
Boeing 787 Suffers Rare Dual Engine Failure on Landing - georgecmu
https://thepointsguy.com/news/boeing-787-suffers-rare-dual-engine-failure-on-landing/
======
esemor
I think the auto shutdown of engines in flight, in case it senses reverse
thrust, is a great design.

The 787 is a replacement for my 767 (currently a pilot on the aircraft) and in
1991 a Lauda Air 767 suffered a failure in one of its thrust reverser and it
became activated during cruise. The aircraft was destroyed in flight.

The thrust reversers should not activate during flight (a air/ground sensors
prevents that) but as it is a catastrophic failure, having the engine shut
down automatically seems like a great fail safe device.

In this case it seems that the 787 engines were reversed before the air/ground
sensor had sensed ground and it is a potential problem.

~~~
alexbanks
I am very scared of flying (although I still do it, although it's not fun).
Any advice/rationalism you can convey? I am a person that became sweaty and
anxious reading your post.

~~~
tjohns
My advice is to look at the statistics. Commercial flying is much, _much_
safer than any other mode of transport.

Do you get scared when you drive to work? Or take a train? Both are more
risky. (Driving significantly so.)

More specifically... The pilots have extensive training, modern airliners have
fail safes everywhere, and the amount of research and engineering spent on
aviation safety is mind boggling.

See: [http://airlines.org/dataset/safety-record-of-u-s-air-
carrier...](http://airlines.org/dataset/safety-record-of-u-s-air-carriers/)

~~~
soheil
An accident during flight is pretty much a binary event when it comes down to
whether you live or not, but with cars there is a whole slew of different
types of accidents and vast majority of them don't cause instant death
preceded by 45 seconds of absolute terror. Before you downvote what I said in
no way discounts the statistics. It is much safer to fly of course than to
drive, but when we think of accidents which is an inevitable fact of any mode
of travel one mode is binary you live or die and another not. To our mammalian
brains the statistics is a very hard sell.

~~~
marvin
Aircraft accidents aren't binary at all. Many crashes have few or some
casualties, e.g. landing gear failure, running off the runway or hitting
another aircraft on the ground. Ditto with in-flight failures that don't
impact the flight (there's only one major thing that fails, picked up by the
redundancies), engine failures that lead to emergency landings, extreme
unexpected turbulence or ditchings etc. that might cause injuries and in some
cases deaths. It's only the worst crashes (termed "air disasters" or similar)
that lead to everybody on board dying. Of course, these get the most
attention. I blame the news.

~~~
soheil
How can you argue against what I said, it takes profound willingness to ignore
precise words to accomplish that. I did not say all accidents I said majority
are. If you consider a mosquito hitting the windshield of an airplane when
it's parked on the ground and no passenger in it an accident that's your
problem. Of course I meant an accident that happens during flight as that's
the vast majority of the time that people are in an airplane and when they're
worrying about dying.

~~~
marvin
I don't think that's a super fair assessment of my comment. If we're just
disagreeing on the definition of an in-flight accident, or what percentage
between 30% and 90% of accidents constitute a vast majority, we should
probably leave it at that, because that's not really disagreement :)

My point is, there's plenty of accidents caused by things that happened while
the plane was in the air, that has many survivors or just some injuries. The
news article at [0] has some examples, and it's possible to search for more.
Granted, if you exclude the cases where the injuries or casualties were caused
during an attempted landing or a forced landing due to malfunction, the
picture would probably look much more bleak, but then you would also have
ruled out a large portion of the accidents that happened.

It's thankfully _extremely_ rare that it's been impossible to make an honest
attempt at a controlled landing or ditching during an accident, and in a large
part of the cases where this was possible, things turned out okay for most
passengers.

[0]: [https://www.nbcnews.com/news/us-news/after-air-accidents-
sur...](https://www.nbcnews.com/news/us-news/after-air-accidents-survivors-
grapple-flying-again-n868086)

------
Animats
This is really strange. Not only did they have a dual engine failure, they
couldn't restart while stuck on the runway. After 40 minutes, the aircraft had
to be towed in. Then maintenance couldn't find a fault.

