Flight conditions were recovered from non-volatile memory in the left engine electronic engine control (EEC). At the suspected point of reverser deployment, the EEC readout indicated that the airplane was at an approximate altitude of 24,700 feet, a speed of Mach 0.78, and developing climb power.

The airplane crashed in mountainous jungle terrain at 14 degrees 44 minutes North latitude and 99 degrees 27 minutes East longitude at approximately 1617 hours. Night time visual meteorological conditions prevailed.

1.2 Injuries to Persons

1.5 Personnel Information

The pilot-in-command, Thomas John Welch, male, age 48, held an Airline Transport Pilot certificate number 1589103 issued by the United States Federal Aviation Administration. This certificate carried a rating for Airplane Multi-engine Land, with type ratings for B-727, B-757, and B-767 airplane. The certificate also carried a rating for Airplane Single Engine Land which was limited to Commercial Pilot privileges. The pilot-in-command's United States certification was rendered valid by the Republic of Austria under a Decree of Recognition (#5227) issued December 19, 1990, valid until December 31, 1991. Additionally, the pilot-in-command held a Flight Engineer's certificate with a Turbojet rating (US #1825915). His total flight time as of April 25, 1991 was approximately 11,750 hours.

The co-pilot, Josef Thumer, first officer, male, 41 years of age, held an Airline Transport Pilot certificate (#313) issued by the Department of Civil Aviation of Austria, issued April 24 1985, valid until October 24, 1992. His total flight time was approximately 6,500 hours.

1.6 Airplane Information

The airplane, a Boeing 767-3Z9ER(NOTE 1), line number 283, serial number 24628, was delivered to Lauda Air on October 16, 1989. It was powered by two Pratt and Whitney 4060 engines, serial number P724134 on the left, and serial number P724130 on the right. Engine records indicate the left engine was installed on October 3, 1990, and had 2,904:15 hours and 456 cycles of operation. The right engine was installed on September 15, 1989, and had 7,444:02 hours and 1,133 cycles of operation. The airplane technical log, serial number 61287, dated May 26, 1991, shows the airframe with 7,444:02 hours and 1,135 cycles of operation. The reason for the minor variation in cycle count between the airframe and right engine is not known.

Technical logs, component status records, and the Lauda trouble shooting file maintained by their Maintenance Control were reviewed as far back as November 30, 1989. Since August 14, 1990, there were 13 maintenance actions logged on the left engine thrust reverser system, almost always in response to recurring Propulsion Interface Monitor Unit (PIMU) messages of "EEC CH-B REVERSER RNG FAIL" and "EEC CH A/B REV CR-CHK FAIL." Ten of these actions occurred since January 28, 1991. The majority of the corrective actions involved removing and replacing valves or actuators, and adjustments to the system. Typically then the PIMU message would not reoccur for several flights. The most recent known action prior to the accident was on May 25, 1991 at Vienna. At this time, a left engine thrust reverser locking actuator was replaced. Lauda had accomplished all the troubleshooting steps from the Boeing Fault Isolation Manual (FIM) without correcting the problems of the recurring PIMU messages. The company continued to dispatch the airplane on its regular schedule, with troubleshooting accomplished after return to the home station. Lauda personnel stated, they were in the process of conducting a complete inspection of the left thrust reverser wire bundle for damage before the accident occurred. The last record of visual inspection for the wiring was entered in a trouble shooting log, kept by Lauda Maintenance Department, on March 26, 1991. Dispatch of the airplane with the particular PIMU messages was permitted under a time limited dispatch condition as outlined in the airline's maintenance planning document. The Boeing Dispatch Deviation Guide cites the Pratt and Whitney Type Certificate Data Sheet E24NE, which permits dispatch for up to 500 operating hours with a EEC maintenance message annunciated.

The right engine thrust reverser had three maintenance items logged against it since August 14, 1990, and these were all for reasons of component wear and service bulletin requirements.

The Airplane Communication Addressing and Reporting System (ACARS) installed on this airplane was designed to transmit takeoff and cruise reports to ground receiving stations. The takeoff report from Bangkok was successfully transmitted and recorded. Previous takeoff and cruise reports were also available through this system. A review of this historical data did not reveal any unusual indication in the airplane or engine parameters or any marked differences between the right and left engines.

1.7 Meteorologica1 Information

The last pre-accident weather observation at Don Muang Airport in Bangkok was taken at 1600 hours, and indicated winds from 160 degrees at 6 knots, visibility in excess of 10 kilometers, 1/8th sky coverage by cumulus clouds at 2,000 feet, 3/8ths sky coverage by stratocumulus clouds at 4,000 feet, and 6/8ths sky coverage by cirrus clouds at 30,000 feet. The temperature was 26.3 degrees C and dewpoint 22 degrees C, QNH altimeter setting 29.75 in/Hg or 1007.5 mb, and in remarks temperature 79.2 degrees F and humidity 79 percent.

Another weather observation was taken after the accident, at 1636 hours, indicating winds from 170 degrees at 6 knots, visibility in excess of 10 kilometers, 1/8th sky coverage by cumulus clouds at 2,000 feet, 3/8ths sky coverage by stratocumulus clouds at 4,000 feet, and 6/8ths sky coverage by cirrus clouds at 30,000 feet. The temperature was 26.1 degrees C and dewpoint 22.5 degrees C, QNH altimeter setting 29.75 in/Hg or 1007.5 mbs, and in remarks temperature 78.9 degrees F and humidity 81 percent.

The significant weather prognosis chart for flight level 240 through flight level 450 from Don Muang Airport weather personnel, valid until 0300 hours on May 27, forecast broken layer tops at flight level 300 and isolated embedded cumulonimbus with tops as high as flight level 400. This forecast covered the general route area between Bangkok and Rangoon.

A depiction of weather radar returns at 1500 hours showed an area of weak precipitation return along the flight's projected path, but still northwest of the accident site. No pilot reports of weather activity in the general vicinity of the accident site were received, and air traffic personnel stated no weather returns were observed on the radar at the time of the accident.

1.8 Aids to Navigation

No discrepancies were noted in any aid to navigation that could be expected to have a bearing on the accident. Radar tracking was not recorded.

1.9 Communications

There were no radiotelephone transmissions received by any ground station indicating any trouble with NG004. No discrepancies were noted on any communications equipment that could be expected to have a bearing on the accident.

1.10 Aerodrome Information

Departure aerodrome status and conditions were not a factor.

1.11 Flight Recorders

The CVR and Digital Flight Data Recorder (DFDR) on the Boeing 767 are located in the airplane fuselage, aft left side, within the pressurized area of the airplane. Both recorders were recovered from the accident site and sent to the United States National Transportation Safety Board (NTSB) laboratories in Washington, DC, where readout was attempted under the direction of the Airplane Accident Investigation Committee.

The DFDR was a Sundstrand model UFDR, part number 980-4100-BXUS, serial number 5632. Its recording medium was damaged by heat, and no useful information could be recovered.

The CVR was a Fairchild model A100A, part number 93-A100-80, serial number 52889. Although damaged, it was successfully read out, and a transcript extract of its contents is included in this report as Appendix A.

1.12 Wreckage and Impact Information

The wreckage site was generally located at 14 degrees 44 minutes North latitude and 99 degrees 26 minutes East longitude. This was in mountainous jungle terrain approximately 3 nautical miles north northeast of Phu Toey village of Tambol Huay Kamin in the Ban Dan Chang district of Suphan Buri Province, Kingdom of Thailand. The average elevation of the wreckage area was estimated to be 600 metres.

Most of the wreckage was found in a one square kilometer area, but some lighter weight components were found up to 2,000 metres from the initial impact point. The horizontal stabilizer was the first major component found in the debris pattern, which was along a generally northwest/southeast track. Thrust reverser actuators from the left engine (both sleeves) were found in the fully deployed position. A diagram of the wreckage spread is included in this report as Appendix B.

