psychological effect of frequent reports of engine shut-downs.

Figure "Damage statistics" The top diagram (see Ref. 2-10) shows that the number of fatal accidents has remained constant despite the large increase in air traffic. The number of damages with escaping fragments (uncontained failures) has reached a relatively low level. A clear maximum can be recognized around 1970, which was caused by the introduction of the first generation of large fan engines, which took many years to reach the current levels of technological maturity.
The lower diagram shows how rapidly designers learned from their experiences. Later generations of engines had considerably lower shut-down rates. This improvement is even more pronounced with longer operating times.

Figure "Engine-related accidents and incidents" This diagram is based on values given in Refs. 2-11 and 2-12. “Maturing” of engine technology lowers the number of engine failures, even if it does not do so in the desired magnitude.

Escaping disk and spacer ring fragments:
The main cause of these damages is most likely fatigue, which sets in after long operating times. This effect on life span is promoted by the design philosophy that constructs rotor components with a limited operating life/load cycles (start-up/shut-down cycles). Under the high intended loads, unforeseen operation-conditional changes or special material weaknesses can lead to crack initiation and expansion.

Malfunction of the engine and improper reactions by the crew:
These damages should be seen in connection with problems with the indicators of the sensor systems. These indicators may have malfunctioned (Example "Faulty connectors"), been misinterpreted, or the action taken by
the crew may have been the wrong one (Example "Engine shutdown mistake I" and Example "Engine shutdown mistake II" ).
These problems can occur after a compressor stall or regulator malfunction, for example.

Environmental conditions:
These act upon engines primarily as foreign object damage caused by fragments, particles, ice, or birds being sucked into the engine (also see Chapter 5).

Uncontained rotor blades:
A noteworthy factor is proportion of uncontained rotor blade fragments, even though observation of available acceptance standards and verifications is intended to prevent exactly this type of damage. One explanation may be that constructive measures and verifications were not possible for older engines, or that factors were involved that had not been foreseen when the engine type was accepted. In the past few years, great efforts have been made to guarantee safe containment of fan blades.

Thrust reversers:
In this case, the thrust reverser is considered part of the engine. This is not self-evident. The greatest problems occur, when the thrust reverser opens during flight (Ref. 2-12). This poses an immediate risk of the aircraft crashing. Even not opening thrust reversers can be dangerous, if they unacceptably increase braking distance or steer two-engine aircraft off of the runway.

Fires:
Fires can ignite and sustain burning in the outer engine in various ways. The engine nacelles are equipped with sensors that detect fires and extinguishing systems that ensure a high level of safety.

Fuel (lack, mismanagement):
Fuel shortages in flight were a problem especially in the 1950s and 60s due to contamination (icing) and less advanced fuel management systems. This problem is evidently still relevant today.

Housing failure:
Housings of the engine core are highly stressed pressure cookers that are subject to fatigue and can fail due to crack initiation. Failure of internal components such as the combustion chamber can lead to weakening and cracking of the housing wall followed by the escape of combustion chamber fragments.

Separation of the engine nacelle:
Engine nacelles are also not necessarily considered a part of the engine. The nacelle and its equipment are not usually delivered by the engine manufacturer.
In certain aircraft types, the engine can separate due to dangerously high vibrations (Ref. 2-16).
There are two primary causes for unintended separation of the nacelle (Ref. 2-14, Example "Engine separation"), and they can complement one another: damage to the fastening bolts or grommets during operation (e.g. due to corrosion or fretting) or improper handling during engine mounting and maintenance. A fatigue crack then progresses into the bolt from this damage (Chapter 4.5). Another known cause for failure of engine suspensions is extreme overstress in flight, such as that caused by turbulence in rare cases (Fig. "Heavy turbulence").

Figure "Rotor damages" The data at left were taken from FAA values given in Ref. 2-9. Unfortunately, they are already somewhat aged. However, they still have relevancy with regard to the trends they show.
Rotor damage is always especially interesting, since it is usually in connection with uncontained high-energy fragments with correspondingly extensive damage to the aircraft and immediate danger to the passengers.
At first glance, it is confusing that, in a large portion of the incidents, the cause is listed as “unknown”. When considering the fact that targeted and sufficiently successful preventive measures necessitate an understanding of the damage causes, this is especially alarming. Experience has shown that a lack of effective remedies will usually result in more incidents of the same type occurring.
It is also surprising that the number of life span-conditional damages is relatively small. The question must be asked, whether some of the cases with unknown causes are related to the life span of the failed parts.
In order to promote further understanding, it must be mentioned that a number of the damages in the reference works occurred during start-up and take-off. This number is roughly the same as that of uncontained rotor blade failures, disk damage, and ring damage. In the vast majority of cases, this damage was in the fan or compressor and involved the blading. The turbine was rarely affected.
It must be asked, whether the continually increasing gas temperatures in new engine types have changed the focal point of damage over time.
A positive note is the small number of rotor damages that can be traced back to problems with quality control. However, the critical question which must be asked is how far contributing factors such as limits of the applied testing procedures or problems with the evaluation of weak points were considered and/or recognized.
With regard to flight situations, a surprisingly large number of damages occur during cruising flight, despite the fact that start-up and take-off presents the greatest amount of disk stress, when thermal strain combines with centrifugally-induced stress in highly-stressed engine areas and the high engine output is accompanied by correspondingly high gas and blade tempera tures.

