Powerplant Reliability Issues and Wear Monitoring in Aircraft Piston Engines. Part II: Engine Diagnostic

Abstract

This paper introduces a method to efficiently monitor the status of a piston engine during flight. ECUs (Electronic Control Units) make it possible to fly safely without emergencies or urgencies with random electronic failures of components and connections. The same can be easily done on older engines by adding a reliable digital monitoring system and an automated calibration of the carburetors. In fact, their reliability is several order of magnitude inferior to modern turboshafts. In modern engines with FADEC (Full Authority Digital Electronic Control) as the “on” button is pressed the sensors and actuators are checked. The CPUs will then run start-up during the cranking phase (engine running without ignition). If everything is all right, then the engine starts and the post start checks are also performed. During flight, the ECU checks CPUs, sensors and actuators. Therefore, the electronic system can be monitored with high reliability without much effort. The sensors may crosscheck the engine situation and may output very reliable early diagnosis of incoming failures. Statistical data on spare parts are invaluable for monitoring application, signaling weak or not-lasting components and failure modes. This is another advantage of automotive piston engines conversions to aircraft use.

1. Introduction

Most aircraft-piston-engines were designed more than 30 years ago. Their reliability have been always inferior to general aviation turbines. Even modern updated automotive propulsion unit have a better reliability than “certified” aircraft piston engines. It is therefore compulsory to install digital monitoring system for the powerplant of older aircrafts and to replace these engines with modern, automotive-derived units in new aerial vehicles. This paper introduces a possible monitoring technique for aircraft piston engines. This technique differs from diagnostic automotive software (OBD—On Board Diagnosis) running on car ECUs (Electronic Control Units) for reasons that will be briefly introduced in the following paragraphs. This paper is composed by an introduction about aircraft piston engine reliability, a summary of most common aircraft piston engine failures, a brief description of engine monitoring systems, and the proposal for a the new digital monitoring software.

1.1. Aircraft Piston Engine Reliability

Federal Aviation Administration published a statistic in which aircraft piston engines have an average failure rate of one every 3200-flight hours, while turbines have a failure rate of one per 375,000 flight hours [1]. The best turbines will have an even lower failure rate. For example, the popular P&W PT6 turboshaft has an in-flight shutdown rate of 1 per 651,126 h (2016) [2]. The actual reliability of aircraft piston engine is worse than the one of modern car engines. Italian car drivers (in the Emilia Romagna region) run their car at an average speed of 34 km/h [3]. If the annual mileage is 60,000 km per year, they drive for 1800 hours per year. With “reliable” aircraft piston engines, these drivers would call the wrecker every two years for an engine failure. Detailed statistical records are available in references [1,2,3,4,5,6,7,8,9]. A main factor of this poor performance is due to the small number of engines that are produced. Rotax 912/914 constitute more than 80% if the whole piston engine powered aerial vehicle fleet. Only slightly more than 50,000 engines of the Rotax 912/914 series were delivered since 1989, with approximately 45 million flight hours. In the same period, over eight million Fiat Fire engines were produced with approximately 20 billion hours. A production rate of 3000 engine per day is common for automotive engines. Therefore, the total number of the Rotax 912/914 engines sold in nearly 30 years would have been produced for a car in 16 days. This means that the amount of money that can be invested in the design, development and production of an automotive engine is several order of magnitude larger than aircraft engines. Since the design process even in modern days it far from perfect, the development of a new engine and of its production line usually encounters several unforeseen problems that have to be solved. In automotive engines, strict quality control is performed on the production batches with full traceability of the parts. Tolerances and fits measurement of main components are fully executed by expensive automatic machines and the assembly is fully automated. The defects should be measured in a few every 100,000 items produced. The run-in of the production line can be of 250,000 engines. This massive investment is justified by the fact that an even minor recall for defects can involve hundreds of thousand vehicles with huge costs. On the contrary, the aircraft engine runs out of budget easily. This fact compels engineers to patch the problem and not to solve it. A typical example is given by the camshaft early-wear-problem on a popular aircraft engine. The solution given is to use a special lubricant and to reduce the lubricant replacement interval. When the same problem arose in the FIAT Fire engine, a proper system of oil jets was designed to lubricate the camshaft in critical positions.

