When maintenance bites back
Proper reassembly isn’t guaranteed
The airplane’s factory-rebuilt Continental IO-550-N installed in February 2022 had accumulated 735 trouble-free hours and was performing well right up until the moment when its number one cylinder suddenly went rogue and shut down. The engine continued to run on five cylinders but was change-of-underwear rough. The Columbia’s pilot and owner—I’ll call him Rob—made a precautionary landing at a nearby airport and taxied to the maintenance shop on the field. He described the incident to the shop’s director of maintenance and asked the shop to diagnose the cause.
The diagnosis didn’t take long. Once the top cowling was removed, the intake rocker cover on cylinder number one (right rear) appeared badly damaged, perforated, and dripping with oil. Removing the ailing rocker cover revealed that the rocker shaft was no longer attached to the cylinder head. The rocker shaft is secured to the cylinder head by two beefy 5/16-by-18 bolts. One of those bolts had backed out, and the other had fractured into two pieces. This left the rocker shaft violently flailing around inside the rocker cover, preventing the intake valve from opening (hence the cylinder shutdown) and bashing the bejesus out of the poor rocker cover. Had that bashing continued much longer, it would have poked a hole in the rocker cover and allowed engine oil to be pumped overboard, but fortunately that didn’t happen here.
Why did the rocker shaft come loose like this? There’s only one plausible explanation: When the two bolts were installed to secure the rocker shaft to the cylinder head, they were not properly torqued and safetied. The bolts have to be tightened to a specific torque value and then safetied with locktabs to prevent them from backing out. Clearly this had not been done correctly. One of the bolts backed out, allowing one end of the rocker shaft to bounce up and down about 20 times per second. That movement caused repetitive stress
fatigue in the other bolt, which ultimately broke in two.
The DOM showed Rob what they had found, and said the number one cylinder would need to be removed so the camshaft could be checked for damage. This was a wrongheaded suggestion, since the rocker shaft release unloaded the intake lifter from the cam lobe, so there was no possibility of cam damage. But Rob accepted the director of maintenance’s assertion that cylinder removal was necessary and approved it.
Covered by warranty?
At this point, Rob—who is a SavvyQA consulting client—first brought this situation to our attention. The question he posed to us was whether this failure would be covered by Continental’s warranty. We doubted it would, since Continental’s warranty period on rebuilt engines is 24 months or 500 hours, whichever comes first. Rob’s engine was about 30 months and 735 hours, so it was clearly out of warranty.
We advised Rob asking Continental for warranty consideration might be worth a shot anyway—but only if Rob could establish that the Continental factory had installed and safetied the two bolts in question and that they had not been messed with since. A review of the engine logbook should tell the tale.
In the meantime, the director of maintenance had taken it upon himself to call Continental tech support (without asking Rob’s permission) to tell them what had been found and seek guidance. When the director of maintenance told the Continental tech rep that the locktab for the bolt that had broken in two could not be located, the rep predictably replied that the engine would need to be torn down. (They always say that.) This struck us as ridiculous, because even if the missing locktab had fallen into the engine sump, it couldn’t do any harm because it was way too big to get past the suction screen and into the oil pump.
Nevertheless, the director of maintenance told Rob he wouldn’t be able to sign off the aircraft as airworthy unless the engine was removed and sent to an engine shop for a teardown. Feeling stuck between the proverbial rock and a hard place, Rob reluctantly capitulated and approved the engine removal and teardown.
Whodunnit
As if this weren’t bad enough, a review of the Columbia’s engine logbook revealed the Continental factory had not been the last one to lay a wrench on the two rocker shaft bolts. They had been messed with in the field about 18 months earlier. Why? Because of a nasty mandatory service bulletin (MSB) issued by Continental and an even nastier airworthiness directive (AD) issued by the FAA.
In February 2023, Continental issued MSB22-01A prompted by a couple of reports of crankshaft counterweight releases traced to improper installation of retaining circlips at the Continental factory. This MSB affected all big-bore Continental engines built or rebuilt in the factory between June 1, 2021, and February 7, 2023—about 2,400 engines. Unfortunately for Rob, his engine was one of them. Compliance required removing cylinders number one and number two to gain access to the crankshaft counterweights, and then inspecting them to ensure that the retaining circlips were properly installed.
So, it turns out that the number one and number two cylinders on Rob’s engine had been removed for the AD-mandated circlip inspection. The inspection revealed no issues with any of the circlips, but whoever reinstalled the number one cylinder obviously messed up when torquing and safetying one of the rocker shaft bolts. Ironically, this occurred early enough in the life of Rob’s factory-rebuilt engine that it would have been covered by Continental under warranty. But compliance with the AD set the stage for an in-flight failure two years and 500 hours later, and that wasn’t Continental’s error and wasn’t covered under warranty.