This is an ANA aircraft, which means it's probably maintained well and flown
by competent pilots. Looking forward to a good analysis on this.

Most large aircraft have a "weight on wheels" switch, activated when the
aircraft is on the ground. There might be some bad interaction between the
"weight on wheels" sensing and the thrust reverser protection. Pure
speculation: initial touchdown, pilots deploy reversers, small bounce into the
air, weight on wheels switches open, engine controller detects flight
condition with thrust reversers deployed and shuts down engines.

The other side of this kind of failure is dealing with unintended thrust
reverser deployment in flight. Here's an overview.[1] Historically, it wasn't
a big deal at altitude, but on some newer aircraft, it is, and so stronger
steps have been taken to avoid it.

[1]
[https://lessonslearned.faa.gov/ll_main.cfm?TabID=3&LLID=34&L...](https://lessonslearned.faa.gov/ll_main.cfm?TabID=3&LLID=34&LLTypeID=2)

~~~
reidacdc
Your speculative scenario has actually happened, but on a significantly less
computerized Boeing 737, in 1978.[1]

In that case, the aircraft touched down, reversers were deployed, a runway
obstacle (a snowplow) appeared, and the pilots attempted to go around. They
got airborne and cleared the obstacle, but as they lifted off, the "squat
switches" on the main gear opened. One of the reversers was still deployed,
and with the squat switches open, was no longer powered, and could not
retract. The aircraft was uncontrollable, and crashed.

In that case, shutting down the reversed engine would likely have been
preferable, although if we're doing counter-factuals, telling the snowplow
driver about the airplane's revised arrival time is your go-to move, I think.

[1]
[https://en.wikipedia.org/wiki/Pacific_Western_Airlines_Fligh...](https://en.wikipedia.org/wiki/Pacific_Western_Airlines_Flight_314)

------
cbhl
The Boeing 787 is now about nine years old. I wonder how much of this is
operator proficiency triggering latent bugs (aka, "pilots got too good at
pushing buttons quickly").

The bugs in the Therac 25 were only discovered after the machine had been in
production for a while (you had to be typing "too quickly" in order to get the
software to trigger the bug with the safety interlock).

~~~
t0mas88
It's not very typical for pilots to push buttons quickly. Especially not the
thrustreversers and engine and flight controls.

But it is entirely possible that nobody pulled the reversers while still
airborne in 9 years, because it's a very strange thing to do. A bit like
opening your car door while still driving 60 mph... Nobody does that in normal
operation.

~~~
NAHWheatCracker
_A bit like opening your car door while still driving 60 mph... Nobody does
that in normal operation._

You don't open and shut a door when you notice it didn't fully close because
you can hear the wind?

~~~
frogpelt
A better comparison might be putting the car in reverse at 60 MPH.

~~~
isostatic
You never missed a gear, thinking you were driving a 6 speed rather than a 5
speed?

~~~
stevehawk
No, but for as long as I've been driving manual cars they've had gates to
prevent that very action. (1995)

~~~
camtarn
Not mine (Honda Jazz). But you physically can't do it, as the reverse gear has
no synchro and won't mesh unless stationary.

~~~
jstanley
It can be done, but it's neither easy nor a good idea:
[https://youtube.com/watch?v=ARJENV0qGdY](https://youtube.com/watch?v=ARJENV0qGdY)

You'd certainly struggle to do it by accident.

------
code4tee
Boeing’s answer seems to say if you accidentally pull the thrust reverser
lever before the aircraft is on the ground it just force shuts down the
engines.

That sounds like an odd safety override. Surely a better solution would be to
just not activate reverse thrust. Unlike car engines a jet engine can’t just
be quickly restarted if it accidentally shuts down. It typically takes 30-60
seconds to get going.

