Aeroengine Safety

Figure "Rotor failures risk tree" (Ref. 8.1-1): This explanation concerns technical hazards and damage sequences. Naturally, human casualties can also result directly from fragments. If rotor fragments (Fig. "Typical fragments of rotor blades") are not contained in the engine, many different areas and components of the aircraft are threatened. Some cases can result in crashes.
If the Structure of the aircraft is damaged in supporting cross-sections, even normal operating stresses can cause failure of the affected parts. Beyond this, the drop in rigidity can result in natural oscillations fomented by aerodynamic forces (“fluttering”). This leads to dynamic overlstress of the weakened structure with immediate danger of fracturing. If the pressurized cabin is breached, a dangerous pressure loss can be expected (in extreme cases passengers have been torn from the cabin).
Systems essential for safe operation, such as flight regulators, hydraulics (e.g. for flap adjustment) and cables, can have their functions impaired, interrupted, or spring leaks. If the emergency power supply is cut, a crash can occur.
If the tank is punctured or affected by external fires, fuel loss and/or fires can be expected.
Damage to the fuel supply system results in a loss of thrust. This is especially hazardous if all engines are affected or the damage occurs in the crucial start-up phase.
Fragments from one engine can also directly damage other engines (Fig. "Rotation direction demands position of auxiliary components"). In twin-engined warplanes, where the engines are close together and parallel in the hull, this danger is especially high. This danger is further compounded if the engines are connected to ancilliary equipment via a common gearbox.
There have also been cases in passenger planes, where multiple engines failed due to fragment impacts. In one case, for example, the second engine on the other wing was struck by fragments that had bounced off the runway (Fig. "Production caused turbine disk failure").
If a system vital to engine operation is damaged, a loss of thrust can be expected even in the engines not directly affected by the damage.
Damage to the engine outlet can cause a loss in thrust and/or divert hot gases.
The continuation of the flight becomes endangered when the crew`s ability to control becomes impaired due to a failure of steering systems or fire, or if fuel supplies are no longer sufficient.

Figure "Typical rotor fragments" (Ref. 8.1-2 and 8.1-4): Normally, the area of the disc experiencing the most stress during LCF (Starting/shutdown cycles) is at the hub bore (top left diagram). This is caused by the superposition of gradients of centrifugal force and temperature. Other disc regions are susceptible to cracks due to geometric anomalies, such as stiffness cracks in shaft sockets or axial bores in the shaft connections (top right diagram; Example "Rejected takeoff due to uncontained failure"). In the hub area, a crack will quickly expand and, due to the high stress levels and low gradients, even small critical crack lengths will lead to the disc breaking in half.
Rim fractures (diagram at top right) are usually connected to high thermal stress levels and/or overheating of the rim area. However, rim fractures can also be caused by disc oscillations, especially if the mean stress levels are high. In extreme cases, the entire rim assembly can detach itself. A crack can be diverted into this zone if the periphery is experiencing high stress levels (e.g. at the transition point of a shaft socket).
The root of turbine rotor blades is usually fir tree shaped. A root fracture usually lies in the radially outermost tooth (second row of diagrams). In terms of containment, it must be taken into account, that a root fracture results in a significantly higher fragment weight than a leaf fracture.
Unlike in compressors, rotor shaft failures result in runaway turbine rotors that reach uncontrollable overspeed. Therefore the behaviour of the turbine rotors at overspeed after a failure is important with regard to the consequential damages to be expected (see examples in Volume 1).
A preemptive release of turbine blades can prevent the turbine disc from bursting upon reaching overspeed. This lowers the risk of extensive damages. This is a special trait of blades with “fine teeth” (third row of diagrams), as are common especially in older engines, depending on OEM. Due to the expansion of the disc, smaller teeth lose their grip before breaking. Thus the blades are released from the disc and the turbine`s rpm drops rapidly, at least in single-stage engines.
Depending on conditions, blade rubbing on labyrinth partitions can create cracks that lead to ring fractures (bottom diagram). These fragments have relatively little kinetic energy and are usually contained by the overlying static labyrinth ring.

