Safety and costs of an airplane are significant affected by maintenance and overhaul of its engines. In Flight Shut Downs (IFSD) of the engines can seve as an indication for the safety (Ill. 19.2-1.1). Correspondent Ill. 19.2-1.1 about 30 % of all IFSD are associated causal with the maintenance. Above this, overhaul processes are an essential cost factor where the actual work lies considerably under the expense of the material and support.
In the sub-chapters (chapter 19.2.1 to chapter 19.2.4) important issues to special components/parts are seperately discussed.
Astonishingly appears even seemingly easy routine-maintenance work in connection with dangerous safety problems. The experience shows, that the danger of a simultaneously breakdown of more engines from one airplane (Lit. 19.2-2 up to Lit. 19.2-5) not seldom is connected with a faulty maintenance process (Ill. 19.2-3.1, Ill. 19.2-3.2 and Ill. 19.2-4). The particular danger obviously exists in that, the same maintenance personnel makes at the same time the same failure. A typical example is the frequent routine removal and fitting of magnet plugs for the chip control in the oil circuit (Ill. 19.2-2.2). For this reason especial procedures were issued (Ill. 19.2-4.2).
How an insufficient consideration of „Human Factors“, especially an unsufficient reviewd design, promotes maintenance failures shows the example in Ill. 19.2-5. Also the selection of materials, which are sensitive for usual engine media like oil and fuel, is a genuine error of the designer. To this belong problematic plastics (Ill. 19.2-16) which wettability during maintenance work must always be reckoned with.
Auxilary materials, oil and grease for lubrication purposes can trigger dangerous situations when unsuitable handled (Ill. 19.2-6) and/or when mixed (Ill. 19.2-6). An important influence has thereby the marking and storage of the auxilary materials. This leads for example for the injection fluid in the compressor of an aeroengine to a short term thrust maximisation and to the failure of both engines and so to a flight accident (Ill. 19.2-8).
Less the endangering of the flight safety than the extremely annoying attendant circumstances for the crew and ther flight passengers is linked with odour nuisances (Ill. 19.2-9). Those can have different causes which are often only difficult to identify (Ill. 19.2-10). Relatively frequent such incidents are connected with the entry of oil into the supply system of the cabin air. Such a condition for example can occur on an airliner type, when within the maintenance work the oiltank of the engine was overfilled (Ill. 19.2-11 and Ill. 19.2-13).
Like in Ill. 9.2-1 can be seen, played at ISD's problems respectively malfunctions up to the failure of sensors/probes and their transmission lines/cabeling a main role. To this issue the chapter 19.2.1 is dedicated. It could be forseen, that this theme gets even more impotance with the trend to „Health Monitoring” and „Lifing“ (chapter 25.1). It can be imagined, that it is obviously planed to monitor the engines of future fighter aircrafts by more than 300 sensors.
The foreign object problem (FOD; volume 1, chapter 5.2) also an own chapter is dedicated. The importance shows the „bath tub curve” (volume 1, Ill. 18.104.22.168-5). It is also true just for the overhaul of aeroengines. The curve got its form, not at least from incidences like forgotten equipment (e.g., pocket lamps, cleaning rags), tools (e.g., screw wrench) and fastening elements (e.g., Bolts and nuts). In the furthest meaning there is also to mention aspirated/ingested foreigen material from the surrounding of the maintenance area (dust) or the certification test rig (recirculation). Extra measures like fire extinguishing can also prove as very cost driving if an aggressive contamination, especially at the hot parts takes place.
To minimise the deterioration (efficiency drop) of the compressor as a result of operational deposits (fouling) with its consequences for the fuel consumption and the overhaul costs, the `washing' respectively cleaning of the compressor is carried ot during maintenance. This is definitely not unproblematic. A special chapter 19.2.3 is dedicated to this theme.
To avoid maintenance faults/errors, it is necessary to learn from incidents. Requirement is the identification of the (main) causes. For this purpose such cases must be systematic investigated (e.g., according to MEDA) and analysed. Because this approach definitely takes place in the maintenance organisation and requires its input, the coprehension and acceptance of thie procedure is especially important. So this task was dedicated to chapter 19.2.5.
Ill. 19.2-0 : The experience shows, that dangerous situations can develop, when symptoms respectively unusual observations are not sufficient clarified. With this the danger increases , that the real cause is not identified and at a later time has catastrophic consequences. A typical example are chips in the lubrication oil, which location of formation was indeed identified (e.g., bearing) and also a repair takes place. However, if the question for the main cause of the bearing failure is not asked and answered, can e.g., furthermore occurring causal vibrations from unbalances lead to considerably damages like the fracture of a shaft. For this reason the claryfying of the real failure cause has priority.
Repair costs and logistics
Effort respectively costs for repair have a high significance and become more important. The increase of material costs and with this the costs of raw parts requires more and more the adoption of repaired parts/components instead of new ones. So, for example, a new compressor exit casing of a fighter engine has the equivalent value of a middle class automobile. The costs are already noticeably influenced in the concept phase. For example it is of high importance, if a module concept exists. Rising fuel costs require a minimal deterioration (efficiency drop; volume 2 , Ill. 7.0-2). This necissitates for example an early repair of clearance seals (rub in coatings, labyrinth tips). The design respectively dimensioning of the parts/components co-decides about possible repairs. A high load level can complicate or prevent repairs at all (Ill. 21.3.4-6). For this several reasons are possible:
A high load level can limit the acceptable fault size so much, that a series suited non destructive testing (NDT) can not guarantee the required safety.
It is also possible, that the materialsm necessary for the high stess level (e.g., powder metallurgical Ni-alloys) suffer too heavy drop in strength during repair. An example is the heat (hot) cracking in repair welds of labyrinth tips (Ill. 21.2.1-3 and Ill. 21.3.4-5).
For the optimising/minimisation of the operation costs systematic analysis and approaches were developed. To those belong the so called `maintainability, availability planing program' (RAM, Ill. 19.2-1.2). It refers to the whole product cycle from the conceptual design up to the planed lifetime end, that means for the whole life cycle. Thereby technical terms respectively abbrevatiions are used which are explained in Ill. 19.2-1.3.
