ABSTRACT

There are certification and airworthiness requirements relevant to the provision of clean breathing air in the crew and passenger compartments. There have been continuing reports and studies over the years regarding oil fumes in aircraft, including impaired crew performance. Oil fumes are viewed in varying ways ranging from rare seal bearing failures, to low level leakage in normal flight. A Masters of Science (MSc) research degree was undertaken to assess whether there is any gap between the certification requirements for the provision of clean air in crew and passenger compartments, and the theoretical and practical implementation of the requirements using the bleed air system. A comprehensive literature search reviewed applicable certification standards, documented and theoretical understanding of oil leakage. Two types of interviews were conducted to address the research questions. Key aviation regulators were questioned about the process by which they certify and ensure compliance with the clean air requirements. Aerospace engineers and sealing professionals were interviewed about their understanding of how oil may leak past compressor oil bearing seals, and into the air supply under various flight conditions. The outcome of the research showed that there is a gap between the clean air certification requirements, and the theoretical and practical implementation of the requirements using the bleed air system. Low level oil leakage into the aircraft cabin in normal flight operations is a function of the design of the engine lubricating system and bleed air systems, both utilising pressurised air. The use of the bleed air system to supply the regulatory required air quality standards is not being met or being enforced as required.

Keywords:

Bleed Air, Secondary Air, Gas Turbine Engines, Cabin Air Quality, Lubricants, Oil Bearing Seals, Labyrinth Seals, Mechanical Seals, Oil Fumes

1. Introduction

The first reports of concerns of exposure to jet engine oils leaking from aircraft engines into cabin air supplies date back to the early 1950s [1][2][3]. This coincided with the introduction of synthetic jet oils that replaced mineral oils and the introduction of higher performing, higher temperature and pressure turbine engines [4]. Varying types of reports have continued to the present day including military, airline, manufacturer and crew reports. Furthermore, there have been airworthiness directives, regulator initiatives, legal and insurance claims, scientific committee studies, published literature and media reports. The “vast majority” of fume events are associated with an abnormal leakage of engine or Auxiliary Power Unit (APU) oil [5].

The reported frequency of fume events varies widely including 2.1 events per 10,000 departures [6], oil fumes in 1% of flights [7]and seals leaking as a function of the design and operation of oil seals reliant upon compressed air [8][9]. Despite recognised under-reporting, crew impairment has been recorded in around 30% of fume event reports [8][10][11].

Exposure to a range of hazardous substances and pyrolysis by-products, from engine oils and hydraulic fluids contaminating the aircraft air supply, is increasingly recognised as potentially adversely impacting flight safety [12][13][14][15]. Despite no real time monitoring to detect compressor bleed air contamination, a growing number of studies have confirmed the presence of low levels of oil substances in the air supply system in normal operations between 25% and 100% of flights [11][16][17]. While the significance of exposure continues to be questioned, an increasing number of global initiatives continue to be undertaken [12][18][19].

Despite “general acceptance that cabin air can become contaminated by compounds released from pyrolysed oil from engines and APUs” [20]on a somewhat “regular” basis [21], the frequency of such exposures is widely debated.

There are two varying positions held within the aviation industry regarding the leakage of oil outside the engine oil bearing chamber. In the wider aviation industry, outside of the seal and engineering specialist areas, a common position held is that leakage is a function of seal failure or operational deficiencies. Rare seal or mechanical failures [22][23][24], unintentional oil leakage [25], improper work or damage to the main shaft seals [26]or worn seals or overfilled sumps [27]are commonly cited. A broader approach by the European Aviation Safety Agency (EASA), recognises fault conditions to include seal or bearing failure, maintenance irregularities and design deficiency enabling oil contamination of the air supply [5].

The second view comes from an increasing understanding that low level leakage occurs at various phases of normal flight. Various views are reported, including that all engines leak from the seals and bearings [28], which is a feature of the design using the bleed air system [29], and oils seals may leak at greater rates during transient operations and while the engine is still achieving optimum temperature and pressures [30]. Oil seal leakage is also reported to occur during certain engine events, such as engine switching or at top of descent; and in older aircraft with chronic exposure to vapours that “continuously leak through the seals in “tiny” amounts” [31]. Oil leaking from bearings can be either “slowly varying and somewhat continuous, or sporadic and quite intermittent” [32]. The specialist oil sealing and engineering sector tends to support the latter position, however their views are not commonly available.

There are also varying ways in which oil leakage effects are seen. Lower level leakage related to system design is often viewed as normal, safe and acceptable, associated with minor discomfort only, with increased levels due to wear or failure possibly affecting occupant health and flight safety [30]. Fume events are said to range from rare and serious smoke events to “simple dirty socks smells” [33], whilst improved seals lead to concentrations of oil in the bleed air being “negligible” [30]. Some suggest that air is safe and meets all the applicable regulatory standards [34], however hazards associated with the oils are recognised [15][35]- [41]. Additionally ground based safe exposure limits do not apply to the aircraft environment [30][42][43]. With regard to oil/air sealing flows, in 1995 the NASA Seal Development Workshop stated that “oil vapours and coking smells are obnoxious at best and health hazards at worst to the customer” [44].

Maintenance diagnostics have been referred to as being of a “trial and error” nature [27], while failure to eliminate the source of the contamination will lead to repeated occurrences [45]. The financial implications related to oil fume events are suggested to range from approximately $40,000 per incident to $2,000,000 per day [46][47].

There are clear regulatory standards and guidelines available that outline the requirements for clean air to be supplied to the crew and passenger compartments. Therefore, given the regulatory frame work applicable to air quality requirements and the discrepancy in the two varying positions on oil leakage frequency, a research question was identified. A question was raised regarding whether oil leakage out of the bearing chamber occurs only in the occasional failure or maintenance deficiency situation, or as a normal part of engine operation when using pressurised oil seals and compressor bleed air to supply cabin air?

The aim of this research was to therefore assess whether there is any gap between the certification requirements for the provision of clean air in the crew and passenger compartments, and the theoretical and practical implementation of the requirements using the bleed air system [11].

