How did the electronically controlled thrust reverser in Lauda Air Flight 004 (which crashed) get deployed in mid air without the pilot command. Was there a fault in the electronic controller, a hardware or software fault?

In his book Air Disaster Volume 2, the aviation writer Macarthur Job wrote

had that Boeing 767 been of an earlier version of the type, fitted with engines that were mechanically rather than electronically controlled, then that accident could not have happened.

How could that incident not have happened in a mechanically controlled engine?

  • $\begingroup$ There are several questions in your post, you might either refine your intended question. Are you more interested in the root cause or whether a mechanically controlled thrust reverser could suffer the same failure? $\endgroup$ Commented Jan 25, 2017 at 19:07
  • $\begingroup$ also, a related question: aviation.stackexchange.com/questions/13259/… $\endgroup$ Commented Jan 25, 2017 at 19:16
  • 1
    $\begingroup$ The FAA and official investigators could not determine the cause for the thrust reverser deployment. The FDR was completely destroyed. There isn't any way to tell why, hardware or software, that the thrust reverser deployed on 004. There is no factual answer to the first part of this question unfortunately. $\endgroup$
    – Ron Beyer
    Commented Jan 25, 2017 at 20:11
  • 2
    $\begingroup$ Like Ron said, they were never able to determine the exact cause. In addition to the damaged FDR the actual components were looted from the crash site and when they got then back they had been tampered with. The airline was apparently none too cooperative in providing the maintenance records and what was provided was missing sections. Through testing they identified a few different failure modes but with no way of determining if they had occurred. I'd say that writer you quoted is going on specious assumptions $\endgroup$
    – TomMcW
    Commented Jan 25, 2017 at 21:26
  • $\begingroup$ If the FDR was destroyed and no evidence was found to support the theory of a thrust reverser deployment, I don't see how anyone could conclude the accident was a result of an uncommanded TR deployment from the available evidence. But Boeing certainly concluded that must have been the most probable cause... "On Monday, 9 September 1991, the Boeing Commercial Airplane Group asked its customers to replace a valve in the thrust reverser systems that could cause the thrust reverser to deploy in flight." community.seattletimes.nwsource.com/archive/… $\endgroup$ Commented Jan 28, 2017 at 22:16

1 Answer 1


The investigation into Lauda Air Flight 004 determined that the probable cause was the deployment of the left engine thrust reverser (TR) during climb. An unsuspecting crew would not be able to recover control of the aircraft after such an event. Damage to the components involved in the crash prevented identifying a definite cause of the TR deployment.

TL;DR: The hydraulic system that opens and closes the TR includes two separate valves. The investigation found certain electrical and hydraulic failures that could result in both of these valves malfunctioning, resulting in uncommanded deployment of the TR. 767 aircraft with different engine models used a mechanical system to control the TR valves, which were not susceptible to those faults.

Information here summarized and quoted from the accident investigation report, you may refer to it for more detail.

Two important components involved in the investigation were the Hydraulic Isolation Valve (HIV), which determines whether hydraulic fluid can flow into the TR system, and the Directional Control Valve (DCV), which directs hydraulic pressure from the HIV to either deploy or stow the TR. In normal cruise flight, the HIV should be closed, and the DCV should be commanding the TR to be stowed, which provides redundant control of the hydraulic side of the system. The report analyzes electrical and hydraulic failures that could have resulted in both of these valves being in the wrong position, allowing uncommanded deployment of the TR.

Both valves are controlled electronically based on the position of the reverse thrust lever in the cockpit. The HIV normally will not open without the landing gear sensing the airplane is on the ground, but it is also controlled by an "auto-restow" system.

The auto-restow circuit design was intended to provide for restowing the thrust reversers after sensing the thrust reverser cowls out of agreement with the commanded position. The auto-restow circuit powers the HIV to open regardless of indications from the air/ground circuit.

If the aircraft senses that the HIV opens while in the air, a REV ISLN (reverser isolation) message is given to the crew. About 6 minutes after takeoff the crew started to discuss an intermittent appearance of this message, and after referencing their manuals determined that no further action was necessary. The TR opened about 9 minutes later.

That an electrical wiring anomaly could explain the illumination of the "REV ISLN" indication is supported by the known occurrence of wiring anomalies on other B 767 airplanes.

With the HIV open, hydraulic power would be available to the TR system, but the DCV should still command the TR to be stowed. The DCV was also electronically controlled.

The investigation of the accident disclosed that certain hot short conditions involving the electrical system could potentially command the DCV to move to the deploy position in conjunction with an auto restow command, for a maximum of one second which would cause the thrust reversers to move.


Boeing could not provide test data or analysis to determine the extent of thrust reverser movement in response to a momentary hot-short with a voltage greater than 8.2 Vdc or the ability of the thrust reverser to return to the stowed position after tripping of the circuit breaker associated with the source of the hot-short.

So the investigation determined that it was possible for electrical issues to cause the TR to deploy in flight, but they could not determine whether the electrical system on the accident plane had any issues.

The degree of destruction of the Lauda airplane negated efforts to identify an electrical system malfunction. No wiring or electrical system component malfunction was positively observed or identified as the cause of uncommanded thrust reverser deployment on the accident airplane.

Electrical issues were not the only reason the DCV could malfunction. Contamination in the hydraulic system could also cause the DCV to command TR deployment. But the investigation was not able to rule out contamination of the DCV in question.

The condition of the left engine DCV which was recovered approximately 9 months after the accident, indicated that it was partially disassembled and reassembled by persons not associated with the accident investigation.

Without knowing the original condition of the DCV and aircraft wiring, the investigators could not identify a definite cause. Some of the issues found in the investigation were addressed by airworthiness directives (AD's) from the FAA, and by design changes by Boeing and the equipment manufacturers. This consisted of making the wiring less susceptible to faults and the valves less susceptible to malfunction from contamination.

The electrical failures were dependent on the configuration of the aircraft electrical system, and the hydraulic failures were dependent on the design of the valves. The report includes an FAA letter analyzing whether a similar failure could occur on other Boeing aircraft.

The accident airplane was a 767 with PW4000 engines. Once the investigation identified the above issues, the TR's on these planes were deactivated until a fix could be implemented. 767 aircraft with JT9D or CF6-80A engines were excluded at the time from any corrective action:

Since these thrust reverser systems employ mechanically actuated directional control valves, it is felt that they do not possess the same potential for inflight reversal as those systems listed above.

757 aircraft with PW2000 engines were very similar in design to the 767/PW4000 system, so system checks and valve replacement were mandated.

747-400 aircraft had similar systems to the 767, but were not immediately affected, because aerodynamic differences meant that a TR deployment in flight would not be as serious. The same fixes were to be implemented though.

767 aircraft with CF6-80C2 and RB211-524 engines had a different system, but inspections and tests were anticipated until design changes were made or determined unnecessary.

757 aircraft with RB211-535 engines had a different hydraulic design that wasn't susceptible to contamination failure, but the electrical system was analyzed for potential issues.

737 aircraft with CFM56-3 engines were not found to have the same issues.

Schematic of 767 PW4000 TR system


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .