Many things can cause the in-flight failure, or flame out, of an aircraft engine. Anything from icing to bird strikes, failure to put enough fuel in the tanks (hellooo, Air Canada), or a structural turbine failure (stand up, Pratt & Whitney).

During the time I spent at ATC college, the topic of emergencies was covered in some depth. The importance of knowing the aircraft type when an emergency is declared was impressed upon us, more so on some who didn't immediately grasp that an engine failure is potentially far less serious for a Boeing 747, which has four engines, than it is for a Piper Cherokee, which only has one. Was this noder included in such admonishment? Not telling.

The potential ambiguities in language used during emergencies was also mentioned; such language should be carefully checked, we were told, particularly considering the high stress levels such a situation can provoke. More than one airliner has been lost because engines literally fell off, and the pilots' report to ATC that they had "lost" said engines was interpreted merely as them failing, since the vernacular is, rather inconveniently, the same.

After wanting to node one incident in particular—and I'll leave it to you to guess which one it was—and after my writeup with 'survived' in the title, I got thinking about flights that had suffered in-flight engine failures and still made it home. Some of those must have been pretty unusual, right? Yes, it turns out. In the interest of some semblance of structure, perhaps we should go through the incidents in ascending number of engine failures per aircraft, in a sort of inverse countdown, before we reach our winner with the greatest number. A combustion failure compendium. A fascicle of flame-outs. A shock of shutdowns. An engine failure hit parade, if you will.

I'm trying to keep this fairly light, so those familiar with their air disasters will probably find many incidents missing from this writeup. I'm generally sticking to the ones that didn't kill anyone.

Single engine failure

Pah. Small potatoes. Yes, lots of single-engined aircraft—and some multi-engined aircraft—have been lost to a single engine failure, boo hoo hoo, but they're way down on this list of morbid prestige. I'd be here all day listing examples proportionally. If you absolutely insist, however, here's an interesting example of a single engine failure; an unusual capturing of a bird ingestion by a Boeing 757 at Manchester Airport (Ringway), complete with dialogue between the pilots and ATC.

Off the top of my head, at least one heavy—a DC-10—has been lost to an engine literally falling off, and several 747s have had nasty moments as a result of the same. Part of the problem there is that the engines of a jetliner are difficult or impossible to see from the cockpit, so it's not always obvious whether you've lost an engine or lost an engine. An engine can severely damage an aircraft when detaching so knowing what's happened is critical, but it can be difficult for the crew to tell. Especially if the aircraft is a freighter with no windows besides those in the cockpit.

Coincidentally, Japan Airlines Flight 46E was a Boeing 747 freighter. It departed Anchorage for O'Hare on March 31, 1993. Shortly after takeoff and passing through 2,000 feet it flew through severe turbulence, experienced an uncommanded left bank of about 50° and airspeed fluctuations between 170 knots and 245 knots, which is quite high for that altitude. Moments later the #2 engine fell off, taking a large chunk of the flaps for that wing with it.

Despite severe control problems, exacerbated by the turbulent weather, the crew were able to land the aircraft safely, unaware an engine had detached. The subsequent investigation concluded that turbulence had exceeded the lateral load capacity of the engine pylon, which was already weakened by fatigue cracks.

In other happy fun times, passengers going to the toilet has caused an engine to fall off at least three Boeing 727s in flight, and caused an engine shutdown on two others. In all cases the blame was laid on ice accumulating around a service panel on the fuselage near the outlet for the cabin lavatory. The ice broke away in-flight and was ingested by one of the engines, which on the 727 are all at the rear. In three cases the subsequent, dead stoppage of the turbine resulted in the engine wrenching itself off the fuselage. However, all aircraft landed safely without injuries, and the NTSB issued a safety recommendation to improve panel seals that (eventually) resulted in Airworthiness Directives from the FAA, so it's all good.

Thinking about the whole are-all-my-engines-present thing, it's interesting to consider AAL191 - the DC-10 that crashed after an engine detaching. Simulator tests done after the mishap found that even experienced pilots were unable to recover from the conditions of the incident if they went in blind; only pilots that knew an engine had separated from the wing took the correct actions to recover.

Double engine failure

A little more interesting; Boeing, Airbus, Gulfstream, Embraer and several other 'factors all have hundreds, if not thousands of twinjets in service, many of which have suffered in-flight engine failures for one reason or another.

Again, even restricting to the "interesting" incidents would probably exceed the writeup character limit so here's just a few of them.