The objectives were to: 1) evaluate the aircraft certification requirements for the provision of clean air in crew and passenger compartments, and the processes in ensuring their compliance; 2) assess the theoretical documented understanding of bleed air contamination of the air supply; and 3) assess the feasibility of the implementation of the aircraft certification requirements for the provision of clean air in crew and passenger compartments, in the context of the potential contamination caused by various conditions in the aircraft bleed air system.

The research was structured reviewing the applicable certification standards and the existing documented theoretical understanding of turbine engine oil leakage past oil-bearing seals into the cabin. Further research was then undertaken to understand how the certification process is undertaken in practice and how oil may contaminate the aircraft bleed air supply.

This research should be beneficial for a wide range of interests within and outside the aviation industry including engineering and design, maintenance, airlines, manufacturers, regulators, occupational health and safety, environmental health occupational and public health and policy makers.

2. Materials and Methods

This research consisted of 3 elements:

1) A review of the certification standards and guidelines applicable to the ventilation air provided to the aircraft cabin;

2) A review of the theoretical and documented understanding of how oil may contaminate the aircraft air supply when using the bleed air system;

3) Research addressing the real world implementation of the certification requirements requiring clean bleed air.

In order to understand how the certification process is undertaken in practice and how oil may contaminate the aircraft bleed air supply, two separate interview processes were utilised.

An extensive review of the literature and databases was undertaken addressing current documented understanding of oil leakage and certification standards. This was required to meet two of the research objectives, in order to then address the final aim of identifying whether there is a gap between the requirements for clean air and the theoretical documented understanding and practical implementation.

A semi-structured qualitative interview approach was undertaken. Written questionnaires were sent to the two sets of interview candidates, with follow up phone interviews undertaken where required.

EASA and the Federal Aviation Administration (FAA) were selected as the regulatory authorities to interview as many countries utilise the EASA and FAA certification and type certificate process or use essentially the same standards when undertaking their own certification. Seven questions were directed to the engine/APU and airframe airworthiness departments to understand the process by which they certify and ensure clean aircraft air requirements are met with the use of bleed air.

Ten aviation engineering professionals and two seal supplier experts were selected to conduct the interviews involving their professional judgement on how oil may leak past oil bearing seals into the air supply under various flight operational conditions. The respondents were identified based upon professional contact with the researcher due to the researcher’s previous expertise in this area [15]. All were required to have extensive relevant aviation expertise and hold or have held senior positions within the industry. Ten of the 12 experts had an average of 43 years in their respective fields. The experts selected were based in four countries in three continents. Eight questions were utilised to gain an understanding of the professional view of the interviewees about oil leakage past bearing seals into the compressor core air, including into the aircraft cabin air supply.

3. Results

3.1. Certification

The key relevant European Certification Specifications (CS) and Federal Aviation Regulations (FAR) and suggested non-mandatory acceptable means of compliance (AMC) or guidance material related to the clean air requirements are outlined below. Specific wording related to some of the requirements and AMC are outlined in Table 1.

The Guidance material for the engines and APU above note that when dealing with such low probabilities, absolute proof is not possible, with reliance placed on good engineering judgement, previous experience, sound design & test philosophies.

CS 25.1309 and the FAR equivalent airframe airworthiness standards require equipment, systems and installations to be designed ensuring they perform their intended functions under any foreseeable operating condition, including fluid or vapour contamination, according to the AMC. The FAR requires failures causing the prevention of safe flight and landing to be extremely improbable and reduced ability of the crew to cope with adverse operating conditions, improbable. The CS specifications utilise three categories including “hazardous” failures, as extremely remote and “major” failures as remote. As shown in Figure 1 and Figure 2, the AMC shows each failure condition should have a probability inversely related to its severity.

The EASA AMC lists major failure conditions as those that could impair crew efficiency, or cause physical discomfort to the pilots, or physical distress or injury to the passengers or cabin crew. Such conditions must be remote, unlikely to occur to each aeroplane during its total life, but may occur a few times during the total life of all aircraft of type, with average probability per flight hour of 1 × 10⁻⁵ or less but greater than 1 × 10⁻⁷. See Table 2 for further detail outlining the CS 25.1309 AMC Relationship between Probability and Severity of Airframe Failure Conditions.

Warning systems must be provided to alert the crew to unsafe system operating conditions and to enable them to take corrective action FAR and CS 25.1309C.

A safety analysis of the engine, including the compressor bleed system is required under Certification Standard-Engines (CS-E) 510 and FAR 33.75, with

acceptable means of compliance provided as shown in Table 1. Concentrations of toxic products in the engine bleed air for the cabin deemed sufficient to incapacitate crew or passengers are regarded as a “hazardous” engine effect under the FAR or CS standard and must be predicted to occur as extremely remote, at less than 10⁻⁷ per engine flight hour/efh. “Major” engine effects must be remote at less than 10⁻⁵/efh. “Hazardous” effects include no effective means to prevent the flow of toxic products to crew or passenger compartments, or toxic products impossible to detect or stop prior to incapacitation. Degradation of oil leaking into the compressor airflow is listed as a toxic product. Concentrations of toxic products slow enough acting and/or readily detectable so as to be stopped prior

Note 1: A numerical probability range is provided here as a reference. The applicant is not required to perform a quantitative analysis, nor substantiate by such an analysis, that this numerical criteria has been met for Minor Failure Conditions. Current transport category aeroplane products are regarded as meeting this standard simply by using current commonly-accepted industry practice.

to incapacitation are considered “major” engine effects. These include substances sufficient to degrade crew performance.

CS-APU 210 safety analysis and its AMC are similar to CS-E 510, while a US APU Technical standing order (TSO)-C77b requires that failures do not generate an unacceptable concentration of toxic products in the bleed air.

Prior to the 2007 FAR 33.75 amendment, there was no requirement to review toxic bleed air components, while the 2001 Joint Aviation Requirements (JAR) acceptable compliance referred to unacceptable concentrations of toxic products in the bleed air supplied to the cabin.

CS-E 690 requires contamination or purity tests of the bleed air when it is directly used in the cabin. An analysis of the defects which could affect the purity of the bleed air must be prepared and where necessary defects must be simulated and tests undertaken to establish the degree of contamination that is likely to occur.

