Aeroengine Safety

Fig. "Unrecognized dangers" : The experience shows, that dangerous situations can develop, when symptoms respectively unusual observations are not sufficient clarified. With this the danger increases , that the real cause is not identified and at a later time has catastrophic consequences. A typical example are chips in the lubrication oil, which location of formation was indeed identified (e.g., bearing) and also a repair takes place. However, if the question for the main cause of the bearing failure is not asked and answered, can e.g., furthermore occurring causal vibrations from unbalances lead to considerably damages like the fracture of a shaft. For this reason the claryfying of the real failure cause has priority.

Figure "Overhaul costs" (Lit. 19.2-1): Those diagrams are valid for two of the most frequent fan-aeroengines for airliners about the year 2000.
The information of the left diagram is astonishing for an outsider. 30% of the safety relevant problems which lead on aeroengines to an „in flight shut down” (IFSD) are obviously causative connected with the maintenance (volume1, Ill. 2-7).

The by far dominating percentage (50 %) is connected with sensors and the cabling/wiring (chapter 19.2.1). Here also connections with the maintenance may suspected. This is for example obvious for contaminated or corroded connectors.

The trend towards intensified monitoring of the aeroengines with sensors, for example to best possible utilise the lifetime of the components (lifing, health monitoring, chapter 25.1), let suppose, that this problems will get even more important. An already since years ovserved example are the fire monitoring systems in the aeroengine nacelles (volume 2, Ill. 9.5-2). Its connectors (Ill. 19.2.1-1, chapter 25) and cables obviously are especially affected by vibrations, corrosion and contamination.

The diagram at the right is applied to a small fleet (13 airliners) with its reserve engines (8). It is interesting, that the costs of the real maintenance work compared with the hardware and the support is relatively moderate (service and logistic, Fig. "Important terms").
This example also seems to show, that the costs refered to the hardware and the use of the module concept can be markedly reduced. That is the case, if not every reserve engine is equipped with a fan, but considerably less fan-modules are stockpiled. With this „rexting capital“ is minimised. But the additional expenses and a certain potential risk for the exchange of the fan-modules are not clear (Fig. "Advantage and danger of module design", Fig. "Critical joining of big engine modules 2").

Figure "RMA reliability maintainability availability" (Lit. 19.2-25 up to Lit. 19.2-28): The effort to keep a product in operation is minimised with so called „reliability, maintainability, availability- programs” (RMA) of the (US) Department of Energy (DOE). It concerns an analysis that schould make life cycle costs during the operation , overhaul, maintenance and repair, expecially by including the development process more controllable.

This process (a guidance gives Fig. "Integrated Logistics Support 1" /-1.4.2) uses the whole development process of a part/component respectively a machine. This includes the planning as far as overhaul (life cycle model, lower frame) and from, this subsequent optimisations (lessons learned).
The RMA-process succeedes as follows:

In the forground stands

• Availability
  
• Reliability- Maintainability/repairability
  

Design and production are considered in a RMA-program with the clarificatiion of the following determining factors:

• Requirements for the life time of the product.
• Normal and most heavy operation conditions.
• Down time for maintenance and repair work (Fig. "Important terms").Data of the subsystems (also suppliers) flow into the superior analysis if the entire program.
  

A RMA must also contain a risk management. For this it is needed:

• Identification of the necessary operation characteristics with its measurable risks.- Quantitative description of the risks for the end product during the operation time including the normal case and the most bad case (design reference mission = DRM).
  
• Examination and documantation of the influences of the sub systems (e.g., supplies) for requirements of the complete system
• DRM.
• Comprehensible estimation of the behaviour of the main system, subsystems and equipment. For this serves the analysis of experiences (e.g., failure cases) and calculations (engineering analysis).
• Bottom-up-estimation of the influences of the sub systems and the equipment for their requirements at the end product.
• Identification of the equipment which influence down times of the complete system. For this critical equipment a special technical support is carried out, to guarantee sufficient safe the specifications of the complete system.
  

Figure "Important terms" (Lit. 19.2-26): Into the analysis of the effort for operation and logistics for an aeroengine flow parameters with special names and acronyms. These are here assembled. If explanations in detail are needed special literature can be used.

Illustrations 19.2-1.4.1 and 19.2-1.4.2 (Lit. 19.2-29 up to Lit. 19.2-31): The „integrated logistic support“ (=ILS) is a management process, which consists of a systematic with 10 separate steps (ILS-elements). It was originally developed and used in the military area and becomes now also accepted for civil applications to plan the support of the products over the whole life time cycle.

