Posts Tagged ‘general aviation’

Why Returning To The “Golden Age of Aviation” Is A Terrible Future

Monday, June 16th, 2014

pilot

Here’s a Private Pilot, circa 1930. (photo credit: James Crookall)

I’m not a big fan of nostalgia. Here’s why:

The Golden Age of Aviation” was a time when the only people who flew themselves in an airplane were titans of industry, movie stars, or crazy people.

The aviation industry is on course to revert back to the 1930′s. This is bad, bad, news, because if you look at what aviation was like back between the world wars, it was a terrible time.

Folks in our community complain about how private aviation is circling the drain, that it’s a lost cause. I refuse to believe that. We just have too many things going for us. I believe the future of private aviation is viable, as long as we stop trying to relive the past.

The first few chapters of the book, “Free Flight,” by James Fallows, pretty much lit my brain on fire. It remains one of the best, most objective, primers on the state of aviation in America. The rest of the book focuses on the trajectory of both Cirrus and Eclipse and their attempts to disrupt and reinvent air travel in the last decade.

Fallows nails it when he explains that there are two kinds of people. There are “the Enthusiasts,” (You, me, and most anyone reading this.) and “the Civilians.” (everyone else.)

On Enthusiasts
“…The typical gathering of pilots is like a RV or hot rod–enthusiasts’s club. People have grease under their fingernails. The aircraft business is littered with stories of start-up companies that failed. One important reason is that, as with wineries or small country inns or literary magazines, people have tried to start businesses because they loved the activity, not because they necessarily had a good business plan.”

On Civilians
“Civilians–mean most of the rest of us– view airplanes not as fascinating objects but as transportation. Planes are better than cars, buses, or trains to the extent that they are faster. Over the last generation, most civilians have learned to assume that large airliners nearly always take off and land safely. …From the civilian perspective, the bigger the plane, the better. Most civilians view people who fly small planes the way I view people who bungee-jump or climb Mount Everest; they are nuts.”

James Fallows, “Free Flight, Inventing the future of Travel

Fallows calmly explains how travel for most of us has gotten worse, not better in the last 30 years. He stresses that the hub and spoke system adopted by the airlines post deregulation has contributed to the misery. He cites former NASA administrator Daniel Golden, who noted in 1998 that the average speed door to door traveling on commercial airlines had sunk to only around fifty or sixty miles an hour.

The book concisely charts how we got into this fine mess. He compares how air travel works today to that of the world before automobiles. In the last generation, the airlines have benefited the most from investment in development and infrastructure. Today we pack most people onto what may as well be very fast train lines that go from major metro to major metro. Cornelius Vanderbilt would be so proud.

The other side of the coin is what General Aviation has evolved to for the folks who have the means to fly private jets. The industry has done a fabulous job of responding to the needs of the very small percentage of us who can afford to operate or charter turbine aircraft. This equipment flies higher and faster than most airliners, and can get people to small airports much closer to almost any destination. Fallows shows how this is analogous to travel by limousine. Remember, when cars first appeared on the road, they were considered too complicated and too dangerous for mere mortals to operate. Anyone who could afford one, hired a professional driver. I’m sure Andrew Carnegie was chauffeured from point to point too.

So for the most part, we have trains and limousines. It’s like some bizarre alternate history world where Henry Ford never brought us the automobile.

I refuse to believe that we’re simply on the wrong side of history here.

It’s actually a pretty great time to be a pilot. The equipment has never been more reliable, the tools keep making it easier, and the value proposition keeps getting more compelling compared to other modes of travel when you note that moving about the country on the airlines or the highways keeps slowing down due to congestion. For the first time in history, for most of us the country is no longer growing smaller. It’s getting bigger.

A few examples of what excites me about the future of aviation, and what I hope can prove to be disrupters looking forward…

  • ICON A5 – A 2 seat jet ski with wings that you can tow behind your pickup.
  • Cirrus Vision SF50 – 5 Seats, single jet engine, it’s going to define a completely new category for very light jets. I imagine it to be like a Tesla and an iPad mashed together in one 300 knot machine.
  • Whatever it is that Elon Musk builds next – please, please, please, let it be a flying car.

The future is bright, as long as we don’t go backwards.

The Dark Side of Maintenance

Tuesday, June 10th, 2014

The Dark SideHave you ever put your airplane in the shop—perhaps for an annual inspection, a squawk, or a routine oil change—only to find when you fly it for the first time after maintenance that something that was working fine no longer does?  Every aircraft owner has had this happen. I sure have.

Maintenance has a dark side that isn’t usually discussed in polite company: It sometimes breaks aircraft instead of fixing them.

When something in an aircraft fails because of something a mechanic did—or failed to do—we refer to it as a “maintenance-induced failure”…or “MIF” for short. Such MIFs occur a lot more often than anyone cares to admit.

Why do high-time engines fail?

I started thinking seriously about MIFs in 2007 while corresponding with Nathan Ulrich Ph.D. about his ground-breaking research into the causes of catastrophic piston aircraft engine failures (based on five years’ worth of NTSB accident data) that I discussed in an earlier post. Dr. Ulrich’s analysis showed conclusively that by far the highest risk of catastrophic engine failure occurs when the engine is young—during the first two years and 200 hours after it is built, rebuilt or overhauled—due to “infant-mortality failures.”

But the NTSB data was of little statistical value in analyzing the failure risk of high-time engines beyond TBO, simply because so few engines are operated past TBO; most are arbitrarily euthanized at TBO. We don’t have good data on how many engines are flying past TBO, but it’s a relatively small number. So it’s s no surprise that the NTSB database contains very few accidents attributed to failures of over-TBO engines. Because there are so few, Ulrich and I decided to study all such NTSB reports for 2001 through 2005 to see if we could detect some pattern of what made these high-time engines fail. Sure enough, we did detect a pattern.

About half the reported failures of past-TBO engines stated that the reason for the engine failure could not be determined by investigators. Of the half where the cause could be determined, we found that about 80% were MIFs. In other words, those engines failed not because they were past TBO, but because mechanics worked on the engines and screwed something up!

Sheared Camshaft Bevel GearCase in point: I received a call from an aircraft owner whose Bonanza was undergoing annual inspection. The shop convinced the owner to have his propeller and prop governor sent out for 6-year overhauls. (Had the owner asked my advice, I’d have urged him not to do this, but that’s another story for another blog post.)

The overhauled prop and governor came back from the prop shop and were reinstalled. The mechanic had trouble getting the prop to cycle properly, and he wound up removing and reinstalling the governor three times. During the third engine runup, the the prop still wouldn’t cycle properly. The mechanic decided to take the airplane up on a test flight anyway (!) which resulted in an engine overspeed. The mechanic then removed the prop governor yet again and discovered that the governor drive wasn’t turning when the crankshaft was rotated.

I told the owner that I’d seen this before, and the cause was always the same: improper installation of the prop governor. If the splined drive and gears aren’t meshed properly before the governor is torqued, the camshaft gear is damaged, and the only fix is a teardown. (A couple of engine shops and a Continental tech rep all told the owner the same thing.)

This could turn out to be a $20,000 MIF. Ouch!

How often do MIFs happen?

They happen a lot. Hardly a day goes by that I don’t receive an email or a phone call from an exasperated owner complaining about some aircraft problem that is obviously a MIF.

A Cessna 182 owner emailed me that several months earlier, he’d put the plane in the shop for an oil change and installation of an STC’d exhaust fairing. A couple of months later, he decided to have a digital engine monitor installed. The new engine monitor revealed that the right bank of cylinders (#1, #3 and #5) all had very high CHTs well above 400°F. This had not shown up on the factory CHT gauge because its probe was installed on cylinder #2. (Every piston aircraft should have an engine monitor IMHO.) At the next annual inspection at a different shop, the IA discovered found some induction airbox seals missing, apparently left off when the exhaust fairing was installed. The seals were installed and CHTs returned to normal.

Sadly, the problem wasn’t caught early enough to prevent serious heat-related damage to the right-bank cylinders. All three jugs had compressions down in the 30s with leakage past the rings, and visible damage to the cylinder bores was visible under the borescope. The owner was faced with replacing three cylinders, around $6,000.

Sandel SN3308The next day, I heard from the owner of an older Cirrus SR22 complaining about intermittent heading errors on his Sandel SN3308 electronic HSI. These problems started occurring intermittently about three years earlier when the shop pull the instrument for a scheduled 200-hour lamp replacement.

Coincidence?

I’ve seen this in my own Sandel-equipped Cessna 310, and it’s invariably due to inadequate engagement between the connectors on the back of the instrument and the mating connectors in the mounting tray. You must slide the instrument into the tray just as far as possible before tightening the clamp; otherwise, you’ve set the stage for flaky electrical problems. This poor Cirrus owner had been suffering the consequences for three years. It took five minutes to re-rack the instrument and cure the problem.