1.13 Medical and Pathologica1 Information

Post mortem examination of the victims by the Royal Thai Police Forensic Medicine Institute indicated that all fatalities resulted from severe trauma.

1.14 Fire

Although there was evidence of fire both before and after ground impact, there were no definite indications found of any fire prior to the airplane breaking up in flight.

No fire fighting activities took place due to the remote location and general inaccessibility of the accident site.

1.15 Survival Aspects

The accident was not survivable.

1.16 Tests and Research

Examination of recovered components of the thrust reverser system was conducted at facilities of the Boeing Commercial Airplane Group in Seattle, Washington, USA, and other component manufacturers under the auspices of the Airplane Accident Investigation Committee. The limited number and the degree of damage to the components precluded a determination of functional condition.

Approximately 9 months after the accident, the DCV was returned to Department of Aviation by persons not associated with the accident investigation. The DCV was exchanged for a reward. It was sent to Boeing in Seattle, Washington, under strict control and examined by team members supervised by NTSB and FAA personnel.

DCV examination was conducted on February 18 through 20, 1992. Computer tomography inspection (cat scan/x-ray) of the valve prior to disassembly, indicated that the component responsible for directing hydraulic flow within (second stage spool) the DCV was intact and located in the "reverser stowed" position. This is the normal position for the valve without hydraulic pressure applied. Further examination of the spring that holds the second stage spool in position indicated that it was intact.

The examination of the DCV also revealed that 3 of 4 screws used to secure the solenoid operated pilot valve body to the DCV were loose. Soil was found inside internal passages of the valve.

A metal plug, identified as a case relief valve plug used elsewhere in the engine accessory section, was found installed "finger tight" in the DCV "retract" port. All solenoid operated pilot valve (first stage spool) internal passages were unobstructed. There was no evidence that indicated preimpact failure of the valve, however the condition of the valve indicated that the valve was partially disassembled and reassembled by persons not associated with the accident investigation prior to examination by the investigation team.

Additional system tests were performed using production components in an attempt to simulate potential failure modes.

In one hypothetical condition, the introduction of a damaged piece of O-ring seal into a hydraulic orifice resulted in an uncommanded opening of the directional control valve (DCV). For further information on these tests, see paragraph 2.5.4.

Testing of the electrical function indicated possible areas where an electrical hot short occurring simultaneously with an auto-restow action could result

in uncommanded opening of the DCV for up to one second. For further information on these tests, see paragraph 2.5.3.

A full hydraulic set-up was used to verify normal operation of the thrust reverser system and to determine if uncommanded deployment could occur under various hypothetical failure conditions. Hypothetical failure conditions involved the directional control valve (DCV) seal damage, thrust reverser actuator piston head seal leakage and a return line blockage during hydraulic isolation valve (HIV) cycling. Also, a vibration test simulating the vibration environment of the DCV during it's life was performed.

In another hypothetical failure condition, the effects of piston seal leakage through a thrust reverser actuator was examined with the HIV open. Several test configurations were examined with the piston head O-ring and cap strip missing from the actuator(s). Only one side (one of two sleeves) of the thrust reverser cowl deployed when an actuator was tested with the piston head seal missing and the bronze plating separated from the piston head. Under this condition, with the HIV open, internal leakage across the piston was sufficient to deploy the 3 actuators associated with the deployed sleeve depending on the location of the actuator piston head in the cylinders. If in the stow position and the piston heads were firmly bottomed against the inner cylinder head end prior to commanding thrust reverser stow, the thrust reverser actuators would not deploy. When the head end of the two actuators were slightly unseated, fluid could pass from the rod end to the head end of the locking actuator causing unlock and extension of 3 actuators (one sleeve).

Examination of the thrust reverser actuators from the left engine of the accident airplane was not conclusive, because only one piston head and it's associated seal was recovered from the accident site. The cap strip from this actuator piston head had considerable wear and was extruded.

A DCV was mounted on a vibration table and subjected to resonant searches, resonant dwells, random vibration and sweeps through engine speed

ranges in three axes while under constant and pulsing pressure in the hydraulic lines. Pressure transducers and flow meters on the outflow of the valve indicated that the valve did not open unexpectedly or leak during the test under excessive vibration.

1.17 Additional Information

Each engine installed on the B767 is equipped with a thrust reversing system. The thrust reversers are approved for ground operation only. A general systems description is included in this report as appendix C.

The United States National Transportation Safety Board (NTSB) issued four urgent action safety recommendations regarding the accident to the Federal Aviation Administration (FAA) on July 3, 1991 They are included in this report as appendix D.

The FAA issued information on the accident to appropriate operators and authorities on September 11, 1991 by letter format. It is included in this report as appendix E. Additionally, the following Airworthiness Directives (ADs) affecting the B767 were issued:

AD 91-15-09, July 3, 1991 - Requires tests, inspections and functional checks of the thrust reverser systems on all B767 airplanes powered by Pratt and Whitney PW4000 series engines.

TAD 91-17-51, August 15, 1991 - Requires de-activation of thrust reverser systems on all B767 airplanes powered by Pratt and Whitney PW4000, General Electric CF6-80C2, and Rolls Royce RB211-524 series engines. This superseded AD 91-15-09.

TAD 91-18-51, August 23, 1991 - Allows re-activation of thrust reverser systems on B767 airplanes powered by General Electric CF6-80C2 and Rolls Royce RB211-524 series engines. This superseded TAD 91-17-5 1.

AD 91-22-02, October 7, 1991 - Requires tests, inspections and functional checks of the thrust reverser systems on all B767 airplanes powered by General Electric CF6-80C2 and Rolls Royce RB2l 1-524 series engines.

AD 9 1-22-09, October 11, 1991 - Requires modification and allowed re-activation of thrust reverser systems on all B767 airplanes powered by Pratt and Whitney PW4000 series engines. This superseded TAD 91-18-51.

An international manufacturing industry/government task force formed by the FAA as a result of this accident is continuing to review design philosophy and certification standards of transport airplane thrust reverser systems.

1.18 Useful or Effective Investigation Techniques

Fire damage to the DFDR recording tape eliminated a valuable source of vital flight information. Since this information was critical to the investigation, a search was conducted to identify non-volatile memory in various computerized components as an alternate source of data. Electronic circuit boards and micro-chip components from the EECs were analyzed by the Pratt & Whitney and Hamilton-Standard companies. The data developed proved helpful in validating conditions prior to and during the accident, but did not provide the time correlation normally available with the DFDR. Readouts from such sources are accomplished by manufacturer's personnel in their own laboratories, as these items were not originally designed to support airplane accident investigation activities.

between the respective hydraulic isolation valve (HIV) and the associated thrust reverse lever position or an anomaly in the air/ground system. No corrective actions were necessary and none were identified as taken by the crew.

The crew's discussion of the REV ISLN indication was of an informative nature and continued for about four and one-half minutes. The co-pilot read information from the Airplane Quick Reference Handbook as follows: "Additional systems failures may cause in- flight deployment" and "Expect normal reverser operation after landing." The pilot-in-command remarked "....its not just on, its coming on and off," he said, "...its just an advisory thing...," and shortly thereafter stated, "could be some moisture in there or something." The critical nature of an in-flight thrust reverser deployment in this phase of flight was not known and therefore the flightcrew was not provided with operational guidance. Airplane design changes implemented after this accident eliminated the need for operational guidance for the flightcrew.

Review of the thrust reverser system design indicates that when the auto-restow system function is required, system pressure to close the reversers is applied during restow and for 5 seconds after restow is sensed. The REV ISLN light illuminates for this period except for the first 2 seconds. The associated EICAS message appears 2 seconds after the REV ISLN light illuminates. Interpretation of the crew's comments regarding the reverser ISLN indication, "Coming on and off' indicates that they may have been observing cycling of the auto-restow system (see Appendix C). The specific interval of illumination of the light, and the possibility that the light ceased to be observed, could not be determined from the cockpit voice recorder comments nor from any other evidence. Also it could not be determined if the REV ISLN light was accompanied by an EICAS message; nothing was verbalized by the crew. There was no recoverable data from the nonvolatile memory available in the recovered EICAS components.