The repair of parts/components and modules as well as the maintenance of the aeroengine influence one another with the logistic. To handle those complex correlations systematics like the „Integrated Logistic Support“ (= ILS; Lit.2-29 up to Lit.19.2-31, Ill. 19.2.1-1.4) are used.
Illustration 19.2-1.1 (Lit. 19.2-1): Those diagrams are valid for two of the most frequent fan-aeroengines for airliners about the year 2000.
The information of the left diagram is astonishing for an outsider. 30% of the safety relevant problems which lead on aeroengines to an „in flight shut down” (IFSD) are obviously causative connected with the maintenance (volume1, Ill. 2-7).
The by far dominating percentage (50 %) is connected with sensors and the cabling/wiring (chapter 19.2.1). Here also connections with the maintenance may suspected. This is for example obvious for contaminated or corroded connectors.
The trend towards intensified monitoring of the aeroengines with sensors, for example to best possible utilise the lifetime of the components (lifing, health monitoring, chapter 25.1), let suppose, that this problems will get even more important. An already since years ovserved example are the fire monitoring systems in the aeroengine nacelles (volume 2, Ill. 9.5-2). Its connectors (Ill. 19.2.1-1, chapter 25) and cables obviously are especially affected by vibrations, corrosion and contamination.
The diagram at the right is applied to a small fleet (13 airliners) with its reserve engines (8). It is interesting, that the costs of the real maintenance work compared with the hardware and the support is relatively moderate (service and logistic, Ill. 19.2-1.3).
This example also seems to show, that the costs refered to the hardware and the use of the module concept can be markedly reduced. That is the case, if not every reserve engine is equipped with a fan, but considerably less fan-modules are stockpiled. With this „rexting capital“ is minimised. But the additional expenses and a certain potential risk for the exchange of the fan-modules are not clear (Ill. 19.1.4-6.1, Ill. 20.1-25).
Illustration 19.2-1.2 (Lit. 19.2-25 up to Lit. 19.2-28): The effort to keep a product in operation is minimised with so called „reliability, maintainability, availability- programs” (RMA) of the (US) Department of Energy (DOE). It concerns an analysis that schould make life cycle costs during the operation , overhaul, maintenance and repair, expecially by including the development process more controllable.
This process (a guidance gives Ill. 19.2-1.4.1 /-1.4.2) uses the whole development process of a part/component respectively a machine. This includes the planning as far as overhaul (life cycle model, lower frame) and from, this subsequent optimisations (lessons learned).
The RMA-process succeedes as follows:
In the forground stands
Design and production are considered in a RMA-program with the clarificatiion of the following determining factors:
A RMA must also contain a risk management. For this it is needed:
Illustration 19.2-1.3 (Lit. 19.2-26): Into the analysis of the effort for operation and logistics for an aeroengine flow parameters with special names and acronyms. These are here assembled. If explanations in detail are needed special literature can be used.
Illustrations 19.2-1.4.1 and 19.2-1.4.2 (Lit. 19.2-29 up to Lit. 19.2-31): The „integrated logistic support“ (=ILS) is a management process, which consists of a systematic with 10 separate steps (ILS-elements). It was originally developed and used in the military area and becomes now also accepted for civil applications to plan the support of the products over the whole life time cycle.
All ILS-elementes must be developed by a responsible position („system engineering”) in a coordinated process in each other dependency. Thereby compromises can be necessary to make lowest life cycle costs (Ill. 19.2-1.2) possible at tolerable features like:
The plannig follows an ILS-plan (ILSP) under consideration of the purchase strategie. The list of the picture gives an overview of the tasks which have to be executed respectively must be clarified. By the way, in the concrete application will be refered to the available literature for the training. This is offered in a multitude of application oriented specialist books, e.g., in the internet.
Illustration 19.2-2.1 (Lit. 19.2-3): This chart givs a general overview (no claim for completeness) about influences („human factors“ see chapter 19.1), which from experience are in causal connection with maintenance errors/faults. In the specified literature they are assigned to the example 19.2-1 (Ill. 19.2-2.3 and Ill. 19.2-3.2). As contributing influences they lead in the addressed case thereto, that in all four engines of an airliner the O-ring seals of the magnet plugs were forgotten. Thereby it came to the shut down ot the aeroengines and an emergency landing. As can be seen, the causal coaction of a multitude very different factors is concerned, which lead to an extreme dangerous situation:
Illustration 19.2-2.2 (example 19.2-1, Lit. 19.2-3 and example 19.2-2 ): Personnel problems in on site maintenance can evoke dangerous situations. Just then the required experience with maintenance work must be considered by the responsible organisation. The illustrated case was possible by a chain of wrong decisions. The picture shows the correct, scheduled, complete organisation of a shift with 12 (workers). This consists of 1 leading `general foreman', 2 experienced `senior supervisors', 3 supervisors and 6 technicians. Unfortunately the night shift was because of personnel shortage reduced to 9 workers. This lead to critical situations. The whole process is described in the following and poits instructive at the weak points.
The leading supervisor (general foreman „B”) gave the instruction to one of the supervisors (leading hand „C“) to take oil samples for oil analysis (SOAP, chapter 22.3.4) and to change the magnet plugs for chip control at all four aeroengines.
The supervisor (leading hand „C”) was not trained for this specific aeroengine maintenance, however he was authorised for it. He did not find the new magnet plug sets for the assembly.
Normally those are supplied by the aeroengine night shift („F“). But this was cancelled due to personnel shortage without transfering the task alternatively to the day shift.
The supervisor went after an agreement with „B” to the support, found the magnet plugs which he considered ready for assembly („D“). However the concerned parts where untested without sealing rings (O-rings, sketch down right). He arranged them to exchange sets by himself („E”).
There was no technician („F“) for the maintenance work when he returned. The supervisor decided to execute the work by himself („G”), however without consulting the manual.
In the manual the fitting of new sealing rings (O-rings) and a test run with especial attention for leaks was demanded. This didn't happen („H“). It could be seen, that such oil leaks can be only sufficiens sure identified by a test run with sufficient high engine performance with appropriate high oil pressure (Ill. 19.2-2.3).
The field map/operating sheet had to be signed by the techmnician who had executed the work step and the supervisor in charg. The supervisor requested a technician to sign the work as his own and than signed himself as supervisor („I”).
Before the flight the ground crew did not see leaking oil and the aeroengines behaved normal during run up and the rolling of the aircraft to the runway.
