MIKE BUSCH COMMENTARY / SAVVY AVIATOR

Figure 1— gear failures like these can cause a magneto to start fi ring random spark plugs at random times.

The Redundancy Trap The best way to protect against failure of any component is to have two—or is it?

Civil Aviation Regulations producing power. Usually, the only Part 13— Airworthiness sign that a has failed in-fl ight is Subpart B—Reciprocating Engines that the EGT on the aff ected cylinder rises § 13.111 . All spark ignition engines shall be by 50°F or so. And unless you have an equipped with either a dual ignition system having at least two spark engine monitor installed and keep it in plugs per cylinder and two separate electrical circuits with separate “normalize mode,” you’ll probably never sources of electrical energy, or with an ignition system, which will even notice. Often, such failures aren’t function with equal reliability in fl ight. caught until the next prefl ight mag check, where the failed plug causes an excessive Federal Aviation Regulations (14 CFR) mag drop. Sometimes, it isn’t caught until Part 33—Airworthiness Standards: Aircraft Engines the next annual inspection or scheduled Subpart C—Design and Construction; Reciprocating Aircraft Engines spark plug cleaning. § 33.37 Ignition system. Each spark ignition engine must have a Magneto failures happen less often, but dual ignition system with at least two spark plugs for each cylinder and when they do happen, the consequences two separate electric circuits with separate sources of electrical energy, can be much more serious—or not, depend- or have an ignition system of equivalent in-fl ight reliability. ing on the specifi c failure mode. If the mag just quits cold—say, because the breaker BOTH THE FARS AND THEIR predecessor CARs require that certifi - points fail, the coil opens, or the condenser cated spark-ignition reciprocating aircraft engines—the kind most shorts—then the consequences are rela- of us fl y behind—have fully redundant dual ignition systems. tively benign. All cylinders continue to There’s a good reason for this: Ignition system failures in these make power in single-ignition mode, and all engines are relatively commonplace. Without a properly function- EGTs rise in unison. You fl y to your destina- ing ignition system, the engine could quit, the airplane could fall tion and get the bad mag fi xed. No big deal. out of the sky, and people could get hurt. On the other hand, a failure that aff ects How often do ignition systems fail? Well, spark plug failures the magneto’s timing can be a very big deal, happen a lot, but the consequences aren’t usually serious—some- particularly if the timing is advanced—i.e., times they’re not even noticeable—precisely because we have two the spark plugs fi re earlier than they spark plugs in each cylinder, and one is enough to keep the should. A mag that fi res 5 degrees early can

28 Sport Aviation May 2013 PHOTOGRAPHY COURTESY OF JOHN SCHWANER AT SACRAMENTO SKY RANCH

28-32_savvyMAY.indd 28 4/16/13 9:35 AM quickly send CHTs right through the roof, failure rate, given the potentially destructive landing at Cincinnati’s Lunken Field. In and one that fi res 10 degrees early can melt consequences of such failures. every one of these six cases—high-time or holes in and cause cylinder heads to Not to worry, that’s why the FAA requires low-time pilot, high altitude or low alti- separate. Not pretty. that our engines have two magnetos. Even if tude—the pilot declared an emergency, The worst kind of mag failure—and one mag gets sick and goes berserk, we’ve pulled the power back to near-idle, and put one we’re seeing disturbingly often— still got a healthy one to get us home, right? the airplane on the ground at the nearest occurs when the mag’s plastic distributor Don’t be so sure. airport. Fortunately, all of the emergency gear fails and starts shedding teeth. (See landings were uneventful (disregarding the Figure 1.) When this happens, the mag- THE TWO-MAG FALLACY condition of the pilots’ briefs or boxers). neto can start firing random spark plugs I investigated these six magneto distributor Needless to say, had the pilots involved at random times, and all hell breaks loose. gear failures quite thoroughly. They happened been taught to deal with such a failure by The engine starts running very rough— to all sorts of pilots, ranging from newbies to identifying and shutting off the bad mag- I’m talking change-of-underwear veteran multi-thousand-hour CFIs. They neto, the engine would have resumed rough—and unless the pilot quickly throt- occurred in various phases of fl ight, ranging smooth operation and the airplane could tles way back, the powerplant can start from pattern altitude to Flight Level 210. have continued uneventfully to the coming seriously unglued. Here’s the thing: Not once did the pilot planned destination, at which point the I’m personally aware of six such magneto have the presence of mind to identify and bad magneto could have been repaired or distributor gear failures during the past two shut off the misfi ring magneto! That’s even replaced. But none of the pilots did that. years in a fl eet of roughly 300 GA air- true of the failure that occurred at FL210, Every one treated the situation as a cata- planes operated by clients of my company. where the experienced pilot had nearly a strophic engine failure. Not one attempted That’s one failure per year per 100 airplanes. half-hour to troubleshoot the issue as he to troubleshoot or resolve the problem, To my way of thinking, that’s a pretty scary was descending power-off to an emergency something that could have been easily

