Figure "Damage system" This diagram is taken from Ref. 4.5-1, and is based on a descriptive analogy from the FAA used to explain how an aircraft accident occurred.
Every independently rotating disk represents one step (in this case a component) of the damage process. The holes are typical failure mechanisms of these components. Catastrophic damage to the engine only occurs if holes in each disk are aligned in a straight line. Complex processes can have more than 20 such steps (disks). If even one disk does not have an aligning hole, then catastrophic damage will not occur, since a link in the causal chain will have been broken. The objective is to keep the number of holes in the disks as low as possible.

Figure "Stop causes" Even in aircraft with multiple engines, the standstill of an engine in flight is treated as a serious occurrence and is classified as an “incident” (see Chapter 2). This also includes shutting down an engine because of an actual or assumed malfunction. Consciously shutting down an engine is referred to as an “inflight shutdown”.
Understandably, engines of single-engine aircraft, usually military aircraft, require considerably lower failure rates than, for example, engines of the same type in twin-engine aircraft (also see Fig. "Operating experience").
In order for an aircraft design to be certified, its safe operation must be verified with occupancy and maximum fuel supply even during the start phase. Engine failure is especially important in twin-engine commercial aircraft that have to cover longer distances over water. These are covered by what are called ETOPS regulations (Chapter 3), which allow the maximum flight times with a single engine. These times must be achieved through extensive verifications during testing and/or flight operation.
This diagram shows typical causes of engine stoppage during flight. These are certainly not all damage to the engine itself. For example, fuel starvation and accidental engine shutdown must also be included in these considerations. The following text briefly covers the typical causes for engine stoppage during flight.

Fuel starvation:
Fuel starvation can be caused by fuel system failure (e.g. malfunctioning pumps or valves) or improper fuel management (Figure "Double engine failure"). According to Ref. 4.5-2, roughly 10% of all incidents concerning flight safety can be traced back to inadequate fuel management due to improper actions. If the incident is not due to failure of the fuel system or the fuel supply to one engine, but rather a complete lack of fuel or problems with the nacelle-side fuel supply (see example 5.4-7), then all engines are affected. This is an emergency situation that can result in a crash in extreme cases (Example "Engine shutdown mistake II" and Example "Engine separation").

Fuel system failure:
Aside from the tanks, fuel systems consist mainly of pipes, pumps, regulators, filters, and the injection systems in the engines. In some cases there is a redundancy that compensates for malfunctions of a component. On the other hand, there are also cases in which there is only one fuel pump (see examples in Chapter 3 and Example "Torque sensor casing") or other vital component. However, if the entire system is affected by freezing of (unsuitable) fuel, for example, the redundancies will no longer be effective.

Extinguishing of the combustion chamber: (see Chapters 5.1.1, 5.1.2, 5.1.4). Experience has shown that extreme rain and hail combined with low engine RPM (landing approach) can extinguish engines.

Engine damage:
Stoppage or shutdown of a single engine can usually be traced back to a malfunction or damage.

Inflight shutdown:
The pilot can shut down the affected engine after malfunctions or damage. It is a fairly common occurrence that engines are shut down due to malfunctioning indicator instruments or sensors.
Experience has shown that in emergency situations, such as after serious engine damage or due to malfunctioning indicator instruments, the wrong engine, i.e. the still functioning engine, can inadvertently be shut down (Example "Engine shutdown mistake I" and Example "Engine shutdown mistake II").

Figure "Causes for shaft separation" Separated shafts are a serious occurrence that must be considered as early as the design and construction stages, in order to ensure that no unallowable consequential damages can occur and threaten the entire aircraft (see Fig. "Detached fan rotors"). Shaft failures are rare, but when they do occur, then they are usually consequential damage after the failure of a rotor system component or directly neighboring part groups such as bearing casings or labyrinth seals. Typical causes of separated shafts include (not in any specific order):

Softening of the shaft due to a fire:
Shaft overheating can be caused by several different factors. In multiple-shaft systems, oil fires can occur and stabilize between the shafts. They heat up the outer lying shaft from the inside. Depending on the intensity of the fire, dangerous engine part temperatures can be reached in minutes.
Oil fires in the bearing chambers can overheat the shaft or the flange from the outside (see Example "Power-turbine retention system" and Example "Damage to the fan shaft").
It is also possible that overheating can occur after combustion chamber damage, if hot gases penetrate the heat protection and come into contact with the shafts.

