MSG stands for Maintenance Steering Group. The three methods that carry its name, MSG-1, MSG-2 and MSG-3, are the reason a modern aircraft maintenance programme looks the way it does. Every task in your AMP, every interval you defend to an auditor, inherits its justification from a line of reasoning that began in 1968 with a committee that could not afford to maintain a Boeing 747 the old way.

This is the story of how the industry stopped assuming and started analysing, and why the shift from MSG-2 to MSG-3 came down to changing a single question. The video waypoints below are taken from Lesson 2 of Raven’s Aircraft Maintenance Programme Development course.

Before MSG: the hard-time era

In the propeller and early-jet decades, maintenance rested on one intuitive belief: parts wear out predictably with age, so if you overhaul or replace them at a fixed number of hours, you reset the risk. That is the hard-time philosophy: everything has a life, run to the life, then restore or discard. It felt obviously right, and for some parts it was.

The trouble is that overhauling everything on a clock is expensive and can be counter-productive. Stripping a complex system that is working introduces fresh assembly errors and infant failures. As fleets grew, airlines watched costs climb and engineers began to suspect that much of the scheduled heavy work was not buying safety at all.

The Comet: fatigue writes a new rule

Then structure taught a brutal lesson. The de Havilland Comet, the first jet airliner, suffered catastrophic in-flight break-ups in the mid-1950s. Investigation traced them to metal fatigue originating at stress concentrations around fuselage cut-outs, driven by repeated pressurisation cycles.

Failure here was not about calendar age. It was about accumulated cycles and stress, invisible from the outside. No time-based overhaul could have caught it. The Comet permanently changed certification and maintenance thinking: it forced the concepts of fatigue life, of designing and inspecting against crack growth, and of counting cycles rather than hours alone as a usage parameter. The idea that you could keep a pressurised structure safe purely by time-based overhaul was dead.

By the 1960s two pressures had collided. Aircraft were becoming far more complex and far more expensive to maintain on hard-time logic, and accident experience showed that time-based overhaul neither caught every failure mode nor justified its cost. The wide-body was coming, and nobody could afford to overhaul a 747 the way you overhauled a DC-6, or safely justify doing so.

MSG-1: the 747 forces a new method

In 1968, as Boeing prepared the 747, the airlines, manufacturers and the FAA faced a question with no good answer under the old rules: how do you build a maintenance programme for an aircraft twice the size and complexity of anything before it, without simply multiplying hard-time overhauls until it is uneconomic to operate? They formed the Maintenance Steering Group, and its first output became MSG-1.

MSG-1’s insight sounds obvious now but was radical then: instead of assuming every item needs periodic overhaul, analyse each item and decide. For a given component or system, ask whether a scheduled task is both applicable, meaning capable of detecting or preventing the failure, and effective, meaning worth doing for the consequence it addresses. If yes, schedule it. If no, do not.

To structure that judgement, MSG-1 introduced decision-logic diagrams: a guided sequence of questions leading an analyst to the right maintenance task, or to none at all. It also formalised the three classic process outcomes of hard-time, on-condition and condition-monitoring.

MSG-1 worked. The 747’s programme was leaner and better targeted than hard-time would have produced. But it was bespoke to that single project, with no general version other types could reuse.

MSG-2: the method generalised

In 1970, MSG-1’s ideas were generalised into MSG-2, a method any programme could use. It spread quickly and shaped the maintenance programmes of a whole generation of aircraft, so if you work on older types you are still meeting its fingerprints.

MSG-2 was process-oriented and worked bottom-up. You started with a component or system, examined its failure characteristics, and used decision logic to sort it into one of three maintenance processes:

Every item ended up labelled HT, OC or CM. This was a genuine advance: it broke the reflex to overhaul everything, gave engineers a repeatable way to justify tasks, and matched the maintenance process to the item’s actual behaviour.

The hidden weakness

But MSG-2 asked the wrong first question. Starting at the part and asking “what process suits this item?” quietly assumed the point of the task was to protect the item. It did not force the analyst to ask what actually happens to the aircraft and its occupants when the item fails: whether the failure is even noticeable to the crew, and whether it matters for safety at all. Two items with identical wear behaviour but wildly different safety consequences could be treated the same.

Nowlan and Heap: six patterns, and the number that stunned the industry

In 1978, two United Airlines engineers, Nowlan and Heap, published the study the data demanded, for the US Department of Defense. They asked a deceptively simple question with a huge library of airline reliability data behind it: for real aircraft components, how does the probability of failure actually change with age? If age-equals-risk were true, most items would show failure rates climbing steadily as they got older.