The airworthiness ventilation and heating requirements are set out under CS and FAR 25.831. CS 25.831a requires that each crew compartment has enough fresh air enabling crew members to perform duties without undue discomfort or fatigue. FAR 25.831a is very similar but covers normal and probable failure conditions, uses the term “sufficient amount of uncontaminated air” and references reasonable passenger comfort. CS and FAR 25.831b require that the crew and passenger compartment air must be free of harmful or hazardous concentrations of gases or vapours. Only carbon monoxide (CO), carbon dioxide (CO₂), ozone (O₃) levels and fresh airflow rates are listed.

An unsafe condition includes events that occur more frequently than the safety objectives allow, or that may reduce the ability of the crew to cope with adverse operating conditions, impair crew efficiency or cause discomfort/injuries to occupants―EASA AMC 21. A.3Bb.

Historically, Military Standard (Mil Spec) MIL-E-5007 specification was utilised as one form of certification guidance compliance. Oil leakage within engines was not to cause oil discharge upon starting after previous shutdown or cause contamination of the bleed air or deposits. A compressor bleed air analysis was to be undertaken to ensure contaminant levels were within specified limits, including oil breakdown products.

There are various other voluntary standards or recommended practices such as the Society of Automotive Engineers Aviation Recommended Practice SAE ARP4418, SAE Aerospace Standard AS 5780A and the previous Military Specification, MIL-PRF-23699F and the American Society of Heating, Refrigerating and Air-Conditioning Engineers ASHRAE standard and associated guideline 161-2013.

3.2. Oil Sealing System

Around 25% of the engine core airflow is extracted and utilised to supply engine internal air and various aircraft systems. This secondary air, also known as bleed air is primarily tapped off the compressor and used for cooling the engine, and accessory components, bearing chamber oil cooling and sealing, control of turbine tip clearances, cavity ventilation bearing load controls, cabin pressurisation, ventilation, anti-icing and other services. Around 3% - 4% of the air bled off the compressor core airflow is used for cabin ventilation purposes. The extracted secondary/bleed air is controlled and minimised as it reduces power and efficiency of the engine. To do this a number of oil and air seals are required.

Figure 3 shows a typical engine oil system. The minimum quantity of oil is used to perform lubricating, cooling, corrosion protection and sealing functions and then returned to the lubrication system, taking into account the permissible consumption of oil, usually around 0.1 to 0.5 US Quarts/ hour per engine [48].

Engine bearings grouped in bearing chambers require a continuous supply and removal of oil. In addition to lubricating and cooling the bearings, the oil washes away metal parts released from the bearings in normal operations and supports the sealing of a particular type of seal, the carbon face seal.

The philosophy behind engine bearing compartment sealing involves using compressor pressurised air (see Figure 4) to maintain the bearing compartment at a lower pressure than its surroundings, therefore inducing an inward flow to prevent an outward oil leak [50]. Too much airflow around the chamber to prevent oil leakage is a performance penalty and increases the heat load to the oil in the chamber [51]. The pressurised air from the compressor in addition to preventing oil leaking out over the bearing seals is also used to cool and ventilate the bearing sumps to prevent a build up of combustible gas mixtures. Oil leakage outside the bearing sumps may result in performance loss due to the contamination of aerodynamic parts, engine fires, vibration due to oil accumulating in

rotating parts, or pollution in the bleeds resulting in cabin air contamination [49][50].

The ability of contaminants to migrate from the core air into the cabin bleed air supply will be influenced by a number of factors including, the design and location of the bleed off-takes and the specific operating conditions.

Pressurised oil bearing seals are generally clearance labyrinth seals or mechanical contact face seals, both relying upon compressor air as a part of the sealing function [48]. The seals operating at high speeds require either a clearance or well lubricated seal [52]. The compressor sealing air flowing across the seal into the bearing compartment is responsive to variations in engine operating conditions [53]. Sealing bearing compartments at near ambient pressures is difficult [54][55]. The pressure difference between inside and outside the chamber is very small, so as to not blow oil out through the oil system breather. However, the small differential in transient modes provides a much greater chance of pressure reversal.

3.2.1. Labyrinth Seals

Non-contacting clearance labyrinth seals (see Figure 5 and Figure 6) rely upon a small tight clearance between the stationary and rotating members to reduce leakage air flows. An inward flow or controlled leakage of air, through a series of restrictions, followed by a clear volume creates expansion of the air, therefore reducing pressure over the seal. The clearance is set by aero-thermal mechanical conditions allowing for rotor and axial excursions and minimising rotor contact with the shroud [54]. Labyrinth seals provide simplicity, reliability, reduced wear and low cost, however they are subject to high air leakage and loss of engine performance. However, they do not in isolation provide a complete barrier to leakage [56]. They do not respond well to dynamics, with permanent increases

in seal clearances from shaft excursions on stop/start operations, other transient conditions [54]and other factors such as engine age and a variety of operating conditions [57].

The clearance permits fluids to flow in either direction, dependent on pressures and the momentum of the fluid [59]. Leakage of fluid will always occur across the seal from high to low pressure [52][59]. The seal is essentially a controlled leakage device [60], relying on pressurisation to minimise oil leakingalong the compressor shaft [61].

3.2.2. Mechanical Contact Seals

Mechanical positive contact seals, such as carbon face seals form a seal between a stationary and rotating flat precision-finished surface, thereby preventing leakage [62]. These seals are often used to seal bearing sumps, thereby restricting air leakage into the bearing sumps and preventing oil vapours passing into the cabin air stream. However, they are more complex, maintenance intensive, expensive, subject to higher wear rates, and have a shorter life than labyrinth seals.

Figure 7 shows the faces are held in sealing contact by a combination of force by a spring and positive system pressure to ensure adequate loading of the carbon elements to minimise leakage and wear [55]. Carbon seal performance is affected by excessive seal wear during transients, finite rates of wear and coked oil deposits.

A small amount of oil is forced across the flat faces. The minimal film of oil is a compromise ensuring the oil is sufficiently thick, providing adequate lubrication of the seal and a long life and being as thin as possible to minimise leakage [52]. A normal contact seal will leak a very small amount of oil vapour from a few parts per million (ppm) to 10 cc/min [62]. The flat faces, providing the seal, will distort with thermal and pressure effects, encouraging increased oil between the faces then pumped out to the air high-pressure side of the seal [52]. Various features may be utilised to help prevent oil leakage into the compressor at various phases of engine operation.