This and earlier incidents are highlighting the dangers automation can add to
mission critical systems. No pilot wants to hear notices about “hey, so in
case you didn’t know our programmers added some code that does this strange
uncommanded thing when you push buttons a certain way”

~~~
nck4222
Do you have experience with aircraft engine design, or landing protocols, or
insight in to the meetings when the engines were designed?

If so, I'll take back my words but considering the manufacturer doesn't know
exactly why this happened, and the engineers on the ground said it seems like
a "software bug", it seems a bit presumptuous and frankly a bit comical to
start saying things like:

"Surely a better solution would be to just"...

Ah well, glad a 5 sentence comment on the internet can resolve an issue in a
hardware, software, and social engineering challenge decades in the making.

~~~
maxxxxx
I always love it when you have worked on something for months and someone new
comes by and says "Why don't you just X?".

~~~
ergothus
It's worse when they are right though. I wish I could say that had not
happened to me.

~~~
Retric
Is that from other experts with a very close understanding of the specifics,
or random people online?

What I find is you start with several viable approaches, pick one and go down
the path enough to figure out the downsides. At which point you need to decide
to backtrack or keep going. That’s the hard part not simply coming up with a
seemingly simple solution.

~~~
jlg23
> Is that from other experts with a very close understanding of the specifics,
> or random people online?

These groups are not mutually exclusive, membership can only be assigned by a
domain expert and is finally irrelevant if the other is right.

~~~
Retric
Constraints define good decisions. A new team member making a viable
suggestion is very different from a random person tossing out a wild ass guess
that happens to be right. The difference is the random commentator has no real
way to judge how viable something is, and thus is simply tossing out ideas.

------
MFLoon
The Professional Pilots Rumor Network (PPRUNE) is a pretty awesome forum full
of aviation professionals discussing aviation at a high level, I always go
there for aviation news commentary. The thread on this isn't very extensive
yet, but has some interesting commentary [https://www.pprune.org/rumours-
news/617426-ana-787-engines-s...](https://www.pprune.org/rumours-
news/617426-ana-787-engines-shutdown-during-landing.html)

------
sschueller
"Boeing said that selecting full reverse too quickly upon landing before the
aircraft has fully transitioned to ground mode could cause the system to
activate."

That sounds like apple's "you are holding it wrong" when "antenagate"
happened. Not something I want to hear from an aircraft company where people's
lives depend on it working.

~~~
Someone
Reading between the lines, and having read other comments here, I can
interpret Boeing’s remark as _“if the pilots or the on-board software try to
reverse engines when it still is really, really dangerous, the Thrust Control
Malfunction Accommodation system (TCMA) will try to make matters less bad, in
some cases by shutting down the engines instead”_.

They may have to fine-tune that system, but from a safety perspective, this
event had a good ending, and making its decision system more complex also
carries risks, so, maybe, nothing has to change.

~~~
marcosdumay
> when it still is really, really dangerous

More apt would be "when the computer is not sure that isn't really, really
dangerous".

------
exabrial
Sort of off topic, but reverse thrust sort of boggles my mind. If you're
sucking air in from the front of the aircraft and ejecting it out the front,
don't those forces counterbalance each other?

~~~
minedwiz
Reverse thrust doesn't come directly out the front of the engine - it's vented
out the side (or, in very old engines, redirected from the back exhaust):

[https://upload.wikimedia.org/wikipedia/commons/d/df/F-GTAR_A...](https://upload.wikimedia.org/wikipedia/commons/d/df/F-GTAR_Air_France_%283698209485%29.jpg)

~~~
cpcallen
That makes it even more surprisingly counterintuitive.

I think the important thing to consider is the relative velocities of the
intake and exhaust air (the latter being much larger).

------
anderspitman
Oh Dreamliner, still[0] making me look bad 12 years later.

