runaway engine on B737

[NAIA91]

In the B737-800 sim we practiced with a runaway engine,has any one of you ever heard of one of those incidents and how this could actually happen? I thought it was a pretty remote chance of ever happening in the real world.
Thanks for any thoughts on this.

Greets Bas

[tdracer]

Originally Posted by NAIA91

In the B737-800 sim we practiced with a runaway engine,has any one of you ever heard of one of those incidents and how this could actually happen? I thought it was a pretty remote chance of ever happening in the real world.
Thanks for any thoughts on this.

Greets Bas

It's known as "UHT" - Uncontrolled (or Uncontrollable) High Thrust. Rare, but it happens (worldwide, ~ 1 per 10,000,000 flight cycles. Lots of potential causes, but the most likely/common is the FADEC losing control of the Fuel Metering Valve and the valve going wide open. If you're "up and away" it's generally not a big deal and you can shutdown the affected engine, but during final approach and on the ground it can get pretty exciting.
I'm aware of only one hull-loss accident due to UHT - a 737-200 roughly 25 years ago (memory is fuzzy if it happened in Egypt or it was an Egyptian operator) - during TO power set, the N2 shaft speed input into the (hydromechanical) fuel control stripped - the control took that as an N2 underspeed and opened the fuel metering valve wide open. Crew elected to abort when they couldn't maintain directional control due to the asymmetric thrust - but due to the failure the engine didn't respond when the thrust levers were retarded and they went off the side of the runway. Subsequent fire destroyed the aircraft but everyone got off without serious injury.
Since this is a single failure, the regulators decided that UHT violated the 'no single failure shall result in an unsafe condition' provision of 25.901(c) - since every aircraft out there has single failures that can result in UHT it made the worldwide fleet non-compliant
Once it became apparent that it was not something that could be addressed in the existing fleet, the regulators granted a 'partial exemption' to the 25.901(c) requirement for already certified aircraft, but all new certs need to address the issue - either by providing compliance, or demonstrating why it's impractical to provide full compliance and hence get the existing exemption extended to the new cert.
New designs need to address UHT - Boeing came up with something called "TCMA" - Thrust Control Malfunction Accommodation. In simple terms, if (while on-ground) TCMA detects an engine either going to high thrust uncommanded, or staying at high thrust after idle has been selected, TCMA will shutdown the engine. TCMA is only active on-ground, since a nuisance TCMA trip could potentially shutdown all the engines which would be obviously really bad in-flight.
The 787, 747-8, and 737 MAX all have some version on TCMA. Airbus uses something different to achieve the same goal, but I don't know the details.

[NAIA91]

Originally Posted by tdracer

It's known as "UHT" - Uncontrolled (or Uncontrollable) High Thrust. Rare, but it happens (worldwide, ~ 1 per 10,000,000 flight cycles. Lots of potential causes, but the most likely/common is the FADEC losing control of the Fuel Metering Valve and the valve going wide open. If you're "up and away" it's generally not a big deal and you can shutdown the affected engine, but during final approach and on the ground it can get pretty exciting.
I'm aware of only one hull-loss accident due to UHT - a 737-200 roughly 25 years ago (memory is fuzzy if it happened in Egypt or it was an Egyptian operator) - during TO power set, the N2 shaft speed input into the (hydromechanical) fuel control stripped - the control took that as an N2 underspeed and opened the fuel metering valve wide open. Crew elected to abort when they couldn't maintain directional control due to the asymmetric thrust - but due to the failure the engine didn't respond when the thrust levers were retarded and they went off the side of the runway. Subsequent fire destroyed the aircraft but everyone got off without serious injury.
Since this is a single failure, the regulators decided that UHT violated the 'no single failure shall result in an unsafe condition' provision of 25.901(c) - since every aircraft out there has single failures that can result in UHT it made the worldwide fleet non-compliant
Once it became apparent that it was not something that could be addressed in the existing fleet, the regulators granted a 'partial exemption' to the 25.901(c) requirement for already certified aircraft, but all new certs need to address the issue - either by providing compliance, or demonstrating why it's impractical to provide full compliance and hence get the existing exemption extended to the new cert.
New designs need to address UHT - Boeing came up with something called "TCMA" - Thrust Control Malfunction Accommodation. In simple terms, if (while on-ground) TCMA detects an engine either going to high thrust uncommanded, or staying at high thrust after idle has been selected, TCMA will shutdown the engine. TCMA is only active on-ground, since a nuisance TCMA trip could potentially shutdown all the engines which would be obviously really bad in-flight.
The 787, 747-8, and 737 MAX all have some version on TCMA. Airbus uses something different to achieve the same goal, but I don't know the details.