Then, after the start in flight the oil leaks at the magnet plugs occurred (see the description in the example 19.1-1 and Ill. 19.2-2.3).
Illustration 19.2-2.3 (Example 19.2-1, Ref. 19.2-3 to Ref. 19.2-5): The four engined airplane of a military operator was forced at the beginning of the flight to shut down one engine. Later, after indications of a heavy oil loss during an emergency landing further engines shut dowm.
Cause of the oil loss was a maintenance fault. The magnetic chip detector plugs (= MCPD) were assembled without „O“ rings on all four aeroengines.
The magnet plugs must be periodical disassembled and again assembled (all 50 start/stop cycles) for chip control.
During the start of the engines and during rolling to the runway the ground crew noticed no sign of an oil leak. The explanation for this is, that thereby not the maximum engine load/performance was reached. So the oil pressure was too low for a markedly oil leak. Not until the start of the airplane and the climb the oil pressure was high enough that the catastrophic oil loss occurred (lower sketches).
Example 19.2-1 (Lit. 19.2-3, Ill. 19.2-3.1 and Ill. 19.2-3.2):
15 minutes after the start of the aircraft the crew noticed during climb at about 1700 meters, that the oil charge detector of aeroengine 2, 3 and 4 pointed at `empty'. The oil volume in engine 1 was indicated as 1/4. The crew returned to the exit airport. Thereby the oil pressure warning light of engine 3 flashed and was switched off. After this the emergency was declared and an alternate airport approached to land. Now also the oil warning lights of engine 2 and 4 began to indicate. Therefore the performance/load of these engines was withdrawn to idle during approach for landing. Engine 1 was now operated with full load for compensation. Then in safe landing position engine 2 was shut down, engine 4 followed during rolling. So on ground only engine 1 was fuctioning.
The engine cowls were covered with oil. During opening of the engine nascelles oil burst out to the ground.
The disassembly of the magnet plugs showed, that they had no O-ring as oil seals.
Illustration 19.2-3.1 (example 19.2-2, Lit. 19.2-7 and Lit. 19.2-16): This incident is in many aspects similar to this one described in the Ill. 19.2-2.1 up to Ill. 19.2-2.3. To those influences which promoted the lack of the magnet plug seals also belong deficits in information and training of the technicians (Ill. 19.2-3.2). Beyond this the question arises, if an analogy in the work situation between both cases is accidental:
Noticeable is the unsufficient sensitising for this problem. Already in the previous 2 years 12 serious cases emerged in connection with the installation of magnet plugs.
Example 19.2-2 (Ill. 19.2-3.1 up to Ill. 19.2-3.2): Before the flight of the three engined airliner the flight engineer performed the usual inspection tour round the aircraft („walk around”). Thereby he did not notice indications of an oil leak in the area of the aeroengines. Also during run up of the engines and the rolling to the start the instruments showed no anomalies. Also not during the start and cruise over sea like pressure oszillations at the instrument displays were noticed. Buring descent to the landing the flight engineer reported the flashing of the warning lamp for low oil pressure of engine 2 (backward). The oil pressure fluctuated considerably underneath the minimum value. Thereon the pilot determined the shut down of the engine. Because the weather at the destination airport was bad, the pilot decided to return to the departure airport. During the following climb the oil warning lamp of engine 3 flashed and shortly after that that from engine 1. At this point in time all instruments which measure the oil level indicated that no more oil was present. From this the wrong conclusion was drawn by the crew, that this perhaps will be an instrument failure. About 5 minutes later the engine 3 failed. Now the crew knew, that the displays are dependable and a severe problem exists. The attempt to restart engine 2 failed. After further 4 minutes engine 1 failed. The functioning APU supplied still the on-board systems. So it was possible to control the aircraft in spite of the failure of all aeroengines. Already preparing oneself to a splashdown the necessary schedulings were made. The pilot tried once more to start all e engines one after another - unsuccessfuly. At least the third start attempt of engine 2 succeeded. There the pilot decided to land at the near exit airport and succeeded. The engines 1 and 3 smoked and were extinguished by the particular extinguishing system of the engine nascelle.
A following investigation showed as cause of the oil loss and the extreme overheating damages in the area of the engines main bearings that during maintenance O-ring seals of the magnet plugs have been forgotten.
Dangers of a simultaneous maintenance of several aeroengines from the same aircraft (multi-engine maintenance).
The practice to execute simultaneously at several aeroengines of one aircraft the same maintenance process increases the possibility for engine problems. Such a case seems at the first glance extremely unlikely but definitely occures, shows the literature about failures with highly dangerous consequences (example 19.2-1 und 19.2-2). Those reach from the in flight shut down of a single engine up to the thrust loss of all engines with accordant safety risks. Cases which emerged (Ill. 19.2-2 and Ill. 19.2-3) can be mostly traced back to leakages of the oil system caused by an insufficient seal. But also a case emerged where a wrong position of the power lever prevented to reach the take off power of the aeroengines. Such cases can be avoided by training the personnel of operator and maintenance. Important is the understanding of the problem with its causes (Ill. 19.2-4.1).
Not only the simultaneity of a special maintenance process must be avoided. The risk increases, when the task is executed by the same person. Too high is the possibility that a certain wrong procedure recurs. In unavoidable cases of a multi-engine maintenance it is at least recommended that such maintenance process are performed on the engines of one aircraft by different persons. The safety can be increased by safeguarding checks and test flights.
Illustrations 19.2-4.1 and 19.2-4.2 (Lit 19.2-2): Explanations of the strategies to minimise the frequency of failures at simultaneous maintenance of aeroengines:
A planned, timely staggered maintenance should avoid, that maintenance processes on the aeroengines are performed by the same personnel at the same time.
If a simultaneous maintenance of the aeroengines can not be avoided, the exchange of the maintenance personnel should be planned. That can be the case after a damage on several aeroengines by impact of a flock of birds. In such a case the aeroengines should be maintained by different teams. So also a different mental crowd/group behaviour can be utilised.
A simultaneous maintenance with a suitable sequence shows Ill. 19.2-4.2. Are those attended, the failure risk can drop.
From mthe process planing, supervision and the technicians due to hands-on experience and detail knowledge helpful recommendations can be expected.