1.2. Wrong Concepts on Aircraft Piston Engines

Another big problem comes from wrong ideas about aircraft piston engines. For some “experts”, the aircraft piston engines should have a “flat” architecture. This assertion is denied by piston engine history. In fact, at the beginning the aircraft engines were radials. The big advantage of these engines was the large frontal area, which meant that they could be air-cooled. In fact, an inline air-cooled engine tends to be hot on the rear cylinder. Still, a few small air cooled in line engine were available at the end of WWII. However, even for radials, the bigger the engine, the larger the cooling problem becomes. Extra-thin fins were required, with sophisticated machined castings (Pratt&Whitney) or very thin aluminum sheet metal fin segments that were swaged into grooves in the steel cylinder barrel cold framed fins (Wright Cyclone). Multi-rows radials proved to be problematic for cooling. In fact, there are a few huge air-cooled radials still flying. Their size is unthinkable for other engine architectures. As the power requirement increased, water-cooled engines appeared to be convenient. However, air-cooling was still preferred in military planes, due to their ability to sustain battle damage. Nowadays, liquid cooling is nearly universal for piston engines, with small aircraft engines being one of the few areas where air cooling is still used. After WWII, in the absence of large power requirements (where turbines are the best choice), a compromise was met with flat engines. Flat engines have two or three cylinders on each side with limited temperature difference for frontal and back cylinders. Another advantage of this architecture is that, like radials, flat engines have a short crankshaft. Therefore, in most flat engines, torsional vibrations can be controlled without damping devices. The flat engine is not tall, and, in side-by-side-seating aircrafts, it is a good compromise. These flat engines have a relatively large displacement, relatively high blow-by, and poor engine and installation efficiency. The overall efficiency of a Cessna 152 aircraft with the excellent McCawley propeller and the very good installation design is as low as 62%. This means that every 100 kW of engine output power, 38 kW are “wasted” by the propeller and the cooling system [4,5]. Just for comparison, a WWII Mustang fighter has an installation efficiency larger than unitary, due to the Meredith effect cooling and the ejector exhausts. Another relatively important problem of air cooled flat engines comes from head temperature that should not exceed a certain value due to limitations of aluminum alloys. For this reason, temperature gauges are common on air-cooled aluminum alloy heads. As the requirement of power output grew also in small piston engines, liquid cooled heads were introduced along with propeller speed reducers. This approach maintained the large blow-by and poor installation efficiency of air cooled engines, but did not require a complete redesign of the engine. It was, as usual in aircraft piston engines, a patch to the problem. Another big issue is the common “knowledge” about aircraft piston engines. In the aerospace university lectures, very little time is dedicated to piston engines that are an extremely small number in the aerospace propulsion world. On the other side, pilots are told that single engine trainers have engines that are extremely reliable because they are certified. This lack of information brought common myths that have run through the years. The first one is the certification. The certification process is composed by several activities and checks. However, the certification process is not a reliability assessment process. Reliability comes from statistics that can be only assessed by flying hours. For all of the reasons described in the previous parts of this paragraph, monitoring of aircraft piston engines is strictly necessary and pilots, copilots and flight engineers have always performed it. Nowadays, digital engine monitors can, not only record vast amount of measured data, but can also elaborate them to detect defective functioning of engines and sensors before a failure occurs. This system is also partially implemented into new automotive engines and can be improved to fulfil the reliability requirement of aircraft power units. It is also possible to define a TBO for the engine being monitored. In fact, TBO depends on the way the engine is used. This second part of this paper describes common failure modes of engines and their in-flight diagnosis. For this purpose, methods for automatic analysis of engine monitor data and for labeling potential problems are described. The PART I of this paper deals with “long flight” preparation of the engines and “true” TBO prediction.

2. Aircraft Piston Engine Reliability

In a very popular piston-engine powered UAV, the large majority of the in-flight failures are attributable to the combination of malfunctions in the powerplant system [8]. The UAV showed a MTBF (Mean Time Between Failures) of 28.6 h, with perc = 51% of the failure due to the powerplant. The class A mishaps were M_ishap = 161 in R_efTime = 100,000 h, with critical powerplant failures of about 1 every H_tofail = 1271 flight hours (Equation (1)). A class A mishap is an accident with significant vehicle damage or total loss.

$$H_{tofail}=\frac{M_{ishap}}{R_{eftime}}perc=1271\mathrm{h}$$

(1)

This figure is very high, but the statistic refers to the whole powerplant that includes automatic throttle control system, fuel system, cooling system, variable pitch propeller, and powerplant automatic control system. The generators that are installed on a UAV are a far more complex system than the ones of a common aircraft. Another data that can be approximately deduced is the number of maintenance operations N_m during this period (Equation (2)).

$$N_m=\frac{H_{tofail}}{MTBF}perc=21.7$$

(2)

This number sums to the ordinary preventive maintenance operations that has to be performed to keep the engine efficient and safe. By comparison, automotive insurance data [3] show that most cars run with extreme reliability for 120,000 km without any engine failure. Given the average speed of or a driver in Rimini (Italy) of 29.2 km/h [3], a car engine will have the MTBF of 4109 h (Equation (3)).

$$MTB{F}_{automotive}=\frac{\mathrm{120,000}}{29.2}=4109\mathrm{h}$$

(3)

In the following paragraphs the main failures modes are described and they are summarized in

Table 1. Failed parts and results.

