History of Flight

Lauda Air Flight 004 (NG004) was a scheduled passenger flight from Hong Kong to Vienna, Austria, with an intermediate stop in Bangkok, Thailand. The flight departed Bangkok at approximately 23:02 local time. Six minutes after takeoff, investigators concluded that an "L REV ISLN VAL" message appeared on the Engine Instrumentation and Crew Alerting System (EICAS) panel. Based upon conversation between the captain and first officer, this message appeared intermittently during the initial climb. It was concluded by investigators that this EICAS message may have indicated that the thrust reverser hydraulic isolation valve (HIV) for the left engine had opened, or was intermittently opening, allowing hydraulic fluid to pressurize the thrust reverser restow system. The in-flight opening of the HIV (and associated EICAS message) was believed to be associated with a 767-300 thrust reverser safety system referred to as the "auto-restow" system. The auto-restow system on the 767 was intended to provide an automatic reverser restow command in flight if one or both reverser sleeves were detected, by proximity sensors, to have moved aft from their fully stowed position.

There were no crew actions or procedures associated with the occurrence of this EICAS HIV message since it was considered only an "advisory" message at the time. After consulting the Quick Reference Handbook (QRH), the crew elected to continue the flight to Austria rather than return to Bangkok. At approximately 15 minutes into the flight and at approximately 25,000 feet altitude, one flight crew member commented that the reverser had deployed.

This comment was immediately followed by evidence of a rapid airplane attitude change and subsequent in-flight break up, leading to airplane wreckage falling into remote jungle terrain approximately 94 nautical miles from Bangkok.

Thrust Reverser Maintenance

The Boeing 767-300 accident airplane was delivered to Lauda Air on October 16, 1989. It is a common practice within the airline industry for newly delivered airplanes to undergo engine changes in the first year of operation in order to pair newer engines with higher time engines on the same airplane. The objective of this engine change is to stagger planned maintenance tasks so that both engines are not due for maintenance at the same time. The left engine was installed on the airplane on October 3, 1990, while the right engine was original to the airplane and was installed prior to delivery. Records showed the left engine had 2,904 hours of operation and 456 cycles at the time of the accident, while the right engine had 7,444 hours and 1,135 cycles.

Maintenance records were reviewed as far back as November 30, 1989, and as of August 14, 1990, 13 maintenance actions were noted relating to the left engine thrust reverser system. Ten maintenance actions related to this reverser were noted since January 28, 1991. Most of the actions involved removal of valves or actuators and adjustments to the system. Airplane maintenance monitor displays would subsequently indicate normal reverser operation following this maintenance. Thrust reverser messages would begin to reoccur after several flights.

The most recent thrust reverser maintenance action prior to the accident flight was on May 25, 1991, the day before the crash, in Vienna. This involved removal and replacement of the left engine thrust reverser locking actuator. The Boeing Fault Isolation Manual (FIM) was used by Lauda Air maintenance personal without correcting the problems of reoccurring thrust reverser maintenance messages. Personnel had begun conducting a visual inspection process of the left thrust reverser wire harness. Records showed that the last wire harness inspection was accomplished on March 26, 1991.

Reverser Deployment Effects on Wing Lift

This Boeing Model 767 Lauda Air accident in 1991 resulted in an industry-wide recognition that previously held beliefs regarding the in-flight effects of a thrust reverser deployment were largely incorrect. Prior to this accident, many thrust reverser deployments had been experienced in service on a wide variety of airplanes without any record of a severe airplane controllability problem. As a result of this relatively satisfactory service experience, thrust reverser regulations were primarily focused at keeping the unwanted reverser deployment from happening during takeoff and landing, where it was believed the event could be catastrophic.

The in-flight hazards were primarily addressed by showing that unwanted in-flight deployments were controllable and the plane could be safely landed with the reverser in the deployed position. It was believed that this safety determination had been accomplished during the certification program of the 767 by both the manufacturer and the Federal Aviation Administration (FAA). Information that came from the Lauda Air accident investigation, however, proved this determination to be based upon an incorrect premise: this being that low airspeed thrust reversal hazards were the most critical condition with respect to airplane controllability.

View animation of takeoff profiles with various engine/reverser failure modes below: 

Throughout the 1960's and 1970's, the aviation industry believed that uncommanded in-flight thrust reverser deployment represented a vulnerability to airplane controllability mainly during low speed, at or near the ground conditions. High speed/higher altitude events, though relatively common, had not resulted in reports of loss of airplane control. However, advances in wing/engine nacelle aerodynamics which took place in the late 1970's on airplanes such as the 767 resulted in the development of shorter engine pylons and placements of the engines nearly in front of the wing leading edges, rather than below. This engine placement had the unintended effect of allowing the reverser efflux plume that occurred at high speed and high power conditions to go over the upper surface of the wing, rather than generally under the wing as on earlier designs. Since all previous in-flight reverser controllability testing, including testing conducted on the 767, had been conducted at low speed/engine idle conditions, the actual critical condition for airplane controllability was not revealed until after the Lauda Air accident.

View animation of the reverser efflux pattern and effects on wing lift below: 

Thrust Reverser Operational History Leading Up to Lauda Air

Until the Lauda Air accident, a primary concern relative to thrust reversers was prevention of an inadvertent deployment on or near the ground at low airspeeds. Further, risks for inflight deployments at higher airspeeds and altitudes were believed to be adequately mitigated by required safety features, such as automatic thrust reduction to idle, and throttle interlocks which prevented selection of reverse thrust in flight. It was believed, based primarily on historical evidence, that an in-flight deployment at higher airspeeds would be relatively benign and easily controlled. The history of thrust reversers on transport airplanes had largely substantiated that belief.

The first generation of jet transports did not have thrust reversers. In order to keep early jet engines operating properly, idle thrust levels were relatively high, and airplane antiskid systems were less effective than today's modern systems. This combination of high idle thrust and low antiskid effectiveness led to the development of thrust reversers, for ground use only, in order to enhance deceleration (stopping performance) during landing or rejected takeoffs, especially on wet or icy runways.

Some thrust reversers were designed for limited use in flight (such as inboard engines on the McDonnell Douglas DC-8), to enhance descent performance, much the same as present day speed brakes. Certification rules at the time were aimed primarily at protecting the airplane on the ground against an inadvertent deployment.

Early Regulations

The first mention of jet engine thrust reversing systems in the regulations was CAR 4b, Amendment 6 (July 1957). CAR 4b.474(b) required a positive lock or stop at the flight idle position and a "separate and distinct operation" to enter reverse thrust. In CAR 4b, Amendment 11 (October 1959), CAR 4b.407(a) prescribed, for ground-use only systems, a means to prevent inadvertent deployment. CAR 4b.407(b) prescribed the same safeguards for systems approved for in-flight use. So-called "piggyback" levers, a second set of throttles used only for actuation of the reversers, was the design selected by the majority of jet transport manufacturers.

A safety focus for early thrust reversers was on preventing an inadvertent deployment during takeoff that could result in an excursion off the side of the runway or a runway overrun. In-flight failures, independent of approval for use in flight, were, for controllability and performance aspects, regarded much the same as engine failures. Continued safe flight and landing following an in-flight deployment was assumed. Operational history tended to support this assumption. Until the Lauda Air accident, inadvertent deployments were relatively frequent but had also been controllable, and resulted in continued safe flight and landing.

Early Thrust Reverser Designs

Early thrust reverser designs reversed the exhaust stream (turbine exhaust). Many early jet engines either didn't have fans, or if equipped with fans utilized very low bypass ratios, making fan reversal ineffective. As a result, in combination with the engine installation geometry, the reverser itself was, for wing-mounted engines, usually significantly under or well aft of the wing leading edge, and would not influence flow over the wing if an inadvertent in-flight deployment were to occur. Other airplane designs prevalent at the time had the engines located on the aft portion of the fuselage and clearly would have no influence on the wing's ability to generate lift.

For aft mounted engines, rudder blanking at high levels of reverse thrust during ground operation was a consideration. However, due to the reverser plume suppression resulting from higher in-flight airspeeds, this did not seem to be a problem from a controllability standpoint. Controllability problems following an inadvertent in-flight deployment had not been experienced on large transport airplanes, even though there had been over 100 in-flight reversals reported, on several models of airplanes, prior to the Lauda Air accident.

Although other designs existed, the initial reverser design, still commonly seen today, incorporated a mechanism that rotates open, to block and redirect the turbine exhaust stream. As turbofan engines increased in their size and bypass ratios, later reversers, such as that installed on the 767-300, incorporated "fan-only" reversing systems, and directed all bypass fan flow to turn through "vanes," expelling the flow out the sides of the engine. Engine core flow, or that air which passes through the combustor and turbine sections of the engine, is not affected by the fan-only reverser, and continue to process hot air and combustion products exactly as in forward thrust. "Fan-only" reversing systems now represent the majority of reverser designs on large commercial transport airplanes in service today.

Evolution of Thrust Reverser Testing

Per CAR 4b, and the earliest versions of Title 14 of the Code of Federal Regulations (14 CFR), part 25, certification tests were conducted to evaluate performance effects and handling qualities with reversers deployed. The primary focus was on handling qualities effects (controllability) on the ground, with a secondary focus to establish reverser performance effects. These objectives are accomplished by conducting reverser rollout tests to determine reverser effectiveness. These tests also establish the minimum "cutback" speed (minimum speed for reverser stowage) for landing with a single reverser inoperative.

Regulatory Evolution

With the introduction of the 747, the high bypass, high thrust engines refocused attention on airplane controllability following an uncommanded reverser deployment at high thrust. The certification basis of the 747 was set at 14 CFR, part 25, Amendment 8 in February 1965. Almost concurrently, 14 CFR, part 25, Amendment 11, including 14 CFR §25.933 was developed and adopted in June 1967. Amendment 11 became effective prior to certification of the 747 (June 1969), but too late to have been included in the certification basis. As a result, special conditions were developed for the 747 that incorporated the requirements of Amendment 11.

The Boeing Model 767 Reverser System

The original 767 thrust reverser, incorporating a Pratt and Whitney JT9D-7R4 turbofan engine, contained features very similar to other large, high bypass turbofan engine installations of the era such as the model 747. These early designs incorporated what is referred to as a "two-lock" reverser system. In a two-lock reverser system, there are two separate systems which both have to be activated in order to power the reverser to the deploy position and to restow the reverser. One of the systems involves a means to "isolate" the reverser while in flight, and for the Pratt and Whitney JT9D and PW4000 installations, is referred to as the "hydraulic isolation valve" or HIV. Once in flight, the valve is normally closed through ground/air logic switches, which prevents hydraulic pressure from being available to the reverser system. The second "lock," or valve, is referred to as the "directional control valve" or DCV, and is normally in the stow position by means of constant spring pressure. An electric signal is necessary to move the valve to the deploy position, and is intended to always return the valve to the stow position following use of the reverser after landing. Upon beginning taxi following landing, the electric signal is removed from the DCV, and the hydraulic port of the valve returns to the stow position. The DCV does not return to the deploy position again until commanded by the crew during activation of the thrust reverser levers in the cockpit following the next landing or rejected takeoff.

View animation of the thrust reverser system and operation as installed on the accident airplane below: 

The model 747 had experienced several in-flight uncommanded thrust reversals in service at the time the model 767 design was being considered. Although these in-service incidents on the 747 did not result in airplane controllability problems being reported, they did pose a significant disruption to service since they often resulted in an engine shutdown and possibly an unscheduled diversion to an alternate airport. It was for this reason that the initial 767 reverser design using the PW JT9D-7R4 engine (as well as later used on the PW4000 powered model 767-300), incorporated a feature known as the "auto-restow" system. This feature was intended to reduce or eliminate the occurrence of what had been observed on many of the earlier 747 uncommanded in flight reversal events.

In these earlier events, one or both reverser sleeves were discovered to have migrated aft while in flight (usually due to sleeve misrigging), and, in combination with flight air loads, eventually were pulled aft into the deploy position, thereby causing an uncommanded thrust reversal and an engine in-flight shutdown. The auto-restow system originally incorporated on the 767 was designed to detect a slight aft motion of the thrust reverser sleeve from the stowed position and then trigger a momentary stow command by opening the HIV. Since the DCV was always positioned to the "stow" direction in flight, the slight aft movement of the reverser sleeve would cause the auto-restow system to momentarily open the HIV to port hydraulic pressure to the stow side of the actuators, thereby re-stowing the reverser. This system had worked satisfactorily in service up to the Lauda Air accident.

767 Thrust Reverser Certification Testing

Certification of the 767, equipped with Pratt & Whitney JT9D-7R4 engines, began in 1981 and included testing for in-flight thrust reverser deployment as prescribed in 14 CFR, part 25, Amendment 40 (§25.933). To test the auto restow system, a flight was performed in the 767 with a reverser unlocked (and travel mechanically restricted to one inch). Another test demonstrated an in-flight deployment with the engine at idle at 220 knots and 12,000 ft. Following deployment, a handling qualities evaluation was conducted. This test included an approach and landing with the reverser remaining in the deployed position and the engine running at idle reverse thrust. Testing was considered to have demonstrated that controllability was adequate following an inadvertent in-flight reverser deployment and that if an in-flight deployment occurred, continued safe flight and landing could be accomplished.

The transition from high forward thrust to high reverse thrust, and automatic thrust reduction to idle, were assumed to be uneventful and were not evaluated. The differences in the engine spin down characteristics and net thrust for each condition are shown in the adjacent diagrams.

The 767, powered by the Pratt and Whitney JT9D-7R4 engine, entered airline service in 1982. Throughout the 1980's, several additional engine/reverser combinations were certified and entered commercial service. These included:

• Pratt & Whitney PW4000
• General Electric CF6-80A
• Rolls-Royce RB211-524

In-flight reverser deployments for all these configurations were evaluated in testing similar to that which was conducted on the original 767 configuration, and all performed satisfactorily.

767 in Airline Service

Between entry into service in 1982 and May 1991, no uncommanded in-flight reverser deployments occurred on any 767 involving a full (both sleeves) reversal. Two occurrences involving single sleeve deployments did occur; one due to a maintenance error and one due to an engine failure. Airplane controllability problems were not reported in either of these prior single sleeve events. Following the Lauda Air accident, knowledge gained about the effects of a high power reverser deployment on flight controllability of the 767 resulted in the realization that many other in-service airplanes were equally vulnerable to loss of airplane control following a high power/high speed reversal, and extensive redesigns became necessary.

Back to top

The accident was investigated by the Aircraft Accident Investigation Committee of the Thailand Ministry of Transport and Communications, with the assistance of the United States National Transportation Safety Board (NTSB).

The Thai authorities issued 15 findings. The first three findings concerned crew qualifications, maintenance of the accident airplane, and local weather at the time of the accident. None of these aspects was deemed a factor in the accident.

Finding 4 concluded that the left engine thrust reverser was in the deployed position.

Finding 5, based on examination of the nonvolatile memory of the electronic engine control, concluded that the left engine was at climb power when the reverser deployed, the engine was reduced to idle with the reverser deployment, and the Mach number increased from .78 to .99 after the deployment. The actual maximum speed reached was not able to be determined due to uncertainties in pressure (airspeed) measurement.

Finding 6 concluded that the airplane experienced an in-flight breakup at a steep descent angle and low altitude.

Findings 7 and 8 determined there was no evidence of either an in-flight fire or hostile acts.

Finding 9, based on simulation results, concluded that with a 25% lift loss on the left wing, the ensuing upset was uncontrollable by an unprepared flight crew.

Finding 10 raised, at the time, unanswered questions as to reverser plume characteristics and induced flight effects caused by an in-flight reverser deployment.

Finding 11 questioned the validity of the Federal Aviation Administration (FAA) certification of the in-flight controllability of an inadvertently deployed thrust reverser, and based on wind tunnel results, concluded that recovery of the upset suffered by the Lauda airplane was not possible unless full recovery (both roll and yaw) controls were applied within 4 to 6 seconds of reverser deployment.

Finding 12 determined that certain "hot-short" conditions involving the electrical system occurring during an auto restow command could potentially cause the directional control valve to momentarily move to the deploy position. However, no specific wire or component malfunction was physically identified that caused the deployment.

Finding 13 determined via post-accident testing that certain hydraulic system failures could cause the thrust reverser to inadvertently deploy. However, no specific component malfunction was identified that caused the deployment.

Finding 14 could identify no specific Lauda maintenance action that caused the deployment.

Finding 15 concluded that the design changes mandated by the FAA in Airworthiness Directive (AD) 91-22-09 would effectively prevent an in-flight deployment, even after multiple failures.

View the entire Lauda Accident Report.

Back to top

The Thai investigating authority made two recommendations. The first recommendation was for the FAA to "examine the certification philosophy of all airplanes certificated with ground only engine thrust reverser systems to provide appropriate design safeguards to prevent in-flight deployment."

The second recommendation urged a revision to flight data recorder (FDR) standards such that recorders were capable of withstanding "prolonged thermal exposure that can be expected in accidents which occur in locations that are inaccessible for fire fighting efforts." This recommendation was the result of the total loss of FDR data due to destruction of the recorder in the post impact fire.

Additionally, The NTSB made four recommendations ranging from fleet inspections to development of new procedures. In summary those recommendations included:

• A-91-45 - Recommended a certification review of PW4000 thrust reverser systems to "evaluate electrical and mechanical anomalies and failure modes that could allow directional control valve pressure to be applied to the reverser EXTEND port." This recommendation further advised that the evaluation should subject "the valve to the engine's vibration spectrum concurrent with the introduction of pressure spikes to the valve pressure port." Finally, it was recommended that the review should also determine "the adequacy of......system safeguards when the hydraulic isolation valve is open to prevent uncommanded thrust reverser extensions."
• A-91-46 - Recommended that the 767 Flight Crew Operations Manual be revised to include in the section "Reverser Isolation Caution Light," a warning that in-flight reverser deployment may result in severe airframe buffeting, yawing, and rolling forces.
• A-91-47 - Recommended, pending completion of a certification review of the thrust reverser system, that operational procedures be established for action following illumination of the REV ISLN Message in the EICAS system. This recommendation was aimed at enhancing airplane controllability in the event that a secondary failure resulted in the inadvertent deployment of a thrust reverser in flight. It recommended actions to be taken to achieve an appropriate combination of airspeed, altitude, and thrust settings that would minimize control difficulties in the event that a reverser subsequently deploys. This recommendation also urged consideration of inclusion of a procedure to pull the fire handle on the affected engine (resulting in a more immediate and positive engine shutdown). The recommendation also included the provision that operators could be directed to deactivate thrust reversers until the certification review was completed and adequate reverser system reliability could be assured.
• A-91-48 - Recommended an examination of the certification bases of other model airplanes equipped with electrically or electro hydraulically actuated thrust reverser systems for appropriate safeguards to prevent in-flight deployments and ensure that operating procedures are provided to enhance airplane control in the event of an inadvertent in-flight deployment.

Back to top

14 CFR, §25.933 amendment 40: Reversing Systems.

(a) requires "ground only" reverser systems to produce no more than idle thrust during any reversal in flight; restorability following a reversal to the forward thrust position; and continued flight and landing capability following any possible position of the reverser.

(b) for reverser systems intended for in-flight use, no unsafe condition from likely combination of failures.

(c) establishes propeller reversing system low pitch requirements.