Education/training and instruction should point at particular, possibly not evident risks of certain components and systems. For example poiting at the significance of the oil respectively the oil system and its components like filters, magnet plugs,drain bolts, filler caps and pumps (Ill. 23.2.1-18). Oil loss can always be a safety problem. To this belong oil bearing components like gears. A special attention should be devoted to the diverse seals (chapter 23.4).
The use of „supporting documents“ like special manuals for simultaneous maintenance. With the application of pictures from areas were already problems which have occurred are described and the risk is comprehensible illustrated.
Helpful are small information sheets for pocketing with hints at critical areas and suitable approaches.
Stickers as „leaflets” can remember at the increased risk of the simultaneous maintenance. Tips of the aeroengine OEM in form of „service letters“.
Additions or attachments to the work/operation sheets.
There can be posters purchased from authorities like FAA, which deal with the prevention of maintenance problems.
Illustration 19.2-5 (Lit. 19.2-9): The day before the here described incident the maintenance personnel saw fuel dropping from the drainage pipe of an aeroengine. The fuel came from the area of the fuel/oil heatexchanger. Thereon the problem should be eliminated by two approved technicians with the substitution of the heat mexchanger. This process was executed as follows:
Loosening of the flange of the feeding fuel pipeline (sketch). Thereby fuel sprayed out of the pipe line. From this it was concluded, that the heatexchanger obviously is not the reason for the leak. Now the pipeline should be connected again. After the seal rings were supported for replacement and the installation the three nuts of the flange connection were tightened. By this the for the safety of the connection important retaining flange (retainer) was ignored.
The technicians with this task consigned were not familiar with this type of coupling. For the loosening and again the fastening of the pipeline the technicians however did not inform themselves in the handbook of the aircraft OEM for elimination of failures. Also the maintenance manualas not reviewed. A notice about the procedure in the maintenance documents was not carried out. The leak tightness of the connection was carried out from an elevated position according to the instructions. The further search for failures showed however the heat exchanger as cause of the leak. Thereon this was exchanged by the two technicians. The leak tightness check was carried out 6 minutes during running idle of the aeroengine. This time the tightness check was carried out on ground. This is admissible for the heat exchanger. However the check of the pipeline connection must be carried out like before from an elavated platform. For this a special developer fluid must be sprayed at the mounted connection. This facilitates an identification of the leak. Those prescribed steps were not carried out. After the test run the documentation was completed.
The next day during start of the airplane a fuel leak in form of a noticeable spray plume was identified. The pilots got an information by radio. Afterward the aircraft landed again. Later arose that already about 3700 kg fuel had escaped.
The following investigation showed:
The fuel pipeline to the heatexchanger came loose although the flange coupling with its three boltings seemed to be okay. However it appeared that the retainer (flange, see sketch) lacked. This had been slipped unnoticed during the assembling along the pipe line and so was ignored. However the connection with the three nuts could be tightened keeping the tolerances (fastening torques, measures). In this case The sealrings perform during a test run at idle a sufficient seal effect. But at start thrust the connection fails. At this engine performance the pressure doubles and the flow rate in the feed line rises almost 15-fold.
Besides the described defiencies in the maintenance process „human factors” seem to play an important role in this case (Ill. 19.1.4-2 and Ill. 19.1.4-3.1):
Illustration 19.2-6: From experience interchangings have a high risk potential. That has especial reasons:
An interchanging risk exists at nearly every technical field, so also during maintenance. Not always it is about an unconsciously process. Also cases are known when switched to a product with supposed respectively apparently advantages (e.g., costs, operation behaviour, maintainability, availability). In such a case the designation interchanging is „limping“. This is especially true for auxiliary material like lubrications (e.g., grease) ond cleaning agents (above left).
An especially interchanging risk is the external similarity (optical,smell, feeling/consistency). Classical is the interchange of MoS2 containing lubrications with such, containing graphite, as well a typical black paste (Ill. 22.4.1-1). At hot parts MoS2 can trigger dangerous corrosion (sulfidation), under tensile load with a fast crack initiation and propagation (sketch above left).
Basically is the packing of essential importance for a certain identification of the content. An arbitrary alternation, for example by decanting into a not original packing includes already the danger of a confusion. Such changes can also be the result from damages of packings.
A clearly documented storage with doubtless assignment and identification of products and suitable labeling is absolutely necessary. Especial attention must be pointed at, that labels were not damaged or modified without documentation. To this belong also the interchange of labels (sketch above right) respectively the use of canisters/cans which normally let expect an other content.
Also „suspected unapproved parts” (SUP, „bogus parts“, chapter 20.2.1) can be counted to this problematic. Here the interchange may be strategy (down left).
Unsuitable canisters/cans,especially with provisorily or not clear labeling have lead to aircraft accidents (sketch down right, Ill. 19.2-8).
Illustration 19.2-7 (Lit. 19.2-10): A later investigation of the, in this incident concerned auxiliary power turbine (APU) showed, that the fuel-draining line (sketch down right) was blocked by several particles of an elastomer. It was an at room temperature hardening material that is used during the assembly of the APU as sealant between the flanges. The operator confirmed this approach. The overhaul manual of the APU OEM advises the operator especially at a spare use of the sealant. So every excessive sealant must be removed before the mounting of the guiding tube to avoid the blocking of the drainage connections. Does a blockage occur according to the hand book it is to reckon with torching flames.
Cause of the overheating of the fuselage end in the region of the APU, was a clogged drainage line at the combustion chamber. During an unfavourable start sequence, the remaining fuel was nebulised and blown out of the exhaust pipe. Tailwind blew the fuel during standing airplane to the front and wetted the back of the fuselage. This fuel was ignited by the hot exhaust gases during the start of the APU.
Illustration 19.2-8 (Lit. 19.2-12, see also volume 1, Ill. 5.5-4): At the beginning of the 70s a spectacular momentous aircraft accident was triggered by a maintenance failure.
To increase the start performance of the aeroengines into the concerned engine type distilled water is injected behind the compressor (sketch below). For this purpose unlabeled canisters were taken from a storage room, which obviously contained water. However in the canisters was actually not clear water. But instead they were filled with water, contaminated with kerosene. This originated from a former exceptionally action. The canisters were brought with the airplane to the next airport of destination. There the aircraft needs for the start thrust the water injection. Therefore the canisters were here now filled into the injection water tamk of the airplane. During decanting a technician noticed the smell of fuel. The therefore addressed pilot however guessed…“here everxthing smells of fuel”. So a last chance to avoid the accident was lost.