Part/Subassembly	Failure Frequency	Consequence
Crankshaft	Extremely rare	Catastrophic
Crankcase	Extremely rare	Oil leakage
Cam/lifter	Low	Power Reduction
Pushrods	Low	Power Reduction
Timing belt	High	Catastrophic
Chain	High	Catastrophic
Connecting rods	Extremely rare	Catastrophic
Rod cap bolts	Extremely rare	Catastrophic
Head bolts	Extremely low	Power Reduction
Head gasket	Low	Power Reduction
Piston and ring	Low	Power Reduction
Cylinder	Extremely rare	Power Reduction
Valves	Low
Gears	Extremely low	Power Reduction
Oil pump assembly	Extremely low	Catastrophic
Coolant pump assembly	High	Power Reduction
Carburettor	Low	Power Reduction
High pressure pump	Extremely low	Catastrophic
Injector power system	Extremely low	Power Reduction
Spark plug power system	Low	Power Reduction
Magneto	Low	Power Reduction
Generator	High	Power Reduction
Battery	High	Power Reduction
Fuel pipes	Extremely low	Catastrophic
Fuel pumps	Extremely low	Power Reduction
Fuel filter	Low	Catastrophic
Cooling/oil pipes	Extremely low	Power Reduction
High power wirings	Low	Power Reduction
Low power wirings	High	Power Reduction
ECU	Extremely rare	Power Reduction
Sensors	High	Power Reduction
Actuators	Low	Power Reduction
Throttle system	Extremely rare	Catastrophic

. These data come from FAA (Federal Aviation Administration), ATSB (Australian Transport Safety Board) and direct Author experience [1,2,3,4,5,6,7,8,9].

3. Engine Failure Modes: Statistics

Engine criticalities depends on engine and engine version. The most reliable way to detect them is to look at the spare part deliveries. In fact, part substitution is in most cases linked to failure of the parts. Other factors, like accidents or operator’s mistakes are largely negligible. Again, the availability of a large number of engines running is an invaluable advantage of automotive mass production [10,11,12,13]. In this case, it is possible to choose the most reliable engines and the engine type that is the best for aircraft application. Again, the low number of aircraft piston engines affects the overall reliability figure. Failure modes can be derived from engine statistics and are specific on engine type and architecture. Therefore, the following part of this paper will be sketchy, since specific data and algorithms depend on engine type, model, and version.

4. Engine Failure Modes: Mechanical Failures

Federal Aviation Administration published a statistic of Failure Modes and Effects Analysis (FMEA) of aircraft piston engines that had a service time up to 60 years [2,9]. This approach involves examining each critical component failure mode and looking at the consequences those failures and the related corrective actions. A Lycoming study showed their crankshafts often remain in service for more than 14,000 h (more than seven TBOs) and more than 50 years. Crankshafts may fail in early hours due to improper material, treatments and manufacture or accidentally by unreported prop strikes. Secondary crankshaft failure are due to bearing problems and lubricant related accidents. Over the past 20 years, almost every piston engine manufacturing company had had major recalls of crankshafts for bad base material, damage during manufacture, or incorrect assembly. These crankshafts invariably failed within the first 200 h. Therefore, if the crankshaft survives its first 200 h it will last at least to the TBO. Crankcases also provide reliable service for many TBOs. They are typically replaced as necessary (on condition). In a few engine types, they are also align-bored to restore critical fits and limits. Since crankcases are designed for stiffness, cracks propagate slowly and are detected in time-based controls before they propagate to final failure. Therefore, engine failures that are caused by case cracks are extremely rare in engines designed in the last 60 years. The cam/lifter interface is a classical location for wear in piston engines. Even tiny pits due to corrosion or fatigue lead the spalling of the surfaces and are the number one reason for the need for a premature overhaul. However, cam and lifter wear almost never cause catastrophic engine failures. Even with a badly spalled cam lobe, the engine continues to run. Typically, a spalling problem is discovered when the oil filter is cut open at oil change. Properly designed engine gears typically have a very long useful life and they rarely cause catastrophic engine failures. Gears are not replaced at overhaul unless visible damage is found. Failure of the oil pump is rarely responsible for catastrophic engine failures. However, the pump housing can be scored if a chunk of metal passes through the oil suction screen. This causes the oil pressure to stay low enough to reduce lubrication and cooling of crankshaft bearing causing catastrophic engine failure. Modern journal and roller bearings useful life is much longer than the TBO and they are always replaced at any overhaul usually in pristine condition with no detectable wear. Bearings fail by lubricant contamination with metal, coolant, and fuel, by low lubricant pressure, or by bearing holes misaligned (spun bearings). Spun bearings are infant-mortality failures or due to a long period of crankcase fretting. Connecting rod failure is typical of catastrophic engine failures with “thrown rod” out of a hole in the crankcase. Connecting rods are always replaced at overhaul. Improper tightening of the rod cap bolts or oil starvation are the main failure causes. Piston and ring failures are rarely catastrophic with complete power loss. Piston and ring failures occur in early engine life (infant-mortality failures) due to errors in manufacturing or assembly or in cause of overheat due to pre-ignition, lack of ignition, destructive detonation or overload. Overheat failures can be caused by wrong fuel or by operation overload. A digital engine monitoring system is the only practical solution to detect pre-ignition or overload before heat-distress damage is done. Cylinder failures are rare especially in liquid cooled engines but can cause complete power loss. On Continental and Lycoming engines the cylinder consists of a forged-steel, nitrided barrel interference fit into an aluminum alloy head casting. Cylinder barrels typically wear slowly, and wear is monitored by at annual borescope inspections and compression tests. The integral head-cylinder cast can suffer of fatigue failures, and occasionally the head can separate from the barrel with only a partial loss of power. Cylinder failures are usually infant-mortality failure. In fact, most overhauls include new cylinders, so fatigue related cylinder failures are quite rare. In modern engines, a weak point is the cylinder gasket. Metallic cylinder gaskets have reduced the problem, usually due to severe overheat or overload. Liquid cooling and FADEC (Full Authority Digital Electronic Control) also help to control cylinder temperature. In older engines, it was quite common for exhaust valves and valve guides to develop problems well short of TBO. In modern engines, it is far less common. It may happen due to corrosion in engines that are left unused for long times. In this case, borescope inspection is required before re-start. Valve moving equipment like rocker arms usually fail due to bushings that should be replaced at every overhaul. Rocker arm failure due to fatigue is very rare. Pushrod failures are much more common. Stuck valves often cause them. Fortunately, valve failure is far less common than in the past. This is due to a huge work that have been done on treatments and materials in the last years with the introduction of unleaded fuels that lack of lubricating properties and are prone to valve seizure. However, even if valves do not fail, they tend to offer more friction with wear. This fact overloads pushrods, which have a fairly complex design due to the oleo-dynamic play-control systems. Valve failure is very dangerous, since the broken part can interfere with the piston causing full engine failure. Another common cause of failure is timing belt failure. The problem comes from the poor quality of automotive derived timing belt. With modern technology, it is perfectly possible to install a timing belt that outlasts the engine. Automotive quality timing belts are replaced on a time basis and should be replaced as a system. In addition, pulleys, tensioner, and accessories working with the timing belt should be replaced, with the exception of High Pressure Pumps (HPP) in CRDIDs (Common Rail Direct Injection Diesel). Other accessories, like water pumps, should be replaced with the belt. Timing belt failure is catastrophic for the engines. Maximum care should be taken in the quality of the spare parts. For this and other reasons, modern engines tend to use chains instead of timing belts. Chains had the same problems of timing belts, with “reinforced chains” commonly available on the market. The problem with chains is that the tensioner is also very critical and many of them been subjected by several recalls by automotive manufacturers. For this reasons, when automotive conversions are used on aircrafts, it is necessary to know exactly the production batch of the engine used and its (failure) history. Carburetors are rarely a main problem for engine reliability. Condensate is eliminated during pre-flight checks and by the use proper filters. Properly designed fuel systems avoid fuel lock. Therefore, it is rare that a carburetor fails. It will never be rightly regulated, the engine output and the fuel consumption will not be optimal, but engine power output will be acceptable for normal flight. However, even carburetors are not flawless. In a few modern engine rubber-intake-ducts tend to fail or the fuel levelling system may face problems. The engine will reduce power output but rarely fail. Carburetors icing is another classical problem that is more an installation problem than an issue of the piston engine itself. Fuel filtering had also been critical in aircrafts, with mysterious clogging of duct after the fuel filters. In modern engines, better filtering solves the problem.

