Development of the Minimum Equipment List: Current Practice and the Need for Standardisation

Abstract

As part of the airworthiness requirements, an aircraft cannot be dispatched with an inoperative equipment or system unless this is allowed by the Minimum Equipment List (MEL) under any applicable conditions. Commonly, the MEL mirrors the Master MEL (MMEL), which is developed by the manufacturer and approved by the regulator. However, the increasing complexity of aircraft systems and the diversity of operational requirements, environmental conditions, fleet configuration, etc. necessitates a tailored approach to developing the MEL. While it is the responsibility of every aircraft operator to ensure the airworthiness of their aircraft, regulators are also required to publish guidelines to help operators develop their MELs. Currently, there is no approved standard to develop a MEL, and this poses a challenge to both aviation regulators and aircraft operators. This paper reviews current MEL literature, standards and processes as well as MEL related accidents/incidents to offer an overview of the present state of the MEL development and use and reinstate the need for a systematic approach. Furthermore, this paper exposes the paucity of MEL related literature and the ambiguity in MEL regulations. In addition, it was found that inadequate training and guidance on the development and use of MEL as well as lack of prior experience in airworthiness topics can lead to mismanagement and misapplication of the MEL. Considering the challenges outlined above, this study proposes the combination of system engineering and socio-technical system approaches for the development of a MEL.

1. Introduction

Airworthiness relates to the ability of an aircraft to conduct safe operations, and aircraft maintenance activities comprise its backbone [1]. Aircraft must be maintained and certified under regulatory standards published by regional authorities to ensure airworthiness in every private or commercial aircraft operation and achieve acceptable flight and ground safety levels while ensuring dispatch reliability. Under this mandate, in collaboration with aircraft manufacturers and aviation regulatory bodies, the Master Minimum Equipment List (MMEL) and Minimum Equipment List (MEL) were introduced in the late 1960s [2]. The MMEL and MEL are documents with a list of aircraft components or systems that may be inoperative for aircraft dispatch [3,4]. The former is developed by the aircraft manufacturer, and the latter is based on the MMEL but further customised by each airline depending on its distinct operational characteristics and needs. MMEL and MEL are reviewed, rejected or approved by the corresponding National Aviation Authority (NAA).

However, although several parties and professionals are involved in the development and review of the MMEL, the MEL still lacks a similarly standardised process. Typically, the MEL per operator and aircraft type is approved by the respective competent authority after it has been compiled according to generic guidelines [3,4,5] which describe what must be achieved but provide only a little guidance on how to develop a MEL. Although the MMEL can serve as the basis to build MEL, under a systems approach, the existence and performance of each component, as well as the combined effects of various malfunctioning components or systems, can resonate and lead to adverse situations that had not been anticipated when examining the performance of the former separately from their environment [6]. Thus, mere reliance on MMEL, which typically refers to behaviours of individual components and subsystems under assumed conditions, might not suffice to publish a MEL proper for the operational environment of each air carrier.

Considering the above, the overall aim of our study was to examine the current situation around MEL and suggest whether a more standardised framework is necessary. In the next section of the paper, we present an overview of the current MMEL/MEL development process and respective standards, and we refer to the associated topics of reliability, safety/acceptable level of safety, environment and human factors. The paper continues with a review of MEL-related studies and an analysis of MEL-related accidents and incidents to detect the types of relevant problems/issues and identify possible gaps in the MEL development and application process. After a discussion of the overall picture, our paper concludes with recommendations about the application of system engineering and socio-technical system approaches to the development of MELs.

2. Master Minimum Equipment List (MMEL)/Minimum Equipment List (MEL)

Aircraft are designed with highly reliable equipment. Nevertheless, failures could occur at any time resulting in an accident/incident or simply flight cancellations and delays. The main objective of the Master Minimum Equipment List (MMEL) is to “…reconcile an acceptable level of safety with aircraft profitability while operating an aircraft with inoperative equipment” [3]. MMELs/MELs are used to examine the release of an aircraft with inoperative equipment for flight. Their aim is to permit operation for a specific period under certain restrictions pending replacement or repair of the faulty item. However, the repair must be carried out at the earliest opportunity [2,3,4].

Before the introduction of MEL, the permission or not to operate with inoperative or underperforming systems/components was more a topic of negotiations between the operator and the regulator. Each regulator was forming its judgment and evaluation based on the competence of its staff, personal experiences, and information from previous cases depending on the type of aircraft under assessment [2]. This led to operators claiming favouritism when they had discovered that the list of permissively inoperative components and systems of aircraft of the same type belonging to another airline was less restrictive. The regulation and management of MELs were institutionalised in the 1960s [2].

