Engine Failure and Engine Fire

Engine failure is among the emergencies pilots rehearse most often. Every multi-engine rating, type rating and recurrent simulator check contains at least one, usually at the worst moment, just after the take-off decision speed. The reason is not that engines often fail, but that the response must be automatic: in the first seconds the pilot has to fly the aircraft, not analyse the failure.

The drills share one order. Keep control, identify and confirm the failed engine, secure it, deal with any fire, then plan the landing with the thrust that remains. The control problem itself, asymmetric thrust and minimum control speed, is covered in asymmetric flight; this article covers the procedures that follow.

Engine failure after V1

A failure recognised before V1 leads to a rejected take-off. At or after V1 the take-off is continued, because the certified figures guarantee that the aircraft can reach 35 ft within the take-off distance on the remaining engine, but not that it can stop on the runway (see take-off speeds). This applies to an engine fire at V1 as much as to a failure: the crew do not touch the thrust levers, but rotate, climb and deal with the fire once airborne and at a safe height.

The engine failure after V1, or V1 cut, is flown as follows:

1. Keep straight with rudder as the yaw develops.
2. Rotate at VR as normal, then follow the flight director. On the A320 the speed target becomes the speed at which the failure was detected, but not less than V2 or more than V2 + 15 kt; the Boeing 737 flight director commands V2 if the aircraft is slower than V2 at the failure, the existing speed if it is between V2 and V2 + 20 kt, and V2 + 20 kt if it is faster.
3. Gear up once a positive rate of climb is confirmed.
4. No action on the failed engine until a safe height, at least 400 ft above the runway in most procedures, other than flying the aircraft on the briefed engine-out route.
5. At the engine-out acceleration altitude, level off or reduce the climb, accelerate, retract the flaps on schedule and set maximum continuous thrust. On the A320 this altitude must be at least 400 ft above the aerodrome, keep the net flight path 35 ft above obstacles, and not require take-off thrust for longer than its limit, 10 minutes with one engine inoperative.
6. Then run the ECAM or checklist for the failure.

The climb that the aeroplane must achieve is set by certification. The second segment, from gear retraction to the acceleration height, demands a gross gradient of at least 2.4 per cent for a twin, which is why it so often limits the take-off mass on a hot, high day (see take-off climb segments).

View full schematic

Engine failure after take-off in light aeroplanes

In a single-engine aeroplane an engine failure after take-off (EFATO) leaves one option: lower the nose at once to hold the glide speed, and land ahead or within about 30° either side of it. The turn back to the runway, the impossible turn, has killed many pilots and is discussed in forced landing and ditching. The memorised actions come first, and the checklist is read only if height and time allow.

A light twin keeps some climb only if the pilot acts quickly and correctly: maintain control and the blue-line speed VYSE, set full power, reduce drag, identify the dead engine, verify it by closing its throttle, then feather its propeller. The performance rules for multi-engine Class B aeroplanes do not assume an engine failure below 300 ft above the aerodrome, and a light twin that cannot climb after a failure close to the ground must be landed ahead under control rather than flown below VMCA.

Identifying and securing the failed engine

Shutting down an engine is irreversible, and shutting down the wrong one is catastrophic. In the 1989 Kegworth accident, the crew of a Boeing 737-400 shut down the serviceable engine instead of the damaged one, and the aircraft crashed short of the runway. Procedures therefore insist that one pilot identifies the engine and the other confirms it, and that every irreversible action, on a thrust lever, a fuel lever or engine master switch, or a fire handle, is confirmed by both before it is taken.

Identification starts with the yaw, dead foot, dead engine, and is confirmed from the engine indications: N1, EGT, fuel flow, vibration and oil pressure. Closing the thrust lever of the suspected engine, the first step of many drills, also helps to identify it.

The engine fire drill

An engine fire is detected by loops of heat-sensing elements in each engine's fire zones. The warning is unmistakable: a bell or continuous repetitive chime, master warning lights, and the engine's fire handle or pushbutton lit red. An engine fire usually causes no loss of thrust, so there is no yaw to show which engine is burning; the lit fire handle does.

The engine fire drill follows the same logic on every type: starve the fire of fuel, air and electrical energy, then discharge the extinguisher.

1. Silence the aural warning and confirm the engine.
2. Close the thrust lever of the affected engine (on the Boeing 737, disengage the autothrottle first so that the lever stays closed).
3. Cut off its fuel: start lever to CUTOFF on the 737, ENG MASTER to OFF on the A320.
4. Pull the fire handle or push the fire pushbutton. On the 737 this closes the engine and spar fuel shut-off valves, the engine bleed valve and the hydraulic shut-off valve, disables the thrust reverser, trips the generator and arms the bottles. On the A320 it closes the LP fuel valve, hydraulic fire shut-off valve, bleed valve and pack flow control valve, cuts the FADEC supply and deactivates the generator.
5. Discharge the first bottle. If the warning is still present after about 30 seconds, discharge the second.

Transport aircraft typically provide two shots of extinguishant per engine. The A320 has two bottles for each engine; the 737 has two bottles that can be discharged into either engine, by rotating the fire switch one way or the other and holding it for a second.

