Multi-Engine Maintenance

The practice of performing multi-engine maintenance presents many opportunities for error. The results of such errors include engine problems, shutdown, or even loss of thrust on multiple engines, and the related risks to safety of flight. Operators and maintenance personnel can reduce the likelihood of this type of error by understanding its causes and taking steps to prevent repeating the same error on multiple engines.

Maintenance of all engines on an airplane at the same time or by the same individual or team presents the potential for error and the possible loss of thrust from all engines. Boeing has long advocated that operators stagger scheduled maintenance on their airplane engines. When multi-engine maintenance cannot be avoided during a single occasion, Boeing recommends that different maintenance personnel work on each engine and exercise added scrutiny. This added scrutiny may be as simple as redundant checks of work performed or as demanding as a nonrevenue flight to ensure the integrity of all systems.

Preventing engine problems or loss of thrust related to multi-engine maintenance error is possible by learning about the following:

  1. Examples of multi-engine maintenance errors.

  2. Causes of errors.

  3. Strategies for avoiding multi-engine maintenance errors.

Examples of Multi-Engine Maintenance Errors
Several problems with engines have been reported that occurred after multi-engine maintenance. The following examples show the variety of problems. In each example, the airplane experienced an in-flight shutdown or developed problems on more than one engine.

Causes Of Errors
Errors occur for several reasons, but these reasons rarely include individual carelessness or incompetence. The fact that even careful maintenance personnel make mistakes has led to the discovery of several factors common to mistakes. Examples include the following:

(See "Are Mistakes Repeated?" and "Human Factors Process for Reducing Maintenance Errors" in AERO no. 3, July 1998, for additional information about maintenance error.)

Strategies for Avoiding Multi-Engine Maintenance Errors
After investigating several multi-engine maintenance events, Boeing identified a key strategy for avoiding multi-engine maintenance error: If possible, operators and repair stations should avoid performing maintenance on multiple engines using the same personnel during a single maintenance visit. Following this strategy should also minimize the potential that improper maintenance will occur on redundant or backup critical systems, such as flight controls, electrical generation and distribution, and hydraulics.

To incorporate this key strategy, some operators have extended their ETOPS approach to their non-ETOPS fleets (see "ETOPS-Based Maintenance Guidance"). By adopting some or all of the ETOPS strategies, operators have also increased the reliability of their fleets.

Additional strategies for avoiding multi-engine maintenance errors include

Staggering maintenance.
If possible, all scheduled maintenance on engines should be staggered to avoid multi-engine maintenance by the same personnel during a single shop visit.

Varying maintenance personnel.
Multi-engine maintenance during a single visit may be unavoidable. For example, multiple bird strikes that affect all engines may require both inspections and repair to be performed. To reduce errors during both tasks, different personnel or teams should work on each engine of a multi-engine airplane. This multiple-personnel approach increases the number of mental models (see "Mental Models: How People View the World") available during maintenance that could help prevent redundant errors.

Developing specific processes for multi-engine maintenance.
At those times when multi-engine maintenance may be required during one visit, operators or repair stations should consider the following to help prevent error:

Employing existing maintenance personnel expertise.
An operator's maintenance planning department, shop supervision, and mechanics will have excellent ideas on how to avoid errors. For example, Boeing worked with one of its engine suppliers to reduce the in-flight shutdown rate for a particular engine. By working with several operators' mechanics, Boeing and the supplier learned about a variety of ways to reduce error.

Educating maintenance personnel about critical systems.
Though all airplane components are important, some components have greater influence on airplane flight safety than others. For instance, oil is necessary for any airplane engine to run. Thus, all the places where oil can leak become critical, especially those locations that are likely to require handling, such as oil fill covers, gearbox access covers, oil filters, chip detectors, and plugs.

Using tools provided by airframe manufacturers and engine companies.
As part of the Boeing initiative to reduce maintenance-related error, the company is developing the following error-prevention tools for operators:

The U.S. Federal Aviation Administration (FAA) and other agencies have also developed tools to help operators reduce and manage error. For example, the FAA has published a poster entitled "Maintenance Personal Minimums Checklist." This poster suggests some error-reduction ideas for maintenance personnel to consider both before and after a task.

