Originally Posted by
VinRouge
So on the C17, im fairly sure a similar probability loss model is used. If 2 of 3 interlock prox sensors indicate TR deployment in flight (or if 2 prox sensors fail in flight and loose resilience), the controller automatically commands flight idle on that engine. So its not impossible (nor difficult) to meet FAR/CS25 requirements in a modern aircraft design if this design were adopted. But again, structure would need to be beefed up (weight cost, complexity etc), and there is no role requirement for it, hence why its not a design feature.
If I were in a similar scenario in a commercial equivalent (Lauda scenario) the T-Handle would be the best place to start I suspect. But that would require very rapid actions and realization of what is happening pretty quickly.
The devil is in the details. When the T/R deployed on Lauda, the FADEC
immediately commanded idle thrust on that engine (as is required by the regulations). But big turbine engines
don't respond immediately - it takes finite time to spool down - especially at altitude - and by the time the event engine got close to idle, it was already too late - the aircraft was out of control and already coming apart (I was directly involved in the Lauda investigation - it wasn't pretty). If an engine is significantly above idle with asymmetric reverser deployment, you're F
ed. Simply failing to wait until the engine spooled down to idle before commanding in-flight reverse could be catastrophic with asymmetric reverse at altitude.
With the old pure jet and low bypass engines, in-flight reverse - even if something went wrong - wasn't a big deal. But what we didn't know before Lauda was that with high bypass engines it's a whole different story (and the F117 - aka PW2000 - is most definitely a high bypass engine). Had the C-17 been Part 25 certified, in-flight reverse would have been banned in the aftermath of Lauda.
The Lauda crew
knew that something funny was going on with the reverser before the deployment occurred - but still were unable to perform a shutdown of the engine in time to prevent complete loss of control. and the resultant aircraft breakup.
Boeing looked at doing a Part 25 cert of the C-17 (abandoned due to insufficient interest to justify the costs). In flight reverse would have been among the first things to get deleted.
Edited to add - the C-17 was designed and put into production pre-Lauda. They hadn't yet learned the Lauda lesson of what high bypass reverse in-flight can do. The analysis that the 767/PW4000 reverser was safe - even with an in-flight deployment - was done as part of the certification. Problem was it was WRONG.
We know better now.