5. Engine Failure Modes: Electric Failures

In old engines, magneto failure is still quite common. This is mostly because magnetos are full of nonconductive plastic components and their ball bearings are grease-lubricated for life. For this reason, most aircraft engines are equipped with dual redundant ignition, and the probability of both systems failing simultaneously is theoretically remote. Unfortunately, it may happen that, in the case of magneto bearing failure, both systems fail. Therefore, magnetos are always been a weak point of aircraft engines. Another weak point are always been wiring, especially the ones that are connected to ground. Frequent control of wiring and connectors should be performed, preferably on daily basis. A 500hours overhaul of magnetos reduces the likelihood of an in-flight magneto failure drastically. On modern engines, generators are common. These electric machines have brushes, rectifiers, and converters to adapt to the 12 VDC vehicle network. They are also equipped with ball bearing are grease-lubricated for life. The considerations made for the magnetos can also be extended to the automotive derived generators with the notable variations that they are not usually overhauled but simply replaced with brand new units. Brush-less alternators are becoming common especially in UAVs. These units share the same problems of generators except for the absence of brushes. Since they are high quality units, their bearings are more robust and their reliability is higher. Most automotive derived generators/alternators are v-belt driven. Therefore, the failure of the generator or of its belt does not stop the engine. Batteries are other very critical components. Battery overload due to regulator failure or short-circuit may conduct to explosion or fire. Single battery element full failure may reduce the output voltage below the minimum required for ignition or injection. For this reason, it is better to use dual redundancy also for battery with overload and short circuit protection. Power electric wiring have been a weak point in aerial vehicles. The use of wiring calculated for short circuits, new insulation materials and high quality connectors partially solved the problem in recent times.