According to the International Civil Aviation Organisation (ICAO) [7], the overall goal of a MEL is to describe when an aircraft with inoperative components or systems is still airworthy and authorised for dispatch. Airbus [8] describes MEL as a document based on the MMEL and developed by the air operator to optimise flight planning and dispatch as well as the operator’s profitability while maintaining an acceptable level of safety. Nowadays, the general principles governing the compilation, approval, maintenance, and monitoring of MEL are the following [3,4,5]:

• The MEL is based on the MMEL, but the former must be more restrictive than the latter because MMEL is generic.
• The MEL must be produced by the operators and approved by the respective NAA.
• The MEL must be customised/tailored to account for various environmental conditions and operational contexts. This means that approving NAAs consider the environmental conditions (e.g., operating temperature and humidity) as well as the operators’ scheduled destinations before a MEL is approved. For example, the MEL for an airline operator in the United Kingdom (UK) will be different from airlines in China who operate the same aircraft (e.g., prolonged exposure to cold of aircraft systems/components in the UK compared to exposure to dust and sand in China).
• The MEL allows operators to optimise aircraft dispatch reliability. The use of a MEL reduces aircraft downtime and increases airlines’ profit without compromising safety.
• Each of the item/equipment in the MEL has conditions for dispatch. An aircraft cannot be dispatched until the category of the equipment/item in question is confirmed from the MEL.
• Equipment not listed in the MEL are automatically required to be operative for the dispatch of an aircraft.

Various professionals are involved in the process of MMEL [3,5]. Interactions within and across (sub)systems are extensively analysed, ensuring that multiple failures would not lead to an unsatisfactory level of safety by considering the impacts of critical failures and/or unserviceable items on flight safety, crew workload and operations.

Table 1. Differences between the Federal Aviation Authority (FAA) and the European Aviation Safety Agency (EASA) MMEL development and approval [5,9,10,11].

FAA	EASA
Final MMEL is developed by FAA	MMEL is developed by the manufacturer
Flight Operations Evaluation Board is the primary point of contact	Flight Standards Department is the primary point of contact
Proposed Master Minimum Equipment List is submitted for review	A full MMEL is submitted for review
Approved and published by FAA	Recommended by EASA’s Operations Evaluations Board, approved by the NAA and published by the manufacturer

illustrates the differences in the MMEL approval process between the Federal Aviation Authority (FAA) and the European Aviation Safety Agency (EASA).

2.1. Methods of MMEL Justification

Before creating an MMEL, a thorough analysis must be conducted quantitatively and qualitatively to justify whether a component/system should be included in the list. The main tools used for these analyses are the Failure Mode Effect Analysis (FMEA) and Fault Tree Analysis (FTA) [12,13]. While these tools are meticulous and versatile for performing safety assessments, there are also limitations associated with their use.

Table 2. Advantages and limitations of Failure Mode Effect Analysis (FMEA).

Advantages	Limitations
FMEA provides a systematic approach in assessing the performance of relatively simple systems/components as it provides a systematic approach to system safety analysis.	FMEA does not guarantee the identification of all critical failure modes of a component/system under assessment when there is a lack of information/knowledge/experience.
FMEA offers flexibility in system safety analysis because of its ability to examine a system’s failure modes and their safety impacts on a system/subsystem level or on a component level.	FMEA does not consider the human factors element; therefore, it cannot be used as a stand-alone safety system analysis tool.
FMEA complements other safety assessment tools (e.g., Fault Tree Analysis and Markov Analysis) as it provides source data for critical items/components of a system.	While the FMEA can be very thorough, it does not consider external system/component threats during analysis (e.g., multiple failures and common cause failures).
FMEA considers all possible failure modes and impacts on system operation, reliability, safety, and maintainability.	FMEA needs continuous management to keep it up to date. It takes time and is expensive to generate.
FMEA identifies both critical single failure events and latent failures.	FMEA does not consider multiple failure analysis within a system.

and

Table 3. Advantages and limitations of Fault Tree Analysis (FTA).

Advantages	Limitations
FTA identifies all basic events and describes their relationship within a system.	FTA requires a thorough understanding of the design, and this might be a challenge especially when the design is new.
FTA permits the evaluation of hypothetical events to determine their potential impacts on the top event.	FTA is tailored to a top event; thus, it includes only failures/events concerning the top event. Besides, the contributing events are not exhaustive as they are based mainly on the analyst’s judgement.
FTA forecasts potential failures in a system’s design, thus identifying areas of improvement within a system and enabling safety improvements.	FTA is not 100% accurate because it is based on an estimate/perception of reality. In addition, it does not consider maintenance and periodic testing of a system/subsystem.
FTA can be used during the design and operational phase of a system.	FTA depends mainly on the top event; thus, if incorrectly defined, the FTA will be incomplete/incorrect.

highlight the advantages and limitations of FMEA and FTA correspondingly [14,15,16].

The application of FMEA and FTA is based on results from qualitative and quantitative analyses and considers any optional and redundant equipment to inform decisions and develop a MMEL. Qualitative analysis is carried out before quantitative analysis [3,4,13]. It includes an evaluation of the effects of inoperative or underperforming components and systems on aircraft operation, flight crew workload and passenger safety to assess the achievement of an acceptable level of safety for dispatch [4]. Additionally, the qualitative analysis must ensure that the combined impact of multiple inoperative pieces of equipment will not lead to a catastrophic/hazardous failure [4]. Quantitative analysis supplements qualitative analysis [3,4] and is performed for items/equipment/components that are characterised as critical to the safe operation of the aircraft [4]. Furthermore, additional analysis may be required to analyse the rectification interval of each component or system [13]. This type of analysis adopts the System Safety Assessment (SSA) process which is based on the quantitative results from the FTA or FMEA techniques [12,13].

