Oil Fumes, Flight Safety, and the NTSB

Abstract

During its investigations into a series of ten aircraft crashes from 1979 to 1981, US National Transportation Safety Board (NTSB) officials were presented with a hypothesis that “several” of the crashes could have been caused by pilot impairment from breathing oil fumes inflight. The NTSB and their industry partners ultimately dismissed the hypothesis. The authors reviewed the crash reports, the mechanics of the relevant engine oil seals, and some engine bleed air data to consider whether the dismissal was justified. Four of the nine aircraft crash reports include details which are consistent with pilot impairment caused by breathing oil fumes. None of the tests of ground-based bleed air measurements of a subset of oil-based contaminants generated in the engine type on the crashed aircraft reproduced the inflight conditions that the accident investigators had flagged as potentially unsafe. The NTSB’s conclusion that the hypothesis of pilot incapacitation was “completely without validity” was inconsistent with the evidence. Parties with a commercial conflict of interest should not have played a role in the investigation of their products. There is enough evidence that pilots can be impaired by inhaling oil fumes to motivate more stringent design, operation, and reporting regulations to protect safety of flight.

1. Introduction

With the exception of the Boeing 787, commercial and military aircraft are designed to “bleed” (or extract) ventilation air, either off the main aircraft engine compressors or from an auxiliary compressor when the aircraft is on the ground. This hot compressed “bleed air” is then cooled, dehumidified, typically mixed with some fraction of recirculated air, and routed to the cabin and flight deck for ventilation and pressurization [1]. To greater or lesser degrees—engine oil can contaminate the compressed air, whether it migrates across engine seals, spills from an overserviced reservoir, or is vented improperly, for example [2]. The problem with this design is that a fraction of that compressed air is then bled off the engine and routed to the air conditioning system for cabin ventilation and pressurization. The “bleed air” stream is not filtered, so oil fumes from the engine can be delivered directly to the occupied zones of the aircraft.

Concerns about aircrew exposure to either suspected or confirmed bleed-sourced fumes inflight have been raised globally since the 1930s on all types of aircraft [3,4,5,6,7,8,9,10,11,12,13]. One of the early references to pilots breathing “hot oil fumes” inflight acknowledged that “the symptoms in these cases have been similar to those of carbon monoxide poisoning,” but noted that various aldehyde breakdown products are “probably the causative agents,” which the author describes as present at concentrations that are “obviously sufficient to be dangerous to safety inflight” [14] (pp. 178–180).

Within this history, there are two documents which explicitly refer to fatal accidents associated with pilot impairment caused by oil-contaminated bleed air. One of those documents refers to “several unexplained fatal crashes involving single pack, carrier-based, turbine-powered aircraft…attributed (rightly or wrongly) to contaminated engine bleed air” [15] (p. 1). In response to those crashes, the United States (U.S.) Air Force, Navy, and manufacturers apparently “initiated efforts to resolve the contamination problem” [15] (p. 1). The other document describes an investigation by the U.S. National Transportation Safety Board (NTSB) conducted in response to ten crashes on privately-operated turboprop planes, all equipped with the Garrett TPE331 engine [16]. NTSB investigators had hypothesized that “several” of the crashes could have been the result of the pilots being impaired by breathing oil fumes inflight. The suggested source of the oil fumes was a cracked front main shaft compressor carbon seal in the engine. In response, the NTSB initiated ground-based engine testing to assess what the pilots may have inhaled [16]. In conjunction, the U.S. Federal Aviation Administration (FAA) exposed test animals to oil fumes and observed the physiological effects [17]. Ultimately, the NTSB and their industry partners dismissed the hypothesis that inhaling oil fumes could have impaired any of the pilots [16]. The authors reviewed the evidence to determine if the dismissal was supported by the evidence that was available at the time. The authors also reviewed the relevant aviation regulations in the United States to consider whether they are sufficient to prevent inflight exposure to oil fumes.

2. Materials and Methods

Between August 1979 and April 1981, ten private aircraft, each outfitted with Garrett TPE331 engines lubricated with Exxon 2380 oil, crashed. The dates, location, aircraft types, and registration numbers are listed in

Table 1. Accidents investigated for pilot incapacitation.

Crash No.	Date (yyyy-mm-dd)	Location	Aircraft Type	Registration No.
1	1979-08-03	Hays, Kansas	Mitsubishi MU-2B	N208MA
2	1979-11-01	Nashville, Tennessee	Mitsubishi MU-2F	N8730
3	1979-12-21	Provo, Utah	Mitsubishi MU-2B-20	N2-OBR
4	1980-01-11	Atlantic Ocean	Cessna 441	N441NC
5	1980-02-14	Near Houston, Texas	Mitsubishi MU_2B-35	N346MA
6	1980-02-23	New Orleans, Louisiana	Mitsubishi MU-2-40	N962MA
7	1980-12-06	Ramsey, Minnesota	Mitsubishi MU-2-40	N969MA
8	1980-12-15	Richmond, Indiana	Mitsubishi MU-2B-30	N93UM
9	1981-01-07	Burns, Oregon	Aero Commander 690B	N81521
10	1981-04-22	Alpena, Michigan	Mitsubishi MU-2B-20	N9JS

, reproduced from the NTSB investigative reports [16].

The authors searched online NTSB databases for the crash reports, nine of which were fatal accidents and one of which was a serious incident. The crash reports were only available on microfilm and, because of the COVID-19 pandemic, the NTSB library which houses microfilm reports was closed. Instead, the authors were able to purchase nine of the ten crash reports through a private company (General Microfilm, West Virginia). The remaining report was unavailable. Additional details of the 10 crashes are listed in

Table 2. Additional details of ten accidents investigated for pilot incapacitation.