Figure "Risk analysis" (Ref. 2-20) This picture shows the two typical approaches of risk analysis in the aeroengine technique by means of examples:

With help of the weibull analysis (upper frame):

This method is used, when for a high number (in the 10³ range) safety relevant parts during operation the first failures occur. Thereby the approach is analogous the following steps:
1. Identification of the failure relevant operation time, respectively cycles of every aeroengine respectively the triggering component of the concerned fleet at the time of failure (diagram above left).
2. Calculation of the failure probability and registration in a weibull diagram above the operation time respectively cycles.
3. Determination of the weibull parameter “m” (gradient of the weibull line) and of the characteristic lifetime “L_c“ (diagram above right) befor a failing of 63,2 % of the parts is to be expected. “m” can assigned the phases of the bath tub curve (Fig. "Increased risk following overhaul"). Is m < 1 the failure likelihood drops with the lifetime, we speak about „Infant mortality”. m = 1 means a constant failure rate (conditioned by chance = “random”), m>1 shows an increase of the outages, usually by aging and wear (“wearout”). The smaller “m” the bigger the scatter. This permits hints at the failure mechanism (e.g., HCF or LCF, Fig. "Statistics").

With the parameters “m” and „L_c” the expected number of failing parts can be estimated for a certain operation time respectively calendar time, if the operation profile is known (in the upper frame, diagram below right, see examples in Ref. 2-20). To this belongs the knowledge of the following influences:

• operation/running time above the calendar time
  
• Scheduled/planned overhauls at which the triggering failure is identified in time.
• All remedies it the time to be considered.
• Eventual exchange of a failed part or repair. During fitting of a repaired part its reliability must be considered.

With help of the „Monte Carlo Simulation”:

Concerned is a simple, fast and powerful computer-aided process. „Modellized “ is the cooperation of several random/stochastic influences (scheme lower frame left). For this a computer model of the failing mode is established and ots influence at the component lifetime evaluated. The application of this process can be applied to the most different scenarios of the aeroengine engineering like production, deviations, test planning, aging and repair. Thereby the prediction quality rises with the number of the considered random influences.
The lower frame shows an example which serves the forecast of the spare parts supply. A purchase in time of the supply of spare parts guarantees an acceptable operability, preventing high additional costs
For the computer model of this Mote Carlo Simulation the following random/accidental influences have been used:
“1”: The present distribution of the operation time at the aeroengines.
“2”: The for a period of one year summarized monthly operation times of all parts.
“3”: The for one year summarized future monthly production of the aeroengines.
“4”: Planned inspections and its intervals.
“5”: Premature selection of the parts/components over the time.
This method can also be used at the behaviour of the aeroengines. So risks respectively safety aspects of flight missions get accessible. Useful examples are shown in Ref. 2-20.

Now the Monte Carlo Simulation can consider every part/component. Thereby inspection periods to be planned and unpredicted and overhauls can be forecast.

Figure "Issues during takeoff I" and Figure "Issues during takeoff II" (Ref. 2-21): During a normal start (Fig. "Issues during takeoff II", sketch above) the “rotation” is initiated by the pilot, this means the front landing gear the lift off at a speed of VR. It then reaches at least 35 ft (ca. 12 m) hight above the end of the runway during the minimum V2. V1 (see later), VR and V2 are depending from the airplane type.
A drop out of an aeroengine demands from the crew very short-term decisions if the start should be continued or aborted. Thereby especially aggravating affects the usually increased attention of the crew the start process and not the aeroengines. Differently the layman could suppose at the first glance, necessary actions don't comply with markings at the runway, but depend from the speed of the airplane. Thereby an important role plays the speed V1 (“Take Off Decision Speed”), a so called “Action Speed”. This speed is misleadingly also termed “Decision Speed” or “Engine Failure Speed”. Before 1978 it was called “Critical Engine Failure Speed”. These terms suggest, that not before the reaching of V1 action is needed. However “V1” is the maximum speed till the pilot must begin to introduce the start abort (sketch in the middle). So this period of time before V1 is the definition and of special importance for the start abort (Fig. "Issues during takeoff II", lowest sketch).
The NTSB initiated 1990 by way of the FAA the following definition of V1:
“1. In respect of the NO GO criteria: V1 means the maximum speed in the takeoff at which the pilot must take the first action (e.g. apply brakes, reduce thrust, deploy speed brakes) to stop the airplane within the remaining field length under the conditions and procedures defined in the JAR/FAR.
2. In respect of the GO criteria: V1 also means the maximum speed in the take off, following a failureof the critical engine at VEF, at which the Pilot can continue the takeoff to achieve a screen hight of 35 ft at the end of the runway.
VEF (“Engine Failure Speed”) is the flight speed at drop-out of the “critical” aeroengine (middle and lower sketch in Figure "Issues during takeoff II"). This speed is also known as “Engine Failure Recognition Speed”.
So the necessary procedures must occur between EF and V1.

It must be considered, that from experience the identification of an aeroengine drop-out needs at lest one second (see middle and lower sketch in Fig. "Issues during takeoff II"). Thereby it is supposed, that the flight speed of the airliner increases 3 knots.
As “critical aeroengine” applies the aeroengine, whose drop-out affects the aircraft performance most.
Rolls during a failed rejected takeoff the airplane beyond the runway (“Overrun” , sketch below) a dangerous condition is reached.
In the time period between 1959 and 1991, 81 500 of 245 000 000 starts had to be aborted. Thereby 74 accidents occurred as the airplane moved beyond the runway (“Overrun Accidents”).
The experience shows, that already a seemingly minor exceeding of V1 by about few knots can lead to the destruction of the airplane. A “Rejected Takeoff” (= RTO) can have different causes. The most frequent cause is the drop-out of an aeroengine (diagram above). Thereby it is not clear if e.g., a bird strike caused the failing of an aeroengine but was counted separate. Aeroengine drop-outs during start caused by bird impact are well known (Example "Twin engine failure" and Fig. "Multi bird impact", Fig. "Flocks of small birds").