Ultimately Rob received a bit of good news: The engine shop located the missing locktab in the sump and wisely decided that there was no reason to tear the engine down after all. They repaired the number one cylinder, installed it back on the engine, and shipped the engine back to the shop where it was hung back on Rob’s airplane. This was a costly episode for Rob, but not nearly as costly as it would have been had the engine been torn down.
Risk versus benefit
The best accident data we have for small noncommercial general aviation airplanes, including AOPA’s McSpadden Report (formerly Nall Report), indicates that roughly 80 percent of accidents are pilot-caused and the remaining 20 percent are machine-caused. About 70 percent of the machine-caused accidents involve powerplant failure.
How many of those powerplant failures are because of maintenance errors like the one that Rob experienced? The data on that is sparse, but maintenance-induced failures account for at least 25 percent of powerplant failures, and the number could be as high as 50 percent.
Engine maintenance is risky business, and invasive maintenance—notably cylinder removal and reinstallation—is particularly risky when performed in the field (as opposed to at the factory or in a top-notch engine overhaul shop). Therefore, it should not be done lightly, but only after performing a thoughtful risk-benefit assessment. Unless the benefit of doing such maintenance clearly outweighs the risk, we should not do it.
Two cases in point: The director of maintenance’s insistence that the number one cylinder should be removed to inspect the cam for possible damage was wrongheaded—the likelihood of cam damage was infinitesimal while the likelihood of a maintenance-induced failure during the cylinder removal and reinstallation was significant. Even more wrongheaded was the Continental tech rep’s insistence that the engine should undergo a teardown because a rocker shaft bolt locktab couldn’t be located. Very costly and risky with virtually zero benefit. Fortunately, the engine shop was better at risk-benefit analysis than Continental’s tech rep.
Is the cure worse than the disease?
The cylinder removal and reinstallation that was responsible for Rob’s in-flight mechanical issue is a bit different since Rob had no choice in the matter. That cylinder removal was mandated by AD 2023-04-08, and compliance with ADs is non-negotiable. Perhaps Rob could have chosen a different shop or mechanic to perform the circlip inspection, but he didn’t have the option of declining the work.
What about the risk versus benefit of the AD itself? Did the risk of an incorrectly installed counterweight circlip outweigh the risk of the maintenance-induced failures caused by the removal and reinstallation of roughly 4,800 cylinders on the roughly 2,400 engines affected by the AD? In other words, was the cure worse than the disease? How does the FAA make these risk assessments?
Anecdotally, I spoke with several directors of maintenance whose shops had performed one or more of the circlip inspections required by AD 2023-04-08. Collectively they inspected a bunch of circlips—there are eight in each engine—and found precisely zero that were improperly installed. This leads me to believe that the incidence of improper circlip installation at the Continental factory was quite rare.
But in 2023, neither Continental nor the FAA had any way of knowing how many of those 19,200 circlips in those 2,400 engines were improperly installed. Nor could they predict how many maintenance-induced failures would be caused by the removal and reinstallation of 4,800 cylinders in order to inspect those 19,200 circlips, nor how catastrophic those failures were likely to be. What they did know is that a single improperly installed circlip could result in a counterweight release which can be a catastrophic event—the released counterweight can punch a hole in the crankcase. So, if you were the FAA, what would you do?
The FAA’s Order 8040.4B, Safety Risk Management Policy, requires a structured risk assessment for all safety-related actions, including ADs. This policy requires the agency to evaluate both the risks of the unsafe condition and the risks introduced by the corrective actions mandated by the AD. This involves identifying hazards, assessing their severity and likelihood, and ensuring that mitigation measures (such as AD corrective actions) reduce the overall risk to an acceptable level without introducing disproportionate new risks.
That all sounds good on paper. In the real world, however, the FAA rarely has good data about the severity and likelihood of the hazard being addressed, and even less data about the severity and likelihood of the corrective action to be mandated. As the mess involving improperly installed circlips at the Continental factory illustrates, it’s often more guesswork than science.
It has been my observation over many years that the FAA tends to overestimate the risk associated with an allegedly unsafe condition and to underestimate the risk associated with the mandated corrective action. So, sometimes the FAA issues an AD where the cure is worse than the disease. I’ve been involved in battling against quite a few of these at the notice of poroposed rulemaking stage. Sometimes we’re able to change the FAA’s mind about a proposed AD that we think will hurt more than it helps. Other times we’re not. I would guess my batting average is no better than 50 percent.
Is the Continental circlip debacle one of those? Your guess is as good as mine. 