If an item is over the minimum required for safe operations in a particular flight route/condition or the aircraft could be operated under restrictions, inoperativeness of the specific item may be accepted and approved for inclusion in the MMEL. For example, the flight data recorder system in a Bell 412 Helicopter may be out of service for a limited time [17]. In addition, although the number of items with identical functionality installed on an aircraft depends on the manufacturer, operating a piece of equipment in the optional category is subject to the satisfaction of the NAAs that an acceptable level of safety would be maintained. If the functions of the system/item under assessment can be substituted by an alternative system/item with similar functions, then, it would be accepted for MMEL inclusion on a redundancy basis. The condition is that the alternative system would provide an acceptable level of safety as long it is confirmed operative. However, redundancy cannot be claimed for the inclusion of an item in the MMEL if all items/equipment are required to be operative based on the aircraft’s type certificate. For instance, in Bell 412, two air data interference units are installed on the aircraft where one may be inoperative provided the second unit is fully operative for flight [17].

In cases that MMEL allows inoperative items, the aircraft can be dispatched to prevent aircraft grounding situations subject to maintenance or replacement of the affected component or system within the time frame specified in the MMEL. Nonetheless, to maintain the same level of reliability certain restrictions might apply (e.g., transferring functions to another fully operative system, flight limitations, night/day operations restrictions) to ensure that safety is not compromised.

2.2. Factors Considered in MMEL/MEL Development and Justification

This section summarizes the principal factors which are collectively mentioned by Airbus [3], EASA [4], and UK CAA [5] and exert a major influence on the development of a MEL and affect decisions to include or exclude items from the list.

2.2.1. Reliability

Despite the technological advancements over time, the demand for highly reliable and performing systems has increased due to the complexity of modern systems [18,19]. Reliability of a component/system plays a key role during the MMEL development process as it helps to analyse and predict possible failure causes through the application of engineering knowledge [19]. Reliability plays a role in both MMEL and MEL. Reliability analysis is performed during the MMEL development and justification by using the tools and techniques mentioned in Section 2.1 above, and sufficient reliability must also be ensured for MEL items during operations.

According to Airbus [3], the MMEL contributes to the operational reliability of airline operators as it optimises dispatch reliability by reducing aircraft downtime. To maintain a MEL item’s reliability, servicing/scheduled maintenance is required [20], and MEL items must be inspected at predetermined time intervals prescribed by the manufacturer or regulator.

2.2.2. Safety/Acceptable Level of Safety

Acceptable Level of Safety (ALoS) is primarily related to aircraft accident prevention, and its definition depends on the region, regulatory framework, safety records, etc. During the MMEL development process, crew performance and workload must be considered along with the effects of system/component failures on landing and take-off and their impact on the aircraft and its occupants [4]. In the context of MEL, ALoS can be maintained by adjusting aircraft operational limitations, transferring a system or component’s function to another functioning system or a system that provides the information needed or performs similar functions as long as the crew workload changes are acceptable, and the training provided to the crew remains sufficient and relevant [4].

Another way of maintaining an ALoS during MEL application is by developing maintenance actions based on the MMEL (e.g., deactivating and securing the system/component concerned). For instance, for the Bombardier CL600 concerned, to maintain an ALoS on a lavatory fire extinguishing system when it is inoperative a placarding procedure is carried out: Associated lavatory door is locked CLOSED and placarded, “INOPERATIVE–DO NOT ENTER” [21]. Another example regarding the Airbus A320 is the Emergency Locator Transmitter (ELT) which broadcasts signals in the event of an accident; to maintain the ALoS, the inoperative ELT must be deactivated and repaired within 90 days [22].

2.2.3. Environmental Factors

MMEL development cannot be complete without the assessment of the varying environmental conditions in which aircraft would operate. Commercial aircraft operate between different regions; thus, their availability must not be impacted by the environment since designing an aircraft for a particular region would not be cost-effective [23]. Therefore, designers must obtain adequate knowledge of the environment so that to design aircraft that can withstand varying environmental conditions [24] while observing various local and international environmental standards and regulations.

Furthermore, concerning MMEL development and justification, there must be measures to reduce environmental impact on aircraft dispatch, e.g., impact of rain and icing conditions. With provisions such as effective anti-ice and wiper systems, aircraft dispatch is not limited/restricted in these conditions. In addition, it is important to consider the aircraft’s flight envelope to specify the aircraft’s maximum and minimum altitudes quantitatively when systems or components underperform or are out of service and define dispatch conditions (i.e., GO–IF items) to facilitate aircraft operations.

2.2.4. Human Factors

The goal of system safety assessments is to enhance a system’s reliability, performance and safety by considering the persons (e.g., flight crew, ground crew and engineers) that will interact with the system. Reducing the effects of possible human errors must be a proactive and systematic activity considered during the design phase of a system [15]. Therefore, every system analysis must encompass human factors, particularly during the MMEL development and justification process. For instance, the application of sound ergonomic principles in the design of cockpit instrumentation, displays and controls can alert flight crews of any technical failures and provide timely and effective information (e.g., appropriately sized and readable figures) [15].

Consequently, as part of justifying the inclusion of an item in the MMEL, human factor analysis is conducted to anticipate the operation of cockpit systems/computers in varying operational conditions. However, it must be noted that the management of human factors is equally important throughout the lifetime of the aircraft during which MEL applies. Hence, it is imperative to understand the impact of an inoperative MEL item on crew performance when developing the lists [3]. For instance, Job Task Analysis [25] is a technique that can be conducted before carrying out any MEL-related task to identify the required resources (e.g., knowledge, certifications, and experience) for the successful execution and completion of the task.