Pinnacle Airlines Flight 3701

This was a ferry flight of a Bombardier CRJ-200 from Little Rock to Minneapolis on October 14, 2004. With no passengers and a quiet night flight ahead, the pilots decided to try to join the ranks of those who had taken the CRJ-200 to its maximum cruising altitude of Flight Level 410 (about 41,000 feet). Although successful, in doing so they exceeded the aircraft's maximum climb rate, and stalled it when they got there by flying too slowly. This shouldn't have been much of a problem since they were at 41,000 feet with plenty of air beneath them in which to recover; unfortunately they overrode the anti-stall mechanism that would have nosed down to gain some airspeed, and overstressed the engines by trying to maintain altitude which eventually resulted in both engines flaming out.

Despite six attempts to relight the engines—using both the auxiliary power unit, and the windmill method, involving a dive to increase speed so the airflow rotates the engines fast enough to relight them—neither engine rotated at all, suggesting that expansion damage incurred by the overheat and abrupt shutdown had seized both engines completely.

Although the crew initially recovered from the stall, the fact that they were unable to relight either engine meant that aircraft systems which depended on the engines for power, such as the cabin pressurization systems and the hydraulics, ceased operating. The crew had to don oxygen masks and deploy the ram air turbine (a small turbine generator which pops out from the fuselage) in order to power the flight controls.

Only after 14 minutes of failed attempts to restart the engines—and a concomitant loss of almost 30,000 feet—did the crew finally report to ATC that both engines had failed. The amount of altitude lost in the attempts to restart the engines left the aircraft with insufficient altitude or speed to reach any diversion airfields and it crashed outside Jefferson City, killing both crew members.

The investigation blamed unprofessional behaviour by the pilots for causing the initial upset, and failing to properly follow the engine restart procedures or to prepare for an emergency landing.

Air Canada Flight 143

This was a Boeing 767 on a flight from Montreal to Edmonton on July 23, 1983. The aircraft ran out of fuel in cruise at 41,000ft which resulted in the flameout of both engines in the space of a few minutes. The 767 was one of the first aircraft to use the Electronic Flight Information System (EFIS), which informed various cockpit display systems typically depended on for safe flight. An engine failure left most of these displays dead, and likewise the flight control systems. The ram air turbine was deployed, which gave a measure of flight control, and some rudimentary instrumentation did remain, which could be used to effect a landing.

Although the crew was diverting to Winnipeg after the failure of the first engine, the failure of the second left them unable to reach it, and moreover there was no documentation in the cockpit on flying the aircraft with no engines. Fortunately the captain was an experienced glider pilot, and with the help of ATC calculated that he could reach a former airbase at Gimli that he used to fly from.

Unfortunately, the lack of hydraulics meant that not only could the flaps and slats (devices which increase lift and drag in low-speed situations) not be deployed, but that the landing gear could not be locked into position either. The relatively low speed of the aircraft as it approached the landing strip—which was being used for public drag racing that day—meant that the power being produced by the ram air turbine was decreasing, making the aircraft more difficult to control. However, it was still too fast for a safe landing, and without sufficient altitude to circle to bleed off airspeed. After executing a forward slip manoeuvre, the 767 landed roughly on one of the airfield runways, thankfully avoiding anyone on the ground, who would not have heard its approach.

The unlocked nosewheel collapsed on landing and a small fire started in the nose area, but this was quickly put out after the aircraft had come to a stop, by safety personnel attending the racing events at the airfield. The only injuries occurred during the evacuation from the tail section, which was high in the air because of the collapsed nosewheel.

The investigation, while praising the airmanship of the crew in landing the aircraft safely, also criticized them and the maintenance staff of Air Canada for failing to correctly allocate the task of checking the aircraft's fuel load; this would normally have been done by the aircraft's flight engineer, but the 767 was the first jetliner to eliminate this position. Canada was transitioning from the imperial to metric system of measurement at the time; although fuel quantity had been correctly calculated in kilograms, it was metered in pounds when the aircraft was fueled, which gave less than half the amount actually required. The Captain was demoted for six months, and the First Officer and three maintenance workers were suspended.

The aircraft suffered only minor damage during the landing, and after repairs continued to fly for Air Canada (with the informal nickname "Gimli Glider") until 2008, when it was retired to the Mojave Desert.