Figure "Typical fragments of rotor blades": The top row of diagrams shows typical fracture points of fan blades in older engine types. The leaves of these blades have a relatively short chord length and are supported by annular struts (clappers). The clappers stiffen the blade ring considerably in parts, so that a bird impact at the tip of the blade above the clapper usually results in a small fragment breaking off. The typical fracture points due to oscillation fatigue are in the area of the clapper and in the contact area of the dovetail root (fluttering oscillations). Due to the supporting and cushioning effect of the clapper, leaf fractures in the transition area to the root platform are uncommon.
It is true for all fan rotor blades, that the strong axial aerodynamic forces in the case of a fixing failure (Example "Rotor blade fixing failure") lead to the release of multiple blades from the disc. These blades can also escape from the containment area towards the front, posing a threat to the safety of other parts of the aircraft.
The middle row of diagrams show the most common fracture points in compressors with wide chord blades. Due to the lack of a clapper, leaf oscillations that threaten the transition area to the root platform are more likely to occur.
The bottom diagrams show fan blades in large modern engines. These blades are either hollow soldered titanium alloys or they are made of carbon fibre-reinforced resin (CFK). These blades have no root platform. The hub contour is made up of separate segments. When the blades are distorted (e.g. bird impact), they push against these segments. If these segments are stiff, this can result in increased stress on the leaf and thus a failure in this zone. Hollow titanium or synthetic fragments are good from a containment perspective due to their light weight and their particular behaviour upon failing.
For containment certification, CFK blades usually fracture at the hub contour, which results in lower fragment weights. However, it must be ensured that the rest of the blading is not overstressed by a blade failure, which would result in an uncontrollable multi-blade failure. This requires special tuning and configuration of the housing and containment.
The introduction of integrally bladed fan discs (Blisk=bladed disk) eliminates the danger of root failure at the dovetail connections. However, a increased risk of fatigue fractures at the connection point between blade and disc can be expected. The advantage of this configuration is that containment measures are only necessary for leaf failures, and not, like in other versions, for the considerably heavier fragment resulting from a root failure.

Figure "Fragments outside rotational plane" (Ref. 8.1-1 and 8.1-4): If a fragment penetrates a housing, it escapes within a certain angle. The flight paths lie within a cone (top left). The axial divertion is especially interesting. Since the probability of a fragment penetration is roughly the same around the circumference (without regard to varying wall strengths and attached parts), the axial divertion is primarily responsible for determining the endangered structural area. High-energy fragments are only diverted slightly (approx. 5 °), fragments with low energy up to 33° (above right). This is also the minimum axial extension necessary for containments. Naturally, as the distance from the housing wall increases, the axial length of external containments must also be increased accordingly.

Figure "Hazards of disk fragments" (Ref. 8.1-1 and 8.1-4): The kinetic energy of a released fragment is composed of two parts: the rotor fragment moves along its trajectory and thus has translatory energy. At the same time, it rotates around its center of gravity in the direction of rotation of the rotor, because the outer zones have a higher circumferential velocity than the areas located further in on the radius. The fragment also has rotatory energy (top diagram). The penetration ability is determined by the translatory energy of a fragment. An unbroken disc (sector angle 360 °) stores all its energy in rotary motion. This means that it is, as far as penetration ability is concerned, “harmless”. The energy proportions of burst disc fragments depends on the sector angle (bottom diagram). The most dangerous fragments are those with sector angle of about 133 °, because they have the highest proportion of translatory energy .

Figure "Housing deformations by disk failures" (Ref. 8.1-3): Rotor turbines with a relatively heavy hub and short blades have typical damage symptoms after a hub failure. The foremost fragment area in direction of rotation is decelerated when the blades make contact with the housing. The blades are overstressed at the contact points and usually fracture above the root. The housing becomes oval and rips open symmetrically.

