Aircraft reciprocating engines may be more complex than jet engines, not only in terms of the number of parts, but the stresses they undergo, and actions to assure their airworthiness have not been effective. So much for a half-century of accident investigations, recommendations which may be of marginal impact, and piecemeal regulatory fixes such as airworthiness directives (ADs). This finding, of holes in the net of safety assurance, is the central conclusion of a recent Australian Transport Safety Bureau (ATSB) study of aircraft reciprocating-engine failures. As the report delicately stated, “The recurrence of power train component structural failure suggests that corrective actions that are part of the airworthiness assurance system may have been ineffective.”

The study found that piston engine failures and the loss of two Space Shuttles – the low and the high end of aerospace technology – have much in common. The ATSB report was subtitled, “An Analysis of Failure in a Complex Engineered System.” The phraseology indicates that aircraft piston engines are anything but rudimentary.

For reciprocating aircraft engines, the study found that the interaction of combustion shockwaves, alternating loads, rubbing of parts, lubrication stress-concentrating features and other factors combined to yield failure rates well in excess of the reliability goals expressed in Federal Aviation Administration (FAA) design standards. As an example, the FAA conceded that the in-flight shutdown rate for piston engines could be anywhere from once every 1,000 hours to once every 10,000 hours. Not only does this range indicate the uncertainty surrounding FAA data, it falls far short of the one in 10,000,000 reliability goal expressed in design standards.

The ATSB report is replete with examples of failures and, more importantly, it documents why a more broad-based view of reciprocating engine reliability needs to be taken.

Extracts of the 255-page ATSB report follow:

“Executive Summary ….

“The focus of this safety study is the reliability of propeller-based propulsion systems that provide thrust for the operation of aircraft commonly used in low-capacity public-transport [8-10 passengers] operations during the period 2000-2005.…

“In the period January 2000 to December 2005, twenty power train structural failure events in high-power (300 to 375 brake horsepower) horizontally-opposed, reciprocating engines were associated with air safety occurrences reported to the ATSB. These occurrences range in severity from: in-flight engine shutdown to engine failure and forced landing; engine failure combined with in-flight fire and fracture of both upper engine mounts; and a fatal accident involving a regular public transport flight following the structural failure of both engines. Power train structural failure has the capability to create a threat to safe operation despite the redundancy provided by twin propulsion systems and pilot training to respond to a period of abnormal operation following the failure of one propulsion system.…

“The power train structural failure events investigated in this study are dominated by combustion chamber component melting, plain bearing breakup or movement, and the initiation and growth of fatigue cracking in components that are designed to have a life not limited by fatigue. … Failure events were not restricted to one engine model, one engine manufacturer, or one component type.…

“For the engine failure occurrences investigated in this study, it is clear that leaning at climb power settings increased the likelihood of detonation. It is also evident that the fuel-air mixture settings – lean climb and lean cruise, resulted in the deposition of a non-volatile lead compound on combustion chamber surfaces. The presence of non-volatile deposits also increases the likelihood of detonation.…

“The complexity of systems has an important effect on the feedback process through the inability to predict, with complete certainty, the consequences of interactions between physical, chemical, mechanical and human processes.

“The means of overcoming the barriers to effective feedback lies in developing an awareness of the factors that: prevent the seeing of evidence clearly and in context, result in incorrect classification, result in incorrect cause and effect linkages, and interfere with communication at all levels. Feedback is highly dependent on viewing the system in its entirety, and viewing its elements in detail. Feedback to ensure continued safe operation should be based on the potential consequences of a sequence of events.…

“Introduction.…

“High-power reciprocating-engine structural failure occurrences, 2000 to 2005:

Figure A

“Propulsion System Reliability ….

“Reliability may be expressed in qualitative terms or quantitative terms. A correlation between the qualitative and quantitative terms, along with descriptors of failure severity and effect on aircraft and aircraft occupants, is shown in table 3.1 [this table, by the way, is the finest and most succinct compilation of probabilities and failure effects we have seen, boiling reams of discussion down to a single page]. It is normally accepted that a reliable system has a probability of failure of 1 in 10,000,000 (10-7) or that the probability of failure is extremely remote (improbable).

Figure B (Table 3.1)

“Reliability Measurement ….

