Jump to Content

Recommendation issued to: Boeing Co

Recommendation details
Output No: R19980244
Date issued: 30 March 1999
Safety action status:
Background:

SUBJECT - NORMAL CATEGORY ROTORCRAFT FUEL FILTER


SAFETY DEFICIENCY

The ability to detect fuel contamination between the fuel tank and the engine on Boeing Rotorcraft Light Helicopter Division Model 369 and 500N has been significantly reduced because of the approved removal of the fuel filter drain valve.

Note: This aircraft was previously McDonnell Douglas Helicopter Company (MDHC) 369 and 500N.


FACTUAL INFORMATION

Occurrence 9800067

A Boeing 369D helicopter was engaged in a sling operation to lift a powerline to the top of a transmission tower. The pilot was hovering the helicopter about 60 ft above the 30 ft tower, and had just passed the powerline to the linesman when the engine experienced a total loss of power. The pilot immediately banked the helicopter to the right to avoid personnel on and below the tower, and attempted a landing in light scrub. The helicopter came to rest on its right side, incurring substantial damage, and slightly injuring the pilot.

A maintenance investigation found that the engine fuel system was contaminated with water, discoloured fuel, and particle debris. After the engine fuel system was cleaned, the engine was successfully ground-run. The helicopter had recently spent 45 hours engaged in firefighting operations in the 60 hours since the last maintenance inspection. During the firefighting operations, refuelling was routinely undertaken from an assortment of drum and mobile bowser fuel sources. Hot refuelling also accounted for a significant proportion of those refuelling operations. It is probable that the fuel system was contaminated during that period; however, the investigation was not able to conclusively prove when or how water and other contaminants entered the fuel system.

The pilot reported that he was not forewarned of a fuel filter problem and did not recall seeing the amber fuel filter differential pressure warning light during the accident sequence. The first warning light that he recalled was the red engine-out light at the time the engine failed. He explained that functional tests had been carried out on the fuel filter differential pressure warning system during the pre-flight sequence. The system had been functioning normally.


Fuel system design and maintenance requirements

The Boeing 369D fuel tanks are lined with a bladder. As bladders rarely sit smoothly and flat on the tank floor, some water may be trapped between the ripples in the bladder and consequently may not be drained from the fuel tank drain valve. In addition, the fuel system is fitted with a fuel filter differential pressure warning system to alert pilots of filter contamination and an impending bypass of the filter. The flight manual provides the following instructions regarding the fuel filter indicator:

"Amber fuel filter indicator illuminated indicates clogged filter; turn start pump on, monitor instruments and continue flight; the lighted indicator indicates that the pressure through the filter is 0.8 psi differential or more";

"Warning, after the fuel filter indicator has lighted, and following the completion of the flight in progress, additional flight is prohibited until the fuel filter has been serviced".

The fuel system filter is readily accessible for drain purposes, as the engine cowls, behind which the fuel filter is located, are easily unlatched. However, the aircraft maintenance manual provides the following warning:

"Air in the fuel system will cause a power reduction or flameout. Do a fuel system vacuum leak check and system air bleed after opening the fuel system to atmosphere and prior to releasing helicopter for flight".

This maintenance must be carried out any time that the fuel system filter is removed either for inspection or replacement. In most cases, pilots are not appropriately qualified to perform this maintenance.

The manufacturer does not call for scheduled inspection of the filter, only its replacement every 300 hours. In addition, the fuel filter housing is not transparent. Therefore, unless the fuel filter differential pressure warning system alerts the pilot to a developing problem, contamination of the filter may only be detected by dismantling the fuel filter for a visual inspection.

In this occurrence, a certificate of airworthiness was issued for the aircraft on 26 September 1997 at 2,751 hours aircraft total time in service. The fuel filter was not inspected or changed at the subsequent 100-hourly inspection on 23 December 1997, prior to the accident on 7 January 1998. The fuel filter had been in service for 160 hours.


Design and subsequent modification of the Boeing 369D fuel filter

The helicopter manufacturer was issued a Federal Aviation Administration (FAA) type certificate against Civil Aviation Regulation (CAR) 6. CAR 6.427 states that:

"a strainer incorporating a sediment trap and drain shall be provided in the fuel system between the fuel tanks and the engine and shall be installed in an accessible position. The screen shall be easily removable for cleaning".