[0]
[https://news.ycombinator.com/item?id=9477941](https://news.ycombinator.com/item?id=9477941)

~~~
whizzkid
I have never ever thought avionics software development would be in such a
condition that you described in the link.

I am surprised to say the least.

I have always imagined avionics developers in a different way. Like having a
thick rulebook to go through to add a new line to codebase etc.

~~~
anderspitman
Keep in mind my experience was almost exclusively with communications systems,
which are important but nowhere near as vital as things like autopilot. Things
could very likely be better there, or at a different company. And even many of
the things I worked on were like you describe. There is a lot of red tape and
testing to make certain changes, and the industry documents are often strict.
But it wasn't always clear how much of that actually made things better/safer
and how much was just fluff.

------
nitinreddy88
How many easter eggs will emerge from Boeing. In last 2 months, we had similar
incidents from Boeing where an undocumented software safety kicked in and
causing trouble for everyone

~~~
aaronbrethorst
_and causing trouble for everyone_

You mean killed 189 people, right?
[https://en.wikipedia.org/wiki/Lion_Air_Flight_610](https://en.wikipedia.org/wiki/Lion_Air_Flight_610)

~~~
danielvf
That aircraft was being knowingly flown with [edit: a broken sensor]. It was
unsafe on takeoff.

The final problem that brought the aircraft down - the trim run-away - happens
_all the time_ in airliners you've flown in. When the run-away starts, the
pilot is supposed to flip two switches to disable the trim system motors. In
the Lion Air crash, it is indeed believed that a software bug from the
misbehaving sensors started the run-away, but again, handling trim run-aways
are something that pilots are supposed to train for and deal with.

737's are even safer here than many airliners, because after you disable the
electric trim motors, you have manual wheels in the cockpit that you can
rotate to set the trim back to what it should be. Some other airliners in
common use don't have these manual trim controls - you have to disable a trim
run-away in time, or it's game over.

~~~
Someone1234
> That aircraft was knowingly flown with multiple broken sensors. It was
> unsafe on takeoff.

You'll need to cite that, since it contrary to any information I can find on
the Lion Air accident e.g.:

> The chief executive officer of Lion Air, Edward Sirait, said the aircraft
> had a "technical issue" on Sunday night, but this had been addressed in
> accordance with maintenance manuals issued by the manufacturer. Engineers
> had declared that the aircraft was ready for takeoff on the morning of the
> accident

Your claim that it was "unsafe to takeoff" and had "multiple broken sensors"
is pretty remarkable. So I'll definitely need to see a source backing up such
remarkable claims.

~~~
teraflop
From the same Wikipedia article that was just linked:

> "The aircraft suffered an airspeed indicator problem for its last four
> flights, including the flight to Denpasar. Thinking that it would fix the
> problem, the engineers in Bali then replaced one of the aircraft's AoA
> sensors, but the problem persisted on the penultimate flight [...] [the
> crew] recorded a twenty-degree difference between the readings of the left
> AoA sensor and the right sensor."

> "On 28 November, Indonesia investigators said the Lion Air jet was not
> airworthy on flight before crash."

~~~
Someone1234
Those are prior flights. The aircraft was fully repaired:

> The chief executive officer of Lion Air, Edward Sirait, said the aircraft
> had a "technical issue" on Sunday night, but this had been addressed in
> accordance with maintenance manuals issued by the manufacturer. Engineers
> had declared that the aircraft was ready for takeoff on the morning of the
> accident

So you still haven't supported your extraordinary claim that the aircraft was:

> unsafe on takeoff.

In fact we know it was safe on takeoff.

~~~
laken
Quoting from the same comment you just replied to:

> "On 28 November, Indonesia investigators said the Lion Air jet was _not
> airworthy_ on flight before crash."

"not airworthy" means that it was unsafe.

~~~
detaro
_on flight before the crash_. After which it was repaired, and sent on the
fatal flight.

~~~
DuskStar
It was also repaired before the previous flight.