6. Materials and Methods

In most modern engines, the automotive-derived FADEC (Full Authority Digital Electronic Control) or ECU (Electronic Control Unit) of CRDID (Common Rail Direct Injection Diesel), CRDISI (Common Rail Direct Injection Spark Ignition) and IDSP (Indirect Injection Spark Ignition) engines is composed by sensors and actuators that are connected to the CPUs. The CPUs, in most automotive Marelli and Bosch ECUs are commonly dual redundant, while the sensors are commonly not redundant in cars. Full redundancy of actuators, sensors in aircraft applications is not as common as thought, and, in many cases, only fundamental sensors and actuators are redundant. In modern engines, the aircraft FADEC runs a software that manages fuel dosing and ignition and checks ignitions system, injection systems, actuators, sensors, (OBD—On Line Board Diagnosis), and the back-up CPU(s). The most common failure cause is the software that fails to diagnose in time sensor and actuator failure or contain bugs. ECU failure is extremely rare and it is due to water, lubricant, fuel contamination, or overheating. Sensor and actuator failure is much more common. The most critical component is the battery. The slave or back-up CPU runs in parallel to the main one without giving inputs to the actuator (emulation mode) and reads a watchdog timer from the main CPU. If the failure of a sensor occurs, then the master CPU reads the back-up sensor or actuates recovery strategies like sensor software emulation. In this situation, the FADEC turns from standard to the recovery or back-up state. In the recovery state, engine efficiency may be reduced with increased fuel consumption. In the case of master CPU failure, the slave CPU turns off the master one and substitutes the master CPU in every function. This operation is usually done while the injectors and the ignition system are not active and does not have any effect on the engine performance. Actuator failures are treated in different ways. In a few actuating system, like the drive-by-wire (DBW) throttle, dual redundancy is built in the systems. In fact, most DBW cars use a pair of redundant Throttle Position Sensors TPS. The need of a redundant system is because TPS—often integrated with the servo that controls throttle position—decides the idle or wide-open position of the throttle. This fact poses obviously a safety problem. Even if most DBW vehicles have redundant systems, bad TPS is still a problem. For this reason, OBD is continuously checking the said sensor with high priority and increasingly sophisticated algorithms. For aircraft FADECs, three different approaches are present. The first one sees a fully redundant system with double sensors, actuators and wirings. If the main system fails, the secondary one is activated. The process includes the primary system fading and the controlled insertion of the back-up one. The operation is flawless if the propeller is running and the airflow is strong. Unfortunately, it is much more critical with low airflow and low engine rpm. Another approach is to have a fully or partially redundant system for all sensors and actuators, except the injection and the ignition of the single cylinder. Each injector and ignition system is fully separated and autonomous from all of the other ones. In case of a failure of the redundant part of the system, the switch-off-insertion process is flawless being made when no injection and ignition takes place. The lack of power due to the failure of one cylinder injector/ignition is compensated (recovered) by the other ones. A third approach is to have two fully redundant systems. The first system fully controlling the engine and the other one in emulation mode. As the engine ceases to respond to throttle, the second system shuts down completely the primary one and begins to operate. In this way, power output is suspended for a defined time like in the automatic restart systems in turboshafts. Sensors can be fully redundant or the full reliability figure can be limited to a limp-back-home system. Electronic component failures follow the classical belly shaped curved. The infancy mortality can be eliminated by a training phase of the system in a climatic chamber, where the FADEC is run at topmost temperature for a fixed time (typically 16 or 24 h). Wiring and connectors are the true weak link of the system. In many cases, automotive derived connectors should be used. Automotive components are rarely of aircraft-quality level. Aircraft wires are hand-made and are tested for electric parameters. It is very rare that a vibration test is performed. Wiring failure diagnosis is not so easy at it may appear. Proper diagnosis is required for safe operations. In any case, electronic reliability is not a problem if the FADEC is properly designed and manufactured. Another big issue comes from battery. Battery is the first cause of “electronic” failure on cars. Software is the second one. Battery and software reliability improvement is beyond the scope of this paper.

7. Monitoring Systems

Traditionally, engine information available to the pilot come from control panel(s), indicating engine parameters. Typically engine/propeller rpm, manifold pressure, oil pressure, coolant temperature, oil temperature, exhaust gas temperature, head temperature, and fuel flow. From the nimble WWII BF 109 up to the massive C124 Globemaster these gauges give the necessary information about the engine health.

More advanced solutions exist today in form of engine monitors that cover many engine data in a hierarchical digital display system. Even the very small EFIS (Electronic Flight Instrument System) [14] displays many gauges in a structured way. It is also possible to implement a digital monitoring and control system directly in the tiny CPU of the EFIS display system.

The aircraft crew is trained on the specific type for correct engine monitor data and interpretation. In fact, engine data are also used for improved fuel economy. For example, by monitoring the temperatures of the exhausts it is possible to assess the health of the engine and to have an idea of the temperatures inside the combustion chamber. This temperature at high loads is roughly correlated to engine efficiency and fuel consumption. Low temperatures may indicate engine problems, like high blow by, faulty ignition, and improperly working injectors, clogged nozzles. Engine parameters can also be collected from engine monitoring systems and recorded on a digital storage system. Gauges and sensors have always had a major “reliability & accuracy” problem with pilots overhauling working engines because certain parameters, still in the green arc, where too low or too high for their point of view. Therefore, adding a monitoring system, especially an advanced one with embedded diagnosis and TBO evaluation, requires also an OBD system for its sensors, the CPUs and the wirings. In fact, also the monitoring system has its own reliability figure. However, even in older engines, the installation of an engine monitoring system will increase the safety of the aerial vehicle and reduce the maintenance and operating costs, thus avoiding unnecessary maintenance and keeping log of the events on the aerial vehicle propulsion system.

