Proposed Airworthiness Directive for ECi Cylinders

Risk Analysis Process

1

This paper explains the risk analysis process used to establish the removal 

requirements in the Airworthiness Directive (AD) proposed against ECi Part Number 

(P/N) 631397 cylinders installed in Continental Motors, Inc. (Continental) engines. A 

Notice of Proposed Rulemaking (NPRM) was published on August 12, 2013, and a 

Supplemental NPRM was published on January 8, 2015.

Methodology

The risk analysis for the ECi cylinders was performed in the typical manner of similar 

analyses for aviation components, whether original equipment or replacement parts. 

Risk analysis methodologies, and the acceptable risk guidelines for continued 

operational safety, are outlined in policy and/or advisory material issued by each of the 

Directorates.

A risk analysis involves using the past data, both successful operation as well as 

failures (including cracks), to develop a relationship between part parameters, including 

age and usage, and risk of failure. In the risk analysis discussed in this paper, “failure” 

refers to an accident causing at least one fatality (“Fatal Accident”) initiated by the 

cracking or separation of a cylinder.

In this particular safety issue, all the available data indicate that the risk of failure does 

not vary by age (hours of operation) of the part. The statistical term is that the failure 

rate is random. A random failure rate allows for a risk calculation using mean time 

between failure (MTBF) calculations. This means that the past rate of occurrence can 

be used to directly calculate future risk. The occurrence rate can be applied to future 

operating hours under different replacement recommendations to calculate the 

expected number of events under each scenario. MTBF is used in most certification 

analyses and in continued operational safety when the failure mode is known, assumed, 

or expected to be random. For this safety issue, the assumption of a random failure 

mode was further supported by Crow-AMSAA and cumulative sum analyses performed 

on the data. Note that, if a random failure rate was not used, but rather increasing risk 

with age, the risk would be higher than predicted.

The failures also do not vary significantly between twin- and single-engine airplane 

usage. 

As is often the case with components used in general aviation and/or air taxi operations 

(and even in many instances of commercial aviation), population demographics must be 

estimated based on the best available knowledge and data. In the case of the P/N 

631397 ECi cylinders, the current population size, and the operating hours on each part,

were estimated from production data, retirement rates, the number of parts affected by 

a prior AD against the P/N, and utilization rates. Additionally, the same data sources 

enabled an estimation of the total P/N 631397 cylinder fleet hours to the time of the 

current proposed AD’s preparation. The total fleet hours provided the denominator for

the rate of failure; the number of parts in the current fleet, and their ages, enabled

prediction of future risk.
Proposed Airworthiness Directive for ECi Cylinders

Risk Analysis Process

2

Assumptions

Any risk analysis is dependent on its underlying assumptions. In the case of the P/N 

631397 ECi cylinders, these are the assumptions:

• Time-independent (random) failure mode. 

• No differentiation by serial numbers (S/Ns). In other words, all parts equally 

suspect.

• 28,800 P/N 631397 ECi cylinders installed in Continental engines are subject to 

this risk analysis. This is the estimated total at the time of current AD preparation 

(September 2014).

• 6 cylinders per engine.

• Average fleet utilization: Average airplane utilization (normalized across twinand single-engine airplanes by percentage) is rounded to 140 hours/year.

• 74% engines installed on twins.

• Current part age distribution (estimated by advancing 11/2010 histogram used for 

prior P/N 631397 ADs)

• Over 1500 hours (assumed to be past overhaul) 21%

• Between 1001 and 1500 hours 21%

• Between 681 and 1000 hours 42%

• 680 or fewer hours 16%

• Parts advanced 140 hours per year for 3.75 years from histogram established for 

prior ADs.

• 35% of produced parts retired. This is based on production rates and the 

number of parts affected by the prior AD.

• The recommended overhaul interval varies from 1200 hours to 2400 hours 

depending upon engine type, but the average interval is assumed to be 1700 

hours.

• 2 fatal accidents involving P/N 631397 ECi cylinders cracking or separation on 

Continental engines (see details below).

• Maximum allowed time for each category (no credit for removal for cause).

• Zero risk for replacement parts. In other words, parts produced in the future will 

not be suspect of having the safety issue.