It goes like this:

several flights report problem

maintenance "fixes" the problem

next flight reports that another, worse problem has appeared - bad enough that
regulators have now said that the plane was "not airworthy" during this flight

maintenance "fixes" the problem

final flight impacts ocean at high speed

Your assertion is that since maintenance cleared the plane after the second
fix, the plane must have been fine. To that, I point to the previous time
maintenance cleared the plane, when it was demonstrably not fine.

~~~
detaro
No, my claim merely was that the quote does not make the claim about the
specific flight (although I didn't word it quite clearly). The findings about
bad maintenance culture certainly suggest that the plane wasn't fixed
properly.

------
Rooster61
The second high-profile potentially deadly software caused failure related to
automated safety features in as many years (if that ends up being the cause,
of course).

Very glad the touchdown went nominally. Had they pushed the point of touchdown
just a bit further down the tarmac, they'd have skittered right off the
pavement.

~~~
kondro
Skittered right into the arrestor bed:

[https://en.wikipedia.org/wiki/Engineered_materials_arrestor_...](https://en.wikipedia.org/wiki/Engineered_materials_arrestor_system)

~~~
Rooster61
If that particular tarmac is equipped with such a countermeasure, yes.

------
jshprentz
Aviation professionals discussed this incident on the Aviation Herald website.
[http://avherald.com/h?article=4c2fe53a](http://avherald.com/h?article=4c2fe53a)

------
ken
This is straight out of chapter 1 of Alan Cooper's "The Inmates Are Running
the Asylum" (2004). What do you get when you cross a computer and an airplane?
A computer!

------
0xFFFE
Seems like reasonable choice on the Boeing's part, the objective of the
reverse thrust is to provide additional braking to the aircraft, if shutting
down the engine has similar effect (albeit to a lesser extent), why not?
Better than getting stuck in a dangerous situation if the reverse thrust was
deployed prematurely.

~~~
booi
You're joking right? The engine is required for nearly everything else
including but not limited to applying thrust to abort the landing.

------
jiveturkey
> Engineers inspected the engines and could find no reason for the dual
> failure. With the post-inspection finding nothing to cause the engines to
> fail, engineers are saying the likely cause for the shutdown is a software
> issue onboard the aircraft.

Very interesting that

a) one of the first checks by engineers is not an evaluation of the software
"log" or similar. either they have a specific checklist they MUST go by and
that checklist doesn't include software log, and/or such log is simply not
available to them.

b)"likely cause"? again, why don't engineers have easy access to a software
event log?

I can very well imagine such instrumentation of software caused events not
even existing for the shit apps we build, but for safety critical systems in
an airplane? The log MUST exist. Why don't engineers on the ground have easy
access to it. The software is integral these days.

~~~
Glawen
And where would you store these logs ? I'm sure the engine stores its faults
somewhere, but i'm not expecting more.

You have to realise that you can run safety critical software on certified
microcontrollers, which have usually like 10 mb of flash. Moreover it is an
aicraft, and worse it is an engine, so I guess that the mechanical
requirements are insane (able to withstand a lot of vibrations, operate in -60
to 160 deg celsius, withstand cosmic rays). A samsung ssd does not fit the
bill.

It's probable however that the aircraft communications lines are recorded in a
black box, but you can only see the data exchanged by the ECUs, not the
relevant internal variables telling you about the bug.

Mind you i'm not working in the aicraft industry, my assumptions may be false,
but my guess is that the engine controller is on the engine itself.

------
dorfsmay
I wonder if it could be ice in the fuel line.

Ice doesn't leave trace by the time it melts. This has happened in the past on
a different type of plane (Boeing 777).

[https://www.telegraph.co.uk/news/uknews/1950444/Heathrow-
cra...](https://www.telegraph.co.uk/news/uknews/1950444/Heathrow-crash-
landing-caused-by-fuel-freeze.html)

------
ncmncm
Does nobody remember the Lockheed aircraft that ran off the end of the runway
because both the brakes and lift spoilers refused to deploy?

It was another case of misguided safety interlock. IIRC, they landed 20 knots
fast because of storm conditions; the brakes wouldn't go with too little
weight sensed, and the lift spoilers wouldn't go above a certain speed.
Catch-22!

------
dreamcompiler
I had expected this story was about a Rolls-Royce problem; their Trent 1000
engines are giving the 787 a bad name. But it looks like it was just a normal
software interlock that would never cause a problem during flight.

------
leowoo91
Well, Rolls Royce monitors those engines remotely and have access to their
logs afaik. So, it should be clear by now whether it has been called from
software or not.