The data revealed not one behaviour but six distinct failure patterns. Some items do show a classic wear-out age: a bathtub curve, a steady wear-out rise, or a gradual increase. But many others show infant mortality followed by a constant rate, or simply a constant, random probability of failure with no relationship to age at all.

Then came the number. Only a minority of item types, roughly eleven percent, showed a wear-out age where scheduled overhaul or replacement would help. The large majority, about eighty-nine percent, had no such age at all. For those items a fixed-time overhaul is not merely wasteful: by disturbing a working unit, it can introduce failures. The intuition that had run maintenance for fifty years was, for most components, simply wrong.

The reframing: consequence first

If age rarely predicts failure, then scheduling by age is the wrong starting point. Nowlan and Heap reframed the problem around consequence. First ask what the failure does: is it hidden or evident, does it affect safety, operation, or only economics? Only then ask which task, if any, is worth doing. This is Reliability-Centred Maintenance, and it inverts MSG-2’s logic from bottom-up to top-down.

RCM’s genius is triage. It concentrates effort where the consequence is severe, especially on hidden failures the crew cannot detect, which can combine with a second failure to cause an accident. It is relaxed about failures whose only consequence is cost. And it accepts that for many items the right scheduled task is none: you run them to failure by design, because no task would improve safety.

MSG-3: task-oriented, top-down logic

MSG-3 is the industry method used to derive the baseline of scheduled maintenance tasks for a transport aircraft. It does not begin with a component. It begins with a functional failure, meaning a function the aircraft is meant to deliver and the ways it can stop delivering it. It then asks two questions in that order: what are the consequences of that failure, and what task, if any, addresses them?

The output is therefore not a label attached to a part. It is a specific task with an interval, selected because it is applicable to the failure and effective against the consequence that failure carries.

Evident or hidden, then the consequence category

The first question in MSG-3 is whether a functional failure would be evident to the operating crew during normal duties, or hidden. That distinction drives everything, because hidden failures are the dangerous ones: nobody knows the protection is gone until it is needed. From that split, each failure is sorted into one of five categories:

Safety categories demand a task; economic categories only justify one if it pays. This is triage written into a flowchart.

Only once the consequence is known does MSG-3 select the task type: servicing or lubrication, an operational or visual check, an inspection, a functional check, a restoration, or a discard. The point is the order. Consequence first, task second. That order is the entire lesson of the last fifty years.

Three analyses, and the document they produce

MSG-3 does not stop at systems and powerplant. It runs parallel analyses for structures, including fatigue and the damage-tolerance thinking the Comet forced on the industry, and a zonal analysis that inspects whole areas of the aircraft for general condition, security and, importantly, wiring. Later revisions added dedicated treatment of lightning and high-intensity radiated fields (L/HIRF). One coherent method, several streams.

Applied to a new type by the manufacturer and the airlines together, MSG-3 produces the recommended baseline of scheduled tasks, which becomes the Maintenance Review Board Report, the seed document for every operator’s AMP. So when you open an MRBR or an MPD, you are reading MSG-3 output: consequence first, task second, interval attached.

Why the history is not just history

Two ideas from this story survive into every programme you build or revise.

The first is that age is not risk. The Comet proved a pressurised structure can fail on accumulated cycles and stress rather than calendar age, and Nowlan and Heap proved the same for most components. That is why cycles count as a usage parameter alongside hours, and why structure still gets its own analysis. The second is that a task must justify itself. Stripping a working system on a clock can buy fresh errors rather than safety, so no task in a modern AMP simply inherits a life. It earns its place by being applicable and effective against a consequence that matters.

Hold on to both, and the rest of the programme (source documents, task types, intervals, the reliability programme) stops looking like paperwork and starts looking like reasoning.

Learn the full method

The waypoints above are four of six in one lesson of ten. Raven’s Aircraft Maintenance Programme Development course takes you from the legal basis in M.A.302 through source documents (MRBR, MPD, ALS/CMR), task types and intervals, fuel tank safety and CDCCL, structures and ageing aircraft, the reliability programme, and approval, ending in a full build walkthrough.

Related reading: Part-CAMO: A Complete Compliance Guide, Airworthiness Directive Management, and What Is a CDCCL? for the fuel tank limitations that sit inside the programme.

FAQs