Main bearing damage:
Main bearing damage can cause extreme temperatures (up to the melting point of the steels in the engine) in a very short time (seconds). In engines with multiple hollow shafts, this can also overheat the inner shafts (Example "Power-turbine retention system" and Example "Damage to the fan shaft"). Because the main bearing determines the axial position of the shaft system, main bearing failure always results in shaft offset.

Labyrinth damage:
Labyrinth failure can directly or indirectly cause shaft failure. A labyrinth carrier can cut or burn through the shaft cross-section after extreme rubbing (e.g. after failure of the opposite stator assembly) or due to bearing failure.
If the labyrinth seal failure occurs as a typical self-increasing process resulting from material buildup and expansion of the rotating part, then high temperatures and intense spark development can burn through hollow shafts and disk lugs located concentrically inside or outside.

Disk bursting:
Since disks are usually an integral part of the shaft system, burst disks usually cause the shaft to separate. Also, disks can also burst due to uncontrolled overspeed following a shaft failure.

Shaft separation due to operating loads without overtemperatures:
Shafts can be made to separate by various operating damages, even if this occurrence is very rare:

• Fractures due to dynamic fatigue (torsion, circumferential flexure) at normal operating loads, originating in material weak points.
• Cracks initiate in operation-induced notches such as corrosion pittings, located in constructive weak points such as jumps in stiffness.
• Overstress due to unusually high dynamic loads (e.g. caused by unbalance).
• Friction can wear splining (fretting) down until the connection can no longer grip.
• Wear around seating and centering surfaces, causes loosening bearing seats to be ground through.

Grinding spacers:
If the shaft itself serves as a rub-tolerant surface (e.g. opposite shroudless blade tips of a compressor stator) for a spacer ring, then unusually heavy contact (e.g. during a premature restart of an engine with rotor bow) can result in overheating and/or the shaft being ground through.

Rotor bolts:
If the threaded rotor connection fails, possible consequential damages include loose flying fragments such as bolt heads or nuts that were knocked off (Example "Forgotten tool").
There may also be unusual operating damages, such as embrittlement due to inward diffusion of metals (e.g. silver, cadmium) or corrosion (e.g. sulfidation, crack corrosion). Failure of threaded connections usually occurs as a type of “unbuttoning” process. This makes it possible to detect the damage when unbalance begins to set in, before shaft separation occurs.

Figure "Consequences of shaft separation" Separation of a main shaft is always an extremely dangerous situation and has very different damage sequences, depending on the construction.
Main shafts usually connect the compressor with the power turbine. In triple-shaft engines, they are referred to as the high-, middle-, and low-pressure shafts. The low-pressure shaft is also referred to as the “fan shaft”. In two-shaft engines, the fan is located on the same shaft as the booster. In triple-shaft engines, the turbine only powers the fan. If a shaft fails, the entire power of the turbine can contribute to an RPM increase. This can directly lead to the turbine rotor bursting due to overspeed.
The location of the fixed bearing relative to the shaft fracture determines which components can become axially offset, e.g. the fan, compressor, or turbine. Usually, the pressure ratios around the disks are designed so that the axial forces of the turbine (rearwards) and the compressor (forwards) largely cancel each other out across the shaft and only relatively small axial forces affect the fixed bearing. If the shaft separates, these forces are released and deflect the section of the shaft that is no longer held by the fixed bearing.
Naturally, the section of the shaft held by the fixed bearing can temporarily experience correspondingly large axial forces.
The consequential damages to a runaway low-pressure turbine are partially dependent on whether or not the fixed bearing prevents axial offset. If the shaft breaks behind the fixed bearing, then the rotor will also rub against static parts axially , especially against the turbine stators. This can be useful if it brakes the rotor before it bursts. However, the rubbing can also damage (overheating, sectional weakening) other rotor components (e.g. the disks) so that even moderate overspeed result in fragments breaking off. Therefore, in some engine types the rotor is designed specifically so that the braking process occurs through the blading (Fig. "Intermeshing principle").
Shaft failure can result in excessive oil leakage from the damaged bearing seals. This oil can ignite and the resulting oil fire can further endanger the aircraft.