8. Diagnostic System: General Introduction

The proposed method is a statistically based failure pattern recognition approach. It uses default engine monitor alarm limits to discriminate the criticality of the situation. Crosschecking is used to increase reliability. It is mainly conceived for preventive maintenance and TBO evaluation. It uses the advantages of constant regimes before and during flight to evaluate the engine health and to monitor the engine as a system. The diagnostic process is divided by phases of flight. A large difference exists between modern engines with FADEC/ECU and older engines with analogic electronics and carburetors or mechanical injection. The new engines have already many reliable sensors that can be successfully used for monitoring. Additional sensors, like a precise fuel meter, accelerometers (converted knocking sensors), and exhaust temperature meters can be easily added to the original set. In this case, the original ECU executes the diagnosis and the TBO-forecast as additional tasks. These new engines are quite precise in metering the fuel mixture and compensating for OAT (Outside Air Temperature), OAP (Outside Air Pressure), and OAH (Outside Air Humidity), according to altitude. Throttle and propeller-pitch are often mapped together with IAS (Indicated Air Speed). In this case, cross-controls are easy to make to increase diagnostic reliability. For traditional engines with carburetors or mechanical ignition, the fuel to air mixture is more approximated and, especially for spark ignition engines, the engine is never performing at its best. For this reason, set values should be stored in the monitoring system before take-off. In this case, not only diagnostic should be done with an additional ECU, but also the results are less reliable than in new FADEC controlled engines. Fortunately, especially in UAVs, most of the sensors are already present on the aerial vehicle and can be used for engine monitoring. In traditional aircrafts, the new additional sensors needed may replace the original instruments and a new EFIS-based display system can replace in the cockpit the original engine instruments. For a possible list of sensors of a liquid cooled engine, see

Table 2. A few parameter necessary to the diagnosis.

Symbol	Explanation
OAT	Outside air temperature
OAP	Outside air pressure
OAH	Outside air humidity
MAP	Intake manifold pressure
MAT	Intake manifold temperature
EGT 1-n	Exhaust Gas Temperature cylinder 1 to n
OIL TEMP 1	Oil Temperature inlet
OIL TEMP 2	Oil Temperature in sump
OIL P 1	Oil pressure after the cooler
C P 2	Pressure in crankcase
H P 3	Pressure under the head cover
LIQTEMP1	Cooling liquid temperature in input
LIQTEMP2	Cooling liquid temperature in output
MAT	Input manifold temperature
T	Engine Torque (derived)
Tdiff	Torque variation
RPM	Crankshaft rotation speed
MAP	Manifold Pressure
%VibMV	Variation in RSM Vibration Level
%VibV	Variation in Peak Vibration Level
CLD	CHT Cooling Rate
DIF	EGT Span
V	Battery voltage
DV	Battery ripple
OL	Oil level variation
CL	Coolant level variation
FC	Instantaneous fuel consumption
FP	Fuel pressure

.

If the engine is air cooled, then it is essential to have also head temperature as close possible to the spark plug or to the injector in diesels. In fact, aluminum alloy has a limit temperature that should not be exceeded. Fuel flow is an additional important parameter. In CRDIDs, CRDISIs, and IDSP (Indirect Injection Spark Ignition) engines, many of these parameters are already available in the FADEC-ECU [5]. In this case, it is convenient to embed the monitoring system inside the FADEC to avoid further complications in the power plant. The system is based on the discrimination of the various flight phases. A few of them are very significant to evaluate engine health (

Table 3. Relevance of flight phase to diagnosis.

Phase	Possibility to Retrieve Significant Data
Pre-start	High
Startup	High
Idling before flight	High
Preflight check	High
Taxying	Low
Take off	Low
Climb	Low
Level cruise	High
Descent	Low
Landing	Low

).

Figure 1 shows the basic algorithm of the proposed monitoring system.

9. Diagnostic System: Pre Start

The pre-start phase is very important, since most of the sensors and actuators can be diagnosed for failure before starting the engine. The most important component is the battery. In a FADEC controlled engine, the battery should be in nearly perfect condition, since in most systems it is a very important component of the FADEC. It is very different for traditional magneto engines where the aircraft engine will run even with low or absent battery. In any case, battery diagnosis is fundamental to check whether the battery is still serviceable. In old times, flight manuals allowed take off with a very low or nearly dead battery. With a magneto ignition and with the voltmeter in red arc with the engine on it was possible to start anyway. With modern engines and aircrafts that are richer of electric-powered devices this approach is unsafe and provoked also nearly fatal accidents. Modern battery are different from the old ones and a more accurate diagnosis is possible and easy to implement with commercial-off the shelf diagnostic systems. Sensors and actuators should have a diagnostic algorithm in the monitoring system software.