Aviation industry professionals involved with multi-engine maintenance, including trained maintenance personnel and operators' planning departments, work together to avoid maintenance errors. However, because mistakes continue to occur and are repeated on multiple engines, Boeing has developed strategies for operators and repair stations to follow to recognize the possibility of error and reduce the effect of these errors. These strategies include staggering scheduled maintenance on engines, using different personnel, and developing special processes for multi-engine maintenance during a single shop visit. Operators may also consider applying some aspects of their ETOPS approach to their non-ETOPS fleets. The ultimate result of combining these actions may be to reduce multi-engine maintenance errors and improve flight safety.

Are Mistakes Repeated?

One question that human-factors professionals are often asked is whether a mechanic will make the same mistake a second, third, or fourth time while performing a task. For instance, if a mechanic adds oil to the right engine and forgets to secure the oil cap, will this same mechanic be less likely to secure the oil cap on the left engine after adding oil to the left engine? In addition, if the mechanic remembers to secure the cap on the left engine, will he or she then remember that the oil cap cover on the right engine was not secured?

According to the Boeing Commercial Airplanes Maintenance Human Factors organization, the question has multiple results that can be affected by various factors called performance-shaping factors (PSF). External PSFs are such things as lack of positive-lock feedback or task sequence interruption. Internal PSFs are such things as distraction due to multitasking. In a sample scenario, a mechanic does not secure an oil cap on engine no. 1. If the same external PSF that caused the mechanic to not secure the cap on engine no. 1 is present on the remaining engines, and if no other factors are present, then the mechanic probably will not secure the cap correctly on the other engine. However, if a mechanic fails to secure an oil cap on engine no. 1 because of either external or internal PSFs (for example, distraction caused by multitasking), then the mechanic may or may not do the task correctly on engine no. 2. The difference is in the sequence in which the task is performed, and the relative impact that each PSF has in causing the mechanic to make decisions at the time. In the example of the BAe 146 cited in the main story, maintenance was performed on all four engines: On three of the engines, the oil seals were left off; on the remaining engine, the seals were installed.

Because it appears that cues play an important role in how a maintenance task is ultimately accomplished, operators should consider the cues that the mechanics are likely to encounter when they perform a task. These cues can be explicit (such as written on a task card) or implicit (cues that are assumed to be present).

ETOPS-Based Maintenance Guidance

Operators with extended-range twin-engine operations (ETOPS) approval to fly their airplanes for more than 60 min from an en route alternate airport use the U.S. Federal Aviation Administration (FAA) Advisory Circular (AC) 120-42A for maintenance guidance as well as FAA Federal Aviation Regulation 121.161. Information in the AC includes the following:

Maintenance planning
Systems are purposely maintained to avoid working on redundant critical systems at one shop visit. Additional processes such as checklists and functional tests are developed for those occasions when such maintenance cannot be avoided during one shop visit.

Oil consumption program
Oil consumption analysis is performed to anticipate failures for both engines and other systems where oil is used. For instance, some operators know the approximate oil consumption for a flight from Chicago to London. If the oil consumption is more or less than expected, a review is initiated to understand this difference.

Engine condition monitoring (ECM)
Engine deterioration that might affect ETOPS operations is monitored through a disciplined data collection and analysis program. Some operators assess engine performance during flight with satellite data transfer processes. An ECM program is available from all engine manufacturers for their engines.

Airplane discrepancy resolution program
This focused process is established for dealing with engine shutdowns, primary system failures, and similar situations and is implemented by the ETOPS operator. For example, for one operator, all discrepancies on ETOPS flights are assessed by a team that includes the line engineers responsible for an airplane model, the system engineer for the system that produced the discrepancy, line maintenance, maintenance training, and the mechanics who perform the work.

Reliability program
A program for enhanced reliability is developed for early identification and prevention of ETOPS-related problems. The objective is to identify problems before they prompt an ETOPS flight discrepancy.

Propulsion system monitoring program
Specific criteria are developed for propulsion systems related to actions taken when various adverse trends occur. These criteria identify what events or rates of events will prompt action by the operator.

