When the Maintenance Manual Disabled the Monitor: The Boeing 737NG Thrust-Reverser Lock-Indication AD Through an ARP4761A and 25.933 Lens

A thrust-reverser lock indication is a monitor. In normal flight it does nothing. It sits on the upper locking actuator, waits for the reverser to be unlocked when it should be stowed, and earns its keep exactly once: by lighting the REVERSER caption on the aft overhead panel before an unlocked reverser becomes an unlocked-and-deployed reverser. The 737NG story in front of the FAA right now is not that this monitor fired wrong. It is that a maintenance manual procedure could quietly arrange for the monitor to never fire at all — by grinding down the very target it reads — and that the airplane would dispatch, for thousands of flights, with its last defense against in-flight reverser deployment silently switched off.

This is the second time the FAA has had to chase this exact defeat. The first time was 2019. The fact that we are back here in 2026, on the same actuator, over the same lock indication, is the part worth slowing down for — because the recurrence is the lesson, not the footnote.

1. The public record

On March 30, 2026 the FAA published a notice of proposed rulemaking, Project Identifier AD-2025-00364-T, Docket No. FAA-2026-2726 (91 FR 15566), applicable to all The Boeing Company Model 737-600, -700, -700C, -800, -900, and -900ER airplanes — the 737NG line — certificated in any category. Comments closed May 14, 2026. The action is filed under ATA Code 78, Thrust Reverser, and it incorporates by reference Boeing Alert Requirements Bulletin 737-78A1099 RB, dated July 8, 2025.

The FAA's statement of the unsafe condition is short and specific: "adjusting the upper locking hydraulic actuator proximity sensor targets in accordance with certain data in the aircraft maintenance manual (AMM) could result in incorrect upper locking hydraulic actuator indications, which could result in a thrust reverser that indicates `locked' when it is not locked." The consequence the agency is buying down: "a decrease in safety margins to prevent a possible uncommanded in-flight deployment of the thrust reverser, which could result in loss of control of the airplane."

The proposed AD would require, on each of the four upper locking hydraulic actuators (left and right reverser halves of each engine), a battery of checks straight out of the Boeing bulletin: a lock integrity test of the upper locking hydraulic actuator, an operational check of the manual unlock handle assembly torsion spring, a measurement of manual unlock handle angular free-play, a measurement of the clearance between the proximity sensor and the proximity sensor target leading edge, and a measurement of the proximity sensor target itself. Where the hardware fails the check, the on-condition actions are blunt: replace the torsion spring, replace the proximity sensor target, deactivate the thrust reverser for flight, or replace the actuator outright. The AD would also fold a set of certification maintenance requirements — 70-CMR-01 and 78-CMR-01 through 78-CMR-07 of Boeing CMR document D626A001-9-03, dated September 2023 — into each operator's maintenance program. The FAA estimates the rule reaches 1,805 U.S.-registered airplanes, at 18 work-hours each, with actuator replacement running roughly $47,920 a unit where it is needed.

Here is the part that should make a safety engineer sit up. This proposed AD explicitly terminates the integrity test and corrective actions of an earlier rule — AD 2019-18-03 (84 FR 49005, effective October 3, 2019). And AD 2019-18-03 existed for the same reason. In May 2019, Boeing told the FAA that an AMM procedure intended for rigging a newly installed upper locking actuator was being used on worn actuators to make a nuisance indication go away. In the FAA's 2019 words, the procedure "removes material from the upper locking actuator's lock sensor target until the upper locking actuator's unlocked indication (the `REVERSER' light on the flight deck aft overhead panel ...) is no longer illuminated" — but it "does not require a check to verify that the thrust reverser upper locking actuator locking mechanism is operative or that the unlocked indication functions normally after removal of the material." The result, stated plainly: "a locking mechanism failure ... could remain undetected for thousands of flights."

So the 2019 AD prohibited grinding or trimming the lock sensor target, ripped the offending text out of the maintenance program, and mandated a repetitive integrity test of the upper locking actuator at intervals not to exceed 750 flight hours, with actuator replacement if the reverser moved more than a defined "slight movement." That should have been the end of it. It was not. Operators discovered that the integrity test itself could wind residual torque into the reverser's flexible drive shafts, and reversers were failing to deploy on the first command after the test — so the FAA had to issue follow-on guidance telling crews to deploy and retract once after the test to bleed that torque off (Aviation Week, Regulators Urge 737NG Operators To Adjust Reverser Repair Steps; Aviation Week, FAA Alert Flags 737NG Thrust Reverser Issue). The 2026 NPRM is the FAA replacing a corrective monitor that had its own side effects with a fuller, CMR-anchored verification set. Same hazard, third revision of the fix.

Why this hazard sits at the top of the severity scale is not in dispute. Uncommanded in-flight thrust-reverser deployment is the failure condition behind Lauda Air Flight 004 — a 767-300ER whose left-engine reverser deployed in the climb on May 26, 1991, with the loss of all 223 aboard (Aviation Safety Network accident record). That accident is precisely why the airworthiness standard for reversing systems is written the way it is.

2. The standards lens

Start with the type-certification requirement the lock and its indication exist to satisfy. 14 CFR 25.933(a)(1) ("Reversing systems") requires, for a thrust reverser intended for ground operation, that the reverser system be designed so that no single failure or malfunction — or probable combination — will result in unwanted in-flight deployment, or that the airplane be capable of continued safe flight and landing if it occurs. In practice the manufacturer discharges 25.933 by showing inadvertent in-flight deployment is extremely improbable, which routes straight into 14 CFR 25.1309 and its quantitative ladder: a Catastrophic failure condition must be shown to be no more frequent than 1×10⁻⁹ per flight hour, and — this is the operative clause — must not result from a single failure.

That "not from a single failure" language is what forces the architecture in question. The reverser restraint cannot be a lone latch whose failure deploys the reverser. So the design layers it: a stow lock, a synchronization lock, and an upper locking actuator whose lock state is sensed and annunciated. The REVERSER light is the monitor that converts a would-be latent failure (an unlocked actuator) into an annunciated, dispatch-blocking one. The entire 25.1309 numerical argument for the reverser leans on that monitor being independent and available.

This is ARP4761A territory, and it is the clause set that should have caught the maintenance-induced defeat. The reverser Functional Hazard Assessment classifies "uncommanded in-flight deployment" as Catastrophic. The Fault Tree Analysis that supports the 25.1309 budget models that top event as a combination: loss of the actuator restraint AND failure of the monitor to catch it. The monitor is a latent (dormant) item — it does nothing until the day it is needed — so ARP4761A demands its exposure time be bounded. The mechanism for bounding it is a Certification Maintenance Requirement (CMR): a periodic test, derived from the safety assessment and made mandatory, that resets the latent-failure clock. The 750-flight-hour integrity test in the 2019 AD was that CMR in everything but name; the 2026 NPRM finally writes the CMRs (78-CMR-01 through 78-CMR-07) into the maintenance program explicitly.

Here is the artifact that was missing, and it is not a clever one. ARP4761A's latent-failure analysis assumes the monitor's availability is governed by hardware wear plus a defined inspection interval. It does not, by default, model the maintenance manual as a defeat path for the monitor. Yet that is exactly what happened: a rigging procedure, correct for a fresh actuator, became — when applied to a worn one — a documented way to extinguish the unlocked indication without re-proving that the lock works or that the indication still functions. In ARP4754A / ARP4761A language, a maintenance task silently invalidated an independence-and-availability claim that the System Safety Assessment depended on, and nothing in the assessment's Common Cause Analysis flagged the AMM step as a credible source of monitor loss. The Catastrophic budget for the reverser was, on paper, intact. On the ramp, a maintainer with a grinder could zero it out.

That is the difference between a hazard that is analyzed and one that is controlled. The 2019 AD controlled it by prohibition (do not grind the target) plus interval test. The 2026 AD controls it by replacing the trim-able indication margin with measured tolerances, a lock integrity test, an indication-path operational check, and CMRs that the operator cannot quietly drop. The standard never changed. The discipline of treating the maintenance procedure as part of the safety architecture is what was missing.

3. A worked snippet — FHA row and fault tree

First, the Functional Hazard Assessment row the reverser system owns, stated in ARP4761A terms rather than automotive ASIL:

| ID | Function | Failure condition | Phase | Effect | Classification | Quantitative objective | |---|---|---|---|---|---|---| | FHA-TR-01 | Reverser restraint + unlocked annunciation | Upper locking actuator unlocked in flight with lock indication defeated (latent monitor loss) | Climb / cruise | Uncommanded in-flight deployment; asymmetric thrust and spoiling drag; potential loss of control | Catastrophic | ≤ 1×10⁻⁹ per flight hour; no single failure (14 CFR 25.933 / 25.1309) |

Now the fault tree for the top event. Note the structure: the Catastrophic outcome needs both a restraint loss and a defeated monitor, and the maintenance manual lives inside the monitor-defeat branch as a basic event that the original assessment never drew.

