Figure "Cause of damage": Searching for the “damage-causing failure” is of fundamental importance for preventing failures and designing proper remedies. In this case, the issue is not whether the failure was the main cause or only a contributing factor, but whether it is even an unallowable failure or a weak point characteristic of the material or technology. When designing parts, this type of unavoidable weak point must be properly taken into account with regard to conditions such as operating behavior and life span.
Failures that cannot be safely prevented by the prescribed testing procedures for the series and/or system monitoring must be classified as weak points. A clue that indicates a flaw of a size that can be safely discovered by penetration testing is “technical scribing” (bottom diagram). This is defined as a semi-elliptical surface crack with a length of 0.8 mm and depth of 0.4 mm. A criterion for parts at risk for crack growth may be the threshold (also see Fig. "Incubation time") of the stress concentration at the flaw. Flaws with an effective crack length of a_th, whose stress concentration at all relevant operating loads is under the threshold value K_th will not grow further and do not affect the life span of the part. However, this is only true if other damaging influences (e.g. corrosion) do not cause the flaws to grow beyond the threshold value during operation, or the threshold value is not reduced by effects such as embrittlement.
Even if a dynamic crack initiates at a material flaw, this does not mean that the flaw is damage-causing, as long it is within the allowed specifications with regard to the above considerations.
When evaluating causal flaws, mistaken conclusions can easily occur if the investigation is not done with a wide perspective. This kind of situation is to be expected if, for example, the evaluation is based only on a metallographic grind or one SEM image of the damaged part at high magnification without inspection or specification of typical comparable parts that have proven themselves in operation. One example is the material-specific micro-porosity (shrinkage cavities) in cast parts made from superalloys, as are used in almost all modern turbine blades.
Integral cast turbine disks of low-performance engines of the type used in helicopters and APUs are especially affected by micro-porosity in the hub, which is subject to cyclical high-stress. The designer needs to take these specific weak points into account.
If materials or technologies with characteristic flaws are used above their thresholds due to the lack of other viable products, then fracture mechanical inspections are necessary to determine a safe life span. The crack progress phase must be considered for the safe life span. Naturally, a sufficient safe distance from the critical crack length must be maintained. Sufficiently proven and accurate data for the crack progress behavior of the material and parts must be available.
If flaws are discovered after delivery, then risk disclosures under aspect of the “threshold flaw limit” are helpful.

Figure "Sensitivity to changes" Turbine engines are more sensitive than other machines to any changes to the proven and authorized configuration. “Improvements” to prevent damages and weak points often lead to new damages on the same parts or new problems in other engine parts (Fig. "Disimprovement"). The above model showing balance conditions (top and middle diagrams) is intended to make this behavior more easily understandable. The ball represents the behavior of the part, its movement from the center is the size of the operating influence, the distance from the edge represents the safety against part failure, and the speed at which the ball rolls is the damage speed.
A part with stable behavior has the ability to counter the load changes with a measure sufficient to ensure stable conditions. This is the case, for example, when a self-repairing effect such as that with thermal fatigue cracks leads to de-stressing and slowing of crack progress. The most frequent type of stable part performance is when a part`s resistance to elastic deformation is great enough to ensure that it reaches an equilibrium without unallowable changes (e.g. plastic deformation, crack initiation, fractures).
A part with indifferent behavior reacts to load changes with an even damage speed. For example, wear processes that occur over a long period.
A part with unstable behavior reacts to small load changes with a self-increasing damage process. An example of this is rubbing that heats up the rotor, causing it to expand and rub more vigorously.
This also includes imbalances that do not result in a balanced state and continue to increase the offset of the rotor.
The middle diagram depicts the situation typical for a highly stressed engine part. It is a combination of indifferent and unstable behavior. The width of the platform represents the overdimension of the part. As long as the ball remains on the platform, it is subject to the designed loads and the “natural” aging process. Since overdimensioning is kept to a minimum in engines, the platform is rather narrow. If the load changes move the part beyond the platform (beyond the tolerable loads), it will result in self-accelerating damage.
The high load levels from various operating factors that are typical and necessary in engines are also the reason why apparently small changes beyond the designed load levels can cause engine parts to fail. Because the size of the overdimension is often unknown, (e.g. design based on experience or approval based on test runs), it is also not known exactly how close to the load limits the engine part is operating. Only during engine operation will it become known, if the changes are acceptable. In this case, as well, “the engine will tell us”. A typical example of this is compressor blading. Seemingly small changes to the blading can lead to increased vibrations and fatigue fractures in the blade leaves.
The transfer of effects from an altered part to other parts is promoted by engine-specific design characteristics (bottom diagram). To save weight, engine parts such as housings have relatively thin walls and are sensitive to vibrations. They are coupled by solid connections across almost the entire length of the engine. The rotors influence one another across the bearing and the gas flow, for example. The gas flow transfers changes (e.g. gas vibrations) in and against the direction of flow and therefore allows different parts to influence one another across large distances.