Furthermore, worksheets and logbooks should be used to communicate any component failure during post-flight or pre-flight inspections. Logbook entries are the starting point for assessing defects of components included in a MEL [8] and help the ground crew understand the causes of failures. This practice facilitates communication between pilots and engineers and ensures that they are aware of MEL tasks that have been completed or are pending. Moreover, the consistent use of logbooks encourages teamwork and improves coordination, especially between work shifts.

3. Literature Review

3.1. Utility of MEL

Munro and Kanki [26] described the MEL as an operational document for air operators, which has direct implications on the safety and airworthiness of an aircraft. Pierobon [27] shared a similar opinion by naming MEL as a barrier against aircraft dispatch with unauthorised defects. Grüninger and Norgren [28] believe that MEL serves two different purposes. Its first purpose is to identify aircraft systems/components that could be inoperative while keeping the aircraft airworthy for dispatch. The second purpose of MEL is to serve as a reference document for engineers and pilots to conduct MEL-specified tasks/procedures before aircraft dispatch. Interestingly though, Hertzler [29,30] suggested that the name MEL is unsuitable for the specific document as it could be possibly interpreted as a list of equipment/items/systems that must be installed on an aircraft. Thus, he suggested a name change to “permissibly inoperative instruments and equipment or stuff that doesn’t have to work”.

Following a report published by the Accident Investigation Board of Norway [31], Herrera, Nordskaga, Myhreb and Halvorsenb [32] researched the impact of changes and developments in the Norwegian aviation industry. Amongst other findings, the authors found that, although MEL provides information about the overall status and serviceability of an aircraft, it was not considered as a parameter in the holistic assessment of safety and a leading indicator of safety performance. Consequently, Herrera et al. [32] recommended the development of a risk assessment model that would integrate safety indicators such as the MEL to facilitate the identification of maintenance-related airworthiness and safety issues by air operators proactively.

3.2. Differences in MEL Standards and Requirements

In his review, Feeler [33] confirmed differences in MEL standards worldwide. For instance, he compared MEL standards for corporate/business jets published by Transport Canada (TC) and the Federal Aviation Administration (FAA), and he observed that MEL provisions and applications differ in these regions. In Canada, both business and commercial operators can operate without an approved MEL, and the decision to fly is ultimately based on the pilot in command by considering, amongst other factors, applicable Airworthiness Directives and aircraft equipment/systems required for the intended flight route and conditions (e.g., day or night flight, operating under visual flight rules or instrument flight rules) [34,35]. Even where there is an approved MEL, the ultimate dispatch decision is still made by the pilot in command [33,34].

However, in the United States, non-commercial, business/corporate operators (a.k.a. Part 91 operators) are not permitted to operate an aircraft without a MEL [33]. Nonetheless, compared to their commercial counterparts, Part 91 operators enjoy some leniency. For example, commercial operators or operators with MELs approved under the Federal Aviation Regulations (FAR) 135, 129, 125 or 121 must comply with the repair intervals specified in MMEL/MEL, whereas Part 91 operators are not obligated similarly. Hertzler [29,30] compared the use of MEL under two distinct types of regulations, FAR Part 135 and 91, and, amongst others, found that MEL is not a technically approved document for Part 91 operators because they are authorised to use the MMEL as MEL, subject to FAA approval. Moreover, for the same category of operators concerned, compliance with deferral categories/repair intervals specified in MMEL was not mandatory. It is noted that, according to the advisory circular published by FAA [36], MELs approved under Part 135 apply even when the operator conducts operations under Part 91. According to FAA [36] “to provide relief to operators under the MEL concept, some operators may find it less burdensome or less complicated to operate under the provisions of FAR 5 91.213(d)”.

On the other hand, in Australia, aircraft are not allowed to operate without an approved MEL or a manual for permissibly unserviceable components/systems under the provisions of CAR 37 [37]. In addition, in the United Kingdom (UK), aircraft are not permitted to commence a flight with inoperative equipment governed by Commission Regulation (EU) No 965/2012 [5,38]. Therefore, although the institutionalisation of MMEL/MEL has been promoted since the 1960s [2], some countries still exempt operators from the scheme and the aviation industry lacks a uniform approach.

3.3. Issues in MEL Development and Application

In the late 1980s, FAA launched a special inspection program to evaluate compliance of commuter air carriers with FARs with the participation of fifteen FAA inspection teams, consisting of six airworthiness inspectors each. A total of 35 air carriers were thoroughly inspected with a focus on 13 different areas, the MEL included [39]. The teams identified a total of 87 findings relevant to MEL, and they highlighted the following ones:

• Aircraft had been dispatched with inoperative systems/equipment not covered/permitted by the MEL.
• Cases of late rectifications of MEL items; air carriers operated MEL items/equipment for extended periods.
• Unrevised MELs or MELs less restrictive than MMELs.
• Inadequate placarding procedures as required by MELs.
• Inappropriate use of MELs (e.g., use of an Airbus A319’s MEL on an A320 model or Bell 412’s MEL on AgustaWestland AW139).

