The SDU Re-logon: A Small Detail That Tells Us So Much About the Fate of MH370

MCS 6000
The Honeywell/Thales MCS6000 Satellite Data Unit is the middle of the three boxes shown here.


One of the peculiarities of the MH370 mystery is that, while we have only a very small handful of clues about the fate of the plane, some of them often get overlooked due to their highly technical nature. Today I’d like to revisit a topic that I’ve touched on before but which I feel continues to be get short shrift: the re-logon of the  MH370 Satellite Data Unit, or SDU. Just on its own, this little data point tells us a great deal about what happened to the missing plane.

First, some basic background. Flight MH370 took off from Kuala Lumpur International airport at 16:42 UTC on March 7, 2014 bound for Beijing. At 17:07:29, the plane sent an ACARS report via its satcom. At 17:20:36, five seconds after passing waypoint IGARI and a minute after the last radio transmission, the transponder shut off. For the next hour, MH370 was electronically dark. The next ACARS transmission, scheduled for 17:37, did not take place. At 18:03 Inmarsat attempted to forward an ACARS text message and received no response, suggesting that the satcom system was turned off or otherwise out of service. At 18:22, MH370 vanished from primary radar coverage over the Malacca Strait. Three minutes later the satcom system connected with Inmarsat satellite 3F-1 over the Indian Ocean and inititated a logon at 18:25:27.

The question is, by what mechanisms could MH370’s satcom have become inactive, then active again?

Logging on and off the satcom is not something airline pilots are trained to do. A pilot can deselect the satcom as a mode of transmission for ACARS messages so that they go out over the radio instead, but this is not what seems to have happened in the case of MH370. According to the ATSB report issued in June of 2014,

A log-on request in the middle of a flight is not common and can occur for only a few reasons. These include a power interruption to the aircraft satellite data unit (SDU), a software failure, loss of critical systems providing input to the SDU or a loss of the link due to aircraft attitude. An analysis was performed which determined that the characteristics and timing of the logon requests were best matched as resulting from power interruption to the SDU.

Like most of us, I’d never heard of an SDU before MH370 happened.

It’s a piece of equipment which processes the signals that are transmitted and received between the plane and the satellite network. The SDU lives above the ceiling of the passenger cabin, toward the back of the airplane, near the rear emergency exit. The reason it’s there is that in order for it to work efficiently, it needs to be located as close as possible to the satellite antennae, which protrude from the top of the airplane just above it. Imagine an electronic version of an old-timey ham radio operator sitting underneath a radio tower. Bear in mind that the SDU doesn’t generate information per se; it’s just providing the link between the aircraft and the satellite. A useful analogy is to think of your smart phone. When you turn it on, it connects to the cell network, but it doesn’t communicate with anyone until you send a text message, make a phone call, or activate an app.

The SDU is a very important piece of equipment in the MH370 saga because the seven pairs of BTO and BFO values, which together comprise all that we know about the final six hours of the flight, depend on computations carried out in the SDU.

How could the SDU power interruption have occurred? For one thing, it couldn’t have happened accidentally. Independent researchers have spent months trying to figure out a way that the SDU could have logged off and back on again without human intervention, without success. So it must have been intentional. However, there is no on/off switch for the SDU in a 777 cockpit. A person wanting to turn the SDU off has two options. The first is to descend into the electronics and equipment bay (E/E bay) through a hatch at the front of the first-class cabin and flip three circuit breakers located there. I call this the “easy way.” The second method, which can be accomplished directly from the cockpit, is to isolate the portion of the plane’s electrical system which feeds the SDU, the left AC bus. I call this the “hard way.” Since it’s quite complicated, I’d like to discuss it in greater detail.

According to IG member Barry Martin, the left main AC bus can receive its electrical power from any one of four sources:

  • left main engine IDG via a left generator circuit breaker
  • right main AC bus via both left and right bus tie breakers
  • auxiliary power unit generator via an auxiliary power breaker and the left bus tie breaker
  • backup generator converter which connects to the left transfer bus via a left converter circuit breaker, and the left transfer bus connects to the left main AC via a left transfer bus breaker.