www.eaa.org 29

28-32_savvyMAY.indd 29 4/16/13 9:35 AM accomplished simply by shutting off one HOW ABOUT 1-1/2 MAGS? independent magnetos packaged into one magneto at a time until the bad one was Then there’s the Bendix D2000/D3000 dual box, with a single drive shaft, mounted on a identified and disabled. magneto used on many Lycoming engines. If single pad on the accessory case. (See Of course, with a failure mode like this, your Lycoming engine model number ends Figure 2.) The idea behind this dual mag- having a good mag does you no good unless in a “D” suffi x—e.g., O-360-A1F6D or TIO- neto was to reduce the “real estate” and you shut off the bad one. Clearly, we have 540-F2BD—it probably has one of these gear train complexity at the back of an education problem here. puppies installed. In essence, this is two the engine. This probably wasn’t Lycoming engineer- ing’s best idea. Sport Aviation’s fearless leader J. Mac McClellan made an entry in his weekly Left Seat blog in November 2012 cleverly titled “Is One and a Half Mags Enough?” that highlighted the issue. I was struck by how many aircraft owners and mechanics responded with bad experiences with dual mags, some going as far as to declare that they would not fl y any single- engine airplane that was dual mag-equipped. It’s generally accepted that the original D2000 dual mag was disastrously unreli- Figure 2—The Bendix D2000/D3000 dual mag is basically two independent magnetos packaged into a single unit. able, and most of them have long since been

30 Sport Aviation May 2013 PHOTOGRAPHY COURTESY OF CLIFF ORCUTT OF AIRCRAFT MAGNETO SERVICE

28-32_savvyMAY.indd 30 4/16/13 9:35 AM replaced with the later-design D3000, coupling failure can take out which was much improved. But although the entire ignition system. the D3000 has pretty much dual every- Although the D2000/ thing—dual breaker points, dual coils, dual D3000 dual magneto complies and distributor gears—it still with the letter of the FAA’s doesn’t provide the level of redundancy of two-source requirement set two conventional magnetos. forth in CAR 13.111 and FAR One major problem area has been the 33.37, I question whether it hold-down clamps that attach the mag to the meets the spirit of the reg. engine. They have a history of coming The dual mag just doesn’t pro- loose—either because they were not prop- vide the same level of erly torqued by mechanics in the fi eld, or redundancy as two conven- because the magneto mounting fl ange or tional mags, and I wonder engine mounting pad was worn. When the whether the FAA made a mis- clamps come loose, the dual mag can shift, take by certifying it. and that screws up the timing of both mag- netos, not just one. COMMON-MODE FAILURES Another single-point failure is the Even with two conventional impulse coupling that drives the dual mag mags, it’s still possible for a from the engine gear train. A dual mag- common-mode failure to com- equipped Lycoming engine has only one of promise the entire ignition Figure 3—Fracture of this plastic magneto pressurization fi lter caused simultaneous and these, rather than two, and an impulse system. One such failure severe high-altitude misfi re of both magnetos. So much for redundancy…