~~~
metalliqaz
That's not true. A full investigation will be required to reconstruct events
from all data stored by the various Aircraft systems, including the engines.

------
anotheryou
why a shutdown and not a denial of going to reverse thrust in the first place?

or does it shut down when you open throttle in reverse thrust and allow you to
switch the engine configuration beforehand?

------
stephenr
Did anyone else find it odd that it took 40 minutes to get the plane towed
back to the terminal?

~~~
marcinzm
The article is a bit ambiguous to me about whether it was 40 minutes after
landing or 40 minutes after they failed to restart the engines. The former is
sensible to me since it'd take time for them to try to restart the engines and
make sure the plane is otherwise safe (probably some kind of checklist to do
as well). Some other articles on this explicitly say it was 40 minutes after
landing.

~~~
stephenr
I wouldn't call it ambiguous:

> The pilots followed their checklists and worked with maintenance personnel
> via phone to troubleshoot, but were unable to get the engines to relight.
> This left the aircraft stranded and led to the closure of the runway. A tow
> truck arrived some 40 minutes later to tow the aircraft off the runway.

~~~
marcinzm
It's ambiguous to me because the runway would presumably be closed as soon as
the plane got stuck and not after waiting for the engines to restart. So the
obvious reading of the sentence doesn't make sense.

------
redleggedfrog
Wait, what - Rolls Royce?! The same company that makes the some of the most
expensive and unreliable cars on the market? Boeing, Boeing, what were you
thinking?

------
sargun
How do you restart the Boeing 787 in mid-air? With the lack of an APU (they
use li-on batteries, I think?), what's the mid-air engine restart procedure?

~~~
stephen_g
The 787 does have an APU and a ram air turbine (RAT) as well as the batteries.

------
nabla9
It's likely software as they suspect.

Another possibility is that there was something wrong with the fuel.

~~~
mrguyorama
The young 777 had a vaguely similar situation that was caused by a fuel filter
freezing up

[https://en.wikipedia.org/wiki/British_Airways_Flight_38](https://en.wikipedia.org/wiki/British_Airways_Flight_38)

------
mensetmanusman
One engine should be iOS and the other Android to prevent simultaneous bugs in
the future.

------
laretluval
I hope people are beginning to understand that the presence of software in any
system is a liability.

~~~
anonu
I think software has existed in computer systems for 7 or 8 decades now - and
the pitfalls are well understood.

I think the problem is one of simplicity vs complexity. New systems today rely
on dozens - hundreds even - of packages and libraries - many of which are not
written by the implementer. How can you ensure reliability in all these
components?

This is why engineering from first principles - even in today's software
development environment - is important. Unfortunately, the trends are in the
other direction.

~~~
dmead
you would be wrong.

~~~
AnimalMuppet
That's not a very useful reply. Can you explain _where_ anonu is wrong? Can
you explain _why_? Can you give some _evidence_? A bare dismissal is like
five-year-olds arguing: "Did too!" "Did not!" It's not useful to advance the
conversation, and it's not effective at persuading people.

~~~
noir_lord
It's quite possible that software creates new failure modes (as programmers
I'm sure we all feel that to be true some days) while at the same time
preventing more.

When the software fails (if it did) we assume the software makes it more
dangerous because we have a concrete example of what happened but not what
could have happened in it's absence.

This is what may eventually stall self driving cars for many years, the first
time one does the PR equivalent of smashing through the local orphanage.

We as a society are notoriously poor at assessing systemic risks.

Now to address your point about evidence, I'm curious how you could control
for other confounding factors.

Airliners are safer today than ever before (based on passenger miles) but how
do you control for better engines, material science, procedures if you compare
say 1979 to 2019.

