Aeroengine Safety

Figure "Failure mode and effects analysis (FMEA)" (Refs. 17.1-1 and 17.1-2): In contrast with problem analysis (Ill. 17-11), failure mode and effect analysis (FMEA) is a preventive process. In addition to other applications, it serves as preparatory work for risk minimization, risk analysis, and the estimation of risk priorities. FMEA can be used to systematically determine and prevent potential flaws. This systematic, comprehensible, and documented approach is an important characteristic of FMEA. This analysis can make it possible to recognize flaws and gain insight regarding measures to prevent them. FMEA is an extremely effective tool for design engineers, developers, production engineers, and test planners to minimize potential problems. It is used especially effectively in a preventive manner parallel to the development phase of safety-relevant parts and/or problematic parts.
Newly developed parts or the use of new materials or procedures are typical situations in which FMEA can be applied in production.

Process:
The prerequisite is understanding the technical functions of the systems being considered (items under consideration). This also includes their interactions with one another. This can best be achieved through a thorough on-location meeting with the entire analysis team. In addition, the team members must have and understand all relevant documentation. The considerable preparation work this requires must be included in the cost and time frameworks.
Under no circumstances can taboos be allowed to be established. This means that there can be no basic assumption that there are no flaws. Training may be required in order to achieve this “attitude”.

Analysis: Naturally, this process follows a plan that has been optimized for the application (e.g. finishing process or construction process), preferably in the shape of a form (middle frame). The potential flaws are attributed to the items/characteristics under consideration (only shown as a list for one case here). This includes all possible flaws, independent of their probability.
The potential flaws have potential flaw consequences. These include consequences for the subsequent production process as well as for operation after installation.
Potential flaw causes are listed next to the flaws in a separate column.

Risk assessment: If several flaw sequences occur in the composition discussed above, which is to be expected, the most serious one should form the basis of risk analysis. For flaws with several potential causes, all combinations should be considered. Risk assessment is done by calculating the risk priority number (RPN). This is the product of the risk numbers (RN) that are determined using evaluations on a 1-10 scale.

RN (A) for the probability of a flaw occurring in connection with the flaw cause. This assumes that flaws and flaw causes will only be discovered after noticeable effects have occurred. The probabilities are estimated and categorized in tables of superordinate assessments:

• improbable
• very low
• moderate
• high

They are then individually assigned to the estimated frequencies. These are used to calculate the RN (A) that can reach up to 10 depending on the probability of a flaw occurring.

RN (B) concerns the importance of the flaw and assesses its consequences and effects. This can refer to the subsequent production process (process FMEA) or consequences in later operation (customer FMEA). The RN (B) increases up to 10 with the importance of the flaw.

RN (E) referst to the probability of finding the flaw. Depending on the type of problem, this can be considered and estimated depending on the probability of finding the flaw in production or having it be delivered to the customer. The assessment is based on the effectiveness of the testing methods that will be used, with 1 representing the highest probability of detection.

RPM and necessary action: The higher the RPN, the greater the risk and the greater the demand for action. The limit values for necessary action should be determined and specified by each company under consultation with the responsible decision-makers (management). In wide-reaching cases the heads of the company should be involved. In general, if the RPN is greater than 40, measures should be seriously considered, and if the RPN is greater than 80, action becomes unavoidable.

Measures and risk minimization: First, suggestions are collected. These can be divided into two main categories: flaw-detection measures and preventive measures. Depending on their probability of success, these measures are subjected to a risk assessment with regard to the improved conditions. In this context, work/costs, effectiveness, and realizability should also be considered. If there are several suggested measures, that with the greatest likelihood of success should be given priority.

In flaws in parts that are delivered (RN E), 100% tests are often ineffective, despite their greater cost and work. In terms of work/cost, it is more advantageous to prevent flaws than to improve flaw detection. If the part safety/reliable functioning is primary, the probability of detection becomes especially important. It should be close to “1”, and move RN (A) towards “1”, as well.

The realization and monitoring of the measures requires clear responsibilities and deadlines. This usually exceeds the capabilities of the FMEA team, in which case management and technical departments should be included in the management of dates.

Figure "Systematic analysis of problems i" (Refs. 17.1-1 and 17.1-2): In contrast to preventive FMEA (Ill. 17-10), problem analysis (PA) is used with problems that have already occurred, especially flaws. All analyses proceed incrementally. They make verifiable documentation possible. Even if new knowledge is acquired later or “facts” must be corrected, actualization is possible.
Usually, problem analysis is included in a system of several analyses that are used for preparation (situational analysis; SA) and subsequent analyses. This is the decision analysis (DA) that should lead to optimal verifiable measures and aid potential problem analysis (PPA). It considers potential risks during and after the implementation of corrective measures.
A situational analysis (SA, top left frame) is done first if the type of analysis to be used must be determined (PA, DA, PPA).