British Airways Flight 038

You have probably heard of this one, which occurred in January 2008; it is notable because it resulted in so far the only first hull loss of a Boeing 777, which is the largest twin-engine jetliner in service (also the proud carrier of the most powerful jet engines ever fitted to anything, fact fans).

During final approach to London Heathrow Airport, after a 13-hour flight from Beijing, Boeing 777 G-YMMM suffered an "uncommanded rollback" of both engines simultaneously, two miles from touchdown at 720 feet. The autopilot attempted to maintain the correct glideslope by pitching up and increasing the throttle but both engines failed to respond, and the aircraft hit the ground 200 feet short of runway 27L. The impact collapsed the landing gear, forcing the right strut up into the passenger cabin and the left strut into the wing, puncturing one of the fuel tanks. Although several passengers were injured during the incident—including a compound fracture caused when the left landing gear strut entered the cabin—there were no fatalities or fire, and the aircraft was successfully evacuated.

After an investigation lasting almost two years, the UK Air Accidents Investigation Branch, though unable to precisely replicate the failure conditions of the incident, concluded that ice had formed on a fuel-oil heat exchanger, which had restricted fuel flow and caused the rollback. The aircraft had encountered unusually cold conditions during its flight, which had caused a high volume of ice crystals to form in its fuel (small quantities of water are normally present in jet fuel). Following the investigation both the AAIB and the American NTSB requested a redesign of the offending heat exchanger from Rolls Royce, which manufactured the engines fitted to G-YMMM, and Boeing has issued guidelines for pilots to prevent and deal with such blockages on 777 until the parts are replaced.

All of BA38's flight crew were awarded the British Airways Safety Medal after the incident, and the aircraft has now been broken up.

Triple engine failure

We're getting into unusual territory now, so this definitely warrants the raise of both eyebrows.

Eastern Airlines Flight 855

This was a Lockheed L-1011 (aka 'Tristar') tri-jet on a flight from Miami to Nassau. 54 miles from destination, during descent for landing, the oil pressure warning light for #2 engine (the one in the tail) lit. The crew immediately shut down the engine. This is nominally no problem; all multi-engined aircraft are required to be able to fly for a minimum amount of time if an engine fails (the exact amount depends on where the aircraft is flying, and the aircraft type). So while less efficient, the Tristar should still have been able to make it to Nassau on two engines. However, weather was severe at Nassau at the time and although it was over twice the distance, the crew decided to turn back to Miami, guessing they could be on the ground sooner.

Less than ten minutes after #2 engine had been shut down, oil pressure warnings lit for engines #1 and #3. Considering the teeny chances of losing oil for all three engines at the same time, the crew assumed that the indicator lights were faulty and in the words of the Captain were "only slightly alarmed." After some system checks showed everything to be normal, and after engine #3 seized completely about five minutes later, they presumably became slightly more alarmed. With only one engine left, and evidence suggesting little time remained before it went the same way as the others, preparations were made for ditching in the Atlantic.

Just over half an hour after takeoff, having descended to 13,000 feet, engine #1 finally let go. There was no chance of gliding back to land from this altitude, and the crew began frenzied attempts to restart engine #2. Repeated attempts at the in-flight engine restart procedure failed, and in a (hah) last-ditch effort, the ground start procedure was tried, which finally brought #2 engine back to life, just 3,000 feet above the ocean and 34 miles from Miami. One engine was at least enough for level flight, and the aircraft was able to land safely, after which engine #2 failed again, stranding them on a taxiway.

When the crew got off the plane they were met by a foreman from line maintenance, who knew exactly what had happened: working on the aircraft the previous night by torchlight and car headlamps (seriously), two mechanics had fitted sensors to all three engines without fitting oil seals, which had allowed oil to leak out when the engines were running. Engine #2 had less than one minute of oil left after landing.

American Airlines DC-4

This doesn't strictly belong in this writeup, but I'm including it because I don't know what other topic it could come under, and because it amused me.

In October 1947, an American Airlines DC-4 was making a hop from Dallas to Los Angeles. Along with the two Captains, a third was also hitching a ride in the cockpit in the jump seat. This guy thought it would be a great joke to engage the aircraft's gust lock in flight without telling the other two Captains.

What does the gust lock do? It locks the aircraft's control surfaces (elevators, ailerons, what have you) in position so that they won't flap around in the wind when the aircraft is on the ground. Yes, you can probably already see that engaging this in-flight was a cerebral move.