• No credit taken in the risk analysis for inspection. Part 91 operators do not have 

a required 100-hour inspection. There is considerable uncertainty about the 

value of the available inspection in this particular safety issue.

Additional analyses were performed using different values for part utilization and the 

number of fatal accidents. Specifically:

• The utilization rates underwent refinement. Note that, since utilization 

assumptions affect both prior and future usage, this didn’t have a significant 

effect on the analysis except in number of parts currently in the various age 

categories. 

• Originally, the analyst did not have knowledge of the fatal accidents. An 

estimation of the risk of fatal accident given cylinder cracks and separations was 
Proposed Airworthiness Directive for ECi Cylinders

Risk Analysis Process

3

used by applying a conditional probability of in-flight engine shutdown (IFSD), 

and then using a generic (from all causes) small-airplane IFSD-to-accident 

conditional probability. The generic conditional probability was found to be 

significantly too low for the actual fatal accident experience involving the P/N 

631397 ECi cylinders.

The following 2 fatal accidents, as documented by ASW-190, are known or likely to be 

initiated by the same separation mode of an ECi cylinder:

• A cylinder that failed in a Bahamas accident on October 5, 2010 on a Cessna 

402C airplane was originally a P/N 631397 cylinder that had been overhauled 

(the "overhaul" did not change the design condition that causes the first thread 

failures). The accident resulted in nine fatalities.

• An ECi cylinder failed in a New Hampshire accident on September 2, 2002 on a 

Beachcraft 58P airplane, resulting in seven fatalities. Based on the engine type

(TSIO-520-WB) and the materials laboratory factual report it is believed to be the 

suspect part number, P/N 631397. 

Results and effects

The following values are calculated using the methodology and assumptions outlined 

above. 

The overall airplane fatal accident rate of occurrence is 4.0E-7 per airplane hour. This 

value is the normalized rate (averaged by relative percentages of each type) across 

twin- and single-engine airplanes.

Removal recommendations were iterated to provide values that allowed staggered 

removals across calendar time (converted to hours in the proposed AD) that met the 

guidelines for allowed operation while the safety issue is mitigated. It should be 

remembered that the guidelines are maximum values, not targets. The appropriate 

guidelines for small airplanes are 0.5 fatal accidents from any specific safety issue on 

twin-engine airplanes and 0.7 fatal accidents on single-engine airplanes. As noted 

above, the majority of suspect cylinders are installed in engines on twin-engine 

airplanes. Note that the guidelines are “not to exceed” values rather than targets. 

The proposed AD requirements, and the resultant risk, are as follow:

• Above overhaul recommendation: remove within 80 hours

• Above 1000 hours: remove within 160 hours not to exceed overhaul 

recommendation

• 680-1000 hours: remove within 320 hours not to exceed 1160 hours

• 0-680 hours: remove by 1000 hours

• Indication of failed or cracked cylinder: remove all cylinders prior to further flight
Proposed Airworthiness Directive for ECi Cylinders

Risk Analysis Process

4

These requirements equate to 0.31 expected fatal accidents. 0.23 of the risk accrues 

on twin-engine airplanes; 0.08 on single-engine airplanes. Obviously, the actual result 

cannot be a fractional fatal accident. The expected number of events can be related to

the probability of one or more event occurring through the Poisson distribution. Through 

use of this statistical relationship, 0.31 fatal accidents equates to a 27% chance that one 

or more fatal accidents will occur during the proposed AD period while the suspect parts 

are removed from service.

Since the failure mode appears to be random, and part removal is staggered for 

logistical purposes, the oldest parts being removed soonest is simply the method 

chosen to prioritize and force removal over time. 

It is worth noting that use of quantitative risk analysis allowed considerable relief to the 

original version of the proposed AD, published on August 12, 2013.

Prepared by Ann Azevedo, FAA Chief Scientist & Technical Advisor, Aircraft Safety 

Analysis, with assistance from an FAA multifunctional team comprised of 

representatives from the Small Aircraft Directorate, Transport Aircraft Directorate, and 

Chief Scientific and Technical Advisors and members of the Engine and Propeller 

Directorate and the Special Certification Office.