Crash No.	NTSB Report No.	Flight Phase, Time of Day, Weather	Pilot Age (Years), Flight Time (h)	Probable Causes/Factors (per NTSB)		No. Deaths ***
1 **	MKC79FA046	cruise, night, “clear”	34; 2168.	Forward main shaft bearing failed; improper inflight decisions; failed to obtain or maintain flying speed.		7
2	IAD80FA007	descent, night, three-mile visibility, dry, light fog	PIC age redacted; 1498. Copilot age redacted; 2521	Pilot-in-command (PIC) misjudged the distance and altitude on final approach; inadequate supervision of flight; failed to use checklist.		5
3	DEN80FA012	approach, night, “visibility was around one mile”	46; 12,833	Inadequate pre-flight preparation or planning; improper Instrument Flight Rules (IFR) operation; misjudged altitude; Pilot could not find runway; aircraft came to rest in water.		2
4 *	IAD80AA018	descent, night, check	47; 8000		Miscellaneous, undetermined; unable to obtain a response from crew; uncontrolled descent; aircraft came to rest in water.	3
5	FTW80FA042	approach, evening, two-mile visibility, rain showers	45; 12,500	Improper IFR operation; altimeter setting incorrect.		4
6 **	FTW80FA048	approach, morning, 0.25-mile visibility, fog	51; hrs. not reported	Improper IFR operation; crashed into water.		7
7 **	CHI81FA010	approach, afternoon, “good” weather	54; 4949	Failed to obtain/maintain speed; icing conditions, including sleet, frozen rain, etc.		5
8	CHI81FEG03	approach, night, dense fog	59; 10,587	Improper IFR operation; icing conditions, including sleet, frozen rain, etc.		0
9 **	SEA81FA015	approach, afternoon, overcast, 15-mile visibility, wind calm	32; 2177	Miscellaneous/undetermined; uncontrolled collision with ground/water.		2
10	CHI81FA051	approach, night, two-mile visibility, light rain, fog	53; 16,766	Improper IFR operation; crash on final approach, 1.6 miles short of runway; cause unknown.		3

* Microfilm report was unavailable for crash #4. ** Details in the reports for crash #1, 6, 7, and 9 are consistent with engine oil fumes as a contributory factor. Additional details are provided in Table 5. *** In all but crash #8, everyone onboard was killed. In crash #8, the pilot and one of two passengers were injured.

.

The authors researched the design of the Garrett TPE331 engine and the associated potential for bearing and seal failures which could cause oil fumes to contaminate the bleed air supply.

The authors reviewed the NTSB investigative report which described the results of bleed air quality engine testing for selected oil-based contaminants in the bleed air supplied by a Garrett TPE331 engine with and without oil contamination [16]. The test protocol had been designed to “investigate the hypothesis that toxic or anesthetic gases could be generated from engine oil that leaked into the engine airflow through a broken seal and that these gases might adversely affect the crew’s capacity to control the aircraft during critical phases of flight” [16] (p. 8). Key features of the bleed air tests are listed in

Table 3. Key features of engine bleed testing, per the NTSB investigative report [16].

Test No.	Carbon Seal Intact or Missing?	Oil Added to Bleed Air?	Glass Filter in Bleed Air Line?	Reflects Potential Onboard Conditions?
1	intact	No	yes	no
2	intact	No	yes	no
3a–3f	intact	yes; 2–12 lb/hr	yes	no
3g	intact	No	no	no
4	intact	No	yes	no
5a	missing	No	yes	no
5b	missing	yes; “dirty start”	yes	no

.

The authors reviewed the relevant aviation regulations for U.S.-registered aircraft operated on routine commercial flights (

Table 4. U.S. aviation regulations relevant to air quality on routine commercial flights.

Regulation	Design/Operation	Description
14 CFR § 25.831(b) * “Ventilation”	Design	“The aircraft air supply system must be designed to ensure that crew and passenger compartment air [is] free from harmful or hazardous concentrations of gases or vapors.”
14 CFR § 25.831(b)(1)“Ventilation”	Design	The carbon monoxide concentration in the cabin and flight deck supply air must not exceed 50 ppm.
14 CFR § 25.1309(c) “Equipment, systems, and installation”	Design	“Warning information must be provided to alert the crew to unsafe system operating conditions, and to enable them to take appropriate corrective action. Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors which could create additional hazards.”
14 CFR § 121.703(a)(5) “Service difficulty reports”	Operation	Airlines “shall report the occurrence or detection of each failure, malfunction, or defect concerning…[a] aircraft component that causes accumulation or circulation of smoke, vapor, or toxic or noxious fumes in the crew compartment or passenger cabin during flight.”
14 CFR § 121.705“Mechanical interruption summary report”	Operation	Airlines shall report each “interruption to a scheduled flight,” such as a diversion, cancellation, or tail swap, caused by known or suspected mechanical difficulties or malfunctions that are not required to be reported under the 14 CFR § 121.703.
FAA Order 8020.11D (Chapter 6 and FAA Form 8020-23)	Operation	Airlines shall report accidents and occurrences which are associated with the operation of an aircraft and affect (or could affect) the safety of operation, including smoke/fumes.