“The UK AAIB [Air Accidents Investigation Branch], in the course of its investigation of a Cessna 404 Titan G-ILGW accident (UK AAIB report 2/2001), raised the issue of engine reliability with several regulatory agencies and asked for data on in-flight shut-downs by different models of reciprocating engines. The response from the FAA [Federal Aviation Administration], and other agencies, was that no reliable data exists for this kind of comparison, largely due to ‘gross under-reporting’ of in-flight shutdown of general aviation piston engines. The FAA assessed the rate as ‘between 1 per 1,000 and 1 per 10,000 flight hours.’ This failure rate, qualitatively described as ‘probable’ or ‘reasonably probable’, is well in excess of the ‘improbable’ or ‘extremely remote’ reliability goals expressed in design standards.

“Occurrence 2000/90 VH-MZK

“During the cruise phase of flight, the pilot heard a bang from the left engine. The left engine then stopped and the propeller feathered. A visual inspection of the engine from the cockpit revealed that the engine cowling had been damaged. The aircraft was forced to land.

“Time since overhaul: 1,673 hours.

Figure 6.20

The extent of damage to the engine cowling caused by the forceful separation of the No. 1 cylinder assembly.

“Examination of the engine revealed that the No. 1 cylinder had separated from the crankcase. An internal examination revealed that the No. 1 connecting rod little-end had fractured.

Figure 6.21

The No. 1 cylinder ‘as recovered.’

Figure 6.22

The No. 1 connecting rod showing the fractured little-end housing.

“While the remnant of the little-end housing had been damaged extensively and the rest of the housing was lost during the engine failure, it is evident that the nature of the failure is consistent with the development of fatigue in the housing.…

“Occurrence 2001/2544 VH-TTX

“The left engine failed during climb at approximately 600 feet. The pilot completed the engine failure checklist and returned to land.

“Time since overhaul: 1,300 hours.

“Examination of the engine revealed that the crankshaft had fractured in two locations … as a result of fatigue cracking. … The effect of increased alternating stress in this location results in rapid fatigue crack initiation and crack growth.…

Figure 6.48

Crankshaft fracture. The engine ceased to function following the fracture.

“Crankshaft design

“The crankshaft in a multicylinder reciprocating engine combines the force created by combustion of the fuel-air mixture in each cylinder to provide rotational power at the end of the shaft.…

“The varying forces acting on a crankshaft create alternating stresses in the shaft through the alternating flexure of the shaft in both lateral and torsional directions.…

“The magnitude of alternating stresses at these sites, created by crankshaft flexure, is controlled by: the sizing of the journals and crankwebs, the overlap between adjacent journals, the rigidity of the supporting structure (crankcase), the size of the fillet radius between the journals and crankweb, and the creation of residual compressive stresses in the material at the fillets.…

“Summary

“Plain bearings in high-powered aircraft reciprocating engines are an example of a complex subsystem operating within a complex thrust system. Complexity brings with it a variety of failure modes and a sensitivity of the failure process to initial conditions.…

“Factors associated with fatigue cracking in power train components

“The power train components are designed to have a life not limited by fatigue crack initiation and propagation to final fracture ….

“Power train components are subjected to an extremely high number of alternating stress cycles over the duration of their expected service life, for example, 1.5x107 … rev. cycles [15 million] will be created over a period of 100 hours for an engine speed of 2,500 rpm.…

“Summary

“In this study, sources of increased component alternating stress were found to have been associated with gas pressures produced by combustion, increased component flexure, and reductions in component preload. Sources of decreased fatigue endurance strength were found to have been associated with surface damage created by adhesive wear (galling), surface scoring created by rubbing contact with a closely associated component, and cracking of nitrided surfaces created by localized frictional heating.…

“In addition to the complex interrelationships between loads, preloads, geometric stress concentrations, residual stress, surface finish, surface hardening, and material of an individual component, there are clear interdependencies between the combustion process in individual and multiple cylinders of a horizontally-opposed engine, the physics of plain bearing lubrication, the mechanics of bearing insert retention, and the process of fatigue crack initiation.

“Condition monitoring of propulsion systems ….

“The frequency of aircraft reciprocating-engine structural failure during the period 2000 to 2005 … suggests that there was a breakdown in the systems created to ensure engine reliability, in particular, the systems created to ensure that structural failure of engine components does not occur during flight.…

“Feedback barriers ….