Figure "Disimprovement" (Example "The engine will tell us"): The problems with remedies and improvements are always ongoing. First, there is the question of the effectiveness of a remedy. In not all cases is a single measure sufficient, but the remedy is comprised of a bundle of different, complementary, and supporting measures. These can, for example, be adjusted to one another so that they show an immediate improvement for a short length of time (temporary solutions) in order to buy time until more extensive, long-term measures can be taken. Typical examples of temporary solutions are frequent inspections with non-destructive testing procedures to find dynamic cracks. These measures then allow further operation, even if the operating intervals are limited by the safe length of the crack growth phase.
If remedies do not lead to a noticeable reduction in damages, it is a clear sign that:

• Important contributing causes and perhaps even main causes were not recognized or were not properly assessed.
• Measures are unsuitable or insufficient.The desire to achieve fast and safe success often leads to several measures being implemented at once.
  

This presents the danger that the effect of the individual measures on one another is not understood or that the estimation of their contribution to the observed changes is wrong. This increases the risk of unnecessary measures with undesired side effects lead to new problems.
The increase of ineffective remedies and solutions is called “disimprovement”. It not only has little or no effect, but also leads to an increase of the same damages. While the original damages may no longer occur, new types of damage begin to occur in the same parts and/or other areas of the engine.
“Disimprovement” is especially dangerous when there is no sufficiently accurate damage analysis and the measures that are based on it are not or can not be implemented in sufficiently small increments, but rather alterations are made that are not accompanied by the necessary experiential background. These situations are difficult to avoid when engines are being developed with revolutionary new technologies.

Figure "Overload": In order to ensure optimum fuel consumption, engines are designed and adjusted to exactly fit the required performance levels that they will be used at. The pronounced competition between different manufacturers and operators minimizes the amount of play for excess performance. This is true for commercial engines as well as military ones, although in the latter the competition is with potential enemies on a technical level. This increases the risk of “disimprovements” (Figs. "Sensitivity to change" and "Disimprovement").
In the commercial branch, the desire is to build very similar engines for several aircraft types with
related performance levels. This benefits the operator in terms of logistics, operation, maintenance, and repair. The result are so-called “engine families” , which are intended to cover the largest possible performance range. Since the constructive framework leaves little room for innovation, performance increases must be achieved primarily through increasing the gas temperatures. This leads to the implementation of new technologies such as thermal barriers or single-crystal blades with more complex cooling air structures. Even if these new technologies improve the durability towards high temperatures enough that no shortening of the life span of the parts is to be expected, these parts are more sensitive to changes in the gas temperatures than less highly stressed parts (e.g. a change in temperature distribution). If the thermal barrier fails, e.g. through spalling due to an OOD, the parts will fail much more rapidly. This higher sensitivity can increase the damage rate if, for example, the operator often uses these engines at their upper performance limits.
With military engines, especially, it is often not understandable that the client demands that the performance limits be pushed as early as the design phase. This demand does not give enough regard to the usual experience, which is that aircraft become heavier throughout development. This virtually guarantees serial operation of the engine to be marked by high damage rates, frequent IFSDs, and unnecessary repair costs.

