|University of Bielefeld - Faculty of technology|
Networks and distributed Systems
Research group of Prof. Peter B. Ladkin, Ph.D.
|Back to Abstracts of References and Incidents||Back to Root|
|1.1||History of Flight||2|
|1.2||Injuries to Persons||3|
|1.3||Damage to Airplane||3|
|1.8||Aids to Navigation||7|
|1.12||Wreckage and Impact Information||8|
|1.13||Medical and Pathological Information||8|
|1.16||Tests and Research||9|
|1.18||Useful or Effective Investigation Techniques||13|
|2.2||Airplane Wreckage and Structural Failure Analysis||17|
|2.2.2||In-Flight Breakup Sequence||18|
|2.4||Thrust Reverser Certification||27|
|2.5||Possible Thrust Reverser Failure Modes||30|
|2.5.2||Crew Commanded Deployment||31|
|2.5.3||Electrical System Failures Resulting in Deployment||32|
|2.5.4||Hydraulic System Failures Resulting in Deployment||33|
|2.7||System Design Changes as a Result of the Accident||36|
|2.8||Flight Data Recorder Damage||38|
|Appendix A--Cockpit Voice Recorder Transcript Extract||44|
|Appendix B--Wreckage Distribution Diagram||58|
|Appendix C--Thrust Reverser System General Description||59|
|Appendix D--U.S. National Transportation Safety Board|
|Urgent Action Safety Recommendations 91-45 through 91-48||69|
|Appendix E--U.S. Federal Aviation Administration Letter|
|Dated September11, 1991||74|
|Appendix F--Diagram 767 PW 4000 Thrust Reverser, Current/New System||79|
|Appendix G--Comments of Accredited Representatives||80|
Flight conditions were recovered from non-volatile memory in the left engine electronic engine control (EEC). At the suspected point of reverser deployment, the EEC readout indicated that the airplane was at an approximate altitude of 24,700 feet, a speed of Mach 0.78, and developing climb power.
The airplane crashed in mountainous jungle terrain at 14 degrees 44 minutes North latitude and 99 degrees 27 minutes East longitude at approximately 1617 hours. Night time visual meteorological conditions prevailed.
1.2 Injuries to Persons
1.5 Personnel Information
The pilot-in-command, Thomas John Welch, male, age 48, held an Airline Transport Pilot certificate number 1589103 issued by the United States Federal Aviation Administration. This certificate carried a rating for Airplane Multi-engine Land, with type ratings for B-727, B-757, and B-767 airplane. The certificate also carried a rating for Airplane Single Engine Land which was limited to Commercial Pilot privileges. The pilot-in-command's United States certification was rendered valid by the Republic of Austria under a Decree of Recognition (#5227) issued December 19, 1990, valid until December 31, 1991. Additionally, the pilot-in-command held a Flight Engineer's certificate with a Turbojet rating (US #1825915). His total flight time as of April 25, 1991 was approximately 11,750 hours.
The co-pilot, Josef Thumer, first officer, male, 41 years of age, held an Airline Transport Pilot certificate (#313) issued by the Department of Civil Aviation of Austria, issued April 24 1985, valid until October 24, 1992. His total flight time was approximately 6,500 hours.
1.6 Airplane Information
The airplane, a Boeing 767-3Z9ER(NOTE 1), line number 283, serial number 24628, was delivered to Lauda Air on October 16, 1989. It was powered by two Pratt and Whitney 4060 engines, serial number P724134 on the left, and serial number P724130 on the right. Engine records indicate the left engine was installed on October 3, 1990, and had 2,904:15 hours and 456 cycles of operation. The right engine was installed on September 15, 1989, and had 7,444:02 hours and 1,133 cycles of operation. The airplane technical log, serial number 61287, dated May 26, 1991, shows the airframe with 7,444:02 hours and 1,135 cycles of operation. The reason for the minor variation in cycle count between the airframe and right engine is not known.
Technical logs, component status records, and the Lauda trouble shooting file maintained by their Maintenance Control were reviewed as far back as November 30, 1989. Since August 14, 1990, there were 13 maintenance actions logged on the left engine thrust reverser system, almost always in response to recurring Propulsion Interface Monitor Unit (PIMU) messages of "EEC CH-B REVERSER RNG FAIL" and "EEC CH A/B REV CR-CHK FAIL." Ten of these actions occurred since January 28, 1991. The majority of the corrective actions involved removing and replacing valves or actuators, and adjustments to the system. Typically then the PIMU message would not reoccur for several flights. The most recent known action prior to the accident was on May 25, 1991 at Vienna. At this time, a left engine thrust reverser locking actuator was replaced. Lauda had accomplished all the troubleshooting steps from the Boeing Fault Isolation Manual (FIM) without correcting the problems of the recurring PIMU messages. The company continued to dispatch the airplane on its regular schedule, with troubleshooting accomplished after return to the home station. Lauda personnel stated, they were in the process of conducting a complete inspection of the left thrust reverser wire bundle for damage before the accident occurred. The last record of visual inspection for the wiring was entered in a trouble shooting log, kept by Lauda Maintenance Department, on March 26, 1991. Dispatch of the airplane with the particular PIMU messages was permitted under a time limited dispatch condition as outlined in the airline's maintenance planning document. The Boeing Dispatch Deviation Guide cites the Pratt and Whitney Type Certificate Data Sheet E24NE, which permits dispatch for up to 500 operating hours with a EEC maintenance message annunciated.
The right engine thrust reverser had three maintenance items logged against it since August 14, 1990, and these were all for reasons of component wear and service bulletin requirements.
The Airplane Communication Addressing and Reporting System (ACARS) installed on this airplane was designed to transmit takeoff and cruise reports to ground receiving stations. The takeoff report from Bangkok was successfully transmitted and recorded. Previous takeoff and cruise reports were also available through this system. A review of this historical data did not reveal any unusual indication in the airplane or engine parameters or any marked differences between the right and left engines.
1.7 Meteorologica1 Information
The last pre-accident weather observation at Don Muang Airport in Bangkok was taken at 1600 hours, and indicated winds from 160 degrees at 6 knots, visibility in excess of 10 kilometers, 1/8th sky coverage by cumulus clouds at 2,000 feet, 3/8ths sky coverage by stratocumulus clouds at 4,000 feet, and 6/8ths sky coverage by cirrus clouds at 30,000 feet. The temperature was 26.3 degrees C and dewpoint 22 degrees C, QNH altimeter setting 29.75 in/Hg or 1007.5 mb, and in remarks temperature 79.2 degrees F and humidity 79 percent.
Another weather observation was taken after the accident, at 1636 hours, indicating winds from 170 degrees at 6 knots, visibility in excess of 10 kilometers, 1/8th sky coverage by cumulus clouds at 2,000 feet, 3/8ths sky coverage by stratocumulus clouds at 4,000 feet, and 6/8ths sky coverage by cirrus clouds at 30,000 feet. The temperature was 26.1 degrees C and dewpoint 22.5 degrees C, QNH altimeter setting 29.75 in/Hg or 1007.5 mbs, and in remarks temperature 78.9 degrees F and humidity 81 percent.
The significant weather prognosis chart for flight level 240 through flight level 450 from Don Muang Airport weather personnel, valid until 0300 hours on May 27, forecast broken layer tops at flight level 300 and isolated embedded cumulonimbus with tops as high as flight level 400. This forecast covered the general route area between Bangkok and Rangoon.
A depiction of weather radar returns at 1500 hours showed an area of weak precipitation return along the flight's projected path, but still northwest of the accident site. No pilot reports of weather activity in the general vicinity of the accident site were received, and air traffic personnel stated no weather returns were observed on the radar at the time of the accident.
1.8 Aids to Navigation
No discrepancies were noted in any aid to navigation that could be expected to have a bearing on the accident. Radar tracking was not recorded.
There were no radiotelephone transmissions received by any ground station indicating any trouble with NG004. No discrepancies were noted on any communications equipment that could be expected to have a bearing on the accident.
1.10 Aerodrome Information
Departure aerodrome status and conditions were not a factor.
1.11 Flight Recorders
The CVR and Digital Flight Data Recorder (DFDR) on the Boeing 767 are located in the airplane fuselage, aft left side, within the pressurized area of the airplane. Both recorders were recovered from the accident site and sent to the United States National Transportation Safety Board (NTSB) laboratories in Washington, DC, where readout was attempted under the direction of the Airplane Accident Investigation Committee.
The DFDR was a Sundstrand model UFDR, part number 980-4100-BXUS, serial number 5632. Its recording medium was damaged by heat, and no useful information could be recovered.
The CVR was a Fairchild model A100A, part number 93-A100-80, serial number 52889. Although damaged, it was successfully read out, and a transcript extract of its contents is included in this report as Appendix A.
1.12 Wreckage and Impact Information
The wreckage site was generally located at 14 degrees 44 minutes North latitude and 99 degrees 26 minutes East longitude. This was in mountainous jungle terrain approximately 3 nautical miles north northeast of Phu Toey village of Tambol Huay Kamin in the Ban Dan Chang district of Suphan Buri Province, Kingdom of Thailand. The average elevation of the wreckage area was estimated to be 600 metres.
Most of the wreckage was found in a one square kilometer area, but some lighter weight components were found up to 2,000 metres from the initial impact point. The horizontal stabilizer was the first major component found in the debris pattern, which was along a generally northwest/southeast track. Thrust reverser actuators from the left engine (both sleeves) were found in the fully deployed position. A diagram of the wreckage spread is included in this report as Appendix B.
1.13 Medical and Pathologica1 Information
Post mortem examination of the victims by the Royal Thai Police Forensic Medicine Institute indicated that all fatalities resulted from severe trauma.
Although there was evidence of fire both before and after ground impact, there were no definite indications found of any fire prior to the airplane breaking up in flight.
No fire fighting activities took place due to the remote location and general inaccessibility of the accident site.
1.15 Survival Aspects
The accident was not survivable.
1.16 Tests and Research
Examination of recovered components of the thrust reverser system was conducted at facilities of the Boeing Commercial Airplane Group in Seattle, Washington, USA, and other component manufacturers under the auspices of the Airplane Accident Investigation Committee. The limited number and the degree of damage to the components precluded a determination of functional condition.
Approximately 9 months after the accident, the DCV was returned to Department of Aviation by persons not associated with the accident investigation. The DCV was exchanged for a reward. It was sent to Boeing in Seattle, Washington, under strict control and examined by team members supervised by NTSB and FAA personnel.
DCV examination was conducted on February 18 through 20, 1992. Computer tomography inspection (cat scan/x-ray) of the valve prior to disassembly, indicated that the component responsible for directing hydraulic flow within (second stage spool) the DCV was intact and located in the "reverser stowed" position. This is the normal position for the valve without hydraulic pressure applied. Further examination of the spring that holds the second stage spool in position indicated that it was intact.
The examination of the DCV also revealed that 3 of 4 screws used to secure the solenoid operated pilot valve body to the DCV were loose. Soil was found inside internal passages of the valve.
A metal plug, identified as a case relief valve plug used elsewhere in the engine accessory section, was found installed "finger tight" in the DCV "retract" port. All solenoid operated pilot valve (first stage spool) internal passages were unobstructed. There was no evidence that indicated preimpact failure of the valve, however the condition of the valve indicated that the valve was partially disassembled and reassembled by persons not associated with the accident investigation prior to examination by the investigation team.