3.2.3. Common Aspects of Oil Bearing Seal Operation

There is a fundamental assumption regarding oil bearing seals that the compressor gas path air will be at a higher pressure than the oil in the bearing chamber, ensuring that leakage will always be into the bearing housing and not into the gas path. It is commonly reported that oil seals only leak when there is a failure or under reverse pressure conditions, but the literature suggests this is not always the case due to a variety of factors as outlined below.

・ Oil leakage may flow against the positive pressure gradient with both types of seals, that is from low to high pressure. A positive gradient is difficult to obtain under all operating conditions and not a guarantee of zero oil leakage and sealing bearing compartments at near ambient pressures is difficult [53][55].

・ Pressure generated in the oil film between mechanical face seals can cause liquid in the film to overcome the pressure gradient to leak both with and against the pressure gradient [52][63].

・ Dalton’s law of partial pressures with gas trying to create a constant partial pressure, indicating high pressure will not prevent oil vapour from permeating through the labyrinth against the pressure gradient [52].

・ Reverse pressures over the seals during engine operation causing higher pressure on the oil side of the bearing chamber, allowing both types of seals to allow leakage in the opposite direction [52].

Just about all known seals will leak, with seals designed to limit leakage and no such thing as a seal that does not leak, even if a very small amount, perhaps an emission, rather than a leakage [52]. Chupp et al. 2006 state that “a zero leakage seal is an oxymoron” [54]. Only very small amounts of oil need to leak to generate a noticeable odour in the cabin [45], with odours noticeable before high oilconsumption is noticed [64]. There will be a variety of other factors that influence the volume of leakage.

3.2.4. Oil Bearing Seal Leakage

Military jet aircraft commenced using pressurised air bled off the compressor in the late 1940s. It was soon recognised that engine bleed air used for the ventilation was increasingly subject to unacceptable contamination, with the compressor bearing seals being the main source of oil leakage [65]. The bleed air contaminated by oil was said to be non toxic, ranging from objectionable odours to severely irritating and therefore initially unsuitable for commercial airliners [65]. With higher performing civil aircraft necessitating larger turbocompressors to compress the outside air and as there was “no discernable difference in quality between ram air and bleed air”, it was decided to use direct bleed air to ventilate the cabin [25].

Upon a closer review, industry awareness of seal leakage is well established. There is a general view that mechanical and labyrinth seals will leak as a part of their normal function, along with the need for more advanced seals. Limited examples include: recognition that carbon seals will always leak a small amount; sealing technical challenges including low leakage, long life at high temperatures and speeds; seals needing to act as seals not flow restrictors; seals varying in effectiveness at different stages of aircraft operation, especially during transients. The major part of consumption in Rolls-Royce gas turbines was said to represent “loss of liquid oil arising from permissible leakage past certain seals, escape of mist or aerosol through breathers and losses incurred during inspections, made good by ‘topping up’ the system with fresh oil” [66].

The actual bearing seal arrangements are complex, differing widely, with specific engine design details not publicly available. The selection of one type of seal over another involves acceptance of advantages and penalties, varying with differing engine designs. There seem to be contradictory reports on which seals are optimal for sealing the bearing compartment. A few examples are listed below.

・ Air/oil face seals requiring improved reliability and future research on the transient behavior of the seals [67].

・ Carbon seals suggested to be more effective for bearing compartment sealing and preventing oil leakage into the cabin [55].

・ Carbon face seals are industry workhorse but have problems with face blisters [68].

・ Use of secondary sealing practices in aero engines is unknown, although single seals appear to be utilized [52].

・ Original Equipment manufacturer’s OEMs satisfied with labyrinths for main shaft sealing despite mechanical seals suggested to be “seals of the future” for aircraft engines [69]. Labyrinths will be around for a long time [70].

The problems associated with conventional shaft oil sealing were clearly highlighted with seal technology not keeping pace with other major engine component advances [71]. It was recommended that in order to address some of the concerns, seal design should be thoroughly integrated into the engine design process [70].

While labyrinth seals are noted to have high air leakage leading to high oil consumption, both labyrinth and mechanical contact seals have high oil loss and oil pollution in the cabin during reverse pressure conditions [71][72]. Axial lift mechanical seals are suggested to prevent oil pollution in the cabin during reverse pressure scenarios [72]. Advanced seals are being developed to reduce leakage, improve life and offering wider operating conditions than available for conventional seals [54].

Fluid control measures appear to depend on how leakage is regarded. The aviation industry is suggested to be unique in that environmental factors drive sealing requirements rather than emission limits as occurs in other critical industries and the general environment [69]. It is suggested that customer requirements for the cabin free of smells and performance parameters drive aerospace sealing technology [54][69]. Where emission limits apply, single, double or tandem seals may be utilised, however few limits apply to the aerospace industry where leakage may be defined as 10,000 ppm or as a visible oil mist [69].

The air bled from the compressors is parasitic to the main engine cycle and costs up to 6% of the specific fuel consumption (SFC) in a modern air transport turbofan [73]. Higher performing gas turbine engines and the drive for improved SFC, have necessitated greater sealing efficiencies to prevent increased performance losses [71]. A 1% reduction in secondary air extracted gives a 0.4% reduction in SFC [54]. However, the literature strongly reports on leakage paths, generally referring to minimisation of airflow leakage into various components, including into the bearing chambers, so as to reduce performance penalties. There are only minor references to air/oil leakage out of the bearing chambers.

Lower level oil leakage is expected under a range of circumstances and is widely reported amongst the specialist engine/oil sealing community, while reference to oil bearing seal failure is far more limited. Seals for the aerospace industry are suggested to be far more demanding than those used in industrial applications, given frequent speed changes and seal operation at high altitude, start-up and shut-down [74]. Further sources of increased oil leakage into the air are referenced, such as misalignment of shafts and bearings before engine stabilisation, rapid throttle advancement and autothrottle adjustment [75].