At ten minutes twenty seven seconds into the flight, the co-pilot advised the pilot-in-command that there was need for, "a little bit of rudder trim to the left." The crew discussion of trim took place from an elapsed time of 10:27 and lasted nine seconds. About four and one-half minutes separated the REV ISLN

indication event from the trim discussion. It ended with the pilot-in-command saying "O.K., O.K.". It is probable that the trim requirement was a normal event in the flight profile. The trim requirement does not appear to be related to the upcoming reverser event, and there was no apparent reason for the crew to interpret it as such.

Fifteen minutes and one second into the flight the co-pilot's voice was heard to exclaim, "ah reverser's deployed," accompanied by sound similar to airframe shuddering, sounds of metallic snaps and the pilot-in-command stating "here wait a minute." The cockpit voice recording ended twenty nine seconds later with multiple bangs thought to be structural breakup of the airplane.

An assessment of flightcrew attempts to control the airplane's flightpath was not possible due to loss of the FDR data as a result of ground fire damage to the recorder tape.

The physical evidence at the crash site conclusively showed that the left engine thrust reverser was deployed. Nonvolatile computer memory within the electronic engine control (EEC) indicated that an anomaly occurred between channel A and B reverser sleeve position signals. It was concluded that this anomaly was associated with the thrust reverser deployment of one or both sleeves. The EEC data indicated that the thrust reverser deployed in-flight with the engine at climb power; based on EEC design, it was also concluded that the engine thrust was commanded to idle commensurate with the reverser deployment, and that the recorded mach number increased from 0.78 to 0.99 (the actual maximum speed reached is unknown due to pressure measurement and recording uncertainties). The left EEC data indicates that the fuel cutoff switch was probably selected to cutoff within 10 seconds of thrust reverser deployment. Examination of the cutoff switch also indicates that it was in the cutoff position at impact.

2.2 Airplane Wreckage and Structural Failure Analysis

2.2.1 Airplane Wreckage

The relative close proximity of the wreckage scatter (within one square kilometer) indicated that the airplane experienced in-flight breakup at a steep descent angle and low altitude. A breakup altitude estimation was attempted using time-synchronized information from the CVR. Although the airspeed history between reverser deployment and the end of the recording (due to structural breakup) cannot be confirmed, the high speeds likely achieved during the descent indicate that the in-flight breakup most likely occurred at an altitude below 10,000 feet.

Damage to the fan runstrips(sic)on both engines indicates nontypical loads from an unusual flight path. The fan rubstrips are located on the forward case of each engine and form the fan blade tip airseal. Each engine fan runstrip(sic) had a deep rub from the fan blades. The character of the rubs is typical of rubs caused by the interaction with the rotating fan. The depths are substantially deeper than typical rubs experienced during normal operation. These rubs were centered at approximately 66 degrees on the left engine and approximately 0 degrees on the right engine as view from the rear of the engine looking forward.

Flight testing of the B767 with JT9D-7R4 engines showed rubs near the top of the engines to be minor depth and centered at approximately 45 degrees on the left engine and approximately 315 degrees on the right engine. The rub results from aerodynamic load from the engine cowls. These loads were determined to be essentially down from the top when the aircraft nose was lowered during descent.

The PW4000 installation is designed for the maximum cowl aerodynamic loads that occur during takeoff rotation. At that condition a .050 inch deep rub, which is considered a minor depth rub, centered at the bottom of the engine can be expected. This rub would be due to upward aerodynamic force on the cowl at aircraft rotation angles of attack. The depth and location of the rubs in the

Lauda accident indicates; 1) cowl load forces much greater than the forces expected during takeoff rotation and 2) by the location, that the forces were essentially down from the top of the cowl. The center of the rubs shown shifted clockwise from the locations documented by the B767/JT9D-7R4 test flights suggests that the airplane experienced a nose-down pitch accompanied by abnormal roll and yaw.

The CVR transcript indicates that the in-flight breakup did not occur immediately after the deployment of the thrust reverser, but rather during the subsequent high-speed descent.

The EEC can provide general altitude and Mach number data however calibration is not provided outside the normal speed envelope. Information from the engine manufacturer indicates that the EEC data may indicate altitude and Mach numbers which are higher than the true value. Also, EEC calibration of its ambient pressure sensor affects the accuracy of the recorded Mach number and altitude. This calibration is not designed to be accurate above maximum certified airplane speeds. In addition, the EEC ambient pressure calibration does not account for the effect of reverse thrust on fan cowl static pressure ports. However, EEC recorded data does suggest that the airplane was operating beyond the dive velocity of 0.91 Mach.

High structural loading most probably resulted as the crew attempted to arrest the descent. Large control inputs applied during flight at speeds in excess of the airplane's operating envelope appear to have induced structural loads in excess of the ultimate strength of the airplane structure.

2.2.2 In-Flight Breakup Sequence

The analysis of the major structural damage showed that the failures were probably the result of buffeting, maneuvering overload, and excessive speed. Parts of the airplane that separated from buffeting overload appear to be pieces of the rudder and the left elevator. This was followed by the down-and- aft separation

of most of the right horizontal stabilizer from maneuvering overloads, as the crew attempted to control the airplane and arrest the high-speed descent. No evidence of impacts were observed on the leading edges of the horizontal and vertical stabilizers indicating that no airframe structural failure occurred prior to horizontal stabilizer separation. It is thought that the download still present on the left stabilizer and the imbalance in the empennage from the loss of the right stabilizer introduced counterclockwise (aft looking forward orientation) torsional overload into the tail, as evidenced by wrinkles that remained visible in the stabilizer center section rear spar. The separation of the vertical and left horizontal stabilizers then occurred, although the evidence was inconclusive as to whether the vertical stabilizer separated prior to or because of the separation of the left stabilizer and center section. (The damage indicated that the vertical stabilizer and the attached upper portion of four fuselage frames departed to the left and that separation of the vertical fin-tip and the dual-sided stringer buckling in the area of the fin-tip failure occurred from bending in both directions prior to the separation of the vertical stabilizer from the fuselage). The loss of the tail of an airplane results in a sharp nose-over of the airplane which produces excessive negative loading of the wing. Evidence was present of downward wing failure. This sequence was probably followed by the breakup of the fuselage. The complete breakup of the tail, wing, and fuselage occurred in a matter of seconds.

2.2.3 Fire Damage

There was no indication of an in-flight fire prior to the breakup of the airplane. The audible fire warning system in the cockpit was silent. The absence of soot on the cabin outflow valve and in the cargo compartment smoke detectors indicates that no in-flight fire existed during pressurized flight. Evidence indicates that the fire that developed after the breakup resulted from the liberation of the airplane fuel tanks.

>From the available evidence, there was nothing to indicate damage from a hostile act either from within the airplane or on the exterior. No shrapnel or explosive residue was detected in any portion of the wreckage that was located.

Evidence of an explosion or fire in the sky was substantiated by witness reports and analysis of portions of the airplane wreckage. Although it is possible in some cases that some "in-air" fire damage was masked by ground fire damage, only certain portions of the airplane were identified as being damaged by fire in the air. These include the outboard wing sections and an area of right, upper fuselage above the wing. Evidence on the fuselage piece of an "in-air" fire include soot patterns oriented with the airstream and the fact that the piece was found in an area of no post-crash ground fire. Evidence of an "in-air" fire on the separated outboard portions of the right and left wings include that they were found in areas of no ground fire, yet were substantially burned. The separated right wing portion had been damaged by fire sufficiently to burn through several fuel access panels. In addition, one of the sooted fractures on the right wing section was abutted by a "shiny" fracture surface. These fracture characteristics show that the separation of the right wing section had preceded its exposure to fire or soot in the air, followed by the ground impact that produced the final, "shiny" portion of the fracture.