* Note that “14 CFR” refers to the Code of Federal Regulations Title 14 which are aviation and aerospace regulations published by the FAA for U.S.-registered aircraft. The symbol “§”is shorthand for “Part” when referring to U.S. regulations. The relevant regulations include “Part 25” (Airworthiness Standards: Transport Category Airplanes) and “Part 121” (Operating Requirements: Domestic, Flag, and Supplemental Operations).

). Globally, aviation regulations are harmonized, so most of these regulations are the same in other countries. This is especially true for design and construction-related regulations which are classified under Part 25 of the Federal Aviation Requirements in the United States and as CS-25 (Certification Standards) in Europe, published by the European Union Aviation Safety Agency (EASA).

Finally, the authors reviewed some proposals to implement engineering and operational control measures intended to prevent exposure to oil fumes on aircraft.

3. Results

3.1. Accident Reports

For nine of the ten aircraft crashes, the authors were able to obtain the NTSB investigation reports (Table 1 and Table 2). The microfilm report for crash number 4 was unavailable. Of these nine crashes, eight were fatal accidents (35 people were killed) and one (crash number 8) was a serious incident (the pilot and one of the two passengers were injured). Details in the accident reports for crash numbers 1, 6, 7, and 9 (Table 1 and Table 2) suggest that oil fumes were either a contributory or casual factor (

Table 5. NTSB accident report details consistent with exposure to oil fumes.

Crash No.	Description of Crash Conditions
1	The NTSB report describes how, when the pilot was en route, at what may have been top of climb, the pilot “reported a loss of oil pressure in the right engine.” At the same time, “the pilot reported smoke and fumes in the cabin.” A few minutes later, the pilot reported that he had shut down the right engine. He then stopped communicating with air traffic control and crashed into a field without putting the landing gear down (per witness reports). The subsequent teardown of the right engine “revealed that the forward main shaft bearing had failed.”
6	The NTSB report describes how, on approach, the pilot stopped responding to air traffic control. The aircraft descended into a lake and “all aboard perished.” The report goes on to say that “[d]uring the course of the investigation, it was reported by various persons that the aircraft had a history of smoke, fumes, and carbon monoxide collecting in the cockpit and cabin area...Examination of the interior of the subject aircraft environmental control system revealed an oily residue in the portion which is supplied by the left engine [with a history of a cracked carbon seal] while that supplied by the right engine was clean.”
7	The NTSB report describes how, on approach, the pilot did not respond to air traffic control instructions. Witness reports described how the aircraft came out of the clouds spinning with the nose down and crashed into a field. In the engine tear down report, there were references to “black dirt deposits found throughout the entire gas path of the engine… [including] the bleed air ports…” The NTSB report stated that the pilot had failed to obtain/maintain speed and the cause of the crash was unknown.
9	The NTSB report describes how ground witnesses observed the aircraft flying away from the airport maneuvering erratically. The aircraft crossed a highway, pitched up steeply, fell, and crashed. The engine tear down was “to determine the condition of the carbon seal and bearing located between the compressor section and gearbox section.” The report concluded that “one carbon seal, due to the discoloring of the oil slinger, was leaking some oil past the face.“ The report also noted that “Bonneville Power maintenance personnel felt the amount of leakage was insignificant,” but the basis for their claim and their qualification to make it were not provided.

).

In addition to the four crashes described in Table 5, crash numbers 5 and 10 (Table 1 and Table 2) include details which could be related to oil fumes, although the significance of those details is less clear. Specifically, the NTSB report for crash number 5 describes how, without warning, the aircraft crashed into the trees near the runway on final approach. Another pilot who observed the crash stated: “We feel that the pilot of the MU-2 got disoriented and just flew the airplane into the ground.” The autopsy report for the pilot reported 5% carboxyhemoglobin in his blood. The NTSB report for crash number 10 describes how the aircraft crashed on final approach, after which the engine manufacturer performed the engine tear down to determine if oil fumes played a role in the crash. The manufacturer concluded that there was “no indication” of anything other than normal engine operation and they attributed the engine compressor carbon seal damage to impact. The Civil Aeromedical Institute (CAMI) toxicology lab (the research arm of the FAA) tested a component of the air supply system from the aircraft and found a “trace quantity of petroleum base constituent,” although the significance of that finding is not clear.

3.2. Description of the TPE331 Engine and Seal Assembly

The Garrett TPE331 is a fixed-shaft constant-speed turboprop engine (Figure 1). Its gas turbine consists of a compressor, combustion chamber, and turbine. Ambient air is directed to the compressor section through the engine inlet. A two-stage centrifugal compressor increases air pressure and directs it to the combustion chamber. In the combustion chamber, fuel is added to the air through the fuel nozzles. On engine start-up, the gas mixture is ignited by igniter plugs. In a normal operation the igniter is not in use because the combustion is self-sustained. The hot and high-velocity combustion gases flow through the turbine rotors, where the energy of the gases is converted to torque exerted on the main shaft (A in Figure 1). The reduction gear is designed as a planetary gear on the propeller shaft (B in Figure 1). It converts the low torque (at high rpm) of the main shaft to high torque (at low rpm) on the propeller shaft and drives the propeller. The combustion gases leave the turbine to the atmosphere via the exhaust.

The TPE331 is called a fixed-shaft engine because the propeller is firmly connected to the gas turbine. The constant-speed engine maintains its speed by a governor on the propeller. The propeller shaft rotates at a constant speed of 1591 rpm in cruise flight. The main shaft of the engine rotates at a constant speed of 41,730 rpm. Power changes are made by increasing the fuel flow (which increases the torque) rather than the engine speed.