On the A320 it is the engine master switch, not the fire pushbutton, that stops the engine at once. The pushbutton closes only the LP valve in the wing, and the fuel left in the lines beyond it would keep an engine at ground idle running for about a minute.

Once the drill is complete, the aircraft lands at the nearest suitable aerodrome, and a fire warning that persists after both bottles makes that landing urgent. On the ground the actions depend on whether the aircraft is moving or stopped and on the risk to the occupants, and an engine fire on the ground commonly leads to an evacuation.

In a light single-engine aeroplane the engine fire in flight drill is to close the mixture and the fuel selector, switch off the master switch, close the cabin heat and vents, which draw air from around the engine, and carry out a forced landing. If the fire goes out, the engine is not restarted: fresh fuel on a hot, damaged engine invites the fire back.

Severe damage or separation

Severe damage is a mechanical break-up of the engine: a loud bang, heavy vibration, a rapid loss of parameters, and often loss of the engine's generator, bleed and hydraulic supply. Separation is the loss of the engine from its pylon. Boeing combines both with fire in one checklist, Engine Fire, Severe Damage or Separation, with the same recall items: the engine is isolated with its fire switch from everything that connects it to the aircraft, and a bottle is discharged if the fire or overheat warning stays on. On the 737 an engine overheat light that stays on after the thrust lever has been closed also leads into this checklist.

Fragments from an uncontained failure can damage the wing, the fuel system and the fuselage; in 2018 fragments from an engine of Southwest Airlines Flight 1380 struck the fuselage and a cabin window departed (see decompression). Where structural damage is suspected, the aircraft is manoeuvred with care and its handling checked before the approach. A severely damaged engine is not relit.

Single-engine approach and landing

With an engine secured, the crew choose where to land. US rules for two-engine airliners, 14 CFR 121.565, require a landing at the nearest suitable airport, in point of time, at which a safe landing can be made; airline procedures elsewhere lead to the same decision.

A single-engine approach and landing is planned deliberately:

• landing distance with the failure, which on many types uses a reduced landing flap setting and a higher approach speed;
• the one-engine-inoperative missed approach, which must be flyable, and the level-off altitude for it;
• automatic landing limits: on the A320, a fail-passive automatic landing with an engine out is approved only in configuration FULL, with the engine-out procedures completed before 1,000 ft on the approach;
• rudder trim, which must be reduced as thrust is reduced, because the yaw from the live engine falls with its thrust;
• reverse thrust, available only from the live engine, so directional control on the landing roll needs care.

In a light twin, a single-engine landing is flown to avoid a go-around: its one-engine-inoperative climb is demonstrated with gear and flaps up, and with gear and full flap down it may not climb at all, so final flap is left until the landing is assured.

Dual engine failure

A dual engine failure, or loss of thrust on both engines, turns a twin into a glider. It is rare, and the cause is usually external to the engines: fuel exhaustion or starvation; volcanic ash, as on British Airways Flight 9 over Java in 1982 and KLM Flight 867 in 1989, whose crews restarted the engines once clear of the ash; or bird ingestion. On 15 January 2009 US Airways Flight 1549, an A320 climbing through about 2,800 ft above the ground after take-off from LaGuardia, lost thrust on both engines after flying into a flock of Canada geese. The crew ditched on the Hudson River, and all 155 people on board survived.

The first actions are to fly the aircraft and restore power to what matters:

• Speed. The crew fly the speed the procedure gives, either the best-glide speed or an optimum relight speed. The E190-E2 procedure, for example, flies green dot towards the landing site.
• Electrical and hydraulic power. On the A320 an ENG DUAL FAILURE warning comes with the continuous repetitive chime and GEN FAULT and PACK FAULT lights, and the ram air turbine deploys automatically once both main AC buses are lost, pressurising the blue hydraulic system. The APU can be started as a further source.
• Relight. The Boeing 737's Loss of Thrust on Both Engines recall items select the engine start switches to FLT for continuous ignition, place the start levers to CUTOFF, then return them to IDLE detent once EGT is decreasing, repeating the cycle as needed.

A MAYDAY is declared, and if no relight is achieved the crew plan a forced landing or a ditching early, while height still gives them a choice.

In-flight engine relight

An in-flight engine start, or airstart, uses one of two methods. In a windmilling relight, the airflow through the engine turns the compressor fast enough for combustion, so only fuel and ignition are needed; it requires a relatively high airspeed. A starter-assisted relight uses bleed air from the APU or the other engine to turn the engine at lower speeds. The APU is not usable at every altitude for this: on the A320, APU bleed for engine starting is limited to 20,000 ft. Each type publishes a relight envelope of altitude and airspeed. After a flameout at high altitude and high speed, the crew generally descend and slow down to bring the engine back inside it.

On the A320, continuous ignition comes on automatically after a flameout in flight, and in an automatic in-flight start both igniters fire as soon as the engine master switch is set ON. The Boeing 737's auto-relight fires both igniters whenever the engine control detects a flameout, from a rapid uncommanded fall in N2 or N2 below idle. Automatic start protection is weaker in flight than on the ground: the A320's FADEC aborts automatically only on the ground, and on the E190 E1 the crew must abort an in-flight start themselves if there is no light-off within 30 seconds. On the 737 the EGT limit for an in-flight start is shown on the display.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.