The overall conclusion of the FAA airworthiness inspectors was that there was a need for MEL compliance training as management personnel were not familiar with the MEL. Interestingly, over 30 years later, similar concerns were raised by Airbus [8] whose report restated the correct application/use of the MEL with a focus on compliance with its provisions as well as the principles and best practices when deferring and dispatching aircraft according to MEL. Furthermore, Pierobon [27] stressed the need for pilots and engineers to have prior knowledge and experience in airworthiness management for proper interpretation of the MEL document because the short familiarisation training received by pilots is insufficient. For instance, as part of the MEL application process in Canada and Australia, there is a requirement for operators to have MEL training programmes in place before approval and commencing operations with the MEL [37,40]. On the other hand, in the USA and UK, MEL training requirements are not defined in their respective guidance documents [5,36,41].

Similar findings were revealed by the study of Munro and Kanki [26], who reviewed 1140 maintenance reports issued between 1996 and 2002 and detected 143 reports relevant or related to the use of MELs. Their research identified improper deferral of MEL defects, failure to accomplish MEL specified tasks due to errors of omission, placarding issues and unrecorded MEL defects in technical logbooks. However, Munro and Kanki [26] also revealed contributory factors to MEL-related incidents including time pressure, unclear MELs, lack of familiarity, misinterpretation of the MEL, and communication flaws regarding the applicability of the MEL to aircraft status.

Moreover, Pierobon [27] stated that there is no standard MEL development methodology. After collecting opinions from industry professionals, especially those experienced in the MMEL/MEL process, he concluded in the necessity for NAAs to publish more specified guidelines to help air operators develop their MELs. This position and urge agree with the work of Feeler [33]—as presented in Section 3.2 above, the concerns of Hertzler [29] about the difficulty in interpreting the FAR Part 91.213 MEL regulations, and the observations of Yodice [42] regarding the ambiguity in FAA MEL regulations. To overcome these inherent challenges, the professionals interviewed by Pierobon [27] recommended the following improvement points:

• Delegating the MEL responsibility to persons experienced in MEL development and understanding the methodologies behind the development and justification of the MMEL.
• Appointing and training staff to specialise in the MEL authoring and review processes.
• Outsourcing MEL to knowledgeable and experienced professionals to ensure consistency in the MEL development and review process.
• Mandating the customisation of MELs to each operator per different aircraft model (i.e., reject mere duplications from the MMEL).
• Provision of adequate guidance from NAAs through a clear and detailed framework or methodology.

3.4. Published Studies on MEL-Related Accidents

Grüninger and Norgren [28] analysed the Spanair’s McDonnell Douglas MD-82 fatal crash. The aircraft crashed shortly after take-off because the flaps/slats were not deployed due to a series of omissions/mistakes [43]. The investigation concluded that the take-off warning system did not activate, leaving the crew clueless about the incorrect configuration of the aircraft. The flight had been dispatched according to the MEL due to a faulty ram air temperature probe heater. Albeit the ‘ground sensing relay’ controls for both the take-off warning system when on the ground and the ram air temperature probe heater when airborne, the MEL did not require a detailed inspection to determine if the source of failure was, in fact, the inoperative temperature probe or a defective ground sensing relay. Had the MEL specified this, then perhaps the inoperative take-off warning system, which is a ‘No Go’ item if faulty, could have been discovered. Furthermore, the report also highlighted other instances of MEL misuse days before the accident; in one case, the crew had used the MEL during taxiing while it should be consulted only on ground before taxiing or take-off, and, in another case, the crew used the MEL without consulting with technicians/engineers.

Grüninger and Norgren [28] asserted that the interconnectedness and complexity of modern aircraft systems require a detailed understanding of the failure modes of each component/equipment within each system because a system’s malfunction can be caused by several failures, but a single point of failure can also have several different effects. The authors above pointed out that the MMEL does not cover all conceivable scenarios during the operational phase of an aircraft, and they stressed the importance for engineers and crew members to maintain their ‘mindfulness’ since they comprise the last line of defence when dispatching an aircraft under the provisions of a MEL. Nonetheless, as Thomas Fakoussa, founder of Awareness Training Fakoussa (cited in Pierobon [27]) articulated, even with the MEL, pilots need advanced troubleshooting skills to tackle failures/defects under the provisions of the document. This is because flight crews are more aware of the type of operation and condition ahead of them (weather, terrain, region, etc.) as well as the required components/systems for aircraft dispatch.

Pierobon [27] analysed the Air Canada Boeing 767 event in 1983 where the aircraft was dispatched with inoperative fuel tank gauges and ran out of fuel while airborne [44]. Although the aircraft landed safely, the investigation report states that the captain had “consulted the MEL in a very cursory way” before the flight [44], suggesting that the MEL was not thoroughly reviewed by the pilot. Another concern raised by the investigators was the fact that the maintenance control centre on another occasion had granted an aircraft release against the restrictions of the approved MEL. However, the MMEL should not be consulted once a MEL has been customised for an aircraft; before this accident, an illegal relief had been granted based on the MMEL [44]. Pierobon [27] believes that the dispatch was based on (mis)perception rather than the use of the MEL, which must be the ultimate decision-making tool for aircraft dispatch for both pilots and engineers.