Thanks a million for this great and complete answer!

[megan]

Had it occur twice in helicopters with hydromechanical systems, governor drive shaft snapped in one, power had been wildly fluctuating prior to complete failure (in flight), the other don't know reason - ice in FCU suspected (on ground throttles fully open).

[tdracer]

Originally Posted by NAIA91

Thanks a million for this great and complete answer!

You're welcome - had to spend way too much time addressing UHT in my pre-retirement days .
Curious, what was the nature of the UHT they hit you with in the sim? I assume on-ground or final approach?

[jimjim1]

I happened to hear of one such incident the other day. Occurred April 2010. A330.

Stuck fuel control system due to contaminated fuel. Salt water in the fuel unexpectedly degraded fuel filter material and the resultant debris caused one engine to fail and the other to become stuck at high thrust. Landed successfully but the consequent brake fire resulted in an evacuation.

https://skybrary.aero/accidents-and-...ong-china-2010

You Tube

[172_driver]

Curious, what was the nature of the UHT they hit you with in the sim? I assume on-ground or final approach?

Not going to speak for the OP but for me an engine runaway has been one of the typical engine malfunctions, often during take off past V1, together with flameout, engine overheat or fire, engine seizure, turbine failure, engine surge. Our sim seem to simulate the problem exactly the same way everytime, EGT and N2 off the scale, fuel flow in excess of 6000 kg/hr. Sounds realistic? The debrief often involves a discussion about how to treat that particular malfunction, shut down the engine by memory or not. I have always wondered how far you’d be from an engine completely disintegrating and think shutting it down asap seems like a good idea. Should I be concerned?

[tdracer]

Originally Posted by 172_driver

Not going to speak for the OP but for me an engine runaway has been one of the typical engine malfunctions, often during take off past V1, together with flameout, engine overheat or fire, engine seizure, turbine failure, engine surge. Our sim seem to simulate the problem exactly the same way everytime, EGT and N2 off the scale, fuel flow in excess of 6000 kg/hr. Sounds realistic? The debrief often involves a discussion about how to treat that particular malfunction, shut down the engine by memory or not. I have always wondered how far you’d be from an engine completely disintegrating and think shutting it down asap seems like a good idea. Should I be concerned?

At least in the case of Part 33 certified engines (which is all you see in Part 25 certified commercial aircraft), turbine engines are required to have some sort of independent overspeed protection system. The exact nature of the overspeed protection is highly engine dependent, but fall into two categories - hydromechanical (basically flyball type), or electronic. Electronic systems always made me a bit nervous - one of the ways you can get an uncontrolled overspeed is an overheat of the FADEC which can cause it to lose control of the fuel metering valve - it's a cert requirement that the engine company show that the electronic overspeed protection stay healthy to a temperature enough higher than the FADEC to insure it doesn't also get taken out by the overheat - but it's still a potential common failure mode (electronic overspeed protection is typically co-located in the FADEC 'box' but physically and electronically isolated). Electronic overspeed protections typically work for all rotors, mechanical systems usually only apply to the high speed rotor - so when mechanical systems are used, it must be shown that at the high rotor overspeed set point, the low rotor(s) will remain below the burst speed (there is a separate cert requirement for rotor burst speed - memory says it's 20% over redline but don't hold me to that).
Hydromechanical overspeed systems typically hold the rotor at the set speed (slightly over redline), electronic overspeed systems typically just command the fuel metering valve full-closed (depending on the engine, that can be he min-flow stop or zero fuel flow).
In addition to all that, in the takeoff envelope, most turbine engines won't exceed redline rotor speeds even with a wide open fuel metering valve - the aero loads are simply too high. It's a different story at altitude. You didn't mention the engine/aircraft type, but N2 off the scale during takeoff is more likely to a stator vane malfunction (i.e. going closed - which will cause N1 to drop and N2 to rapidly increase) than a fuel metering valve issue.