The lighter cerosene gathered in the injection water tamk above the water. During extraction while injecting first at the beginning water was sucked from the aspirating port near the bottom of the tank (middle sketch). Then the concentrated cerosene followed. Instead of a cooling effectnow fuel was
injected without control and so the hot parts of both aeroengines extremely overheated. This lead to the melting of the turbine blading. Without any thrust from the engines the pilot tried an emergency landing on the near highway with catastrophic consequences (sketch of this sequence left).
Odor nuisance and danger of poisoning by maintenance caused gases and vapours.
Flowing gases and vapours are, dependent from aircraft and aeroengine type, relatively frequent and recurring. This deals normally with suctioned media of the surrounding (Ill. 19.2-9.1). Primarily there are lubrication oils for aeroengines or APUs if they are integrated in the system of the air conditioning system. Also auxilary materials like anti icing fluid (volume1 example 5.5-3.2) or wash- and cleaning agents can remain in the compressor (Ill. 19.2.3-1). Hydraulic fluid from a leak (Ill. 19.2-15) or contamination from the assembly can be also sucked. Is a water-methanol injected at hot days into the compressor to increase the performance and for cooling (volume 1 Ill. 5.5-4) also a contamination of the bleed air can not be not ruled out. Fire extinguishant can for example arrive during overheating of the nose gear into the aeroengine ( volume 1 Ill. 5.5-2).
As well the cockpit as the passenger cabin can be cocerned single or both. As long as we deal only with a rather annoying but harmless event it is a commercialand/or prestige problem of the operator. But if the crew hindered in the execution of its tasks and/or arise short-term or long-term health problems at the crew and/or passengers we must act on the assumption of a serious safety problem. The danger of vapour from engine oil exists because it contains till now as oil additive tricresylphosphate ( TCP, Ill. 19.2-10). This poisenous, obviously not rare contamination of the breathing air seams not until now to have the duly devoted attention.
In the predominant number of all incidents we seem to deal with oil vapour or oil smoke from the APU or the aereoengines. This contaminations are preferably inserted from the bleed air for the ventilation (Ill. 19.2-10). Oil predominantly gets into the bleed air of the compressor from leaking seals. This leakages must not necassarily be traced back to a defective seal. Short-term major quantities of leak oil can escape from the main bearing chambers, dependant from the seal type, during a compressor surge. During the surge occur heavy oscillations of the gas pressures and so axial thrust loads at the rotor (volume 3, Ill. 22.214.171.124-1). This causes a rotor shift with an increase of the seal gaps in the labyrinths. Also the contact pressure springs of the slip ring seals (Ill. 126.96.36.199-1) can yield too much. Overfilled oil systems respectively oil tanks (Ill. 19.2-13) can press oil during standstill or in operation through the seals (e.g., labyrinths or slip ring seals, Lit. 19.2-7). We know from experience that the overfilling of the oil tank can happen during the routinely maintenance. This is promoted by shortcomings of the system (readout) and obscure or difficult understandable specifications/ instructions.
Ill. 19.2-9.1 ( Lit. 19.2-33 and Lit. 19.2-34): Typical contaminations which can get through the compressor into the bleed air for the cabin cabin air. This schematic sketch gives no hint at a concerned aeroengine type. Some contaminations are engine type specific. That is for example true for the sensibility for contaminations by leak oil and oil vapour from the main bearing chambers.This is because of the toxic effect especially alarming (Ill. 19.2-10). An injection of water-methanol to increase the start power also is limited at distinct types.
Also the remained washing fluid of a cleaning process (chapter 19.2.3) has already airplanes forced to return and land after the start (Lit. 19.2-35).
after the start
Illustration 19.2-9.2 ( Lit. 19.2-12, Lit. 19.2-13, Lit. 19.2-14, Lit. 19.2-15, and Lit. 19.2-18):
In the indicated literature we can find systematic analysis, especially in connection with certain types of airliners. That militates in favour of specific design features of aeroengine caused smell nuisance (Ill. 19.2-10 and Ill. 19.2-12). This deals for example with design details of the front main bearing chamber (seals, pressure differences). For an APU is the position and configuration of the intake at the fuselage is important (Ill. 19.2-12 and example 19.2-4). Smell nuisances are promoted, if oil can enter from the rotor into the high pressure compressor and from there into the bleed air (Ill. 19.2-12). But the literature also shows, that human factors can play an impportant role (Ill. 19.2-13). To this counts the maintainability in connection with the re-filling of oil and the control of the oil level (Ill. 19.2-12). The diagrams are based on the analysis if incidents at two airplane types.
the subjective cognition of the smell characteristic can be seen from the both upper diagrams. Obviously there is a diversity of typical smells which differ significant. The differences in the cognition point at different causes (diagrams below). It is interresting, that smoke in by far the most cases occurred in connection with an oily smell. This argues for lubrication oil contaminations of the air (arrowheads). In this cases a connection with the oilsystem of the aeroengine or the APU seems likely.
A high percentage (30 - 40%) of all incidents can not be related a distinct cause. This makes remedies difficult and longsome.
Illustration 19.2-10 (Lit.19.2-8, Lit. 19.2-12 and 19.2-17): Studies showed that contaminations of the cockpit air and cabin air can have toxic influences. These can be individual very different (example 19.2-4).
It is especial safety critical that both pilots are concerned. The situation tightened by the behaviour of the pilots, if they in spite of indisposition and other symptos continue their service.
The following conclusions can be drawn:
The potential danger of cabin air and cockpit air contaminations is considered in the standard for airplane ventilation (FAR/JAR 25.831).
Illustration 19.2-11 (Lit 19.2-12): The precondition for specific measures/remedies is also here the knowledge of the causes. 30-40% of not identified causes (Ill. 19.2-9) show, that those are obviously not easy to determine.
From the character of the smell (Ill. 19.2-9) and the visual appearance (smoke, mist) can be concluded at the cause if there is sufficient knowledge about the ventilation system. Naturally at least during oil odour primarily the aeroengine or the APU are a possibility as origin. It must be considered, that also contaminations of the air ventilation duct which occurred before (filter?) can trigger such incidents. Naturally then the cause must be searched in a former event.