Most of the air (70%) passing through the engine provides internal cooling. Only about 10% of the air that passes through the engine is actually used in the combustion process. Up to approximately 20% of the compressed air may be bled off for the purpose of heating, cooling, cabin pressurization, and pneumatic systems [18], which appears to be within the average range for other engine types [2]. If the bleed air is contaminated with oil fumes, then the air in the cabin is also contaminated. Normal bleed air pressure is approximately 157 psi (10.82 bar) and the temperature is 360 °C in cruise flight [16].

The engine shafts are supported by rolling bearings. The compressor bearing (1 in Figure 1) is a ball-bearing (Figure 2). The same is true for bearings 2 and 3 in Figure 1.

The engine cutaway drawing is given in Figure 3 and a detail of that picture enlarged is given in Figure 4.

In the TPE331 front main shaft compressor seal assembly, two seals are used, acting in series. They prevent the escape of the engine lubricant present in the reduction gearbox via the main shaft and through the compressor bearing into the compressor (Figure 4). The following detailed explanations are reproduced with text elements from [16]:

“First, a mechanical (carbon) seal is provided to prevent leakage if operating oil pressures exceed normal pressures and to prevent potential leakage that might occur during engine shutdown. The mechanical seal potentially is subject to wear and damage” [16] (p. 2). “When the engine is shutdown, oil drains from the engine walls which increases the oil level above the shaft installation level of the compressor front main shaft; without a mechanical seal, the oil would leak from the reduction gearbox, out the engine inlet and onto the ground. Therefore, a mechanical (carbon-element) seal is necessary to prevent oil leakage when the engine is not operating” [16] (p. 33). This is illustrated in Figure 5.

“Secondly, the TPE331 has a pressurized knife-edge labyrinth air seal that is specifically designed to prevent passage of air/oil mist from the reduction gearbox into the compressor chamber during engine operation” [16] (p. 2). “This pneumatic-type seal is pressurized to approximately 26 psi (1.79 bar) at the inner knife edges. When the engine is operating, the pneumatic seal is independently capable of preventing the air/oil mist from passing out of the reduction gearbox because of a flow of pressurizing air from the seal into the reduction gearbox. However, the labyrinth seal has no sealing capability to prevent engine oil from exiting the reduction gearbox when the engine is not operating and, therefore, requires a mechanical seal to prevent oil leakage when the engine is shut down. The symptom of a failed mechanical seal is oil leaking past the labyrinth seal and running out the engine inlet onto the ground when the engine is not operating” [16] (p. 35). The bleed air passage directs sealing air from the compressor to the labyrinth seal. All of this is illustrated in Figure 6 and additional details are shown in Figure 7.

“The pressure balances that are maintained may be clearly understood by considering that the chamber containing the air/oil mist operates at approximately 12 psia (−2 psig) while the center of the labyrinth is pressurized to 26 psia (+12 psig). Since air will always flow from a higher pressure area to a lower pressure area, air will flow outward from the center of the labyrinth. Each of the knife-edges operates with only slight clearance from the outer wall, resulting in a high local velocity as the air crosses into the next chamber. With a high local velocity, the air/oil mist cannot flow past the knife edges and enter the compressor air flow” [16] (p. 36). This is illustrated in Figure 7.

“In addition to the labyrinth seal, there are two other pneumatic sealing actions incorporated in the oil containment design of the TPE331 engine… [First, there is] a negative pressure of approximately 2 psi inside the reduction gearbox with respect to atmospheric conditions. This is accomplished by pumping the oil out of the reduction gearbox at a rate twice that at which it is being pumped in. (Nine gallons per minute in, versus 18 gallons per minute out.) The extra nine gallons pumped per minute is air and this creates a negative pressure (slight vacuum) in the reduction gearbox. If the mechanical seal should fail, the overscavenging will draw air into the reduction gearbox and will prevent the air/oil mist from flowing out… Secondly the negative pressure effect is supplemented by raising the pressure in the chamber on the air side of the mechanical seal to a positive six psi above ambient” [16] (p. 36). This higher pressure is produced by the centrifugal compressor.

3.3. Bleed Air Testing

In July 1981, the NTSB and a team of government and industry partners formed an “Ad Hoc Investigative Committee” to respond to the hypothesis that oil fumes could contaminate pilots’ breathing air through the main shaft compressor carbon seal in the Garrett TPE331 turboprop engine. All the crashed aircraft flew with this engine type. The team proposed to measure selected gaseous contaminants (carbon monoxide, carbon dioxide, nitrous oxides, and total hydrocarbons) in the bleed air produced by that engine type. The goal was to attempt to reproduce the conditions on the crashed aircraft to determine whether the pilots could have been subjected to toxic or anesthetic gases sufficient to impair their ability to operate the aircraft.

Because oil leakage through the carbon seal was the suspected source of oil fumes in the bleed air, selected gaseous contaminants were measured in the bleed air downstream of the compressor, first through an intact seal and second with the seal removed (considered worst-case), during conditions that ranged from no oil to 12 pounds of oil per hour (lb/hr).

The sampling methods were developed by the Exxon Research and Engineering Company and the test conditions, summarized in Table 3, were performed on an engine test stand at the Garrett Turbine Engine Company. During two of the tests, oil mist samples were also collected and analyzed. Largely though, gases were sampled because the investigators “expected that particulate matter would not form” [16] (p. 9).

3.3.1. Primary Bleed Air Testing Conditions

The key features of the 12 primary engine bleed testing conditions, as described in the NTSB report [16] are summarized in Table 3. Additional salient details of the engine bleed testing are summarized in

Table 6. Description of TPE331 engine bleed testing, per NTSB report [16].

