1. Introduction

Any high-value, repairable asset will only earn its keep when it is being used. A fleet of commercial aircraft, no matter how efficient, earns nothing while they are on the ground, passengers do not pay to sit in an aircraft waiting at a gate or broken down on the edge of the runway (even if it feels like it sometimes). A power station or pumping station earns nothing while sitting idle waiting for someone to come and repair it. In fact, in many cases, assets actually cost their owners money if they are out-of-service through penalties imposed for failure to achieve contracted levels of availability.

Although most of the following is applicable across a wide range of assets, we make no apologies for concentrating primarily on the engines of commercial aircraft. The methods and models used have been in operation for many years within this sector. Aircraft are expensive, they have relatively short working lives but are expected to achieve high levels of utilization and availability and generally run at low profit margins. They are also subject to some of the strictest safety legislation to which any system has to comply.

The following was taken from an article written by Daniella Horwitz, deputy editor, Aircraft Technology Engineering & Maintenance, which appeared in 'Aviation-Industry's' daily report for Tuesday 22 May 2007 'Boeing figures show that 50 per cent of flight delays due to engine problems cost at least $9,000 per hour; 50 per cent of flight cancellations due to engine problems cost at least $66,000 per cancellation; and 20 to 30 per cent of engine in-flight shutdowns cost at least $500,000 per shutdown'.

Preventative maintenance is one of the key policies in aircraft and engine maintenance. The aim is to achieve sustained operational performance at very high levels of safety. (Flying by commercial airlines is reputed to be the safest form of travel per passenger mile.) The safety criteria legislation, long-term profitability and competitiveness cannot be achieved for any system without sustained performance.

Smith (1993) defines preventative maintenance as the pre-planned series of inspection and/or servicing tasks that is intended to achieve retention of the functional capabilities of operating systems or equipment. Jamali et al (2005) defines that preventative replacements are scheduled at instants kT (k=1, 2, ...). The replacements are carried out only if the item age exceeds a threshold to be determined. At failure, the failed item is replaced by a new one.

Although preventative maintenance is in many ways preferable to corrective maintenance it may not always be the most cost-effective policy. In some cases, of course, it may not even be practical; there is no point in replacing your car windscreen before setting out on a journey in the hope of avoiding breakage due to foreign object damage (FOD) such as stones. It probably does not make sense to replace your tyres at fixed intervals because it is very easy to inspect them for wear so you can wait until they need to be replaced. By contrast, it does make sense to replace the cam belt on, or before reaching a given mileage because the consequences of failure are usually expensive and it is generally not practical to inspect or monitor it at regular intervals. If it has been necessary to do some maintenance work which has exposed the cam belt and the belt is reasonably old, it will probably be cost effective to replace it opportunistically.

In the case of gas turbine aero-engines, a certain amount of preventative maintenance is performed for safety reasons. Typically, shafts and discs are life-limited so have to be replaced on or before achieving a given age (ie at a fixed or hard life). Occasionally engines will suffer FOD, ingestion of large birds, stones and other debris that may be thrown up from off the runway. For most other components, the primary cause of rejection is wear. Moubray (1997) states that wear-out characteristics most often occur where equipment comes into direct contact with the product. Actual failures may be prevented by employing engine health or on-condition monitoring (OCM) but this tends to only give a very short notice of the impending failure so these can still be regarded as unplanned.

When an engine requires invasive maintenance that cannot be done in situ, it will be removed and sent to a repair and overhaul (R&O) facility for recovery. To minimize the downtime of the aircraft, the removed engine is generally replaced with a spare engine. In the event that a spare is not available, a lease engine may be fitted. The aircraft is then returned back into service.

2. OCM and target build life (TBL)

Although very few engines actually fail, OCM generally gives very little advanced warning of when an engine will need invasive maintenance. In many cases, the cost of monitoring the system is high compared to the benefits it gives. The monitors themselves may be just as unreliable as the components they are monitoring (Crocker, 2003a). Another concern is that when the condition monitoring is inappropriate they can be very expensive and sometimes bitterly disappointing waste of time (Moubray, 1997). For instance, if an indicator has shown signs of impending failure, the engine is either taken out of service or, if the symptoms are not too severe it is put 'on-watch' during which time it will be observed more closely. Occasionally, the symptoms that triggered the warning disappear and the engine is then taken off watch until such time as the OCM flags it again.