“The resolution of differences between operational and design reliability, in situations where the feedback process is ineffective, resulting a change in expectation of propulsion system performance and an acceptance of a lower level of reliability. The management of threats to the well being of passengers and crew becomes more dependent on system redundancy and the ability of pilots to manage periods of abnormal operation. However … the defense of propulsion system redundancy is not present for all phases of flight.…

“The issue of over reliance on system failure defenses is noted in the UK CAA’s [Civil Aviation Authority] handbook on condition-monitored maintenance:

‘In the case of a system designed to a multiple redundancy philosophy it has been a common misunderstanding that, as redundancy exists, an increase in failure rate can always be tolerated without corrective action being taken.’ (Leaflet 13-4 CAAP 418, p. 7)

“The tendency to accept deviations from initial performance standards is not restricted to the operation of aircraft reciprocating engines. The subtle, insidious, unpredictable effect of accepting deviations from agreed performance standards has been highlighted in the reports of investigations into the Challenger and Columbia space shuttle accidents:

‘The initial Shuttle design predicted neither foam debris problems nor poor sealing action of the Solid Rocket Booster joints. To experience either on a mission was a violation of design specifications. These anomalies were signals of potential danger, not something to be tolerated, but in both cases after the first incident the engineering analysis concluded that the design could tolerate damage. These engineers decided to implement a temporary fix and/or accept the risk and fly. For both O-rings and foam, that first decision was a turning point. It established a precedent for accepting, rather than eliminating, these technical deviations. As a result of this new classification, subsequent incidents of O-ring erosion or foam debris strikes were not defined as signals of danger, but as evidence that the design was now acting as predicted.’ (Columbia accident investigation, 2003, p. 196)

“Conclusions ….

“The reliability of reciprocating engines is an issue for a significant portion of the Australian civil aviation fleet.…

“Analysis of each failure mode revealed that factors contributing to the failure ranged from:

• A change in combustion from normal flame propagation to end gas auto-ignition (detonation);
• A change in plain bearing lubrication regime;
• A change in the force acting to retain bearing inserts in their housings;
• A change in the force acting to move bearing inserts in their housing; and
• The initiation of fatigue cracking in components designed to have a life not limited by fatigue cracking. …

The formal action of the regulatory authorities and the engine manufacturer, during the period 2000 to 2005, have been concentrated on crankshaft material and manufacturing issues, and have touched lightly upon the behavior of plain bearings manufactured with an aluminum-tin layer.

It is evident … that threats to flight safety have been created by cylinder head fatigue, piston melting, connecting rod little-end fracture, and cylinder attachment fastener fracture. The actions taken to address crankshaft material issues will have no effect on these other types of power train structural failure.…

“The complexity of propulsion systems powered by reciprocating engines has an important effect on the feedback process through the inability to predict, with complete certainty, the consequences of interactions between physical, chemical, mechanical and human processes.

“The means of overcoming the barriers to effective feedback lies in developing an awareness of the factors that: prevent the seeing of evidence clearly and in context, result in incorrect classification, result in incorrect cause and effect linkages, and interfere with communication at all levels. Feedback is highly dependent on viewing the system in its entirety, and viewing its elements in detail. Feedback to ensure continued safe operation should be based on the potential consequences of a sequence of events.

“Analysis of failure events in complex engineered-systems should be undertaken with regard to component failure control plans and the safety assurance system as it is applied to the aspects of design, manufacture, operation, and maintenance.” (The full ATSB report, ‘Aircraft Reciprocating-Engine Failure: An Analysis of Failure in a Complex Engineered System,’ may be viewed at www.atsb.gov.au/publications/2007/pdf/B20070191.pdf)

In other words, fixing failures via an airworthiness directive (AD) or service bulletin (SB) one at a time has been of limited effectiveness. A more comprehensive assessment of reciprocating engine reliability, based on detailed operator feedback, is needed. To achieve this will be an uphill climb, says a retired FAA official familiar with small aircraft certification. He says, “The NTSB [National Transportation Safety Board], with their high count of superficial recommendations rather than fewer or even a singular but complex fix, does not solve the problem. As a policy from the top, the FAA most always actions the NTSB recommendations, and neither the NTSB nor the FAA are eager to excise the cancer due to the high cost of airplane health care. They, too, have their own health maintenance organization policy, and band-aids and placebos are always cheaper and less painful than surgery.”

It may be a bit strong to say so, but the central implication of the ATSB special study seems to be that the emperor of safety assurance has no clothes.