Serious incident to OY-JPJ (Cessna 650 Citation III) 3 nautical miles west of Aalborg (EKYT) on 27-5-2023

The aircraft air conditioning system comprised an Environmental Control Unit (ECU/pack), installed in the aircraft tail section, with two independent air circuits (upper and lower).

Each ECU circuit included a combined primary and secondary heat exchanger, an Air Cycle Machine (ACM) and a water separator (with coalescer bag).

The LH engine bleed air supplied the lower part of the ECU and the cockpit with conditioned air. The RH engine bleed air supplied the upper part of the ECU and the cabin with conditioned air.

Figure 1. Environmental Control Unit

A ram air duct guided ambient ram air through the heat exchangers to cool the bleed air.

The air conditioning system was electrically controlled and automatically protected against overheating by thermal switches.

Figure 2. Lower ECU airflow chart

The aircraft manufacturer’s maintenance programme (in the Aircraft Maintenance Manual (AMM), chapter 4 and 5) included the following recommendations:

• ECU detailed inspection every 400 FH (AMM task 21-50-00-220). The task included an ACM oil level check (and replenishment if necessary).
• ECU servicing every 800 FH (AMM task 12-10-01-610). The task included ACM oil replacement.

The operator’s Approved Maintenance Programme (AMP) included the above task intervals.

A technician from the operator’s Approved Maintenance Organisation (AMO) performed the ECU detailed inspection on 22-5-2023 at 14,267.3 FH (5 days, 6 flights and 10.5 FH prior to the serious incident). The technician observed that the ACM oil level was midway in the sight glass and replenished the oil level. Another technician independently inspected the task.

The technician performed the ACM oil replenishment task in accordance with the AMM by a “fill to spill” principle (adding oil until oil overflowed from the fill port) using the recommended Mobil 254 jet engine oil.

The lower ACM was overhauled in 2014 and had accumulated 1,057.1 FH and 827 flights since overhaul at the time of the serious incident.

The ACM Original Equipment Manufacturer (OEM) recommended maintenance intervals differed from the AMM maintenance intervals by the following recommendations:

• ACM oil level inspection every 100 FH.
• ACM oil replacement every 600 FH.

A lubrication placard was installed on the ACM during overhaul which included the following text:   

OIL SPEC	MOBIL JET 254 OR EQUIVALENT
CAPACITY	FILL TO SPILL
INSPECT	100 HR
CHANGE	600 HR

Figure 3. ACM lubrication placard

The ACM OEM had not published the maintenance recommendations neither in the ACM Component Maintenance Manual (CMM) nor in other published documentation.

In addition to the ACM oil level inspection, the AMM ECU detailed inspection task (AMM task 21-50-00-220, interval 400 FH) had the following description (extract):

"(3) Inspect the environmental control unit installation for security of installation, including all attaching fasteners and brackets, correct safety wiring, cleanliness, corrosion, cracks, wear, dents, signs of overheating, or other types of damage.

(4) Examine the lines and hoses for security of attachment, including all fittings, kinks, cracks, correct routing and clamping with no signs of chafes, indication of leaks, cracked fittings, and any other apparent damage."

AMM section 21-50-00 (environmental control system ‒ inspection check) included a heat exchanger inspection task. The task required replacing/cleaning a heat exchanger in case contamination reduced the air flow. The task did not include a task reference number, and the task was not part of the aircraft manufacturer’s maintenance programme.

The task had the following description (extract):

"(2) Do an inspection of the [OEM name removed] heat exchanger.

     (a) Remove the flexible ducts from the ram air inlet side of the environmental control unit.

     (b) Use a flashlight and mirror to look for dust, dirt and other particles on the heat exchanger inlet radiator fins.

     (c) Look for cracks, gouges and other damage.

     (d) If contamination of the exchanger components reduces the airflow, remove the heat exchanger. Refer to                    Chapter 21, Environmental Control Unit [OEM name removed] - Maintenance Practices.

      1  Complete the Environmental Control System Heat Exchanger Cleaning Form.

      2  If necessary, send the heat exchanger to an authorized repair facility.

     (e) Install the flexible ducts to the ram air inlet side of the environmental control unit."

The full text from both tasks in AMM 21-50-00 are presented in Appendix 1.

The aircraft manufacturer presented information about dirty heat exchangers, and their potential contribution to ACM failures, during a customer conference in 2019. The presented ECU, heat exchangers and ACMs were, however, not identical to those installed on OY-JPJ.

Slides from the presentation. See Appendix 2.

During troubleshooting on the aircraft following the serious incident, technicians discovered that the lower ECU coalescer bag was soaked with oil. An oil film covered the inside of the cockpit windshields and the glareshield.

No oil was visible through the lower ECU ACM sight glass. After removing the ACM, technicians discovered that the shaft connecting the compressor and turbine wheels was no longer centred.

A component shop performed a disassembly and inspection of the ACM. Prior to disassembly, the ACM was able to rotate, even though binding, and a light oil film covered the outside of the ACM housing.

Inside the ACM was a small amount of oil (approximately 50 millilitres (ml) ‒ normal capacity was 100 ml) and a large amount of metallic chips and debris. The bearings suffered from overheat and consequential damages. The shaft for the compressor and turbine had also suffered damages and bending deformation from overheating.

The shop concluded the main reason for the damages to be low oil level inside the ACM.

Pictures of damaged ACM parts. See Appendix 3.

The AIB consulted the ACM OEM regarding the ACM damages and findings. The ACM OEM informed that different factors might have contributed to the ACM failure. These included:

• Failure to service the ACM correctly with oil
• Carbon seal failure, leading to low oil level
• Oil contamination
• Oil blockage
• Dirty heat exchangers causing insufficient cooling and compression of the bleed air. This could cause the ACM to operate in fan surge mode which would cause damage to the ACM.

The ACM OEM informed that smoke would begin to form when Mobil 254 jet engine oil was heated to a temperature of 275° Celsius (C). The OEM also considered it very likely that this temperature would be reached in the ACM during the failure due to increased friction of the parts.

Shortly after the serious incident, a newly installed lower ACM failed on the same aircraft. The failure did not cause a smoke-in-cockpit occurrence. The only effect of the failure was a lack of efficiency of the ACM.

Following the second ACM failure, but for other reasons, the operator’s AMO technicians performed a leak check on the ECU heat exchangers. Both heat exchangers (upper and lower) failed the leak check and were sent to a component shop for repair.

The component shop receiving inspection evaluation of the ECU lower heat exchanger stated the following:

“As received visual inspection finds unit is dirty, has minor scratches, and surface wear. Unit has bent fins and dirt/debris inside”

During normal operation of the ECU system, the pressure energy of the compressed bleed air drove the turbine of the ACM.

The ACM turbine drove the ACM centrifugal compressor. The purpose was to increase the pressure and, thereby, the temperature of the bleed air before it entered the secondary heat exchanger. The higher temperature through the secondary heat exchanger (resulting in a higher temperature difference to the ram air) allowed for a more efficient cooling of the bleed air.

In case the secondary heat exchanger ram air flow was interrupted (by dirt), the bleed air would not be efficiently cooled, and bleed air temperature and, thereby, pressure would remain high before passing through the ACM turbine.

The higher air pressure of the bleed air flowing through the ACM turbine resulted in a higher-than-intended speed of the ACM turbine and compressor. The higher speed of the ACM compressor would then further increase the pressure in the secondary heat exchanger.

At a point when the bleed air pressure in the secondary heat exchanger exceeded the pressure that the ACM compressor could deliver, the ACM compressor airflow would stall and then surge (resulting in reverse airflow).

The surge would result in a reduction of bleed air pressure in the secondary heat exchanger. This allowed the ACM compressor to initially recover, before it would increase the heat exchanger air pressure again for another surge. The process would continue to repeat itself as long as bleed air was supplied, and the ACM would be operating in fan surge mode. The increased vibrations from operating in fan surge mode would result in premature failure of the ACM.

Figure 4. ACM and secondary heat exchanger in normal operation

During the AIB safety investigation, the AIB consulted the aircraft manufacturer about the maintenance procedures and the aircraft maintenance programme.

The aircraft manufacturer considered the heat exchanger inspection to be covered by the ECU detailed inspection every 400 FH.