It would be perfectly feasible to recover the engine by simply addressing the symptoms that led to its rejection. This will certainly give the minimum number of component replacements in the given shop visit and will likely maximize the amount of useful life obtained from each part. If parts are very expensive relative to the other costs such as labour and disruption to service, this could be a sensible policy. However, if parts are very expensive then it is likely that spare engines will also be very expensive. This maintenance policy will tend to produce a relatively low mean time between shop visits and a relatively high requirement for spare engines.

Under many of the 'Power-by-the-Hour^®' (Power-by-the-Hour and PbtH are registered trade marks of Rolls-Royce Group.) contracts that Rolls-Royce operates with various airlines, there are invariably penalty clauses covering such things as the number of 'in-flight shutdowns' (IFSD) and delays and cancellations (D&C). While it may not be possible to avoid these completely, the penalties imposed generally make it sensible to take all reasonable action to at least minimize them.

It is recognized that most part rejections are age-related in so far as they are more likely to be caused by wear/usage than by external factors or poor quality control. By knowing the ages of all of the parts which may cause the engine to be rejected and the probability density functions of the times-to-failure (TTF) of these parts, it is possible to calculate the mean residual life of the engine, that is, the mean time to next rejection. For the past 30 years, Rolls-Royce has used the Weibull distribution to describe these TTF. This distribution has also been widely adopted to describe the lifetime distributions, for instance, see Rao and Bhadury (2000).

With the Weibull distribution, it is actually very convenient to work with the cumulative hazard functions rather than the mean residual times to failure. Appendix A describes how this can be used to determine the TBL and from this which components should be replaced during any given shop visit.

3. Model description

The model used to produce the results given in the case study is a discrete event simulation known as PSALMS—Platform Support Arisings, Logistics and Maintenance Simulation. The first version of PSALMS was written in 2004 by one of the authors and runs to over 45 000 lines of Simscript II.5^® code. It is however, a development of an earlier Simscript model called MEAROS that was, in turn, a development of a FORTRAN model called ORACLE that was first written in 1969.

The basic philosophy for PSALMS is described in detail in Crocker (2001). The following gives an overview of what the model does and how it works.

The model contains some 21 processes and five traditional events. A 'process' in Simscript II.5^® typically replaces several traditional start and end events by putting the process in a state of waiting or working for a given time and by suspending it within the routine and re-activating it from outside. It can also be used in conjunction with 'resources' by 'requesting' one or more 'resources' which automatically suspends the process until they have become available. Once the resources have been used, they can be 'relinquished' making them available for another process (or the same process acting on a different instance of the entity).

Figure 1 gives a high-level flow diagram of how the model basically works. There are essentially four types of entity: platform, LRU, modules and parts although as far as the model itself is concerned, LRU, modules, parts major assemblies, minor assemblies, etc are all treated as 'components' that may belong to a parent and may own offspring. There may be several different types of each and there may be a great many instances of each type. Each instance of each type of each entity can be in any one of several different states. Platforms and components can also be added to or removed from the simulation at any time. They can also be modified such that they take on new values for some of the attributes such as different hard lives, TTF distribution parameters, repair and recondition times and many more.

Figure 1.

High-level flow diagram of PSALMS.

Full figure and legend (57K)

In the case study described later there is one type of platform—a 2-engined airliner—one type of LRU—the engine—10 different types of module and up to seven different types of part per module. The fleet comprises 85 aircraft with 170 installed and 30 spare engines. Thus there are some 50 different types of entity with over 4000 instances. The actual numbers of each and how they relate to each other are defined by the user via the input data set.

The platforms are assigned to tasks which define such things as the location (site), the start and end date, the role, and the number of platforms and monthly target operating hours (per platform). The last two of these can be changed at any time during the simulated period by what are referred to as run time changes.