Figure "Housing stress by blade fracture" (Ref. 8.1-7): Aside from the translatory motion in its trajectory, a fragment also rotates around its center of gravity (Fig. "Hazards of disk fragments"). Upon release from the rotor assembly, the fragment has the same direction of rotation as the rotor (Fig. "Hazards of disk fragments"). The fragment is also affected by rotatorily directed impulses from impact- and aerodynamic forces that can go against the original motion of the fragment and influence the penetrative ability of the fragment considerably. An example are long rotor blades, as are commonly found in fans. If the blade fails in the root, the tip is stopped by the housing (top diagram, facing page). The heavier, radially more closely positioned blade root has a lower circumferential velocity than the blade tip. It is accelerated by the following blades and thrown against the housing, in this case causing the fragment to rotate in the opposite direction from the rotor. In tests of structural parts in a testing rig then, the released fragment will have the same direction of rotation as the engine.
The bottom diagram shows the calculated relationships (Ref. 8.1-18) between the area of impact of a leaf fragment and the necessary thickness of a titanium alloy wall for containing the fragment. According to these calculations, a fragment striking the wall with the tip will penetrate a housing wall roughly three times thicker than one striking the wall with the section connecting to the root. This seems to contradict the effect described in the top diagram, which did not account for this calculation. This clearly shows how greatly the penetration ability can vary and how susceptible it is to conditions and coincidences.

Figure "Penetration potential of fragments" (Ref. 8.1-7): The shape of a fragment`s impact surface plays an important role concerning its penetration ability (compare with diagram 8.1-6). Fragments with equal mass and different contours can have extremely different minimum penetration speeds (top right). The toughness of the housing is also influential, and dependent on the impact speed (left diagram). It is obvious that this is a complex process, and not very approachable analytically. Since it is not possible to predict the shape of a rotor fragment`s impact surface, the appraisal or rating of a housing`s penetration resistance should always be done with the worst-case scenario in mind. When analysing technical trials, the limited ability to analyse containment behaviour should be remembered. This limited ability to give concrete figures also contributes to the fact that fragments often escape from engines where the containment rating based on available evidence makes this completely unexpected (Example "Engines of older design unable to meet new requirements").

Figure "Containment performance by design": In line with experience, the penetration resistance of multiple concentric housing walls is higher than that of a single wall with the same total thickness (Ref. 8.1-1). Thus, configurations where a rotor fragment must penetrate multiple housing walls in sequence provide good containment.

Figure "Escaping of rotor blades despite containment": This diagram shows a summary of causes in damage cases where blade fragments escaped. These cases are frequently reported, although it would be expected that containment regulations would prevent at least most of these housing penetrations (Examples 8.1-3, 8.1-4 and 8.1-5).
It is worth noticing, that especially in the low-pressure turbines, occurrences of blade fragments escaping are relatively frequent. This could be explained by typical peculiarities of these components:

• Relatively large rotor blades with corresponding mass.
• Thin housing walls. Functionally one-layered design (the internally located segmented fuel guide cannot withstand any tangential stress).
• Long blades with thin cross-sections tend to haircuts and thus a greater stress on the housing.
• Overspeed after failure of the fan shaft creates relatively high-energy fragments.

Figure "Centrifugal strain in different blade parts": In the case of static overstress, such as during high overspeed (tensile stress) or extreme blade rubbing (flexural stress), the toughness of the material and the presence of notching, i.e. tension gradients, determines whether or not a structural part will break. In the root, especially fir tree roots (top left diagram), and at the connection between leaf and root, there are notches which influence the behaviour during failure. Brittle materials are more sensitive to notches (bottom diagram) than tough materials, since the latter reduce tension and distribute it more evenly across the most heavily stressed cross-section.
Material changes must also be critically assessed with regard to overstress. If this isn`t done, there is a risk of the structural parts failing at significantly lower tension levels or of damages due to overstress becoming unacceptably serious.
Such cases can occur if, for example, a tough, multicrystalline turbine blade material is replaced by a single crystal material that reacts more brittly at high deformation rates. This increases the possibility of all blades failing; a so-called “Haircut” (Fig. "Uncontainment by blade 'haircut'").
Whether plastic deformations occur in the root or leaf first depends on the progress of stress in the stressed cross-section (top right diagram). In a notched cross-section, a relatively small plastic lengthening can be expected. Therefore, the corresponding curve above the RPM will be fairly flat until failure. The more evenly and less heavily stressed leaf cross-section will progressively plastically lengthen upon reaching the yield point. The safe amount of clearance needed to prevent a turbine blade failure at high overspeed depends heavily on the toughness of the material. If the material`s behaviour changes noticeably at different operating temperatures, then this should be taken into account when considering containment or at technical trials calculating the RPM levels at which bursting occurs.