TOP: Uncommanded in-flight thrust-reverser deployment  [Catastrophic, target <=1E-9/FH]
        AND
        ├── G1: Upper locking actuator restraint lost in flight
        │        OR
        │        ├── BE1  Locking mechanism worn / failed to hold
        │        ├── BE2  Torsion spring fails to bias unlock handle to locked
        │        └── BE3  Hydraulic / mechanical disturbance unseats a marginal lock
        │
        └── G2: Unlocked condition NOT annunciated and corrected before deployment
                 OR
                 ├── BE4  Lock sensor target material removed per AMM rig step
                 │        => REVERSER caption extinguished though actuator unlocked
                 ├── BE5  Sensor-to-target leading-edge clearance out of tolerance
                 │        => proximity sensor reads "locked" (false stow)
                 ├── BE6  No post-maintenance re-verification of lock + indication path
                 └── BE7  Latent exposure interval unbounded (no enforced CMR)

The two-headline reading of this tree is the whole point. In a healthy program, gate G2 is hard to satisfy — the monitor is independent, available, and its dormancy is interval-bounded — so the AND gate keeps the top event below 1×10⁻⁹/FH. The AMM defeat collapses G2 to a single, cheap, intentional basic event (BE4). Once BE4 is on the table, the reverser is one G1 failure away from a Catastrophic event with no flight-deck warning. The fault tree was never wrong; it was just drawn without the maintenance manual in it.

4. Derived requirements (excerpt)

Five traceable requirements, with stable IDs, that close the branch above. These are written the way they should have appeared in the System Safety Assessment and the ICA, not after a second AD:

TR-SR-01 — The reverser lock-indication function shall annunciate an unlocked upper locking actuator to the flight deck within one actuation cycle of the unlock event, on all four actuators, independent of actuator wear state. (Derives from FHA-TR-01, 25.933(a)(1), 25.1309.)
TR-SR-02 — No maintenance task — rigging, adjustment, or target dressing — shall be capable of extinguishing the unlocked indication without a mandatory, automatic re-verification (lock integrity test plus indication-path operational check) completed before next dispatch. (Closes BE4, BE6.)
TR-SR-03 — Removal of material by grinding or trimming from the upper locking actuator lock sensor target is prohibited; proximity sensor-to-target leading-edge clearance and target dimensions shall be verified to drawing tolerance, with out-of-tolerance actuators replaced before further flight. (Closes BE4, BE5; mirrors AD 2019-18-03 (h) and the RB measurements.)
TR-SR-04 — Latent failure of the lock-indication monitor shall be bounded by an enforced Certification Maintenance Requirement (70-CMR-01, 78-CMR-01 through 78-CMR-07) with an exposure interval no greater than 750 flight hours, such that the combined latent-plus-active probability of an undetected unlocked reverser remains at or below 1×10⁻⁹ per flight hour. (Closes BE7; binds the FTA exposure term.)
TR-SR-05 — Following any upper-locking-actuator integrity test, a full deploy-and-retract cycle shall be commanded before return to service to release residual flexible-shaft torque, so the corrective test cannot itself induce a failure-to-deploy on the next commanded deployment. (Closes the field-reported side effect of the 2019 integrity test.)

5. What the headline really tells us

If you skim past it, this is a $1,530-per-airplane inspection AD on a 30-year-old airframe — the kind of rule that never trends. Read as an engineer, it is one of the cleaner case studies this year in how a Catastrophic-rated function gets hollowed out without anyone touching the design. The reverser's safety case was sound: a layered restraint, a monitor on the lock, a fault tree that kept in-flight deployment below 1×10⁻⁹ per flight hour, all blessed under 25.933 and 25.1309. What defeated it was not a cracked part or a software bug. It was a maintenance manual that offered a worn-actuator shortcut the safety assessment had never modeled as a credible path to monitor loss — and a first fix, in 2019, that bounded the wear and the interval but still left the indication margin trim-able and introduced a torque side effect of its own.

The missing artifact was never exotic. It was a single line of Common Cause Analysis treating the AMM as part of the safety architecture, and a CMR that no maintainer could quietly retire. The headline says "thrust reverser inspection." The work product it is really asking for is the one that says: a monitor you can disable with a grinder, and not notice for thousands of flights, was never really a monitor at all.

If you want to walk through how the reverser FHA, the latent-failure fault tree, or the CMR derivation would slot into your own ICA and System Safety Assessment, the contact link on the main site is the fastest way to reach me.