The Certification Rules Worked on A380
When we talk or think about engine failure, or practice for failure in the simulator, we are dealing with a loss of thrust. That’s certainly important. But the really critical turbine engine failures are uncontained fracture of the high speed rotors of the compressor and turbine sections of the engine.
There is so much energy in the centrifugal force of the spinning rotors that if something breaks, the engine literally explodes. Some time ago the FAA modified its certification criteria for turbine airplanes declaring that the energy of a failed high speed component of a turbine engine is infinite for certification purposes. That means airplane designers must allow for flying parts from an exploding engine to sever whatever is in their path.
In other words, no amount of shielding of the engine, or of aircraft structure and systems, can protect from an uncontained failure. The flying parts will tear through whatever is in their way, and the airplane must be able to continue on to a safe landing after an engine comes flying apart.
The only good news in this otherwise grim reality is that the path of exploding parts from a turbine engine is predictable. The same centrifugal force that imparts so much energy to the spinning components also directs them on a fairly narrow path called the rotor burst zone. The rotor burst zone is not the entire length of an engine, but the smaller area that contains the high speed, high pressure components. The zone is, obviously, annular, so it extends in all directions around the engine.
The fan on the front of turbofan engines, however, can be contained after a failure. The fan blades are much larger and heavier than the high pressure turbine and compressor blades, but the fan rotates much more slowly and thus has less destructive energy. For example, the high pressure section of the Rolls-Royce Trent 900 that exploded on the Airbus A380 spins at more than 12,000 rpm while the fan rotates at less than 3,000 rpm. Rotational speeds are higher in some engines, but the Trent 900 is so huge it doesn’t need the higher rpm.
The risk from a failed turbine is so great that some engine makers have tested new engines in a hole in the ground called a “spin pit”. If the test engine comes apart good old mother earth surrounds it to absorb the energy of the exploding components. Otherwise engine test stands are placed far away from anyone or anything that could be damaged by a failure.
The required certification tests for all turbine engines are stringent and the engine maker must demonstrate that an uncontained failure of the high pressure, high speed section is unlikely. Those required tests don’t, however, prove that such a failure can never happen. And that’s why airplane designers have to account for the worst.
The rules were not always so strict. For example, many jets that trace their certification roots back 30 or more years have all sorts of critical items smack in the middle of the rotor burst zone. Think of the business jets that have big fuel tanks right between the engines which would surely be ruptured or ignited by a rotor burst. Many jets have control lines and cables passing through the rotor burst zone. And also in the zone are single structural elements that could be severed if the worst happened.
But the A380 is a very recent design, and what happens if a rotor bursts was fully analyzed and accounted for. Flying parts from the engine pierced the wing and appeared to go all the way through, but the airplane flew safely on. No flight controls were lost, no primary structure compromised, and there was no fire. Also, the failed engine’s companion engine on the left wing survived.
It is tempting to call the safe landing of the A380 after such a massive uncontained failure a miracle, but it is actually the result of careful planning by certification authorities who said this is the worst that can happen, and you, Airbus, must demonstrate that the airplane can survive. And it did.
As an aside, the next time you are sitting close to a turbine engine and are clearly in the rotor burst zone, don’t think certification rules are being broken. Only people critical to the safe continuation of flight–the pilots, for example–can’t be in the burst zone.