Generally, it appears that fire damage was limited to the wings and portions of the fuselage aft of the wing front spar (except for the left mid-cabin passenger door). Likewise, many areas of the fuselage aft of the wing front spar were devoid of fire damage. This is further indication that the airplane was not on fire while intact, but started burning after the breakup began. The absence of any fire damage on the empennage indicates that it had separated prior to any in-air fire.

The sooting documented on the left mid-cabin passenger door is unique in that the fuselage and frame around the door were undamaged by fire or soot. Even the seal around the door appeared to be only lightly sooted. The door was found in an area of no ground fire, indicating that the door was sooted before ground impact. The sooting on the door, but not on the surrounding structure, may have resulted as the door separated from the fuselage during the breakup and travelled through a "fire ball" of burning debris. It is not known why the door seal did not exhibit the same degree of sooting as the door itself, although it is possible that the soot would not adhere to the seal as well as to the door.

2.3 Engineering Simulation

Immediately after the accident, many airlines attempted to duplicate the events with their flightcrew training simulators. These efforts yielded erroneous results because the simulators were never intended for such use and did not contain the necessary performance parameters to duplicate the conditions of the accident flight.

On behalf of the Accident Investigation Commission of Thailand, the U.S. NTSB requested the Boeing Commercial Airplane Group to develop an engineering simulation of in-flight reverse thrust for the conditions thought to have existed when the left engine thrust reverser deployed in the accident flight.

As previously stated, the flight data recorder (FDR) tape in the accident airplane was heat damaged, melted, and unreadable due to post-crash fire. Flight conditions were therefore derived from the best available source, post-accident readout of the left engine EEC non-volatile memory parameters. Test conditions were proposed by Boeing and accepted by the participants as follows:

Configuration:


Model 767-300ER with PW4060 engines

Flaps and gear: up

Weight: 390,000 pounds

Center of Gravity: 25% MAC


Flight Condition Based on Electronic Engine Control Data

Altitude: Approximately 24,700 ft.

Airspeed: Mach 0.78

Both engines at maximum climb power


Left engine Simulation:


The left engine thrust reverser was configured to provide reverse thrust effect at the start of reverse cowl movement rather than phased to cowl position. The EEC was configured to automatically initiate thrust cutback on the left engine to idle after 10% reverser cowl motion (about 2 inches) and command idle power at 15% of thrust reverser travel.


Right engine simulation:


The right engine was set up to be controlled by the pilot through the throttle handle. Tests were run with pilot commanded right engine throttle cutback to idle following the reverser deployment on the left engine. Tests were repeated with no throttle cutback on the right engine.


Autopilot:


The autopilot was engaged in single channel mode for all conditions. This provided the autopilot with 17 degrees (+/-) of wheel authority. (65 degrees (+/-) is the maximum wheel deflection). Upon initiation of pilot recovery action, the autopilot

was disengaged by the pilot. The autopilot does not operate the rudder under the conditions experienced by the accident airplane. The autopilot operates the rudder only while in the "autoland" mode of flight. The simulation model included the B767's yaw damper (2 degrees (+/-)) effect on the maneuver. However, it was not considered to be significant.

the total thrust required for flight. This results in less thrust/drag asymmetry. Based on engineering judgement the lower proportion of thrust and resultant airflow affects a smaller percentage of the wing, and therefore the effect of reverse thrust is less significant on a three or four engine airplane than on a two engine airplane.

The mechanical design and type of engine is also important in the event of in-flight reverse thrust. The B767's engines are high-bypass ratio turbofans, with reverser systems which employ blocker doors and cascades to redirect airflow from the N1 compressor fan blades. On large twin-engine transport airplane, the thrust reverser cascades are slightly below and in front of the wing. At high thrust levels, the plume of thrust from the reverser produces a yawing moment and significantly disrupts airflow over the wing resulting in a loss of lift over the affected wing. The loss of lift produces a rolling moment which must be promptly offset by coordinated flight control inputs to maintain level flight. The yaw is corrected by rudder inputs. If corrective action is delayed, the roll rate and bank angle increase, making recovery more difficult.

Low-speed B767 wind tunnel data from 1979 was available up to airspeeds of about 200 knots at low Mach numbers. From these wind tunnel data, an in-flight reverse thrust model was developed by Boeing. The model was consistent with wing angle-of-attack, although it did approximate the wheel deflection, rudder deflection, and sideslip experienced in a 1982 idle-reverse flight test. Since no higher speed test data existed, the Boeing propulsion group predicted theoretically the reverse thrust values used in the model to simulate high engine speed and high airspeed conditions. This preliminary simulation model employed a 10% lift loss factor. It was evaluated by investigators in Boeing's B767 engineering simulator in June 1991.

The simulator tests at 10% lift loss indicated that sufficient time existed for the flightcrew to react and sufficient control authority to return the airplane to a normal flight path. These findings were inconsistent with CVR data and that it appeared fact that control was lost by a trained flightcrew in the accident flight.

Another simulation model was developed using low-speed test data collected from a model geometrically similar to the B767 at the Boeing Vertol wind tunnel. Scale model high-speed testing would have required considerably more time for model development. Therefore low-speed data were used and extrapolated. The wing/pylon model used at Boeing Vertol was similar in configuration to the B767 so that these tests results are believed to be applicable for this case. These tests included inboard aileron effectiveness, rudder effectiveness, and lift loss for the flaps up configuration at different angles-of- attack and reverse thrust levels, data not previously available.

Investigators from the Accident Investigation Commission of the Government of Thailand, the Austrian Accredited Representative and his advisers, the NTSB, FAA, and Boeing met in Seattle, Washington, in September 1991 to analyze the updated Boeing-developed simulation of airplane controllability for the conditions that existed when the thrust reverser deployed on the accident flight. The results of the Boeing Vertol wind tunnel tests showed approximately 25% lift loss for an engine at maximum climb power, reducing to approximately 13% as the engine spooled down to idle thrust. It takes about 6 to 8 seconds for the engine to spool down from maximum climb to idle thrust levels. Boeing re-programmed the B767 simulator model based on these new tests.

The Chief B767 Test Pilot of the Boeing Company was unable to successfully recover the simulator if corrective action was delayed more than 4 to 6 seconds. The range in delay times was related to engine throttle movement. Recovery was accomplished by the test pilot when corrective action of full opposite control wheel and rudder deflection was taken in less than 4 seconds. The EEC automatically reduced the power to idle on the left engine upon movement of the translating cowl. If the right engine throttle was not reduced to idle during recovery, the available response time was about 4 seconds. If the right engine throttle was reduced to idle at the start of recovery, the available response time increased to approximately 6 seconds. Recovery was not possible if corrective action was delayed beyond 6 seconds after reverser deployment. Immediate, full opposite deflection of control wheel and rudder pedals was necessary to compensate for the rolling moment. Otherwise, following reverser deployment, the aerodynamic lift loss from the left wing produced a peak left roll rate of about 28 degrees per second within 4 seconds. This roll rate resulted in a left bank in excess of 90 degrees

within 5 seconds. The normal 'g' level reduced briefly between 0 and .5 'g' for about 2 seconds, then returned to about 1 'g' and stayed relatively constant throughout the roll maneuver.

Assuming that the simulator tests with the 25% lift loss are a valid model of the accident conditions, simulated flights piloted by Boeing's Chief B767 Test Pilot indicated that a recovery could not be accomplished unless the flight crew of the Lauda B767 took full corrective action within 4 to 6 seconds of reverser deployment. The use of full authority of the flight controls in this phase of flight is not part of a normal training programme. Further, correcting the bank attitude is not the only obstacle to recovery in this case, as the simulator rapidly accelerates in a steep dive. Investigators examined possible pilot reactions after entering the steep dive. It was found that the load factor reached during dive recovery is critical, as lateral control with the reverser on one engine deployed cannot be maintained at Mach numbers above approximately 0.83 when combined with load factors above 2.5 "g." This is because the effectiveness of the flight controls is reduced at high Mach numbers, and the airplane configuration remains asymmetrical due to the deployed thrust reverser. According to Boeing, the reduction in flight control effectiveness in the simulation is because of aeroelastic and high Mach effects. These phenomena are common to all jet transport airplanes, not just to the B767.