Pitot-Static PlumbingNot long after that, I got a panicked phone call from one of my managed-maintenance clients who’d departed into actual IMC in his Cessna 340 with his family on board on the first flight after some minor avionics work. (Not smart IMHO.) As he entered the clag and climbed through 3,000 feet, all three of his static instruments—airspeed, altimeter, VSI—quit cold. Switching to alternate static didn’t cure the problem. The pilot kept his cool, confessed his predicament to ATC, successfully shot an ILS back to his home airport, then called me.

The moment I heard the symptoms, I knew exactly what happened because I’d seen it before. “Take the airplane back to the avionics shop,” I told the owner,  “and ask the tech to reconnect the static line that he disconnected.” A disconnected static line in a pressurized aircraft causes the static instruments to be referenced to cabin pressure. The moment the cabin pressurizes, those instruments stop working. MIF!

I know of at least three other similar incidents in pressurized singles and twins, all caused by failure of a mechanic to reconnect a disconnected static line. One resulted in a fatal accident, the others in underwear changes. The FARs require a static system leak test any time the static system is opened up, but clearly some technicians are not taking this seriously.

Causes of Accidents

Why do MIFs happen?

Numerous studies indicate that three-quarters of accidents are the fault of the pilot. The remaining one-quarter are machine-caused, and those are just about evenly divided between ones caused by aircraft design flaws  and ones caused by MIFs. That suggests one-eighth of accidents are maintenance-induced, a significant number.

The lion’s share of MIFs are errors of omission. These include fasteners left uninstalled or untightened, inspection panels left loose, fuel and oil caps left off, things left disconnected (e.g., static lines), and other reassembly tasks left undone.

Distractions play a big part in many of these omissions. A mechanic installs some fasteners finger-tight, then gets a phone call or goes on lunch break and forgets to finish the job by torqueing the fasteners. I have seen some of the best, most experienced mechanics I know fall victim to such seemingly rookie mistakes, and I know of several fatal accidents caused by such omissions.

Maintenance is invasive!

Whenever a mechanic takes something apart and puts it back together, there’s a risk that something won’t go back together quite right. Some procedures are more invasive than others, and invasive maintenance is especially risky.

Invasiveness is something we think about a lot in medicine. The standard treatment for gallstones used to be cholecystectomy (gall bladder removal), major abdominal surgery requiring a 5- to 8-inch incision. Recovery involved a week of hospitalization and several weeks of recovery at home. The risks were significant: My dad very nearly died as the result of complications following this procedure.

Nowadays there’s a far less invasive procedure—laproscopic cholecystectomy—that involves three tiny incisions and performed using a videoscope inserted through one incision and various microsurgery instruments inserted through the others. It is far less invasive than the open procedure. Recovery usually involves only one night in the hospital and a few days at home. The risk of complications is greatly reduced.

Similarly, some aircraft maintenance procedures are far more invasive than others. The more invasive the maintenance, the greater the risk of a MIF. When considering any maintenance task, we should always think carefully about how invasive it is, whether the benefit of performing the procedure is really worth the risk, and whether less invasive alternatives are available.

Ryan Stark of Blackstone LabsFor example, I was contacted by an aircraft owner who said that he’d recently received an oil analysis report showing an alarming increase in iron. The oil filter on his Continental IO-520 showed no visible metal. The lab report suggested flying another 25 hours and then submitting another oil sample for analysis.

The owner showed the oil analysis report to his A&P, who expressed grave concern that the elevated iron might indicate that one or more cam lobes were coming apart. The mechanic suggested pulling one or two cylinders and inspecting the camshaft.

Yikes! What was this mechanic thinking? No airplane has ever fallen out of the sky because of a cam or lifter problem. Many have done so following cylinder removal, the second most invasive thing you can do to an engine. (Only teardown is more invasive.)

The owner wisely decided to seek a second opinion before authorizing this exploratory surgery. I told him the elevated iron was almost certainly NOT due to cam lobe spalling. A disintegrating cam lobe throws off fairly large steel particles or whiskers that are usually visible during oil filter inspection. The fact that the oil filter was clean suggested that the elevated iron was coming from microscopic metal particles less than 25 microns in diameter, too small to be detectable in a filter inspection, but easily detectable via oil analysis. Such tiny particles were probably coming either from light rust on the cylinder walls or from some very slow wear process.

I suggested the owner have a borescope inspection of his cylinders to see whether the bores showed evidence of rust. I also advised that no invasive procedure (like cylinder removal) should ever be undertaken solely on the basis of a single oil analysis report. The oil lab was spot-on in recommending that the aircraft be flown another 25 hours. The A&P wasn’t thinking clearly.

Even if a cam inspection was warranted, there’s a far less invasive method. Instead of a 10-hour cylinder removal, the mechanic could pull the intake and exhaust lifters, and then determine the condition of the cam by inspecting it with a borescope through the lifter boss and, if warranted, probing the cam lobe with a sharp pick. Not only would this procedure require just 15% as much labor, but the risk of a MIF would be nil.

Sometimes, less is more

Many owners believe—and many mechanics preach—that preventive maintenance is inherently a good thing, and the more of it you do the better. I consider this wrongheaded. Mechanics often do far more preventive maintenance than necessary and often do it using unnecessarily invasive procedures, thereby increasing the likelihood that their efforts will actually cause failures rather than preventing them.
Mac Smith RCM Seminar DVDAnother of my earlier posts discussed Reliability-Centered Maintenance (RCM) developed at United Airlines in the late 1960s, and universally adopted by the airlines and the military during the 1970s. One of the major findings of RCM researchers was that preventive maintenance often does more harm than good, and that safety and reliability can often be improved dramatically by reducing the amount of PM and using minimally invasive techniques.

Unfortunately, this thinking doesn’t seem to have trickled down to piston GA, and is considered heresy by many GA mechanics because it contradicts everything they were taught in A&P school. The long-term solution is for GA mechanics to be trained in RCM principles, but that’s not likely to happen any time soon. In the short term, aircraft owners must think carefully before authorizing an A&P to perform invasive maintenance on their aircraft. When in doubt, get a second opinion.

The last line of defense

The most likely time for a mechanical failure to occur is the first flight after maintenance. Since the risk of such MIFs is substantial, it’s imperative that owners conduct a post-maintenance test flight—in VMC , without passengers, preferably close to the airport—before launching into the clag or putting passengers at risk. I think even the most innocuous maintenance task—even a routine oil change—deserves such a post-maintenance test flight. I do this any time I swing a wrench on my airplane.

You should, too.

Will Fly for Pie!

Friday, May 30th, 2014

 

 1910 Fun

Circa 1910 Airplane Fun

Some pilots have all the fun.  When you think about it, fun is why most of us started flying. According to the National Endowment for the Humanities having fun is a relatively new concept in our nation’s lexicon. In the early twentieth century, the former Victorian ideals of decorum and self-restraint, once prevalent in the nineteenth century, gave way to the notion that “having fun” was good for one’s health and overall well being.

Cheap Suits in formation

Circa 2014 Airplane Fun

The Cheap Suits Flying Club exemplifies fun.  Recently I got a chance to talk to Joe Borzelleri, the co-founder of the flying club.  He was thrilled to tell me about the origins of the club, and how he believes that social flying clubs can impact General Aviation in a positive way.  “We are a bunch of guys and gals in Northern and Central California who fly high drag, low speed airplanes. Our mission statement: “We Fly for Pie!” We are known as the “Cheap Suit” Flying Club. This IS the most fun flying club in the history of ever,” says Joe.

Joe Borzelleri and John "Cabi" Cabigas Founders

Joe Borzelleri and John “Cabi” Cabigas,  Founders

This “flying club”, which started out very much tongue in cheek, was meant to be fun from the get go. Joe says, “In the beginning it was my good J-3 Cub buddy, John (Cabi) Cabigas, and me. It was not meant to be a formal club and it still is not. There are no regular meetings, no by-laws, no board of directors, no dues and no rules. The name Cheap Suit came about when Cabi suggested the use of a VHF interplane frequency that approximated the price of an inexpensive suit.”

Not long after, Cabi shared a logo to use.  Joe designed the front of the shirt to have the look of a cheap brown leisure suit. Soon, both designs were on t-shirts and with that, they were a fully functioning club with a flight suit!

Soon a Facebook “Cheap Suit” page was created. That’s when things really took off. Cheap Suits began to post their fly outs and other shenanigans on Facebook. It didn’t take long to have a large following. Cubs, Colts, C-120s/140s and other fabric-covered fun performance airplanes, soon joined them.

Cheap Suits Flight Suit

Cheap Suits Flight Suit

Cabi has taught many of the Suits the finer points of flying safely in formation. They also have participated in several memorial missing man formations for other aviators who have gone west.

