The Open Oil System — Caps, Plugs and Covers That Drain Both Engines

The pattern: engine oil systems are closed by small, undramatic parts — oil filler caps, borescope port plugs, magnetic chip detector covers, rotor drive covers — and when maintenance leaves one unsecured, the engine pumps its oil overboard in flight. When the same person does the same task on every engine in one visit, the error becomes a dual-engine oil loss. The anchor: during a night shift at East Midlands, an undermanned line crew — four on duty instead of the nominal six — meant the shift's Line Engineer performed the 750-hour borescope inspections of both engines of a Boeing 737-400 himself, while also running the shift. The HP rotor drive covers, one per engine, were never refitted, the required ground idle runs were never done, and the job was signed off as complete. Next morning, climbing out for Lanzarote, both oil quantities fell toward zero and both pressures collapsed; the crew declared a Mayday and diverted. Both engines had lost almost all their oil and were shut down on Luton's runway during the landing roll.

The AAIB's first causal factor is the signature of the whole pattern: the aircraft was presented for service with the inspections "signed off as complete in the Aircraft Technical Log although the HP rotor drive covers had not been refitted" (AAIB AIR 3/96 Synopsis). The report's answer became doctrine — Safety Recommendation 96-31: work affecting the airworthiness of an engine "should not be conducted on all of the powerplant installations of an aircraft at one point in time by the same personnel" (AAIB AIR 3/96 §4.4). Segregate the engines, or interpose an independent check and a leak-proving run — because twin-engine redundancy is void against a replicated error.

1. Every oil-system closure you disturb — cap, plug, cover, detector — is an open item until it is refitted, torqued and verified; track each one to closure.
2. Where practical, do not let the same person perform the same airworthiness-critical task on all engines in the same visit; split the work or split the shifts.
3. After any oil-system disturbance, run the engine as the manual requires — a ground idle run long enough for a leak to declare itself — before certifying.
4. Certify only what is physically complete: a signature on an inspection with its covers off is the pattern's ignition point.
5. If oil quantity falls on more than one engine in flight, believe the gauges — a shared maintenance visit is a shared failure mode, and "faulty indication" is the trap.

The specific dual-engine escape is rare, but the underlying closure error recurs steadily: unsecured oil-system closures feature repeatedly in the UK CAA's recurring maintenance-error listings, and the AAIB noted "numerous reports" of engine oil filler access panels found open before departure or detaching in flight across one operator's A320 fleet alone (AAIB AAR 1/2015 §1.17.8).

Climbing through about FL140 both oil quantity gauges read about 15 percent and falling; by 1205 hrs both oil pressures were below 13 psi and a Mayday was declared. The aircraft diverted and landed at Luton at 1214 hrs, both engines shut down during the landing roll at about 120 kt; both engines had lost almost all their oil, and cowls, wings and flaps behind the engines were filmed with it. No injuries; both engines were removed for examination (AAIB AIR 3/96 Synopsis, §1.1.1).