The flight performance simulation developed by Boeing is based upon low-speed (Mach 0.3) Vertol wind tunnel testing, unlike the high airspeed (Mach 0.78) in the Lauda B767 case. The current simulation is the best available based on the knowledge gained through wind tunnel and flight testing.

>From a flight performance standpoint related to the accident, there are three questions which still remain unanswered:

1. Does the engine thrust reverser plume shrink or grow at higher Mach numbers?

   ---

   27
   (The size of the plume greatly affects the magnitude of the aerodynamic lift loss on the wing and the effectiveness of the horizontal and vertical tail).
   
   
2. During an in-flight engine thrust reverse event, does airframe buffeting become more severe at higher Mach numbers (such as in cruise flight), and if so, to what extent can it damage the airframe?
   
   
3. What is the effect from inlet spillage caused by a reversed engine at idle-thrust during flight at a high Mach number?
   

It is Boeing's belief that the lift loss on the accident flight would be less than 25% of total airplane lift because of the high Mach number and the conservative method used to develop the engineering simulation model. When Boeing personnel were asked why the aerodynamic increments used in the simulation could be smaller at higher Mach numbers; they stated that this belief is based on "engineering judgment" that the reverser plume would be smaller at higher Mach number, hence producing less lift loss. No high speed wind tunnel tests are currently planned by the manufacturer. Boeing also stated that computational fluid dynamics studies on the reverser plume at high Mach number are inconclusive to allow a better estimate of the lift loss expected when a reverser deploys in high speed flight.

2.4 Thrust Reverser Certification

Boeing received certification for the B767 propulsion systems on the basis of Federal Aviation regulations (FAR) Part 25, 36, and special regulation 27. Amendments 25-38 through 25-45 were complied with.

FAR 25.933 states;

Reversing systems

(a) Each engine reversing system intended for ground operation only must be designed so that during any reversal in flight the engine will produce no more than flight idle thrust. In addition, it must be shown by analysis or test, or both, that


1. The reverser can be restored to the forward thrust position; or
   
   
2. The airplane is capable of continued safe flight and landing under any possible position of the thrust reverser.
   
   
(b) and (c) omitted

(d) Each turbojet reversing system must have means to prevent the engine from producing more than idle forward thrust when the reversing system malfunctions, except that it may produce any greater forward thrust that is shown to allow directional control to be maintained, with aerodynamic means alone, under the most critical reversing condition expected in operation.

10 and L-1011 in the early 1970's. The FAA states it was their policy to require continued safe flight and landing through a flight demonstration of an in-flight reversal. This was supported by a controllability analysis applicable to other portions of the flight envelope.

Flight demonstrations were usually conducted at relatively low airspeeds, with the engine at idle when the reverser was deployed. It was generally believed that slowing the airplane during approach and landing would reduce airplane control surface authority thereby constituting a critical condition from a controllability standpoint. Therefore, approach and landing were required to be demonstrated, and procedures were developed and, if determined to be necessary, described in the Airplane Eight Manual (AFM). It was also generally believed that the higher speed conditions would involve higher control surface authority, since the engine thrust was reduced to idle, and airplane controllability could be appropriately analyzed. This belief was validated, in part, during this time period by several in-service un-wanted thrust reverser deployments on B747 and other airplanes at moderate and high speed conditions with no reported controllability problems.

The original engine installed on the B767 was the Pratt and Whitney JT9D-7R4. In-flight thrust reverser controllability tests and analysis performed on this airplane were applied to later B767 engine installations such as the PW4000, based upon similarities in thrust reverser, and engine characteristics. The original flight test on the B767 with the JT9D-7R4 involved a deployment with the engine at idle power, and at an airspeed of approximately 200 KIAS, followed by a general assessment of overall airplane controllability during a cruise approach and full stop landing. In compliance with FAR 25.933(a)(2), Boeing demonstrated, at 10,000 feet and 220 KIAS, control of the airplane in cruise flight. The engine remained in idle reverse thrust for the approach and landing as agreed to by the FAA. Controllability at other portions of the flight envelope was substantiated by an analysis prepared by the manufacturer and accepted by the FAA.

In compliance with FAR 25.933(a)(1), the engine fuel control contains a design feature to retard the engine to idle thrust when uncommanded thrust reverser deployment occurs. The B767 was certified to meet all applicable rules

and interpretation of those rules as defined by the FAA for certification of the airplane in 1981.

The circumstance of this accident, however, bring into question the adequacy or interpretation of the FAA requirements and the demonstration/analyses that were required. This accident indicates that changes in certification philosophy are necessary. The left engine thrust reverser was not restored to the forward thrust position prior to impact and accident scene evidence is inconclusive that it could have been restowed. Based on the simulation of this event, the airplane was not capable of controlled flight if full wheel and full rudder were not applied within 4 to 6 seconds after the thrust reverser deployed. The consideration given to high-speed in-flight thrust reverser deployment during design and certification was not verified by flight or wind tunnel testing and appears to be inadequate.

Regarding B767 certification, results of this investigation indicate that the assumptions made regarding high speed flight and its beneficial effect on control effectiveness did not take into account the effects of reduced lift caused by a combination of the reverser plume and/or engine inlet spillage. Although much information has yet to be gathered on the reverser/wing relationship at high speed conditions, experience on other large transport airplanes suggest that not all airplane are affected to the same degree as the B767. Future controllability assessments should include comprehensive validation of all relevant assumptions made in the area of controllability. This is particularly important for the generation of twin-engine airplane with wing-mounted high-bypass engines.

2.5 Possible Thrust Reverser Failure Modes

2.5.1 General

The Boeing B767 thrust reverser system is designed for ground operation only. Actuation of the PW 4000 thrust reverser requires movement of two

hydraulic valves that are installed in series. The system has several levels of protection designed to prevent uncommanded in-flight deployment. Electrical mechanical systems design considerations prevent the powering of the Hydraulic Isolation Valve (HIV) or the movement to the thrust reverse levers into reverse. The investigation of this accident disclosed that if certain anomalies exist with the actuation of the auto-restow circuitry in flight these anomalies could have circumvented the protection afforded by these designs.

The Directional Control Valve (DCV) for the left engine, a key component in the thrust reverser system, was not recovered until 9 months after the accident. The examination of all other thrust reverser system components recovered indicated that all systems were functional at the time of the accident. Lauda Airlines had performed maintenance on the thrust reverser system in an effort to clear maintenance messages. However, these discrepancies did not preclude further use of the airplane.

2.5.2 Crew Commanded Deployment

The possibility of crew commanded thrust reverser deployment was considered. The probability of an experienced crew intentionally selecting reverse thrust during a high-power climb phase of flight is extremely remote. There is no indication on the CVR that the crew initiated reverse thrust. Had the crew intentionally or unintentionally attempted to select reverse thrust, the forward thrust levers would have had to be moved to the idle position in order to raise the thrust reverser lever(s). In addition, the air/ground system would have prevented hydraulic power from being applied to deploy the thrust reversers. Examination of the available airplane's center control stand components indicated that the mechanical interlock system should have been capable of functioning as designed.

2.5.3 Electrical System Failures Resulting in Deployment

The possibility of electrical system failures resulting in an uncommanded thrust reverser deployment was considered. Testing and detailed analysis of the thrust reverser system design were conducted at Boeing with participation of the FAA and the NTSB. The investigation of the accident disclosed that certain hot short conditions involving the electrical system could potentially command the DCV to move to the deploy position in conjunction with an auto restow command, for a maximum of one second which would cause the thrust reversers to move.

To enable the thrust reverser system for deployment, the Hydraulic Isolation Valve (HIV) must be opened to provide hydraulic pressure for the system. The HIV is opened either by a circuit that includes the air/ground electrical sensing system or through the auto-restow circuit.