The helicopter fuel system in this occurrence had been subsequently modified in accordance with a mandatory MDHC Service Information Notice No: HN-237, dated 26 September 1994, which approved the removal of the engine fuel filter drain valve. The FAA approved this modification in accordance with the later design requirement of Federal Aviation Regulation (FAR) 27.997(b). This regulation states that:

"there must be a fuel strainer or filter between the fuel tank outlet and the inlet of the first fuel system component which is susceptible to fuel contamination, including but not limited to the fuel metering device or an engine positive displacement pump, whichever is nearer the fuel tank outlet. This fuel strainer or filter must have a sediment trap and drain except that it need not have a drain if the strainer or filter is easily removable for drain purposes".

The manufacturer elected to remove the filter drain valve to prevent engine flameouts suspected to be the result of air entering via the firewall and filter drain valves, pooling in the filter and forming an air slug. This possibility was apparently not proven in laboratory simulation. Another manufacturer overcame the possible air slug scenario by establishing the tolerance level of the engine to air in the fuel, and installing a calibrated air bleed in the filter to remove the air safely.


Fuel system inspection requirements

Civil Aviation Order (CAO) section 20.2 refers to safety precautions before flight. Paragraph 5.1 (b) recommends that all fuel system filters and collector boxes be checked for water contamination at frequent intervals. The intent of the order is to check for the presence of water before the start of each day's flying and after each refuelling. However, CAO 20.2 paragraph 5.1 A states that "paragraph 5.1 does not apply to helicopters that are being hot refuelled in accordance with section 20.10".

CAO section 20.10 refers specifically to requirements for hot refuelling in helicopters. The note in paragraph 1A.1 states that "operators and pilots should note the provisions of paragraph 5.1 of section 20.2 of the CAO's relating to the inspections and tests for the presence of water in an aircraft's fuel system before the start of each day's flying are applicable to helicopters to which this section applies".


ANALYSIS

Quality control of fuel entering the fuel system is a valuable defence against the consequences of contaminated fuel. However, the ability of the pilot to detect contamination of the fuel system during routine inspections is an equally important safety defence. These two safety defences should not be considered mutually exclusive. Analysis of this occurrence revealed a design deficiency in Boeing 369D helicopters manufactured without, or modified to remove, the fuel filter drain valve. The removal of this drain significantly reduces the ability of the pilot to detect contamination of the fuel system in either daily or post-fuelling inspections.


Fuel system design and maintenance requirements

Water and other contaminants could have accumulated in the filter for a total of 160 hours prior to the accident. Whilst it could not be conclusively proven, it is most likely that the water contaminated the fuel system during the refuelling operations that took place during fire-fighting activities. Ash particles found in the fuel filter during the post-accident inspection are consistent with fuel contamination at that time. Further, water in the fuel that may not have drained from the tank sump drain valve, possibly because of retention in ripples in the tank bladder, may have continued to accumulate in the filter during the 15 hours subsequent to the firefighting refuelling operations.

In view of this occurrence, and the CAO 20.2 recommendation for safety precautions before flight that checks for the presence of water in the fuel filter be conducted at frequent intervals, the Bureau considers that the replacement schedule of 300 hours for this fuel filter does not meet with the intent of the recommendation. Changing the fuel filter in accordance with this maintenance schedule, and with no provision for a daily filter contamination inspection, does not provide an adequate safety defence for fuel system integrity.

The Bureau also considers that allowing the removal of the filter drain valve on this aircraft on the basis of easy removal of the filter for drain purposes, is flawed logic. Removal of the filter for drain purposes is a good feature; however such maintenance action would only normally be carried out if there were a known contamination problem. In addition, in order to prevent subsequent engine flameout, the fuel system must be bled and tested for air leaks prior to releasing the helicopter for flight. Pilots are not normally approved to perform this maintenance. None of this may be accomplished easily for any gas turbine engine installation, especially if the helicopter is operating in a remote region and in hostile refuelling conditions. Provision of a fuel filter drain would enable a pilot to readily conduct a check for contaminants, without requiring further maintenance to return the aircraft to service.