Trial No.	Description of Sampling Conditions
1–2	These two trials were intended to characterize background levels of contaminants in the bleed air stream. The engine compressor carbon seal was intact, and a glass wool filter was installed in the bleed line. Moreover, oil was not purposefully injected into the bleed air stream.
3a–3f	These six trials were intended to characterize levels of oil-based contaminants in the bleed air stream through an intact engine compressor carbon seal and a glass wool filter. Oil was injected into the bleed air stream for 90 min at a rate of 2–12 pounds per hour while the bleed air was sampled for carbon monoxide, carbon dioxide, nitrous oxides, and hydrocarbons.
3g	This trial was intended to characterize levels of oil-based contaminants in the bleed air stream through an intact engine compressor carbon seal but without a glass wool filter in the bleed stream. The tester injected oil for 15 min, during which time the same gaseous bleed air measurements were made.
4	This trial was intended to simulate the potential for worst-case bleed air contamination by removing the engine compressor carbon seal. Of note, though, a glass wool filter was installed in the sampling line and no oil was injected.
5a	During this trial, the tester did not collect measurements but ran the engine for 10 min and then shut it down to prepare for a “dirty start” in the following test.
5b	During this trial, the engine underwent a simulated “dirty start” which involved internal oil ingestion. The tester measured the concentrations of carbon monoxide, carbon dioxide, nitrous oxides, and hydrocarbons for the first 10 min after the engine was started.

.

3.3.2. Additional Engine Bleed Air Testing

During two of the oil injection tests (3c and 3f), the tester collected oil mist samples on “membrane filters” which were subsequently analyzed for tricresyl phosphates. The authors of the report noted that no “para or ortho isomers” of tricresyl phosphate were present above the detection limit [16] (p. 24), although the authors did not define the detection limit or mention the concentrations of meta and mixed meta/para isomers which comprise more than 99% of commercial blends [21].

During tests 1–3, carbon sorbent tubes and impingers were used to collect samples that were subsequently analyzed by GC-MS [16]. The authors stated that these “analyses performed by the Environmental Protection Agency (EPA) [lab]… did not lend themselves to meaningful interpretation because of apparent contamination of the samples and lack of parallel quantitation of known compounds…” [16] (p. 27). Still, the authors affirmed that “based on the analyses, there was no significant toxicological gaseous content of the TPE331 engine bleed air…” [16] (p. 27). The authors also referred to the presence of “a number of compounds in the bleed air under various conditions of the test protocol,” but described occupational exposure limits as protective for workers. The report noted that, by comparison, “the concentration of those substances [measured by the EPA] appears to be at such a low level as to cause no acute degradation of pilot performance” [16] (p. 66). Specifically, the authors stated that “it is apparent that toxic effects to aircraft crewmembers would only result from breathing air contamination of sufficient concentrations to cause acute effects” [16] (p. 66).

3.4. Regulations

Aircraft regulations stipulate that the cabin and flight deck ventilation supply systems must be designed to provide air that is “free from harmful or hazardous concentrations of gases and vapors” (14 CFR § 25.831(b)), which includes no more than 50 ppm of carbon monoxide and 5000 ppm of carbon dioxide (Table 4). Moreover, crews must be provided with “warning information” to alert them to unsafe conditions and enable them to take “appropriate corrective action” (14 CFR § 25.1309(c)) (Table 4). To date, though, these regulations have not been applied to monitor contaminants in the cabin air and alert pilots to the presence of oil fumes.

In addition to the design regulations, U.S. airlines are required to comply with three FAA reporting regulations for fume events (Table 4), but all are underutilized [22].

4. Discussion

4.1. Accident Reports

In the investigated crashes (Table 1), eight of the ten aircraft were Mitsubishi MU-2 aircraft. The Mitsubishi MU-2 is a twin-engine turboprop aircraft with a pressurized cabin (Figure 8). The aircraft is known for its difficult handling and high rate of accidents, including fatal accidents [23]. Crash numbers 7 and 8 with this aircraft were in icing conditions which may be relevant, given an Australian Bureau of Air Safety Investigation report on two fatal crashes on MU-2 aircraft, both of which were also in icing conditions [24]. However, even for the 1988 and 1990 fatal crashes in Australia, “icing on the airframe” was only listed as the “probable” cause and, for one of those two crashes, pilot fatigue was also referenced extensively. Thus, the reference to icing conditions in crash 7 in this investigation should be acknowledged but does not rule out cabin air contamination, either as a causal or contributory factor.

Regarding the remaining two crashed aircraft (Table 1), one was a Cessna 441 Conquest II and the other was an Aero Commander 690B. As with the MU-2, each of these is a turboprop aircraft with a pressurized cabin.

In at least four of these ten crashes, there are details which are consistent with impairment caused by oil fumes (Table 5). For each of the crashes, the NTSB identified “probable causes” (including “undetermined”), all of which are reproduced in Table 2. In many cases, though, the “probable cause” is more of a description than an explanation. The real question is, why? Why did the pilot in command “misjudge distance and altitude” or “fail to obtain/maintain speed”? Why was air traffic control “unable to get response from crew”? Was it because these pilots were distracted or fatigued, or were they impaired by fumes?