That an electrical wiring anomaly could explain the illumination of the "REV ISLN" indication is supported by the known occurrence of wiring anomalies on other B 767 airplanes.

The auto-restow circuit design was intended to provide for restowing the thrust reversers after sensing the thrust reverser cowls out of agreement with the commanded position. The auto-restow circuit powers the HIV to open regardless of indications from the air/ground circuit. If another electrical failure such as a short circuit to the DCV solenoid circuit occurred, then with hydraulic pressure available, the DCV may cause the thrust reverser cowls to deploy. The electrical circuits involved are protected against short circuits to ground by installing current limiting circuit breakers into the system. These circuit breakers should open if their rated capacity is exceeded for a given time. The DCV electrical circuit also has a grounding provision for hot-short protection.

Testing and analysis conducted by Boeing and the DCV manufacturer indicated that a minimum voltage of 8.2 Vdc was required to actuate one of 599 DCV solenoids tested. The worst case hot-short threat identified within the thrust reverser wire bundle would provide 22.6 Vdc to the DCV solenoid for 1.0 seconds. Boeing could not provide test data or analysis to determine the extent of thrust reverser movement in response to a momentary hot-short with a voltage greater than 8.2 Vdc or the ability of the thrust reverser to return to the stowed position after tripping of the circuit breaker associated with the source of the hot-short.

Additional analysis and testing indicated that shorting of the DCV wiring with wires carrying AC voltage could not cause the DCV solenoid to operate under any known condition.

The degree of destruction of the Lauda airplane negated efforts to identify an electrical system malfunction. No wiring or electrical system component malfunction was positively observed or identified as the cause of uncommanded thrust reverser deployment on the accident airplane.

2.5.4 Hydraulic System Failures Resulting in Deployment

Testing at Boeing on the B767 hydraulic test fixture, in conditions with the HIV open, disclosed that contamination of the solenoid operated DCV pilot valve could result in an increase in pressure on the deploy side of the valve. This could result in uncommanded deployment of the thrust reverser if the HIV was open to supply hydraulic pressure to the valve. Immediately following this discovery, Boeing notified the FAA and a telegraphic airworthiness directive (AD) T91-17-51 was issued on August 15, 1991 to deactivate the thrust reversers on the B767 fleet.

Testing of a DCV showed that contamination in the DCV solenoid valve can produce internal blockage, which, in combination with hydraulic pressure available to the DCV (HIV open), can result in the uncommanded movement of the

DCV to the deploy position. Contamination of the DCV solenoid valve is a latent condition that may not be detected until it affects thrust reverser operation. Hydraulic pressure at the DCV can result from an auto-restow signal which opens the thrust reverser system hydraulic isolation valve located in the engine pylon. Results of the inspections and checks required by AD 91-15-09 indicated that approximately 40 percent of airplane reversers checked had auto-restow position sensors out of adjustment. Improper auto-restow sensor adjustment can result in an auto-restow signal.

Other potential hydraulic system failures including blockage of return system flow, vibration, and intermittent cycling of the DCV, HIV, and the effects of internal leakage in the actuators were tested by Boeing. The tests disclosed that uncommanded deployment of the thrust reverser was possible with blockage of the solenoid valve return passage internal to the DCV or total return blockage in the return line common to the reverser cowls. Uncommanded deployment of one thrust reverser cowl was shown to be possible in these tests when the HIV was energized porting fluid to the rod end of the actuator (stow commanded) with the piston seal and bronze cap missing from the actuator piston head. The results of this testing indicates that this detail may have been overlooked in the original failure mode and effects analysis.

The aerodynamic effects of the thrust reverser plume on the wing, as demonstrated by simulation, has called basic certification assumptions in question. Although no specific component malfunction was identified that caused uncommanded thrust reverse actuation on the accident airplane, the investigation resulted in an FAA determination that electrical and hydraulic systems may be affected. As previously stated, the AD of August 15, 1991 required the deactivation of all electrically controlled B767 (PW4000 series powered) thrust reversers until corrective actions were identified to prevent uncommanded in-flight thrust reverser deployment.

The condition of the left engine DCV which was recovered approximately 9 months after the accident, indicated that it was partially disassembled and reassembled by persons not associated with the accident

investigation. Examination of the DCV indicated no anomalies that would have adversely affected the operation of the thrust reverser system. The plug the investigation team found in the retract port of the DCV (reference paragraph 1.16) would have prevented retraction of the thrust reverser cowls on the left hand engine. However, the accident investigation team concluded that the plug (a part used in the hydraulic pump installation on the engine) was placed into the port after the accident by persons not associated with the investigation. This determination was based on the fact that the plug was found finger tight which would indicate the potential for hydraulic fluid leakage with the hydraulic system operating pressure of 3000 psi applied. Also, soil particles were found inside the valve body.

2.6 Maintenance Activity

It was apparent, from examination of the "Trouble Shooting" documents and interviews with Lauda maintenance personnel, that they were following the procedures in the Boeing Fault Isolation Manual (FIM) to resolve recurring REV RNG FAIL and REV CR-CHK fault messages in the left engine PIMU. However, their efforts were unsuccessful in that the procedure never led to identifying an anomaly. When several attempts at the entire procedure were unsuccessful, Lauda personnel felt the need to continue troubleshooting efforts. They removed/interchanged DCVs, HIVs, and PIMUs however they did not seek assistance from Boeing or Boeing's Vienna based field service representative. Boeing considers these removals and interchanges as not related to PIMU fault messages, ineffective in resolving the cause of the messages, and not per FIM direction.

Lauda maintenance records also indicate replacement and re-rigging of thrust reverser actuators. There was no further procedure or other guidance available in the Boeing FIM, and Lauda maintenance personnel made the decision to physically inspect the entire thrust reverser wiring harness on the engine and in the pylon. Wire continuity checks between the EEC and the Linear Variable Differential Transducers (LVDTs) for troubleshooting "RNG FAIL" messages are part of the FIM procedure if resistance values of the LVDTs are within limits. However, checking other thrust reverser wiring because of "RNG FAIL" messages

is, according to Boeing, "inappropriate" since "RNG FAIL" PIMU messages are independent of the operation and indication circuits of the thrust reverser.

The Boeing Dispatch Deviation Guide allows dispatch for up to 500 hours with an EEC maintenance message annunicated. If the message is cleared following a corrective action and does not reoccur on the next flight, when if it does reoccur, a new 500 hour interval begins. Therefore, Lauda was not remiss in continuing to dispatch the airplane and trouble shoot the problem between flights. No specific Lauda maintenance action was identified that caused uncommanded thrust reverser actuation on the accident airplane.

2.7 System Design Changes as a Result of the Accident

The NTSB issued four urgent action safety recommendations to the FAA on July 3, 1991 regarding this accident (see appendix D). The FAA issued a letter dated September 11, 1991 describing FAA actions in response to the accident. An international industry/government task force is reviewing design philosophy and certification.

As a direct result of testing and engineering re-evaluation accomplished after this accident, Boeing proposed thrust reverser system design changes intended to preclude the reoccurrence of this accident. The changes are mandated by FAA airworthiness directive for all PW4000 series powered airplane. In service B767's were modified by incorporation of a Boeing service bulletin by teams of Boeing mechanics. The fleet modification was completed in February 1992. Design reviews and appropriate changes are in progress for other transport airplane.

The B767 design changes are based on the separation of the reverser deploy and stow functions by:

1. Replacing the solenoid operated Hydraulic Isolation Valve (HIV) with a motor-operated Hydraulic Isolation Valve.
   
   
2. Adding a dedicated stow valve.
   
   
3. Adding new electric wiring from the electronics bay and flight deck to the engine strut. Critical wire isolation and protective shielding is now required.
   
   
4. Adding a new reverser test/reverser system maintenance indication panel in the cockpit.
   
   
5. Replacing existing reverser stow proximity targets with improved permeability material to reduce nuisance indications.
   