About two years into the “Cheap Suits” flying club’s tenure, Joe began to pursue the idea of taking over the day-to-day management of his home airport, Sutter County (O52).  He says, “I was inspired by you and Mitch and the Friends of Oceano Airport (L52,) to get out there to do something to keep my airport open and affordable. The group of pilots involved in the organization are very passionate and love their home airport. I was thinking that if we could organize a bunch of guys to go get a $100 burger nearly every weekend, we might be able to form a legitimate organization and come up with a plan to run our airport.”

By utilizing social media, email and posters, they were able to organize a large group of local pilots and aircraft owners to form a non-profit organization. With the help of the California Pilot’s Association they did just that.  It has been a little over 2 years since that first meeting, and the Sutter Buttes Regional Aviation Association, will take over the management of the Sutter County Airport (O52) on July 1st, 2014!  “It was a road paved with red tape, and we couldn’t have not done it without the help of Stephen Whitmarsh of SBRAA, Cal Pilot’s Jay White, Bill Dunn and John Pfeifer of AOPA, along with Corl Leach and Bill Turpie of the Lincoln Regional Pilot’s Association, Harrison Gibbs of the Turlock Regional Aviation Association and Geoff Logan of Business Aviation Insurance Services, Inc.” says Joe.

Sutter Buttes Regional Aviation Association

Sutter Buttes Regional Aviation Association

The “Cheap Suits” Flying Club has been around for 5 years now. During this time they have flown to over 100 fly outs and airshows, and have flown thousands of miles, in close formation. The Suits have eaten a million dollars’ worth of burgers and pie, formed a non-profit airport management group and created many close friendships with other airplane people. What they do isn’t so much about airplanes, though. It’s about fun times, flying memories, shredded toilet paper, river runs, making lifetime friendships, helping friends in need, and hanging out with people who love life.  Maybe a story like this will inspire you to do something fun at your home ‘drome.  After all if they knew in 1900s that fun was “good for one’s health and well-being,” who are we to argue?

https://www.facebook.com/pages/Cheap-Suits-Flying-Club/141010646601

http://www.sutterbuttesaviation.org/

http://www.CalPilots.org

The Hacked Airplane

Wednesday, May 14th, 2014

For better or worse, the relentless march of technology means we’re more connected than ever, in more places than ever. For the most part that’s good. We benefit from improving communication, situational awareness, and reduced pilot workload in the cockpit. But there’s a dark side to digital connectivity, and I predict it’s only a matter of time before we start to see it in our airborne lives.

Consider the recent Heartbleed security bug, which exposed countless user’s private data to the open internet. It wasn’t the first bug and it won’t be the last. Since a good pilot is always mindful the potential exigencies of flying, it’s high time we considered how this connectivity might affect our aircraft.

Even if you’re flying an ancient VFR-only steam gauge panel, odds are good you’ve got an Android or iOS device in the cockpit. And that GPS you rely upon? Whether it’s a portable non-TSO’d unit or the latest integrated avionics suite bestowed from on high by the Gods of Glass, your database updates are undoubtedly retrieved from across the internet. Oh, the database itself can be validated through checksums and secured through encryption, but who knows what other payloads might be living on that little SD card when you insert it into the panel.

“Gee, never thought about that”, you say? You’re not alone. Even multi-billion dollar corporations felt well protected right up to the moment that they were caught flat-footed. As British journalist Misha Glenny sagely noted, there are only two types of companies: those that know they’ve been hacked, and those that don’t.

Hackers are notoriously creative, and even if your computer is secure, that doesn’t mean your refrigerator, toilet, car, or toaster is. From the New York Times:

They came in through the Chinese takeout menu.

Unable to breach the computer network at a big oil company, hackers infected with malware the online menu of a Chinese restaurant that was popular with employees. When the workers browsed the menu, they inadvertently downloaded code that gave the attackers a foothold in the business’s vast computer network.

Remember the Target hacking scandal? Hackers obtained more than 40 million credit and debit card numbers from what the company believed to be tightly secured computers. The Times article details how the attackers gained access through Target’s heating and cooling system, and notes that connectivity has transformed everything from thermostats to printers into an open door through which cyber criminals can walk with relative ease.

Popular Mechanics details more than 10 billion devices connected to the internet in an effort to make our lives easier and more efficient, but also warns us that once everything is connected, everything will be open to hacking.

During a two-week long stretch at the end of December and the beginning of January, hackers tapped into smart TVs, at least one refrigerator, and routers to send out spam. That two-week long attack is considered one of the first Internet of Things hacks, and it’s a sign of things to come.

The smart home, for instance, now includes connected thermostats, light bulbs, refrigerators, toasters, and even deadbolt locks. While it’s exciting to be able to unlock your front door remotely to let a friend in, it’s also dangerous: If the lock is connected to the same router your refrigerator uses, and if your refrigerator has lax security, hackers can enter through that weak point and get to everything else on the network—including the lock.

"There's an app for that!".  The Gulfstream interior can be controlled via an iOS device.

“There’s an app for that!”. The Gulfstream interior can be controlled via an iOS device.

We can laugh at the folly of connecting a bidet or deadbolt to the internet, but let’s not imagine we aren’t equally vulnerable. Especially in the corporate/charter world, today’s airplanes often communicate with a variety of satellite and ground sources, providing diagnostic information, flight times, location data, and more. Gulfstream’s Elite cabin allows users to control window shades, temperature, lighting, and more via a wireless connection to iOS devices. In the cockpit, iPads are now standard for aeronautical charts, quick reference handbooks, aircraft and company manuals, and just about everything else that used to be printed on paper. Before certification, the FAA expressed concern about the Gulfstream G280′s susceptibility to digital attack.

But the biggest security hole for the corporate/charter types is probably the on-board wi-fi systems used by passengers in flight. Internet access used to be limited below 10,000 feet, but the FAA’s recent change on that score means it’s only a matter of time before internet access is available at all times in the cabin. And these systems are often comprised of off-the-shelf hardware, with all the attendant flaws and limitations.

Even if it’s not connected to any of the aircraft’s other systems, corporate and charter aircraft typically carry high net-worth individuals, often businessmen who work while enroute. It’s conceivable that a malicious individual could sit in their car on the public side of the airport fence and hack their way into an aircraft’s on-board wi-fi, accessing the sensitive data passengers have on their laptops without detection.

What are the trade secrets and business plans of, say, a Fortune 100 company worth? And what kind of liability would the loss of such information create for the hapless charter company who found themselves on the receiving end of such an attack? I often think about that when I’m sitting at Van Nuys or Teterboro, surrounded by billions of dollars in jet hardware.

Aspen's Connected Panel

Aspen’s Connected Panel

Internet connectivity is rapidly becoming available to even the smallest general aviation aircraft. Even if you’re not flying behind the latest technology from Gulfstream or Dassault, light GA airplanes still sport some cutting-edge stuff. From the Diamond TwinStar‘s Engine Control Units to the electronic ignition systems common in many Experimental aircraft to Aspen’s Connected Panel, a malicious hacker with an aviation background and sufficient talent could conceivably wreak serious havoc.

Mitigating these risks requires the same strategies we apply to every other piece of hardware in our airplanes: forethought, awareness, and a good “Plan B”. If an engine quits, for example, every pilot know how to handle it. Procedures are committed to memory and we back it up with periodic recurrent training. If primary flight instruments are lost in IMC, a smart pilot will be prepared for that eventuality.

As computers become an ever more critical and intertwined part of our flying, we must apply that same logic to our connected devices. Otherwise we risk being caught with our pants down once the gear comes up.

Quest for a TBO-Free Engine

Tuesday, May 13th, 2014

“It just makes no sense,” Jimmy told me, the frustration evident in his voice. “It’s unfair. How can they do this?”

Jimmy Tubbs, ECi’s legendary VP of Engineering

Jimmy Tubbs, ECi’s legendary VP of Engineering

I was on the phone with my friend Jimmy Tubbs, the legendary Vice President of Engineering for Engine Components Inc. (ECi) in San Antonio, Texas. ECi began its life in the 1940s as a cylinder electroplating firm and grew to dominate that business. Starting in the mid-1970s and accelerating in the late 1990s—largely under Jimmy’s technical stewardship—the company transformed itself into one of the two major manufacturers of new FAA/PMA engine parts for Continental, Lycoming and Pratt & Whitney engines (along with its rival Superior Air Parts).

By the mid-2000s, ECi had FAA approval to manufacture thousands of different PMA-approved engine parts, including virtually every component of four-cylinder Lycoming 320- and 360-series engines (other than the Lycoming data plate). So the company decided to take the next logical step: building complete engines. ECi’s engine program began modestly with the company offering engines in kit form for the Experimental/Amateur-Built (E-AB) market. They opened an engine-build facility where homebuilders could assemble their own ECi “Lycoming-style” engines under expert guidance and supervision. Then in 2013, with more than 1,600 kit-built engines flying, ECi began delivering fully-built engines to the E-AB market under the “Titan Engines” brand name.