4. Review and Analysis of MEL-Related Events

Considering the standards, guidelines, reports and literature reviewed above, the authors aimed to complement the work of Munro and Kanki [26] and examine the types of MEL-related issues emerging from aviation safety events to detect necessary intervention areas. It is noted that the goal of the research was not to derive epidemiological data and rates across and within the regions of the investigation agencies. Instead, we aimed to map types of MEL issues that have contributed to incidents and accidents, generate an overview and compare the findings against relevant literature to detect possible development gaps in the particular area. The first step was to identify the sources of safety investigation reports and define proper keywords to conduct the search. The criteria for selecting sources were the availability of reports online and publicly in the English language from regional agencies that are responsible for a large volume of aviation operations. The databases identified were the ones maintained by National Transportation Safety Board (NTSB) of the United States, Transportation Safety Board of Canada (TSBC), Air Accidents Investigation Branch (AAIB) of the United Kingdom and Australian Transport Safety Bureau (ATSB). All of these repositories relate to the respective country’s registered aircraft and include occurrences that have been investigated by the respective agencies.

Relevant incidents and accidents were identified by utilising the search option on the AAIB and NTSB websites and using ‘Maintenance’ and ‘Minimum Equipment List’ as keywords. This way, the research strings covered also MMEL-related records since the term MEL is a subset of MMEL. The keywords above were also used on the ATSB and TSBC websites, but the search did not result in a substantial number of reports to review; TSBC’s website produced 0 and 4 reports, respectively, and ATSB’s website produced 0 and 1 reports correspondingly. Consequently, considering research time limitations, we decided to review the 400 most recently published incident/accident investigation reports on both ATSB and TSBC websites.

The search described above resulted in 1323 investigation reports, the synopsis/summary and findings/conclusions of each were studied to identify and analyse MMEL/MEL related events. The analysis included reports where MEL-related issue was identified regardless of its attribution as a contributory factor or not to each event. In addition, cases where unreported or unrecorded defects contributed to the events were reviewed and analysed. The latter cases were consulted based on the view of Airbus [8] on the importance of recording defects to, amongst others, allow the retrofit of the MEL and assess their criticality in conjunction with other possible system and component malfunctionings or failures.

The filtering process described above resulted in the identification of 52 investigated events, 42 of which were directly related to MEL and ten regarded maintenance issues not covered by MEL but indirectly and likely affecting safety. In addition, although the search strategy followed is seen as comprehensive enough to generate a representative sample of relevant safety investigations, there might be reports that were unintentionally excluded from this study (e.g., input/typing errors of operators when populating the fields of the databases searched) as well as MEL-related events that have happened in other regions. Nonetheless, we believe that the final sample analysed represents the best-case picture adequately when considering the intensive safety initiatives of the specific agencies and the overall developments in the aviation industry of the respective regions.

Table 4. Results of the search strategy and filtering of reports.

Investigation Agency	Search Strategy	Time Period Covered	Number of Reports Identified/Analysed	Number of Reports Relevant to This Research	MEL-Related Issues (Contributory)	MEL-Related Issues (Non-Contributory)	Indirect MEL-Related Issues
Accidents Investigation Branch, UK (AAIB)	Keyword: ‘Minimum Equipment List’	2004–2018	106	5	5	0	0
	Keyword: ‘Maintenance’	2002–2018	179	8	1	0	7
National Transportation Safety Board (NTSB)	Keyword: Minimum Equipment List	1982–2016	83	26	19	6	1
	Keyword: Maintenance Report status: Factual	1994–2019	155	0	0	0	0
Transportation Safety Board of Canada (TSBC)	400 most recently published incident/accident final reports	2005–2018	400	9	1	6	2
Australian Transport Safety Bureau (ATSB)	400 most recently published incident/accident final reports	2012–2018	400	4	3	1	0
		Total	1323	52	29	13	10

presents the results of each of the search steps, and

Table 5. MEL events categories.

Code	Category	Description	Result
UNJMEL	Unauthorised and unconfirmed MEL dispatch	Events where aircraft were dispatched against MEL specified requirements, e.g., flying below MEL specified altitude.	21
OPWMEL	Operating without a MEL	Events where operators dispatched aircraft without an approved MEL, e.g., operating an aircraft prior to developing a MEL.	7
UNAMEL	Unanticipated failures during MMEL development and justification	Events where failures were not foreseen during the MMEL justification phase, e.g., unanticipated Electronic Centralised Aircraft Monitor (ECAM) failure.	5
UNSCMEL	Ambiguous and incomplete MEL due to unanticipated scenarios during MEL development	Events where MEL scenarios were not foreseen during MEL development, e.g., insufficient MEL maintenance procedures.	4
LMEL	Late rectification of MEL items	Events where MEL related defects/deficiencies were not rectified on time in accordance with MEL specified intervals, e.g., Late replacement of inoperative thrust reversers.	4
INAPMEL	Inappropriate use of a MEL item	Events where MEL items were misused, e.g., Use of MEL lockout pins for the deactivation of the thrust reversers when it was not required.	1
DHIS	Defects recording/Handover issues	Events where defects were not reported or recorded in the aircraft’s technical logbook as required.	10

summarises the classification of the analysed events. The full list of the reports included in our study is available to the reader upon request to the corresponding author of the paper.