Contaminations of the ventilation system can have very different causes (Ill. 19.2-9):
Example 19.2-3 (Lit. 19.2-12, Ill. 19.2-13):
This incident occurred after a maintenance lasting 26 days. Already during start and accelerating of the aeroengines temporary occurred a smell of hot oil in the cockpit. Shortly after the take off the smell returned. This moved the crew to use the oxygen masks and to return to the departure air port where the airplane landed.
An investigation showed, that deficts of the maintenance stay in causal connection with the incident:
We know from experience, that an overfilling of the oil system can partly block the passage slots in the air-oil separator (breather). So the vent system will be overloaded by the large amount of not separated air. This leads to a pressure increase in the concerned bearing chamber. In an extreme case there is not sufficient sealing air at the front main bearing of the low pressure shaft. Oil exits into the low pressure rotor occures (Ill. 19.2-12). From here leak oil respectively vapour and/or mist are centrifuged outside and reach the compressor air flow. Now in the high pressure compressor the oil contaminated air enters with the bleed air into the cabin ventilation. In the present case the cockpit has its own air supply. The air extraction occurs before the mixing for the cabin supply.
Example 19.2-4 (Lit. 19.2-20, Ill. 19.2-12):
During the routeing and rolling of the aircraft the cabin crew and passengers noticed an acidly smell.
A member of the crew sicked. Additional concentration problems occurred, which prohibited the executing of the tasks. This condition lasted about 1 hour. An other crew member had merely a slight feeling of dizziness and palpitations. A third member had only a light giddiness. Some passengers lamented about burnig of the eyes. Others showed no symptoms. After that the airplane did not start.
Normally the air supply is carried out by the APU during start and rolling. Therefore the air supply of the cabin was switched from the APU to the aeroengine. However this brought no improvement.
An inverstigation showed a larger quantity of deicer (anti icing fluid) in the air control system following the APU. The intake of this APU at the concerned airplane type had no protection lid, instead it is permanent open. This configuration is especially unfavourably against a contamination of the APU. So for example the deicer could run along the fuselage and get into the intake.
Example 19.2-5 (Lit. 19.2-19):
The passengers of a twin-jet had already occupied their seats. During the preparations in the cockpit a cloud of smoke and mist (vapour) passed outside the cockpit window. A short term later the personnel determined a heavy smoke annoyance in the cabin. Thereon the passengers were requested from the aircraft captain by the board loud speaker to leave the airplane as fast as possible.
An investigation unfolded, that a metal mesh of a flexible hydraulic line (chapter 23.5.2) has worn through by touching the electric supply cable of a hydraulic pump in the right wheel. As a consequence an electric arc perforated metal mesh and hydraulic line, so hydraulic fluid could exit. The liquid mist was short term ignited by the flash-arc (about 5 seconds). Then the conditions no more given and the ars quenched. Obviously smoke and vapours were suck by the ventilation system of the cabins.
After that the hydraulic line and the hydraulic pump were replaced. A test showed a further leak. The next day a „burned smell“ arose and the airplane was put out of service for a more closely inspection. Some components of the system have been exchanged and the airplane returned to the air traffic.
The chafing of the line was traced back to the lack of knowledge of the technicians about a service letter which deals with the suitable safety device of the line.
Example 19.2-6 (Lit. 19.2-18):
The copilot noticed before the flight heavy smoke in the cabin and the flight deck of the airplane. For the air supply the APU is responible. When the smoke formation aggravated the air supply was shut down.
At this four engined commuter aircraft the air system is in a complex manner supplied, depending from the operation situation, by the aeroengines and/or the APU (Ill. 19.2-12).
The following maintenance found an oil leak at the drive of the generator from the APU. The local carbon seal (chapter 188.8.131.52) was replaced. Up to now, cases of failed carbon seals with a subsequent air contamination occurred frequently. The leakage oil flows into the compressor of the APU which supplies the airplane on ground with air.
After about 10 days once more smoke appeared in the cabin air. This time it was possible to identify after tests one of the four aeroengines as cause. A later inspection of the aeroengine showed oil traces in the high pressure compressor resulting from a worn carbon seal of the main bearing chamber.
Illustration 19.2-12 (Lit. 19.2-18, Lit. 19.2-20, Lit. 19.2-21, Lit. 19.2-22): This APU supplies on ground together with the aeroengines or separate cabin and cockpit by a complex system with air (lower figure, example 19.2-6). The configuration of the air intake of the APU obviously promotes the suction of contaminations like deicing fluid on the fuselage (example 19.2-4).
APUs from experience suck most different contaminants:
The APU itself, depending of the type, can be causative engaged in air contaminations. An example are carbon seals which are sensitive to for wear (example 19.2-6).
Illustration 19.2-13 (Lit. 19.2-12, example 19.2-3): During the following investigation of this incident alarming findings were made:
A check of the oil charges showed in the left aeroengine 17 litres, in the right one 20 litres. Respectively the oil level in the glass sight gauge of the right engine was near the „full” point. From experience with „oil smell“ in the cockpit air and the cabin air of the concerned airplane type, as a precaution the operator filled the oil level only to max. 1 litre under the „full point”. Correspondent the engineers of the operator considered the 20 litres in the right engine as too high. So they dumped 2 litres of oil.
An inspection of the „maitenance history“ of the airplane revealed, that already months before there were oil smell incidents. Thereby the APU could ruled out as origin.
The oil system of the concerned aeroengines has a 20 litre tank which is mounted at the right side on the fancasing. At this location also a maintenance door is arranged. This allows to control the oil level in the glass sight gauge (sketch above left). Oil can be filled up by means of a quick opening device.
Additional the cockpit is fitted with an electronic oil level gauge up to a value of max. 20 litres. However the tank can hold more oil. An overfilling is not indicated by the cockpit instrument. The feed pump in the sump of the tank has a carbon seal. However as tests showed, it is possible that oil during several hours dead time exits from the carbon seal into the oil system. Together with a decline of the oil volume during cooling, the oil level drops in the level gauge about one litre. Therefore the oil level must be controlled in a space of time between 10 minutes and 1 hour after the shut down of the aeroengine. Is this work later carried out there is the danger of overfilling.