All ILS-elementes must be developed by a responsible position („system engineering”) in a coordinated process in each other dependency. Thereby compromises can be necessary to make lowest life cycle costs (Fig. "RMA reliability maintainability availability") possible at tolerable features like:

• Operation behaviour,
• maintainability,
• conservation/preservation,
• transportability and environmental sustainability.

The plannig follows an ILS-plan (ILSP) under consideration of the purchase strategie. The list of the picture gives an overview of the tasks which have to be executed respectively must be clarified. By the way, in the concrete application will be refered to the available literature for the training. This is offered in a multitude of application oriented specialist books, e.g., in the internet.

Figure "Causes for maintenance faults" (Lit. 19.2-3): This chart givs a general overview (no claim for completeness) about influences („human factors“ see chapter 19.1), which from experience are in causal connection with maintenance errors/faults. In the specified literature they are assigned to the example 19.2-1 (Fig. "Simultaneous maintenance work" and Fig. "Ill advised maintenance work"). As contributing influences they lead in the addressed case thereto, that in all four engines of an airliner the O-ring seals of the magnet plugs were forgotten. Thereby it came to the shut down ot the aeroengines and an emergency landing. As can be seen, the causal coaction of a multitude very different factors is concerned, which lead to an extreme dangerous situation:

• Merely half of the normal shift personnel was for the night shift available. In spite of a reduced supervising capacity the supervisor did not reduce equivalent the planned volume of work of the shift (concerned factors 11 and 13).
• The cancellation of the night shift for the aeroengine was unsufficient planned by the management. Therefore the hangar night shift lacked the necessary magnet plug- exchange sets.
• In spite of the risk of a simultaneously accomplishment of the same overhaul procedure at all aeroengines, the exchange of the magnet plus was analogical executed (concerned factors 9,11 and 13).
• The supervisor surpassed his capabilities and experience. His self-assessment was unsufficient. So he tried to arrange the lacking exchange sets from engine parts by himself (concerned factors 8,13, 14 and 15).
• The supervisor was not trained for this routine maintenance work and executed the task without looking into the manual (concerned factors 9,11,12 and 13).
• The supervisor did not stick to the instructions of the manual (concerned factors 8,9,12 and 13).
• The supervisor called upon the technician to sign a work without executing it himself.
• The supervisor executed a work himself but did not sign it as supervisor (concerned factors 10 and 12).
• After the maintenance work the ground run of the aeroengine was not ordered (concerned factors 8, 12 and 14).
• The highest supervisor (general foreman) monitored the work unsufficient. He affirmed himself only unsufficient of the utilisation of the safety satandard (concerned factors 1,9,12 and 13).
  

Figure "Nightshift problems" (example 19.2-1, Lit. 19.2-3 and example 19.2-2 ): Personnel problems in on site maintenance can evoke dangerous situations. Just then the required experience with maintenance work must be considered by the responsible organisation. The illustrated case was possible by a chain of wrong decisions. The picture shows the correct, scheduled, complete organisation of a shift with 12 (workers). This consists of 1 leading `general foreman', 2 experienced `senior supervisors', 3 supervisors and 6 technicians. Unfortunately the night shift was because of personnel shortage reduced to 9 workers. This lead to critical situations. The whole process is described in the following and poits instructive at the weak points.

The leading supervisor (general foreman „B”) gave the instruction to one of the supervisors (leading hand „C“) to take oil samples for oil analysis (SOAP, chapter 22.3.4) and to change the magnet plugs for chip control at all four aeroengines.

The supervisor (leading hand „C”) was not trained for this specific aeroengine maintenance, however he was authorised for it. He did not find the new magnet plug sets for the assembly.

Normally those are supplied by the aeroengine night shift („F“). But this was cancelled due to personnel shortage without transfering the task alternatively to the day shift.

The supervisor went after an agreement with „B” to the support, found the magnet plugs which he considered ready for assembly („D“). However the concerned parts where untested without sealing rings (O-rings, sketch down right). He arranged them to exchange sets by himself („E”).

There was no technician („F“) for the maintenance work when he returned. The supervisor decided to execute the work by himself („G”), however without consulting the manual.