Problem analysis (PA, bottom left frame) is usually a prerequisite for corrective measures (Fig. "Minimizing scrap rates throuch reworking"), risk assessments, and decisions (Volume 1, Ill. 4.1-3). Its goal is to determine the causes of the problem, the damage, and the flaw as accurately and comprehensibly as possible. Problem analysis is made up of three main steps.

Fact collection: The operative term is “fact”. The “quality” and reliability of these facts determines the analysis results. All findings are referred to as facts. These include findings from inspections (e.g. metallographic, fracture surface/SEM, chemical analysis), operating/process data (e.g. diagrams), test results (e.g. non-destructive testing), and monitoring results from facilities (e.g. temperature distribution in furnaces). Fact collection is also usually a task for technical specialists. It is important to remember that facts are not speculations. They should fundamentally be examined by “independent” bodies. Experience has shown that this minimizes the risk of subjective mistakes that can easily be made by engaged personnel.

Creating hypotheses: Of course, working hypotheses are helpful even in the stage of fact collection. However, they are marked by having to undergo an alteration process depending on the facts that are collected. Adhering to working hypotheses, for example due to reasons of prestige, is absolutely unallowable. If possible, no team members that are under pressure or have interests should be involved.

Creating hypotheses is primarily a creative process. However, it requires sufficient (technical) knowledge of the relationships and processes. Helpful problem descriptions for delimitation can be made in line with the question “what would have been expected, but did not occur?” This type of question is especially important as it opens up new points of view.

Testing hypotheses is based on a plausability comparison with the facts with regard to both the problem description and delimitations. This process is considerably more complicated that it seems at first glance. Even very minor inconsistencies will disqualify a hypothesis. Vague arguments (gut feeling) are not sufficient to confirm a hypothesis. Experience has shown that objectivity is especially hard to maintain in light of “pet hypotheses”. This strict approach can be explained by reference to criminal cases with mistaken verdicts in which it was later revealed that the primary witness was actually the culprit. Retrospectively, it was evident that minor inconsistencies in the management of evidence could have prevented the error, but that these were not considered sufficiently.
Of course, it is possible to develop and test new hypotheses or variants in an iterative process.

Decision analysis (DA, top right frame) is used when, for example, corrective measures are to be developed and prioritized on the basis of the results of a problem analysis. This approach ensures that necessary criteria (“must” criteria) are identified and considered ahead of merely desirable criteria (“should” criteria). In a subsequent risk analysis, the consequences and probability of the alternatives are assessed and the final decision is made.

The potential problem analysis (PPA, bottom right frame) is based on the implementation of measures resulting from the decision analysis. In some cases, the possible measures are altered to minimize risks. In addition, possible corrective measures are developed during the production process, thus reacting to an “alarm” from the warning system that is to be put in place.

Figure "Forming a problem analysis team": Forming a team for a problem analysis (Fig. "Systematic analysis of problems i") is not easy. Competent technical personnel with a proper mentality must be selected from various organizational departments that are related to the problem (Ref. 17.1-1).
A special problem is the fact that engaged specialists such as production process developers have difficulty objectively and critically examining the risks and problems of their own developments and processes for which they are responsible. This should be considered when selecting team members and/or corrected through suitable training with instructers. It is always recommended to have a neutral moderator who ensures that the analysis proceeds correctly.
There is a reason that some of the best literary critics are not authors. It can hardly be expected for an author to provide an objective critique of his own work.

Figure "Potential danger of confusion in the production": Mixing up media/auxiliary materials, parts, equipment, and materials is also a problem in production. The potential damage extent is especially high in this case of flaws. This is primarily due to the fact that mix-ups are often recognized very late, and then only by chance. The reason for this is that unexpected and difficult-to-detect damages such as embrittlement and strength losses, which cannote be non-destructively tested for, will only be revealed by unallowable operating behavior. This has serious consequences:

• many parts are affected
• identification of the potentially affected parts for risk assessments and corrective measures is difficult (Fig. "Minimizing finishing problems by documentation")
• operating damages that affect safety and/or have high costs

Media: Refilling auxiliary materials and relabeling containers (top diagrams) has a potential danger of mix-ups. If clear labeling is not done during refilling, subsequent mistakes are likely. Mix-ups can even occur during relabeling. As a result, a part can be treated in the wrong processing baths (electroplating), etc.

Equipment: In this case, clamping shapes are one possible factor. If these do not fit sufficiently well, it can result in local overstressing of the parts (Fig. "Fastening of parts during finishing"). This can lead to coating cracks in parts with brittle diffusion coatings (bottom left diagram, Fig. "Cracks by deformation of diffusion"), which causes a considerable loss of dynamic fatigue strength. Unsuitable materials in the clamping materials can result in wear products adhering to the parts (Fig. "Damaging by foreign materials on parts"). Subsequent heat treatment or a galvanic process can then cause damage (Fig. "Damages by metallic surface fouling from finishingfinishing").