When a platform first goes into service, the model determines the age (in operating hours) of when it will next be due for invasive maintenance. It does this by calculating the next time to rejection for each LRU which is the minimum of the times to next rejection for the LRU and each module within the LRU which are, in turn, the minimum of the times to next rejection of the module and each of its constituent parts.

Each component can be rejected for any number of reasons. These include planned arisings resulting from a component reaching its 'hard life' or life limit, coming due for routine inspection or failing due to one of its failure modes (each of which is invariably described by a Weibull distribution). Aging may be measured in operational hours or 'cycles' which will depend on the type of operation.

At the end of each operating period, the number of hours (operated) is added to the age of the platform and this is compared to the age when it is due for invasive maintenance. The platform is then either prepared for the next period of operation or taken out of service for maintenance. Once it has been prepared it waits until the start of the next period of operation.

When a platform is taken out of service for maintenance, the hours accrued are added to the components. The model determines which LRU was responsible and removes it. The supply environment, which typically comprises a hierarchy of sites at a number of levels or echelons, is then searched for suitable replacement LRU. The 'best' one, based on user-defined criteria, is selected and moved to the site where the platform is waiting and fitted immediately upon arrival. Having recovered the platform, it then recalculates the time to next maintenance. The platform is then ready to be prepared for its next period of operation.

Each of the removed LRU now follows its own route around the maintenance and supply environments. Firstly, the primary cause of rejection is identified. Next all of the secondary rejections are identified resulting from damage, wear or aging. These may be dependent on the site where the maintenance is to be carried out and which components are exposed during the stripping process. Once all of the components have been rejected for these reasons, the remainder of the modules are checked against the TBL requirements (as described in Appendix A).

The location where maintenance is to be done is determined based on the depth of strip (which modules have to be removed) and the capabilities and capacities of the potential sites. The LRU is moved to the chosen site and as soon as the necessary resources are available stripping begins.

At the end of the stripping time, the LRU is ready to start the rebuild process. Firstly, the model has to decide whether the LRU can be recovered by module exchange or whether it has to wait for the modules which were removed to be recovered. It then starts the search for the required modules. If at least one is not found, the process is suspended. It is re-activated by the last of the missing modules becoming available.

Having acquired a full complement of modules, the LRU is rebuilt usually taking the same time as it took to strip it. When reassembled, the LRU is then sent to the test facility and tested before being either added to the spares pool or sent to a waiting platform to be re-fitted.

The rejected modules undergo an almost identical process. The only subtle difference being that they are not tested when recovered.

Rejected modules with no rejected parts and rejected parts will be sent to a maintenance site for repair or recondition depending on the cause of rejection, the age of the component and the probability it is beyond repair. The component will be declared serviceable at the end of the appropriate time and added to the spares pool or sent to a site where a parent is waiting.

Almost all of the parameters, including reliability data, number of spares, recovery and transit times can be changed during the run at any time and as many times as desired.

The main advantage of using a discrete event simulation model is that it allows each entity to be tracked throughout the life of the fleet and to allow these to move between different systems within the fleet. Components on aircraft within a given fleet can accumulate stress cycles at very different rates depending on the type of flying and length of flights. This can have a significant effect on their reliability. The different ages of the components will also determine which should be replaced prematurely to satisfy the TBL or soft life policies.

Over the years, a number of exercises have been carried out to determine the optimum number of passes (future histories or replications). On each occasion, there seemed to be very little benefit from performing more than 10. This is a very small number when compared to those needed when running Monte Carlo simulations. One explanation for this is that we are usually modelling a fleet of multi-engined aircraft with quite a large number of components per engine. The other, possibly more pertinent, reason is that we are not so much concerned with steady-state conditions or the average behaviour as we are with the ranges of engine removals, module rejections, part repairs, etc per year over the life of the fleet. We wish to be able to assess the relative risks and costs of not having enough resources against over-stocking or over-manning. Can we offset the likely costs of penalties and potential loss of reputation against the savings by employing fewer mechanics or stocking lower numbers of spares, say? Will the PbtH^® rate generate sufficient revenue to cover the costs of the maintenance required with a confidence level exceeding 90%? At what level should we set the trigger to start negotiations for a possible increase in the rate or a reduction in the amount 'creamed off' to profits? Should we start reducing the number of components replaced opportunistically so as to increase our profit margins over the last few years of the contract period and what will be the likely effect on the rates needed to be set for any follow-on contract?

