On 17 April 2018, fan blade number 13 broke out of the left engine of a Boeing 737-700 over Pennsylvania. The engine did exactly what it had been designed and certified to do: the fan case caught the blade. By the letter of the regulation, the failure was contained.

Seventeen minutes later the aircraft was on the ground at Philadelphia with one passenger dead.

That gap — between a successful containment and a fatal accident — is the reason “uncontained” is the ugliest word in an engine manual, and the reason it is also one of the most widely misunderstood. Containment is a promise about one specific part. It is not a promise about everything inside the cowling, and it was never meant to be.

What “Contained” Actually Promises

The requirement sits in one sentence of Part 33, the American airworthiness standard for aircraft engines. Section 33.19, headed simply Durability, says that the design of the compressor and turbine rotor cases must provide for the containment of damage from rotor blade failure, and that the energy levels and trajectories of any fragments that do get out must be defined.

Read it again and notice what it does not say. It says blade failure. It does not say disc failure, hub failure or shaft failure. The containment case around a modern fan is a steel or composite ring engineered to absorb one blade leaving its slot at full speed and the violent imbalance that follows. It is not engineered to absorb the disc those blades are mounted in, and no case of a sane weight could be.

The proof is a destructive test that an engine manufacturer gets to perform exactly once per design. Section 33.94 requires two of them, in fact: the most critical fan or compressor blade is deliberately failed while the engine runs at maximum permissible rpm, and the most critical turbine blade is failed the same way. The blade has to let go at the outermost retention groove — or, for an integrally bladed disc, at least 80 per cent of the aerofoil has to break off.

The engine then has to keep running for at least fifteen seconds without catching fire and without tearing off its own mounts, unless the damage trips a self-shutdown. One of the two tests may be replaced by analysis, but only the one that produces the less severe imbalance, and only if the analysis is shown to be equivalent.

Fifteen seconds sounds short. It is not. A fan losing a blade at takeoff thrust goes from a balanced rotor to a violently eccentric one in milliseconds, and the loads that follow travel straight into the case, the mounts and the airframe behind them.

Blade-off and water ingestion certification testing, filmed by the engine makers themselves.

The Part Nobody Can Contain

The FAA’s own definition of the rotor is broad: the rotating components that analysis, test or experience shows can be released during an uncontained failure. In practice that means discs, hubs, drums, seals, impellers, blades and spacers.

Everything on that list except the blades is, for containment purposes, a lost cause. A turbine disc is a solid forging carrying every blade on its stage at rim speeds that can exceed the speed of sound, and it stores rotational energy on a scale that has no business inside a thin aluminium wing. When a disc cracks and bursts, the pieces do not slow down in the case. They go through it, through the nacelle, and through whatever is on the other side.

Part 33 does not pretend otherwise. Section 33.75, the safety analysis rule, lists seven outcomes that count as hazardous engine effects, and non-containment of high-energy debris is the first of them — ahead of uncontrolled fire, ahead of the engine falling off its mounts, ahead of being unable to shut the engine down at all.

Rather than ban it, the regulation prices it. Hazardous engine effects must be predicted to occur at a rate not greater than “extremely remote”, defined as a probability between 10^-7 and 10^-9 per engine flight hour, and compliance for any single failure mode is normally shown at 10^-8. The rule then adds, with unusual candour, that at probabilities of this order absolute proof is not possible.

That is the honest position of the whole system. Discs will occasionally burst. The job is to make it rare, and to make the aeroplane survive it when it happens.

Drawing the Danger Zone

If you cannot stop the pieces, you can at least work out where they go. That is the purpose of FAA Advisory Circular 20-128A, published on 25 March 1997 and still the reference document for the problem. Its title is a mouthful — Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and APU Rotor Failure — but its logic is simple.

Fragments leave a bursting rotor in a flat fan, close to the plane of rotation of the stage they came from. The AC defines a fragment spread angle measured fore and aft of that plane, starting at the shaft centreline, and gives the airframe designer a standard set of fragments to assume.

The headline fragment is a single one-third disc piece: a third of the bladed disc by mass, with one third of the blade height still attached, assumed to travel within a spread of just ±3 degrees. An intermediate fragment, one thirtieth of the bladed disc mass moving at rim speed, gets ±5 degrees. Small shrapnel up to the tip half of a blade aerofoil, and fan blade fragments, get ±15 degrees. An alternative model folds the first two together as a one-third disc piece spread over ±5 degrees.

Those narrow angles are the designer’s one piece of luck. A ±3-degree wedge is a thin slice of aeroplane. If the hydraulic lines, the fuel feeds and the flight control runs can be routed outside it — or at least separated so that one fragment cannot take two redundant systems at once — the aircraft has a chance.

What the Airframe Is Asked to Do

The matching airframe rule is 14 CFR 25.903(d)(1), and it is a single sentence of careful wording: design precautions must be taken to minimize the hazards to the aeroplane in the event of an engine rotor failure, or of a fire inside the engine that burns through the case.

Minimize. Not prevent, not preclude. The advisory circular explains why in terms nobody in the industry has ever improved on.

The precautions themselves are mostly geometry and bookkeeping. Keep critical components out of the impact areas. Where that is impossible, separate duplicated systems by at least the dimension of the half-blade fragment. Put dry bays or shielding under fuel tanks that sit above an engine and inside the one-third disc and intermediate fragment zones. Arrange things so that a single one-third disc fragment cannot cause a loss of fuel that prevents the flight being completed, and cannot take out enough of the flight controls to lose the aeroplane.