Catch 22, FAA-style

ECi’s Titan Exp experimental engine

A Titan engine for experimental airplanes.
What will it take to get the FAA to certify it?

Jimmy is now working on taking ECi’s Titan engine program to the next level by seeking FAA approval for these engines to be used in certificated aircraft. In theory, this ought to be relatively easy (as FAA certification efforts go) because the Titan engines are nearly identical in design to Lycoming 320 and 360 engines, and almost all the ECi-built parts are already PMA approved for use in Lycoming engines. In practice, nothing involving the FAA is as easy as it looks.

“They told me the FAA couldn’t approve an initial TBO for these engines longer than 1,000 hours,” Jimmy said to me with a sigh. He had just returned from a meeting with representatives from the FAA Aircraft Certification Office and the Engine & Propeller Directorate. “I explained that our engines are virtually identical in all critical design respects to Lycoming engines that have a 2,000-hour TBO, and that every critical part in our engines is PMA approved for use in those 2,000-hour engines.”

“But they said they could only approve a 1,000-hour TBO to begin with,” Jimmy continued, “and would consider incrementally increasing the TBO after the engines had proven themselves in the field. Problem is that nobody is going to buy one of our certified engines if it has only a 1,000-hour TBO, so the engines will never get to prove themselves. It makes no sense, Mike. It’s not reasonable. Not logical. Doesn’t seem fair.”

I certainly understood where Jimmy was coming from. But I also understood where the FAA was coming from.

A brief history of TBO

To quote a 1999 memorandum from the FAA Engine & Propeller Directorate:

The initial models of today’s horizontally opposed piston engines were certified in the late 1940s and 1950s. These engines initially entered service with recommended TBOs of 500 to 750 hours. Over the next 50 years, the designs of these engines have remained largely unchanged but the manufacturers have gradually increased their recommended TBOs for existing engine designs to intervals as long as 2,000 hours. FAA acceptance of these TBO increases was based on successful service, engineering design, and test experience. New engine designs, however, are still introduced with relatively short TBOs, in the range of 600 hours to 1,000 hours.

From the FAA’s perspective, ECi’s Titan engines are new engines, despite the fact that they are virtually clones of engines that have been flying for six decades, have a Lycoming-recommended TBO of 2,000 hours, and routinely make it to 4,000 or 5,000 hours between overhauls.

Is it any wonder we’re still flying behind engine technology designed in the ‘40s and ‘50s? If the FAA won’t grant a competitive TBO to a Lycoming clone, imagine the difficulties that would be faced by a company endeavoring to certify a new-technology engine. Catch 22.

Preparing for an engine test cell endurance run.

Incidentally, there’s a common misconception that engine TBOs are based on the results of endurance testing by the manufacturer. They aren’t. The regulations that govern certification of engines (FAR Part 33) require only that a new engine design be endurance tested for 150 hours in order to earn certification. Granted, the 150-hour endurance test is fairly brutal: About two-thirds of the 150 hours involves operating the engine at full takeoff power with CHT and oil temperature at red-line. (See FAR 33.49 for the gory details.) But once the engine survives its 150-hour endurance test, the FAA considers it good to go.

In essence, the only endurance testing for engine TBO occurs in the field. Whether we realize it or not, those of us who fly behind piston aircraft engines have been pressed into service as involuntary beta testers.

What about a TBO-free engine?

“Jimmy, this might be a bit radical” I said, “but where exactly in FAR Part 33 does it state that a certificated engine has to have a recommended TBO?” (I didn’t know the answer, but I was sure Jimmy had Part 33 committed to memory.)

“Actually, it doesn’t,” Jimmy answered. “The only place TBO is addressed at all is in FAR 33.19, where it says that ‘engine design and construction must minimize the development of an unsafe condition of the engine between overhaul periods.’ But nowhere in Part 33 does it say that any specific overhaul interval must be prescribed.”

“So you’re saying that engine TBO is a matter of tradition rather than a requirement of regulation?”

“I suppose so,” Jimmy admitted.

“Well then how about trying to certify your Titan engines without any TBO?” I suggested. “If you could pull that off, you’d change our world, and help drag piston aircraft engine maintenance kicking and screaming into the 21st century.”

An FAA-inspired roadmap

I pointed out to Jimmy that there was already a precedent for this in FAR Part 23, the portion of the FARs that governs the certification of normal, utility, aerobatic and commuter category airplanes. In essence, Part 23 is to non-transport airplanes what Part 33 is to engines. On the subject of airframe longevity, Part 23 prescribes an approach that struck me as being also appropriate for dealing with engine longevity.

Since 1993, Part 23 has required that an applicant for an airplane Type Certificate must provide the FAA with a longevity evaluation of metallic  wing, empennage and pressurized cabin structures. The applicant has the choice of three alternative methods for performing this evaluation. It’s up to the applicant to choose which of these methods to use:

  • “Safe-Life” —The applicant must define a “safe-life” (usually measured in either hours or cycles) after which the structure must be taken out of service. The safe-life is normally established by torture-testing the structure until it starts to fail, then dividing the time-to-failure by a safety factor (“scatter factor”) that is typically in the range of 3 to 5 to calculate the approved safe-life of the structure. For example, the Beech Baron 58TC wing structure has a life limit (safe-life) of 10,000 hours, after which the aircraft is grounded. This means that Beech probably had to torture-test the wing spar for at least 30,000 hours and demonstrate that it didn’t develop cracks.
  • “Fail-Safe” —The applicant must demonstrate that the structure has sufficient redundancy that it can still meet its ultimate strength requirements even after the complete failure of any one principal structural element. For example, a three-spar wing that can meet all certification requirements with any one of the three spars hacksawed in half would be considered fail-safe and would require no life limitation.
  • “Damage Tolerance” —The applicant must define a repetitive inspection program that can be shown with very high confidence to detect structural damage before catastrophic failure can occur. This inspection program must be incorporated into the Airworthiness Limitations section of the airplane’s Maintenance Manual or Instructions for Continued Airworthiness, and thereby becomes part of the aircraft’s certification basis.

If we were to translate these Part 23 (airplane) concepts to the universe of FAR Part 33 (engines):

  • Safe-life would be the direct analog of TBO; i.e., prescribing a fixed interval between overhauls.
  • Fail-safe would probably be impractical, because an engine that included enough redundancy to meet all certification requirements despite the failure of any principal structural element (e.g., a crankcase half, cylinder head or piston) would almost surely be too heavy.
  • Damage tolerance would be the direct analog of overhauling the engine strictly on-condition (based on a prescribed inspection program) with no fixed life limit. (This is precisely what I have been practicing and preaching for decades.)

How would it work?

SavvyAnalysis chart

Engine monitor data would be uploaded regularly to a central repository for analysis.

Jimmy and I have had several follow-on conversations about this, and he’s starting to draft a detailed proposal for an inspection protocol that we hope might be acceptable to the FAA as a basis of certifying the Titan engines on the basis of damage tolerance and eliminate the need for any recommended TBO. This is still very much a work-in-progress, but here are some of the thoughts we have so far:

  • The engine installation would be required to include a digital engine monitor that records EGTs and CHTs for each cylinder plus various other critical engine parameters (e.g., oil pressure and temperature, fuel flow, RPM). The engine monitor data memory would be required to be dumped on a regular basis and uploaded via the Internet to a central repository prescribed by ECi for analysis. The uploaded data would be scanned automatically by software for evidence of abnormalities like high CHTs, low fuel flow, failing exhaust valves, non-firing spark plugs, improper ignition timing, clogged fuel nozzles, detonation and pre-ignition. The data would also be available online for analysis by mechanics and ECi technical specialists.
  • At each oil-change interval, the following would be required: (1) An oil sample would be taken for spectrographic analysis (SOAP) by a designated laboratory, and a copy of the SOAP reports would be transmitted electronically to ECi; and (2) The oil filter would be cut open for inspection, digital photos of the filter media would be taken, when appropriate the filter media would be sent for scanning electron microscope (SEM) evaluation by a designated laboratory, and the media photos and SEM reports would be transmitted electronically to ECi.
  • At each annual or 100-hour inspection, the following would be required: (1) Each cylinder would undergo a borescope inspection of the valves, cylinder bores and piston crowns using a borescope capable of capturing digital images, and the borescope images would be transmitted electronically to ECi; (2) Each cylinder rocker cover would be removed and digital photographs of the visible valve train components would be transmitted electronically to ECi; (3) The spark plugs would be removed for cleaning/gapping/rotation, and digital photographs of the electrode ends of the spark plugs would be taken and transmitted electronically to ECi; and (4) Each cylinder would undergo a hot compression test and the test results be transmitted electronically to ECi.

