Boeing 747-8 operators are installing new engine electronic control (EEC) software as a precaution against possible in-flight deployment of the thrust reversers.

The action, mandated in an FAA airworthiness directive (AD), follows recommendations issued by Boeing to operators in a service bulletin in December. Although no incidents of thrust-reverser deployment have occurred on the General Electric GEnx-2B powered aircraft, Boeing says “our recommendation was based on analysis of data that led us to conclude while extremely remote and already prohibited by operational standards, this was a potential scenario. There has been no occurrence of this condition in service or in testing.”

The AD requires “removing certain defective software and installing new, improved software,” says the FAA, which adds the action “was prompted by a determination that the existing EEC software logic can prevent stowage of the thrust reversers during certain circumstances, which could cause the TRs to move back to the deployed position.”

The agency says such a failure could result in “inadequate climb performance at an altitude insufficient for recovery, and consequent uncontrolled flight into terrain.” The AD is effective April 9 although, as of March 25, Boeing says “we believe the considerable majority of the fleet—and potentially all of it—has already been updated.”

The FAA has been particularly watchful over protecting against the potential for in-flight deployment of thrust reversers since the May 1991 crash of a Pratt & Whitney PW4000-powered Lauda Air 767-300ER in Thailand. Uncommanded in-flight reverser deployment was identified as the likely cause when investigators discovered amongst the wreckage that the thrust reverser of the left engine was in the unstowed position.

Although FAA thrust reverser system certification required that the aircraft be capable of continued safe flight and landing under any possible position of the thrust reverser, post-accident tests and simulations demonstrated that aerodynamic effects of the reverser plume in-flight during engine run down to idle resulted in a 25% lift loss across the wing.

Further simulations showed the aircraft was not capable of controlled flight unless full aileron and full rudder were applied within four to six seconds after the thrust reverser deployed.

Although the investigation showed that under certain “hot-short” conditions the electrical system could potentially cause part of the mechanism to momentarily move to the deploy position, the accident report found no specific wire or component malfunction associated with the uncommanded thrust reverser deployment on the 767.