(d) Each turbojet reversing system must have means to prevent the engine from producing more than idle forward thrust when the reversing system malfunctions, except that it may produce any greater forward thrust that is shown to allow directional control to be maintained, with aerodynamic means alone, under the most critical reversing condition expected in operation.

14 CFR 25.901(c) - Installation

Establishes "fail-safe" criteria for propulsion system installations

Back to top

Approximately 30 years of service experience on turbine powered transport airplanes tended to validate the industry-wide belief that the critical condition for thrust reverser deployment involved relative slow speed, low altitude exposures. Higher speed, higher altitude conditions were believed to have relatively minor effects since airplane flight controls generally had greater authority at these conditions. What was not understood until after the Lauda 767-300 accident was the serious impact on wing lift that resulted from high power, high airspeed uncommanded in-flight thrust reversal events.

Back to top

• In-flight deployment of the left thrust reverser, creating lift loss on the left wing, a large accompanying rolling moment, and loss of control of the airplane.
• Insufficient reverser control system independence to prevent in-flight deployment. The "two-lock" reverser control system proved to be inadequate for a critical function such as preventing an unwanted in-flight reversal. This was especially true considering co-routed control system wires.

Back to top

• In-flight deployment at high power was not a catastrophic event. It was assumed that the automatic thrust cutback to idle would quickly reduce thrust to a safe/controllable level and that the auto restow system would drive the reverser closed before reverse thrust was produced.
• Reverser system safeguards were sufficiently robust to prevent in-flight deployment.
• Thrust reverser control system independence of the Hydraulic Isolation Valve and Directional Control Valve would prevent common failure modes from affecting both systems, and unwanted reversals would be prevented. The auto restow system would augment this protection.

Back to top

There were no precursor accidents prior to the Lauda Air 767-300 accident. All previous incidents involving uncommanded in-flight deployments on other model airplanes were reported to be controllable, and tended to reinforce the industry-wide belief that high speed reverser events were less critical than those at slower airspeeds and lower power levels.

Back to top

Fleet Controllability Assessment

In October 1991, the FAA chartered a joint FAA/AIA (Aerospace Industries Association) task force to examine the thrust reverser controllability and reliability aspects of the transport fleet. The task force report was released in March 1992 and resulted in the following determinations:

• A subset of the transport fleet airplanes with twin, tail-mounted engines, for example, was established as "controllable" following an in-flight reverser deployment.
• A much larger subset, including most large twin-engine transports, such as the 767, were determined to be "uncontrollable" following an in-flight reverser deployment, and in need of reverser system safety improvements to preclude in-flight deployments.

The task force further advised that airplanes deemed "controllable" should also require sufficient system safety to takeoff and attain cruise configuration without a reverser deployment. This would allow attainment of an altitude and speed combination that would be advantageous to recovery should a deployment occur relatively soon after takeoff. At the time the task force was making its recommendations, sufficient reverser system safety did not exist - additional failsafe features were deemed necessary.

As part of the fleet controllability assessment, the task force also arranged for the National Aeronautics and Space Administration (NASA) to develop a model of the effects of in-flight reverser deployment, and visualize the resulting upper wing surface flow disruption. A test flight on a NASA-owned DC-8 was conducted to validate NASA's modeling techniques. The flight consisted of several in-flight deployments of the inboard thrust reversers (the DC-8 is approved for in-flight use of reverse thrust) at various Mach numbers. The left wing upper surface was tufted in order to visualize the airflow effects over the upper wing surface with a reverser deployed.

The results of that flight test were published in NASA Technical Memorandum 110351, a report dated June 1995.

There are two video clips available that show representative test conditions. The video shows two views shot while the left inboard reverser is deployed at idle: the first from in front (leading edge) of the wing and the second from aft (trailing edge) of the wing. As the engine thrust is increased, flow disturbance over the wing upper surface (resulting in lift loss) is evident, as is the increase in buffet levels resulting from the deployment and thrust increase.