In the manual the fitting of new sealing rings (O-rings) and a test run with especial attention for leaks was demanded. This didn't happen („H“). It could be seen, that such oil leaks can be only sufficiens sure identified by a test run with sufficient high engine performance with appropriate high oil pressure (Fig. "Simultaneous maintenance work").

The field map/operating sheet had to be signed by the techmnician who had executed the work step and the supervisor in charg. The supervisor requested a technician to sign the work as his own and than signed himself as supervisor („I”).

Before the flight the ground crew did not see leaking oil and the aeroengines behaved normal during run up and the rolling of the aircraft to the runway.

Then, after the start in flight the oil leaks at the magnet plugs occurred (see the description in the example 19.1-1 and Fig. "Simultaneous maintenance work").

Figure "Simultaneous maintenance work" (Example 19.2-1, Ref. 19.2-3 to Ref. 19.2-5): The four engined airplane of a military operator was forced at the beginning of the flight to shut down one engine. Later, after indications of a heavy oil loss during an emergency landing further engines shut dowm.

Cause of the oil loss was a maintenance fault. The magnetic chip detector plugs (= MCPD) were assembled without „O“ rings on all four aeroengines.

The magnet plugs must be periodical disassembled and again assembled (all 50 start/stop cycles) for chip control.

During the start of the engines and during rolling to the runway the ground crew noticed no sign of an oil leak. The explanation for this is, that thereby not the maximum engine load/performance was reached. So the oil pressure was too low for a markedly oil leak. Not until the start of the airplane and the climb the oil pressure was high enough that the catastrophic oil loss occurred (lower sketches).

Figure "Maintenance error leading to engine failure" (example 19.2-2, Lit. 19.2-7 and Lit. 19.2-16): This incident is in many aspects similar to this one described in the Fig. "Causes for maintenance faults" up to Fig. "Simultaneous maintenance work". To those influences which promoted the lack of the magnet plug seals also belong deficits in information and training of the technicians (Fig. "Ill advised maintenance work"). Beyond this the question arises, if an analogy in the work situation between both cases is accidental:

• The same technician changed at all three aeroengines of an airliner the magnet plugs in the same maintenance process.
  
• It was during a night shift.
• A set of magnet plugs ready for assembly, although otherwwise usual, was not available.
• The installation kits were self removed from the store.
• Subject to a wrong assessment of an oil leak detection was the test by means of a short engine run considerably lower than the maximum operation roror speed.

Noticeable is the unsufficient sensitising for this problem. Already in the previous 2 years 12 serious cases emerged in connection with the installation of magnet plugs.

Figure "Ill advised maintenance work"

Illustrations 19.2-4.1 and 19.2-4.2 (Lit 19.2-2): Explanations of the strategies to minimise the frequency of failures at simultaneous maintenance of aeroengines:

A planned, timely staggered maintenance should avoid, that maintenance processes on the aeroengines are performed by the same personnel at the same time.

If a simultaneous maintenance of the aeroengines can not be avoided, the exchange of the maintenance personnel should be planned. That can be the case after a damage on several aeroengines by impact of a flock of birds. In such a case the aeroengines should be maintained by different teams. So also a different mental crowd/group behaviour can be utilised.

A simultaneous maintenance with a suitable sequence shows Fig. "Reduce risk of simultaneout maintenance work 2". Are those attended, the failure risk can drop.

From mthe process planing, supervision and the technicians due to hands-on experience and detail knowledge helpful recommendations can be expected.

Education/training and instruction should point at particular, possibly not evident risks of certain components and systems. For example poiting at the significance of the oil respectively the oil system and its components like filters, magnet plugs,drain bolts, filler caps and pumps (Fig. "Gear pump failures"). Oil loss can always be a safety problem. To this belong oil bearing components like gears. A special attention should be devoted to the diverse seals (chapter 23.4).

The use of „supporting documents“ like special manuals for simultaneous maintenance. With the application of pictures from areas were already problems which have occurred are described and the risk is comprehensible illustrated.

Helpful are small information sheets for pocketing with hints at critical areas and suitable approaches.

Stickers as „leaflets” can remember at the increased risk of the simultaneous maintenance. Tips of the aeroengine OEM in form of „service letters“.

Additions or attachments to the work/operation sheets.
There can be posters purchased from authorities like FAA, which deal with the prevention of maintenance problems.