4. Case study

Martorell et al (1999) study optimal maintenance solutions for continuously monitored multi-component systems with Markov deteriorating processes by using a Monte Carlo simulation which is more efficient than the analytical method. In the following case study, we use simulation as a tool to compare the possible results in different policies.

We assume that:

• Lifetimes are independent and identically distributed.
• Maintenance actions are carried out in a perfect way, that is, we are not modelling maintenance-induced failures. Although repairs may not always restore the component to a same-as-new condition (Crocker, 1999), we assume here that they are 100% effective.
• All the resources are available at all times except for spares which are modelled explicitly.

This case study was conducted on the gas-turbine engines of a fleet of 85 aircraft which are simulated over the expected life of the fleet (some 40 years). Each engine comprises 10 modules with each module typically owning from 1 to 5 parts the rejection of anyone of which can cause it to be rejected. A gas-turbine aero-engine can be considered as a series system. Each aircraft is expected to be operated for approximately 200 h per month on short haul routes (of typically just over 1 h flying time). The engines are expected to be supported by a 'total care package' such that the operator will be charged a fixed rate per engine flying hour (eg PbtH^®) in return for a number of guarantees covering availability, IFSD, D&C.

In each of the following graphs, each point is based on the results from 10 passes of the simulation model. The same number of engine flying hours was flown in all cases. This was achieved because the model schedules flights in order to maximize the probability of achieving the target rather than flying to a timetable.

In the first of the graphs, Figure 2, the x-axis is the mean time between engine shop visits in engine flying hours. Basically, the x-value is calculated by taking the total engine flying hours and dividing this by the number of engine removals so is, effectively the best estimate of the mean time between failures (MTBF) or the average time an engine spends on the wing before being removed. In a power-by-the-hour type contract, this time can be considered as proportional to the revenue available to fund the maintenance needed to be done when the engine has been removed. The y-axis gives the average number of modules rejected at each of these engine shop visits and hence can be regarded as an estimator of the maintenance costs incurred. Obviously there are several other factors and because different modules incur different costs, there is no direct relationship between this average and the actual costs but it is reasonable to assume there is some correlation between them.

Figure 2.

Graph showing how the TBL affects both the average number of modules replaced per engine shop visit and the mean time between these shop visits.

Full figure and legend (34K)

In Figure 2, the 10 points correspond to target build lives (TBL) ranging from 0 to 0.9 in steps of 0.1-(0.0[0.1]0.9). The lowest point on the graph is for a TBL=0.0, that is, one in which no modules are replaced prematurely in order to try to increase the time on wing. By contrast, the highest point (TBL=0.9) corresponds to a policy in which most of the modules were replaced on most of the shop visits. This line effectively sets the boundary—any point to right or below this line is an improvement on the best OCM policy while anything to the left or above is likely to be more costly. It is effectively a 'Pareto Surface'. (For an explanation of what TBL is and how it is calculated, see Appendix A.)

In Figure 3 there are two additional sets of points (joined by dotted and dashed lines). The higher of the two gives the points obtained by setting the hard life on one of the components to 1000, 1500, 2000, 3000, 5000 and 7500 h, respectively while holding the TBL at 0.9. The lower line was for the same hard life values but with the TBL=0.7.

Figure 3.

Graphs showing the effects of different hard life policies for two TBL values.

Full figure and legend (47K)

The two new graphs in Figure 3 meet the baseline, boundary line when the hard life is effectively set to infinity (ie when no hard life is set). The fact that both lines are to the left and above the boundary line indicates that setting a hard life on the given component is likely to prove more expensive. The part chosen to be given a hard life was the one which had the highest average failure rate combined with strongly age-related failures, that is, the one most likely to cause an engine removal. (In this case the shape of the Weibull distribution used to describe the TTF was 6.) The logic behind this was that this would most likely be the best module to replace prematurely in so far as it was likely to result in the smallest number of unplanned engine removals for any given value of the hard life.