Figure "Uncontainment by blade 'haircut'" (Example "Containment of debris" and Example "Broken off blade tip leading to blade jam"): Containment certifications are usually done for the failure of individual blades. However, if a blade fragment jams in certain locations, this can lead to a failure of the entire blading (haircut). If the fragments jam in a small area, the released energy is concentrated there, understandably creating significantly higher stress levels in the housing than would be present due to a single blade failure. The housing wall can be breached and a large number of fragments escape at the same spot, thus concentrating the concequential damages. It is also important, when choosing blading material, not to increase the possibility of a “haircut”. The toughness of the blade material at high deformation rates and normal operating temperatures plays an important part in this (see diagram 8.1-10).

Figure "Factors influencing 'haircuts'" (Ref. 8.1-4): When all the blades on a rotor fail, it is referred to as a “haircut”. In this instance, the housing experiences high stress levels. Therefore, one must endeavor to avoid haircuts. The susceptibility of blading to haircuts depends on many factors, which can be classified into three main groups:

Construction: To ensure that blade fragments are as light as possible with little energy, blade failures due to flexural overstressing should be kept as far outward on the blade as possible (bottom diagram, Ref. 8.1-4). In any case, failure of the entire blade along with the disk`s fir tree toothing must be avoided. This behaviour is influenced by the structural design of the blade. A general rule is that the stress in the dovetail of the disk should be less than in the root shaft of the blade, which should in turn be less than at the connection point between leaf and root platform. Apart from the blade properties, the surrounding parts, such as control devices, housings, rotors and their bearings are also important in determining behaviour during failure (e.g. stiffness, i.e. flexibility and hardness).

Operation: The temperature of a structural part is very important with regard to its behaviour in case of failure (Fig. "Containment clamping influence"). High leaf temperatures usually lower hardness and increase ductility. When temperatures approach those of the initial fusing (in the region of the solidus temperature), nickel alloys behave brittly and show fission-fracture like signs. These fractures are easily confused with fatigue fractures. If the disc ring overheated along with the blade roots, the fir tree toothing may fail. The high centrifugal and high circumferential speed typical of overspeed can change the manner in which the blading fails. This is due in part to the fact that the deformation rate rises, increasing embrittlement.

Material: The blade material is primarily responsible for the manner in which it fails. Typical coarse-grained cast materials tend to brittle cracks when subjected to solidus temperature and impact stess. This is especially true for single-crystal blades. Experientially, the danger of a haircut is greater in single-crystal bladings than in polycrystalline materials. This tendency must be remembered when changing a blading from polycrystalline to single-crystal in order to permit higher operating temperatures. In each case, the containment ability of the housing should be reassessed. Brittle blade fragments lose kinetic energy when they shatter, making the fragments easier to contain due to their relatively low energy. When changing structural materials or assessing blade materials, the density of the material must be taken into account. For example, there are single-crystal materials that contain wolfram, making them considerably (about 10%) heavier than the standard nickel alloys.
When considering the introduction of “alternative” brittle blade materials such as ceramic or intermetallic phases (IP), their susceptibility to sudden failures of the entire blading should be an important criteria. Intermetallic phases exhibit a brittle behaviour up to a few hundred °C before becoming ductile. They are also especially susceptible to failure at the low temperatures present during startup, increasing the danger of foreign object damage. If a fragment breaks off, it will most likely result in a avalanche-like self-increasing destruction of the blading.