Figure "Detached fan rotors" (Ref. 4.5-8) Damage caused by main bearing failure and the resulting shaft separation. The rotation energy stored in the released fan section caused it to climb up the intake duct.

Excerpt: “… The latest incident occurred….when (the aircraft) was climbing…At 15 000 feet the six-foot diameter fan of the center engine detached from the shaft, and spun up the S-band centre intake. Fragments punctured the rear pressure bulkhead of the aircraft and parts of the titanium fan penetrated one of the aircrafts toilets.
…(before) suffered a similar failure… In addition to actual failures of the fan module where the blades and disc actually broke away, the…early versions of the engine have suffered failures of the low-pressure location bearing which is just behind the fan” (Fig. "Shaft failure caused by bearing damage").

Remedies (also see Example "Damage to the fan shaft"):

• Improvement of the vibration monitoring system
• Securing the affected bearing`s oil supply
• Constructive changes to ensure that bearing damage does not cause the fan to separate from the shaft system.

Figure "Shaft failure caused by bearing damage" This diagram is a detailed view of the damaged area of an engine.
The damage process is complicated (Ref. 4.5-8). Evidently, the first step was the failure of the oil supply in the front main bearing of the fan shaft. This caused the bearing to overheat and ignited an oil fire which softened the shaft (see description of Fig. "Consequences of shaft separation"). The result was shaft separation with a load drop in the low-pressure turbine, which reached overspeed and burst, creating uncontained fragments.

Figure "Possible consequences of bearing damage" Example for a complicated damage sequence with uncontained fragments caused by a runaway shaft system (see Example "Worn out ball bearing")

Figure "Overspeed prevention" There are several strategies for preventing runaway turbines after shaft failures. This diagram shows a mechanical variation which makes use of the axial offset that follows shaft separation. Naturally, this assumes that the shaft failure occurs behind the fixed bearing. During offset, the shaft moves a bolt (B) rearward, which actuates the fuel control unit by means of a linkage assembly.
One problem with this design is the possibility that lubricating oil could get into the clearance gap of the bolt, which juts into the bearing chamber. If the oil cokes up, it could block the bolt.
For this reason, and also to make use of the faster responses of modern electronic control units, attempts are made to use the axial movement of the shaft in this case, as well. One possibility would be to have the shaft movement split a conductor with through-flow.

Figure "Intermeshing principle" If a rotor is braked by rubbing against a closed ring surface, then a lubricating pool crater may form and diminish the braking effect. This can be prevented if the surface provides non-continuous contact, such as that between blade rows (intermesh-construction).
One example is breaking the low-pressure turbine rotor after a shaft failure. The axial offset causes the outer rotor blades to rub against a specially designed stator vane stage. The contact forces and the decrease in power output due to the damaged blading must be sufficient to prevent the rotor from reaching uncontrollable overspeed. To ensure this, the blades must absorb sufficient energy and must not fail, e.g. through a rapid haircut. The braking effect is increased by the damage to the blades, which decreases the drive torque. Additionally, the circumferential stress on the blade decreases, lowering the risk of a the disk bursting. The blade design and material selection are very important for minimizing brittle fractures and ensuring sufficient braking energy. The above factors must also be considered when implementing single-crystal and directional-hardened materials.