In order to prevent any of these from supplying electrical power, Martin writes, a multi-step process is required:

The left IDG can be disconnected in a couple of ways via the flight deck electrical power system control panel. The preferred method would be via the left generator control switch. The second method is by use of the guarded drive disconnect switch, which permanently disconnects the IDG and the connection can only be remade on the ground. The L GEN CONT switch will open the left generator circuit breaker, but the left bus tie breaker would then automatically close to re-energise the left main bus so the left BTB must be switched to ISLN on the electrical control panel before attempting to disconnect the IDG.

The left main bus can still be powered from the left transfer bus which picks up power from a solid-state variable-speed constant-frequency backup generator converter. The easiest method of preventing this is by simply opening the left transfer bus breaker, which allows the left transfer bus to remain energised to ensure the left transformer rectifier unit stays powered. However, I don’t see an option on the flight deck control panel to manually open the left transfer bus breaker. A second option would be opening the left converter circuit breaker, connecting the left transfer bus to the backup generator. Again, there’s no L CCB switch on the panel. Therefore the third option is to switch both backup generators off, which is possible via the panel.

This explanation is somewhat above my paygrade but my takeaway is that isolating the left AC bus requires some technical savvy—indeed, technical savvy beyond the ambit of 777 pilots. When I asked Patrick Smith, a 777 pilot who is one of the most well-regarded aviation commentators in the US, about the SDU reboot, he replied, “The what?” After I explained, he answered: “There isn’t a 777 pilot alive, I’ll bet you, who has the remotest clue as to what the SDU is.” I’ve brought up the topic with many other 777 pilots I respect and have gotten essentially the same response.

I would add that while it seems clearly possible to power the SDU on and off my isolating and then reconnecting the left AC bus, to do so would be a risky undertaking. In a fascinating blog post on an airline pilot who goes by the handle “Ken” describes going through a simulated left AC bus failure in the course of a training session. He notes that among the systems lost were Window Heat (Left) and a Primary Hydraulic Pump (Left). “No biggie,” he writes, but adds that in addition:

…there are a whole host of ancillary services lost. Many of these are reflected by the amber lights on the overhead panel. Having looked at the roof – you later discover even then that it’s not the whole story. In this particular scenario we decided to return to KLAX. Part of the return process was fuel jettison down to maximum landing weight. Guess what? Without the Left Bus – the main tank jettison pumps are failed. You’ll be advised of this… when you start the fuel jettison. I didn’t give this a second thought… but the discussion we had afterwards that included a talk about this little quirk of the Boeing EICAS/ECL was interesting. There are no EICAS/STATUS messages to advise you of everything you’ve lost, and in many cases, until you attempt to use something that’s failed – you won’t know about it. Older aircraft used to publish a Bus Distribution List (Electrical and Hydraulic) so that you’d know exactly what you’d lost with a particular electrical bus failure – but not on the 777. My fellow pilots were vaguely disturbed by the lack of information.

It’s not impossible to imagine that one of the pilots cooked up a plan that involved switching off the satcom by isolating the left AC bus, but to do so they would have had to do intensive research into the issue, without any way of knowing if their research was complete. “ It can be difficult to find out just what equipment is powered by a particular bus,” says Smith, “so if you start isolating buses you’ll likely wind up shutting down things you don’t mean to or expect to.” All told, this would be a complicated and risky strategy.

And to what end? Why would anyone want to depower the SDU anyway?

One might imagine that the SDU was powered down for the same reason that the other forms of electronic communication were shut down around the time MH370 reached IGARI: to slip away from ATC surveillance in order to pull a 180 and slip away undetected. One doesn’t need to depower the SDU to go dark, however.  If the satcom was deselected for ACARS and the IFE was switched off (both of which are easily accomplished from the cockpit) then there would be no reason for a pilot to fear that the satellite would give away his position.