The AC also carries the statistics that motivated it, and they are worth quoting with their date attached. Across 28 years of fixed-wing commercial service from 1962 to 1989, the Society of Automotive Engineers logged 676 uncontained events in 1,089.6 million engine operating hours. Ninety-three of those caused significant damage with the aircraft still able to land safely. Fifteen caused severe damage — a crash landing, critical injuries, fatalities or a hull loss. Engines have improved enormously since 1989, and that dataset should never be quoted as a current rate; what it establishes is the shape of the problem, not today’s numbers.

The classic demonstration of what happens when the geometry does not save you came on 19 July 1989, when the stage one fan disc of the tail-mounted CF6 on a United DC-10 burst over Iowa. The fragments cut the lines of all three independent hydraulic systems, which were routed through the same part of the tail. More than a third of the 296 people on board died at Sioux City. Every wide-body built since has had to answer for that routing.

Philadelphia, 2018: Contained, and Still Fatal

Southwest Airlines flight 1380 is the case that shows the limit of the word. The CFM56-7B on the left wing has 24 fan blades. Number 13 fractured at its dovetail root from a low-cycle fatigue crack, and the fan case did its job: the blade did not come out through the side.

What came out went forward. Fragments of the blade travelled into the inlet, and the local deformation of the fan case travelled around and along it into the inlet attach ring. Parts of the inlet departed the aircraft. Meanwhile the blade’s impact fed enormous loads into the fan cowl through a radial restraint fitting at the bottom of the inboard cowl, cracking the cowl skin and frames until the three latch assemblies joining the cowl halves let go.

One recovered piece, the inboard fan cowl aft latch keeper, matched impact damage and witness marks on the fuselage beside the missing window at row 14. The window departed, the cabin decompressed explosively, and one passenger was killed. Of the 144 passengers and 5 crew on board, eight others were injured. The aircraft landed at Philadelphia about 17 minutes after the failure.

Here is the number that matters most, and it is the reason this accident changed how engine and airframe people talk to each other. The certification blade-off tests had indicated a fan blade tip exit trajectory of 15 degrees, and the inlet was designed and certified against that figure. Post-accident examination put the real trajectory at between 15 and 30 degrees. The mid-span fragments had never had their exit trajectory defined at all, because the blade tip was assumed to carry more energy.

Nothing in the engine certification was violated. The blade was contained. The model of what a contained blade does to the structure wrapped around the engine was simply not conservative enough.

The crack had probably been there since before the blade set’s overhaul in October 2012, when a fluorescent penetrant inspection failed to find it. After a similar fan-blade-out event on another Southwest 737-700 in August 2016, which landed safely at Pensacola, CFM developed an eddy current inspection for overhaul and an on-wing ultrasonic technique for use at blade relubrication. Between them, by August 2019, those methods had found 15 cracked blades on other engines.

Batam Island, 2010: What a Real Disc Burst Looks Like

For the genuine article, go to Qantas flight 32. On 4 November 2010, climbing through 7,000 feet out of Singapore, the number 2 Rolls-Royce Trent 900 on an Airbus A380 suffered what the Australian Transport Safety Bureau calls, in plain regulatory language, an uncontained engine rotor failure.

The ATSB found that a number of oil feed stub pipes in the high-pressure/intermediate-pressure hub assembly had been manufactured with thin wall sections that did not conform to the design specification. The thin wall significantly reduced the life of the pipe in that particular engine, a fatigue crack developed, oil escaped in flight, and an internal oil fire followed. The fire led to the intermediate pressure turbine disc separating from its drive shaft. Freed of its load, the disc accelerated and burst.

Pieces of it went out through the nacelle and into the wing. The A380 landed back at Singapore and the ATSB records the highest injury level as none.

Put the two accidents side by side and the lesson is uncomfortable. The contained failure killed someone. The uncontained one did not. Containment is a design requirement about a single class of part; it is not a prediction about outcomes, and treating it as one is how a certification basis quietly drifts away from reality.

An analysis of the Qantas 32 uncontained failure and the damage the disc fragments did on their way out.

Why the Word Still Matters

Engineers care about the distinction because it tells them which rule applies. A blade event is an engine problem, tested on a rig, proven once, closed. A disc event is an aeroplane problem, analysed in wedges and zones, never fully closed, and revisited every time somebody routes a hydraulic line.

The Trent 900 blade-off test: the same engine family that lost a disc over Batam Island, proving on the rig that it could hold a blade.

Passengers reading an accident report should care for a different reason. “The failure was contained” is not a reassurance that nothing escaped. It is a statement that one specific requirement was met. Philadelphia is the proof that the two are not the same thing, and the inlet trajectory numbers are the proof that even a met requirement can be built on a model that reality later corrects.

The 1997 advisory circular said it first and said it best: it is unlikely that uncontained rotor failures can be completely eliminated. Everything downstream of that sentence — the dry bays, the separated hydraulic runs, the ±3-degree wedge drawn through somebody’s wing — is the industry agreeing with it and designing accordingly.

Sources: 14 CFR 33.19, 33.75 and 33.94, and 14 CFR 25.903, via the Electronic Code of Federal Regulations; FAA Advisory Circular 20-128A (25 March 1997); NTSB Aircraft Accident Report NTSB/AAR-19/03, Southwest Airlines flight 1380; Australian Transport Safety Bureau investigation AO-2010-089, Qantas flight 32.