It feels like a nightmare scenario for airplane passengers: You take a look out the window in between mini-pretzel bites to see an engine cloaked in flames, shedding pieces of metal mid-flight from 10,000 feet in the air. That’s exactly the sight that greeted passengers of United Flight 328 on Saturday not long after departing Denver for Honolulu.
A roughly 500,000-pound jet with one engine seems as likely a candidate to fly as a condor with one wing. And yet for all the danger posed by the flambé Boeing 777 this weekend—and there was plenty, particularly to the Denver suburbs subjected to large-scale debris shed by the plane’s Pratt & Whitney PW4077 engine—staying in the air was extremely low on the list. In fact, its remaining engine is theoretically strong enough to have made the remainder of the flight on its own.
That wasn’t always the case for large aircraft. For decades, the Federal Aviation Administration didn’t allow twin-engine planes to make trips over an hour, much less from the Midwest to a Pacific paradise. “It'll be a cold day in hell before I let twins fly long-haul over-water routes,” then-FAA administrator Lynn Helms insisted when Boeing asked the FAA to change the rule in 1980, according to Robert J. Sterling’s 1991 history of the aerospace giant. If an engine did fail, you’d have at least two others to rely on.
Eventually the FAA relented, expanding the 60-minute rule to 120 and then 180 minutes as the ’80s wore on. Credit improved engines for the change of heart, rather than an increased appetite for risk.
“One engine has to have enough thrust to keep the airplane going, and even climbing if it needs to,” says Ella Atkins, an aerospace engineer at the University of Michigan. That applies even to a worst-case scenario, she says, such as losing an engine while you’re in the process of taking off. The remaining engine needs to be strong enough, if required, to get you airborne on its own.
Which is not to say that engine failure is without consequence, especially when a fire is involved. It introduces a host of complications no matter the size of the aircraft or the complexity of its automated systems. “Many pilots go through their entire career without a single engine failure, even though we train for it,” says Bob Meder, chairman of the National Association of Flight Instructors. “In general, you do your memory items first for the airplane you’re flying. You’ve got an engine fire, you secure the engine and stop the flow fuel to the engine.”
The checklist from there depends on the aircraft, but they broadly comprise steps to isolate the failing engine to minimize its broader impact. Because pilots typically can’t see the engine themselves from the cockpit, they rely on updates from the flight crew to help ascertain what physical damage the engine might have suffered.
Having one good engine provide enough thrust to keep a jet going for hours also introduces some tricky aerodynamics. “Suppose your right engine fails. You have the left engine trying to yaw you, or turn you to the right,” says Atkins. In anticipation of that possibility, manufacturers of twin-engine jets have made the rudders and the ailerons—the hinged section near the end of the wing that controls roll—large enough and responsive enough to counter that yaw if needed. “Even though your thrust vector is misaligned, it’s not down the center of the fuselage anymore, you can still effectively provide a counter-torque that allows the aircraft to remain straight in its velocity vector and under control.”
Think of it like trying to steer a shopping cart with a bum front wheel. It keeps trying to pull you one direction, so you need to push harder with one arm to keep it from knocking down a stack of stewed tomato cans. In the case of an aircraft’s control surfaces, that also introduces more drag, both because the fuselage isn’t necessarily pointing straight and the rudder and ailerons are using the air around them to generate that counter-torque. More drag burns more fuel, and requires the remaining engine to work even harder.
The potential consequences of not responding to that yaw adequately goes beyond simply heading off course. “The real risk is having the airplane roll over onto its side or its back and then you’ve lost control of the aircraft,” says Meder. “And at that point you’re not flying anymore.”
As for the debris shedding from the Boeing 777 that landed in Broomfield, Colorado—at least one large piece of which thudded in someone’s front yard—there’s not much a flight crew can do about it. When planes need to return for an emergency landing, they take the shortest route possible, Atkins says. They currently have no way to set a trajectory that minimizes risk to people below, although there is some work being done in maps intended for low-flying drones that could take things like population or zoning into account even for large aircraft.
Engine failure is not an especially common occurrence, but it does happen. In fact, the Denver debacle was one of two experienced by Boeing aircraft over the weekend; the engine of a 747 cargo plane caught fire and shed parts over the Netherlands as well, injuring two people. But while plenty of questions remain about the weekend’s incidents—and Boeing has grounded all 128 of its 777s equipped with Pratt & Whitney PW4077 engines—a fiery engine is not quite as devastating a spectacle as it seems. (Boeing did not respond to a request for comment.)
“We should be properly alerted because there was a failure,” says Atkins, “but also we should consider the engineering to be a success.”