The effect of this, aside from the obvious of making the aircraft almost impossible to control, is that it reversed the effect of the trim controls. If you've ever looked at the ailerons, elevators or rudder on an aircraft you might have noticed that there was a baby, nested version of each control surface. Like this:

         ______
        /      |
       /  +----+
      /   |    |
     /    |  +-+
    /     |  | |
   /      |  | |
  /       |  +-+
 /        +----+

The baby control surface is the trim tab for the control surface it's mounted on. Its position is adjusted using a small wheel in the cockpit, and it can apply a constant force to the control surface it's attached to. This is used to maintain straight and level flight; for instance, the weight balance of an aircraft might mean that it tends to nose up slightly when in flight; the trim can be adjusted so that the elevators always counteract this tendency without the pilot having to keep constant pressure on the control column.

Now, trim tabs move in the opposite direction to their effect: if the trim tabs on the elevators are raised, the aircraft will 'try' to pitch down. If the trim tab on the right aileron is lowered, the aircraft will 'try' to roll to the right. This is important.

So, back in the DC-4, the flying Captain noticed that the aircraft seemed to be resisting his control and trim inputs. The reason? The main control surfaces were locked in position, meaning that the trim tabs had in effect become the main control surfaces, so their effect was reversed. The more the crew tried to trim the aircraft for a descent, the more it climbed. Not only that, but the more trim that was being applied, the greater effect it was 'trying' to have on the main control surfaces.

So it was just awesome when the jump seat Captain decided to disengage the gust lock, again without telling either of the pilots. He hit the switch, the elevators snapped to their maximum pitch-down position, and the aircraft immediately went into a steep dive. Neither the flying Captain nor the jump seat Captain had their seatbelts fastened, and they were flung into the cockpit ceiling as the aircraft began making an outside loop.

I guess you're wondering where engine failure comes into all this...well, it turns out three of the DC-4's four piston engines were feathered (cutting their thrust to virtually zero) when the heads of the unbelted Captains hit three of the four 'engine feather' switches on the cockpit ceiling. So while not quite a failure, it wasn't exactly a deliberate power reduction either.

This was actually quite good, since a dive at full power would almost certainly have resulted in the aircraft disintegrating mid-air before crashing into the desert beneath it. As it was, the Captain acting as First Officer, who was strapped in, was able to restore power and right the aircraft when it reached the upside-down portion of the loop, before making a prompt emergency landing. The passengers escaped with a few minor injuries from being similarly hurled against the cabin roof.

Needless to say, the jump seat Captain didn't fly for American again after that.

National Airlines 727

I'm including this one in a nod to the more usual. On January 27, 1978, a Boeing 727 tri-jet was making a trip from Newark to Fort Lauderdale, when all three engines flamed out during cruise, in the vicinity of Orlando. There is little narrative available on this incident so I don't know what happened next, or how long it lasted.

It turned out that the flight engineer had accidentally switched off the fuel pumps for all three engines, causing fuel starvation and flameout. The mistake was discovered and the flight continued without further incident, landing safely at Ft. Lauderdale. Oops.

Quadruple engine failure

We're getting into heavy territory now—literally, since only aircraft in the 'heavy' wake vortex category have four engines, and it's rather difficult to find details on multiple engine failures, which fewer-engined aircraft would need to reach this category.

KLM Flight 867

This was a Boeing 747-400 on a flight to Narita International Airport from Amsterdam on December 15, 1989. While descending for a scheduled stop at Anchorage, the aircraft flew through the ash cloud from the eruption of Mount Redoubt. The pilot reported the cloud to ATC, but evidently its spread was greater than it seemed, since he subsequently reported smoke in the cockpit. After turning and attempting to climb to get out of the cloud, all four engines on the 747 shut down.

After an unplanned descent of about 14,000 feet, punctuated by frantic attempts to relight the engines, the aircraft broke out of the cloud and the crew was able to get the engines restarted. The aircraft landed safely, with no injuries, but about $80 million worth of damage. Volcanic ash is extremely abrasive and most of the aircraft's leading edges, and engines, had to be repaired or replaced.

United Airlines Boeing 747

Again, back in slightly-less-weird world, a UA Boeing 747 (registration N4761U, if you want to look it up) in cruise at 39,000 feet en-route from San Francisco to Honolulu, suffered a complete failure of all four engines. Sadly I couldn't find a narrative of what happened next, but according to the NTSB it decended 13,000 feet towards the Pacific before the engines were successfully relit.

