Ignition Switch Defect: A Check That Could Not Have Detected It
A 100-hour inspection on a piston single is signed off at 03:20 by an engineer working the second of three consecutive night shifts. The aircraft is booked for a 07:00 departure. On the run-up the magneto check reads: LEFT drop 75 rpm, RIGHT drop 60 rpm, BOTH drop 120 rpm. The manual limit is 175 rpm maximum drop with 50 rpm maximum difference between magnetos. All figures are within limits. The engineer skips the switch-OFF check because the propeller is cycling on the governor and, in his words, 'we always do it at the next check'. In flight the pilot finds the engine will not stop with the ignition switch. Investigation finds the OFF-terminal ground wire broken inside the loom, with the ends still held by the tape.
1. Explain, from the switch circuit, why the recorded magneto drop figures were normal and why the OFF check was the only ground check that could have revealed the defect.
Read the worked answer
How the circuit works
A magneto is stopped by grounding its primary circuit through the P-lead. The ignition switch has three independent paths:
- LEFT position: grounds the right magneto (engine runs on the left magneto).
- RIGHT position: grounds the left magneto.
- OFF position: grounds both magnetos through a common return to the airframe.
Why the drops looked perfect
The LEFT and RIGHT drop readings exercise only the LEFT and RIGHT grounding paths, and both were intact, so the engine dropped onto one magneto exactly as designed. 75 rpm and 60 rpm are within the 175 rpm and 50 rpm limits and a 15 rpm split is normal.
The BOTH reading is simply both magnetos firing; it carries no information about the grounding paths at all.
Why only the OFF check tests the defect
The broken wire was in the common OFF return. Grounding through LEFT or RIGHT still worked; grounding through OFF did not. No left/right selection in the world proves that the OFF path exists. Only selecting OFF and watching the engine die (the dead-cut check) tests it.
Practical cautions: the check must be done with the propeller clear, chocks in place and the aircraft secured, because with no OFF path the magneto is live whenever the propeller is turned. Note also that a broken OFF path is a silent failure on the ground until someone needs to stop the engine in a hurry, in which case the only option left is fuel and mixture shut-off.
2. Analyse the event using a human factors model. Identify the active and latent failures and propose at least three defences.
Read the worked answer
Fit to a Swiss-cheese / Dirty Dozen style analysis
Active failures (at the sharp end)
- The functional check was deliberately omitted.
- The reason given ('we always do it at the next check') is normalisation of deviance: a shortcut has become the accepted norm.
- No defect entry, no independent inspection of disturbed ignition wiring.
Latent failures (in the system)
- Fatigue: sign-off at 03:20 on a second consecutive night shift, with a 07:00 departure. Night work, circadian low, and consecutive duties are known error multipliers.
- Time pressure: a hard departure slot creates a production-over-safety climate.
- Task design: the switch-OFF check is not captured as a separate signed item on the task card, so it can be dropped without leaving a trace.
- Supervision: no second person required after ignition-system disturbance.
- Handover: no written cross-check of open items between shifts.
Defences
- Task card broken down so the dead-cut check has its own sign-off box with an 'if not done, state why' field.
- Mandatory independent inspection after any disturbance of the ignition switch, P-leads or loom.
- Fatigue risk management: duty-hour limits and no safety-critical sign-off in the early hours without an independent check.
- A no-blame reporting channel plus a visible 'stop the job' authority, so the engineer can refuse a departure slot without fear.
3. State the immediate technical actions and records required before the aircraft flies again, and comment on how the individuals should be treated.
Read the worked answer
Immediate actions
- Aircraft grounded and quarantined; ignition switch left OFF and the propeller treated as live until the circuit is proven.
- Repair or replace the broken ground wire and inspect the whole loom for chafing, heat damage and correct termination; verify the switch contacts on all three positions with a continuity test.
- Functional test after repair: magneto drops within limits, then a dead-cut check with the engine at low idle, propeller clear, aircraft chocked.
- Independent inspection and dual sign-off of the repair and the functional test.
- Technical log entries: defect, rectification, functional test result, reference and signature of the licensed engineer.
- Occurrence report to the national authority under the mandatory occurrence reporting scheme, since this was an in-flight event affecting engine shut-down capability.
Treatment of the individuals
A just culture distinguishes the behaviour from the outcome. The omission of a known required check and the absence of a log entry are procedural violations, but they occurred in a recognisable fatigue and schedule-pressure context. The proportionate response is a non-punitive report, a systems fix (task card and fatigue management), retraining, and a supervisory check, with disciplinary action reserved for deliberate concealment or recklessness. Blaming the night-shift engineer alone would guarantee the next occurrence goes unreported.