Proposed Airworthiness Directive for ECi Cylinders Risk Analysis P rocess

1 This paper explain s the risk analysis process used to establish the removal requirements in the Airworthiness Directive (AD) proposed against ECi Part Number (P/N) 631397 cylinders installed in Continental Motors, Inc. (Continental) engines

. A Notice of Proposed Rulemaking (NPRM) was published on August 12, 2013, and a Supplemental NPRM was published on January 8, 2015

.

M ethodology

The risk analysis for the ECi cylinders was performed in the typical manner of similar analyses for aviation components, whether original equipment or replacement parts. Risk analysis methodologies , and the acceptable risk guidelines for continued operational safe ty, are outlined in policy and/or advisory material issued by each of the Directorates.

A risk analysis involves using the past data, both successful operation as well as failures (including cracks)

, to develop a relationship between part parameters, incl uding age and usage, and risk of failure. In the risk analysis discussed in this paper, “failure” refers to an accident causing at least one fatality (“Fatal Accident”) initiated by the cracking or separation of a cylinder.

In this particular safety issu e, all the available data indicate that the risk of failure does not vary by age (hours of operation) of the part. The statistical term is that the failure rate is random. A random failure rate allows for a risk calculation using mean time between failur e (MTBF) calculations. This means that the past rate of occurrence can be used to directly calculate future risk. The occurrence rate can be applied to future operating hours under different replacement recommendations to calculate the expected number of events under each scenario. MTBF is used in most certification analyses and in continued operational safety when the failure mode is known, assumed, or expected to be random. For this safety issue, the assumption of a random failure mode was further sup ported by Crow

- AMSAA and cumulative sum analyses performed on the data. Note that, if a random failure rate was not used, but rather increasing risk with age, the risk would be higher than predicted

. The failures also do not vary significantly between twin

- and single

- engine airplane usage.

As is often the case with components used in general aviation and/or air taxi operations (and even in many instances of commercial aviation), population demographics must be estimated based on the best available kn owledge and data. In the case of the P/N 631397 ECi cylinders, the current population size

, and the operating hours on each part

, were estimated from production data, retirement rates, the number of parts affected by

a prior AD against the P/N , and utiliz ation rates. Additionally, the same data sources enabled an estimation of the total P/N 631397 cylinder fleet hours to the time of the current proposed AD ’s preparation. The total fleet hours provided the denominator for the rate of failure; the number of parts in the current fleet, and their ages, enabled prediction of future risk.Proposed Airworthiness Directive for ECi Cylinders Risk Analysis P rocess

2 Assumptions

Any risk analysis is dependent on its underlying assumptions. In the case of the P/N 631397 ECi cylinders, these are the assumptions:

• Time

- independent (random) failure mode

.

• No differentiation by serial numbers (S/Ns). In other words, all parts equally suspect.

• 28,800 P/N 631397 ECi cylinders installed in Continental engines are subject to this risk analysis . This is the estimated total at the time of current AD preparation (September 2014).

• 6 cylinders per engine.

• Average fleet utilization : Average airplane utilization (normalized across twin

and single

- engine airplanes by percentage) is rounded to 140 h o u rs/y ea r

.

• 74% engines installed on twins

.

• Current part age distribution (estimated by advancing 11/2010 histogram used for prior P/N 631397 ADs )

• Over 1500 hours (assumed to be past overhaul) 21%

• Between 1001 and 1500 hours 21%

• Between 681 and 1000 hours 42%

• 680 or fewer hours 16%

• Parts advanced 140 hours per year for 3.75 years f rom histogram established for prior ADs.

• 35% of produced parts retired. This is based on production rates and the number of parts affected by the prior AD.

• The recommended overhaul interval varies from 1200 hours to 2400 hours depending upon engine type, but the average interval is assumed to be 1700 hours.

• 2 fatal accidents involving P/N 631397 ECi cylinders cracking or separation on Continental engines (see details below).

• Maximum allowed time for each category (no credit for removal for cause)

.

• Zero risk for replacement parts . In other words, parts produced in the future will not be suspect of having the safety issue.