3.3. Research Results

The interview questions and responses provided by the engineers and regulators are set out below: [11]

3.3.1. Engineers

Q1. What areas can oil leaking out of the engine or APU bearing chamber go? Oil leakage can occur within and outside the engine along with normal oil consumption as part of the oil system via the aircraft breather. There was clear recognition that internal oil leakage from the compressor bearing chamber can allow oil to enter the core flow with potential to enter the cabin bleed air system.

Q2. What are the factors that may allow oil to leak past compressor bearing seals? This complex and specialist area identified a variety of factors including design factors such as the use of seal types that are not an absolute design and will leak; reliance of the seals on pressure differentials; thermal and axial/ radial changes in engine structures; leakage affected by engine speed, power; and design parameters that do not account for all flight conditions. Other key engine operation factors include seal wear and degradation, on condition maintenance, installation, maintenance and in-use factors.

Q3. Does the phase of flight effect oil leakage rates? The three areas identified included: changing pressure differentials and balances over the seals with differing transient engine power, application and ambient conditions affecting seal efficiency and leakage rates; mechanical variations (thermal, axial and radial) in structures over the engine operating range changing gaps requiring to be sealed to prevent oil crossing the seals; and oil leakage at low power settings with low internal pressures such as start, spool up, top of descent and descent.

Q4. Do some types of oil bearing seals leak more than others and why? Both carbon and labyrinth seals leak for varying reasons with some leakage inevitable, as it is inherent in the design. Labyrinth seals rely more on pressure differentials with the clearance allowing leakage both with and against the pressure drop including reverse pressures over the seal. Carbon seals are designed to have low leakage rates as lubrication is required between the faces and rely more on physical contact and more subject to wear and high temperatures. Leakage also occurs with and against the pressure drop.

Q5. How is lower level leakage of oil from the compressor-bearing chamber at various phases of flight perceived with regard to regulatory compliance? Responses provided indicate there are no regulations, limits or measurement methods for air contamination by oil. Differing views indicate action is only required if leakage is above useable limits and alternatively that low level leakage is expected as part of the system design and fails to meet published design requirements. Regulatory enforcement is regarded as a low priority with standards available ignored.

Q6. What can be done to address oil leakage from the compressor bearing chamber? Preventative maintenance, real time measurement, electric air supply rather than cabin bleed air and mitigating oil leaks into the cabin to be given a higher priority, are a few of the suggested ways forward to address compressor oil leakage.

Q7. What is considered oil leakage? Oil leakage is seen in two key differing ways. Any oil that leaves the intended area, resides in areas in a greater amounts than intended or loss over seals is leakage. Alternatively, only loss above permitted oil consumption levels or inadequate system pressure differentials are regarded as leakage, but not lower level oil emissions.

Q8. Are all oil leakage events documented? The majority believe that not all leakage events are reported for a variety of reasons including under reporting, varying record keeping and maintenance dependent on crews identifying odours and then reported in the technical log. A small minority focused on the requirement to report, mandatory maintenance procedures being recorded and higher level events only.

Answers provided clearly identified a comprehensive picture and opinions often based on specific area of expertise, rather than a complete overview, given the specialised topic.

3.3.2. Regulators

Q1. What is the certification process that an engine and APU manufacturer must follow to demonstrate compliance with the requirements of the quality of bleed air utilised for the aircraft cabin? While the applicant must show compliance with the regulations or standards and the means by which compliance is met, there is no specific process to follow to demonstrate this, however guidance is provided. The regulator interactively will review the data submitted to enable agreement that compliance is met.

Q2. What are the relevant certification standards and acceptable means of compliance AMC used to demonstrate bleed air compliance? The safety analysis process and published acceptable methods of compliance for both regulators is essentially identical. “Hazardous” engine effects, including concentrations of toxic products resulting from degradation of oil leaking into the compressor air flow, sufficient to incapacitate crew or passengers must be predicted to be extremely remote 10⁻⁷ to 10⁻⁸/ engine flight hour (efh). EASA reported that “major” engine effects must not occur at a rate greater than remote 10⁻⁵/efh. Toxic products are considered a “hazardous” engine effect for several reasons including there being no effective means to stop the flow of incapacitating toxic products to the crew or passenger compartments. While both require analysis of concentrations of toxic products in the bleed air, the EASA specifications are more specific with engine bleed air purity tests and an analysis of possible defects effecting purity also required.

Q3. Which substances are reviewed and what limits are applied demonstrating compliance? While there is a requirement to prevent incapacitation from toxic bleed air substances, there are no specified regulatory limits. EASA however referred to SAE standard limits ARP 4418A as a means to demonstrate compliance.

Q4. Was there any difference in previous years with what was deemed acceptable to demonstrate compliance? The reference to toxic products did not exist under the FAA safety analysis regulations for aircraft certified before 2007. The initial EASA CS E section in 2003 is effectively the same as the present version. The last version of the JARs published in 2001 referred to “unacceptable concentrations” of toxic products generated in air supplied in the guidance material.

Q5. What defects that could affect the purity of the bleed air might be considered and what tests may be undertaken? The FAA referred to the Advisory Circular guidance material listing oil leakage and degradation of abradable materials into the compressor airflow, without supplying specific defects enabling this to occur. While tests for toxic substances are not defined, EASA standards require analysis and possible simulation of defects as part of the contamination cabin bleed air tests.

Q6. What is the cabin air quality certification process and acceptable means of compliance at the airframe level and which substances and limits are included? The airframe requirements are very similar requiring enough fresh air to avoid discomfort and fatigue and provide reasonable comfort, a minimum airflow and are interpreted to consider carbon monoxide (CO), carbon dioxide (CO₂) and ozone (O₃) only. However, the FAA has required recent certification programs to address the National Research Council (NRC) [25]cabin air quality recommendations including oils and the degradation products into the cabin air. A range of additional standards and guidelines are listed as optionally utilized by manufacturers demonstrating compliance. Examples include ASHRAE standard 161, the European AECMA-STAN standard for acceptable air quality and company specific design specifications.