10. Diagnostic System: Start Up

The startup phase is very important, since most sensors and actuators can be diagnosed also during the cranking phase. The cranking phase is when the engine is running on starter motor without combustion. The vibration sensor, which is a rugged knocking sensor, can easily detect shocks before ignition and injection that indicate big engine problems. Most engines begin the fuel injection and the ignition between 200 and 300 rpm. The measured gradients of the sensors and their relation with the crankshaft acceleration are also very important for failure diagnosis before even beginning injection (and ignition). During start-up, it is also possible to check the generator assembly through the evaluation the current and voltage ripple on the battery. Finally, if the starting phase becomes too long it is necessary to stop and to check the engine. Too long starting phases may damage dampers and accessories that may resonate at low rpm. In spark ignition engines, knocking check is performed all flight long and timing advance is automatically adjusted to avoid knocking. In fact, knocking not only damages the engine, but it also reduces the power output. If the adjustment is too large, the caution switch is turned on. This check is constantly performed during engine firing. The knocking sensor is used also for “vibrations”. This off-design use of this sensor truly detects only shocks.

Figure 2 shows the basic controls during the cranking and starting (firing) phases. During cranking, vibrations are checked along with oil pressure, battery, and fuel parameters. Values and gradients are relevant. If something is out of the prescribed limits the warning light turns off and the firing phase does not take place. During firing (starting) the basic checks are the same but the vibrations. Ranges and limits are different. Time to start is carefully checked along with rpm and ignition. If everything goes fine, the software enters the idling monitoring phase. It something goes wrong, the engine is turned off and the master warning light turns on.

11. Diagnostic System: Idling

The idling phase is also very important; torque variations that are derived from rpm variations indicate how smooth the engine is running. Unusual high shocks may be also detected. Irregular combustion, non-even working of the engine can be checked during this phase. Oil, coolant, and fuel pressures and temperatures should reach the required level. Undue pressure variations are to be checked and addressed. A good throttling will bring the engine coolant to the minimum take-off level (Figure 3).

12. Diagnostic System: Pre-Flight Checks

If preflight tests are run with an automatic throttle system, this phase can be really reliability critical. The gradients in engine parameters measured by sensors are extremely interesting. If the engine can be run at a sufficient high rpm level, torque output and vibration levels can also be evaluated. A mean vibration value can be derived and compared with previous values. Peak fuel consumption is measured and compared with previous values. In engines with carburetors, it is very important to acquire reference values, since these engines are never properly calibrated for air to fuel ratio. This reference value will be kept as an “offset reference” during the flight. The reason of the importance of this phase is that the aircraft is stopped. The additional noise on measures due aircraft dynamic loads in flight are reduced or negligible. In fact, monitoring does not require very precise measures; instead, it requires dependable and rugged sensors, with in-built diagnostic systems. Pre-flight is the last phase in which diagnostic reliability does not afflict safety or reliability but only availability. If something goes wrong the master warning light is turned on and the flight should be aborted. In flight, during cruise, monitoring double checks should be performed before causing false alarms. The pre-flight controls are essentially the same of the “idling phase” with different ranges. The set up parameters are compared before and after the “idling” and “pre-flight” checks. The flight phases are easily detectable through cross check of GPS, actuators, sensors and accelerometric data.

13. Diagnostic System: In-Flight Cruise Checks

As the aircraft is levelled, the pilots are told to make fundamental checks, like fuel consumption (to be mentally checked with average hourly fuel consumption) and instruments in green arc. Pitch and fuel mixture may be manually regulated and cross-checked with head temperature. More or less the same is made with automatic monitoring systems. As the airplane is levelled, the monitor system controls that the sensors stay into acceptable range. Fuel consumption is measured and fuel flow is crosschecked with fuel level meters. Instantaneous fuel consumption should not exceed or remain below a certain amount; otherwise, an injector may be malfunctioning. A cross check with exhaust gas temperature of the cylinders and torque oscillations may indicate the faulty injector. Injectors are usually provided of a system to avoid a fuel surge to the cylinder that may prejudice engine function by washing out the lubricant and contaminating the reservoir. In case of failure, the injector is closed and the remaining one (if present) in the cylinder is used to compensate. For injectors, if redundancy is not available, the injectors on the other cylinders may compensate the power loss. During engine life, the fuel consumption reaches a minimum near ¾ of the useful life, then it tends to increase due to friction increase, blow by and imperfect valve timing as the engine wears out. Monitoring the fuel consumption is therefore important, but difficult, because several “outside” factor influence this parameter. Each parameter is checked for value and oscillation (ripple). If out-of-range cross check is always performed to avoid not necessary stress on aircraft crew. Another important factor is the difference between the exhaust gas temperatures from the cylinders. As a premise, it should be pointed out that piston engines are approximately steady machines. In fact, when the instantaneous parameters are measured on a test bench, measured data are always averaged. In fact, a cylinder is never working in exactly the same way even in two following cycles. Exhaust temperatures follow this law, differences are not only position based, but are also affected by other factors that are difficult to check and control. For this reason, it is important to define quite a large tolerance in exhaust gas temperature measures [10,11,12,13]. More or less the same happens with torque variation. A cross check between temperature and torque may indicate problems on valves, pistons, or head gasket. Generator abnormal ripple on battery may indicate problems on generator or generator belt. It is also possible to measure the ion current signal from a spark plug as an ion probe. In fact, an ion current arises from the central electrode to the combustion chamber wall and back to the ground electrode, when positive bias is applied to the central electrode. Pressure history and flame development influence the ion current. This method can be successfully applied to a monitoring of combustion in the spark ignition engines. Another very important parameter is oil consumption and coolant consumption. If these two parameters can be measured instantaneously, an immediate information of something going very wrong can be retrieved. The long-term measure is always possible and gives a very important information about TBO. Oil pressure is a deceiving information. Ripple in oil pressure during flight is not a very important parameter and it can be due to several factors that may not influence directly engine performance. However, minimum pressure should always be checked with oil pressure rate. Fuel filters and oil filters are becoming more important in modern engines. For this reason pressure drop in filters should also be performed. Accelerometer data are very noisy even if lower frequencies are eliminated. The cruising aircraft is a very noisy environment for vibration measures. Therefore, these sensors can measure only very high shocks. If detected, tests should be repeated with engine idling to understand if the problem truly comes from the engine. Oil contamination sensors can also be successfully used, even if their time-lag prevents an immediate intervention in case of sudden engine damage. Finally, differential pressures between head (camshaft area) crankcase and OAP give immediate reference of problems that arose in the engine.