Some have raised the possibility that whoever took MH370 didn’t want to turn off the SDU per se, but wanted to turn something else that was on the left AC bus and wound up taking the SDU along with it as an uintended consequence. If so, the crucial question then becomes: What else is powered by the left AC bus? It wasn’t easy to find out, but after months of painstaking digging, a number of independent researchers were able to collectively determine that some of the other systems fed by the AC bus are:

  • TCAS (Traffic Collision Avoidance System)
  • Cockpit door lock
  • The centre tank override and jettison pumps
  • Some galley equipment
  • IFE (in-flight entertainment system, which includes passenger satellite phone service)
  • One of the high-frequency radios
  • The main passenger cabin lighting system (the night, cabin and cross-aisle lights remain powered)
  • The Cockpit Voice Recorder (CVR)

There is only one piece of equipment on this list that someone who is in the process of stealing a plane might be strongly motivated to shut off, and that is the cockpit voice recorder. Recall that in December, 1997, the pilot of Silkair Flight 185 apparently got up out of his seat and pulled the circuit breakers for the CVR before returning to the cockpit and flying the plane into the ground. Because the CVR wasn’t working, investigators couldn’t tell exactly what happened in the cockpit in the moments before the crash, so the pilot’s guilt was impossible to establish conclusively. Which presumably was the point.

The idea that MH370’s pilot isolated the left AC bus in order to shut down the CVR is problematic, however. For one thing, it would be far simpler to depower the CVR the “easy way,” by going down into the E/E bay and pulling the circuit breakers. But maybe the pilot had locked the co-pilot out of the cockpit, and so wasn’t free to leave to go down into the E/E bay? In that case, isolating the left AC bus would have had the reverse of the desired consequences. Anyone savvy enough to know how to depower the left AC bus would also understand that the CVR over-writes itself every two hours. Therefore cutting power to the CVR would result in the preservation of the recording of whatever was said and done when the pilot talked the copilot out of the cockpit and locked the door.

Of course, if the pilot planned to fly the plane six hours into the middle of the southern Indian Ocean, he’d have no reason to shut down the CVR anyway, since its contents would be come erased during the long flight into oblivion.

To sum up, the fact that the SDU logged back on with Inmarsat three minutes after leaving primary radar coverage is one of the most significant clues that we have to the fate of MH370. By itself, it rules out the possibility that MH370 went dark due to fire or electrical malfunction (which remains a popular theory despite being impossible for several other reasons as well) and it strongly suggests that the plane was not hijacked by one of its own pilots for the purposes of committing suicide (another popular theory). Instead, the SDU re-logon suggests the plane was taken over by a passenger or passengers with a sophisticated knowledge of aircraft electrical systems.

This may well be one of the reasons that the French judicial authorities are treating MH370 as a terrorist investigation.

131 thoughts on “The SDU Re-logon: A Small Detail That Tells Us So Much About the Fate of MH370”

  1. Trond,

    I don’t know, at what time during the flight were their phones still connected to the Chinese social chat apps do you think? There is still no concrete proof I know of that Fariq’s cell connected (shelved item here) though, it’s never been proven or verified officially, only some “unnamed official” source stating it with CNN using it. Zaharie’s phone was only active in the What’s App until about 7:30 pm I think his brother-in-law stated.

  2. Oh boy, Zaharie’s on What’s APP until only 7:30 yet Fariq’s cell supposedly (shelved item really) connects to a tower circa 18:00, the Chinese are on Chat Apps, yet Phil never calls Sarah from his seat as usual? What to make of it all? More Who’s on First……..

  3. ROB,

    Your arguments do not worth a penny.

    Re: “flying carefully along an FIR boundary”.
    Where did you get it from? They could do it a way more accurately if they needed.

    Re: “at the same time maintaining cruising altitude”

    You are confusing this with the assumption made by IG and ATSB. There is nothing to support it. Moreover, the radar data and BFO data 18:25 cluster indicate the opposite.