Q7. What are the general sources of data used to indicate that the power units and aircraft meet the required standards? The FAA utilized source of data to show compliance is up to the manufacturers. The data provided is interpreted as evidence that incapacitation will not occur above the given rate and a range of sources at the airframe level are utilised. Examples include those listed in Q6 above and ASHRAE research project 957-RP 1999 and NIOSH hazard evaluation report, Alaska Airlines 1993. An interactive process between EASA and the manufacturers is undertaken.

4. Discussion

The aim of this research was to assess whether there is any gap between the aircraft certification requirements for the provision of clean air in crew and passenger compartments using the bleed air system and the theoretical and practical implementation of the requirements. The research results obtained and existing literature has clearly identified differing understanding of bleed air supply contamination, between seals and aero engine experts compared to the wider aviation industry.

The qualitative nature of this research, enabled the respondents to provide a wide range of detailed responses, which were then narrowly categorised, so as to avoid loss of detail in this highly specialist area [11]. Overall the response rates were high and provide an overall picture. While broader categories could have been used to capture higher response rates in each category, this approach would have lost detail and not helped provide a comprehensive understanding.

4.1. Standards and Guidance Material

There are various certification requirements and associated AMC published for the provision of clean air in the crew and passenger compartments, which ought to be acceptable in demonstrating compliance. The requirements and guidelines have been outlined previously, some of which can be seen in Table 1. However, there are a number of deficiencies in the descriptive terminology and the presentation of the requirements between standards and guidance material. This could enable the compliance requirements and AMC to be interpreted in a number of ways or with lesser priority. The engine safety analysis lists the toxic products in the bleed air sufficient to cause incapacitation in the standard. Oil leakage into the airflow and degradation of crew performance are included in the non-mandatory guidance material. This may allow a lesser priority to be placed on leakage causing impairment.

Prior to 2007 the FAR engine safety analysis §33.75 did not reference toxic products in the bleed air. The past and presently used phraseology, “concentration of toxic products sufficient to cause incapacitation or degrade crew performance or unacceptable concentrations of toxic products”, do not provide specific guidance to acceptable levels. Warning systems required for “unsafe system operating conditions” may allow room for interpretation on whether detection systems are required for oil leakage. There may also be room for interpretation regarding the ventilation standard CS/FAR 25.831. The terms “enough clean air” or “sufficient amount of uncontaminated air” may allow the focus to be on the airflow rates listed rather than fresh air preventing undue discomfort. The requirement for air to be free of harmful and hazardous gases and vapours could be interpreted to refer to all substances or CO, CO₂ and O₃ only.

EASA CS bleed air purity tests require analysis and possible tests of defects affecting the purity of the air, however, no further guidance is provided. The safety analysis for both the FAR and CS must include toxic products in the compressor bleed air, yet no guidance is provided. It is left to the manufacturer to demonstrate compliance.

There are however, some broader requirements. Systems must be designed to perform their intended functions under foreseeable operating conditions. Unsafe conditions refer to events occurring more frequently than intended causing impaired crew efficiency, discomfort or injuries.

4.2. Theoretical Understanding

There is a clear discrepancy in the understanding of oil contamination of the bleed air supplied to the cabin. The general understanding within and outside the aviation industry varies markedly to seal and aero engine experts, specifically those involved in the bearing chamber/engine design and maintenance areas [11].

The general understanding primarily supports rare oil leakage due to failed bearing seals. Further damaged or worn seals, seals not working properly under abnormal conditions or overfilled sumps are commonly referenced. There is a less well publicised recognition that oil leakage may occur as a design factor. Oil seals are required to seal across the entire engine operating range, but are less efficient during transient engine manoeuvres. Oil substances are repeatedly being identified at background levels in monitoring studies. Some even report continuous tiny amounts of oil crossing the seal. Studies undertaken generally report exposures to oil fumes as safe, with low level exposures regarded as normal and safe, associated with discomfort only.

The literature supporting the engine and sealing experts understanding of oil leakage is not readily accessible or referenced when the topic of oil leakage is raised [11]. However seal leakage at lower levels is widely recognised. Pressurised compressor air is used to seal the bearing compartment, but is responsive to variations in engine operating conditions. The commonly used bearing compartment seals, both allow lower level oil leakage across the seal. Labyrinth seals rely on a clearance and do not in isolation prevent leakage. Mechanical carbon face seals require oil to lubricate the faces with minimisation of leakage across the faces. Various operational factors allow increased oil leakage over both seals, including wear, changes in clearances, seals not at operational temperature or pressures and during transients. Positive pressure gradients over the seal do not fully prevent leakage. Reverse pressures, which do occur, will allow leakage in the opposite direction. While selected aviation standards related to clean air do exist, several factors stand out as outlined below as why some experts may regard lower level oil leakage as acceptable.

・ Leakage over seals is a normal part of permissible oil consumption limits.

・ Belief that permissible leakage is driven by consumer perceptions rather than regulatory emission limits.

・ Sealing the bearing chamber at near ambient pressures is difficult.

・ Oil leakage is viewed differently - high level mist or low level emission.

・ High awareness of seal technological limitations and concerns about oil leakage out of the bearing chamber, yet no real moves towards advanced sealing, particularly for current aircraft.

The literature [11]identifies that the different groups are not suitably communicating with each other to fully understand the risks.

4.3. Feasibility of Implementation of Standards

Despite, the small sample size, the engineering and seal experts were highly experienced. Eleven out of the twelve experts recognised low level oil leakage or emissions over the oil seals are a part of the system function of utilising pressurised oil bearing seals. A wide variety of factors, including those set out below, were identified that allow oil to enter the compressor air and the bleed air system:

・ Changes in pressures and balances during different engine operating and ambient conditions/transient performance changes reducing seal efficiency;

・ Thermal, axial and radial changes in engine structures cause changes in gaps needing to be sealed over whole engine operating range;

・ Low internal pressures at various phases of engine operation;

・ Standards and designs modeled on steady state conditions, not transients;

・ Seals are not an absolute design, enabling leakage;

・ Seal wear/component degradation.

Based upon the responses provided by the engineering and seal experts and regulators, there appears to be a discrepancy between the design standards and their implementation with the use of the bleed air system. Table 1 shows some of the key EASA and FAA requirements and non-mandatory compliance material, for the airframe and engine and APU where applicable.