Figure "Housing deformations" (Ref. 4.5-11) The number of fragments resulting from a blade failure leaves typical deformations and holes in housings/casings. The above diagrams are from burst tests in spin test rigs. The most common scenario is depicted in the top diagram. It is a symmetrical disk split due to a hub fracture. The movement of disk fragments has different translatory and rotatory components, depending on the fragment type. These determine the damage symptoms of the housing. In some cases, this makes it possible to make conclusions about the fragment size and shape based on the damage symptoms (see Fig. "Damage symptoms of the housing").

Figure "Damage symptoms of the housing" (Refs. 4.5-12 and 4.5-13) The top diagram shows the typical fragments of a failed integral turbine disk of the type used in smaller low-power engines. The cracks labeled “1” are the primary cracks that led to the hub bursting. Cracks “2” are consequential damage caused by the fragments striking the housing. The typical damage symptoms of this type of turbine housing are shown in the bottom left diagram. The symmetrical nature of the damage should be noted. The symptoms of fan damage in the engine of a passenger aircraft are similar, leading to the conclusion that this case was disk failure in which the disk broke into two roughly equal parts.

Figure "Predetermined breaking point" Predetermined breaking points are used in cases where damage limitation is the goal (Ref. 4.5-14). They must break at a certain defined load limit. Broken predetermined breaking points are therefore always an important indicator of high load levels, i.e. that the defined load levels were exceeded due to a malfunction or damage. Naturally, it must be shown that overstress due to the designated loads is plausible (e.g. shaft overstress due to overly high torsion; suspension bolt failure due to shear stress) and is not the result of the crash or other factors that are separate from the intended function of the predetermined breaking point.
Predetermined breaking points are found in different parts of the engine. Engineers are considering whether or not to use predetermined breaking points in large fan engines so that the fan could be separated from the engine by explosive bolts in case of fan blade damage followed by unbalance and vibrations (e.g. similar to rocket technology, Example "Fan decoupler").
There have also been discussions about predetermined breaking points on engine suspensions, which would allow controlled jettisoning of the engine in case of overstress. Predetermined breaking points are also used in the power systems of auxiliary components (e.g. pumps, starters, generators, regulators). When these devices are blocked, their connection is severed at a predetermined point in order to protect other functions and/or to prevent uncontrollable consequential damages. When fuel-carrying components are blocked (e.g. due to broken gear teeth, bearing damage, or DOD such as oil nozzle fractures), there is a risk of seals and housings being damaged so that fuel could leak out uncontrollably. The escaping fuel can cause fires. If the starter is blocked or the engine is sluggish during start-up, predetermined breaking points can prevent greater damages. Predetermined breaking points are always a challenge for the designer. While they must be able transfer all normal operating loads with sufficient safety, they must also guarantee separation at the break point at a certain defined overstress level. The operating loads are dynamic and act over long operating times. Therefore, the predetermined breaking point must have a high dynamic strength. This demand can be met through sufficient fatigue resistance of the surface. This can be accomplished by plastic strengthening (e.g. shot peening or rolling) or by surface hardening (e.g. nitriding or carburizing). The ability to shear off in case of overstress is ensured by a sufficiently hard and tough core section.

Figure "Deposits" The illustrated example shows a main engine bearing after capital damage. Usually, this type of damage would destroy the bearing so completely that the causes could only be speculated about, unless there are recorded data available (e.g. temperatures, oil flow, vibrations, etc.).
However, in some cases, additional information can be gained from the structure, composition, and layering of the wear products that were created during the damage process.
“A” is the heavily damaged balls of the bearing. The balls and the bearing tracks show extensive wear that has changed their contours considerably.
In section “B” of the bearing casing, there is a thick coat of oil coke which is full of shavings. This coat is made up of several layers which correspond to the times at which the oil coke and shavings were created. The oil content rises considerably together with the temperature increases in the bearing.
“C” is a detail of the coating cross-section near the bearing casing wall, i.e. the beginning of the deposits with fatigue-induced outbreaks from the roller bearing tracks.
The next layer, “D”, contains bonded shavings and the top layer (the end of the damage process) contains slugs from the contact surfaces of the bearing that reached extreme overtemperatures.
This all explains the damage sequence, in which pittings formed in the tracks of the main bearing, then the bearing cage became blocked, and finally the bearing function was similar to that of a friction-type bearing.