   
6. Adding a thrust reverser deploy pressure switch.
   
   

2.8 Flight Data Recorder Damage

The recording tape media within the FDR installed on the accident airplane was melted due to thermal exposure related to the post crash fire. It was impossible to extract any information from the recorder. Industry records indicate that investigative authorities have reported a similar loss of recorded data in several accidents that occurred both prior to and subsequent to the subject accident. These events are:

It is recommended that the airplane certification authorities and equipment manufacturers conduct research with the most modern materials and heat transfer protection methods to develop improved heat protection standards for flight data recorders. Standards revisions should include realistic prolonged exposure time and temperature levels. The revised standards should apply to newly certificated FDR equipment and where practical through Airworthiness Directive action, to FDRs that are now in service.

1. The crew members were trained, qualified, and certificated for their respective duties according to the laws and regulations of the Republic of Austria.
   
   
2. The airplane was certificated, equipped and maintained, and operated according to regulations and approved procedures of the Republic of Austria.
   
   
3. The weather in the area was fair. There were no reported hazardous weather phenomena although lightning may have been present. It is possible that the horizon was not distinguishable.
   
   
4. The physical evidence at the crash site showed that the left engine thrust reverser was m the deployed position.
   
   
5. Examination of nonvolatile computer memory within the left EEC indicated that the engine was at climb power when the reverser deployed, engine thrust was reduced to idle with the reverser deployment, and the recorded Mach number increased from 0.78 to 0.99 after the deployment. The actual maximum speed reached is unknown due to pressure measurement and recording uncertainties.
   
   
6. The scatter of wreckage indicated that the airplane experienced in-flight breakup at a steep descent angle and low altitude.

   ---

   41
7. There was no indication on the available wreckage of an in-flight fire prior to the breakup of the airplane.
   
   
8. Examination of the available wreckage revealed no evidence of damage from a hostile act, either from within the airplane or from the exterior.
   
   
9. Simulations of a 25 percent lift loss resulting from an in-flight deployment of the left engine thrust reverser indicated that recovery from the event was uncontrollable for an unexpecting flight crew.
   
   
10. From an airplane flight performance standpoint, questions remain unanswered regarding thrust reverser plume behavior at high Mach numbers and in-flight reverse induced airframe buffeting at high Mach numbers, and effects of inlet spillage caused by a reversed engine at high Mach numbers.
    
    
11. Thrust reverser system certification by the FAA required that the airplane be capable of continued safe flight and landing under any possible position of the thrust reverser (FAR 25.933(a)(2)). However, wind tunnel tests and data used in the simulation of this accident demonstrated that aerodynamic effects of the reverser plume in-flight during engine run down to idle resulted in a 25 percent lift loss across the wing. Simulation of the event disclosed that the airplane was not capable of controlled flight unless full wheel and full rudder were applied within 4 to 6 seconds after the thrust reverser deployed.

    ---

    42
12. Investigation of the accident disclosed that certain "hot-short" conditions involving the electrical system occurring during an auto-restow command, could potentially cause the DCV to momentarily move to the deploy position. However, no specific wire or component malfunction was physically identified that caused an uncommanded thrust reverser deployment on the accident airplane.
    
    
13. Testing identified hypothetical hydraulic system failures that could cause the thrust reverser to deploy. However, no specific component malfunction was identified that caused an uncommanded thrust reverser deployment on the accident airplane.
    
    
14. No specific Lauda Air maintenance action was identified that caused uncommanded thrust reverser deployment on the accident airplane.
    
    
15. The design changes recommended by Boeing and thereafter mandated by U.S. Federal Aviation Administration Airworthiness Directive 91-22-09 for the B767/PW4000 thrust reverser system should effectively prevent in-flight deployment even after multiple failures.
    
    

In addition to the transcript which follows, the recorder tape was also examined in an attempt to document any engine or other background sounds. Sound signatures identified as being produced by the engines were only visible when the power was advanced during the start of the takeoff roll. No other definite engine signatures could be identified during any other portion of the recording.

Background "wind" noise in the cockpit can be heard to increase in intensity from thrust reverser deployment until the end of the recording. This increase in background noise intensity is attributed to the aircraft's increasing airspeed during this span of time. The percentage of increase in the airspeed that the aircraft experienced during those final seconds of the recording could not be determined from the audio recording. Also, during this time a noticeable modulation or vibration in the recorded sounds can be heard on the CVR recording. This anomaly in the recording was probably caused by the physical shaking of the recorder from airframe buffet. Neither the United States National Transportation Safety Board nor the Boeing Company could demodulate this recorded vibration to obtain any meaningful data.

During the final seconds of the recording, several alarm or alert tones were heard on the CVR recording. The U.S. National Transportation Safety Board along with the Boeing Company conducted a detailed investigation to document these tones. There was insufficient information to form a definite conclusion as to the cause of these aural alerts. (see chart at end of CVR transcript.)

TRANSCRIPT OF A FAIRCHILD MODEL A-100A COCKPIT VOICE RECORDER S/N 52889 REMOVED FROM A LAUDA AIRLINES, BOEING 767-300ER, OE-LAV WHICH WAS INVOLVED IN A ACCIDENT ON MAY 26, 1991 OVER SUPHAN BURI PROVINCE, THAILAND.

Notes: All times are expressed in elapsed time only. Only radio transmissions to and from the accident aircraft were transcribed.

LAUDA AIR (VN241) ACCIDENT COCKPIT VOICE RECORDER
CAUTION AND WARNING ALERTS STUDY

CAUTION	POSSIBLE ALERTS		POSSIBLE CAUSE
(30:44)
		AUTOPILOT (manual activation)	Control wheel inputs by pilot. Pilot response to an upset condition.
		AUTOTHROTTLE DISCONNECT (manual activation)	Pilot actuation of the A/T Disengage Switch on the throttle levers. Pilot response to an abnormal engine condition.
		LEFT ENGINE SHUTDOWN (manual activation)	Pilot action as specified in QRH procedure for "REVERSER UNLOCKED" condition
	UNLIKELY ALERTS
		AUTOPILOT (automatic activation)	Automatic response to system degradation.
		AUTOTHROTTlLE DISCONNECT (automatic activation)	Automatic response to system degradation.
WARNING (30:47)	POSSIBLE ALERTS
		AUTOPILOT DISCONNECT (manual activation)	Pilot actuation of the A/P Disengage Switch on the control column. Second actuation of the switch more than 700 msec after first actuation.
WARNING (30:52)	POSSIBLE ALERTS
		OVERSPEED (automatic activation)	Automatic response to overspeed condition.

Date: July 3, 1991
In reply refer to: A-91-45 through -48

Honorable James B. Busey
Administrator
Federal Aviation Administration
Washington, D.C. 20591

September 11, 1991


To FAA Principal Inspectors for U.S. operators of Boeing Model 737, 747, 757, and 767 airplanes.

To airworthiness authorities of countries having operators of Boeing Model 737, 747, 757, and 767 airplanes.

This letter represents a continuation of the series of letters describing the FAA's actions in response to a recent accident which apparently resulted from an uncommanded Inflight thrust reverser deployment on a Boeing Model 767-300ER airplane.

The National Transportation Safety Board (NTSB) is investigating this accident, but has not yet identified a probable cause. The FAA is cooperating in this investigation and, in addition, is reviewing thrust reverser certification philosophy and the design of current thrust reversers. There will be future actions taken by the FAA to assure the safety of thrust reverser systems.

The rules for thrust reverser certification assume that inflight reverser deployments will occur and they require that such deployments not result in an unsafe condition. Traditionally, this has been demonstrated by tests conducted at relatively low speed and thrust conditions supported by analytical extrapolations to all flight conditions. Service experience on many airplane models has included inflight deployments which were controllable and appeared to validate these certification procedures. These procedures were applied to the 767 certification effort, and indicated that an inflight reversal was a controllable event. The recent accident calls these certification assumptions into question. It is possible that modern high bypass engines combined with more efficient thrust reversers have resulted in aircraft which require a new thrust reverser certification philosophy. Inflight reversal, under certain flight conditions, may now be an event similar in magnitude to certain primary flight control failures which must be prevented to avoid loss of the aircraft.

The Boeing Company is in agreement with the need to upgrade the level of safety of thrust reverser systems, and has been cooperating with the FAA in a review of all of their thrust reverser installations. This includes system design philosophy and system design details. This review, of course, began with the 767 due to the recent accident.

Boeing Model 747-400 engine thrust reverser systems:

The PW4000 CF6-80C2F, and RB211-524G/H engine thrust reverser systems on the 747-400 are essentially the same as the respective systems on the 767. Any applicable system improvements identified for the 767 systems will be required on the 747-400 in the long term. No immediate actions are being taken on the 747-400 because aerodynamic differences between the 747 and the twin-engine airplanes result in adequate controllability with a reverser deployed.

Nevertheless, the FAA believes and Boeing agrees that inflight thrust reversals are undesirable, and all design improvements identified for the 767 thrust reverser system will also be incorporated on 747 airplanes.

Boeing has indicated that it plans to release system check service bulletins for the 747 thrust reverser systems in the near future. The FAA recommends that any Boeing-provided system cheeks be performed, but there are no current plans to release airworthiness directives requiring the performance of the system checks contained in these service bulletins.


Boeing Model 737 airplanes powered by CFM International CFM56-3 series engines:

Interim results of the 737/CFM56-3 design review indicate that this system is not subject to the latent failure modes induced by hydraulic system contamination that were present on the 767/PW4000 airplane. There is, however, an on-going effort to review the 737/CFM56-3 system to the same criteria noted above. While there are no plans for FAA action as of this date, results of these investigations may require that steps be taken to incorporate features or activities consistent with actions taken on other models.


In closing, we would like to point out that, in addition to the above, you should be aware that the Transport Airplane Directorate is conducting a Design review of the thrust reverser installations on other large jet transports manufactured by McDonnell-Douglas, Airbus Industries, Lockheed, etc. As a result of that review, design changes may be required in the future.

We request that you ensure that this letter is made available to airline flight departments and to all pilots of the above Boeing airplanes, to keep them fully apprised of the progress of this investigation.

Sincerely,


(original signed by)
Leroy A. Keith
Manager, Transport Airplane Directorate
Aircraft Certification Service, ANM-100
Federal Aviation Administration


END OF APPENDIX E

The Accredited Representative of the Republic of Austria, whilst agreeing that this report is a fair record of the investigation, regrets that the report was unable to form any conclusion as to the reason for the uncommanded thrust reverser deployment which was the fundamental cause of the accident. Whilst acknowledging the modifications package developed for aircraft similar to the Lauda machine and the recommendation for design reviews of all other aircraft certificated for ground-use only reverser systems, the lack of knowledge about the aerodynamic effects of deployment at high Mach numbers and Indicated Air Speeds should not be allowed to persist. Accordingly it is felt that the report should call for further analysis and testing to be accomplished on the effects of reverser deployment throughout the flight envelope on aircraft of similar configuration to the Boeing 767. In addition, it is noted that the requirements of FAR 25.933(a) (2) are probably not met by any aircraft unless it has demonstrated by flight test that it remains controllable throughout all phases of flight with a reverser deployed.

I am concerned by the apparent lack of analysis of the Cockpit Voice Recorder, being the only continuous record of the accident event in the

---

82

Page 2 of 06 Pages
Comments to Lauda Air Accident

absence of the Digital Flight Data Recorder. There appears to be no attempt to interpret anything other than the cockpit speech although the recording contained considerably more recorded intelligence which, if anlalysed in-depth, may have yielded information about the crew's and the aircraft's behaviour following the inadvertent deployment.

I am also of the opinion that the Boeing Company's interpretation of their own Dispatch Deviation Guide requirements should be reexamined. A repetitive EEC fault message that continues for some 1800 hours despite rectification actions is clearly not responding to these actions and yet could theoretically continue indefinitely as long as it does not manifest itself during the 500 hour period allowed by the Dispatch Deviation Guide.

The following changes are proposed to be incorporated in the Final Report as they are written bold Italic, other comments should cause a more detailed explanation in the report:

Page 2
Line 20:
.... by in-flight breakup, ground impact and fire.

Page 3
Line 7:
The pilot-in-command, male, age 48, ...

---

83

Page 3 of 06 Pages
Comments to Lauda Air Accident

Line 14:
.... December 19, 1990, valid until December 31, 1991. Additionally, ...

Line 18:
The co-pilot, First officer, male, 41 years of age, ...

Line 19:
.... Civil Aviation of Austria issued April 24, 1985. Valid until October 24, 1992. His ...

Line 24:
... Boeing 767-3Z9ER, ...

Page 4
Line 13:
.... FAIL". 24 of these entries occurred since December 28, 1990. Post accident interrogation of the EEC non volatile memory, which dated to April 27 indicated a significantly higher number of similar messages occurred than were recorded in the documentations. In addition the Tech Log of May 4, 1991 indicated that a L/H engine outboard Rev. lock sensor had been found out of to tolerance and was adjusted as a result of a crew report of an amber "REV" light remaining on after landing. The majority ...

Line 18:
accomplished most of the troubleshooting ...

---

84

Page 4 of 06 Pages
Comments to Lauda Air Accident

Line 25:
.... dispatch condition of 500 h as outlined ...

Line 19:
.... on the accident. There was no radar recording of the accident flight available.

Page 7
Line 15:
The DFDR was a Sundstrand model ...

Page 8
Line 11:
.... Appendix B.

We feel the need to notify wind in velocity and direction in 1000 ft altitude steps under this headline or in the wreckage diagramme.

Line 25:
.... accident site.

We feel the need to provide more evidence on the nature and the extent of the inflight fire or how the conclusion came up, that it occurred after the inflight break up.

Page 14
Line 14:
.... event in the cockpit that appears to be associated with the intermittent illumination of a light. The pilot-in-command ...

---

85

Page 5 of 06 Pages
Comments to Lauda Air Accident

Page 15
Line 1:
coming on". Since the crew then consulted the A/C Quick Reference Handbook (QRH) dealing with REV ISOLATION VALVES it appears that either the "REV ISLN" advisory light on the center pedestal or its associated "L or R REV ISLN VAL" EICAS advisory messages was the object of the discussion. The REV ISLN light can illuminate in flight when a pressure is sensed downstream of the hydraulic isolation valve (HIV). No corrective ...

Line 13:
.... was not provided with adequate operational ...

Line 24:
.... auto-restow system (see Appendix C). The specific ...

Page 16
Line 3:
.... nonvolatile memory ...

Line 18:
.... breakup of the aircraft.

There is a need for a statement regarding warnings, sirens and all the other metallic sounds.

Page 19
Line 4:
We feel the need to incorporate under this headline a sketch with breakup lines, sequences and reasons.

---

86

Page 6 of 06 Pages
Comments to Lauda Air Accident

Page 40
Line 26:
.... PIMU, which began December 28, 1990 and continued for approx. 1800 flying hours until the accident. However, their ...

Line 27:
.... an anomaly. (Delete all till) They removed/interchanged DCV's, ....

Page 41
Line 9:
.... reverser actuators. On March 26, 1991 Lauda maintenance personnel ...

Line 21:
.... Deviation Guide. The DDG allows continuation of operations with these specific faults until the next A-Check or for 500 h whichever comes first. On this basis Lauda was continuing to dispatch ....

Page 46
Line 23
... reduced to idle after the reverser deployment, ....

Page 48
Line 7
... malfunction was physically identified ...

END OF APPENDIX G.
END OF REPORT

Back to "TOP"
Back to "INDEX"

Back to `Computer-Related Incidents'.

---

Peter B. Ladkin, 1999-02-08
	Last modification on 1999-06-15 by Michael Blume