The standards require “major” engine/APU effects to not be greater than “remote” 10⁻⁵ - 10⁻⁷/efh. “Major” effects compliance guidance includes oil leakage into the compressor airflow sufficient to degrade crew performance. The regulators however place the emphasis on the regulation/standard involving “hazardous” effects including toxic products sufficient to cause incapacitation, with no mention of “major” effects (FAA) and effectively no reference by EASA. Reliance on the regulation/standard was clear with the compliance guidance effectively ignored.

The FAA airframe standards do not allow failure conditions, reducing the crew’s ability to cope with adverse operating conditions to be more than “improbable”. EASA airframe standards require “major” failure conditions to be no more than “remote”. Major failure conditions under the EASA AMC include impaired crew efficiency, flight crew physical discomfort or physical distress of other occupants occurring no more than remotely 1 × 10⁻⁵/flight hour (fh). Remote EASA failure conditions may occur several times during the total life of a number of aeroplanes of type, but are unlikely to occur to each aeroplane. The FAA terminology varies (Table 1), but the intent is similar.

The regulator responses regarding compliance at the airframe level took part of the requirements into account only. CS and FAR 25.831 requiring a “sufficient amount of uncontaminated” or “fresh air” were highlighted, while general airworthiness requirements including “major” effects and impairment (25.1309 and AMC) were ignored. This identifies that in terms of CAQ and oil contamination, the airframe certification requirements are not being adequately applied.

As shown in this research, exposure to lubricants is associated with adverse effects and is expected to occur more than remotely or improbably, based on the design, hazard recognition and frequency reported.

Based on engineering judgment provided in this thesis, “major” engine effects involving oil leakage are occurring more than 1 × 10⁻⁵/engine/APU flight hour. As the oils are accepted in a variety of ways as being associated with adverse effects [15][35]- [41], impaired crew efficiency or degraded crew performance can occur with exposures.

The frequency meets the definition of “probable”. As shown in Table 1, probable failure conditions may not be greater than minor and may not have adverse effects on occupants (FAA) or flight crew (EASA). Table 2 outlines that EASA airframe probable failures should not be more than 1 × 10⁻³/fh, with those more frequent again stated to have no effect on flight crew or inconvenience only to others and no safety effect. Exposure to oils via the bleed air system does not meet this. Major effects are expected which must be improbable or remote.

Those responsible for certification and continuing airworthiness are primarily relying on engineering judgment and analysis to determine the probability of failure conditions and engine effects, without adequately reviewing other factors. In-operation occurrences, under-reporting, hazardous substances, design enabling low-level exposures, and adverse effects on occupants are examples of other factors to be considered.

The ventilation standard CS/FAR 25.831 was interpreted to include only a sufficient amount of uncontaminated air, enough fresh air to prevent discomfort and fatigue, specified ventilation rates, CO, CO₂ and O₃. More recent certification programs have included reference to a number of industry air quality studies and guidelines to determine what is deemed acceptable. However, not all are relevant and some such as AECMA-STAN, no longer exist.

The regulatory emphasis is focusing on the “hazardous” engine effects of toxic products sufficient to incapacitate, with little or no recognition of “major” effects causing impairment. Impairment and discomfort related to the airframe are either being ignored or limited to selected flow rates, limited substances and industry studies.

Alternatively, as lower level leakage occurs as an expected function of various phases of engine operation, it could be suggested that the oil system is working within its intended function. Oil leakage over the seals may be a normal as distinct from a failure condition.

Despite accepted oil leakage in normal operations, there were various contrasting views on acceptability of the leaking oil including: no action required if the leakage is below the permissible leakage levels and within engine pressure limits; transients not measured; no oil published limits or standards exist; contaminants must be within established limits; and normal low level leakage fails to meet the standards. Other key issues include that low level emissions are ignored, under-reporting is occurring, and low priority is given to preventative maintenance and regulatory enforcement.

The non-specified or limited substances referenced under the engine/APU safety analysis, and ventilation requirements help explain the difficulty in determining the acceptability of oil contamination of the air supply. The FAA interpretation of the engine analysis requirements was limited to toxic substances sufficient to incapacitate. EASA referenced an industry standard SAE ARP 4418A that list limits for a few substances and relates to steady-state engine operation only. The previously used compliance specification MIL-E-5007 did not allow any oil leakage into the bleed air.

The lack of detection systems and warning indicators to identify oil fumes inflight fails to meet the regulatory requirement 25.1309c, and causes compliance problems. This also poses difficulties in post flight maintenance rectification.

Leakage of oil into the bleed air meets the definition of an “unsafe condition”, and an unsafe air supply system operating condition.

Type certificate applicants submit a report to the regulator showing how compliance has been met. However, there is no requirement to follow a specified procedure. In a similar manner, bleed air analysis for certification is shown to be non-specific. The FAA does not refer to specific tests that are to be part of the safety analysis, yet engines are required to provide bleed air without adverse effects on the engine. EASA refers to bleed air purity tests, but does not outline what the tests are or under what conditions they need to be undertaken.

In addition to the non-specific requirements related to bleed air contaminated by oil and oil sealing of the bearing chamber, this is a highly specialist area. Different experts have their part of the picture only and interpret acceptability in light of their experience. This becomes problematic in such a safety critical area.

A number of ways to improve the situation were presented including: improved preventative maintenance; better seal, oil sealing system and bleed air designs; increased seal replacement frequency; elimination of bleed air and use of an electric air supply; inflight real time monitoring; bleed air filtration; define emission through seals; avoidance of oil fume exposure in the cabin; better regulatory and air quality standards; and improved compliance and reporting.

Despite lower level oil leakage recognition within the seals and aero engines design community, the aviation industry has failed to address the situation. A number of factors were identified in the research allowing the problem to remain unaddressed. These include data not collected and reviewed adequately. No manufacturer will make significant changes without regulatory requirement given assumed high cost, apparent disincentive to change and regulations, standards and intent of AMC are inappropriately being deemed to be acceptable and met. Furthermore, there is inadequate understanding of low level exposure to hazards. It is likely that the industry expects the regulator to take the leading role to enforce change.