Figure "Stresses during blade fragment containment": The failure of a typical large fan blade in a modern engine with high bypass ratio stresses the entire engine structure. Controlling this type of occurrence is a very demanding design task. A fan blade failure is followed by extreme imbalances, oscillations in the housing and rotors, large torsion moments due to rubbing against the housing and rotor deceleration, combustible abrasions, bending of the rotors, and high bearing loads. These influences on the engine components lead to typical overstresses and damages:

Penetration stress against the fan housing wall. When the failed leaf fragment is “run over” by the tips of the remaining blades (provided there is no nesting behavior), extreme housing oscillations (Fig. "Housing damage by rotor rubbing") occur, subjecting flange connections to high levels of dynamic stress (Fig. "Containment behavior and design characteristics").

The extreme imbalances that follow a blade failure can lead to an overstressing of the engine suspension and/or the airframe, i.e. the wing structure. Thus the release of the engine in extreme damage situations has been provided for (Fig. "Design of engine mounting bolts for controlled failing").
The radial forces and the flexing of shafts and housings can overstress the main bearings. The sudden appearance of powerful radial forces can induce high axial forces in the bearings and thus the failure of the bearing rings, to name an example. Seal failure in the bearing chamber due to deflections in the rotors and housings can result in heavy oil leakage and thus an oil fire.

Housing braces that support the bearings are stressed by radial forces from imbalance in the main bearings and by torsion moments in the case of a fan blade failure. Torsion moments occur, for example, during a canting of the bearings. This is true not only for housings near to the fan. Even housings near the engine`s output can be overstressed due to fan damage.

The engine type affects the stressing of mounted components, such as regulators, gearings, or components of the fuel and oil supply systems. If these devices are mounted on the bypass duct or fan casing, as is usual in warplanes, the stress of a blade impact and/or strong vibrations in the low pressure rotor can cause the mountings to fail. Consequential damages can also include failure of fuel or oil lines resulting in fires.

rubbing of flammable surfaces creates combustible dust and the possibility of a dust explosion. This type of explosion can overstress flange connections to the point that housings are torn open or even torn off.
Heavy rubbing in the compressor can result in a titanium fire.

High torsion moments caused by rubbing can lead to a failure of the rotor assembly. Even a rotor drum can be damaged to the point of fracturing by overheating and/or sectional weakening.

Figure "Brittle material behaviour at impact" (Ref. 8.1-7): During situations necessitating containment, fragments, housings, and parts affected by consequential damages are subjected to high deformation rates. In order to correctly assess containment-related damage sequences with high stress rates, it is necessary to know the behaviour of the materials involved.
The top diagram is of a low-alloy steel pipe with 20 mm thick walls, that reacts in a very ductile manner during normal damage trials. At 50,000 rpm in a testing rig, an integral turbine disc from a small helicopter engine caused this pipe to burst. The steel reacted in a very brittle manner. Multiple large pieces broke out of the pipe without noticeable deformation, meaning that the energy taken from the disc fragment was minimal. Thus, this type of material is not suitable for containment rings. In general, a forged version of the same material is tougher than a cast one.
Welds along containment rings have proven to be exceptionally problematic, because they are notched themselves (molded notches- e.g. undercut, stiffness notches, e.g. due to overly high seams and structural notching), and because the cast structure of the welded seam tends to fracture brittly.
The middle diagram illustrates the phenomenon described above. One can see that, as the deformation rate increases, the elastic limit rises more sharply than the tensile strength and meets it in the embrittlement zone. If the elastic limit is equal to the tensile strength, a spontaneous break occurs without noteworthy plastic deformation; the part breaks brittly. This is evidently not followed by an even decrease in the ultimate strain, but a sudden, steep drop at a certain expansion rate.
Many materials do not exhibit this pronounced embrittlement behaviour, at least at deformation rates normal in containment situations (bottom diagram), even though a rise in hardness is clearly observable. This makes these materials more suitable for containment rings. They include austenitic steels and superalloys. 13% Cr-steel doesn`t exhibit this steep drop, but its ultimate strain is comparitively low.