Materials: The cause of these mix-ups, which are quite rare, is usually insufficient marking of the raw parts. If, for example, the color rings that are usually used to mark bar stock are damaged (bottom right diagram), it increases the risk of mix-ups. Even if the alloy is the same, unexpected differences in the material state (e.g. hardened rather than solution-annealed) can be problematic. This can influence subsequent machining (e.g. grinding cracks), hot forming (e.g. hot cracks), or etching (e.g. corrosion cracking), etc.

A special problem can occur if the material conforms to specifications, but the raw part supplier is not approved for the specific application. In extreme cases, this can result in the installation of unapproved parts, which will require extensive corrective measures.
Even apparently minor deviations in the analysis of auxiliary material such as solders can create unallowable properties in the joint that are very difficult to detect using non-destructive methods. These include insufficient toughness (embrittlement), poor bonding due to a changed solder melting point, or insufficient thermal strength in the joint.

Figure "Part specific testing of the machining process": A major problem concerns sufficient part-specific process testing. There is a risk when testing is done on specimens or parts that do not correspond to the later series parts in all relevant characteristics. For example, structural differences such as grain size, grain boundary orientation, and grain boundary coverage can affect the results of etching processes. In this case, the resistance to intergranular attack can be influenced or hot cracking may occur during welding.

Testing of machining processes requires special mention. This is because operating safety, especially under dynamic loads (dynamic fatigue strength) is decisively dependent on the state of the surface (hardening, residual stresses; Ills. 16.2.2.4-4 and 16.2.2.4-10). It is closely related to machining conditions such as:

• Contour of the surface being machined (curvature radius, top diagram). Testing on a specimen with a relatively small diameter and thus very small radius of curvature can be expected to cause significant deviations in operation-relevant surface characteristics.The part geometry must also be sufficiently considered in the machining parameters of specimens. For example, switch points in which the part RPM and/or thrust are changed can influence the dynamic fatigue strength of the part. In this case, they need to be positioned in a part-specific way and, for test parts that are used for lifespan verification, they must be identical to the later series parts.
  

• Stiffness of the system part/work machine. This influences processes such as chatter or elastic deflection with dimensional problems.

• Cutting parameters dependent on the part geometry. At the same RPM, an inner radius on a plane surface will have a lower cutting speed than at radii farther out (left diagram).
  

• Part cross sections influence both stiffness and thermal capacity, and therefore also the temperatures of the machining process (e.g. grinding). This means that higher temperatures can be expected in thinner part cross-sections.

Figure "Monitoring of fishing processes": The cost and work investment for continual monitoring and documentation of a production process will be accepted if it is relevant to safety. This is especially true if non-destructive testing cannot satisfactorily determine the operating behavior of important production-dependent characteristics. This type of monitoring becomes more reliable, the closer it follows the production step. In any case, the relationship between the measured value of the monitoring process and the part characteristic it is meant to ensure must be clearly known and understood. The more indirect, i.e. the more intermediate steps a monitoring process has, the more likely that deviations in the monitoring system itself will cause its reliability to be suspect. Examples include drifting of thermal elements or vacuum gauges. The diagram shows the problem using the simplified example of a turning process. The thickness of the disk within the specified tolerances must be ensured. Direct measurement ahead of the machining process (“1”) can be seen as the safest measurement method. Measuring the position of the plane surface (“2”) already assumes that other unconfirmed measurements, as well as the clamping system, are correct. The specified and monitored cutting depth of the blade (“3”) is even more indirect in its relevance, as this measurement also depends on influences such as blade wear.

Even more uncertain, but easy to do, is measuring the position of the support. In this case, there is further uncertainty in the form of the elastic deformation of the entire tool/machine system, as well as wear and play in the machine. These are dependent on factors such as the cutting forces, i.e. the condition of the turning tool and chip removal, which are not measured.
Similar considerations could also be applied to completely different processes such as heat treatments or friction welding (Ref. 17-3).

The problems increase with characteristics that can themselves only be indirectly measured. These include beam intensity during shot peening (Fig. "Blasting (Almen) intensity"), which is measured using a separate almen strip. The bond strength and structure of coatings (abradable coatings, thermal barriers, Fig. "Finishing related flaws of thermal spray coatings") are only indirectly measurable using non-destructive methods (Ills. 16.2.2.8-5 and 16.2.2.8-6).