Fuel filter warning system

The pilot did not see the fuel filter differential pressure amber warning light. However, had the pilot been alerted to an impending problem by the warning light, the flight manual stated that the flight may continue. In this occurrence, there was very little warning, if any, before the engine flamed out. This accident demonstrated that the fuel filter warning light could not be relied upon to provide adequate warning of the possible consequences of filter contamination and an impending bypass. A red warning light and a requirement to land immediately may be more appropriate in order to alert pilots to take immediate precautionary action against an uncertain outcome.


Fuel system inspection requirements

Pilots reading CAO 20.2 paragraph 5.1A may wrongly assume that the paragraph 5.1 requirements for fuel system inspection before the start of each day's flying do not apply to helicopters that are being hot-refuelled. The note in CAO 20.10 paragraph 1A.1 however, states that it is applicable. This ambiguity in what is a critical safety check should be removed.

Output text

The Bureau of Air Safety Investigation recommends that Boeing Helicopter Systems review the fuel filter warning light colour and the appropriateness of the Flight Manual instructions that allow a flight to be completed after such a warning.

The Bureau simultaneously issues the following recommendations:

"R980241

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority review the design standard for rotor craft in the normal category to ensure that fuel filter drains are a requirement, particularly for gas turbine helicopters, and that they be retrospectively fitted to all affected helicopters.

R980242

The Bureau of Air Safety Investigation recommends that the Federal Aviation Administration review the design standard of FAR part 27.997 (b) to ensure that fuel filter drains are a requirement, particularly for gas turbine helicopters, and that they be retrospectively fitted to all affected helicopters.

R980245

The Bureau of Air Safety Investigation recommends that Boeing Rotorcraft Light Helicopter Division review McDonnell Douglas Helicopter Systems mandatory Service Information Notice No: HN-237 with a view to restoring the removed filter drain valves and resolving the suspected air problem by other means.

R980246

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority amend CAO section 20.2 paragraph 5.1A to accord with the note in section 20.10 paragraph 1A.1 to ensure that appropriate inspections for water in the fuel are conducted prior to the commencement of operations".

Initial response
Date issued: 07 March 2000
Response from: Boeing Co
Action status: Open
Response text:

An acknowledgement was received by phone from the Boeing Company. It did not contain any specific details by way of a response.

ATSB response:

The Bureau wrote to Boeing MD Helicopters on 15 June 2000 as follows:

A change in the colour of the advisory light may lead to an unnecessary emergency reaction by the pilot. MIL-STD-882C, Page 9, paragraph 4.4.3 , advises, "When neither design nor safety devices can effectively eliminate identified hazards or adequately reduce risk, devices shall be used to detect the condition and to produce an adequate warning signal to alert personnel of the hazard. Warning signals and their application shall be designed to minimise the probability of incorrect personnel reaction to the signals and shall be standardised within like types of system". A red capsule warning light would normally be associated with an engine out condition, loss of oil pressure, or other critical event. The utilisation of red for this capsule light could lead to an unnecessary water ditching, or other unnecessary reaction by the pilot when in fact it may be a slight contamination condition. This point not withstanding, the current flight manual procedures appear to understate the seriousness of the condition. The Boeing response to this recommendation states, "Nothing in the facts or analysis of this incident indicates that the engine failure occurred after an impending bypass condition". A search of the NTSB incident database has revealed two reports (refer NTSB Identification LAX97LA088 (occurrence date 12/1/97) and SEA97LA032 (occurrence date 16/11/96)), where two model 369Ds experienced engine flameouts due to fuel contamination without reporting impending bypass indications. Both resulted in substantial damage to the aircraft and one resulted in serious injury to the pilot. In addition, a search of the FAA Service Difficulties Reports revealed another occurrence (dated 18/4/94) of flameout, with no associated caution advisory. All incident engines revealed fuel nozzle screen collapse following contamination (filters evidently had bypassed without an indication/ advisory). A New Zealand aircraft also reported a flameout following water ingestion (refer occurrence 97/1701) 6/6/97, with associated severe damage, although caution advisory status was not confirmed. These four documented events would appear to justify the landing as soon as practical requirement. It is recommended that the flight manual be revised to state, "land as soon as practical after illumination of the impending bypass advisory". It is further recommended that Boeing review their documented database occurrences of engine flameouts (it is logical to assume more events of this type have been recorded worldwide on their fleet) where no bypass indication/ advisory was in evidence, and assess the probability of such an event on the fleet. It should be noted that in the earlier noted occurrence report, LAX97LA088, the aircraft had just completed a 100/300-hour inspection 21.2 hours before the incident (includes fuel filter replacement). This would appear to eliminate a more frequent inspection and/or replacement schedule for the filter element as a mitigating measure.