The model does allow the engine to be removed for inspection at either fixed lives or after fixed intervals. Suppose the nominal times are every 1000 h with a minimum issue life (MISL) of 400 h then the first will be due at 1000 h. If the engine has to come off wing at 900 h, say, then it is within the MISL (ie it is over 600 h old) so it will be inspected at the same time. If the policy is 'fixed life', the next inspection will be due at 2000 h but if it is 'fixed interval' it will come due at 1900 h (in 1000 h time). In both cases, the curves were almost coincident with those for the hard life cases, even though the points were slightly displaced.

The primary purpose of having scheduled maintenance is to reduce the variance between engine shop visits. In the next two graphs, Figures 4 and 5, the lines give the mean time to next shop visit (middle line of the 3) in Figure 4, this is to the first shop visit while in Figure 5, it is the time between the 9th and 10th shop visits. The lines above the mean are the 95% confidence level and those below the 5% confidence level. These were taken as the respective percentiles rather than assuming a normal distribution and using the t-distribution to determine the intervals mainly because, in the cases of hard lives, the distribution is truncated at the hard life so is anything but normal.

Figure 4.

Mean time to first shop visit showing 90% confidence interval for various scheduled maintenance times (TBL=0.7).

Full figure and legend (38K)

Figure 5.

Mean time from 9th to 10th shop visit showing 90% confidence interval for various scheduled maintenance times (TBL=0.7).

Full figure and legend (41K)

The dotted extension on each line is to show where it would be in the case of no scheduled maintenance. The points for these cases have been plotted at x=10 000 for convenience. In Figure 4 the 5% confidence level was the same value as the 95% CI up to a 3000 h life and actually higher than the mean. By the time the 10th shop visit is due (Figure 5), the variance is starting to show with there being a 5% probability that the 10th SV will be less than 500 h (or so) after the 9th (irrespective of the schedule).

Finally, Figure 6 gives some indication of the likely material costs of the various policies. To avoid any problems with data ownership, etc the numbers of both the x and y axes have been 'normalized' by dividing by the minimum x and y values, respectively.

Figure 6.

PbtH rates versus MTBESV.

Full figure and legend (45K)

In Figure 3, all of the cases relating to the introduction of a hard life are above and to the left of the corresponding case when there is no hard life. This implies these points are, in some way, sub-optimal. In Figure 6 each of the points has been 'costed' by considering the 'prices' of each component. It should also be recognized that these material costs are only a fraction, albeit a fairly large one, of the true costs. Although costs are important, to a service provider, the key value is the rate per hour that they need to charge to recover those costs.

The power-by-the-hour rates were calculated by dividing the total material costs (modules and parts) by the mean times between engine shop visits for each of the cases shown in Figure 3. These costs were then 'normalized' by dividing them by the lowest. Thus, for example, a 1000 h hard life combined with a TBL=0.9 is some 20 times more expensive (per engine flying hour) than the case when there is no scheduled maintenance. Similarly, the case with no opportunistic maintenance (TBL=0) is nearly 2.5 times higher than the cases when the TBL0.6—the minimum occurring at TBL=0.7.

5. Conclusions

Modelling high-value, repairable assets is a complex business as there are so many factors to consider. In this paper we have looked at the effects of maintenance policies during the in-service phase. In particular, we have concentrated on the maintenance of aircraft engines operating in fleets of civil aircraft. If we had performed a similar exercise on military aircraft engines or on different sub-systems of the aircraft the results and conclusions would have been quite different. We deliberately steered clear of costs as these tend to be very sensitive issues and are also likely to mask the underlying factors particularly if there are penalty clauses built into the contracts with the service providers.

Clearly the biggest single factor that affects the cost of maintenance is the reliability of the system and its constituent components. Unfortunately, reliability is primarily a consequence of the design so in general this is not a controllable parameter. It is also extremely expensive to redesign/modify components in the hope that they will be more reliable so the most practical approach is to look at the maintenance policies.