Figure "Statistics" (Example "Fuel with poor lubrication properties", Ref. 4.5-16): In order to do a statistical analysis, it is important that there is a sufficiently large number of “suitable” cases of damage. With isolated occurrences or first damages, no sufficiently meaningful statistics are likely to exist. Damage statistics can be helpful for understanding damage mechanisms and risk assessment, i.e. determining inspection intervals.
The Weibull diagram shows the distribution of leakages over the life (up to the time of damage) of an axial piston pump.
The scatter can be seen in the angle of the line, which is the Weibull parameter. The greater this parameter is, the steeper the line becomes, and the scattering is smaller. Fatigue and wear processes usually have large scatterings (small Weibull parameters) compared with other damage mechanisms. The fact that the lines are parallel shows that both have the same scattering, which indicates a causal relationship between them.
The top right diagram is a Woehler diagram for the life span of dynamically stressed parts. Evidently, the life span scattering is relatively small at high load amplitudes (LCF zone). If the loads are slightly greater than the fatigue strength (HCF zone), then the same load differences result in a considerably greater scattering of the life span. One can also make conclusions regarding the size of the dynamic loads and specific damage causes based on the life span scattering of dynamically stressed parts.
For example, if abbreviated tests (i.e. harsher test conditions than during actual operation) of an improved pump version show the same scattering (i.e. angle of Weibull parameter) as the original part, it shows that the tests are suitable for verifying that the part was improved.

Figure "Incubation time" Similar to natural processes (e.g. in medicine and biology), the term incubation time refers to the time span between the start of an influence and its characteristic damaging effect. During the incubation time, damaging changes occur that do not appear alter the macroscopic outer behavior of the engine in any damaging way. Typical damage mechanisms with pronounced incubation times include dynamic fatigue, erosion, and corrosion processes.
During dynamic fatigue in metals, microscopic changes take place in the structure, including strengthening, weakening, and crack initiation, which cause macroscopic crack growth at the end of the incubation time.
During the incubation period of an erosive process, parts may begin to shatter or erosion particles can become stuck in the surface. These processes can considerably decrease material removal for a short time, which is a characteristic sign of erosion. There are even reported cases where the sticking particles increase the weight of the eroded sample (Fig. "Unexpected behavior").
Often, protective oxide coatings form during the incubation time of corrosive processes. The incubation period ends when the medium can directly damage the base material.
Incubation time is used in order to achieve acceptable life spans or reliability for components with limited life spans. One example is the proportion of the life span that is taken up by the incubation time of engine parts under LCF stress.

Threshold value (Fig. "Cause of damage") refers to the limit value of a damaging influence, beyond which damage actually occurs. Damage mechanisms with one or more damaging influences with different threshold values are quite common. With fatigue processes, fatigue resistance is a dynamic load threshold value. Dynamic fatigue fractures will only occur above this value. Similar threshold values can be observed in parts with internal and external notches (internal: e.g. micro-cracks, cavities, flaws; external: e.g. grooves, structural changes) with regard to a certain stress concentration (see Fig. "Cause of damage").
A classic example of threshold behavior is stress corrosion cracking (see Chapter 5.4.2). The typical crack initiation occurs only after a certain tensile stress level has been reached with material conditions that are sensitive to the corrosive medium.
During erosion, a threshold value may be dependent on the hardness of the surface relative to the hardness of the erosion particles that are acting on it (Fig. "Influence of hardness of particles").
Threshold behavior is of foremost importance for engine technology. This effect is used when designing fatigue resistant parts, estimating the acceptability of certain (unavoidable) weaknesses and flaws characteristic of the technology during design, and conducting risk assessments.
The way in which the temporal damage sequence occurs after the incubation period can depend on various parameters, which must not necessarily by the same as the parameters that determine the threshold value.
For example, if the damage sequence does not involve corrosion, but rather cyclical crack growth due to dynamic loads, other structural characteristics will most likely be the determining factors.