~~~
AnimalMuppet
Statistically? I don't know.

But I have a friend who's an airline pilot. He was telling me about hitting
windshear while coming in for a landing. The plane has software that not only
tells him that he hit windshear, but also tells him what angle to put the nose
at for best results. (The problem is airspeed. So you go to full power, but
pitching the nose _down_ also helps you gain airspeed. But the ground is down
there, because you're coming in for landing. What angle is the best? The
computer can figure it out and tell the pilot what to do.)

~~~
noir_lord
Aye, Things like that the G3000 (Garmin avionics suite for light aircraft)
that now do real time 3D terrain generation so that less experienced pilots
can avoid controlled flight into terrain (literally the way they describe when
a pilot in control smashes into a mountain).

My suspicion is that modern computerised avionics are on balance a life saver
but I'd love to know by how much.

I ended up watching videos of modern avionics in light aircraft on youtube a
while back (as you do) and I find that kind of programming fascinating,
couldn't find much out about the actual hardware/software side of things
though I did gather it runs a custom OS.

------
deugtniet
Is there something special about the software in new Boeings? Dual engine
failure is nothing to sneeze at, and should never happen. Airbus also had its
fair share of software errors in history, but if we count the recent Lion air
crash as software related, Boeing has had 2 serious software related incidents
in a year and I haven't heard anything serious from airbus.

Is it because Airbus started its fly-by-wire development earlier?

~~~
Xixi
The first Airbus FBW airliner was the A320, introduced in 1988 (31 years ago),
while on Boeing side it was the 777, introduced in 1995 (24 years ago). By now
I don't think it would make much of a difference, if any at all.

If anything quarterly reports to shareholders who only care about the very
short-term would be the culprit (or management teams whose bonuses only depend
on the next quarter revenues). But numbers are stubborn and don't tell that
story: the more recent the plane the safer it is. As such 787 and A350 are
probably the safest airliners currently flying, followed by 777 and A380.

~~~
markdown
> the more recent the plane the safer it is. As such 787 and A350 are probably
> the safest airliners currently flying, followed by 777 and A380.

I'd argue that a new model of an old plane like the 737MAX would be safer,
Lion Air incident notwithstanding.

~~~
SomeHacker44
Many actual pilots would likely disagree. Shoehorning vastly different planes
into the same type certificate can be dangerous. Convenient for pilots due to
certification and recurrency issues, but not necessarily a good idea.

Do you really want a pilot to jump into a 737MAX who only ever flew the -100?
I bet the memory items are very different if not also all the speeds and
weights.

(NB: jet pilot, not Boeing airliner pilot though)

------
onewhonknocks
I'm not sure this is a bug. It sounds like pilot-error to me (I am not a
pilot):

"In the bulletin, Boeing said that selecting full reverse too quickly upon
landing before the aircraft has fully transitioned to ground mode could cause
the system to activate."

~~~
samfisher83
There should be manual override. What if this happened in-AIR?

~~~
opwieurposiu
You really, really do not want the reverse thrust to turn on in-AIR. That
would be way worse then then engine shutting down.

~~~
samfisher83
I don't mean specifically reverse thrust. I am saying features such as this.
The Pilot expects something and computer does something else.

~~~
sbradford26
There are usually failsafe modes that disable most of the additional software
features. It is pretty rare though for pilots to switch into those modes
though since those features are what fly the plan a majority of the time.

It is like the issue that are running into with self driving cars, there is a
point where the flight controls become so good that pilots are less likely to
intervene when something is going wrong.