The details still need to be ironed out, but you get the drift. If such a protocol were implemented for these engines (and blessed by the FAA), ECi would have the ability to keep very close tabs on the mechanical condition and operating parameters of each its engines—something that no piston aircraft engine manufacturer has ever been able to do before—and provide advice to each individual Titan engine owner about when each individual engine is in need of an overhaul, teardown inspection, cylinder replacement, etc.

Jimmy even thinks that if such a protocol could be implemented and approved, ECi might even be in a position to offer a warranty for these engines far beyond what engine manufacturers and overhaul shops have been able to offer in the past. That would be frosting on the cake.

I’ve got my fingers, toes and eyes crossed that the FAA will go along with this idea of an engine certified on the basis of damage tolerance rather than safe-life. It would be a total game-changer, a long overdue nail in the coffin of the whole misguided notion that fixed-interval TBOs for aircraft engines make sense. And if ECi succeeds in getting its Titan engine certified on the basis of condition monitoring rather than fixed TBO, maybe Continental and Lycoming might jump on the overhaul-on-condition bandwagon. Wouldn’t that be something?

Contracting: A Great Career Option for the Professional Pilot

Wednesday, April 16th, 2014

As much as one may love flying, it can be a tough career choice. Many pilots struggle through the food chain only to end up discouraged, if not downright hating their job. We’re all aware of the reasons: low pay, long days, little respect, too much time away from home, difficult working conditions, commuting, regulatory hassles, bankruptcies, furloughs, and ruinously expensive training.

Quite a list, isn’t it?

Ours is a small community; word gets around, and it begs the question, how many have bypassed a flying career altogether because of it? I once read a survey suggesting that most pilots would not recommend the field to their children. Of course, many vocations are in this rickety boat. Even formerly high-flying professions like physician and attorney have lost their luster. The message: “it ain’t what it used to be”.

On the other hand, life is often what we make of it. From bush flying to firefighting, there are many different gigs out there for those willing to take Frost’s road-less-traveled. For the past three years, for example, I’ve been flying as a “contract pilot” and truly enjoy it.

The Contractor

Ready to Ride

It’s kind of a generic term, since anyone who flies as an independent contractor rather than a traditional, W-2 employee fits the definition, but I’ll focus on Part 91 and 135 corporate/charter flying because that’s what I know best.

Contract pilots function as a kind of overflow labor. Operators might need temporary help in the cockpit for a variety of reasons: a full-timer is sick, on vacation, leaves the company, times out due to regulatory limitations, or is unavailable for some other reason. God forbid, maybe they ran into trouble with a checkride or medical exam. Perhaps a trip requires multiple pilots due to length or logistics.

Some companies find it advantageous to run tight on full-time labor and supplement with contract pilots since there are no annual costs for training or benefits. They only have to pay contractors when they’re actually used, so as the flight schedule ebbs and flows, they can gracefully scale their workforce up or down without the inefficiency of, say, leaving full-time, salaried pilots sitting at home for an extended period.

For the pilot, there are both pros and cons to life as a contractor.

The Pros

  • You’ve got some control over your schedule and can decline trips. I really hate doing that, because a) I don’t want the company to stop calling me, and b) you never know when things will slow down, so it’s smart to sock away some acorns for the winter. But if you’ve got a big vacation planned or your best friend is getting married? You’re ultimately in control.
  • We can work for multiple operators, which can provide a bit of protection if the flying slows down at one company.
  • You aren’t tied to a seniority system. If you’re an experienced captain at company A, you needn’t start over as the lowest-paid right seater at company B.
  • Contractors earn far more per day than full-time employees, and therefore needn’t work as many days to reach a given income level. That means better quality of life, especially if you’re married and/or have kids.
  • Contract pilots are typically paid by the day. I might have a five day trip consisting of a flight to Hawaii followed by three days on the island before flying home. That’s five days “on the clock”. It can be a more lucrative system than one where you are compensated based on flight hours. Operators are essentially purchasing your time.
  • You’ll travel the country, if not the world. Instead of a few major airports, on larger aircraft like the Gulfstream, you’ll see places you’d never dream of. Though I haven’t been there — yet — North Korea and the South Pole have both been on the table. (Random note: Jeppesen does publish charts and procedures for Pyonyang!)
  • I always get an honest sense of gratitude from the operators for whom I fly, because by definition I’m helping them out when they really need a pilot. For example, I recently got a call from a Part 91 Gulfstream operator whose pilot broke his arm in the middle of a trip. I airlined out the same day and flew that evening’s leg to Las Vegas, keeping the aircraft on schedule.

The Cons

You knew there had to be a few, right?

  • Contractors inherit all the hassles of being your own boss. Does anyone work harder? From providing your own benefits (don’t get me started about healthcare) to paying self-employment taxes, it’s not always the carefree work-and-go-home experience of a full-time employee.
  • You pay for your own training. On a jet, the annual recurrent training costs run in the thousands. I currently allot $15,000/year for recurrent training and associated costs (airfare, hotels, food, incidentals) on my airplane. The expenses are deductible, which helps a bit, but I figure my first month’s work each year is spent digging my way back to financial “zero”.
  • You can’t control when the phone rings. That can mean short-notice trips and/or weird hours.
  • It can be hard to plan your life out when you never know what days you’ll be working. I average about 10 days a month away, so my philosophy has been to just plan my social life as usual, and make sure people know I sometimes have to reschedule or cancel.
  • Work can conflict with itself. I’ve had three operators call me for a trip on the same day. I can only be in one place at at time, so I “missed out” on two of them.
  • No guarantee of work. But then, history has shown that there are no guarantees in life or aviation for anyone, are there?
  • It can be tough getting started. As with many careers, the best entrée is knowing someone who can get you in the door. Initial start-up costs of obtaining a type rating can be a major barrier.

Throttles

I like contracting because when a trip is offered I know it’s because the operator wants to use me rather than has to use me. Contracting represents some of the best that flying has to offer: adventure, interesting destinations and passengers, phenomenal aircraft, and decent pay for the work I do.

So why don’t more people jump into contracting? Awareness, for starters. Not everyone knows about this little niche. Also, it can be tough to break in to the business. You don’t have to know someone on the inside, but it certainly helps.

The initial expense is probably the largest impediment. The best compensation is found on the larger aircraft, and that means an expensive type rating funded solely by the contractor. Some pilots speculate on their ability to get work by obtaining the type before they have a job to use it on. Unless you’re well-heeled, that’s a big financial risk, but it works out for some people.

There is a rather circuitous way around the type rating burden: start off as a salaried employee and switch to contracting after a couple of years. That way the operator pays for your training and in exchange you accumulate a significant body of experience on the airplane.

FAA to the Rescue! Not.

I should note that contracting in the Part 135 world is a bit harder than it used to be. In the old days, if you were typed and current on an aircraft, you could fly for any charter company that operated that kind of plane. It wasn’t uncommon for a contract pilot to fly for several operators. A few years ago — for reasons no one has been able to adequately explain — the FAA essentially did away with that capability.

Today, a five-figure recurrent only entitles you to work for the certificate holder under whom you trained. It doesn’t matter if you’re a veteran of ten years and 10,000 hours in a Gulfstream IV; if you went to recurrent on Company A’s OpSpec, as far as the FAA is concerned, when you move to Company B you are completely unqualified to operate a G-IV on any Part 135 flight until you’ve been through another recurrent… at your own expense, of course.

At first, this seemed like a potential deal-breaker for contract pilots, but it can help as much as it hurts. Just as the change make it harder for a contractor to work for multiple operators, it also makes it more challenging for that operator to replace a contract pilot since a successor wouldn’t be legal to fly until they went back for recurrent training.

Walking the Aviation Tightrope

Contracting does have something in common with scheduled airlines: it’s not right for everyone. If you’re the type that wants a fixed schedule or has to know exactly how much your bi-weekly paycheck is going to be, this ain’t the place. In addition to all the attributes of a good corporate or charter pilot, contracting requires the ability to run a business and cope with uneven income. Some months will be fantastic. Others, not so much. Even when business is slow, though, I get something valuable: more time at home with friends and family. Like I said at the top, life is what you make of it.

But the ability to earn a six figure income right off the bat while working a relatively small number of days? For me at least, it’s more than worth it. What I want in my flying carer is sustainability, the capacity to survive on this aviation tightrope, and ironically that’s what contracting provides. I want to fly without hating it, and that means avoiding the soul-crushing schedule and monotony of many professional flying jobs.

How Do Piston Aircraft Engines Fail?