Maintenance training
Operators enhance their normal maintenance programs to emphasize the key issues associated with ETOPS. For instance, mechanics learn about critical systems that could affect ETOPS operations.

ETOPS parts control
Operators implement a program to ensure that proper parts and configurations are maintained for ETOPS airplanes.

Again, the basic rule for multiple similar systems is to perform maintenance on each unit at different maintenance visits. On many occasions, however, it is not possible or convenient for an operator to split this maintenance. In the document titled "ETOPS Guide, Volume II, Maintenance Program Guidelines" (D641T401, Rev B, April 1, 1998), Boeing describes a variety of practices to help operators avoid introducing problems into dual systems when maintenance is performed at the same visit.

Mental Models: How People View The World

When a person observes an event, participates in an activity, or makes a decision, he or she forms a "mental model" of the event, activity, or decision. These mental models are a person's conceptual thoughts of the way objects work, events take place, or people behave. In general, people form these mental models to manage the many inputs they are constantly receiving, including their own thoughts and sensory experiences (sights, sounds, and physical sensations) as well as the thoughts and experiences of others. By developing mental models, people learn how to effectively use the multiple inputs.

One disadvantage of this tendency to manage thought processes is that mental models are often constructed from fragmentary evidence, with a poor understanding of what is happening and a tendency to assumes causes, mechanisms, and relationships even when there are none. People tend to create cause-and-effect relationships whenever two things happen in succession.

In addition, people may even eliminate useful input because of their mental models, then become surprised by a false assessment in an accident or error. Yet, from the point of view of the person actually making the false assessment, the assessment appears quite natural at the time. When an L-1011 lost all three engines because of low engine oil (see main article), the crew did not believe that such a condition was possible. Indeed, the chances that all three engines could fail, according to the captain, were "one in one million." Once people have an explanation--correct or incorrect--for otherwise discrepant or puzzling events, the discrepancy or puzzle no longer exists. As a result, people become complacent about the explanation, at least for a while, regardless of additional events that may occur.

Mistakes, especially when they involve misinterpreting the situation, are difficult to discover. This is because the interpretation appears reasonable at the time. Many accident sequences or maintenance errors occur because the participants "explain away" the anomalous information, evidence, or circumstances that they later understand caused the error.

Same Process, Same Outcome

Like any activity or process, how a job is performed may dramatically affect its outcome. Processes may be focused on the individual, a team, or an organization.

For instance, when mechanics perform a task, they have a process for closing out the activity; once they repair or replace a part, they do something to complete the task. They may try to do in reverse what they did upon starting the task, or they may have a check process that they use when they believe they have finished a task. The check process may consist of touching every item that they used during the maintenance task. This second touch may be used to confirm that items are where they belong, secured properly, or appropriately placed. Mechanics may also use a check sheet to close an activity that shop personnel have developed. At Boeing, mechanics in the propulsion systems area not only receive specific task cards for various engine buildup efforts, but they also receive kits, known as shadow boxes, where the parts are provided for that task in a logical order. If the mechanics finish a job with a part left over, it is likely that the task is not complete.

Teams may have similar approaches and may also designate someone as the check person. Teams may task the work so that each member is teamed with another team member, so that these pairs work together to complete tasks. Like the flight crews, these pairs may verbally check off the tasks performed by their partners. Teams may hand off assignments to each other as well. For instance, a day shift of workers may hand off a work plan to an afternoon shift of workers. That plan will tell the afternoon shift to what extent the work is finished and the details of the work, such as what bolts are removed and what caps are missing.

Organizations may use both individual and team processes and also establish a philosophy about multi-engine maintenance. For instance, where multi-engine maintenance occurs during one shop visit, the organization may require an extra check by mechanics who did not perform the tasks. The organization may also require various levels of functional checks depending on the multi-engine maintenance events that occur in one shop visit.

Thomas Murray
Safety Engineering
Propulsion Technology
Boeing Commercial

Vince Robel
777 GE/PW/RR Engine
Buildup and Strut
Systems Engineering

Boeing Commercial

return to top | AERO text-only contents | Boeing Home | Commercial
Copyright The Boeing Company. All rights reserved.