View NASA Reverser Deployment Wing Leading Edge Video below: 

View NASA Reverser Deployment Wing Trailing Edge Video below: 

Reverser Locking System Redesign

The 767 with Pratt & Whitney PW4000 engines, as well as other airplane designs, incorporated dual-locking features in their thrust reverser control logic. It was decided that a third lock (a "sync" lock, or similar system) would provide the additional level of safety necessary to prevent future uncommanded deployments.

Boeing designed a third locking system for 767 reversers for all three engine manufacturer's installations, and issued service bulletins for installation of the new systems. All thrust reverser systems which were, when uncommanded deployments occurred, determined to result in the airplane becoming uncontrollable, were modified to add additional system safeguards.

Subsequently, on February 24, 1994, the FAA issued AD 94-12-10 which required installation of the Boeing designed "sync" lock system (per Boeing service bulletin 767-78-0062) on PW400-equipped 767 airplanes. Later AD's levied similar requirements on GE and Rolls-Royce powered airplanes. Among the Boeing fleet, only the 707, 727, and 737-100/200 were assessed as controllable by the task force. Following the actions targeting the 767, all other Boeing models were required by AD to incorporate a third locking system.

View below to see how it was redesigned to incorporate the sync lock:

Back to top

• AD 91-15-09 was issued July 3, 1991, requiring fleet inspections and tests of thrust reverser systems.
• Telegraphic AD T91-17-51 was issued August 15, 1991 requiring deactivation of thrust reversers on the 767 fleet.
• On August 23, 1991 FAA superseded the deactivation AD with AD T91-18-51 to allow reactivation of reversers on GE and Rolls-Royce powered airplanes. Reverser deactivation on Pratt & Whitney powered airplanes remained in effect.
• On October 24, 1991 AD T91-18-51 was superseded by AD 91-22-09 to require the installation of, per Boeing Service Bulletin 767-78-0051: (1) independent stow and restow systems, (2) installation of an additional hydraulic isolation valve, and (3) modification of the electrical control system to make it less susceptible to electrical shorts induced by wire bundle chafing. Following this modification, reactivation of thrust reversers was allowed.
• On November 9, 1992 AD 92-24-03 superseding AD 91-22-09 was issued to require, in addition to the requirements of AD 91-22-09, certain repetitive inspections, tests, adjustments, and functional tests of the thrust reverser control and indication system, and of selected engine wiring per Boeing Service Bulletin 767-78-0046. A specific check of the directional control valve "hot short" protection was included.
• On February 24, 1994 the FAA issued AD 94-12-10 to require the installation of a third locking system ("sync" locks) on 767 airplanes equipped with PW4000 engines, per Boeing Service Bulletin 767-78-0062. Later ADs required similar installations on GE and Rolls-Royce powered airplanes.

Back to top

Airplane Life Cycle:

• Design / Manufacturing

Accident Threat Categories:

• Uncommanded Thrust Reversal
• Lack of System Isolation / Segregation

Groupings:

• Loss of Control
• Automation
• Approach and Landing

Accident Common Themes:

• Flawed Assumptions
• Pre-existing Failures
• Unintended Effects

Back to top

Flawed Assumptions

Prior to the Lauda accident, extensive service experience involving uncommanded in-flight deployment of thrust reversers on many different airplane models tended to support the assumption that a high speed, high altitude deployment did not pose a threat to airplane controllability. It was not until after the Lauda accident that the aviation community realized the true risk for loss of control for some model airplanes which experienced significant wing lift loss following high speed/high power reverser deployments.

Preexisting Failures

In this accident, a reoccurring thrust reverser problem existed for several months, and resulted in numerous maintenance actions without resolution. It was not until another problem, allowing two faults to occur on the same flight, transpired that a powered reverser deployment occurred. This accident underscores the importance of system isolation, both functionally and physically, in order that failure modes be completely independent as assumed by the failure analysis.

Unintended Effects

Advances in aerodynamics in the 1970's resulted in development of wing-mounted engines positioned on airplanes incorporating shorter struts. Engines were located on many models of airplanes nearly in front of the wings, rather than significantly below, such as the 747. While these configurations resulted in less frontal area induced drag, it also presented a significantly more critical aerodynamic response from the wing lifting surface in the case of a high speed and high power uncommanded thrust reversal event.