Wednesday, April 9th, 2014

Last month, I tried to make the case that piston aircraft engines should be overhauled strictly on-condition, not at some fixed TBO. If we’re going to do that, we need to understand how these engines fail and how we can protect ourselves against such failures. The RCM way of doing that is called Failure Modes and Effects Analysis (FMEA), and involves examining each critical component of these engines and looking at how they fail, what consequences those failures have, and what practical and cost-efficient maintenance actions we can take to prevent or mitigate those failures. Here’s my quick back-of-the-envelope attempt at doing that…

Crankshaft

CrankshaftsThere’s no more serious failure mode than crankshaft failure. If it fails, the engine quits.

Yet crankshafts are rarely replaced at overhaul. Lycoming did a study that showed their crankshafts often remain in service for more than 14,000 hours (that’s 7+ TBOs) and 50 years. Continental hasn’t published any data on this, but their crankshafts probably have similar longevity.

Crankshafts fail in three ways: (1) infant-mortality failures due to improper materials or manufacture; (2) failures following unreported prop strikes; and (3) failures secondary to oil starvation and/or bearing failure.

Over the past 15 years, we’ve seen a rash of infant-mortality failures of crankshafts. Both Cnntinental and Lycoming have had major recalls of crankshafts that were either forged from bad steel or were damaged during manufacture. These failures invariably occurred within the first 200 hours after the new crankshaft entered service. If the crankshaft survived its first 200 hours, we can be confident that it was manufactured correctly and should perform reliably for numerous TBOs.

Unreported prop strikes seem to be getting rare because owners and mechanics are becoming smarter about the high risk of operating an engine after a prop strike. There’s now an AD mandating a post-prop-strike engine teardown for Lycoming engines, and a strongly worded service bulletin for Continental engines. Insurance will always pay for the teardown and any necessary repairs, so it’s a no-brainer.

That leaves failures due to oil starvation and/or bearing failure. I’ll address that shortly.

Crankcase halvesCrankcase

Crankcases are also rarely replaced at major overhaul. They are typically repaired as necessary, align-bored to restore critical fits and limits, and often provide reliable service for many TBOs. If the case remains in service long enough, it will eventually crack. The good news is that case cracks propagate slowly enough that a detailed visual inspection once a year is sufficient to detect such cracks before they pose a threat to safety. Engine failures caused by case cracks are extremely rare—so rare that I don’t think I ever remember hearing or reading about one.

Lycoming cam and lifterCamshaft and Lifters

The cam/lifter interface endures more pressure and friction than any other moving parts n the engine. The cam lobes and lifter faces must be hard and smooth in order to function and survive. Even tiny corrosion pits (caused by disuse or acid buildup in the oil) can lead to rapid destruction (spalling) of the surfaces and dictate the need for a premature engine teardown. Cam and lifter spalling is the number one reason that engines fail to make TBO, and it’s becoming an epidemic in the owner-flown fleet where aircraft tend to fly irregularly and sit unflown for weeks at a time.

The good news is that cam and lifter problems almost never cause catastrophic engine failures. Even with a badly spalled cam lobe (like the one pictured at right), the engine continues to run and make good power. Typically, a problem like this is discovered at a routine oil change when the oil filter is cut open and found to contain a substantial quantity of ferrous metal, or else a cylinder is removed for some reason and the worn cam lobe can be inspected visually.

If the engine is flown regularly, the cam and lifters can remain in pristine condition for thousands of hours. At overhaul, the cam and lifters are often replaced with new ones, although a reground cam and reground lifters are sometimes used and can be just as reliable.

Gears

The engine has lots of gears: crankshaft and camshaft gears, oil pump gears, accessory drive gears for fuel pump, magnetos, prop governor, and sometimes alternator. These gears are made of case-hardened steel and typically have a very long useful life. They are not usually replaced at overhaul unless obvious damage is found. Engine gears rarely cause catastrophic engine failures.

Oil Pump

Failure of the oil pump is rarely responsible for catastrophic engine failures. If oil pressure is lost, the engine will seize quickly. But the oil pump is dead-simple, consisting of two steel gears inside a close-tolerance aluminum housing, and usually operates trouble free. The pump housing can get scored if a chunk of metal passes through the oil pump—although the oil pickup tube has a suction screen to make sure that doesn’t happen—but even if the pump housing is damaged, the pump normally has ample output to maintain adequate oil pressure in flight, and the problem is mainly noticeable during idle and taxi. If the pump output seems deficient at idle, the oil pump housing can be removed and replaced without tearing down the engine.

spun main bearingBearings

Bearing failure is responsible for a significant number of catastrophic engine failures. Under normal circumstances, bearings have a long useful life. They are always replaced at major overhaul, but it’s not unusual for bearings removed at overhaul to be in pristine condition with little detectable wear.

Bearings fail prematurely for three reasons: (1) they become contaminated with metal from some other failure; (2) they become oil-starved when oil pressure is lost; or (3) main bearings become oil-starved because they shift in their crankcase supports to the point where their oil supply holes become misaligned (as with the “spun bearing” pictured at right).

Contamination failures can generally be prevented by using a full-flow oil filter and inspecting the filter for metal at every oil change. So long as the filter is changed before its filtering capacity is exceeded, metal particles will be caught by the filter and won’t get into the engine’s oil galleries and contaminate the bearings. If a significant quantity of metal is found in the filter, the aircraft should be grounded until the source of the metal is found and corrected.

Oil-starvation failures are fairly rare. Pilots tend to be well-trained to respond to decreasing oil pressure by reducing power and landing at the first opportunity. Bearings will continue to function properly at partial power even with fairly low oil pressure.

Spun bearings are usually infant-mortality failures that occur either shortly after an engine is overhauled (due to an assembly error) or shortly after cylinder replacement (due to lack of preload on the through bolts). Failures occasionally occur after a long period of crankcase fretting, but such fretting is usually detectable through oil filter inspection and oil analysis).They can also occur after extreme unpreheated cold starts, but that is quite rare.

Thrown Connecting RodConnecting Rods

Connecting rod failure is responsible for a significant number of catastrophic engine failures. When a rod fails in flight, it often punches a hole in the crankcase (“thrown rod”) and causes loss of engine oil and subsequent oil starvation. Rod failure have also been known to cause camshaft breakage. The result is invariably a rapid and often total loss of engine power.

Connecting rods usually have a long useful life and are not normally replaced at overhaul. (Rod bearings, like all bearings, are always replaced at overhaul.) Many rod failures are infant-mortality failures caused by improper tightening of the rod cap bolts during engine assembly. Rod failures can also be caused by the failure of the rod bearings, often due to oil starvation. Such failures are usually random failures unrelated to time since overhaul.

Pistons and Rings

Piston and ring failures usually cause only partial power loss, but in rare cases can cause complete power loss. Piston and ring failures are of two types: (1) infant-mortality failures due to improper manufacturer or assembly; and (2) heat-distress failures caused by pre-ignition or destructive detonation events. Heat-distress failures can be caused by contaminated fuel (e.g., 100LL laced with Jet A), or by improper engine operation. They are generally unrelated to hours or years since overhaul. A digital engine monitor can alert the pilot to pre-ignition or destructive detonation events in time for the pilot to take corrective action before heat-distress damage is done.

Head SeparationCylinders

Cylinder failures usually cause only partial power loss, but occasionaly can cause complete power loss. A cylinder consists of a forged steel barrel mated to an aluminum alloy head casting. Cylinder barrels typically wear slowly, and excessive wear is detected at annual inspection by means of compression tests and borescope inspections. Cylinder heads can suffer fatigue failures, and occasionally the head can separate from the barrel. As dramatic as it sounds, a head separation causes only a partial loss of power; a six-cylinder engine with a head-to-barrel separation can still make better than 80% power. Cylinder failures can be infant-mortality failures (due to improper manufacture) or age-related failures (especially if the cylinder head remains in service for more than two or three TBOs). Nowadays, most major overhauls include new cylinders, so age-related cylinder failures have become quite rare.

Broken Exhaust ValveValves and Valve Guides

It is quite common for exhaust valves and valve guides to develop problems well short of TBO. Actual valve failures are becoming much less common nowadays because incipient problems can usually be detected by means of borescope inspections and digital engine monitor surveillance. Even if a valve fails completely, the result is usually only partial power loss and an on-airport emergency landing.

Rocker Arms and Pushrods

Rocker arms and pushrods (which operate the valves) typically have a long useful life and are not normally replaced at overhaul. (Rocker bushings, like all bearings, are always replaced at overhaul.) Rocker arm failure is quite rare. Pushrod failures are caused by stuck valves, and can almost always be avoided through regular borescope inspections. Even when they happen, such failures usually result in only partial power loss.

Failed Mag Distributor GearsMagnetos and Other Ignition Components

Magneto failure is uncomfortably commonplace. Mags are full of plastic components that are less than robust; plastic is used because it’s non-conductive. Fortunately, our aircraft engines are equipped with dual magnetos for redundancy, and the probability of both magnetos failing simultaneously is extremely remote. Mag checks during preflight runup can detect gross ignition system failures, but in-flight mag checks are far better at detecting subtle or incipient failures. Digital engine monitors can reliably detect ignition system malfunctions in real time if the pilot is trained to interpret the data. Magnetos should religiously be disassembled, inspected and serviced every 500 hours; doing so drastically reduces the likelihood of an in-flight magneto failure.