To date we have not received a response to our letters dated 18 May 2000, 14 April 2000, and 19 November 1999, which all address your response comments to our recommendations addressing issues related to the MD369D fuel system. To restate our position, we are recommending a change to the subject aircraft flight manual to revise emergency procedures in the advent of a fuel filter bypass indication.

We have received responses from all other involved agencies and parties. Your response alone remains outstanding, and as a result, our recommendation R19980244 remains classified OPEN at this time. If we do not receive a response from you on this issue in the near future, we will be forced to close the recommendation and notate that the manufacturer chose not to respond to our recommendations.

Once again we request that you please respond and provide the status of your response, or the projected completion date. A response at your earliest convenience would be greatly appreciated. As always, thank you for your assistance with this matter.

Further correspondence
Date issued: 07 July 2000
Response from: Boeing Co
Response status: Closed - Not Accepted
Response text:

MD Helicopters, Inc. (MDHI) and The Boeing Company appreciates the opportunity to review the safety recommendations contained in the reference letter. Enclosed is MDHI's response to the BASI's recommendations.

A copy of the enclosure was reviewed by Boeing and the FAA Los Angeles Aircraft Certification Office (LAACO) and found acceptable. In addition, MDHI is aware that a similar response has been submitted to the Australian BASI by FAA Headquarters in Washington D.C.

If there are any questions on the above, please let us know.

Subject: 369D Engine Fuel Filter

Reference: BASI - Australia 369D Occurrence #9800067

As a result of a power loss incident on a 369D helicopter, the Australian BASI has issued five recommendations for design changes to the 369D fuel system. Three of these recommendations are for the FAA and two are for MD Helicopters, Inc.

The purpose of this memo is to review the facts and analysis presented by BASI for this incident and provide an engineering response to the recommendations.

FACTUAL INFORMATION

The Factual Information section of the recommendation does not contain some important information that would assist in identifying the cause of this incident:

1 . Was the operator performing the fuel tank sump fuel drain and inspection required by the Pilot's Flight Manual prior to the first flight of every day? If so, was any contamination ever found?
2. Was a vacuum leak check per Boeing Publication CSP-11MI-2 Servicing and Maintenance Instructions, Section 28-00-00 performed on the engine fuel system after the incident?
3. Was the engine fuel filter differential pressure switch inspected after the incident for proper operation per Boeing Publication CSP-11MI-2 Servicing and Maintenance Instructions, Section 28-00-00?
4. Was the engine fuel filter bypass valve inspected after the incident for proper operation per Rolls-Royce Allison Publication 1OW2 250-C20 Series Operation and Maintenance, Section 73-10-01?
5. Was there any inspection of the fuel bladder installation of this helicopter to confirm and quantify the speculation that there were ripples in the bladder that could trap water?
6. Was the engine fuel control inlet screen inspected for contaminates and/or bypass condition?
7. Was the engine fuel nozzle screen inspected for contamination?

The Factual Information section should also include the fact that the 369D helicopter fuel tank has an 8 ounce drainable fuel sump, required by CAR 6.423(b), that the engine fuel system can not draw from in any ground or flight attitude.

ANALYSIS

The first conclusion reached in the Analysis section of the recommendation is that the lack of a drain valve at the engine fuel filter bowl significantly reduces the ability of the pilot to detect contamination of the fuel system in either daily or post-fueling inspections. There is no argument in the analysis that the fuel system contamination came from anywhere but the fuel tank. The tank sump is sized to contain more than all of the entrained water that could migrate out of the fuel from a single refueling. Any contamination in the fuel tank will migrate to the sump, either while on the ground because of the sloping bottom of the tank or during flight operations at different helicopter pitch attitudes regardless of "ripples" in the bottom of the fuel bladder. If not, then the contaminates are effectively trapped in the tank and can not enter the engine fuel system. If the fuel contamination was present in the fuel tank, then the daily preflight inspection required by the Pilot's Flight Manual is sufficient to detect fuel system contamination.

