COVID-recovery Series: Eliminating The Risks Of Refuelling With Traditional Filter Monitors

There is no reason why mobile trucks, or bowsers, cannot be converted once suitable technologies are approved. In principle, the filtration controls are no different from a hydrant dispenser.⁴

Extruded SAP particles that have been linked to operability issues on aircraft are predominantly in the diameter range of 20 microns. This is too small to be visible to the naked eye but large enough to cause issues in various engine components.⁵ Dry SAP can take a range of forms and vary depending on the manufacturer. Additionally, SAP can change its shape, size and consistency when exposed to different levels of water. It can also extrude through fine filtration and reform on the downstream side, making it difficult to contain with particulate filters, especially if it has been exposed to water.

Any approach is technically possible. What is reported will need to be agreed between supplier and airline or agreed through the industry standards.

It is possible, as Filter Water Separators (FWS) are an approved filtration technology within the standards, but this is a cumbersome solution and not one that is convenient for the long-term.⁶

Shell have seen no evidence that this is the case. The problem lies with the release of SAP from the filter on the fuelling vehicle before the fuel even reaches the aircraft. This indicates that the frequency of tank draining on the aircraft is of secondary importance. We also need to recognize that drain points cannot access all low points in an aircraft tank so that water can accumulate in some aircraft even with frequent low-point draining.

All filter manufacturers are attempting to develop technology that will retrofit directly into the filter monitor vessel. So, if all potential technologies are approved, it should be possible to convert a vessel from one technology type to another.

The only potential modification needed is the addition of an electronic water sensor in the pipework downstream of the filter vessel. This sensor is required for the Dirt Defence option, but it has not yet been determined whether it is needed for any of the other technologies still in development.⁷ We are unable to comment on financial impact, other than that; increasing competition generally improves market pricing.

There are differences in operating procedures for operating Dirt Defence Filters (DDF) with an Electronic Water Sensor (EWS), but these are not thought to be onerous. While in the transition phase, JIG recommends pausing fuelling to conduct a chemical water check when the EWS indicates 15 ppm of free water, but this is an additional oversight check. Practically, this is not dissimilar to the practice of conducting a visual sample during fuelling that is part of today's JIG 1 requirements.

The system automatically closes the fuelling down without operator intervention when the EWS detects water levels above a pre-set level; in JIG operations this is 30 ppm.

Shell perceives the Electronic Water Sensor (EWS) and the Dirt Defence Filter (DDF) to be the most expeditious way to remove SAP from our operations. Shell has also done considerable work on test rigs and in simulated failures to support the decision and followed this up with full-scale operations to ensure that erroneous shutdown events are not common – for example, understanding if cavitation from rapidly closing valves would trigger the sensor. For our operations, this combination appears to be robust and allows us to move away from SAP as quickly as possible.

The Energy Institute has tested the performance of both the Dirt Defence elements and the Electronic Water Sensors. In addition, Shell has conducted extensive rig testing where different water levels, different flow rates, different additives, combinations of dirt and water all were tested. We have also conducted full-scale vehicle testing on rigs, where we can simulate other challenges, such as bulk water from a hydrant.

Additionally, Shell has conducted field trials to demonstrate the robustness of the system. This work was confirmed by recently completed field trials at several locations as overseen by JIG, A4A and IATA.⁸ It is the intention of the industry that other emerging filtration technologies should go through a similar amount of rigor before being included in the industry standards.

Shell is going above and beyond to protect aircraft engines by converting all of our refuellers at Shell-managed locations worldwide to Shell Jet Protection so that we can be SAP-free by the end of 2020. We already have a rolling program of Electronic Water Sensor installations in place to achieve this goal. We intend to encourage our joint-venture (JV) sites also to have a plan for conversion, but this will need the agreement of other JV partners.

The calibration of the sensor is conducted on a rolling program that has been agreed to within the industry. This is based on a conservative assessment of past experiences with similar types of applications, and it is important to note that no drift has been seen on any sensor during all the trial activities.

In addition, there is a more frequent field test that will be conducted to ensure that the functionality of the sensor and related systems, other than the light source, remain functional.

The light source itself is somewhat self-checking in that a known amount of light is emitted. It needs to be received by the sensor as part of the start-up process. This requires the light source to work, the mirror to reflect all of that light and the sensor to detect the light at the expected level. If the amount of sensed light is less than expected, then the system does not allow the vehicle to flow fuel. Added to all this, JIG standards will continue to require a visual test of the fuel to be conducted as part of each fuelling.

Finally, it should be noted that an independent company was employed by the standards bodies to consider the failure mechanisms of the Dirt Defence and Electronic Water Sensor. The resulting successful Failure Mode and Effects Analysis (FMEA) was part of the approval process.

The alarm water level for water (30 ppm downstream of the filter in JIG operations) is connected to the deadman control mechanism, which closes the pit valve for hydrant dispensers, or stops the pump refuelling vehicles thereby stopping the fuelling. The system achieves this without any operator input. There are several processes and checks to assure this functionality, and a Failure Mode and Effects Analysis (FMEA) has been conducted to show that the failure modes do not result in unintended consequences.