Figure 4 shows the algorithm of the low oil pressure. The oil pressure in an engine is the most critical parameter. Therefore, it is a good example of cross-check and diagnosis. In cruise diagnosis, each measured value has its own specific software to cross-check and proper corrective action. In the example of Figure 4, if the oil pressure goes to zero (below a certain value) the engines stops immediately. In this case, the loss of power is evident and the engine monitoring system is no more necessary. In case of low pressure or of a sudden drop in pressure, cross-check are necessary. It is possible that the engine is overheating. This fact can be seen by the coolant and exhaust temperatures. Another possibility is a partial occlusion in the ducts before the pumps. In this case, the engine will overheat and coolant temperature will show the problem. It is also possible that there is a leakage in the oil system. This leakage can be internal or external to the engine. In this case, the oil level will detect the problem. In all this cases, the master warning light should be put on with the diagnostic chosen for the case. The message is critical for flight safety and human factor. If possible, the pilot will reduce throttle. It is also possible that the pressure sensor is faulty. In this case, cross-checks will diagnose the problem and only the engine service light will be turned on.

14. Conclusions

This paper introduces a method to efficiently monitor the status of a piston engine during flight. In fact, aircraft engine are not as reliable as they are thought to be when compared with the modern automotive engine. On board Diagnosis and the emulation of vital sensors, ECUs (Electronic Control Units), make it possible to run cars with random electronic failures of components and wiring without the necessity to stop. The same can be easily done on modern aircraft engines that have the FADEC (Full Authority Electronic Control). Older engines reliability can be improved by adding a reliable digital monitoring system. Pre-flight tests may control the engine behavior detecting anomalies that may conduct to major problems during flight. In-flight tests may correlate the output of several sensors to prevent untrue alarms. In this way, the electronic system can monitor the engine with high reliability without much effort. This paper introduces a method to monitor efficiently the status of a piston engine during flight. In fact, automated in-flight refueling has introduced new challenges to UAV (Unmanned Aerial Vehicles) propulsion systems. It is now possible now to run continuously an UAV without landing for long periods. Unfortunately, this is a challenge also for the propulsion systems. ECUs (Electronic Control Units) and batteries/generators make it possible to fly safely without emergencies or urgencies with random electronic failures of components and connections. The same can be easily done on older engines by adding a reliable digital monitoring system and an automated calibration of the carburetors. The electronic CPUs (Central Processing Units) and sensors can be tested for “infant mortality” in ad-hoc test-beds. In this way the flat part of the failure rate curve is cut-away form the belly shaped curve. As the on button is switched on, the sensors and actuators are checked. The CPUs will then run start-up during the cranking phase (engine running without ignition). If everything is all right, the engine starts and the post start checks are also performed. At this point, the engine can run regularly. During normal work the ECU checks both for CPU and sensors. Therefore, the electronic system can be monitored with high reliability without much effort. Another check can be made on the variation of output torque that are roughly correlated to the output torque. A second check comes from accelerometers that can detect the increment of noise in the engine. Sensors for the detection of detonation are available on the market. They are usually cut over 4 kHz. However, they can easily work also in the 3 kHz to 4 kHz band. These sensors are sturdy, economical, and already designed for automotive applications. Unfortunately, vibrations are high during normal flight, since aircraft structure is not stiff and air in not homogeneous. Only very high vibration levels are detected reliably and the diagnosis is in most of the cases too late to be effective. On the contrary, the other sensors may cross check the engine situation and may output very reliable early diagnosis of incoming failures. Statistical data on spare parts are invaluable for this application, signaling weak or not-lasting components and failure modes. This is another advantage of automotive piston engines conversions to aircraft use.