    Re: “maintaining radio, ACARS silence and with radar transponder switched off”

    How do you know they were switched off, but not damaged? It is just your assumption.

    Re: “with navigation systems functioning normally”
    How do you know?

    Re: “you’re definitely backing a looser there.”
    Remains to be seen.

  4. Rob / Oleksandr / Trond,

    Rob,in Oleksandr’s defense, how do we know for sure navigational systems were functioning “normally” if what Victor suggests is the reboot of the AES could have been caused by a restoration of navigational data to it?

    Trond, I still see a slight possibility that acting “non aggressively” the FIRs and all, could be a life-saving endeavor.

    I have to agree with ALSM on this right now, this still has the potential of being several things. And I’ll say it again though, Jeff could be right, it could be a hijacking against our aviators. Jeff bears the title of Aviation Analyst for a good reason.

  5. @Matty I am rather hoping that perhaps the involvement of the French judiciary will lead to pressure being put upon the Malaysians to be more forthcoming in terms of their criminal investigation. In Malaysia, there is a unitary command structure, with no separation between the civil (JIT) and criminal (RMP) elements of the investigation. In France, it ain’t the way they work. Thus my questions to Jeff.

  6. Rand,

    Let me be the third to welcome you back albeit very belatedly. Please stay this time, convince your better half you are needed here. Sorry so late in this but have a lot of “stuff” going on personally, and it’s Triple Crown season and trying to work full time and keep up here. Yikes!!!!!!!

  7. @cheryl

    the nok told the media and showed them after they had been briefed about the disappearence.

    We were told that there are no mobile phone coverage out there. this should also mean no internet coverage. as far as im aware there shouldnt either, and yet a few chinese passengers were still logged in on a social chat app. They were however not typing anything after igari.

  8. A “hijack” yes. The passengers were checked and none possess the knowledge to even fly.

    What i suggest happened is so far out there that two things can be used as evidence to the public.

    One: does the french still have the flaperon.

    Two: the black box, a rectangle shape from the hull the 2x 3x size of the flaperon might be down in the sand. Yes sand and nothing solid.

    The hull itself im not sure about.

  9. I think how it happened has to do with something almost all people are not aware of. The ancient people knew about it. The scientists of today knows about. It is a technology that is progressing and will take more and more parts of our lives, as entertainment, in jobs, etc. We all live in it. I will stop there.

  10. @Rand, Florence de Changy has reported that the French terrrorism judge traveled to Malaysia to meet with the Ministry of Transport investigators, it’s not clear if anything became of it.

    @Oleksandr, Technical failure has never been a serious option, even from the very early days. The whole disappearance began mere seconds after the plane passed IGARI. The plane was actively flown at top speed, at high altitude. It possessed the means to communicate with the ground but didn’t use it. The SDU turned off, then logged back on. Finally, the failure of the seabed search, now officially confirmed by the leader of the search himself, clearly indicates what I wrote here over a year ago: the plane was actively piloted until the end. You can plausibly attempt to litigate any one of these points, but taken together they present an extremely robust weft of evidence: MH370 was not an accident.

    @airlandseaman, There are two problem-solving approaches I see applied to MH370. The deductive approach is to use whatever means available to search out new data, and then critically assess it to refine one’s understanding of what might have happened. The alternative approach, what I called the “IG approach,” is to sit passively until someone else comes up with new data, and then use one’s imagination to dream up possible ways that the data might not be valid, and then explain away whatever inferences others are attempting to draw from this new data. The advantage of the IG approach is that allows one to maintain the comforting illusion that one’s initial beliefs remain tenable. The disadvantage is that it blinds you from noticing the gradual accumulation of evidence that you are indeed wrong. Indeed, this has now happened: Dolan’s admission of failure in the seabed search is a repudation of the IG’s stance.

  11. @Jeff: the more or less straight-line, cruising speed path followed by glide then ditching scenario still hasn’t been ruled out by the underwater search.

    As for the barnacles, no definitive conclusions can be deducted from them. There predators and mechanical abrasion can explain their youth/absence.