In the case on hand, the maintenance task for the oil level was executed as following:
With opened engine cowl the oil level of both aeroengines was determined in the level gauge/sight glass as 19 litres. The technician remembered an information by a newsletter of the technical department. Thereafter exists the danger of oil smell if the oil filling is not at least 1 litre under the mark of the level display. The maintenance manual was accordingly completed and the sticker with hints was attached at the at the maintenance doors. The technician dumped 1 litre oil. Now the oil levels of the left/right aeroengine showed on the cockpit diaplay 18/19 litre and 19/19 liter on the sight glas. Subsequent the task in the documents was postmarked, without mentioning the dumping of the oil.
The technician was not authorised by the operator of the airplane type for the oil monitoring and therefore could not sign the maintenance process. It was supposed, that this will be later executed by the the authorised engineer (licensed aircraft engineer = LAE). However this was prevented by communication problems, because the technician and the LAE normally did not work in the same team. The LAE saw the oil dumping process from far and guessed, that the task is correct executed. At a request the technician indicated that he did not turn to the maintenance manual. He didn't regard this as necessary, if he followed the already mentioned information sheet (newsletter). A personally inspection did not take place. Everybody supposed, the other will make the notation about the dumping of the oil.
So the problem arose, because of an unsufficient documentation the right corrected oil level at a later point in time of the maintenance was unnoticed again filled up to a cockpit display of 20 litre. With this too much oil was in the system.
Remedies by the operator:
Illustration 19.2-14: During transport and storage in the frame of the maintenance parts, components and aeroengines can be damaged in different ways (volume 4, Ill. 18-10).
Vibrations, shocks: Especially anti friction bearings can suffer by plastic deformation (brinelling) and/or fretting (false brinelling) damages on the contacts of the rolling elements at the races (Ill. 23.1.1-13). The higher the rotation speed of the aeroengine (especially small ones), the faster such damages can lead to a catastrophic engine failure (chapter 23.1). Not only shocks from the rail or by shunting during rail transportation or vibrations during transport by trucks can be dangerous. Also apparently harmless vibrations of the floor from a storage hall/assembly hall on wich an aeroengine stands non-suspended, or the transport with a forklift over the gaps of a runway can already be destructive for sensitive assemblies.
A suitable springy damped support of the module of an aeroengine should bring remedy. Is no suitable transport container (Lit. 19.2-24) available, the possibility of transport fastening the rotor by wedges must be considered.
Corrosion develops by air exchange with condensate formation, especially in sea atmosphere or in saliferous fine dust near salt deserts. Particularly anti friction bearings from which during a long standstill the protecting oilfilm dripped off are concerned.
Failures as result of contamination by media which escaped during maintenance.
During the maintenance it can come to the exit of media which can later damage components of the aeroengines. To those belong leaked hydraulic fluid, which decomposes by heating during the engine run. Aggressive compounds which thereby are released can cause dangerous corrosion. For example such decomposition products can attack titanium alloys and trigger hydrogen embrittlement (Ill. 19.2-15).
Lubrication oils and fuels of aeroengines can during standstill react with plastics and damage them. Typical changes are swelling, shrinking, drop of strength and embrittlement (chapter 23.4.1). A further typical example is the change of filled silicone rubber rub in coatings in compressor casings and interstage labyrinths (Ill. 19.2-16).
Ill. 19.2-15 (Lit. 19.2-23): In this failure perhaps hydraulic fluid escaped during maintenance. This wetted the thermal insulation of hydraulic lines and infiltrated them respectively was sucked in. During operation this hydraulic fluid obviously came in contact with the nearby bleed air ring channel (sketch middle left). This consists from high strength titanium alloy sheet whose cross section was considerably removed, embrittled and ripped.
An investigation of the OEM showed: The ring channel (duct) failed by hydrogen embrittlement during the contact with the hydraulic fluid under operating temperatures. Additionaly the wall thickness was markedly etched away and so weakened. So the operating pressure could bulge the wall of the channel and trigger the fracture.
The producer of the hydraulic fluid indicates, that in spite of the innocuousness at normal operation conditions of the hydrauluic system the contact with titanium at temperatures above 160°C must be avoided. In such a case the danger of a hydrogen embrittlement by phosphor ester exists.
The manufacturer of the fuselage determined, that the hydraulic fluid acts highly etching when heated. Even slowly dripping phosphate ester fluid can at temperatures of 176 - 232 °C within days up to weeks eat through a insulation made of ceramic fibres or titanium sheet.
Illustration 19.2-16 (Lit. 19.2-16): Filled silicone rubber is used in the colder compressor region as rub in coating for blade tips and labyrinths (sketch in the middle). This material respectively its adherence at the bearing surface can be damaged by media in the area of aeroengines (lower figure), especially lubrication oil of aeroengines or fuel. As well swelling as also shrinking produce internal stresses with separation and/or crack formation in the coating. The in the lower figure sketched change of the volume gives an impression of the occurring dimensional changes and with this of the developing stresses in the coating.
Problems by left-behind cleaning rags.
Illustration 19.2-17 (Lit. 19.2-32): Not only danger exists if cleaning rags get into an aeroengine (volume 1, Ill. 184.108.40.206-2). As the illustrated incident shows, also outside the aeroengine forgotten cleaning rags can trigger nasty situations.
The airplane underwent in the shop of the operator about 9 operation hours before a heavy maintenance. It was delivered without an inspection of the APU-space. Because especial situations are outlined by the OEM in a separate chapter of the airplane maintenance manual it contains for such a case no separate inspection notes. However the existing instructions were not fully executed by the technicians at the airport after the fire warning.
From the operator all licensed aircraft maintenance engineers (LAME) were advised about the importance of an exact visual inspection of the area for which a fire warning took place.
Not until the cause of an incident is clarified, safety relevant decisions can follow. To this belongs the air traffic with a shut down unit like the APU, even if this is in special cases allowed (e.g., correspondent with a minimum equipment list, MEL).
19.2-1 F.R.Szecskay, „The GE90-Engine Designing for Maintainability“, SAE-940022, page 73-78.
19.2-2 T.Murray, V.Robel, „Multi Engine Maintenance”, page 1-7, The Boeing Company,. http://www.boeing.com/commercial/aeromagazine/aero_05.