The Bottom Line

The bottom-end components of our piston aircraft engines—crankcase, crankshaft, camshaft, bearings, gears, oil pump, etc.—are very robust. They normally exhibit long useful life that are many multiples of published TBOs. Most of these bottom-end components (with the notable exception of bearings) are routinely reused at major overhaul and not replaced on a routine basis. When these items do fail prematurely, the failures are mostly infant-mortality failures that occur shortly after the engine is built, rebuilt or overhauled, or they are random failures unrelated to hours or years in service. The vast majority of random failures can be detected long before they get bad enough to cause an in-flight engine failure simply by means of routine oil-filter inspection and laboratory oil analysis.

The top-end components—pistons, cylinders, valves, etc.—are considerably less robust. It is not at all unusual for top-end components to fail prior to TBO. However, most of these failures can be prevented by regular borescope inspections and by use of modern digital engine monitors. Even whey they happen, top-end failures usually result in only partial power loss and a successful on-airport landing, and they usually can be resolved without having to remove the engine from the aircraft and sending it to an engine shop. Most top-end failures are infant-mortality or random failures that do not correlate with time since overhaul.

The bottom line is that a detailed FMEA of piston aircraft engines strongly suggests that the traditional practice of fixed-interval engine overhaul or replacement is unwarranted and counterproductive. A conscientiously applied program of condition monitoring that includes regular oil filter inspection, oil analysis, borescope inspections and digital engine monitor data analysis can yield improved reliability and much reduced expense and downtime.

The Journey of a Thousand Miles

Wednesday, March 19th, 2014

For as long as I can remember, “no news” has been “good news” when it comes to rules and regulations in the world of aviation. From field approval policy to sleep apnea to CBP searches and security theatre, any diktat emanating from Washington or Oklahoma City was sure to involve increasing demands of time and money while diminishing the usefulness and enjoyment of general aviation. That was the trend.

What a breath of fresh air it is, then, to hear of a well-suported and coordinated effort in both houses of Congress to enact legislation which would eliminate formal medical certification for many aviators.

Like the House bill, the new Senate legislation would exempt pilots who make noncommercial VFR flights in aircraft weighing up to 6,000 pounds with no more than six seats from the third-class medical certification process. Pilots would be allowed to carry up to five passengers, fly at altitudes below 14,000 feet msl, and fly no faster than 250 knots.

When the bill was first offered in the House of Representatives as the General Aviation Pilot Protection Act, it seemed like a long shot. Congress is not a known for acting boldly to free Americans from the heavy yoke of regulation, so one could be forgiven for not getting their hopes up. But now things are different: there’s a matching bill in the Senate, the House iteration has 52 co-sponsors, and the Congressional General Aviation Caucus has grown to more than 250 members.

Is it a done deal, then? Not at all. There’s no guarantee of passage or that President Obama would even sign the bill into law. But the sponsors and caucus members represent a good mix from across the political spectrum, and there are no special interests of any significance who benefit from the medical certification machinery, so I believe the prospects are encouraging.

This Pilot Protection Act is exceptional for several reasons. First, it goes far beyond even the historically pie-in-the-sky proposal fronted collectively by AOPA and EAA. When was the last time that happened? I can’t recall a single example. Typically we’ll ask for X and end up feeling extraordinary fortunate to get even half of it.

That AOPA/EAA submission, by the way, has languished on the FAA’s desk for two years and has yet to be acted upon by the agency. If one needed proof of just how sclerotic the bureaucratic machine has become, this is it. The delay is egregious enough to have warranted an official apology from FAA Administrator Huerta.

Just as importantly, though, is the fact that this is a legislative move rather than a regulatory one. It’s an important distinction, because regulations are instituted with relative impunity by agencies like the FAA, while Congress passes laws that are not nearly as vulnerable to bureaucratic vagaries. In other words, if the FAA instituted the very same change in medical certification through regulatory channels, they could alter or reverse those improvements just as easily. A law, on the other hand, should prove far more durable since the Feds must comply with it whether they like it or not.

It’s a shame that this common-sense change requires a literal Act of Congress. And what does it say about the FAA that a body with 9% approval rating is coming to the rescue of the private pilot? Were it to remain in the FAA’s corner, this medical exemption would probably never see the light of day. I don’t just mean that it would not be approved, I mean it would never even be acted upon at all.

There is a certain schadenfreude which comes from watching the FAA, which is known for soliciting comments from the aviation industry only to ignore that input, suffer the same fate at the hands of the House and Senate. My only question is: what took so long? The last time Congress lent the industry a helping hand was with the General Aviation Revitalization Act. That was in 1994 — twenty years ago. While I’m thankful they’re finally getting off the bench and into the game, this boost is long overdue. I sincerely hope they will not only see it through, but look for other ways to help bring a uniquely American industry back from the brink.

An easing of the medical certification requirements will not fix all of GA’s woes. But if the journey of a thousand miles begins with a single step, perhaps this will at least get us headed in the right direction.

One final note: if you haven’t called your Representative and Senators to express strong support for H.R. 3708 and S. 2103, respectively, please do so! Unlike FAA employees, these folks are up for re-election in eight months. The closer we get to November, the more likely they are to listen.

Do Piston Engine TBOs Make Sense?

Thursday, March 13th, 2014

Last month, I discussed the pioneering work on Reliability-Centered Maintenance (RCM) done by United Airlines scientists Stan Nowlan and Howard Heap in the 1960s, and I bemoaned the fact that RCM has not trickled down the aviation food chain to piston GA. Even in the 21st century, maintenance of piston aircraft remains largely time-based rather than condition-based.

mfr_logo_montageMost owners of piston GA aircraft dutifully overhaul their engines at TBO, overhaul their propellers every 5 to 7 years, and replace their alternators and vacuum pumps every 500 hours just as Continental, Lycoming, Hartzell, McCauley, HET and Parker Aerospace call for. Many Bonanza and Baron owners have their wing bolts pulled every five years, and most Cirrus owners have their batteries replaced every two years for no good reason (other than that it’s in the manufacturer’s maintenance manual).

Despite an overwhelming body of scientific research demonstrating that this sort of 1950s-vintage time-based preventive maintenance is counterproductive, worthless, unnecessary, wasteful and incredibly costly, we’re still doing it. Why?

Mostly, I think, because of fear of litigation. The manufacturers are afraid to change anything for fear of being sued (because if they change anything, that could be construed to mean that what they were doing before was wrong). Our shops and mechanics are afraid to deviate from what the manufacturers recommend for fear of being sued (because they deviated from manufacturers’ guidance).

Let’s face it: Neither the manufacturers nor the maintainers have any real incentive to change. The cost of doing all this counterproductive, worthless, unnecessary and wasteful preventive maintenance (that actually doesn’t prevent anything) is not coming out of their pockets. Actually, it’s going into their pockets.

If we’re going to drag piston GA maintenance kicking and screaming into the 21st century (or at least out of the 1950s and into the 1960s), it’s going to have to be aircraft owners who force the change. Owners are the ones with the incentive to change the way things are being done. Owners are the ones who can exert power over the manufacturers and maintainers by voting with their feet and their credit cards.

For this to happen, owners of piston GA aircraft need to understand the right way to do maintenance—the RCM way. Then they need to direct their shops and mechanics to maintain their aircraft that way, or take their maintenance business to someone who will. This means that owners need both knowledge and courage. Providing aircraft owners both of these things is precisely why I’m contributing to this AOPA Opinion Leaders Blog.

When are piston aircraft engines most likely to hurt you?

Fifty years ago, RCM researches proved conclusively that overhauling turbine engines at a fixed TBO is counterproductive, and that engine overhauls should be done strictly on-condition. But how can we be sure that his also applies to piston aircraft engines?

In a perfect world, Continental and Lycoming would study this issue and publish their findings. But for reasons mentioned earlier, this ain’t gonna happen. Continental and Lycoming have consistently refused to release any data on engine failure history of their engines, and likewise have consistently refused to explain how they arrive at the TBOs that they publish. For years, one aggressive plaintiff lawyer after another have tried to compel Continental and Lycoming to answer these questions in court. All have failed miserably.

So if we’re going to get answers to these critical questions, we’re going to have to rely on engine failure data that we can get our hands on. The most obvious source of such data is the NTSB accident database. That’s precisely what brilliant mechanical engineer Nathan T. Ulrich Ph.D. of Lee NH did in 2007. (Dr. Ulrich also was a US Coast Guard Auxiliary pilot who was unhappy that USCGA policy forbade him from flying volunteer search-and-rescue missions if his Bonanza’s engine was past TBO.)

