Originally Posted by
FlightDetent
It's been a flaming success the last time, many thanks for coming to clarify again. What I missed then same as now: was there any industry-wide change in design requirements and certification standards for TR installation in the aftermath?
Boeing implemented a 'third lock' on all their thrust reverser systems to prevent inadvertent deployment in-flight (retrofit to the existing fleet) - prior to Lauda it only took two failures (the T/R directional control valve - DCV, and T/R isolation valve). Unfortunately, Boeing had added something called "auto-restow" after the 737 Cranbrook crash (737-200, landed in a snowstorm, after T/R deployment a snowplow appeared out of the snow - crew did an aborted landing but one T/R hadn't completed the stow cycle before they lifted off again - the isolation valve had air/ground logic and closed the isolation valve - the aero forces forced the T/R back open and they crashed due to the yaw and loss of thrust (clamshell style T/R on the JT-8D). Auto-restow sensed if the T/R wasn't stowed and bypassed the air-ground logic to open the isolation valve allowing the T/R to stow.
On Lauda, a miss-rigged sensor was causing auto-restow to cycle (sensor would go target far, auto-restow would snug the reverser up tight, sensor would indicate target near, auto-restow would close the isolation valve, vibration and flight loads would move the T/R a bit and cause the sensor to go target far and the cycle would repeat). On one of those cycles, for reasons that were never firmly established, the DCV changed state to 'deploy'. The aircraft was at ~24k, Mach 0.78, max climb - with the engine at power, the eflux from the deployed reverser effectively destroyed the lift on that entire wing and they rapidly rolled into a dive. Although the FADEC commanded the thrust to idle, at those conditions it takes
well over 10 seconds for a PW4000 engine to decel to idle - by which time it was already too late and the aircraft was coming apart.
The addition of the third lock, along with stricter maintenance requirements, pushed the probability of an in-flight deployment from ~10-8 out to ~10-13/flight hour. Prior to Lauda, a T/R deployment in flight wasn't considered to be catastrophic - and had happened multiple times with the older low bypass and pure jet engines - no body appreciated how the introduction of big, high bypass engines tucked up relatively close to the wing had changed the impact. They had actually tested an in-flight T/R deployment during 767 flight test - but they'd done it at 10k, 200 knots, with the engine already at idle - 24k/Mach .78/climb power was completely different.
Interestingly, the relevant FAR
still says a T/R deployment in-flight must be shown to be controllable - so the Boeing cert basis is an "Equivalent Level of Safety" - basically showing it'll never happen (in regulatory lingo, 'never' is "extremely improbable" - a probability of 10-9/hr or less). EASA has changed their CS to basically say 'controllable or 'extremely improbable'.