Well, yes, but I was referring to how the folks making the ETOPS AD decisions were viewing that event at the time in the context of everthing else going on with the 787 Trent at the time. That event was not what drove the ETOPS restrictions.

Considering that I was personally responsible for certifying TCMA on the 747-8, the constant sarcasm/criticism is getting pretty close to being personal.
Hans has already crossed that line...:mad:

So, was definitely not trying to get personal, your input on these forums is very much appreciated by me.
It definitely sounds like B took the right approach with the amount of inputs to prevent problems here.
I was just pointing out that there have been a few times were B could have done better, specifically on the 737. The THY crash in AMS happened because the pilots were asleep AND because the AT only looked at one RA input. B could have taken the hint, and not have changed from the original MCAS on the KC-46 that used both AOAs to use only one AOA on the 737. Getting a stick-shaker on one side because that side has a failed AOA??? Maybe I should not have commented on this specific issue, but B has had a thrust reverser deploy in the air, with a subsequent design change, and it looks like it might have to do some work on MCAS for the 737. I am on the A320, and there is a LOT of things I wish were done the Boeing way*), but having a vote between 3 systems for most things is a plus.


*):
-side-sticks not interconnected
-throttles not moving
-VNAV not arming
-can't update descend profile after TOD
-will disregard restrictions on the arrival because it "thinks" it's on the approach
-ASO

That is serious software verification.
So while it would be interesting to understand the details of the 787 runway shutdown, we can at least be pretty confident that it does not translate to an in flight probability.

And so will changing from config 3 to full and back, and numerous other hacks. So if the system is capable of recalculating why not make it available directly without having to re-enter data?

Why can't I update my descent speed without re-cruising??

Agree that anything may happen, but in fairness, the safeguards Tdracer enumerates for TCMA seem adequate to push the failure probability below that of both engines falling off.

OK, fair enough (I was in a bit of a bad mood last night anyway - had to take the dog in for surgery yesterday and I was rather stressed about the whole thing).
But you need to keep in mind that the redundancy is always connected to the perceived system criticality. The autothrottle was always intended as an aid - not a flight critical system - and there are a number of single failures that can adversely affect the Autothrottle functionality. That's why pilots need to be trained that they need to monitor the system and not just assume it'll do the right thing (and shame on any training program that does not emphasize that fact). Just a few examples, pre-FADEC, is was not particularly uncommon for high downstream cable loads to overwhelm the clutch and cause one throttle to not move (or not move as much) - and even with FADEC, if someone drops something like a pencil down in the throttle quadrant, it can restrict a throttle. On the 747, 757, and 767, the autothrottle drive is a single worm gear - if that gear fails the autothrottle can't move the throttles. As a propulsion guy, we never assumed the autothrottle would always work properly - it made our job harder but we designed for it. The pilots needed to be trained for it as well (I was told that the 787 A/T was designed as a flight critical DAL A system - a first for Boeing Commercial, but I don't know details).

All the issues with MCAS trace back to one simple mistake - MCAS was not determined to be a flight critical system. While this appears incredibly dumb with 20-20 hindsight, it was assumed that an MCAS malfunction was no worse than major and it was designed as a DAL C system. Using a single input for a DAL C system is very normal and acceptable. It's only after people died that it was realized MCAS was flight critical and needed to be designed as such with appropriate levels of redundancy.

Well, Lauda 4 operated by a 763 also had a thrust reverser deploy in 1991 and Boeing claimed it was possible to recover from it.
Only Niki Lauda offering to test such a situation himself bought about an admission.

https://en.m.wikipedia.org/wiki/Lauda_Air_Flight_004

Wiki is far from an authority. I was personally involved in the investigation, and early on it was believed to be recoverable. Boeing did test an in-flight deployment during the original 767 certification flight testing - and it was controllable (at ~200 knots and the engine at idle). Early on, Niki did try it in the simulator and agreed it should have been controllable - however what was programed in the simulator didn't accurately represent 'real world' when a reverser deployed at Mach 0.78/23k/max climb power.
It took months of investigation and wind tunnel testing to understand why it wasn't controllable - after which Boeing added the third lock. I was part of the wind tunnel testing of what a hi-bypass wing mounted engine could do if it deployed in-flight with the engine at high power. I'll always remember the aero S&C guy during the testing - he was rather arrogant and before we'd started he was positive that it was controllable - even volunteered to go on a flight test to test the exact Lauda scenario. But after we started testing and he examined the data, he started getting real quiet, and by the time we finished up he wouldn't talk to most of us. Last test we did was a flow visualization using hundreds of yarn tufts. It was frightening to witness - with the engine at power, the reverser efflux basically blanked out most of the upper surface of the wing on that side. The wing would have dropped like a rock.
What's not commonly known is that when the FAA/JAA went to Airbus and wanted them to add a third lock, Airbus refused, claiming that it could never happen with their system. Until it did. They very nearly had their own Lauda - they were fortunate that the reverser re-stowed and the pilot was barely able to regain control and save it.

Maybe a dumb question but to what incident do you make reference ?

Korean A300, November 1998.

Blade fracture
 

https://www.flightglobal.com/news/ar...-blade-460649/