It is tempting to blame crashes on “pilot error,” typically attributed to either to inexperience or fatigue. Regarding inexperience, the flight time for the pilots on the crashed planes ranged from 1498 to 16,766 h (average 7999) (Table 2). One analysis estimated that, during the time of these crashes, turboprop pilots logged an average flight time of 528 h per year [26], so if the pilots on the crashed planes reflect this average, they are not novices. Regarding fatigue, the accident reports did not consistently cite either each pilot’s total flight time specific to the aircraft type they crashed or the number of hours they flew during the 24 h prior to the accident flights. As a result, the impact of pilot fatigue cannot be assessed.

The authors of this paper are unaware of other challenges to the basis for the claims in the NTSB report [16] that it is not possible for oil fumes to either have contaminated the bleed air on these aircraft or to have played any role in any of these accidents.

Theirs is not the first report, however, to either overlook or downplay the flight safety implications of breathing oil or hydraulic fluid fumes. For example, one published case study investigated the findings of six documented fume event investigations and identified specific oversights and misconceptions about the potential for oil to contaminate the bleed air, as well as a tendency to dismiss the crew-reported symptoms as stress reactions [27]. Another investigation described an event during which pilots reported a blue haze shortly after reaching cruise altitude, prompting a precautionary landing [28]. The initial ground-based engine runs failed to identify any fault. Only additional (and non-standard) high-power engine runs identified the source of fumes—a fractured bearing seal in the compressor. This is important because high-power runs were not part of the fault-finding procedure endorsed by the aircraft manufacturer.

Another investigation described how both pilots reported fumes during approach and felt dizzy and nauseous, with irritated eyes and throat [29]. The pilots donned oxygen and requested priority landing clearance. The auxiliary power unit (APU) was not operating during the approach phase, so it was not investigated as a potential source of oil contamination. However, the aircraft manufacturer has published bulletins alerting airlines that, when the APU is in use, oil fumes can contaminate the downstream environmental control system and ducting, and fumes from that initial contamination can continue to manifest inflight, even when the APU is not in use [30]. Still, the APU was not checked, and the investigation was inconclusive; “no explanation” for either the fumes or the symptoms was found.

In 2020, the French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA) investigated a serious incident on a commercial flight during which the pilots reported a strong, acrid odor accompanied by irritant symptoms during taxi, shortly after the APU had been turned on [31]. During the climb out, both pilots reported dizziness, among other symptoms. They eventually donned oxygen masks and diverted to the nearest airport. Although the details are consistent with breathing bleed-sourced oil fumes, maintenance inspections did not identify an obvious mechanical failure. As a result, the accident investigator concluded that the incident—including fumes, persistent symptoms, and a diversion—was most likely caused by the pilots inhaling “an excessive quantity of carbon monoxide.” Failing to find a more plausible explanation, the accident investigators hypothesized that the source of the fumes may have been engine exhaust from a small business jet as it taxied about 80 m away from the incident aircraft in the presence of a “calm wind.” However, the report added that it “cannot be excluded that the crews were intoxicated by another substance.” This incident highlights the value of installing and operating sensors onboard, both to provide real-time information to the pilots and assist maintenance in subsequent troubleshooting.

Other than its investigation into these ten turboprop crashes in 1979–1981, the NTSB has not weighed in on the flight safety implications of pilots inhaling oil-contaminated bleed air inflight. This is contrary to its counterparts in Australia [32,33], Germany [4], Iceland [34], Ireland [35], New Zealand [36], Spain [5], Sweden [37], Switzerland [7], and the UK [3,6], for example. Each of those safety boards has investigated one or more commercial flights involving pilots whose inflight impairment compromised flight safety and has concluded that breathing contaminated bleed air either likely or definitively played a role. The NTSB does require airlines to report onboard fume/smoke events, but only if either the aircraft sustained structural damage or if specific health impacts were reported by one or more occupant (49 CFR § 830.2). However, oil fume events that meet the NTSB reporting criteria have not been investigated.

4.2. Bearing and Seal Failures in the TPE331 Engine

The description in [16] of the two seals in series contains some contradictions. According to the explanation, the carbon seal is necessary because “when the engine is shutdown, oil drains from the engine walls which increases the oil level above the shaft installation level of the compressor” [16] (p. 33). The labyrinth seal is necessary because the carbon seal is potentially “subject to wear and damage” [16] (p. 2). So, if the carbon seal is worn or damaged, then the oil will flow out of the reduction gearbox into the compressor and contaminate the cabin air when the engine is next started up. This situation was investigated in test 5 [16].

It is known that all seals leak in small quantities [38]. Pressure differentials assumed by the manufacturer may not be present in failure cases. Moreover, pressure differentials may not be sufficient during rapid thrust reduction or at idle thrust. In test 4, it was assumed only that one of the two seals in series (the carbon seal) would have failed. The labyrinth seal was left intact. Certainly, a mechanical failure that causes the carbon seal to fail may also cause the labyrinth seal to fail at the same time. For example, a failure of the main shaft compressor bearing could cause the main shaft to vibrate or rotate eccentrically which could severely damage (or even destroy) both seals.

In addition to crash number 1 (Table 5), an TPE331 compressor bearing failure which caused the engine to fail was documented by the Australian Transport Safety Bureau (ATSB) [39], although without either fatalities or reference to oil fumes. That report described the history of compressor bearing failures on the TPE331 engine which peaked in the early to mid-1980s. Garrett attributed the compressor bearing failures to propeller strikes and subsequently revised the engine maintenance manual, which—by the 1990s—reduced the number of failures. In the accident investigated by the ATSB, when the compressor bearing failed, the bearing cage fractured which caused the balls to come loose. Such loose components can collide with and cause damage to numerous internal rotating engine components, including the compressor seals.