Back to top

The Lauda Air 767-300 was the first accident involving an uncommanded thrust reversal at high speed and high power. Previous incidents of uncommanded thrust reverser deployment without reports of controllability problems tended to reinforce the industry-wide belief that the critical condition for airplane upset was at or near takeoff and landing, when the airplane's control surfaces had less authority. The vulnerability of some airplanes to loss of wing lift following high speed and high power deployment was not fully understood until after the Lauda accident.

Back to top

Technical Related Lessons

Some types of thrust reverser installations can result in a potentially catastrophic airplane response following an uncommanded in-flight reversal. For these types of reverser systems, safeguards must be sufficiently robust so that the risk of an uncommanded thrust reverser deployment is so low as to not be expected to occur on even one airplane in the life of the fleet. (Threat Category: Uncommanded Thrust Reversal)

• Following the Lauda accident, it was learned that an in-flight reversal on a Model 767 at high power resulted in significant disruption of air flow over the upper surface of the wing, and severe airplane upset from which recovery, while possible, was extremely difficult for an unsuspecting flight crew. This airplane response was discovered during post-accident investigation, and revealed a vulnerability which potentially existed on many other models. It had been widely assumed throughout the industry that the critical condition for airplane control following an uncommanded reversal would be during low speed/low altitude flight phases such as takeoff or landing. Consequently, regulatory objectives such as that which required thrust to be automatically reduced to idle following reverser deployment, when the thrust lever was in the forward thrust position, was intended to mitigate risks for those low speed flight phases. The in-flight testing that had been accomplished on nearly every transport airplane at that time focused on a demonstration that the airplane could be safety maneuvered following the reversal, and the plane could be slowed and safely landed with the reverser in the deployed position. This demonstration had been satisfactorily accomplished on the model 767, although from relatively low airspeed and an idle thrust condition. These tests failed to expose the true airplane response (due to rapid lift loss) from a higher speed, higher thrust reversal event, such as that which occurred on the Lauda Air flight.

System independence can be compromised by installation details, such as co-bundling circuit wires, resulting in common mode failures affecting multiple systems. (Threat Category: Lack of System Isolation/Segregation)

• The Boeing 767-300, as in many other transport airplanes of the time, incorporated thrust reverser system architecture that was comprised of two separate systems, or "locks". It was necessary for both circuits to be energized in order to command the reverser to the deploy position. Even though the two systems were functionally independent, circuit wires of both systems were found to be located in common wire bundles within the airplane's fuselage. These bundles contained control circuits for many different airplane systems, encompassing a wide variety of voltages and currents. Although the accident investigators never identified the precise origin of failure(s) that would have commanded the reverser to the deploy position on the Lauda Air accident, it was concluded that a common wire fault may have provided a path for energizing both circuits.

Common Theme Related Lessons

Past assumptions must be confirmed as relevant to present designs. It is necessary to understand the origins of original assumptions before they can continue to be considered valid. (Common Theme Category: Flawed Assumptions)

• In the 1960's and 1970's, it was widely believed throughout the aviation industry that uncommanded in-flight thrust reverser deployment represented a vulnerability to airplane controllability mainly during low speed and on or near the ground. High speed/higher altitude events, though relatively common, had not resulted in reports of loss of airplane control. However, advances in wing/engine nacelle aerodynamics which took place in the late 1970's on airplanes such as the 767 resulted in the development of shorter engine pylons, and placements of the engines nearly in front of the wing leading edges, rather than below. This engine placement had the unintended effect of allowing the reverser efflux plume that occurred at high speed and high power conditions to go over the upper surface of the wing, rather than generally under the wing as on earlier designs. Since all previous in-flight reverser controllability testing, including testing conducted on the 767, had been conducted at low speed/engine idle conditions, the actual critical condition for airplane controllability was not revealed until after the Lauda Air accident.

Back to top