Additional system tests were performed using production components in an attempt to simulate potential failure modes.
In one hypothetical condition, the introduction of a damaged piece of O-ring seal into a hydraulic orifice resulted in an uncommanded opening of the directional control valve (DCV). For further information on these tests, see paragraph 2.5.4.
Testing of the electrical function indicated possible areas where an electrical hot short occurring simultaneously with an auto-restow action could result
in uncommanded opening of the DCV for up to one second. For further information on these tests, see paragraph 2.5.3.
A full hydraulic set-up was used to verify normal operation of the thrust reverser system and to determine if uncommanded deployment could occur under various hypothetical failure conditions. Hypothetical failure conditions involved the directional control valve (DCV) seal damage, thrust reverser actuator piston head seal leakage and a return line blockage during hydraulic isolation valve (HIV) cycling. Also, a vibration test simulating the vibration environment of the DCV during it's life was performed.
In another hypothetical failure condition, the effects of piston seal leakage through a thrust reverser actuator was examined with the HIV open. Several test configurations were examined with the piston head O-ring and cap strip missing from the actuator(s). Only one side (one of two sleeves) of the thrust reverser cowl deployed when an actuator was tested with the piston head seal missing and the bronze plating separated from the piston head. Under this condition, with the HIV open, internal leakage across the piston was sufficient to deploy the 3 actuators associated with the deployed sleeve depending on the location of the actuator piston head in the cylinders. If in the stow position and the piston heads were firmly bottomed against the inner cylinder head end prior to commanding thrust reverser stow, the thrust reverser actuators would not deploy. When the head end of the two actuators were slightly unseated, fluid could pass from the rod end to the head end of the locking actuator causing unlock and extension of 3 actuators (one sleeve).
Examination of the thrust reverser actuators from the left engine of the accident airplane was not conclusive, because only one piston head and it's associated seal was recovered from the accident site. The cap strip from this actuator piston head had considerable wear and was extruded.
A DCV was mounted on a vibration table and subjected to resonant searches, resonant dwells, random vibration and sweeps through engine speed
ranges in three axes while under constant and pulsing pressure in the hydraulic lines. Pressure transducers and flow meters on the outflow of the valve indicated that the valve did not open unexpectedly or leak during the test under excessive vibration.
1.17 Additional Information
Each engine installed on the B767 is equipped with a thrust reversing system. The thrust reversers are approved for ground operation only. A general systems description is included in this report as appendix C.
The United States National Transportation Safety Board (NTSB) issued four urgent action safety recommendations regarding the accident to the Federal Aviation Administration (FAA) on July 3, 1991 They are included in this report as appendix D.
The FAA issued information on the accident to appropriate operators and authorities on September 11, 1991 by letter format. It is included in this report as appendix E. Additionally, the following Airworthiness Directives (ADs) affecting the B767 were issued:
AD 91-15-09, July 3, 1991 - Requires tests, inspections and functional checks of the thrust reverser systems on all B767 airplanes powered by Pratt and Whitney PW4000 series engines.
TAD 91-17-51, August 15, 1991 - Requires de-activation of thrust reverser systems on all B767 airplanes powered by Pratt and Whitney PW4000, General Electric CF6-80C2, and Rolls Royce RB211-524 series engines. This superseded AD 91-15-09.
TAD 91-18-51, August 23, 1991 - Allows re-activation of thrust reverser systems on B767 airplanes powered by General Electric CF6-80C2 and Rolls Royce RB211-524 series engines. This superseded TAD 91-17-5 1.
AD 91-22-02, October 7, 1991 - Requires tests, inspections and functional checks of the thrust reverser systems on all B767 airplanes powered by General Electric CF6-80C2 and Rolls Royce RB2l 1-524 series engines.
AD 9 1-22-09, October 11, 1991 - Requires modification and allowed re-activation of thrust reverser systems on all B767 airplanes powered by Pratt and Whitney PW4000 series engines. This superseded TAD 91-18-51.
An international manufacturing industry/government task force formed by the FAA as a result of this accident is continuing to review design philosophy and certification standards of transport airplane thrust reverser systems.
1.18 Useful or Effective Investigation Techniques
Fire damage to the DFDR recording tape eliminated a valuable source of vital flight information. Since this information was critical to the investigation, a search was conducted to identify non-volatile memory in various computerized components as an alternate source of data. Electronic circuit boards and micro-chip components from the EECs were analyzed by the Pratt & Whitney and Hamilton-Standard companies. The data developed proved helpful in validating conditions prior to and during the accident, but did not provide the time correlation normally available with the DFDR. Readouts from such sources are accomplished by manufacturer's personnel in their own laboratories, as these items were not originally designed to support airplane accident investigation activities.
between the respective hydraulic isolation valve (HIV) and the associated thrust reverse lever position or an anomaly in the air/ground system. No corrective actions were necessary and none were identified as taken by the crew.
The crew's discussion of the REV ISLN indication was of an informative nature and continued for about four and one-half minutes. The co-pilot read information from the Airplane Quick Reference Handbook as follows: "Additional systems failures may cause in- flight deployment" and "Expect normal reverser operation after landing." The pilot-in-command remarked "....its not just on, its coming on and off," he said, "...its just an advisory thing...," and shortly thereafter stated, "could be some moisture in there or something." The critical nature of an in-flight thrust reverser deployment in this phase of flight was not known and therefore the flightcrew was not provided with operational guidance. Airplane design changes implemented after this accident eliminated the need for operational guidance for the flightcrew.
Review of the thrust reverser system design indicates that when the auto-restow system function is required, system pressure to close the reversers is applied during restow and for 5 seconds after restow is sensed. The REV ISLN light illuminates for this period except for the first 2 seconds. The associated EICAS message appears 2 seconds after the REV ISLN light illuminates. Interpretation of the crew's comments regarding the reverser ISLN indication, "Coming on and off' indicates that they may have been observing cycling of the auto-restow system (see Appendix C). The specific interval of illumination of the light, and the possibility that the light ceased to be observed, could not be determined from the cockpit voice recorder comments nor from any other evidence. Also it could not be determined if the REV ISLN light was accompanied by an EICAS message; nothing was verbalized by the crew. There was no recoverable data from the nonvolatile memory available in the recovered EICAS components.
At ten minutes twenty seven seconds into the flight, the co-pilot advised the pilot-in-command that there was need for, "a little bit of rudder trim to the left." The crew discussion of trim took place from an elapsed time of 10:27 and lasted nine seconds. About four and one-half minutes separated the REV ISLN
indication event from the trim discussion. It ended with the pilot-in-command saying "O.K., O.K.". It is probable that the trim requirement was a normal event in the flight profile. The trim requirement does not appear to be related to the upcoming reverser event, and there was no apparent reason for the crew to interpret it as such.
Fifteen minutes and one second into the flight the co-pilot's voice was heard to exclaim, "ah reverser's deployed," accompanied by sound similar to airframe shuddering, sounds of metallic snaps and the pilot-in-command stating "here wait a minute." The cockpit voice recording ended twenty nine seconds later with multiple bangs thought to be structural breakup of the airplane.
An assessment of flightcrew attempts to control the airplane's flightpath was not possible due to loss of the FDR data as a result of ground fire damage to the recorder tape.
The physical evidence at the crash site conclusively showed that the left engine thrust reverser was deployed. Nonvolatile computer memory within the electronic engine control (EEC) indicated that an anomaly occurred between channel A and B reverser sleeve position signals. It was concluded that this anomaly was associated with the thrust reverser deployment of one or both sleeves. The EEC data indicated that the thrust reverser deployed in-flight with the engine at climb power; based on EEC design, it was also concluded that the engine thrust was commanded to idle commensurate with the reverser deployment, and that the recorded mach number increased from 0.78 to 0.99 (the actual maximum speed reached is unknown due to pressure measurement and recording uncertainties). The left EEC data indicates that the fuel cutoff switch was probably selected to cutoff within 10 seconds of thrust reverser deployment. Examination of the cutoff switch also indicates that it was in the cutoff position at impact.
2.2 Airplane Wreckage and Structural Failure Analysis
2.2.1 Airplane Wreckage
The relative close proximity of the wreckage scatter (within one square kilometer) indicated that the airplane experienced in-flight breakup at a steep descent angle and low altitude. A breakup altitude estimation was attempted using time-synchronized information from the CVR. Although the airspeed history between reverser deployment and the end of the recording (due to structural breakup) cannot be confirmed, the high speeds likely achieved during the descent indicate that the in-flight breakup most likely occurred at an altitude below 10,000 feet.
Damage to the fan runstrips(sic)on both engines indicates nontypical loads from an unusual flight path. The fan rubstrips are located on the forward case of each engine and form the fan blade tip airseal. Each engine fan runstrip(sic) had a deep rub from the fan blades. The character of the rubs is typical of rubs caused by the interaction with the rotating fan. The depths are substantially deeper than typical rubs experienced during normal operation. These rubs were centered at approximately 66 degrees on the left engine and approximately 0 degrees on the right engine as view from the rear of the engine looking forward.
Flight testing of the B767 with JT9D-7R4 engines showed rubs near the top of the engines to be minor depth and centered at approximately 45 degrees on the left engine and approximately 315 degrees on the right engine. The rub results from aerodynamic load from the engine cowls. These loads were determined to be essentially down from the top when the aircraft nose was lowered during descent.
The PW4000 installation is designed for the maximum cowl aerodynamic loads that occur during takeoff rotation. At that condition a .050 inch deep rub, which is considered a minor depth rub, centered at the bottom of the engine can be expected. This rub would be due to upward aerodynamic force on the cowl at aircraft rotation angles of attack. The depth and location of the rubs in the
Lauda accident indicates; 1) cowl load forces much greater than the forces expected during takeoff rotation and 2) by the location, that the forces were essentially down from the top of the cowl. The center of the rubs shown shifted clockwise from the locations documented by the B767/JT9D-7R4 test flights suggests that the airplane experienced a nose-down pitch accompanied by abnormal roll and yaw.
The CVR transcript indicates that the in-flight breakup did not occur immediately after the deployment of the thrust reverser, but rather during the subsequent high-speed descent.
The EEC can provide general altitude and Mach number data however calibration is not provided outside the normal speed envelope. Information from the engine manufacturer indicates that the EEC data may indicate altitude and Mach numbers which are higher than the true value. Also, EEC calibration of its ambient pressure sensor affects the accuracy of the recorded Mach number and altitude. This calibration is not designed to be accurate above maximum certified airplane speeds. In addition, the EEC ambient pressure calibration does not account for the effect of reverse thrust on fan cowl static pressure ports. However, EEC recorded data does suggest that the airplane was operating beyond the dive velocity of 0.91 Mach.
High structural loading most probably resulted as the crew attempted to arrest the descent. Large control inputs applied during flight at speeds in excess of the airplane's operating envelope appear to have induced structural loads in excess of the ultimate strength of the airplane structure.