Regarding the accident/incident reports reviewed, AAIB and NTSB provided a detailed discussion of the MEL-related issues identified via a dedicated MEL section/paragraph in their reports, especially in the cases where MEL-related issues directly contributed to the particular events On the other hand, although ATSB and TSBC highlighted MEL-issues in different sections of their reports such as findings, analysis and conclusions, we did not find dedicated parts in the reports addressing MEL-related findings cumulatively. Nonetheless, all the reports reviewed provided enough information to enable the authors of this paper understand the situation and circumstances around the MEL-relevant events. On a side note, only 8 of the 29 reports including MEL-related contributory factors addressed the respective findings through specific recommendations. Although it was outside the scope of our research to evaluate the quality of the investigation reports and the degree of coverage of MEL-related issues through targeted measures, the picture above indicates that investigating agencies did not focus on the resolution of such problems even when they were detected in the course of investigations.

As Table 5 suggests, 50% of the MEL-related events regarded aircraft dispatch against MEL requirements, followed by cases where operations were conducted before MEL was approved (about 17%); this suggests non-compliance with MEL to the level of 67%. Cumulatively, the issues concerning MEL development (i.e., exhaustiveness, completeness and clarity) accounted for 21% of the cases, whereas cases relevant to human error/decision-making when applying MEL were jointly at the level of 12% of the events analysed (i.e., delayed rectifications or misused MEL item).

5. Discussion

Overall, the literature reviewed suggests that aviation professionals are concerned about the current state and application of MELs. Notably, all positions highlighted the importance of MELs and point to the utility of the MEL as a balancing factor between safety and operations where aircraft can be dispatched with inoperative equipment as long as safety is not compromised. However, it has been postulated that a holistic approach is required to streamline the development of a framework/methodology to support the development, maintenance and monitoring of MELs [27,32]. Regulatory authorities and aircraft manufacturers are expected to offer to operators more detailed MEL-related guidance and specific tools along with requirements for respective training programmes.

Given the increasing complexity of aircraft systems, coupled with issues identified in the literature such as different MEL standards worldwide and cases of MEL mismanagement and misapplication [26,29,33], it is important to reinstate the need for standardisation and reinforcement. The issues identified in the literature and revealed through our review of the accidents and incidents above could pose a serious problem and are still prevalent despite MEL was introduced in the 1960s. The urge for MEL standardisation followed by targeted interventions to ensure its consistent and substantive application has become quite undeniable according to aviation researchers and professionals such as Pierobon [27], Hertzler [29] and Yodice [42]. Although literature and previous studies do not argue that the MEL framework should be entirely reformed, its standardisation is expected to ameliorate current issues and support proper and justified customisation of MEL to the operational profile and needs of airlines, minimisation of ambiguity in its implementation and enrichment of respective training. Furthermore, harmonisation of MEL development will allow valid comparisons of practices followed across regions and operators and offer to airlines and NAAs a common reference baseline for knowledge exchange as well as possibilities for continuous review, update and improvement of shared MEL-related processes.

Furthermore, it seems that there is an assumption that the factors/parameters considered during the MMEL development are directly applicable to the MEL, while this may be valid to some extent as MMELs are developed for operators to use as a guide for their MEL development, it is important to note that the MMEL alone might not be entirely suitable and adequate for every operator. MMEL professionals attempt to anticipate the worst possible effect of systems failure, but they may not anticipate all probable scenarios and failure modes that can emerge during operations and stem from the complexity of aircraft systems and their interactions with humans and the environment [28].

The above was also confirmed during our analysis of MMEL/MEL related events under the category UNAMEL where professionals sometimes did not consider the history of failure of an equipment/system during the justification phase. Although it can be argued that the events under this category were random, their occurrence highlights the need for operators to customise their MELs to their environment and type of operations that can affect system/component performance rather than just duplicating the master MMEL document which is based on different datasets of failures and performance. In addition, despite most of the events analysed in our study were not fatal or catastrophic, the outcome severity of any future event cannot be guaranteed, especially when flight crews are unaware or unfamiliar with the problem and cannot exert full control over the unfolding situation [45]. The Spanair’s crash studied by Grüninger and Norgren [28] was linked to an unanticipated MEL failure.

Moreover, it is interesting that, even under the current regulatory mandates around MEL, the importance of the latter might not have been understood completely across the aviation industry as indicated by the high frequency of non-compliant cases. For operators with approved MELs, it was observed that, in several instances, aircraft were dispatched with known inoperative equipment or defects even though the operators had MELs in place (category UNJMEL). In addition, all the events where operators dispatched aircraft without an approved MEL (category OPWMEL) regarded the US region. Most of the operators falling under the latter category were FAR 91 operators or regarded operations conducted under FAR 91. This confirms Hertzler’s [29,30] call to operators to apply for MELs under FAR 135 because FAR 91 operators are the most neglected in terms of MEL oversight. The latter enjoy some leniency and do not utilise the MEL concept compared to FAR 135 operators where compliance with MEL and applicable MEL intervals are mandatory as mentioned in Section 3.2 above.

Another issue identified during the review of MEL events was the late rectification of MEL items (category LMEL). Indeed, EASA [4] and Airbus [3] stress the importance of repairing or replacing an inoperative item at the earliest opportunity and not at the most convenient time for an airline. However, although someone could argue a possible relationship of these cases with human error (e.g., lapses or slips) and non-compliance, these events can also be attributed to a lack of understanding of operators about the intended objectives and philosophy of MEL. The latter, instead of being approached as a constraint to operations, should be viewed as a risk management tool that can help in evaluating operational risks and specifying procedures in maintaining safety margins. Nonetheless, we did not identify literature suggesting any direct links between the MEL and the risk management framework of companies.