Dr. Ulrich analyzed five years’ worth of NTSB accident data for the period 2001-2005 inclusive, examining all accidents involving small piston-powered airplanes (under 12,500 lbs. gross weight) for which the NTSB identified “engine failure” as either the probable cause or a contributing factor. From this population of accidents, Dr. Ulrich eliminated those involving air-race and agricultural-application aircraft. Then he analyzed the relationship between the frequency of engine-failure accidents and the number of hours on the engine since it was last built, rebuilt or overhauled. He did a similar analysis based on the calendar age of the engine since it  was last built, rebuilt or overhauled. The following histograms show the results of his study:

Ulrich study (hours)

Ulrich study (years)

If these histograms have a vaguely familiar look, it might be because they look an awful lot like the histograms generated by British scientist C.H. Waddington in 1943.

Now,  we have to be careful about how we interpret Dr. Ulrich’s findings. Ulrich would be the first to agree that NTSB accident data can’t tell us much about the risk of engine failures beyond TBO, simply because most piston aircraft engines are voluntarily euthanized at or near TBO. So it shouldn’t be surprising that we don’t see very many engine failure accidents involving engines significantly past TBO, since there are so few of them flying. (The engines on my Cessna 310 are at more than 205% of TBO, but there just aren’t a lot of RCM true believers like me in the piston GA community…yet.)

What Dr. Ulrich’s research demonstrates unequivocally is striking and disturbing frequency of “infant-mortality” engine-failure accidents during the first few years and first few hundred hours after an engine is built, rebuilt or overhauled. Ulrich’s findings makes it indisputably clear that by far the most likely time for you to fall out of the sky due to a catastrophic engine failure is when the engine is young, not when it’s old.

(The next most likely time for you to fall out of the sky is shortly after invasive engine maintenance in the field, particularly cylinder replacement, but that’s a subject for a future blog post…stay tuned!)

 So…Is there a good reason to overhaul your engine at TBO?

Engine overhaulIt doesn’t take a rocket scientist (or a Ph.D. in mechanical engineering) to figure out what all this means. If your engine reaches TBO and still gives every indication of being healthy (good performance, not making metal, healthy-looking oil analysis and borescope results, etc.), overhauling it will clearly degrade safety, not improve it. That’s simply because it will convert your low-risk old engine into a high-risk young engine. I don’t know about you, but that certainly strikes me as a remarkably dumb thing to do.

So why is overhauling on-condition such a tough sell to our mechanics and the engine manufacturers? The counter-argument goes something like this: “Since we have so little data about the reliability of past-TBO engines (because most engines are arbitrarily euthanized at TBO), how can we be sure that it’s safe to operate them beyond TBO?” RCM researchers refer to this as “the Resnikoff Conundrum” (after mathematician H.L. Resnikoff).

To me, it looks an awful lot like the same circular argument that was used for decades to justify arbitrarily euthanizing airline pilots at age 60, despite the fact that aeromedical experts were unanimous that this policy made no sense whatsoever. Think about it…

Roots of Reliability-Centered Maintenance

Tuesday, February 11th, 2014

Last month, I discussed the pioneering WWII-era work of the eminent British scientist C.H. Waddington, who discovered that the scheduled preventive maintenance (PM) being performed on RAF B-24 bombers was actually doing more harm than good, and that drastically cutting back on such PM resulted in spectacular improvement in dispatch reliability of those aircraft. Two decades later, a pair of brilliant American engineers at United Airlines—Stan Nowlan and Howard Heap—independently rediscovered the utter wrongheadedness of traditional scheduled PM, and took things to the next level by formulating a rigorous engineering methodology for creating an optimal maintenance program to maximize safety and dispatch reliability while minimizing cost and downtime. Their approach became known as “Reliability-Centered Maintenance” (RCM), and revolutionized the way maintenance is done in the airline industry, military aviation, high-end bizjets, space flight, and numerous non-aviation applications from nuclear power plants to auto factories.

RCM wear-out curve

The traditional approach to PM assumes that most components start out reliable, and then at some point start becoming unreliable as they age

The “useful life” fallacy

Nowlan and Heap showed the fallacy of two fundamental principles underlying traditional scheduled PM:

  • Components start off being reliable, but their reliability deteriorates with age.
  • The useful life of components can be established statistically, so components can be retired or overhauled before they fail.

It turns out that both of these principles are wrong. To quote Nowlan and Heap:

“One of the underlying assumptions of maintenance theory has always been that there is a fundamental cause-and-effect relationship between scheduled maintenance and operating reliability. This assumption was based on the intuitive belief that because mechanical parts wear out, the reliability of any equipment is directly related to operating age. It therefore followed that the more frequently equipment was overhauled, the better protected it was against the likelihood of failure. The only problem was in determining what age limit was necessary to assure reliable operation. “In the case of aircraft it was also commonly assumed that all reliability problems were directly related to operating safety. Over the years, however, it was found that many types of failures could not be prevented no matter how intensive the maintenance activities. [Aircraft] designers were able to cope with this problem, not by preventing failures, but by preventing such failures from affecting safety. In most aircraft essential functions are protected by redundancy features which ensure that, in the event of a failure, the necessary function will still be available from some other source.

RCM six curves

RCM researchers found that only 2% of aircraft components have failures that are predominantly age-related (curve B), and that 68% have failures that are primarily infant mortality (curve F).

“Despite the time-honored belief that reliability was directly related to the intervals between scheduled overhauls, searching studies based on actuarial analysis of failure data suggested that the traditional hard-time policies were, apart from their expense, ineffective in controlling failure rates. This was not because the intervals were not short enough, and surely not because the tear down inspections were not sufficiently thorough. Rather, it was because, contrary to expectations, for many items the likelihood of failure did not in fact increase with increasing age. Consequently a maintenance policy based exclusively on some maximum operating age would, no matter what the age limit, have little or no effect on the failure rate.”

[F. Stanley Nowlan and Howard F. Heap, “Reliability-Centered Maintenance” 1978, DoD Report Number AD-A066579.]

Winning the war by picking our battles

FMEAAnother traditional maintenance fallacy was the intuitive notion that aircraft component failures are dangerous and need to be prevented through PM. A major focus of RCM was to identify the ways that various components fail, and then evaluate the frequency and consequences of those failures. This is known as “Failure Modes and Effects Analysis” (FMEA). Researchers found that while certain failure modes have serious consequences that can compromise safety (e.g., a cracked wing spar), the overwhelming majority of component failures have no safety impact and have consequences that are quite acceptable (e.g., a failed #2 comm radio or #3 hydraulic pump). Under the RCM philosophy, it makes no sense whatsoever to perform PM on components whose failure has acceptable consequences; the optimal maintenance approach for such components is simply to leave them alone, wait until they fail, and then replace or repair them when they do. This strategy is known as “run to failure” and is a major tenet of RCM.

A maintenance revolution…

Jet airliner

The 747, DC-10 and L-1011 were the first airliners that had RCM-based maintenance programs.

As a direct result of this research, airline maintenance practices changed radically. RCM-inspired maintenance programs were developed for the Boeing 747, Douglas DC-10 and Lockheed L-1011, and for all subsequent airliners. The contrast with the traditional (pre-RCM) maintenance programs for the Boeing 707 and 727 and Douglas DC-8 was astonishing. The vast majority of component TBOs and life-limits were abandoned in favor of an on-condition approach based on monitoring the actual condition of engines and other components and keeping them in service until their condition demonstrably deteriorated to an unacceptable degree. For example, DC-8 had 339 components with TBOs or life limits, whereas the DC-10 had only seven—and none of them were engines. (Research showed clearly that overhauling engines at a specific TBO didn’t make them safer, and actually did the opposite.) In addition, the amount of scheduled maintenance was drastically reduced. For example, the DC-8 maintenance program required 4,000,000 labor hours of major structural inspections during the aircraft’s first 20,000 hours in service, while the 747 maintenance program called for only 66,000 labor hours, a reduction of nearly two orders of magnitude.

Greybeard AMTs.

Owner-flown GA, particularly piston GA, is the only remaining segment of aviation that does things the bad old-fashioned way.

Of course, these changes saved the airlines a king’s ransom in reduced maintenance costs and scheduled downtime. At the same time, the airplanes had far fewer maintenance squawks and much better dispatch reliability. (This was the same phenomenon that the RAF experienced during WWII when they followed Waddington’s advice to slash scheduled PM.)

…that hasnt yet reached piston GA

Today, there’s only one segment of aviation that has NOT adopted the enlightened RCM approach to maintenance, and still does scheduled PM the bad old-fashioned way. Sadly, that segment is owner-flown GA—particularly piston GA—at the bottom of the aviation food chain where a lot of us hang out. I’ll offer some thoughts about that next month.