2.2.2 In-Flight Breakup Sequence
The analysis of the major structural damage showed that the failures were probably the result of buffeting, maneuvering overload, and excessive speed. Parts of the airplane that separated from buffeting overload appear to be pieces of the rudder and the left elevator. This was followed by the down-and- aft separation
of most of the right horizontal stabilizer from maneuvering overloads, as the crew attempted to control the airplane and arrest the high-speed descent. No evidence of impacts were observed on the leading edges of the horizontal and vertical stabilizers indicating that no airframe structural failure occurred prior to horizontal stabilizer separation. It is thought that the download still present on the left stabilizer and the imbalance in the empennage from the loss of the right stabilizer introduced counterclockwise (aft looking forward orientation) torsional overload into the tail, as evidenced by wrinkles that remained visible in the stabilizer center section rear spar. The separation of the vertical and left horizontal stabilizers then occurred, although the evidence was inconclusive as to whether the vertical stabilizer separated prior to or because of the separation of the left stabilizer and center section. (The damage indicated that the vertical stabilizer and the attached upper portion of four fuselage frames departed to the left and that separation of the vertical fin-tip and the dual-sided stringer buckling in the area of the fin-tip failure occurred from bending in both directions prior to the separation of the vertical stabilizer from the fuselage). The loss of the tail of an airplane results in a sharp nose-over of the airplane which produces excessive negative loading of the wing. Evidence was present of downward wing failure. This sequence was probably followed by the breakup of the fuselage. The complete breakup of the tail, wing, and fuselage occurred in a matter of seconds.
2.2.3 Fire Damage
There was no indication of an in-flight fire prior to the breakup of the airplane. The audible fire warning system in the cockpit was silent. The absence of soot on the cabin outflow valve and in the cargo compartment smoke detectors indicates that no in-flight fire existed during pressurized flight. Evidence indicates that the fire that developed after the breakup resulted from the liberation of the airplane fuel tanks.
>From the available evidence, there was nothing to indicate damage from a hostile act either from within the airplane or on the exterior. No shrapnel or explosive residue was detected in any portion of the wreckage that was located.
Evidence of an explosion or fire in the sky was substantiated by witness reports and analysis of portions of the airplane wreckage. Although it is possible in some cases that some "in-air" fire damage was masked by ground fire damage, only certain portions of the airplane were identified as being damaged by fire in the air. These include the outboard wing sections and an area of right, upper fuselage above the wing. Evidence on the fuselage piece of an "in-air" fire include soot patterns oriented with the airstream and the fact that the piece was found in an area of no post-crash ground fire. Evidence of an "in-air" fire on the separated outboard portions of the right and left wings include that they were found in areas of no ground fire, yet were substantially burned. The separated right wing portion had been damaged by fire sufficiently to burn through several fuel access panels. In addition, one of the sooted fractures on the right wing section was abutted by a "shiny" fracture surface. These fracture characteristics show that the separation of the right wing section had preceded its exposure to fire or soot in the air, followed by the ground impact that produced the final, "shiny" portion of the fracture.
Generally, it appears that fire damage was limited to the wings and portions of the fuselage aft of the wing front spar (except for the left mid-cabin passenger door). Likewise, many areas of the fuselage aft of the wing front spar were devoid of fire damage. This is further indication that the airplane was not on fire while intact, but started burning after the breakup began. The absence of any fire damage on the empennage indicates that it had separated prior to any in-air fire.
The sooting documented on the left mid-cabin passenger door is unique in that the fuselage and frame around the door were undamaged by fire or soot. Even the seal around the door appeared to be only lightly sooted. The door was found in an area of no ground fire, indicating that the door was sooted before ground impact. The sooting on the door, but not on the surrounding structure, may have resulted as the door separated from the fuselage during the breakup and travelled through a "fire ball" of burning debris. It is not known why the door seal did not exhibit the same degree of sooting as the door itself, although it is possible that the soot would not adhere to the seal as well as to the door.
2.3 Engineering Simulation
Immediately after the accident, many airlines attempted to duplicate the events with their flightcrew training simulators. These efforts yielded erroneous results because the simulators were never intended for such use and did not contain the necessary performance parameters to duplicate the conditions of the accident flight.
On behalf of the Accident Investigation Commission of Thailand, the U.S. NTSB requested the Boeing Commercial Airplane Group to develop an engineering simulation of in-flight reverse thrust for the conditions thought to have existed when the left engine thrust reverser deployed in the accident flight.
As previously stated, the flight data recorder (FDR) tape in the accident airplane was heat damaged, melted, and unreadable due to post-crash fire. Flight conditions were therefore derived from the best available source, post-accident readout of the left engine EEC non-volatile memory parameters. Test conditions were proposed by Boeing and accepted by the participants as follows:
the total thrust required for flight. This results in less thrust/drag asymmetry. Based on engineering judgement the lower proportion of thrust and resultant airflow affects a smaller percentage of the wing, and therefore the effect of reverse thrust is less significant on a three or four engine airplane than on a two engine airplane.
The mechanical design and type of engine is also important in the event of in-flight reverse thrust. The B767's engines are high-bypass ratio turbofans, with reverser systems which employ blocker doors and cascades to redirect airflow from the N1 compressor fan blades. On large twin-engine transport airplane, the thrust reverser cascades are slightly below and in front of the wing. At high thrust levels, the plume of thrust from the reverser produces a yawing moment and significantly disrupts airflow over the wing resulting in a loss of lift over the affected wing. The loss of lift produces a rolling moment which must be promptly offset by coordinated flight control inputs to maintain level flight. The yaw is corrected by rudder inputs. If corrective action is delayed, the roll rate and bank angle increase, making recovery more difficult.
Low-speed B767 wind tunnel data from 1979 was available up to airspeeds of about 200 knots at low Mach numbers. From these wind tunnel data, an in-flight reverse thrust model was developed by Boeing. The model was consistent with wing angle-of-attack, although it did approximate the wheel deflection, rudder deflection, and sideslip experienced in a 1982 idle-reverse flight test. Since no higher speed test data existed, the Boeing propulsion group predicted theoretically the reverse thrust values used in the model to simulate high engine speed and high airspeed conditions. This preliminary simulation model employed a 10% lift loss factor. It was evaluated by investigators in Boeing's B767 engineering simulator in June 1991.
The simulator tests at 10% lift loss indicated that sufficient time existed for the flightcrew to react and sufficient control authority to return the airplane to a normal flight path. These findings were inconsistent with CVR data and that it appeared fact that control was lost by a trained flightcrew in the accident flight.
Another simulation model was developed using low-speed test data collected from a model geometrically similar to the B767 at the Boeing Vertol wind tunnel. Scale model high-speed testing would have required considerably more time for model development. Therefore low-speed data were used and extrapolated. The wing/pylon model used at Boeing Vertol was similar in configuration to the B767 so that these tests results are believed to be applicable for this case. These tests included inboard aileron effectiveness, rudder effectiveness, and lift loss for the flaps up configuration at different angles-of- attack and reverse thrust levels, data not previously available.
Investigators from the Accident Investigation Commission of the Government of Thailand, the Austrian Accredited Representative and his advisers, the NTSB, FAA, and Boeing met in Seattle, Washington, in September 1991 to analyze the updated Boeing-developed simulation of airplane controllability for the conditions that existed when the thrust reverser deployed on the accident flight. The results of the Boeing Vertol wind tunnel tests showed approximately 25% lift loss for an engine at maximum climb power, reducing to approximately 13% as the engine spooled down to idle thrust. It takes about 6 to 8 seconds for the engine to spool down from maximum climb to idle thrust levels. Boeing re-programmed the B767 simulator model based on these new tests.
The Chief B767 Test Pilot of the Boeing Company was unable to successfully recover the simulator if corrective action was delayed more than 4 to 6 seconds. The range in delay times was related to engine throttle movement. Recovery was accomplished by the test pilot when corrective action of full opposite control wheel and rudder deflection was taken in less than 4 seconds. The EEC automatically reduced the power to idle on the left engine upon movement of the translating cowl. If the right engine throttle was not reduced to idle during recovery, the available response time was about 4 seconds. If the right engine throttle was reduced to idle at the start of recovery, the available response time increased to approximately 6 seconds. Recovery was not possible if corrective action was delayed beyond 6 seconds after reverser deployment. Immediate, full opposite deflection of control wheel and rudder pedals was necessary to compensate for the rolling moment. Otherwise, following reverser deployment, the aerodynamic lift loss from the left wing produced a peak left roll rate of about 28 degrees per second within 4 seconds. This roll rate resulted in a left bank in excess of 90 degrees
within 5 seconds. The normal 'g' level reduced briefly between 0 and .5 'g' for about 2 seconds, then returned to about 1 'g' and stayed relatively constant throughout the roll maneuver.
Assuming that the simulator tests with the 25% lift loss are a valid model of the accident conditions, simulated flights piloted by Boeing's Chief B767 Test Pilot indicated that a recovery could not be accomplished unless the flight crew of the Lauda B767 took full corrective action within 4 to 6 seconds of reverser deployment. The use of full authority of the flight controls in this phase of flight is not part of a normal training programme. Further, correcting the bank attitude is not the only obstacle to recovery in this case, as the simulator rapidly accelerates in a steep dive. Investigators examined possible pilot reactions after entering the steep dive. It was found that the load factor reached during dive recovery is critical, as lateral control with the reverser on one engine deployed cannot be maintained at Mach numbers above approximately 0.83 when combined with load factors above 2.5 "g." This is because the effectiveness of the flight controls is reduced at high Mach numbers, and the airplane configuration remains asymmetrical due to the deployed thrust reverser. According to Boeing, the reduction in flight control effectiveness in the simulation is because of aeroelastic and high Mach effects. These phenomena are common to all jet transport airplanes, not just to the B767.
The flight performance simulation developed by Boeing is based upon low-speed (Mach 0.3) Vertol wind tunnel testing, unlike the high airspeed (Mach 0.78) in the Lauda B767 case. The current simulation is the best available based on the knowledge gained through wind tunnel and flight testing.
>From a flight performance standpoint related to the accident, there are three questions which still remain unanswered:
It is Boeing's belief that the lift loss on the accident flight would be less than 25% of total airplane lift because of the high Mach number and the conservative method used to develop the engineering simulation model. When Boeing personnel were asked why the aerodynamic increments used in the simulation could be smaller at higher Mach numbers; they stated that this belief is based on "engineering judgment" that the reverser plume would be smaller at higher Mach number, hence producing less lift loss. No high speed wind tunnel tests are currently planned by the manufacturer. Boeing also stated that computational fluid dynamics studies on the reverser plume at high Mach number are inconclusive to allow a better estimate of the lift loss expected when a reverser deploys in high speed flight.
2.4 Thrust Reverser Certification
Boeing received certification for the B767 propulsion systems on the basis of Federal Aviation regulations (FAR) Part 25, 36, and special regulation 27. Amendments 25-38 through 25-45 were complied with.
FAR 25.933 states;
10 and L-1011 in the early 1970's. The FAA states it was their policy to require continued safe flight and landing through a flight demonstration of an in-flight reversal. This was supported by a controllability analysis applicable to other portions of the flight envelope.
Flight demonstrations were usually conducted at relatively low airspeeds, with the engine at idle when the reverser was deployed. It was generally believed that slowing the airplane during approach and landing would reduce airplane control surface authority thereby constituting a critical condition from a controllability standpoint. Therefore, approach and landing were required to be demonstrated, and procedures were developed and, if determined to be necessary, described in the Airplane Eight Manual (AFM). It was also generally believed that the higher speed conditions would involve higher control surface authority, since the engine thrust was reduced to idle, and airplane controllability could be appropriately analyzed. This belief was validated, in part, during this time period by several in-service un-wanted thrust reverser deployments on B747 and other airplanes at moderate and high speed conditions with no reported controllability problems.
The original engine installed on the B767 was the Pratt and Whitney JT9D-7R4. In-flight thrust reverser controllability tests and analysis performed on this airplane were applied to later B767 engine installations such as the PW4000, based upon similarities in thrust reverser, and engine characteristics. The original flight test on the B767 with the JT9D-7R4 involved a deployment with the engine at idle power, and at an airspeed of approximately 200 KIAS, followed by a general assessment of overall airplane controllability during a cruise approach and full stop landing. In compliance with FAR 25.933(a)(2), Boeing demonstrated, at 10,000 feet and 220 KIAS, control of the airplane in cruise flight. The engine remained in idle reverse thrust for the approach and landing as agreed to by the FAA. Controllability at other portions of the flight envelope was substantiated by an analysis prepared by the manufacturer and accepted by the FAA.
In compliance with FAR 25.933(a)(1), the engine fuel control contains a design feature to retard the engine to idle thrust when uncommanded thrust reverser deployment occurs. The B767 was certified to meet all applicable rules
and interpretation of those rules as defined by the FAA for certification of the airplane in 1981.
The circumstance of this accident, however, bring into question the adequacy or interpretation of the FAA requirements and the demonstration/analyses that were required. This accident indicates that changes in certification philosophy are necessary. The left engine thrust reverser was not restored to the forward thrust position prior to impact and accident scene evidence is inconclusive that it could have been restowed. Based on the simulation of this event, the airplane was not capable of controlled flight if full wheel and full rudder were not applied within 4 to 6 seconds after the thrust reverser deployed. The consideration given to high-speed in-flight thrust reverser deployment during design and certification was not verified by flight or wind tunnel testing and appears to be inadequate.
Regarding B767 certification, results of this investigation indicate that the assumptions made regarding high speed flight and its beneficial effect on control effectiveness did not take into account the effects of reduced lift caused by a combination of the reverser plume and/or engine inlet spillage. Although much information has yet to be gathered on the reverser/wing relationship at high speed conditions, experience on other large transport airplanes suggest that not all airplane are affected to the same degree as the B767. Future controllability assessments should include comprehensive validation of all relevant assumptions made in the area of controllability. This is particularly important for the generation of twin-engine airplane with wing-mounted high-bypass engines.
2.5 Possible Thrust Reverser Failure Modes
The Boeing B767 thrust reverser system is designed for ground operation only. Actuation of the PW 4000 thrust reverser requires movement of two
hydraulic valves that are installed in series. The system has several levels of protection designed to prevent uncommanded in-flight deployment. Electrical mechanical systems design considerations prevent the powering of the Hydraulic Isolation Valve (HIV) or the movement to the thrust reverse levers into reverse. The investigation of this accident disclosed that if certain anomalies exist with the actuation of the auto-restow circuitry in flight these anomalies could have circumvented the protection afforded by these designs.
The Directional Control Valve (DCV) for the left engine, a key component in the thrust reverser system, was not recovered until 9 months after the accident. The examination of all other thrust reverser system components recovered indicated that all systems were functional at the time of the accident. Lauda Airlines had performed maintenance on the thrust reverser system in an effort to clear maintenance messages. However, these discrepancies did not preclude further use of the airplane.
2.5.2 Crew Commanded Deployment
The possibility of crew commanded thrust reverser deployment was considered. The probability of an experienced crew intentionally selecting reverse thrust during a high-power climb phase of flight is extremely remote. There is no indication on the CVR that the crew initiated reverse thrust. Had the crew intentionally or unintentionally attempted to select reverse thrust, the forward thrust levers would have had to be moved to the idle position in order to raise the thrust reverser lever(s). In addition, the air/ground system would have prevented hydraulic power from being applied to deploy the thrust reversers. Examination of the available airplane's center control stand components indicated that the mechanical interlock system should have been capable of functioning as designed.
2.5.3 Electrical System Failures Resulting in Deployment
The possibility of electrical system failures resulting in an uncommanded thrust reverser deployment was considered. Testing and detailed analysis of the thrust reverser system design were conducted at Boeing with participation of the FAA and the NTSB. The investigation of the accident disclosed that certain hot short conditions involving the electrical system could potentially command the DCV to move to the deploy position in conjunction with an auto restow command, for a maximum of one second which would cause the thrust reversers to move.
To enable the thrust reverser system for deployment, the Hydraulic Isolation Valve (HIV) must be opened to provide hydraulic pressure for the system. The HIV is opened either by a circuit that includes the air/ground electrical sensing system or through the auto-restow circuit.
That an electrical wiring anomaly could explain the illumination of the "REV ISLN" indication is supported by the known occurrence of wiring anomalies on other B 767 airplanes.
The auto-restow circuit design was intended to provide for restowing the thrust reversers after sensing the thrust reverser cowls out of agreement with the commanded position. The auto-restow circuit powers the HIV to open regardless of indications from the air/ground circuit. If another electrical failure such as a short circuit to the DCV solenoid circuit occurred, then with hydraulic pressure available, the DCV may cause the thrust reverser cowls to deploy. The electrical circuits involved are protected against short circuits to ground by installing current limiting circuit breakers into the system. These circuit breakers should open if their rated capacity is exceeded for a given time. The DCV electrical circuit also has a grounding provision for hot-short protection.
Testing and analysis conducted by Boeing and the DCV manufacturer indicated that a minimum voltage of 8.2 Vdc was required to actuate one of 599 DCV solenoids tested. The worst case hot-short threat identified within the thrust reverser wire bundle would provide 22.6 Vdc to the DCV solenoid for 1.0 seconds. Boeing could not provide test data or analysis to determine the extent of thrust reverser movement in response to a momentary hot-short with a voltage greater than 8.2 Vdc or the ability of the thrust reverser to return to the stowed position after tripping of the circuit breaker associated with the source of the hot-short.
Additional analysis and testing indicated that shorting of the DCV wiring with wires carrying AC voltage could not cause the DCV solenoid to operate under any known condition.
The degree of destruction of the Lauda airplane negated efforts to identify an electrical system malfunction. No wiring or electrical system component malfunction was positively observed or identified as the cause of uncommanded thrust reverser deployment on the accident airplane.
2.5.4 Hydraulic System Failures Resulting in Deployment
Testing at Boeing on the B767 hydraulic test fixture, in conditions with the HIV open, disclosed that contamination of the solenoid operated DCV pilot valve could result in an increase in pressure on the deploy side of the valve. This could result in uncommanded deployment of the thrust reverser if the HIV was open to supply hydraulic pressure to the valve. Immediately following this discovery, Boeing notified the FAA and a telegraphic airworthiness directive (AD) T91-17-51 was issued on August 15, 1991 to deactivate the thrust reversers on the B767 fleet.
Testing of a DCV showed that contamination in the DCV solenoid valve can produce internal blockage, which, in combination with hydraulic pressure available to the DCV (HIV open), can result in the uncommanded movement of the
DCV to the deploy position. Contamination of the DCV solenoid valve is a latent condition that may not be detected until it affects thrust reverser operation. Hydraulic pressure at the DCV can result from an auto-restow signal which opens the thrust reverser system hydraulic isolation valve located in the engine pylon. Results of the inspections and checks required by AD 91-15-09 indicated that approximately 40 percent of airplane reversers checked had auto-restow position sensors out of adjustment. Improper auto-restow sensor adjustment can result in an auto-restow signal.
Other potential hydraulic system failures including blockage of return system flow, vibration, and intermittent cycling of the DCV, HIV, and the effects of internal leakage in the actuators were tested by Boeing. The tests disclosed that uncommanded deployment of the thrust reverser was possible with blockage of the solenoid valve return passage internal to the DCV or total return blockage in the return line common to the reverser cowls. Uncommanded deployment of one thrust reverser cowl was shown to be possible in these tests when the HIV was energized porting fluid to the rod end of the actuator (stow commanded) with the piston seal and bronze cap missing from the actuator piston head. The results of this testing indicates that this detail may have been overlooked in the original failure mode and effects analysis.
The aerodynamic effects of the thrust reverser plume on the wing, as demonstrated by simulation, has called basic certification assumptions in question. Although no specific component malfunction was identified that caused uncommanded thrust reverse actuation on the accident airplane, the investigation resulted in an FAA determination that electrical and hydraulic systems may be affected. As previously stated, the AD of August 15, 1991 required the deactivation of all electrically controlled B767 (PW4000 series powered) thrust reversers until corrective actions were identified to prevent uncommanded in-flight thrust reverser deployment.
The condition of the left engine DCV which was recovered approximately 9 months after the accident, indicated that it was partially disassembled and reassembled by persons not associated with the accident
investigation. Examination of the DCV indicated no anomalies that would have adversely affected the operation of the thrust reverser system. The plug the investigation team found in the retract port of the DCV (reference paragraph 1.16) would have prevented retraction of the thrust reverser cowls on the left hand engine. However, the accident investigation team concluded that the plug (a part used in the hydraulic pump installation on the engine) was placed into the port after the accident by persons not associated with the investigation. This determination was based on the fact that the plug was found finger tight which would indicate the potential for hydraulic fluid leakage with the hydraulic system operating pressure of 3000 psi applied. Also, soil particles were found inside the valve body.
2.6 Maintenance Activity
It was apparent, from examination of the "Trouble Shooting" documents and interviews with Lauda maintenance personnel, that they were following the procedures in the Boeing Fault Isolation Manual (FIM) to resolve recurring REV RNG FAIL and REV CR-CHK fault messages in the left engine PIMU. However, their efforts were unsuccessful in that the procedure never led to identifying an anomaly. When several attempts at the entire procedure were unsuccessful, Lauda personnel felt the need to continue troubleshooting efforts. They removed/interchanged DCVs, HIVs, and PIMUs however they did not seek assistance from Boeing or Boeing's Vienna based field service representative. Boeing considers these removals and interchanges as not related to PIMU fault messages, ineffective in resolving the cause of the messages, and not per FIM direction.
Lauda maintenance records also indicate replacement and re-rigging of thrust reverser actuators. There was no further procedure or other guidance available in the Boeing FIM, and Lauda maintenance personnel made the decision to physically inspect the entire thrust reverser wiring harness on the engine and in the pylon. Wire continuity checks between the EEC and the Linear Variable Differential Transducers (LVDTs) for troubleshooting "RNG FAIL" messages are part of the FIM procedure if resistance values of the LVDTs are within limits. However, checking other thrust reverser wiring because of "RNG FAIL" messages
is, according to Boeing, "inappropriate" since "RNG FAIL" PIMU messages are independent of the operation and indication circuits of the thrust reverser.
The Boeing Dispatch Deviation Guide allows dispatch for up to 500 hours with an EEC maintenance message annunicated. If the message is cleared following a corrective action and does not reoccur on the next flight, when if it does reoccur, a new 500 hour interval begins. Therefore, Lauda was not remiss in continuing to dispatch the airplane and trouble shoot the problem between flights. No specific Lauda maintenance action was identified that caused uncommanded thrust reverser actuation on the accident airplane.
2.7 System Design Changes as a Result of the Accident
The NTSB issued four urgent action safety recommendations to the FAA on July 3, 1991 regarding this accident (see appendix D). The FAA issued a letter dated September 11, 1991 describing FAA actions in response to the accident. An international industry/government task force is reviewing design philosophy and certification.
As a direct result of testing and engineering re-evaluation accomplished after this accident, Boeing proposed thrust reverser system design changes intended to preclude the reoccurrence of this accident. The changes are mandated by FAA airworthiness directive for all PW4000 series powered airplane. In service B767's were modified by incorporation of a Boeing service bulletin by teams of Boeing mechanics. The fleet modification was completed in February 1992. Design reviews and appropriate changes are in progress for other transport airplane.
The B767 design changes are based on the separation of the reverser deploy and stow functions by:
2.8 Flight Data Recorder Damage
The recording tape media within the FDR installed on the accident airplane was melted due to thermal exposure related to the post crash fire. It was impossible to extract any information from the recorder. Industry records indicate that investigative authorities have reported a similar loss of recorded data in several accidents that occurred both prior to and subsequent to the subject accident. These events are:
|March 10, 1989||Dryden, Ont., Canada||F28||Air Ontario|
|November 27, 1989||Bogota, Colombia||B727||Avianca|
|December 29, 1991||Taipei, Taiwan||B747F||China Airlines|
|January 20, 1992||Strasbourg, France||A320||Air Inter|
It is recommended that the airplane certification authorities and equipment manufacturers conduct research with the most modern materials and heat transfer protection methods to develop improved heat protection standards for flight data recorders. Standards revisions should include realistic prolonged exposure time and temperature levels. The revised standards should apply to newly certificated FDR equipment and where practical through Airworthiness Directive action, to FDRs that are now in service.
|ACM SAMART SODSATIT||CHAIRMAN||GROUP CAPTAIN KITIPONG KESMUTI||EXPERT|
|MR. ROUNGROJ SRIPRASERTSUK||VICE CHAIRMAN||GROUP CAPTAIN SUTUSPUN KAJORNBOON||EXPERT|
|?VM. STAN CHIRAROCHANA||VICE CHAIRMAN||GROUP CAPTAIN VICHAN BOENIM||EXPERT|
|GROUP CAPTAIN SWAKE LAIPRADIT||MEMBER||MR. CHACHAVAL ORANOP NA AYUTHAYA||EXPERT|
|WING COMMANDER LERTROP TOSING||MEMBER||POL CAPTAIN ARNAT SEMTAPPRA||EXPERT|
|GROUP CHAIRMAN THERAPAP SENAWOG||MEMBER||MR. WIWIT DEEPRADIT||EXPERT|
|WING COMMANDER BANDIT|
|MEMBER||MR. VICHAI PRATEEPPRECHA||MEMBER AND|
|MR. PRADIT HOPRASATSUK||MEMBER||MR. THONG ODTONDI||MEMBER AND|
|MR. SUPHAVICH YANVAREE||MEMBER|
|MR. BANCHOED APHINIVES||MEMBER||MR. PITAK CHAILIKIT||MEMBER AND|
|MR. SAWAT SITTIWONG||EXPERT|
In addition to the transcript which follows, the recorder tape was also examined in an attempt to document any engine or other background sounds. Sound signatures identified as being produced by the engines were only visible when the power was advanced during the start of the takeoff roll. No other definite engine signatures could be identified during any other portion of the recording.
Background "wind" noise in the cockpit can be heard to increase in intensity from thrust reverser deployment until the end of the recording. This increase in background noise intensity is attributed to the aircraft's increasing airspeed during this span of time. The percentage of increase in the airspeed that the aircraft experienced during those final seconds of the recording could not be determined from the audio recording. Also, during this time a noticeable modulation or vibration in the recorded sounds can be heard on the CVR recording. This anomaly in the recording was probably caused by the physical shaking of the recorder from airframe buffet. Neither the United States National Transportation Safety Board nor the Boeing Company could demodulate this recorded vibration to obtain any meaningful data.
During the final seconds of the recording, several alarm or alert tones were heard on the CVR recording. The U.S. National Transportation Safety Board along with the Boeing Company conducted a detailed investigation to document these tones. There was insufficient information to form a definite conclusion as to the cause of these aural alerts. (see chart at end of CVR transcript.)
TRANSCRIPT OF A FAIRCHILD MODEL A-100A COCKPIT VOICE RECORDER S/N 52889 REMOVED FROM A LAUDA AIRLINES, BOEING 767-300ER, OE-LAV WHICH WAS INVOLVED IN A ACCIDENT ON MAY 26, 1991 OVER SUPHAN BURI PROVINCE, THAILAND.
|RDO||Radio transmission from accident aircraft|
|BM||Hot boom microphone sound or source|
|CAM||Cockpit Area Microphone sound or source|
|-1||Voice identified as Captain|
|-2||Voice identified as First Officer|
|TWR||Bangkok Local Control (tower)|
|DEP||Bangkok Departure Control|
|CTR||Bangkok Enroute Traffic Control (center)|
|COP||Lauda Company Radio (Bangkok)|
|%||Break in continuity|
|( )||Questionable text|
|(( ))||Editorial insertion|
|46 / -1-|
|Lauda Air (Austria) Flight NG-4 Boeing 767-300ER Reg no OE-LAV May 26, 1991 Suphan Buri province Thailand|
|TIME &||TIME &|
|Start of recording|
|Start of transcript|
|TWR||Lauda four contact approach |
one one nine one after
airborne wind one six zero
degree seven knots cleared for
takeoff two one left good by
|RDO-2||cleared for takeoff two one |
left after airborne one one
nine one sawasdee krab
(good-by) Lauda four
|TWR||sawasdee krab (good-by)|
|BM-2||there's one aircraft coming on ah base leg |
approach checked clear we're cleared for
takeoff two one left
|CAM||((sound of engines spooling up))|
|47 / -2-|
|Lauda Air (Austria) Flight NG-4 Boeing 767-300ER Reg no OE-LAV May 26, 1991 Suphan Buri province Thailand|
|TIME &||TIME &|
|BM-2||ah Vee one|
|BM-2||positive rate of climb|
|BM-1||gear up please|
|RDO-2||Bangkok good evening Lauda four|
|DEP||Lauda four good evening |
identified maintain seven
thousand QNH one zero seven is
|RDO-2||cleared to seven thousand then |
one zero zero seven Lauda four
|48 / -3-|
|Lauda Air (Austria) Flight NG-4 Boeing 767-300ER Reg no OE-LAV May 26, 1991 Suphan Buri province Thailand|
|TIME &||TIME &|
|DEP||Lauda four I'm sorry |
identified stop your climb one
|RDO-2||re-cleared to one one thousand |
Lauda four requesting direct
|DEP||Lauda four Bangkok direct |
|RDO-2||cleared direct Limla Lauda four|
|49 / -4-|
|TIME &||TIME &|
|BM-1||set direct limbo please|
|BM-2||flaps coming up|
|DEP||Lauda four Bangkok request |
|RDO-2||out of three thousand eight |
hundred climbing to one one
|DEP||Lauda four roger|
|DEP||Lauda four contact Bangkok |
control one two eight decimal
|RDO-2||one two eight one sawasdee |
|50 / -5-|
|TIME &||TIME &|
|DEP||sawasdee krab (good-by)|
|RDO-2||Bangkok good evening Lauda four|
|CTR||Lauda four Bangkok control|
|RDO-2||we are out of four thousand |
five hundred for one one
thousand direct to Limbo
|CTR||Lauda four radar identified |
maintain flight level three
|RDO-2||we are re-cleared to level |
three one zero and maintaining
|BM-2||do you want me to delete this speed restriction|
|51 / -6-|
|TIME &||TIME &|
|BM-1||and the after take off check|
|BM-2||landing gear's off flaps up after takeoff |
|BM-1||okay and we got altimeters at thirteen|
|BK-2||((copilot adding numbers in German to himself))|
|RDO-2||Bangkok ground Lauda four|
|COP||Lauda maintenance Bangkok go |
|52 / -7-|
|TIME &||TIME &|
|RDO-2||zero three zero eight|
|COP||zero three zero eight thank you|
|BM-1||that keeps that's come on|
|BM-2||so we past transition altitude one zero one three|
|BM-1||what's it say in there about that just oh|
|BM-2||additional system failures may cause in-flight deployment |
expect normal reverse operation after landing
|53 / -8-|
|TIME &||TIME &|
|BM-1||just ah let's see|
|BM-2||shall I ask the ground staff|
|BM-2||shall I ask the the technical men|
|BM-1||oh you can tell 'em about it just it's it's it's |
just ah no- ah it's probably ah wa- ah moisture or
something cause it's not it's not just on it's coming
on and off
|BM-1||but oh you know it's a- it doesn't really it's just |
an advisory thing I don't ah
|54 / -9-|
|TIME &||TIME &|
|BM-1||could be some moisture in there or somethin'|
|BM-2||think you need a little bit rudder trim to the left huh|
|BM-2||you need a little bit of rudder trim to the left|
|BM-2||((adding numbers to himself in German starts))|
|BM-2||((adding numbers stop))|
|((sound of tape splice))|
|55 / -10-|
|TIME &||TIME &|
|BM-2||oh reverser's deployed|
|CAM||((sound similar to airframe shuddering))|
|CAM||((sound of metallic snap))|
|CAM||((sound of metallic snap ))|
|CAM||(( sound of four caution tones))|
|CAM||(( sound of siren warning starts))|
|CAM||((sound of siren warning stops))|
|CAM||((sound of siren warning starts and continues until end of recording))|
|56 / -11-|
|TIME &||TIME &|
|CAM||((sound of metallic snap ))|
|BM-1||here wait a minute|
|CAM||(sound of two metallic snaps))|
|CAM||((sound of wind (background) noise increasing in volume))|
|CAM||((sound of recorder vibration starts and continues until end of recording))|
|CAM||((sound of multiple bangs start and continue until end of recording ))|
|end of recording|
|CAUTION||POSSIBLE ALERTS||POSSIBLE CAUSE|
| AUTOPILOT |
| Control wheel inputs by pilot. |
Pilot response to an upset condition.
| AUTOTHROTTLE DISCONNECT |
| Pilot actuation of the A/T Disengage Switch on the throttle levers.|
Pilot response to an abnormal engine condition.
|LEFT ENGINE SHUTDOWN |
|Pilot action as specified in QRH procedure for "REVERSER UNLOCKED" condition|
| AUTOPILOT |
|Automatic response to system degradation.|
| AUTOTHROTTlLE DISCONNECT |
|Automatic response to system degradation.|
| WARNING |
| AUTOPILOT DISCONNECT |
| Pilot actuation of the A/P Disengage Switch on the control column.|
Second actuation of the switch more than 700 msec after first actuation.
| WARNING |
| OVERSPEED |
|Automatic response to overspeed condition.|
deployed position, as sensed by the Proximity Switch Electronic Unit (PSEU) logic, the REV display changes to green.
The reverse lever is restricted to the idle reverse position by the throttle interlock system until 40% of the deploy stroke is completed. At 40% deployment the EEC allows power to the interlock relay and extends the interlock actuator allowing free travel of the thrust reverser levers.
The Electronic Engine Control (EEC) also has thrust limiting logic which uses Throttle Resolver Angle (TRA) input via dual position resolvers along with reverser position input via Linear Variable Differential Transformers (LVDT's) to determine engine thrust as a function of reverser position. When the throttle position indicates that reverse thrust has been commanded, the control will limit thrust to idle if the reverser sleeves are less than 70% deployed.
To stow the reverser, the reverse thrust lever is returned to the fully down position thus opening the DCV switch which ports the actuator head end fluid to the return system. Although the isolation valve switch on the thrust lever is also returned to the off (stow) position, auto restow switches operated by each reverser half of the reverser's translating sleeve remain closed and electrically hold the hydraulic isolation valve open until both halves are stowed. The auto-restow circuit is automatically deenergized five (5) seconds thereafter.
When the throttle position indicates that forward thrust has been commanded, the EEC, via thrust limiting logic, will assume that the reverser has been commanded stowed and will limit thrust to idle if the reverser is more than 15% deployed. When the reverser is 75% stowed, the thrust limiting function changes so that 90% of the maximum forward thrust is permitted.
The L(R) REV ISLN VAL message and REV ISLN caution light are not illuminated unless a disagreement exists between the air/ground relays, the reverser system is pressurized in flight, or the reverser system fails to pressurize on command on the ground. A two (2) second delay is used in this circuit to prevent nuisance illuminations.
Thrust Reverser Actuation System Description
The thrust reverser is actuated by hydraulic power from three linear actuators attached to each translating sleeve. The three actuators are synchronized by a flexible cable system contained within the hydraulic supply tubing. Supply and control of the hydraulic fluid to the actuators is by means of a hydraulic isolation valve, a directional control valve, and two flow restrictor orifice "T" connectors. These three components are installed in the engine support strut. Hydraulic power is supplied to each reverser actuation system associated with the engine upon which the reverser is mounted.
Hydraulic Isolation Valve (HIV)
The Hydraulic Isolation Valve (HIV) is a hydraulic servo valve with an arming spool actuated by a solenoid-operated pilot valve. When the solenoid is energized, the pilot valve is opened and fluid is ported to one end of an arming valve spool. This spool is spring biased to the closed position. A pressure buildup of 750 to 900 psid is required to produce flow through the valve. Return flow to the hydraulic power system is ported continuously from the CONT port to the RETURN port, independent of solenoid operation. A check valve is placed in the return port to prevent pressure surges from propagating back into the reverser's return system.
In addition to the de-energized and energized operating modes, the isolation valve has modes for inoperative dispatch and ground servicing. For inoperative dispatch, a pin is inserted into the valve which prevents the valve arming spool from allowing fluid flow to the reverser actuators.
Directional Control Valve (DCV)
The Directional Control Valve (DCV) is mounted in the forward portion of the engine strut. The DCV is dual-staged, with a solenoid operated pilot valve (first stage) and a hydraulic operated main valve (second stage). The DCV solenoid is powered through the DCV deploy switch which is mounted in a switch pack directly below the flight deck. With the DCV solenoid deenergized (stow mode) and the HIV solenoid de-energized, the DCV main spool is spring and pressure biased to the stow mode and hydraulic pressure is applied to the rod end of the actuators only; the head end of the actuators are vented to return. The actuators are maintained in the retracted (stowed) position.
At 29 degrees of reverse thrust lever travel, the DCV switch is closed to deploy, thus energizing the DCV solenoid and allowing hydraulic fluid to pass through the first stage pilot valve. Hydraulic pressure acting on a differential spool area then overcomes the spool spring force and shuttles the main valve spool to the deploy mode. In this valve position, hydraulic pressure is applied to the head and rod end of the actuators, unlocking the locks, and allowing the T/R actuators to be driven to the extended (deployed) position.
A damping orifice, located between the solenoid pilot valve and the main valve power spool, is used to reduce pressure spikes at the center actuator lock lever.
Flow Control System (Orifice Tees)
The flow control system divides the incoming flow from the DCV to operate the two reverser sleeves on each engine as separate mechanisms operating simultaneously. To accomplish this, the system incorporates flow restrictor tees in the extend and retract passages. Incoming flow is ported from the DCV to the PRESS A port for extension. Incoming flow to the PRESS B port to accomplish retractions is controlled by the isolation valve.
During extension of the reverser, flow is routed through the extend restrictor tee to the actuator head ends. Equal pressure is developed in both head and rod end cavities of the actuators. Reverser extension is achieved by having a two-to-one actuator piston area differential favoring extension. The returning flow from the actuator rod ends is routed through the retract restrictor tee and ports to the PRESS B port of the directional control valve.
The six actuators used to operate each engine's thrust reverser sleeves are hydraulically powered. Actuator movement in the extend direction is produced by connecting both head and rod end cavities to the source of flow thus providing an extension force equal to the supply pressure acting over the difference between head and rod end areas. Actuator movement in the retract direction is produced by connecting the rod end cavity to supply and the head end cavity to return. The linear movement of the actuator piston produces rotation of an acme screw that is installed concentric within the piston rod. The piston rod is prevented from rotational motion relative to the actuator body by the gimbal mount of the actuator and pinned attachment of the rod end. Rotation of the acme screw drives the synchronization gear train. The synchronization gear trains of adjacent actuators are connected by flexible cables that are encased within the hydraulic tubing that connects the head end cavities of these actuators. A square end drive on each end of the flexible cables inserts into the worm gear of the synchronization gear train to complete the mechanical connection.
As the actuators extend, fluid flow to the head ends is provided by one-half of the volume coming from the fluid source and one-half the volume coming from the restrictor tee of the flow control system and returned to port PRESS B of the DCV.
Fluid flow to and from the rod end cavity is ported through the snubbing ring. When the actuator is extending, outflow passes to the hydraulic fluid fitting on the actuator rod end. Snubbing begins when the snubbing skirt on the piston rod enters the gap between the piston rod and the snubbing ring. The reverser retract cycle is not snubbed because the retracting velocities are lower and there is no driving aerodynamic loads.
Each half sleeve for each engine reverser is translated with three hydraulic linear actuators. The center actuator on each half sleeve incorporates a locking mechanism that functions by engagement of two serrated discs. This engagement directly prevents rotation of the synchronizing gear train that mechanically interconnects the three actuators.
One disc is keyed to the acme screw in the actuator and rotates when the actuator is translating. The other disc is non-rotating, splined to the actuator barrel, and is actuated linearly along the spline by a helical
spring to engage the two discs, and by the locking piston through the lock lever pivot arm to accomplish separation of the two discs.
As the center actuator nears the stowed position during retraction the helical lock spring becomes compressed forcing the splined, non-rotating disc against the rotating disc. This causes the two discs to ratchet until the actuator piston bottoms. The center actuator is locked against extension by serration engagement which prevents acme screw rotation and hence piston movement.
During retraction, the return flow from the actuator bead end bypasses the lock piston through a check valve and the preload spring holds the lock piston in the locked position. The spring bias of the preload spring also prevents pressure surges from inadvertently unlocking the serrated disks while the reverser is stowed.
Thrust Reverser Position Feedback System
The thrust reverser feedback system provides the EEC with an indication of the thrust reverser sleeve positions as measured at the center locking actuators. The EEC uses the T/R position for thrust lever interlock command and to determine allowable engine power settings (forward and reverse).
The T/R position feedback system consists of the two center locking actuators and two dual linear variable differential transformers (LVDT's), one mounted on each locking actuator. The dual LVDT is essentially two electronically independent LVDT's packaged within one unit. There are two separate electrical inputs, outputs, moveable armatures, etc. The two movable armatures are joined together and are driven by a single mechanical input.
In the 767/PW4000 installation, the LVDT armature assemblies are pinned to the feedback rods of the locking actuators. As the actuators are extended or retracted, the armatures are inserted into or withdrawn from the LVDT stator, respectively.
A spring is included within the LVDT package to bias the armatures of the dual LVDT to the stow indication position. This is included in the system in the event of a mechanical failure of the feedback linkage from the center locking hydraulic actuators.
ELECTRICAL/ELECTRONIC SYSTEMS DESCRIPTION
Electrical Control System
The reverser's electrical control system consists of eight switches and two solenoids for each thrust reverser.
Six switches must all be closed to obtain hydraulic flow in the reverser system for normal reverser system for normal reverser operation. Three switches must be closed to complete the circuit to the isolation valve. They are: (1) a fire switch in the normal position, (2) an air/ground switch that
allows reverser operation (pressurization) only when the plane is on the ground, (3) an isolation valve switch that allows flow to the isolation valve only when the reverse thrust lever is lifted. Likewise, to complete the circuit to the directional control valve, a fire switch and an air/ground switch must be closed as well as a directional control valve switch which is closed via a switch cam located below the flight deck. Either one of two auto-restow sensors, independent of the preceding six switches, initiate or maintain reverser operation any time either reverser half is not stowed. Reverser operation is initiated by energizing the solenoid that opens the isolation valve.
Operating the fire switches will remove electrical power from the isolation valve and the directional control valve solenoids.
The air/ground switches are relays that are activated by the proximity switch system. When both landing gears move out of the tilted position the air/ground relays are energized to the ground mode.
Isolation Valve Switch
The isolation valve switch is a micro switch mounted near the hinge point of the thrust reverse lever. The switch is activated by a contoured surface at the hinge of the lever. The switch closes at any time the thrust reverse lever is lifted more than 10 degrees.
Directional Control Valve Switch
The DCV switch is a micro switch mounted below the autothrottle assembly. The switch is activated by a contoured surface on the switch cam via a follower and roller assembly. The switch closes and energizes the DCV any time the thrust reverse lever is lifted more than 29 degrees.
Auto Restow Sensors
Two proximity sensors, one for each reverser half, are located on the nacelle torque box structure at the forward end of the reverser cascade near the reverser's center actuator. The target elements for the switch sensors are located on the translating sleeve. The sensors are adjusted to close when the reverser sleeve moves from the fully stowed position. The stow relay is energized to complete an electrical circuit to the isolation valve. Since the reverser hydraulic power must remain available until the reverser is fully stowed during the stow cycle, a 5 second time delay following the sensed reverser stowed position is incorporated in the Proximity Switch Electronic Unit (PSEU) logic for the restow circuit.
The electrical circuit controlling the left engine thrust reverser is separated from the right engine. Separate power sources, circuit breakers, switches, wires, and relays through to separate isolation valves are used. The individual reverser wire bundles are routed separately from each other. The auto-restow proximity sensors are connected to separate sections of the proximity switch electronic unit (PSEU). The control circuits to the HIV and DCV solenoids are electrically separated from the indication circuit on each engine.
The auto-restow proximity sensors are excited by an electronic circuit in the PSEU mounted in the electrical rack. The circuit and power source for the left thrust reverser restow sensors are separate from that of the right engine reverser.
Two reverser positions and one system condition are indicated by Engine Indicating and Crew Alerting System (EICAS). Reverser unlock is indicated by "REV" in amber color. In full deploy "REV" changes to green. An isolation valve condition is indicated by L(R) REV ISLN VAL in amber and a repeater amber light (labelled REV ISLN) on the P10 panel. A two-second time delay is used with this isolation valve indication to remove nuisance warnings.
Reverser Unlocked Indication
The reverser unlocked indication is activated by either of two proximity switches located one on each lock housing of the center actuators. The "REV" amber indication occurs anytime either lock is unlocked. The proximity switch is activated by movement of a target arm attached to the lock actuator's pivot shaft.
Full Reverse Indication
The full reverse indication is controlled by two proximity switches which are connected so that the "REV" green indication occurs only when both reverser halves reach the fully deployed position. In the event that amber and green are signalled simultaneously, the amber signal prevails.
Reverser Isolation Indication
The REV ISLN light and EICAS caution indicate a disagreement between the reverser hydraulic pressure and either the air/ground system or the reverser command signal. A pressure switch in the hydraulic supply line immediately downstream of the isolation valve is wired in series with two relay contacts and the air/ground system. A disagreement between pressure and the voltage to the isolation valve or to the reverser control switch or to the air/ground
switch will cause a detect relay to release and provide a ground to the REV ISLN light and EICAS after a 2-second time delay.
L(R) REV ISLN VAL caution indicates that a malfunction exists that may result in a reverser deployment if the thrust reverse lever is lifted in flight, or that on reverser may not deploy when commanded on the ground.
EICAS Interlock Indication
The indication system includes a status message on EICAS to detect an interlock actuator failure to block movement of the thrust reverse control levers. The indication is required because the pilot may not be able to detect the interlock failure to block thrust lever motion during normal thrust reverser deployment. A status message will be sent to EICAS alerting the crew of the lack of interlock for the landing aid the next dispatch.
The electronic circuits operating the proximity switches and reverser indication are located in the proximity switch electronic unit module (PSEU) mounted in the electronic rack. Complete separation is maintained between the left and right engine circuits with separate power sources, circuit breakers, wire, and relays. The only connection between reversers is at the single REV ISLN light and in EICAS where both reverser signals are sent to this module.
767-300ER Electrical System
In the event of a right or left bus failure, normal relays are relaxed and power is supplied to the thrust reversers via the battery and standby busses located on the left engine. Two additional air/ground relays (system No. 1) are incorporated on the right side to function whenever the normal (system No. 2) air/ground relays are de-energized due to a right bus failure.
767-300ER airplanes are also equipped with a hydraulic motor generator (HMG) which provides electrical power to the thrust reversers in the event of loss of all main electrical power. Power which is generated by the HMG is transferred to the right and left thrust reversers via the standby and battery busses. If normal power is recovered during flight such that both main busses are energized, the HMG shuts down to allow normal system operation.
Electronic Control System
The Electronic Engine Control (EEC) is a dual channel micro-processor based electronic unit and is the core of the engine control system on the PW4000 engine. The main function of the EEC is the scheduling of fuel flow, stator vanes and bleed valves to control the thrust and performance of the engine as a function of the thrust lever position.
The EEC is configured as a dual channel system with independent inputs to and outputs from each channel. The throttle lever angle (TLA) is transmitted to each EEC channel as an electrical signal from a dual channel
resolver which is mechanically linked to the throttle levers. This signal is referred to as the Throttle Resolver Angle (TRA). The reverser position is provided as an electrical signal to each EEC channel by two independent position sensing circuits containing linear variable differential transducers (LVDT). The LVDT's sense each sleeve position from the center actuators.
Each channel's output of one dual LVDT is connected in series electrically to the corresponding channel's output of the dual LVDT mounted on the other sleeve's locking actuator. (The LVDT electrical inputs for each channel are wired in parallel). These series connected LVDT outputs provide an indication of the average reverser sleeve position to each channel (primary and secondary) of the EEC, while maintaining electrical separation of the EEC channels.
Each EEC channel provides a discrete output which energizes the interlock actuator relay. The interlock inhibits travel of the reverse thrust lever beyond reverse idle until the average reverser sleeve position is beyond the null thrust position (40% deployed).
Thrust Limiting Function
This function compares the thrust commanded by the pilot (TRA) to the position of the thrust reverser sleeves. When the TRA indicates that forward thrust has been commanded, the EEC will assume that the reverser has been commanded stowed, and will limit thrust to idle if the reverser is more than 15% deployed. Similarly, when TRA indicates that reverse thrust has been commanded the control will limit thrust to idle if the reverser sleeves are less than 70% deployed.
The limiting function is incorporated to ensure that thrust is in the direction of the command. This function is invoked under two circumstances, the first occurs when the direction of commanded thrust has just changed and the reverser is in transit to the commanded position. Mechanical interlocks are incorporated to prevent the pilot from commanding reverse thrust above idle until the thrust reverser is at a prescribed position. Thrust limiting in the EEC, during normal operation, provides a second level of protection against high thrust in the uncommanded direction. Thrust limiting will also be invoked in the case of an inadvertent departure of the thrust reverser from the commanded position. The EECs thrust limiting function provides an independent system to reduce the engines thrust until the sleeve position agrees with the TRA command.
Date: July 3, 1991
In reply refer to: A-91-45 through -48
Honorable James B. Busey
Federal Aviation Administration
Washington, D.C. 20591
On May 26, 1991, at about 2317 local time, a Lauda Airlines Boeing 767-300ER, on scheduled flight NG004 from Hong Kong to Vienna, Austria, with an en route stop in Bangkok, Thailand, crashed into mountainous jungle terrain about 94 natural miles northwest of Bangkok. All 213 passengers and 10 crewmembers on board were fatally injured in the accident.
The positions of the left engine thrust reverser actuators along with data from the electronic engine control (EEC) and the cockpit voice recorder (CVR) indicate that the left engine thrust reverse system deployed while the airplane was at approximately .78 Mach, climbing through 24,700 feet en route to flight level 310. The preliminary evidence suggests that the reverse event was recognized by the flightcrew but that the airplane departed controlled flight, accelerated past the maximum operating velocity, and experienced an in-flight structural breakup. Indications of an in-flight fire prior to the breakup have not been found. However, during the breakup, a large explosion was witnessed and burning debris fell to the ground.
The accident airplane was equipped with Pratt and Whitney PW4000 series engines. The Boeing Airplane Company provides an electro-hydraulic thrust reverse system in these airplanes to redirect engine fan bypass airflow to aid in stopping the airplane on the ground. The thrust reverse system contains logic switching devices that are designed to prevent in-flight deployment caused by a component failure or flightcrew action. These engines also incorporate EEC devices. One function of the EEC is to reduce engine rpm to idle in the event of an inadvertent reverser deployment. Although a reduction in reverse thrust is beneficial, it does not occur immediately because of the time delay while the engine spools down.
The thrust reverse system of the PW4000 series engines installed in Boeing 767 airplanes incorporates a hydraulic isolation valve (HIV) and a directional control valve (DCV) in the engine pylon. An inappropriately positioned HIV is indicated in the cockpit by a reverser isolation valve (REV ISLN) amber caution light on the control pedestal below the throttles. The CVR revealed that the flightcrew observed the REV ISLN caution light illuminated about 9 minutes prior to the reverser deployment on the accident airplane and a crewmember observed that the light came on repeatedly.
The flightcrew discussed the Boeing 767 Quick Reference Flight Handbook (QRH) information which states that if this caution light is illuminated, additional systems failures may cause inflight deployment. The thrust reverse system is designed so that the HIV provides a safeguard against deployment caused by a DCV failure. The system is designed so that the HIV will open to provide pressure to the reverser system in flight to restow the thrust reverser if it is not fully closed. The valve can also open when certain faults exist in the system logic. Because the DCV is downstream of the HIV, a failure of the DCV that would apply hydraulic pressure to the extend side of the reverse actuators would not be apparent until the HIV is opened. The HIV normally opens when the airplane lands and the reverse system is used. A DCV failure might then be apparent when the translating cowl does not stow properly. While information provided by the manufacturer indicates that other Boeing 767 airplanes have experienced 'REV ISLN' caution light illuminations during flight, there have been no prior indications of DCV failure or uncommanded thrust reverser extensions.
The hydraulic thrust reverse actuators from the left engine of the accident airplane were found in the deployed position and no pre-existing faults were evident. Hydraulic power for the actuators can come only through the DCV located in the pylon, which is a high vibration environment. The left engine DCV has not been found and thus could not be examined for malfunction. It was located in the pylon near the point where the pylon separated, from the airplane. However, a failure mode and effects analysis for the thrust reverser system has revealed failure modes in the DCV that could cause an uncommanded reverser deployment after an opening of the HIV. After reviewing HIV/DCV failure modes, the Safety Board believes that the FAA should conduct a certification review of the PW4000 series equipped Boeing 767 airplane thrust reverse system.
The Safety Board has been provided with data from Boeing indicating that flight control has been demonstrated on the Boeing 767 with one engine in the reverse idle position at 200 knots IAS; however, the Board has been informed that such testing has not been performed at higher speeds or at higher engine thrust levels. The Safety Board is concerned about the potential severity of airframe buffeting, aerodynamic lift loss, and subsequent yawing and rolling forces which may occur at the airspeed and engine thrust levels that existed when the reverser deployed in the accident flight.
The Safety Board is also concerned that Boeing 767 flightcrew emergency procedures may not provide appropriate and timely guidance to avoid loss of flight path control in the event that the reversers deploy in flight. Pending completion of actions taken to assure acceptable reliability of the thrust reverse system, the Safety Board believes that flight crew procedures in response to a 'REV ISLN" light while airborne should include actions to attain appropriate combinations of altitude, airspeed, and thrust settings which will minimize control difficulties in the event of subsequent reverser deployment. Furthermore, consideration should be given to the development of emergency procedures which would include pulling the fire handle in the event that the reverser does deploy. This would immediately remove fuel, and hydraulic and electrical power to the affected engine. The Safety Board also believes that flightcrews should be forewarned that an in-flight deployment of a thrust reverser may result in significant airplane buffeting, yawing, and rolling forces.
Therefore, the National Transportation Safety Board recommends that the Federal Aviation Administration:
| U.S. Department|
| Transport Airplane Directorate|
Aircraft Certification Service
| Federal Aviation |
|1601 Lind Avenue S.W. |
Renton, Washington 98055-4056
September 11, 1991
To FAA Principal Inspectors for U.S. operators of Boeing Model 737, 747, 757, and 767 airplanes.
To airworthiness authorities of countries having operators of Boeing Model 737, 747, 757, and 767 airplanes.
This letter represents a continuation of the series of letters describing the FAA's actions in response to a recent accident which apparently resulted from an uncommanded Inflight thrust reverser deployment on a Boeing Model 767-300ER airplane.
The National Transportation Safety Board (NTSB) is investigating this accident, but has not yet identified a probable cause. The FAA is cooperating in this investigation and, in addition, is reviewing thrust reverser certification philosophy and the design of current thrust reversers. There will be future actions taken by the FAA to assure the safety of thrust reverser systems.
The rules for thrust reverser certification assume that inflight reverser deployments will occur and they require that such deployments not result in an unsafe condition. Traditionally, this has been demonstrated by tests conducted at relatively low speed and thrust conditions supported by analytical extrapolations to all flight conditions. Service experience on many airplane models has included inflight deployments which were controllable and appeared to validate these certification procedures. These procedures were applied to the 767 certification effort, and indicated that an inflight reversal was a controllable event. The recent accident calls these certification assumptions into question. It is possible that modern high bypass engines combined with more efficient thrust reversers have resulted in aircraft which require a new thrust reverser certification philosophy. Inflight reversal, under certain flight conditions, may now be an event similar in magnitude to certain primary flight control failures which must be prevented to avoid loss of the aircraft.