Of course, the EWS is only one component in a series of barriers that are designed to keep the fuel clean and dry. Other controls include into-storage water removal, tank positive draining, tank outlet floating suction, vehicle/hydrant filter water separators, low hydrant point draining, post-loading sampling of fuelling trucks, etc.

Some work within JIG has suggested that the end-to-end failure rate of these upstream barriers -- before the fuel even reaches the underwing filtration system -- is several million to one. This is supported by how infrequently we see filter monitors being changed due to water exposure before the end of their 12-month life. The success of all these barriers is further supported from the industry field trials where, within 11,000 fuellings of 126 million litres, there has not been a single event where 30 ppm of water was present in the fuel.

If the question is about what prevents the operator from sabotaging the EWS from functioning, then we would be moving into an area of questioning about how we might prevent gross negligence and wilful misconduct of an operator. This is not something the standards have ever addressed or would be easy to address. We could ask a similar question about what prevents an operator today from conducting wilful misconduct. For example, how do we prevent an operator from consciously operating a filter containing no elements? It could be argued that this would be captured by independent oversight inspection programs, which are also normal within the industry.

Shell has conducted testing at a wide range of flow rates, with different levels of water contamination, with and without dirt. To my knowledge, the testing we have carried out is the most extensive of any test program outside the work conducted by the equipment developer.

Of course, every test method also has a precision level below which it cannot differentiate one result from another. Still, all of Shell's work suggests that the currently assessed EWS technology has the capability of controlling water to a limit of 30 ppm of free water as required by the standards. In fact, in Shell's testing, it would seem that if there is any inaccuracy, it tends to skew high, meaning the sensor reports more water than is actually present. This means that the sensor would stop the fuel flow earlier than necessary.

It might not be appreciated by many, but it is extremely difficult to hold very low parts per million levels of water in suspension in fuel. Water is partially soluble in fuel and even small changes in temperature, such as with pumping, can affect the free water level when conducting testing. So, special care is needed when designing test rigs to do this type of work.

For example, if using a single element filter test rig commonly used by filter manufacturers to qualify filters, then the maximum fuel flow rate will be 30 USG/min (113 L/min). If trying to interpret 10 ppm of water, then on such a rig, we would need to be injecting less than 0.2 mL of water every 10 seconds into this fuel flow. That's the equivalent of emptying a 5-mL syringe of the type used in the Shell Water Detector method in a period of a little over four minutes. And if the flow rate is changed to 50%, the problem doubles, at 25% flow, it is even more challenging, and it would take well over 15 minutes to empty the syringe.

Under such conditions, it is difficult not to inject single drops of water with big spaces between. To do this, we need to consider how accurate the Reynolds Number of the flow is in such small-scale rigs, as this too affects dispersion. Taken as a whole, we find ourselves proving very little about the sensor's operational capabilities under such conditions. The conclusion of this is that care is needed when interpreting results from such experimental arrangements, and knowledge of the test rig limitations is critical to interpreting the results from high-resolution sensors.

Shell is confident in our own testing, and the information and methodology that Shell has developed throughout this program are currently being incorporated into improving the industry standards for Electronic Water Sensor testing, EI1598. Of course, others are at liberty to conduct their own independent due diligence if they wish.

The system self-checks on start-up, and if the light source, mirror, or sensor are defective in any way, then the fuelling cannot be started. Again, the failure modes and effects have been assessed through a dedicated FMEA study.

In principle, single EI1583 qualified elements could be replaced with any of the retrofit technologies in development once they are approved. However, I am aware that there are many 5" filter monitors that have been in use at GA locations. These elements have never been qualified to EI1583, nor have they been included in JIG standards, so the approval for the use of these elements is currently the responsibility of the user. It is assumed that companies using such equipment will need to follow a similar internal risk assessment/qualification approach to approve a replacement technology.

It is interesting to note that JIG standards already allow Avgas applications to use a microfilter (EI1590) as into-wing filtration⁹ , and this may also extend to Dirt Defence (EI1599) in due course. Also, the Energy Institute is currently developing a standard for SAP-free single element filters, which will come under the designation EI1587. At the time of writing, this standard has not yet been published and it is also not clear how many filter manufacturers will produce elements that qualify as meeting this standard once it is published, but it is likely that some will.

Dirt Defence filters do not have coalescer elements, and the DD + EWS combination does not rely on polar surface properties within the filter for water management and therefore is not vulnerable to disarming.

When looking at other filtration technologies, coalescer disarming within EI1581 filter water separators is currently controlled by a regular calendar-based change out of the elements.

Companies will have to make their own decisions about risk and cost. It is difficult to assure fuel meets the specifications and operating limitations of the aircraft while using filter monitors. As meeting the fuel specification is a contracted obligation for fuel providers and a regulatory one for airlines, the decision is not purely a financial one.