Figure "Technicians unfamiliar with aircraft" (Lit. 19.2-9): The day before the here described incident the maintenance personnel saw fuel dropping from the drainage pipe of an aeroengine. The fuel came from the area of the fuel/oil heatexchanger. Thereon the problem should be eliminated by two approved technicians with the substitution of the heat mexchanger. This process was executed as follows:
Loosening of the flange of the feeding fuel pipeline (sketch). Thereby fuel sprayed out of the pipe line. From this it was concluded, that the heatexchanger obviously is not the reason for the leak. Now the pipeline should be connected again. After the seal rings were supported for replacement and the installation the three nuts of the flange connection were tightened. By this the for the safety of the connection important retaining flange (retainer) was ignored.

The technicians with this task consigned were not familiar with this type of coupling. For the loosening and again the fastening of the pipeline the technicians however did not inform themselves in the handbook of the aircraft OEM for elimination of failures. Also the maintenance manualas not reviewed. A notice about the procedure in the maintenance documents was not carried out. The leak tightness of the connection was carried out from an elevated position according to the instructions. The further search for failures showed however the heat exchanger as cause of the leak. Thereon this was exchanged by the two technicians. The leak tightness check was carried out 6 minutes during running idle of the aeroengine. This time the tightness check was carried out on ground. This is admissible for the heat exchanger. However the check of the pipeline connection must be carried out like before from an elavated platform. For this a special developer fluid must be sprayed at the mounted connection. This facilitates an identification of the leak. Those prescribed steps were not carried out. After the test run the documentation was completed.
The next day during start of the airplane a fuel leak in form of a noticeable spray plume was identified. The pilots got an information by radio. Afterward the aircraft landed again. Later arose that already about 3700 kg fuel had escaped.

The following investigation showed:
The fuel pipeline to the heatexchanger came loose although the flange coupling with its three boltings seemed to be okay. However it appeared that the retainer (flange, see sketch) lacked. This had been slipped unnoticed during the assembling along the pipe line and so was ignored. However the connection with the three nuts could be tightened keeping the tolerances (fastening torques, measures). In this case The sealrings perform during a test run at idle a sufficient seal effect. But at start thrust the connection fails. At this engine performance the pressure doubles and the flow rate in the feed line rises almost 15-fold.

Besides the described defiencies in the maintenance process „human factors” seem to play an important role in this case (Fig. "Designed overhaul frendliness" and Fig. "Measures for ergonomic maintainability"):

• The inspection of joined, narrow meighboured components for leaks from very different positions, which can be only realised with problems, are hardly sufficient for the principle of a good accessibility and inspection during maintenance.

• The possibility that the retainer (flange) can slip out of sight, can be seen as a design deficit.
  

Figure "Dangers of interchangeability": From experience interchangings have a high risk potential. That has especial reasons:

• Often interchangings are not seldom identified only late, e.g., during operation, by chance or after a failure. Than it is to reckon with, that already a high number of suspect parts are delivered and are in operation.
• Therefore also a high number of delivered parts may be concerned.
• Is the interchanging noticed not until a clearly from outside visible failure the likelihood exists that there are already serious consequences. An example is the failing of a concerned component/part by fracture.

An interchanging risk exists at nearly every technical field, so also during maintenance. Not always it is about an unconsciously process. Also cases are known when switched to a product with supposed respectively apparently advantages (e.g., costs, operation behaviour, maintainability, availability). In such a case the designation interchanging is „limping“. This is especially true for auxiliary material like lubrications (e.g., grease) ond cleaning agents (above left).

An especially interchanging risk is the external similarity (optical,smell, feeling/consistency). Classical is the interchange of MoS₂ containing lubrications with such, containing graphite, as well a typical black paste (Fig. "Approved lubrication media"). At hot parts MoS₂ can trigger dangerous corrosion (sulfidation), under tensile load with a fast crack initiation and propagation (sketch above left).

Basically is the packing of essential importance for a certain identification of the content. An arbitrary alternation, for example by decanting into a not original packing includes already the danger of a confusion. Such changes can also be the result from damages of packings.

A clearly documented storage with doubtless assignment and identification of products and suitable labeling is absolutely necessary. Especial attention must be pointed at, that labels were not damaged or modified without documentation. To this belong also the interchange of labels (sketch above right) respectively the use of canisters/cans which normally let expect an other content.

Also „suspected unapproved parts” (SUP, „bogus parts“, chapter 20.2.1) can be counted to this problematic. Here the interchange may be strategy (down left).