Therefore, it must be strongly recommended that, at least in military engine development, engine performance is sufficiently “overdimensioned” from the beginning.

Figure "Catastrophic consequences": This diagram describes a typical case of “disimprovement” from Ref. 3-3 that was investigated and published by G. Lange.
After approximately 1000 hours of flight the damage occurred during engine idling on the ground. The compressor disks had burst into many pieces. Comparable damage soon occurred in a second engine.

G. Lange describes the causes of the damage (also see Fig. "Special experiments"):
“Axial compressors made from turbine blade steel X 15 Cr13 were not tempered at 725 °C after hardening as usual, but only at 540°C in order to achieve the highest possible strength. This treatment made the steel especially sensitive to corrosion, since a net of chromium carbide deposited along the former austenite grain boundaries. The disks still reached the prescribed life span because the corrosive medium, moisture from the air flow, was blown away by the high centrifugal force. However, through a seemingly minor constructive change - the turning of a balance ring - the moisture built up in such a way that the disks shattered due to the stress levels, i.e. dynamic crack corrosion.

Figure "IFSD" (Refs. 3-7 and 3-10): IFSD rates for a specific ETOPS time are determined with regard to the requirement that the probability of a catastrophic accident due to total thrust loss is less than 3×10^-9 per flight hour (Ref. 3-10, Fig. "Effects of failures"). In the past, it was necessary that there was sufficient operating experience under commercial conditions before authorities would give twin-engine commercial aircraft ETOPS approval. The basis for this approval was the IFSD rate for a fleet with the same aircraft/engine combination, i.e. the total number of IFSDs over the sum total of the flight time (bottom diagram). The authorities (CAA in this case) then laid down a relationship between the IFSD rate (engine reliability) and the maximum rerouting time (top diagram). Further important criteria are the reliability and redundancy of main systems and the experience of the airline that is seeking ETOPS approval. Operating experiences in the early 1990s (bottom diagram) showed that future modern engines would have sufficiently low IFSD rates to justify 180 minute ETOPS ratings before they even begin commercial operation. This was accomplished with the introduction of new, twin-engine, large capacity aircraft in the second half of the 1990s, the construction of which took into account previous experiences from design and testing. For example, redundancies and reliability were further improved, and testing came closer to simulating real operating conditions. This meant that the preparation time before the first commercial use of an aircraft type became relatively long (Fig. "Operating experience"), but on the other hand it would already be given a 180 minute ETOPS rating when it began operation.

Figure "IFSD statistic" (Ref. 3-24): As shown in the left diagram, engine aggregate components such as gearings, oil and fuel system components, generators, etc. make up over 50% of the causes for IFSDs. This is based on data from engines from various manufacturers. Evidently, the oil systems are especially sensitive. Another point worth noting is the high rate of shut-downs due to false alarms and indicator malfunctions (false fire warnings and instrument malfunctions). The fuel system also creates more IFSD problems than, for example, the turbine, which as a highly stressed hot part would seem to be more likely to fail.

Figure "ETOPS strategy" (Ref. 3-7): In order to obtain and keep an ETOPS rating, the operator of an certain aircraft/engine fleet must make a significant effort (top diagram). This includes, for the entire aircraft:

• Overnight Maintenance
• Airplane Servicing
• Daily 1st Flight Check
• ETOPS Predeparture Check
• ETOPS Dispatch

These must be accomplished at the airports along the routes.

During the validation program (see Fig. "Operating experience") the aircraft in the operator`s configuration is put through a multitude of flight cycles, altitudes, weather conditions, and operating scenarios to simulate one year of serial operation. This also includes, as mentioned above, maintenance and service work, which is also an opportunity to check and approve the work procedures given in the operator`s handbooks.
In the last phase of the validation program, the operating airline has the chance to operate the aircraft in its flight network. This allows it to demonstrate problem-free operation in the “commercial environment”, e.g. with the corresponding service and maintenance work.
The bottom diagram shows the advantages of longer ETOPS times on a trans-Atlantic route between two airports.