In this specific case, the analysis states that the helicopter was operated for 15 hours after the contamination supposedly occurred. That would presumably require at least 5 refuelings and 5 sump drains. It stretches credibility to assert that no contamination would be found in the fuel tank sump during this time but that contamination would be accumulating in the engine fuel filter. It seems more likely that fuel tank sump samples were not taken. If the required fuel tank sump drain samples were not taken during this time, then why would the operator take samples from the engine fuel filter bowl if a drain were available?

Also note that Rolls-Royce Allison 250-C20 Series Commercial Service Letter 1193, dated September 15, 1997, recommends use of the optional airframe fuel filter when operating 250-C20B engine powered aircraft from isolated locations where the fuel is stored in drums or similar extended fuel storage containers. The letter states: "The accessory filter furnishes an additional measure of safety whenever the fuel transportation and storage is less than optimal."

The second conclusion drawn by the analysis is that the engine fuel filter impending bypass amber caution light should be changed to a red warning light and that the Pilot's Flight Manual instructions following the indication should be revised from "turn start pump on, monitor instruments and continue flight' to land immediately". The reason given for this is that the pilot didn't see the amber caution light prior to engine failure due to fuel contamination. The logic apparently is that the amber light was lit, but was ignored by the pilot. The pilot's statement is reported to be that the amber light was not lit.

The engine fuel filter and engine fuel filter impending bypass indicating system are designed to allow continued flight without engine failure after cockpit indication of impending bypass. The impending bypass indication occurs when the filter differential pressure is .78,98 psid. The filter bypasses when the filter differential pressure exceeds 2 to 2.5 psid. Depending on the concentration of contaminates in the fuel, it may take a few hours to dozens of hours or more of operation after the engine fuel filter differential pressure reaches the impending bypass setting for the filter to bypass. Under no circumstances would a properly operating system fail to indicate an impending bypass prior to engine failure. This system is equivalent to having a "popout" type impending filter bypass indicator on the engine filter bowl. A popout indicator can only be inspected between flights; therefore, it must be acceptable to continue the flight after the indication occurs.

Changing the impending bypass light to red and revising the Pilot's Flight Manual to require immediate landing after an impending bypass indication is a serious step and should be considered carefully. Impending bypass indications during flight will likely occasionally happen within the fleet, depending on the quality of each operator's fuel supply. Consistently operating with moderately or heavily contaminated fuel will likely prevent the filter from lasting the 300 hour replacement lifetime. The impending bypass setting is intentionally set low enough relative to the filter bypass differential pressure that continued flight after the indication will not result in engine failure. Forcing the pilot to land immediately upon impending filter bypass indication may result in hazardous landings away from prepared landing facilities.

In this specific case, it is possible that either the engine fuel filter impending bypass indication system was inoperative or that the engine fuel filter bypass valve was either leaking or opening early. In either case, there would be no indication to the pilot of an impending filter bypass. Changing the colour of an unlit light won't make any difference.

The third conclusion made is that CAO 20.2 paragraph 5. 1 A should be clarified to ensure that daily preflight fuel system inspection requirements to apply to helicopters that are being hot -refueled. MDRI has no recommended procedures for hot-refueling of the 369D helicopter; however, the MDHI position has always been that a daily preflight fuel tank sump contamination inspection is required.

R980244

"The Bureau of Air Safety Investigation recommends that Boeing Helicopter Systems review the fuel filter warning light colour and the appropriateness of the Flight Manual instructions that allow a flight to be completed after such a warning".

MDHI's position is that the impending fuel filter bypass indication should remain an amber caution light and that the Pilot's Flight Manual should continue to allow continued flight after an impending bypass indication. Nothing in the facts or analysis of this incident indicates that the engine failure occurred after an impending bypass indication.

 
Share this page Comment
Last update 01 April 2011