Unsuitable canisters/cans,especially with provisorily or not clear labeling have lead to aircraft accidents (sketch down right, Fig. "Careless maintenance").

Figure "Excessive use of sealant" (Lit. 19.2-10): A later investigation of the, in this incident concerned auxiliary power turbine (APU) showed, that the fuel-draining line (sketch down right) was blocked by several particles of an elastomer. It was an at room temperature hardening material that is used during the assembly of the APU as sealant between the flanges. The operator confirmed this approach. The overhaul manual of the APU OEM advises the operator especially at a spare use of the sealant. So every excessive sealant must be removed before the mounting of the guiding tube to avoid the blocking of the drainage connections. Does a blockage occur according to the hand book it is to reckon with torching flames.

Cause of the overheating of the fuselage end in the region of the APU, was a clogged drainage line at the combustion chamber. During an unfavourable start sequence, the remaining fuel was nebulised and blown out of the exhaust pipe. Tailwind blew the fuel during standing airplane to the front and wetted the back of the fuselage. This fuel was ignited by the hot exhaust gases during the start of the APU.

Figure "Careless maintenance" (Lit. 19.2-12, see also volume 1, Ill. 5.5-4): At the beginning of the 70s a spectacular momentous aircraft accident was triggered by a maintenance failure.
To increase the start performance of the aeroengines into the concerned engine type distilled water is injected behind the compressor (sketch below). For this purpose unlabeled canisters were taken from a storage room, which obviously contained water. However in the canisters was actually not clear water. But instead they were filled with water, contaminated with kerosene. This originated from a former exceptionally action. The canisters were brought with the airplane to the next airport of destination. There the aircraft needs for the start thrust the water injection. Therefore the canisters were here now filled into the injection water tamk of the airplane. During decanting a technician noticed the smell of fuel. The therefore addressed pilot however guessed…“here everxthing smells of fuel”. So a last chance to avoid the accident was lost.
The lighter cerosene gathered in the injection water tamk above the water. During extraction while injecting first at the beginning water was sucked from the aspirating port near the bottom of the tank (middle sketch). Then the concentrated cerosene followed. Instead of a cooling effectnow fuel was
injected without control and so the hot parts of both aeroengines extremely overheated. This lead to the melting of the turbine blading. Without any thrust from the engines the pilot tried an emergency landing on the near highway with catastrophic consequences (sketch of this sequence left).

Fig. "Sensibility of contanimations" ( Lit. 19.2-33 and Lit. 19.2-34): Typical contaminations which can get through the compressor into the bleed air for the cabin cabin air. This schematic sketch gives no hint at a concerned aeroengine type. Some contaminations are engine type specific. That is for example true for the sensibility for contaminations by leak oil and oil vapour from the main bearing chambers.This is because of the toxic effect especially alarming (Fig. "Survey of cockpit crew"). An injection of water-methanol to increase the start power also is limited at distinct types.

Also the remained washing fluid of a cleaning process (chapter 19.2.3) has already airplanes forced to return and land after the start (Lit. 19.2-35).
after the start

Figure "Smell nuisance" ( Lit. 19.2-12, Lit. 19.2-13, Lit. 19.2-14, Lit. 19.2-15, and Lit. 19.2-18):

In the indicated literature we can find systematic analysis, especially in connection with certain types of airliners. That militates in favour of specific design features of aeroengine caused smell nuisance (Fig. "Survey of cockpit crew" and Fig. "Example of contaminated cabin air"). This deals for example with design details of the front main bearing chamber (seals, pressure differences). For an APU is the position and configuration of the intake at the fuselage is important (Fig. "Example of contaminated cabin air" and example 19.2-4). Smell nuisances are promoted, if oil can enter from the rotor into the high pressure compressor and from there into the bleed air (Fig. "Example of contaminated cabin air"). But the literature also shows, that human factors can play an impportant role (Fig. "Dangerous overfill"). To this counts the maintainability in connection with the re-filling of oil and the control of the oil level (Fig. "Example of contaminated cabin air"). The diagrams are based on the analysis if incidents at two airplane types.

They show:
the subjective cognition of the smell characteristic can be seen from the both upper diagrams. Obviously there is a diversity of typical smells which differ significant. The differences in the cognition point at different causes (diagrams below). It is interresting, that smoke in by far the most cases occurred in connection with an oily smell. This argues for lubrication oil contaminations of the air (arrowheads). In this cases a connection with the oilsystem of the aeroengine or the APU seems likely.
A high percentage (30 - 40%) of all incidents can not be related a distinct cause. This makes remedies difficult and longsome.