www.eaa.org 31

28-32_savvyMAY.indd 31 4/16/13 9:35 AM occurred to a client of mine who was cruis- every pressurized magneto installation I’ve It’s impossible to predict when ing his Cessna 340 at FL240 when all of a seen does it this way. It’s one reason I don’t care sudden, the left engine came unglued and for pressurized magnetos, and won’t use them it’s going to fail; I’ve seen these started shaking so badly that the pilot was on my own turbocharged airplane. worried it would tear itself off the wing. pumps go for more than 1,000 The pilot called ATC, declared an emer- HIDDEN FAILURES hours without a hiccup, and seen gency, and requested a lower altitude. He Most legacy GA aircraft have air-driven throttled back (which reduced the shaking), gyros powered by dry air (vacuum) them fail in fi ve hours. and started an emergency descent. After pumps. The dry air pump has the most descending a few thousand feet, the left intractable failure mode of any GA aircraft engine started running a lot better, so he component I can think of: It invariably it regularly, preferably on every preflight continued at the lower altitude and landed fails suddenly and totally without any prior to launching on any flight during at his home base. Then he described his warning. One minute it’s working just which IMC is anticipated. experience to his A&P and asked him to try perfectly, then a few milliseconds later it Similarly, Cessna 300- and 400-series to fi nd the problem. fails catastrophically in a cloud of graph- twins manufactured prior to 1973 have an When the mechanic uncowled the left ite dust and melted plastic. And it’s electrical system equipped with two identi- engine, the problem was immediately appar- impossible to predict when it’s going to cal voltage regulators designated MAIN ent. The 340 was equipped with RAM fail; I’ve seen these pumps go for more and STBY. There is a red-guarded toggle engines with Slick 6300-series pressurized than 1,000 hours without a hiccup, and switch that allows the pilot to switch to the magnetos. A tiny plastic nipple on the mag- seen them fail in five hours. STBY regulator if the MAIN regulator fails. neto pressurization fi lter had broken off , Consequently, for any aircraft that fl ies The POH instructs: instantly depressurizing both mags and send- IFR and depends on an air-driven gyro to “For normal operations, the regulator ing them into violent high-altitude misfi re. keep the dirty side down, a backup vacuum select switch should be left in MAIN. If volt- The mechanic removed both mags and source is absolutely essential. Twins typi- age exceeds a predetermined maximum, the opened them up. He found evidence of severe cally have two air pumps, one on each overvoltage relay opens and both alternators internal arcing, and one of the distributor engine, providing the desired redundancy. are disabled. Positioning the regulator select gears was badly burned and partially melted. Singles often are equipped with a standby switch from MAIN to STBY selects the Once again, it strikes me as pretty dumb to vacuum system powered by an electric standby regulator and overvoltage relay, and have both magnetos sharing a single pressur- motor, such as the Aero Safe Guardian I resets the main relay.” ization hose and a single pressurization fi lter, system shown in Figure 4. Predictably, pilots of these airplanes because this creates the potential for a single Such a standby vacuum system can be a fl y around for decades without anyone point of failure that can take out both magnetos great way to protect yourself against vac- ever having selected the STBY regulator simultaneously, eliminating the redundancy uum pump failure—but only if it works to fi nd out if it actually works. The STBY that the FAA calls for and the pilot expects. Yet when you need it. Unfortunately, most regulator is almost never checked during pilots never bother to test the annual inspection, since it really can’t be system to see whether not it tested without both engines running. So works. And most mechanics if the MAIN regulator ever fails, it’s a don’t test it either—since it’s crapshoot whether or not the STBY will very unlikely to be on the work when it’s needed. Contrary to the inspection checklist. POH, I teach pilots of these airplanes to Such a standby vacuum sys- fl y on the STBY regulator from time to tem is a relatively complex time so they can be sure they actually apparatus with lots of poten- have the redundancy that the system is tial failure modes: bad motor, intended to provide. bad pump, bad check valves, bad wiring, etc. Needless to Mike Busch, EAA 740170, was the 2008 National say, if you find yourself facing Aviation Maintenance Technician of the Year, and a vacuum pump failure while has been a pilot for 44 years, logging more than flying through the clag in low 7,000 hours. He’s a CFI and A&P/IA. E-mail him at IMC, that’s not the optimal [email protected]. Mike also hosts free time to be learning whether or monthly online presentations as part of EAA’s webinar Figure 4—A standby vacuum system like this Aero Safe Guardian I can provide protection not your standby vacuum sys- series on the fi rst Wednesday of each month. For a against a vacuum pump failure—but only if you test it regularly during prefl ight. tem works. You’ve got to test schedule visit www.EAA.org/webinars.

32 Sport Aviation May 2013

28-32_savvyMAY.indd 32 4/16/13 9:36 AM