4.3. Bleed Air Testing

Regarding the engine bleed air testing reported by the NTSB [16], the conditions in trials 1–4 did not represent the conditions of concern on the crashed aircraft because the engine compressor carbon seal was intact and, in all but one case, the air was filtered for vapor and particulate. No measurements were collected during trial 5a. Regarding the relevance of conditions tested during trial 5b, on the one hand, the bleed air would have contained oil from the dirty engine start, but it is not clear if this is the same volume and pattern of oil as with a faulty engine compressor carbon seal inflight. Moreover, the bleed air had been passed through a glass wool filter for vapors and particulate, unlike on the crashed aircraft. Finally, it is not clear if the temperatures in the test stand compressor reflected inflight conditions.

It is important to carefully consider the question of the temperature in the engine compressor on these crashed aircraft. In its report, the NTSB referenced some certification data collected by a major engine manufacturer after injecting oil into a large turbofan engine. The tests showed that that carbon monoxide formation was detectable starting around 316 °C [16] (p. 7). The report also notes that TPE331 engine has a standard compressor discharge temperature of 360 °C [16] (p. 6) with a maximum temperature of 386 °C [16] (p. 25). The compressor temperature was high enough for carbon monoxide to be generated in the presence of oil, but the authors claim that the concentration of carbon monoxide would have been too low to cause impairment [16] (p. 2). The authors also rule out the presence of other oil decomposition products (such as acrolein) sufficient to irritate the mucous membranes by noting that “a number of participants sniffed the bleed air lines …[and] no one described an acrid or irritating quality”; [rather] “the consensus was that the odor was that of a warm oil, not a decomposed oil” [16] (p. 27).

In a companion study, CAMI researchers exposed test animals to Exxon 2380 oil for seven hours without, what the NTSB called, “any immediate or delayed behavioral change” [16] (p. 28). The CAMI report does describe an experiment with rats and chickens exposed to aerosolized (but unheated oil) in which the animals seemed unaffected [17] (p. 14). However, in the same study the CAMI researchers reported that, when the engine oil was heated, carbon monoxide started to form at 306 °C and when rats in one trial were exposed to oil fumes heated to 350 °C for 30 min, “it was obvious that the animals were approaching incapacitation” [17] (p. 8). Moreover, when the temperature was further increased, the animals “expired.” Unlike the rats, the pilots on the crashed planes would have inhaled oil fumes in a reduced pressure environment with a corresponding reduction in the partial pressure of oxygen in the ambient air.

More recent sampling data has highlighted the presence and potential health impact of elevated levels of ultrafine particles in the bleed air supplied to the cabin and flight deck on commercial aircraft [40,41,42,43,44]. As noted above, the authors of the NTSB report assumed that “particulate matter would not form” [16] (p. 9), and so did not assess any associated toxicity.

4.4. Regulations

In the 1960s, a report from an aircraft manufacturer (Douglas Aircraft Corporation) describes the need to “show that the level of contamination required for olfactory warning is well below the generally accepted tolerance limits for the toxic materials produced” [15] (p. 3). In 1960, U.S. aircraft manufacturers would have been required to demonstrate to the U.S. Civil Aeronautics Board (which predated the FAA) that aircraft systems were designed to provide ventilation air “free from harmful or hazardous concentrations of gases or vapors”, which included (but was not limited to) the carbon monoxide concentration not exceeding 50 ppm [45]. Presumably, this is what motivated Douglas Aircraft Corporation to propose testing to demonstrate that, “under all possible oil leakage rates,” olfactory warnings would give pilots sufficient time to “permit effective crew countermeasures.” [15] (p. 3). Essentially, tests needed to show that pilots would smell oil fumes before they would be impaired, proving that the presence of oil-based contaminants in bleed air was safe.

Since then, many studies and reports discuss the presence of airborne contaminants in cabin air and comment on whether the levels are “safe” or “acceptable” [40,46,47,48]. “Acceptability” has more commonly been framed in the context of comparing aircraft data to published exposure limits for individual chemical constituents [16,40,49,50], although this approach is not without criticism [51,52].

The quest to define “safe” or “acceptable” concentrations of oil-based compounds is likely borne from the need for industry to comply with the regulation that the aircraft supply system be designed to supply air that is “free from harmful or hazardous concentrations of gases or vapors” (14 CFR § 25.831(b)). If something is acceptable—if it is not harmful—then the design meets the regulation. Interestingly, though, the FAA does not define “harmful or hazardous” beyond its limits for carbon monoxide (14 CFR § 25.831(b)(1)) and carbon dioxide (14 CFR § 25.831(b)(2)) and it had not done so in the early 1980s either. Applying published exposure limits for individual chemicals to complex mixtures [53] (Appendix 10) is problematic [54], especially in a reduced pressure and safety-sensitive environment [52]. This is in part because exposure limits do not exist for every constituent in these mixtures and the various constituents have a variety of toxicity endpoints. Moreover, the diversity of exposure limits published by different authorities for a single chemical illustrates the fallacy that a single number can define the boundary between what is and is not acceptable. In the case of the FAA, their limits for carbon monoxide and carbon monoxide are as high—or higher—than published chemical exposure limits for ground-based application. So, given this gap in the regulatory framework, in 1981, the NTSB and their industry colleagues defined “safety” for themselves—not in the context of certification regulations, but in the context of whether pilots could have been impaired.