Figure "Survey of cockpit crew" (Lit.19.2-8, Lit. 19.2-12 and 19.2-17): Studies showed that contaminations of the cockpit air and cabin air can have toxic influences. These can be individual very different (example 19.2-4).

It is especial safety critical that both pilots are concerned. The situation tightened by the behaviour of the pilots, if they in spite of indisposition and other symptos continue their service.

The following conclusions can be drawn:

• The lubrication oils in aeroengines used contain toxic components which can trigger irritations, susceptibility and harm nerves. They get without contact with the skin only dangereous if they get into the inhaled air.Especially alarming are the, in aeroengine oil used 5 % additive trikresylphosphat (TCP). It is a mixture of several TCP-struktures and belongs to the phosphonic esterns/organic phosphates (Ill. 23.3.1-7, Lit. 19.2-34). TCP and its thermal decomposition products (high compression temperature of the compressor air) act as nerve poison. It affects through the metabolism in the body. Thereby develop toxic acting compounds (Lit. 19.2-3). Therefore towards some assumptions it is not essential how it gets into the organism (skin, mucosas, lunges). It leads to headaches, dizziness, sickness/nausea up to regurgitation. In an extreme case cripping can occur. In several cases the crew had to apply oxygen masks to guarantee the flight safety (Fig. "Toxic TCP getting into the the bleed air"). That TCP is responsible for such dangerous incidents obviously was recognised only recently. Therefore there was not selective searched for TCPin the cabin air. For this reason we find in elder investigations and reports nothing about tis contamination of cabin air.
  

• Contaminations by oil in the compressor air are also known without bearing seal failures and can be hardly avoided. For example load changes of the engine power which affect the pressure of the sealing air and axial thrusts of the rotors as well as landing impulses (lateral load of the rotors) can lead to short time leakages. Such situations can also occur during some flight atitudes. Thousands contamination cases of the cabin air by oil were observed in the last years. Thereby the TCP residues scatter by the factor 10³. The TCP-problem in the breathing air was in elder aeroengine types (e.g., JT3) avoided by means of a separate cabin air compressor. Later because of the costs it was changed over to bleed air from the engine compressor. For airliners which are in development the intake for the cabin air is again separated from the aeroengines.
  

The potential danger of cabin air and cockpit air contaminations is considered in the standard for airplane ventilation (FAR/JAR 25.831).

• The application of the oxygen supply must follow the instructions of the operator, of the airplane OEM and the guidelines of the aeronautical authorities.

• Minor quantities of contaminations („a little bit of contamination”) are, contrary to the estimation of some operators to evaluate as failure accordant to the aviation regulations. Smells/odours and vapours must be always kept seriously. Every incident must be registered/documented respectively reported to the operator and the appropriate aeronautical authority. This enables justified and targeted measures.

• It is interresting that symptoms occurred (lower diagramm) at the crew not only after a noticed comntamination with oil. They were also registered during flights without such an incident (figure above). The incidents are concentrated on two airplane types (Fig. "Smell nuisance").

• Remained contaminations can lead to problems as well as current oil leaks.

• Pilots can lack an understanding for the problem. Also deficits in the estimation of concerns of the pilotsin the, one who is as the operator responsible for the health, were observed.

• Investigations indicate, that obviously CO-gas forms during the degradation respectively oxidation of contaminants and is responsible for a major part of the short-term symptoms.
  

Figure "Smell and odour of cockpit" (Lit 19.2-12): The precondition for specific measures/remedies is also here the knowledge of the causes. 30-40% of not identified causes (Ill. 19.2-9) show, that those are obviously not easy to determine.

From the character of the smell (Ill. 19.2-9) and the visual appearance (smoke, mist) can be concluded at the cause if there is sufficient knowledge about the ventilation system. Naturally at least during oil odour primarily the aeroengine or the APU are a possibility as origin. It must be considered, that also contaminations of the air ventilation duct which occurred before (filter?) can trigger such incidents. Naturally then the cause must be searched in a former event.