19.2-3 B.J.Crotty, „Unplugged, a maintenance error caused oil to be lost from all four engines…“ Zeitschrift „Flight Safety Australia”, Nov.-Dec. 1999, page 43-44.
19.2-4 CAA, Safety Regulation Group, Ref 9/97/CtAw/261, „Letter to the Owners/Operators…“, „Multi Engine Maintenance Practice”, 23.Jan. 2004, page 1.
19.2-5 NTSB Report, Identification LAX94FAer3, „Accident Aug-13-94 at Pearblossom, CA, Aircraft: Lockheed C-130A, registration: N135FF“, Update May 31st 2000, page 1-6.
19.2-6 „Maintenance Error and Airline Accidents”, „Human Factors in Aviation Maintenance and Inspection“, Seite 1-8 , http://www.iasa.com.au/folders/Safety_Issues/others/maintsnafu.html,. (3919).NTSB Recovers From Triple-Engine Failure”, Zeitschrift „Aviation Week & Space Technology“, May 16, 1983, page 30.
19.2-7 „NTSB Cites Maintenance Work In L-1011 Triple-Engine Failure”, Zeitschrift „Aviation Week & Space Technology“, May 9, 1983, page 129 and 30.
19.2-8 Transportation Safety Board of Canada, Aviation Investigation Report A03P0332, „Maintenance Error-In Flight Fuel Leak, Air Canada, Airbus A330-300 C-GHKX, Vancouver International Airport, British Columbia, 06 November 2003”, , May 9, 1983, page 1-9.
19.2-9 NTSB Report, Identification DCA89MA034, Microfiche number 41269A, „Continental Airlines Inc., March17.1989, Oakland Ca, Boeing 737-300, Reg. N12318“, page 1.
19.2-10 D.A.Lombardo, „Controlling Foreign Object Damage”, Zeitschrift Aviation Maintenance (AM) , April 1977, page 27-31.
19.2-11 „Luftfahrt, Tödliche Mischung“, Zeitschrift „Der Spiegel”, Nr. 40/1971.
19.2-12 AAIB, Report No. 3/2005, “Report on serious incident to Boeing 757-236, G-CPER on 7 September 2003”, page 1-74.
19.2-13 „Editor's Notebook “, Zeitschrift „Defense Daily Network”, Sept.04, 2006, page 1 and 2.
19.2-14 „Maintenance shortcomings lead to B757's precautionary landing“, Zeitschrift „ICAO Journal”, Vol. 61, NO.2, March/April, 2006, page 19 - 21.
19.2-15 „Silicone Rubber Resistance to Chemicals“, Fa. Dow Corning, 16.11.06, Seite 1 und 2, http://www.dowcorning/rubber/rubberprop/chem_oil.asp.
19.2-16 National Transportation Safety Board, PB84-910404, Aircraft Accident Report NTSB / AAR-84 / 04, “Eastern Airlines, Inc., Lockheed L-1022, N334EA, Miami International Airport, Miami Florida, May 5, 1983”, page 1-46.
19.2-17 S.Michaelis, „A survey of health symptoms in BALPA Boeing 757 pilots” , J. Occup. Health Safety - Aust NZ 2003, 19(3): page 253-261.
19.2-18 ATSB, Aviation Safety Investigation Report „British Aerospace PIc BAE 146-100A, VH-NJX“, Occ. No. 200205865, 21.August 20023, page 1 and 2.
19.2-19 AAIU Synoptic Report No. 2004-003, File No. 199/0035, 30. Januar 2004, page 1-5.
19.2-20 AAIB Bulletin: 4/2006, „Incident, BAe 146-200, G-JEAW”, EW/G2005/12/11, Occ. 7. December 2005, page 33 and 34.
19.2-21 AAIB Aircraft Accident Report No: 1/2004 (EW/C2000/11/4), „BAe 146-200, G-JEAK“, 5. November 2000, page -50.
19.2-22 Report by the Senate Rural and Regional Affairs and Transport References Committee, „Air Safety and Cabin Air Quality in the BAe 146 Aircraft”, October 2000, page 1-167.
19.2-23 AAIU Report No.: 2003-002, AAIU File No.: 2002/0008 „Schaden am Triebwerk der DC10-30 N, 526 MD am 14.Feb. 2002“, page 1-9.
19.2-24 I.E.Traeger, „Aircraft Gas Turbine Engine Technology”, Second Edition, Glencoe Verlag, 1994, ISBN 0-07-065158-2, page 339.
19.2-25 Department of Energy „Reliability, Maintainability, Availability (RMA) Planning“, Life Cycle Asset Management, Good Practice Guide GPG-FM-004, March 1996, page 1-43.
19.2-26 J.C.Conlon, W.A.Lilius, F.H.Tubbesing, DoD 3235.1-H „Department of Defense Test & Evaluation of System Reliability, Availability and Maintainability”, Third Edition, March 1982.
19.2-27 „Reliability Program for Systems and Equipment Development and Production“, Ergänzung zu MIL-STD-785B, 5. August 1988, page 1-4.
19.2-28 R.A.Leyes II, W.A.Fleming, „The History of North American Small Gas Turbine Aircraft Engines”, AIAA, Smithsonian Institution, 1999, page 659, 668, 672,701.
19.2-29 „Integrated Logistics Support (ILS)“, Wikipedia encyclopedia, March 2006, page 1-5.
19.2-30 Army Regulation 700-127, „Integrated Logistics Support (ILS)”, Headquarters Department of the Army, 19. December 2005, page 1-38. (4130.2)
19.2-31 „Integrated System / Logistic Support (ILS)“, Fa. Philotech Systems and Software Development GmbH, www.philotech.de, 07.08.06, page 1.
19.2-32 Australian Transport Safety Bureau (ATSB), Aiviation Occurrence Report 200605999, „APU event - Darwin Airport NT”, 11 October 2006, page 1-8.
19.2-33 T.van Beveren, „Wenn Nervengift ins Flugzeug gelangt“, Zeitung „Die Welt”, www.welt.de/wissenschaft/article3496723, 5. April 2009, page 1-4.
19.2-34 „Trikresylphosphate“, de.wikipedia.org/wiki, aktualisiert 24. März 2009, page 1-3.
19.2-35 „Dämpfe zwingen Piloten zur Umkehr”, Süddeutsche Zeitung Nr. 253, 2.11.2012.