Figure "Operating experience" (Refs. 3-7): The certification work for a 180 minute ETOPS rating takes four years until the aircraft sees commercial use (bottom diagram). Additional steps (dark background) have been added into the certification procedure. The expanded list of tasks includes, for example, the definition of basic requirements as well as development and component testing that includes previous operating experiences (with aircraft/engine-types that are already in serial operation).

The procedure is as follows:

1. Analysis and evaluation of relevant operating problems
2. Constructive changes as corrective measures
3. Verifying and securing success of the corrective measures on a theoretical basis
4. Developing realistic tests to verify the success of the corrective measures

The first step of the process is shown in the top part of the diagram (analysis of relevant operating problems):
In this case, more than two million flights of a modern twin-engine commercial aircraft were evaluated with regard to ETOPS-relevant incidents, and this experience was then incorporated into design improvements. It is interesting that 30% of the problems were connected to the engines. A closer look reveals that a notable percentage (see Figs. "IFSD statistic" and "ETOPS certification") could be traced back to false warnings from the oil system.

A typical test program for engines is described in Ref. 3-23:

• 3000 test cycles with the complete engine and interspersed tests with imbalances of the high-pressure and low-pressure sections.-A second engine underwent 1000 cycles of imbalance tests on the airplane for tests in flight.
  
• The third engine was “aged” for 2000 cycles and then test flown on the aircraft.
  
• The fourth engine test on a testing rig ended after 2000 simulated flight cycles and three full 180 minute ETOPS rerouting cycles (this engine was later overhauled and went into operation for the airline).
  

All testing rig engines were made available to the validation authority for inspection. The fleet leader engine (the engine with the longest run time in the fleet) with regard to cycles remained on the testing rig and further cycles were run to ensure that it stayed ahead of all the other engines in the fleet in serial operation.

Ref. 3-23 describes the damages and problems of an engine type within the first two years of serial operation, as well as the implemented corrective measures:

• The front bearing damage in the medium-pressure compressor led to a different configuration of the bearings (implemented in 89% of engines).
• Coking up of the bearing chamber of the high/medium-pressure shaft led to changed inspection procedures, a new type of lubricant, and new insulated oil pipes (implemented in 100% of engines).
  
• Rotor blade failures in the high-pressure compressor were corrected by using a new blade version and changing the material they were made from (implemented in 100% of engines).
  
• Oil leaks from the drive system of the auxiliary gearing led to strengthening of the components (corrected in 100% of engines).
  
• Problems with the drive system necessitated better weighting of the shaft (implemented in 100% of engines).
  

Figure "ETOPS certification" (Ref. 3-7): This diagram shows the distribution of damage and problems within the two million flights of the engines of a modern twin-engine commercial aircraft type (see Fig. "Operating experience", top diagram). This experience is intended for use with ETOPS validation. In the middle chart describes the affected engine components/component groups, and the bottom chart divides up the causes of the problems. It is interesting to note the high proportion of false signals from the many monitoring systems for engine functions and surrounding conditions.
The data at top describe actual incidents that can be classified as “false oil system warnings”, as well as the constructive measures taken to correct this.
The high percentage of maintenance- and service-related engine damages (22%, bottom chart) shows how multi-faceted the problems can be. On the surface, one might assume that this is due to a weakness on the part of the operator, but it is also possible that poor engine accessibility for maintenance work may be an important factor for the large number of problems.
In the case at hand, many of the IFSDs were due to a poor seal at the connection of a certain oil line, which decreased oil pressure considerably and/or caused oil supply problems. This line connection loosened during operation. However, even after the part was tightened on the ground, it often happened that the poor seal would again cause an IFSD. This type of problem can not always be solved by mere redesigning of the coupling. If, for example, the inaccessibility of the seal causes mounting problems, then constructive changes to the seal should perhaps be accompanied by relocation of the seal to a more accessible location. A thorough analysis of the problem is necessary to recognize this type of relationship. Analysis also includes consideration of whether the maintenance work can and will be conducted under poor weather conditions (rain, snow, cold).