Figure "Observation during the finishing process": Finishing processes can reveal instabilities through characteristics that deviate from the normal process. This provides experienced specialists with a possibility to implement continual process monitoring (Fig. "Quality assurance by process monitoring"). The focus is always on “anomalies”, which involves merely recognizing changes. Then, the relevant technical departments are contacted in order to evaluate the anomaly and, if necessary, determine its causes and take further measures.
In order to make optimal use of this opportunity, the experience of the on-site personnel is an important factor. Therefore, it is necessary that the normal part and machine behavior, as well as the appearance of the parts before and after the process, are known and accessible. Characteristics of the process such as noise development during working can be important indicators that permit sufficiently early detection of problems. The following examples are intended to make this more clear:
Typical criteria that can be recognized visually are unusual deviations:

Chip appearance, breaking of chips: The appearance of the chips of a continual machining process with a defined cutting edge (boring, turning, top left diagram) is closely related to the cutting edge geometry, the machining data, and auxiliary materials such as cooling lubricants. The machining behavior can also provide information regarding material properties such as strength and toughness. If these change, it can have a noticeable effect on the appearance of the machining chips (length, breaking, evenness, annealing temperature/tarnishing).An especially important sign of a local loss of strength (e.g. crack, segregation) is if chips always break at the same place on the circumference. If a slight surge occurs at the same time, it represents a serious quality issue in the material.

Tarnishing on tool cutting edges, parts, and chips indicates changes in the heat development and therefore also in the machining conditions (Fig. "Damage-relevant characteristics of a bore").
Tool wear indicates changes in the machining conditions. There are various deviations from optimal processing conditions that these could be traced back to. These inlclude the machine tools, cooling lubricant (wear), tools, part material (heat treatment state or mix-up).

Noise development is the result of vibration of the part, the equipment, the tools, or the machine. If, for example, an unusual change has occurred in the clamping of the part or in the part itself (e.g. deformation, cracking), it can audibly change the frequency. The volume depends on the vigor of the vibration, and can in turn indicate the strength of the excitement. It means that changed machining forces are at work. They react to influences such as the strength of the part material, tool wear, or changes in the cooling lubricant or its supply system. Even jammed chips in work surfaces that cannot be visually accessed can change the noise development.
If the noise development is due to part vibrations, it is a warning sign of possible dynamic fatigue. This can be undetectably present as a type of previous damage (Volume 3, Ill. 12.6.3.2-1) or reveal itself through cracking at an advanced stage. Thin-walled parts such as compressor blades (Ill. 16.2.2.5-7) and housings are especially susceptible to this possibility (bottom left diagram).

Optical effects such as flying sparks, smoke, or glowing are, similar to tarnishing, signs of changes in the energy introduction or heat development. Influences such as tool wear or changes in machining data (e.g. infeed speed, machining rate) are causally related to these effects. Unusual spark formation (Ref. 17.1-7) can indicate a material mix-up or unexpected coating. Experienced specialists can even draw conclusions regarding alloy variations that would otherwise require elaborate analysis. The intensity of the flying sparks is more likely to be dependent on the intensity of the machining process and/or the cooling lubricant (e.g. grinding, top right diagram). An unusual smell or the development of smoke and vapors can also indicate a damaging machining process.
Additional optical effects are color changes in processing baths, as well as unusual bubbles or foam (bottom right diagram, Fig. "Warning signs of unusable baths").

Part roughness and topography: A first indication is an unusual shine or matte appearance. This can be limited to specific part zones. On machined surfaces, an unusual mirror-like appearance can indicate tool wear or jammed chips (insufficient chip removal, Fig. "Dynamic fatigue strength influenced by fused chips") with pronounced surface deformation. If the grain can be clearly seen on the machining surface (especially in the case of coarse-grained cast Ni), it indicates pronounced plastic deformations. Matte surfaces are more likely to be expected under the influence of etching baths. For example, if the part has areas that are still metallically shiny, it indicates that the etching bath did not act in these areas. On the other hand, if one expects a shiny surface (e.g. electropolishing) and instead recognizes matte zones, there is a risk of a dangerous intense etching attack (e.g. intergranular corrosion).

Figure "Susceptibility of flaws": The design engineer, preferably in combination with the design planners, should actively strive for optimal production with the lowest possible susceptibility to flaws (FMEA, Fig. "Failure mode and effects analysis (FMEA)").
For example, welded and soldered connections should be positioned on the part in such a way that it creates optimal conditions for processing and allows visual inspection of the joint across its entire length.
In electron beam welding, this can be done through testing of the root area (top diagram). If this is poorly accessible, it can affect part safety (Fig. "Damaging metal splashes abd sparks").
The same is true of soldered connections. These requirements are not always met. One example is the unfavorable design of a soldered connection shown in the bottom diagram (also see Fig. "Controlling gap filling of a brazing").