So the short answer is, there is a lot of protection to prevent UHT from resulting in an overspeed - by itself - from resulting an uncontained failure. So it makes sense to deal with UHT during takeoff in a thoughtful, rational manner instead of panicking and doing something stupid (like shutting down the wrong engine).

[172_driver]

It’s a 737NG with CFM56 simulator. I found a picture what it looks like.

[tdracer]

Ok, not too familiar with the specifics of the CFM56-7 series engine, but I'd be a little surprised if those N1 and N2 numbers are a realistic scenario anywhere near sea level - the aero loads of producing those rotor speeds (and that much thrust) would be so high that you couldn't get there even with a failed wide open fuel metering valve.
I know that for the GEnx-2 (747-8), we couldn't get to redline N1/N2 at sea level with a wide open fuel metering valve - IIRC correctly you had to be above 6,000 ft. to get to redline N2, we couldn't get redline N1 anywhere in the takeoff envelope. Further, if memory serves, the CFM56-7 series uses a hydromechanical flyball style N2 overspeed protection, so not only would the FADEC need to lose control of the fuel metering valve (or go crazy and command it wide open), the independent N2 governor would need to fail - an extremely unlikely dual failure scenario.

Not saying you couldn't experience UHT on the 737NG, just saying that specific scenario shown not realistic.
BTW, I believe the CFM56-7//737NG was the last new engine installation we certified at Boeing that did not have any sort of TCMA protection.

[172_driver]

Thanks for that td.
In the sim you just have to play the game.

[safetypee]

"One of the typical malfunctions"; i.e. it is selected for training because it is available in the simulator, but not necessarily in proportion to the inservice risk.
If so then a safety issue is the possibility of biasing crew behaviour by choosing a rare event, and one where the frequency or simulated indications may not match the real world; e.g. takeoff vs cruise.
Defining risk as a threat severity x frequency; then practicing the malfunction at a higher frequency than reality generates a false sense of risk.
This was an issue way back in the days of PCM+ICR.

Refs: 'Indications of Propulsion System Malfunctions—Sustained Thrust Anomaly Study' 2007
https://www.tc.faa.gov/its/worldpac/techrpt/ar0615.pdf
"Currently, a propulsion system malfunction (PSM) occurs about once every 20,000 flights on Western-built commercial transport turbojet aircraft. Historically, on such aircraft, PSM plus inappropriate crew response (ICR) events number two to three per year in revenue service. From 1958 to 1995, a PSM+ICR event occurred about once every 4 million flights, and a fatal PSM+ICR event occurred about once every 26 million flights. The rate of occurrence per airplane departure for PSM+ICR accidents has remained essentially constant for many years. These accidents are still occurring despite the significant improvement in propulsion system reliability over the past 20 years, suggesting an increase in rate of ICR to propulsion system malfunction."
Overspeed malfunction #27, p2-35 , item 5 fig 2-17 p2-59, 60
Human Factors 4-15 …

'Indications of Propulsion System Malfunctions' 2004
https://www.tc.faa.gov/its/worldpac/techrpt/ar03-72.pdf
N.B fig 4-8 and prob tables p3-36 …
"Only about 1% of powerloss/engine failure events involve failure to a high-thrust conditions" p4-29

PCM+ICR
https://skybrary.aero/sites/default/...shelf/1623.pdf 1998

Evidence Based Training ?
Evidence of improved skills in assessment and management, or evidence of events from the real world.