Figure "Containment clamping influence" (Ref. 8.1-7): At first glance, the minimum penetration speed increases linearly with the wall strength. The angle of this line can, however, vary depending on the materials (top left diagram). At first glance, the minimum penetration speed also increases with the tensile strength of the housing material.
It is interesting, then, that this does not apply to some superalloys at high temperatures (right diagram). This behaviour can be seen in connection with a hardness increase in the temperature zone in question and/or an increase in ductility.
A superficial observation could give the impression, that a completely built-in, “well-supported” housing wall would offer more resistance to a fragment than a flexibly hung wall. This is not true at high impact speeds.
The chart at the bottom shows the minimum penetration speeds of various structural materials with different fixings. The attachment conditions varied the flexibility of the sample. The less the sample could flex (white bar), the lower the penetration speed. The highest penetration resistance, i.e. the highest minimum penetration speed was exhibited by the samples affixed at only one side (black bar).

Figure "Housing damage by rotor rubbing": Even a blade fragment that upon impact does not place any serious strain on the housing can lead to a housing failure and escape.
Diagram 1 shows the moment a large blade fragment is thrown from a fan stage. It is then “run over” by the following blades. The untwisting of the leaves increases the radial length of the blades, causing them to bend and jam (right diagram). Thus, the housing is stressed by strong pulsing radial forces that ovalize it and jerk it forward.
The housing is subject to strong, self-strengthening vibrations (diagram 2) that increase until the rotor blades are subjected to extreme bending stress. This results in the failure of the entire rotor blading (diagram 3). In order to control this phenomenon, at the very least massive flange connections and a flex-resistant housing wall are necessary (Fig. "Containment behavior and design characteristics"). This damage sequence is avoided in nested housings (Fig. "Containment with 'nesting' in the fan area").

Figure "Cause of uncontrolled rotor speed": Evidently, the fragmentation of rotors as a result of uncontrolled overspeed is not completely avoidable, despite measures such as designing the rotor for safety at high overspeed and an accordingly designed regulator (Example "Misuse of engine leading to overspeed").
The case in point concerns a twin-shafted low-output helicopter engine with a gas generator and a free turbine. The mechanical regulator is powered by the free turbine through the main gearbox. When a gear “ahead of the regulator” breaks (bottom diagram), it registers a drop in RPM and tries to correct it by increasing fuel flow. Consequentially, the gas generator and free turbine reach overspeed, leading to a turbine disc failing in the gas generator.
This shows, how important to safe operation the location of the RPM measuring devices can be in exceptional cases.

Figure "Failing of 'redundant systems' by fragments" (Ref. 8.1-15, Example "Tail-mounted engine debris damaging empanage"): The hydraulic systems for setting the rudders and elevators were multiply redundant. However, they all failed due to the damage from the fan disk fragments. It is interesting, that the energy of fragments at a 33° angle of dispersion was sufficient to cause dangerous amounts of damage, although one would expect this to be relatively low (see Fig. "Fragments outside rotational plane").

Figure "Failing of thick cross sections by rubbing" (Ref. 8.1-16, see Example "Damage to disk hub caused by friction "):
In this shaft-power engine (top diagram), rubbing of a thin plate in the disk area (middle diagram) resulted in a disk failure.
Turbine disk failure as the result of a filigreed, thin (relative to the disk width) section of metal plating causing rubbing is a fairly typical damage sequence. This danger is often underestimated. Evidently, the plating behaves like a friction band saw, and is capable of splitting massive cross-sections. The bottom left diagram shows an integrally cast turbine disk from another engine that was caused to fail in a similar manner. In particular, membranous soldered constructions have been shown to cause this type of damage (Fig. "Damage of rotor disc by rubbing membrane"). In order to avoid this type of damage, appropriate constructive measures should be taken (Ref. 8.1-4, Ill. 8.2-21 and 8.2-22).

Figure "Production caused turbine disk failure" (Example "Flying engine debris bouncing off runway", Ref. 8.1-17): This case demonstrates, that a rotor fragment (bottom diagram) from an engine (“A”) can escape in such a way that it damages an engine on the other wing (“C”). In this case, the relatively small annulus fragment bounced off the runway (“B”). There have been other cases, however, in which engine failure during flight affected the other wing.