Furthermore, the cases associated with misinterpretations of MELs (category UNSCMEL) accord with the findings of FAA cited in Pope [39] and Munro and Kanki [26]. As stressed in the literature reviewed, the clarity of MELs and their related regulations along with MEL designated roles within airlines would facilitate the MEL review and development process and improve the reliability of MEL application [27,29,42]. Additionally, air operators need to train their pilots, engineers and aircraft dispatchers on MEL-related operational and maintenance requirements. Based on the nature of events under the specific category, it can be argued that adequate training could have led to anticipation of scenarios within the operator’s operational environment and could have played a positive role. Furthermore, those currently involved in the MEL process might have little or no experience in airworthiness management or competencies and skills in MMEL/MEL. Being type-rated on an aircraft does not necessarily mean that an engineer or pilot is able to fully understand the parameters/factors surrounding the development and application of the MEL and interpret it correctly. Such a situation might lead to adverse events like the ones studied by Grüninger and Norgren [28] and Pierobon [27].

Regarding the ten cases indirectly related to MEL (category DHIS), Airbus [8] highlighted that a logbook entry is the starting point for assessing MEL-related defects/deficiencies. Perhaps, in conjunction with the remarks stated above about proper training, engineers and pilots might not have understood the criticality of registering technical works and problems in logbooks. Undocumented maintenance, unrecorded/unreported defects and improper handover will reduce the information available to pilots, maintenance staff and engineers in making informed decisions about the status and serviceability of aircraft.

Finally, the traditional approaches highlighted in Section 2.1 above have been criticised because they do not consider visibly and methodologically the human interactions with systems [6,46] which are inextricable parts of aircraft operations and are closely related to the development and application of MEL. Due to the interconnectedness of elements and processes that increase the complexity of modern systems, there is a need for more holistic and nonlinear frameworks to system safety analysis. Recent socio-technical systems engineering approaches, which are built upon systems theory, consider the interactions and interdependencies between human and technology [6,47] and have introduced tools and techniques to tackle the limitations of traditional approaches. For example, Leveson [6] has proposed the Systems Theoretic Process Analysis (STPA) technique, Hughes et. al. [46] recommends the Systems Scenarios Tool (SST), while Mumford [48] introduced the Effective Technical and Human Implementation of Computer based System (ETHICS) tool. Although each approach is accompanied by limitations in its endeavour to understand and deal with complexity, these tools suggest a more structured path to socio-technical systems modelling and offer a dynamic approach to systems safety engineering. While such techniques are relatively new compared to FMEA and FTA and perhaps more resource-demanding in their application, they are promising in overcoming the limitations highlighted in Table 2 and Table 3 above and, apart from the proximal technical and human components of aircraft operation systems, could also account for various complex roles aviation stakeholders hold in the MEL development process and consider contextual parameters (e.g., specific NAAs policies and strategies, cultural and societal factors).

6. Conclusions

In this study, we reviewed the current situation around the development and application of MEL as well as literature referring to respective challenges, and we performed an analysis of MEL-related events. Overall, the results of our analysis as presented in Table 5 agree with previous work and suggest the need to revisit the processes related to MEL as demonstrated by the several issues mentioned in the safety investigation reports reviewed and related to unauthorised MEL dispatch, ambiguous MELs and airlines operating without a MEL. The lack of a systematic and uniform approach to MEL, apart from depriving the aviation industry of a standardised and reliable application of MEL, might have led to an underestimation of its importance and criticality for safe operations. The ambiguity detected in MEL-related standards along with the diversity of approaches to MEL in various regions might have contributed to building perceptions which suggest, on the hand, that the MEL is a quick-to-achieve compliance requirement by solely replicating or slightly changing MMELs, and, on the other hand, that individual defects emerging in day-to-day operations can be dealt only subjectively.

However, MEL is not just about the aircraft; it is about the aircraft in service operated by humans within a specific environment. While manufacturers try to anticipate varying environment conditions when compiling MMELs, the latter alone are usually inadequate for the development of MELs. As stressed by Leveson [6], system failures do not occur only as a result of random and individual component malfunctions; instead, we must consider interactions between socio-technical system agents (i.e., technology, end-users, organisations, regulators, society and environment) within and across system levels, which are often neglected during current MEL practice. Therefore, in line with the views of Leveson [6], the MEL development process should be viewed as a dynamic process involving the NAAs, air operators, pilots, engineers and flight dispatchers. The work of Karanikas and Chatzimichailidou [49] who suggested a combined qualitative and quantitative approach to compare system configurations encapsulates the newly introduced Systems-Theoretic Process Analysis (STPA) technique [6] and is an example of how system analysis could consider (1) non-binary behaviours of system agents, (2) the degree of influence of each agent on system performance, and (3) the criticality of each agent. The particular approach, as well as any other approach that encompasses systems engineering and socio-technical principles, could comprise the basis for a holistic and systematic methodology for MEL development and application and address the weaknesses of currently used techniques as presented in Section 2.1 of this paper.