Usefully, the 'probable cause' section of the NTSB report reads: POWERPLANT FAILURE FOR UNDETERMINED REASONS. Phew. I was worried there'd be nothing that could be done to avoid it happening again.

Well, sadly we're drawing to the close of this little round-up. That just leaves...

Quintuple engine failure

British Airways Flight 009

We have a winner! This was a Boeing 747-200 on a flight from London to Auckland, on June 24, 1982. But wait! you say. The 747 only has four engines! Yes, but I'm counting engine failures, not engines.

Approaching Indonesia from the Indian Ocean, cruising at 37,000 feet, the flight crew noticed a St. Elmo's Fire-like effect on the cockpit windscreen, and a smell of sulphur. Smoke was also seen gathering in the passenger cabin. Nothing was on the aircraft's weather radar. Passengers in the cabin could see light coming from inside the engines.

A couple of minutes after this began, engine #4 (right outboard) began surging and flamed out. About a minute later, the other three engines died in the space of a few seconds, prompting probably the most famous cabin announcement in commercial aviation history:

Ladies and gentlemen, this is your Captain speaking. We have a small problem. All four engines have stopped. We are doing our damnedest to get it under control. I trust you are not in too much distress.

The crew declared an emergency, advising Jakarta air traffic control that all four engines had failed, but this was misunderstood to mean only engine #4 had failed. The crew calculated the aircraft could only glide about 90 miles, and a minimum altitude was needed to cross the coastal mountains of Indonesia safely; if this was not achievable, the crew would turn the plane around and attempt to ditch in the Indian Ocean (which, to date, would have been the only time this had been attempted in a 747).

As the aircraft descended, many unsuccessful attempts were made to restart the engines. While this was going on the passengers reported seeing streams of flame, disturbingly, trailing from all four engines. Many assumed they were going to die and wrote messages to their loved ones.

As the aircraft approached the altitude at which the crew would have to turn around to avoid the mountains, engine #4 finally relit. Although this wasn't enough to maintain level flight, it was able to reduce the rate of descent. Soon afterwards, engine #2 also restarted, allowing a gradual climb, and engines #1 and #3 followed in short order. The Captain then requested, and began, a climb back to 15,000 feet to clear the mountains.

As the aircraft was reaching this altitude, the St. Elmo's Fire effect returned to the cockpit windscreen, and engine #2 began surging again and had to be shut down (failure number five). The crew descended again until the effect subsided, and diverted to Jakarta for an emergency landing.

On approach to the airport, the crew found it virtually impossible to see the runway lights, since they were being so diffused by the cockpit windscreen. The approach was done almost entirely using instruments, and one small section of the cockpit window that was relatively clear. Upon safely landing the crew also found it impossible to navigate the airport's taxiways, due to the glare from airport floodlighting, and had to stop and wait for a tug.

It turned out that the 747 had flown through the ash cloud from the eruption of Mount Galunggung. The engines had been shut down by the ingestion of volcanic ash, which had also caused the strobe effect on the cockpit windscreen and the engines. The streams of fire passengers had seen during the restart attempts was unburnt fuel igniting outside the engines. Once the ash in the engines had cooled somewhat, enough of it had broken away and left the engines to allow them to restart. The visibility problems had been caused by ash abrading the cockpit windscreen, rendering it almost completely opaque. The covers on the landing lights had suffered similarly.

After landing, three of the four engines were replaced, as well as the cockpit windscreen. The fuel tanks had to be drained and cleaned, and much time was spent continuing the repairs back at London, during which time the aircraft was nicknamed the "flying ashtray."

I remember this one because an instructor relayed the story during a lesson while I was at ATC college. Curious as to what had happened to the 747 involved, at the time named City of Edinburgh, I looked up its registration number (G-BDXH) on my friend airliners.net. Turned out it was sold to some European charter company but had since retired...to a breaker's yard behind Bournemouth International Airport, just a few hundred metres away from me, sadly sans wings. Small world.

Denouement

So, there we have it. The record for the greatest number of non-fatal engine failures is held by Boeing 747-200 G-BDXH, also the temporary holder of the record for the longest glide in a non-purpose-built aircraft.

In other news: uh, all other aircraft have had fewer engine failures than this.

If you take anything away from this node, perhaps it should be that engine failure won't necessarily kill you. Especially if you have more than one.



I would appreciate any information about potential additions to this node; it's a tricky subject to research.