The Boeing Company is in agreement with the need to upgrade the level of safety of thrust reverser systems, and has been cooperating with the FAA in a review of all of their thrust reverser installations. This includes system design philosophy and system design details. This review, of course, began with the 767 due to the recent accident.
Review of the thrust reverser installations in other Boeing airplanes has been proceeding and is now to a point where some future actions can be defined. These actions include interim actions to assure the safety of thrust reversers and long term design changes and retrofit to bring thrust reverser systems up to safety level of primary flight controls.
This review, will discuss each Boeing airplane modal separately, and will present plans for both interim and final action. These are as follows:
Boeing Model 767 airplanes powered by Pratt and Whitney PW4000 series engines:
At present, all thrust reverser systems on these air planes are deactivated due to the issuance of airworthiness directive (AD) T91-18-31, dated August 23, 1991.
Boeing is at present studying several proposals for interim design changes, which would assure an increased level of safety for this thrust reverser system, thus permitting reactivation of these thrust reversers pending a final revision to the design.
Boeing intends to present their interim design change proposal to the FAA during the week of September 9, 1991, and it is anticipated that service bulletins would be available for FAA review and approval during the week of September 23, 1991. If it is determined by the FAA that the proposal provides adequate safeguards, it is the intention of the FAA to mandate this design change by AD action, and permit reactivation of the affected thrust reverser systems.
When a final design change has been approved, it in turn will be mandated by ad action, it is anticipated that these design changes will reduce or eliminate the requirement for repetitive tests and inspections of the thrust reverser system.
Boeing Model 767 airplanes powered by General Electric CF6-80C2 series and Rolls Royce RB211-524 series engines:
At present, operation of these airplanes with active thrust reverser systems is permitted. It is anticipated that certain repetitive system tests and inspections will be mandated by AD action. The service bulletins necessary for these tests and inspections have already bean approved by the FAA. and AD action is planned before October 1, 1991.
In addition, the electrical wiring for these airplanes is being examined for adequacy with respect to system separation and hot short protection. At the completion of this investigation, it is expected that a final design change will be generated, which will reduce or eliminate the requirement for repetitive tests and inspections of the thrust reverser system.
The FAA upon approving this design change will mandate its incorporation by AD action.
Boeing Model 767 airplanes powered by Pratt and Whitney JT9D or General Electric CF6-80A series engines:
Since these thrust reverser systems employ mechanically actuated directional control valves, it is felt that they do not possess the same potential for inflight reversal as those systems listed above. This assumption is further supported by a trouble free service history to date with respect to uncommanded inflight deployments.
A comprehensive investigation of the hydraulic system is in progress, and any AD action will depend upon the results of this investigation. When a final design change is approved, It will be mandated by AD action.
Boeing Model 757 airplanes powered by Pratt & Whitney PW2000 series
Boeing Model 757-200 series air planes powered by Pratt & Whitney PW2000 series engines employ essentially the same hydraulically actuated thrust reverser system as used on Boeing 767 airplanes with PW4000 engines. The FAA has determined that some 757/PW2000 thrust reversers contain the identical solenoid valve that is on the 767. This valve design bas been found to be susceptible to hydraulic system contamination failures cited in 767/PW4000 airworthiness directive (AD) T91-18-51.
As an interim action, the FAA is issuing an immediate adopted AD the week of September 9, 1991, which mandates initial and follow-on thrust reverser electrical system checks and replacement of those DCV solenoid valves which are susceptible to the contamination failure. A copy of the AD is included with this letter.
The Boeing Company is currently evaluating long term thrust reverser system configuration changes which could be terminating action to all or part of the repetitive electrical system inspections. When a final design change has been approved by the FAA, It will be mandated by AD action.
Boeing Model 757 airplanes powered by Rolls Royce RB211-535 engines:
Boeing Model 757-200 series airplanes powered by Rolls Royce RB211-535 engines employ a different hydraulically actuated thrust reverser design. This system is not susceptible to the contamination failure cited in the 767 AD. FAA/Boeing are currently reviewing the electrical portion of the 757/RB211-535 thrust reverser control system for potential latent failures. Design changes are being developed by Boeing to improve the reverser system.
When a final design change is approved by the FAA, its incorporation will be mandated by AD action.
Boeing Model 747-400 engine thrust reverser systems:
The PW4000 CF6-80C2F, and RB211-524G/H engine thrust reverser systems on the 747-400 are essentially the same as the respective systems on the 767. Any applicable system improvements identified for the 767 systems will be required on the 747-400 in the long term. No immediate actions are being taken on the 747-400 because aerodynamic differences between the 747 and the twin-engine airplanes result in adequate controllability with a reverser deployed.
Nevertheless, the FAA believes and Boeing agrees that inflight thrust reversals are undesirable, and all design improvements identified for the 767 thrust reverser system will also be incorporated on 747 airplanes.
Boeing has indicated that it plans to release system check service bulletins for the 747 thrust reverser systems in the near future. The FAA recommends that any Boeing-provided system cheeks be performed, but there are no current plans to release airworthiness directives requiring the performance of the system checks contained in these service bulletins.
Boeing Model 737 airplanes powered by CFM International CFM56-3 series engines:
Interim results of the 737/CFM56-3 design review indicate that this system is not subject to the latent failure modes induced by hydraulic system contamination that were present on the 767/PW4000 airplane. There is, however, an on-going effort to review the 737/CFM56-3 system to the same criteria noted above. While there are no plans for FAA action as of this date, results of these investigations may require that steps be taken to incorporate features or activities consistent with actions taken on other models.
In closing, we would like to point out that, in addition to the above, you should be aware that the Transport Airplane Directorate is conducting a Design review of the thrust reverser installations on other large jet transports manufactured by McDonnell-Douglas, Airbus Industries, Lockheed, etc. As a result of that review, design changes may be required in the future.
We request that you ensure that this letter is made available to airline flight departments and to all pilots of the above Boeing airplanes, to keep them fully apprised of the progress of this investigation.
(original signed by)
Leroy A. Keith
Manager, Transport Airplane Directorate
Aircraft Certification Service, ANM-100
Federal Aviation Administration
END OF APPENDIX E
COMMENTS OF THE ACCREDITED REPRESENTATIVES
Comments of the accredited representative of the United States of America were brief; and incorporated in the Final Report.
Comments of the accredited representative of Austria are appended. Brief edit items were incorporated in the Final Report. Comments on airline maintenance activities and the calls for further testing and analysis of the effects of reverser deployment and reexamination of the Dispatch Deviation Guide are provided to enlighten the reader. These items were not included in the Final Report or Recommendations.
Republic of Austria
Federal Ministry of public
Economy and Transport
A - 1031 Vienna
The Accredited Representative of the Republic of Austria, whilst agreeing that this report is a fair record of the investigation, regrets that the report was unable to form any conclusion as to the reason for the uncommanded thrust reverser deployment which was the fundamental cause of the accident. Whilst acknowledging the modifications package developed for aircraft similar to the Lauda machine and the recommendation for design reviews of all other aircraft certificated for ground-use only reverser systems, the lack of knowledge about the aerodynamic effects of deployment at high Mach numbers and Indicated Air Speeds should not be allowed to persist. Accordingly it is felt that the report should call for further analysis and testing to be accomplished on the effects of reverser deployment throughout the flight envelope on aircraft of similar configuration to the Boeing 767. In addition, it is noted that the requirements of FAR 25.933(a) (2) are probably not met by any aircraft unless it has demonstrated by flight test that it remains controllable throughout all phases of flight with a reverser deployed.
I am concerned by the apparent lack of analysis of the Cockpit Voice Recorder, being the only continuous record of the accident event in the
absence of the Digital Flight Data Recorder. There appears to be no attempt to interpret anything other than the cockpit speech although the recording contained considerably more recorded intelligence which, if anlalysed in-depth, may have yielded information about the crew's and the aircraft's behaviour following the inadvertent deployment.
I am also of the opinion that the Boeing Company's interpretation of their own Dispatch Deviation Guide requirements should be reexamined. A repetitive EEC fault message that continues for some 1800 hours despite rectification actions is clearly not responding to these actions and yet could theoretically continue indefinitely as long as it does not manifest itself during the 500 hour period allowed by the Dispatch Deviation Guide.
The following changes are proposed to be incorporated in the Final Report as they are written bold Italic, other comments should cause a more detailed explanation in the report:
.... by in-flight breakup, ground impact and fire.
The pilot-in-command, male, age 48, ...
.... December 19, 1990, valid until December 31, 1991. Additionally, ...
The co-pilot, First officer, male, 41 years of age, ...
.... Civil Aviation of Austria issued April 24, 1985. Valid until October 24, 1992. His ...
... Boeing 767-3Z9ER, ...
.... FAIL". 24 of these entries occurred since December 28, 1990. Post accident interrogation of the EEC non volatile memory, which dated to April 27 indicated a significantly higher number of similar messages occurred than were recorded in the documentations. In addition the Tech Log of May 4, 1991 indicated that a L/H engine outboard Rev. lock sensor had been found out of to tolerance and was adjusted as a result of a crew report of an amber "REV" light remaining on after landing. The majority ...
accomplished most of the troubleshooting ...
.... dispatch condition of 500 h as outlined ...
.... on the accident. There was no radar recording of the accident flight available.
The DFDR was a Sundstrand model ...
.... Appendix B.
We feel the need to notify wind in velocity and direction in 1000 ft altitude steps under this headline or in the wreckage diagramme.
.... accident site.
We feel the need to provide more evidence on the nature and the extent of the inflight fire or how the conclusion came up, that it occurred after the inflight break up.
.... event in the cockpit that appears to be associated with the intermittent illumination of a light. The pilot-in-command ...
coming on". Since the crew then consulted the A/C Quick Reference Handbook (QRH) dealing with REV ISOLATION VALVES it appears that either the "REV ISLN" advisory light on the center pedestal or its associated "L or R REV ISLN VAL" EICAS advisory messages was the object of the discussion. The REV ISLN light can illuminate in flight when a pressure is sensed downstream of the hydraulic isolation valve (HIV). No corrective ...
.... was not provided with adequate operational ...
.... auto-restow system (see Appendix C). The specific ...
.... nonvolatile memory ...
.... breakup of the aircraft.
There is a need for a statement regarding warnings, sirens and all the other metallic sounds.
We feel the need to incorporate under this headline a sketch with breakup lines, sequences and reasons.
.... PIMU, which began December 28, 1990 and continued for approx. 1800 flying hours until the accident. However, their ...
.... an anomaly. (Delete all till) They removed/interchanged DCV's, ....
.... reverser actuators. On March 26, 1991 Lauda maintenance personnel ...
.... Deviation Guide. The DDG allows continuation of operations with these specific faults until the next A-Check or for 500 h whichever comes first. On this basis Lauda was continuing to dispatch ....
... reduced to idle after the reverser deployment, ....
... malfunction was physically identified ...
END OF APPENDIX G.
END OF REPORT
|Peter B. Ladkin, 1999-02-08|
by Michael Blume