Figure "Double engine failure": This diagram is based on Ref. 3-13.
A complex technical system such as an engine consists of many components that can be subject to completely different failure mechanisms. This means that the individual failure probabilities must be extremely low in order to keep the failure probability of the whole system acceptably low. This often results in technical limits being reached or unbearable costs and effort being required to ensure safety
from failures. Redundancies are one possibility of achieving the desired failure safety of this type of system.
“Redundancy is the tolerance of a system to the failure of its elements”.
In the general sense, any system that can continue to function sufficiently despite the failure of one or more of its parts can be referred to as redundant.
Redundant behavior can be achieved in many different ways. One possibility is a second, sufficiently different element that takes over the function of the first in case of failure. Both of the elements in the redundancy must be completely different technically and functionally, and they must not be unallowably indirectly connected in order to prevent them being affected by the same failure mechanisms and failing simultaneously (middle diagram). A true redundancy can reduce the failure probability of a system by several decimal powers. Experience has shown, however, that such improvements can often not be realized. Optimal redundancy can only be achieved if there is complete understanding of system characteristics and the influences that could affect these characteristics. This is necessary in order to be able to take suitable measures.

Definitions of terms:
Primary failures are caused by the spontaneous failure of an element of the system (therefore, only by damage in the element itself).
A functional failure of an element is any failure that prevents the element from performing the function it is intended to. Functional failures are caused by internal failures of the element or due to input failures of another element.

The statistical estimations of the damage processes in the diagram presuppose allowable simplifications (see Ref. 3-13).
An unrelated failure pair is when the failure of one engine is not connected with the failure of the other, and the failure of a single element did not cause both engines to fail. Other cases can be referred to as related failure pairs, which can be divided into two categories:
Cascading/consequential failure pairs and common–external-cause failure pairs. A common cause is taken to mean a case in which an external influence causes elements of redundant systems to fail.

Example of a an unrelated failure pair with ideal redundancy (top diagram):
The case concerns a primary failure of one engine. Damage to the second engine is just as probable as in the first. The probability of failure of the first engine during the two-hour flight in question is 4/10⁸. Typical primary failures are fatigue damages such as dynamic fractures or pitting on roller bearings.
In reality, there is no ideal redundancy in case of engine failures. The lost thrust may require increased output from the remaining engine (e.g. in order to maintain the required speed/time until reaching the next airport) or occur during the start phase, when a high total thrust is absolutely necessary. This makes it questionable, whether the failure rate for the remaining engine(s) remains unchanged.

Example of a consequential failure pair (middle diagram): In this case, the failure of one engine directly affects the other.
A typical case is uncontained rotor fragments escaping from an engine. This type of incident primarily endangers military aircraft in which the two engines are close together. In commercial aircraft, the danger is primarily to engines that are mounted together on both sides of the airplane in “double nacelles”. Assuming that in every hundredth case the second engine would be dangerously damaged by the first, the probability of a total loss of thrust would be 4/10⁶, which is about one hundred times greater than the probability with unrelated failure pairs.
An example of a failure pair with a common external cause (bottom diagram):

Typical examples include weather conditions (see Chapters 5.1 and 5.2) such as hail and ice formation. A total fuel shortage might also be thinkable. In this case, as well, the probability of a total loss of thrust is relatively high at 2/10⁶.
Engines in twin-engine fighter aircraft that are connected by a gear box have the characteristics of a consequential failure pair.
In isolated cases (Example "Fuel starvation VI"), even on multi-jet transport aircraft, failed engines dangerously damaged other engines.

Figure "Engine shut down": When an engine on a multi-engine aircraft is damaged, then experience has shown that the wrong engine may be shut down. This can be due to the high psychological stress on the pilot, but is often due to malfunctions, wrong connections (e.g. sensor connections of the fire warning system), or problems with indicators or warning lights.

Figure "Fuel management": Fuel management in modern transport aircraft is an extremely complex process and serves to ensure an optimal center of gravity for the aircraft. If regulations are observed, then a general lack of fuel is not possible. Example "Fuel shortage" shows that this is not always guaranteed. A relatively complex system such as this one is evidently difficult to understand even during malfunctions and can lead to a lack of fuel in the engines (see examples 3-7and 3-8).