The authors of the 1984 NTSB report acknowledged that carbon monoxide would be generated when oil was purposefully introduced into the compressor section of the TPE331 engine, but they noted that it should be “well below permissible limits in the bleed air” [16] (p. 2). However, the permissible exposure limit for carbon monoxide is not a useful benchmark for safety. An applied research study into the effects of exposure to carbon monoxide inflight concluded that “the maximum permissible concentration of carbon monoxide in pressurized passenger airplane cabins should be 0.01 mg/liter,” which is equivalent to 8.7 ppm [55]. By comparison, the permissible aircraft design limit for carbon monoxide is 50 ppm (14 CFR § 25.831(b)(1)) which is, inexplicably, as high, or higher than ground-based limits. This, even though it is primarily applied in a reduced pressure environment (14 CFR § 25.841(a)) with a corresponding reduction in the partial pressure of oxygen available to occupants. Safety of flight depends on pilots’ alertness and reaction time which can be compromised by exposure to asphyxiants, such as carbon monoxide [56]. Moreover, aircraft occupants have no means of egress once the doors are closed, such that an additional safety factor regarding exposure to carbon monoxide is warranted. Finally, carbon monoxide is only one element of a complex chemical mixture.

4.5. Exposure Control Measures

Just as the flight safety implications of breathing oil and hydraulic fluid fumes have been well documented, the need for control measures has also long been recognized. In 1966, an aircraft manufacturer reported that, in response to the evidence that contaminated bleed air could have caused some fatal crashes, the Navy required that crewmembers breathe 100% oxygen from takeoff to landing [15]. In 1955, an engineer with North American Aviation described the outcome of a two-year investigation into engineering solutions to prevent bleed air contamination, recommending either a separate compressor or a bleed air filter [57]. In response to one oil fume event during the descent phase of a commercial flight, the UK Air Accidents Investigation Board recommended that the FAA and EASA “consider requiring” a system to warn pilots about the presence of “smoke or oil mist in the air delivered from each air conditioning unit” [58]. Engineering and operational measures continue to be called for, including bleed air filtration, sensors to provide early warning of airborne contaminants, improved maintenance procedures, more targeted troubleshooting procedures, relocating the air inlet for the auxiliary power unit, and airline worker training and education [59,60].

5. Conclusions

Between 1979 and 1981, NTSB investigators suggested that inhaling oil fumes inflight may have been a causal factor in “several” fatal crashes of turboprop aircraft. In response, the agency partnered with the very companies that had a commercial interest in the outcome of the investigation. Aside from noting the potential for some people to develop “extreme chemical sensitivity” [16] (p. 28) to chemicals in oil fumes, the NTSB and their industry partners soundly dismissed the hypothesis that oil fumes may have impaired some of the pilots on the crashed planes, affirming that it was “completely without validity” [16] (p. 3). However, their conclusions are not supported by the evidence for three key reasons.

First, it was not—and is not—possible to draw any definitive conclusions regarding the cause of these crashes because real-time bleed air testing and suitable post-mortem blood analyses were not available. However, the accident reports for four of the fatal crashes on these turboprop aircraft include details consistent with (and suggestive of) the pilots being impaired by oil fumes (Table 5). Moreover, this is consistent with similar concerns and reports of pilot impairment documented since the 1930s, such that “pilot error” and “undetermined” are insufficient explanations. Without air supply monitoring equipment to provide real-time warning, and without options for a blood test to investigate inhalation of oil fumes, aircraft crashes that are attributable to bleed air contaminants will not be recognized as such.

Second, none of the tests of ground-based bleed air measurements of a subset of oil-based contaminants generated in the engine type that had been on the crashed aircraft reproduced the types of inflight conditions that the accident investigators had flagged as potentially unsafe (Table 3 and Table 5). Specifically, the engine test stand conditions did not assess the impact of oil seeping through a cracked or otherwise damaged compressor seal on the quality of unfiltered bleed air downstream. As a result, the bleed air testing results are not relevant to the question of whether oil fumes could have impaired the pilots inflight. As such, the argument that they somehow discount the potential for impairment is invalid.

Finally, to interpret the bleed air data they collected, the authors of the report used published exposure limits as a benchmark for whether the concentration of gaseous compounds in oil fumes would have been sufficient to cause pilot impairment. However, published exposure limits are not appropriate for assessing the risks associated with inhaling a complex mixture of compounds in an enclosed and reduced pressure environment.

The significant concerns raised by these crashes and the history of pilot impairment associated with breathing oil fumes all support more stringent design, operation, and reporting regulations to protect safety of flight.

6. Recommendations

• For current aircraft that are equipped with bleed air systems, engineering control measures such as sensors and filters should be mandated to prevent inflight exposure to fumes and, thus, improve flight safety. For new aircraft types, non-bleed air supply systems should be standard.
• Given the flight safety implications, all crewmembers should be trained to recognize and respond to the presence of bleed air contaminants [61].
• The NTSB should reopen the 1984 report and update the conclusions based on what was known then about oil fumes and flight safety, and considering the data and reports published since then. The NTSB should also issue recommendations to the FAA on necessary actions to minimize the flight safety impacts of exposure to oil fumes.
• Until suitably protective measures are implemented fleet-wide, the NTSB should consider pilot impairment from bleed-sourced fumes as a potential casual factor in future aircraft accident investigations. This is particularly important when an accident includes either relevant maintenance history or a pilot’s failure to communicate, for example.
• If only to avoid the appearance of bias, future investigations should be independent of all commercial interests. Even though it is not unusual for the NTSB to include the FAA and manufacturers in accident investigations, both the poorly conceived design of the air sampling trials and the sweeping conclusions, suggest that commercial conflicts influenced this project.