• No credit taken in the risk analysis for inspection. Part 91 operators do not have a required 100

- hour inspection. There is consider able uncertainty about the value of the available inspection in this particular safety issue.

Additional analyses were performed using different values for part utilization and the number of fatal accidents. Specifically :

• The utilization rates underwent refinement. N ote that, since utilization assumptions affect both prior and future usage, this didn’t have a significant effect on the analysis except in number of parts currently in the various age categories.

• Originally, the analyst did not have knowle dge of the fatal accidents. An estimation of the risk of fatal accident given cylinder cracks and separations wasProposed Airworthiness Directive for ECi Cylinders Risk Analysis P rocess

3 used by applying a conditional probability of in

- flight engine shutdown (IFSD), and then using a generic (from all causes) small

- airplane IFS D

- to

- accident conditional probability . The generic conditional probability was found to be significantly too low for the actual fatal accident experience involving the P/N 631397 ECi cylinders.

The following 2 fatal accident s , as documented by ASW

- 190, are known or likely to be initiated by the same separation mode of a n ECi cylinder :

• A cylinder that failed in a Bahamas accident on October 5, 2010 on a Cessna 402C airplane was originally a P/N 631397 cylinder that had been overhauled (the " overhaul " did not change the design condition that causes the first thread failures). The accident resulted in nine fatalities.

• An ECi cylinder failed in a New Hampshire accident on September 2, 2002 on a Beachcraft 58P airplane , resulting in s even f atalities. Based on the engine type ( TSIO

- 520

- WB ) and the materials laboratory factual report it is believed to be the suspect part number , P/N 631397

.

Results and effects

The following values are calculated using the methodology and assumptions outlined above.

The overall airplane fatal accident rate of occurrence is 4 .0E

- 7 per airplane hour. This value is the normalized rate (averaged by relative percentages of each type) across twin

- and single

- engine airplanes.

Removal recommendations were iterated to pro vide values that allowed staggered removals across calendar time (converted to hours in the proposed AD) that met the guidelines for allowed operation while the safety issue is mitigated. It should be remembered that the guidelines are maximum values, not targets. The appropriate guidelines for small airplanes are 0.5 fatal accidents from any specific safety issue on twin

- engine airplanes and 0.7 fatal accidents on single

- engine airplanes. As noted above, the majority of suspect cylinders are installed i n engines on twin

- engine airplanes. Note that the guidelines are “not to exceed” values rather than targets.

The proposed AD requirements, and the resultant risk, are as follow:

• Above overhaul recommendation: remove within 80 hours

• Above 1000 hours: remove within 160 hours not to exceed overhaul recommendation

• 680

- 1000 hours: remove within 320 hours not to exceed 1160 hours

• 0

- 680 hours: remove by 1000 hours

• Indication of failed or cracked cylinder: remove all cylinders prior to further flightProposed Airworthiness Directive for ECi Cylinders Risk Analysis P rocess

4 These requirements equate to 0. 31 expected fatal accidents. 0. 23 of the risk accrues on twin

- engine airplanes; 0. 08 on single

- engine airplanes. Obviously, the actual result cannot be a fractional fatal accident. The expected number of events can be related to the probability of one or more event occurring through the Poisson distribution. Through use of this statistical relationship, 0. 31 fatal accidents equates to a 27 % chance that one

or more fatal accident s will occur during the proposed AD period while th e suspect parts are removed from service.

Since the failure mode appears to be random, and part removal is staggered for logistical purposes, the oldest parts being removed soonest is simply the method chosen to prioritize and force removal over time.

It is worth noting that use of quantitative risk analysis allowed considerable relief to the original version of the proposed AD, published on August 12, 2013

.

Prepared by Ann Azevedo, FAA Chief Scientist & Technical Advisor, Aircraft Safety Analysis, with assistance from an FAA multifunctional team comprised of representatives from the Small Aircraft Directorate, Transport Aircraft Directorate, and Chief Scientific and Technical Advisors and members of the Engine and Propeller Directorate and the Special Certification Office.