Contaminations of the ventilation system can have very different causes (Ill. 19.2-9):

• Maintenance problems like overfilling of the oil system/oiltanks (Fig. "Dangerous overfill").
• Failing of the seals in the bearing chamber area.
• Unfavourable pressure build-up in the bearung chamber area. This can be in connection with a temporary especial engine power (e.g., start, idle). For example at aeroengines of fighters this can be a highe speed flight at ground level (volume 2, Ill. 9.2-3). Also a surge of the compressor can change the pressures so that oil exits (volume 2, Ill. 9.2-2 and volume 3, Ill. 11.2.1.2-1).
• Problems in the oil system. An example is the -disturbance of the air separator (breather, Fig. "Example of contaminated cabin air" and example 19.2-1).
• Oil exit during standstill due to lacking sealing air, increased sealing gaps, e.g., by settling of the oil dampened main bearings (Fig. "Damped main bearings") or rotor distortion (rotor bending, volume 2 Ill. 7.1.2-9). The oil which exits into the rotor drum then becomes noticable during operation.

Figure "Example of contaminated cabin air" (Lit. 19.2-18, Lit. 19.2-20, Lit. 19.2-21, Lit. 19.2-22): This APU supplies on ground together with the aeroengines or separate cabin and cockpit by a complex system with air (lower figure, example 19.2-6). The configuration of the air intake of the APU obviously promotes the suction of contaminations like deicing fluid on the fuselage (example 19.2-4).

APUs from experience suck most different contaminants:

• Smoke from external components like wheels(example19.2-5).
  
• Cleanind fluids/washing fluids,
• own exhaust gases (recirculation).

The APU itself, depending of the type, can be causative engaged in air contaminations. An example are carbon seals which are sensitive to for wear (example 19.2-6).

Figure "Dangerous overfill" (Lit. 19.2-12, example 19.2-3): During the following investigation of this incident alarming findings were made:

A check of the oil charges showed in the left aeroengine 17 litres, in the right one 20 litres. Respectively the oil level in the glass sight gauge of the right engine was near the „full” point. From experience with „oil smell“ in the cockpit air and the cabin air of the concerned airplane type, as a precaution the operator filled the oil level only to max. 1 litre under the „full point”. Correspondent the engineers of the operator considered the 20 litres in the right engine as too high. So they dumped 2 litres of oil.

An inspection of the „maitenance history“ of the airplane revealed, that already months before there were oil smell incidents. Thereby the APU could ruled out as origin.

The oil system of the concerned aeroengines has a 20 litre tank which is mounted at the right side on the fancasing. At this location also a maintenance door is arranged. This allows to control the oil level in the glass sight gauge (sketch above left). Oil can be filled up by means of a quick opening device.

Additional the cockpit is fitted with an electronic oil level gauge up to a value of max. 20 litres. However the tank can hold more oil. An overfilling is not indicated by the cockpit instrument. The feed pump in the sump of the tank has a carbon seal. However as tests showed, it is possible that oil during several hours dead time exits from the carbon seal into the oil system. Together with a decline of the oil volume during cooling, the oil level drops in the level gauge about one litre. Therefore the oil level must be controlled in a space of time between 10 minutes and 1 hour after the shut down of the aeroengine. Is this work later carried out there is the danger of overfilling.

In the case on hand, the maintenance task for the oil level was executed as following:
With opened engine cowl the oil level of both aeroengines was determined in the level gauge/sight glass as 19 litres. The technician remembered an information by a newsletter of the technical department. Thereafter exists the danger of oil smell if the oil filling is not at least 1 litre under the mark of the level display. The maintenance manual was accordingly completed and the sticker with hints was attached at the at the maintenance doors. The technician dumped 1 litre oil. Now the oil levels of the left/right aeroengine showed on the cockpit diaplay 18/19 litre and 19/19 liter on the sight glas. Subsequent the task in the documents was postmarked, without mentioning the dumping of the oil.

The technician was not authorised by the operator of the airplane type for the oil monitoring and therefore could not sign the maintenance process. It was supposed, that this will be later executed by the the authorised engineer (licensed aircraft engineer = LAE). However this was prevented by communication problems, because the technician and the LAE normally did not work in the same team. The LAE saw the oil dumping process from far and guessed, that the task is correct executed. At a request the technician indicated that he did not turn to the maintenance manual. He didn't regard this as necessary, if he followed the already mentioned information sheet (newsletter). A personally inspection did not take place. Everybody supposed, the other will make the notation about the dumping of the oil.

So the problem arose, because of an unsufficient documentation the right corrected oil level at a later point in time of the maintenance was unnoticed again filled up to a cockpit display of 20 litre. With this too much oil was in the system.