What we have shown is that the in-service maintenance costs can be heavily dependent on the maintenance policies adopted and that prevention, per se, is not always better than cure provided it is replaced with opportunistic maintenance. We believe that we have demonstrated that discrete event simulation is a useful tool for looking at different policies particularly in cases when the primary drivers of maintenance are strongly related to the usage of the systems and where repairable components can spend significant periods of time in different platforms possibly subject to different operating conditions. It is, however, essential to ensure that such models are sensitive to the many factors that can and do affect the behaviour of the system being modelled. It is also, of course, imperative that good accurate data are used.

Clearly, there is no simple answer to the original question but where preventative maintenance is done to satisfy safety requirements, this should continue but when it is being done for purely economic reasons, it may not be as economical as you think. It might pay to look at the alternatives, in particular, at opportunistic maintenance based on expected times to failure especially in cases where revenue for maintenance is dependent on usage (as in PbtH^® type contracts).

References

1. Crocker J (1999). Effectiveness of maintenance. Journal of Quality in Maintenance Engineering 5(4): 307–313. | Article |
2. Crocker J. (2001). A methodology for the prediction of maintenance and support of fleets of repairable systems PhD Thesis, University of Exeter.
3. Crocker J (2003a). Should preventative maintenance be at fixed intervals? Ceska Zemedelska Univerzita v Praze, ISBN: 80-213-1065-0.
4. Crocker J. (2003b). Target build life: When knowing the failure rates is just not enough. Logistics Spectrum, International Society of Logistics (SOLE), October–December.
5. Jamali MA, Ait-Kadi D, Cléroux R and Artiba A (2005). Joint optimal periodic and conditional maintenance strategy. Journal of Quality in Maintenance Engineering 11(2): 114. | Article |
6. Moubray J. (1997). Reliability-Centred Maintenance. Butterworth Heinemann: London.
7. Martorell S, Sanchez A and Serdarell V (1999). Age-dependent reliability model considering effects of maintenance and working conditions. Reliability Engineering and System Safety 64(1): 19–31. | Article |
8. Rao AN and Bhadury B (2000). Opportunistic maintenance of multi-equipment system: A case study. Quality and Reliability Engineering International 16: 487–500. | Article |
9. Smith A.M. (1993). Reliability-Centered Maintenance. McGraw Hill: New York.

Appendices

Appendix A

Calculation of TBL

For a 2-parameter Weibull distribution with shape and scale (W[, ]) the cumulative hazard function is given by:

For a series system, the cumulative hazard function for the system is simply

where n is the number of failure modes.

The 'characteristic life' of the system is the value of t for which H_S(t)=1. This represents the time by which we can expect the first failure of the system to occur. If none of the failures has a <1, then this value will be greater than or equal to the mean time to first failure. (It is only equal to the MTFF if _i=1 for i=1, n.)

For a component whose age is T, the expected time to next failure (ETNF) is given by t such that:

This obviously extends easily to the system:

Note the ages of the various components in an engine will generally not be the same. In many cases, components are aged in [stress] cycles which depend on how the aircraft is flown and where in the engine the given part sits. In addition, when an engine is recovered, parts may be replaced either with new or recycled (repaired) ones. In some cases engines may be recovered by module exchanged such that very few of the parts on the recovered engine will be the same as those that were on the engine when it entered the workshop.

Now, if it is required that the system should last a given time , then this value can be substituted into the expression on the left-hand side of the above equation. If the result is greater than 1, then the ETNF is less than . To increase the ETNF to , it will be necessary to replace one or more of the components. To decide which, calculate:

for i=1, n

Rank them in descending order and replace as many as is necessary to reduce the value to less than 1.

Note if =1, ()0 thus a component with a failure mode for which =1 will never be replaced prematurely. Similarly, if <1, ()<0 so there will be a distinct disadvantage in replacing such a component.

The value of is called the TBL and is usually expressed as a percentage of the characteristic life. The likely 'profits' can be determined for different values of the TBL and other key parameters (Crocker, 2003b).