5. Conclusions

In current transport aircraft, exposures to lower level oil fumes containing hazardous and harmful substances, was found to be occurring in normal flight via the aircraft bleed air supply. Resulting adverse effects are creating a risk to flight safety.

The research undertaken has found that there is a gap between the aircraft certification requirements for the provision of clean air in crew and passenger compartments using the bleed air system and the theoretical and practical implementation of the requirements. Oil bearing seals are not an absolute design and will allow low level oil leakage over the seals into the compressor and bleed air supply as a normal function of the engine cycle. Lower level oil leakage is not exclusive to failure or mechanical abnormalities. Key conclusions are outlined below.

1) Regulations & standards

Based on a review of the applicable regulations, standards and guidance material and interviews with highly experienced aero and seal experts and regulators, the required bleed air quality is not being met. The standards and compliance material are not specific enough to ensure suitable bleed air quality. The focus is placed on the standard and prevention of incapacitation, with compliance guidance material and impairment almost ignored. The clean air requirements are open to interpretation and are not taking into account the in-operation environment, including hazardous substances and adverse effects, low level normal leakage, the frequency, under-reporting and lack of detection systems.

2) Design

Low level oil leakage over the bearing seals into the bleed air, at various phases of engine operation is an expected normal condition, according to the seals and aero engine experts. While many suggest that enough is being undertaken to meet the certification requirements, careful review of the literature and research undertaken with engineering and seal experts, shows the regulations are not being met. As demonstrated in the literature and supported by the engineer and seal experts interviews, the airframe failure conditions and engine/APU safety analysis requirements are not being met. Oil leakage past the seals, associated with impaired or degraded performance, occurs more frequently than the “major” EASA, and FAA regulatory and compliance criteria allow in Table 1. Oil leakage, capable to cause degraded performance and efficiency is occurring on a greater than “remote” or “improbable” basis. Oil leakage in normal operations is probable or above (Figure 1 and Figure 2, Table 1 and Table 2) and meets the definition of an unsafe condition.

3) Compliance

Although inadequate, compliance is undertaken at certification. However, no detection systems are available in-flight to monitor the quality of the air, including low level leakage in normal operations. The ventilation requirements are not specific enough to ensure occupants will remain free of adverse effects.

4) Preventative Control Measures

Low level and transient oil emissions are not adequately taken into account when considering acceptable leakage levels. Designs are based on steady state conditions, although oil leakage will be minimally occurring during certain engine power conditions and transients. There are no contaminated bleed air detection or filtration systems to identify and protect occupants from oil fumes. Rigorous controls are lacking including improved designs, better maintenance and procedures, and suitable air quality emission definitions.

5) Retrospectively

Previous engine certification requirements either did not include toxic effects or were not specific enough to prevent oil leakage into the air supply.

6) Expertise and Communication

Oil contamination of the air supply is a highly specialist area, with inadequate communication between all relevant parties to ensure compliance and airworthiness.

6. Recommendations and Future Research

Based upon the literature and the research, it has been demonstrated in terms of clean cabin air supply that the standards and compliance guidance are inadequate and not being met. This is a highly specialist area with various actions suggested to be undertaken to meet the requirements for the supply of clean cabin air. These include the establishment of a specialist task group, including the regulators, to review the following issues outlined below.

・ The adequacy of the air quality related standards and compliance guidelines, in light of the real-world understanding of oil leakage into the bleed air supply;

・ Solutions and preventative measures that could be introduced to prevent exposure to engine lubricants in normal operations;

・ The reasons why the industry is inadequately addressing the prevention of inflight exposure to lubricants;

・ Oil contamination of the bleed air supply should not be linked exclusively to rare failure conditions or maintenance irregularities;

・ The frequency should be seen in terms of design factors rather than the rate of reporting;

・ Actions should be undertaken to prevent oil leakage into the aircraft air supply in normal operations;

・ Aircraft certified prior to the current standards should be retrospectively re-certified for bleed air quality;

・ Future aircraft air supply systems should use bleed free designs;

・ Far greater priority should be placed on clean air regulatory compliance including low level oil emissions in normal flight;

・ Inflight oil fume detection systems and flight-deck warning should be implemented on all future aircraft.

Acknowledgements

The MSc degree was funded by the Global Cabin Air Quality Executive, for which the author is Head of Research and by the author.

Conflicts of Interest

The author declares no conflict of interest. The funding sponsors had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, and in the decision to publish the results.

Ethics Approval and Consent to Participate

Permission to conduct this study was obtained from Cranfield University Air Safety and Accident Investigation MSc supervisors as part of an MSc research project in 2012. All participants were asked to sign consent forms.

Availability of Data and Material

The dataset supporting the conclusions of this article is available in full on the authors website as part of the authors Cranfield University MSc research project. Available publicly at: http://www.susanmichaelis.com/pdf/2016_Susan%20Michaelis_MSc%20Cranfield-Clean%20air%20requirements%20using%20bleed%20air%20system.pdf

Cite this paper

Michaelis, S. (2018) Aircraft Clean Air Requirements Using Bleed Air Systems. Engineering, 10, 142-172. https://doi.org/10.4236/eng.2018.104011

References

Abbreviations

AECMA-STAN: Association Européenne des Constructeurs de Matériel Aérospatial Normalisation; AMC: Acceptable Means of Compliance; APU: Auxiliary Power Unit; ARP: Aviation Recommended Practice; AS: Aerospace Standard; ASHRAE: American Society of Heating, Refrigerating and Air-Conditioning Engineers; CO: Carbon monoxide; CO₂: Carbon dioxide; CS: Certification Specifications; CS-E: Certification Specification-Engines; EASA: European Aviation Safety Agency; FAA: Federal Aviation Administration; FAR: Federal Aviation Regulations; JAR: Joint Aviation Requirements; MIL-SPEC: Military Standard; MIL: Military Specification; MIL-PRF: Military Specification; NIOSH: National Institute for Occupational Safety and Health; NRC: National Research Council; O₃: Ozone; SAE: Society of Automotive Engineers; SFC: Specific fuel consumption; TSO: Technical Standard Order;

Abbreviations-Units

CC/min: Cubic centimetre/minute; EFH: Engine flight hour; FH: Flight hour; PPM: Parts per million.