Remedies by the operator:

• Coloured markings on the oil tank to rule out that the allowed oil level in the oil tank is exceeded.
• The max. oil level was set at 2 litres under the „full”-display in the sight glass.

Figure "Damage during transport and storage": During transport and storage in the frame of the maintenance parts, components and aeroengines can be damaged in different ways (volume 4, Ill. 18-10).

Vibrations, shocks: Especially anti friction bearings can suffer by plastic deformation (brinelling) and/or fretting (false brinelling) damages on the contacts of the rolling elements at the races (Fig. "Causes of brielling on bearings"). The higher the rotation speed of the aeroengine (especially small ones), the faster such damages can lead to a catastrophic engine failure (chapter 23.1). Not only shocks from the rail or by shunting during rail transportation or vibrations during transport by trucks can be dangerous. Also apparently harmless vibrations of the floor from a storage hall/assembly hall on wich an aeroengine stands non-suspended, or the transport with a forklift over the gaps of a runway can already be destructive for sensitive assemblies.

A suitable springy damped support of the module of an aeroengine should bring remedy. Is no suitable transport container (Lit. 19.2-24) available, the possibility of transport fastening the rotor by wedges must be considered.

Corrosion develops by air exchange with condensate formation, especially in sea atmosphere or in saliferous fine dust near salt deserts. Particularly anti friction bearings from which during a long standstill the protecting oilfilm dripped off are concerned.

Remedies are

• Conservation (conservation oil)
• Humidity absorption (e.g., `Sikagel')
• Filling gas tight containers with nitrogen.
• Dehumidification by ventilation (volume1, Ill. 5.4.1.2-11)
  

Fig. "Contaminated Hydraulic fluid" (Lit. 19.2-23): In this failure perhaps hydraulic fluid escaped during maintenance. This wetted the thermal insulation of hydraulic lines and infiltrated them respectively was sucked in. During operation this hydraulic fluid obviously came in contact with the nearby bleed air ring channel (sketch middle left). This consists from high strength titanium alloy sheet whose cross section was considerably removed, embrittled and ripped.

An investigation of the OEM showed: The ring channel (duct) failed by hydrogen embrittlement during the contact with the hydraulic fluid under operating temperatures. Additionaly the wall thickness was markedly etched away and so weakened. So the operating pressure could bulge the wall of the channel and trigger the fracture.

The producer of the hydraulic fluid indicates, that in spite of the innocuousness at normal operation conditions of the hydrauluic system the contact with titanium at temperatures above 160°C must be avoided. In such a case the danger of a hydrogen embrittlement by phosphor ester exists.

The manufacturer of the fuselage determined, that the hydraulic fluid acts highly etching when heated. Even slowly dripping phosphate ester fluid can at temperatures of 176 - 232 °C within days up to weeks eat through a insulation made of ceramic fibres or titanium sheet.

Figure "Plastics are sensitive towards fuel" (Lit. 19.2-16): Filled silicone rubber is used in the colder compressor region as rub in coating for blade tips and labyrinths (sketch in the middle). This material respectively its adherence at the bearing surface can be damaged by media in the area of aeroengines (lower figure), especially lubrication oil of aeroengines or fuel. As well swelling as also shrinking produce internal stresses with separation and/or crack formation in the coating. The in the lower figure sketched change of the volume gives an impression of the occurring dimensional changes and with this of the developing stresses in the coating.

Figure "Forgotten cleaning rag" (Lit. 19.2-32): Not only danger exists if cleaning rags get into an aeroengine (volume 1, Ill. 5.2.1.3-2). As the illustrated incident shows, also outside the aeroengine forgotten cleaning rags can trigger nasty situations.

The airplane underwent in the shop of the operator about 9 operation hours before a heavy maintenance. It was delivered without an inspection of the APU-space. Because especial situations are outlined by the OEM in a separate chapter of the airplane maintenance manual it contains for such a case no separate inspection notes. However the existing instructions were not fully executed by the technicians at the airport after the fire warning.

From the operator all licensed aircraft maintenance engineers (LAME) were advised about the importance of an exact visual inspection of the area for which a fire warning took place.

Note:
Not until the cause of an incident is clarified, safety relevant decisions can follow. To this belongs the air traffic with a shut down unit like the APU, even if this is in special cases allowed (e.g., correspondent with a minimum equipment list, MEL).