    The one peer-reviewed paper I am aware of that attempted to use barnacles for forensic purposes was careful to phrase it’s conclusions in terms of a minimum time at sea. That is, if a barnacle is 6 months old (or whatever) you can deduce that the object has been at sea for a minimum of 6 months. It does not logically follow that it has been at sea for a maximum of 6 months. That which we cannot say, we must pass over in silence.

    As for the tsunami debris, the photo albums you linked to a long time ago do not show a definite pattern of barnacle colonization. Of the high-res photos, fully half of them do not show obvious signs of barnacle colonization. I also separated out the ones with kanji markings that prove they came from Japan, and half of those objects did not have barnacles either. And it was not just the smooth buoys either that lacked barnacles: things like plastic pallets supported barnacles in some pictures, but not in others.

    Until the straight-line, glide theory is falsified by a thorough underwater search, it would be premature to entertain more speculative ideas.


  12. Well, of course there is no harm in pursuing any line of thought to see where it goes. The harm is when the better, more parsimonious theory get discounted.

  13. @Warren Platts, I am completely in agreement. The murder-suicide ditch scenario, which Martin Dolan appears to be putting forward as the ATSB’s “Plan B,” is still in play. As I disagree with you in your assessment of the barnacle evidence (SDU re-logon interpretation as well, presumably) then I have a different opinion as to which theory is better and more parsimonious.

  14. Dennis,

    Here is extract from the link you posted:


    Pilot Error: 32%
    Pilot Error (weather related): 16%
    Pilot Error (mechanical related): 5%
    Other Human Error: 6%
    Weather: 12%
    Mechanical Failure: 20%
    Sabotage: 8%
    Other Cause: 1%


    Pilot error can obviously be ruled out. The next top reason is a mechanical failure – 20%. What you suggested (political statement) falls into the ‘Sabotage’ and ‘Other’ categories – total 9%. So, what cause is more likely based on this statistics?

  15. @Jeff

    I have tried hard to understand the IG and SSWG problem solving approach. This population includes some really smart individuals, so it represents an interesting case study to me. The rejection of the consideration of motive or causality is what I am referring to in particular. The ISAT data, which is really the only hard data we have, is not deterministic. One cannot use it to reliably predict a terminus.

    Cut and paste from Wikipedia below:

    In U.S. criminal law, means, motive, and opportunity is a common summation of the three aspects of a crime that must be established before guilt can be determined in a criminal proceeding.

    end cut-paste//

    Using the ISAT data as a qualifier, that is a means to eliminate possibilities, is about the limit of its usefulness. Frankly, the drift studies and bioforensics (broad as they are relative to determining a terminus) are more useful than the ISAT data. Excluding the consideration of motive is a huge error IMO, and has resulted in the waste of a great deal of time and money.

    Getting back to the behavioral theme above, my early metaphor of “law of the hammer”, is still my best guess as to the underlier for the IG and SSWG approach. Another cut and paste from Wikipedia below:

    “Maslow’s hammer, popularly phrased as “if all you have is a hammer, everything looks like a nail” and variants thereof, is from Abraham Maslow’s The Psychology of Science, published in 1966. It has also been called the law of the hammer, attributed both to Maslow and to Kaplan.”

    end cut-paste//

    From time to time I am guilty of crude and rude posts directed at IG members. I would also direct these comments at SSWG members if I knew who they were. It is simply my frustration bubbling to the surface. Now that I am certain the aircraft will not be found, I am past being frustrated.

  16. @Oleksandr

    Good point. 🙂

    Actually the circumstances surrounding the event – piloted behavior, continuation of flight, and lack of communications lower the 20% to much less than 1% (my deduction). So we are looking at a “sabotage” event being >> 10x more likely than an aircraft failure.

  17. Jeff,

    Yes, your points are arguable.

    Re: “Technical failure has never been a serious option, even from the very early days.”

    It actually was. Landing attempt at Langkawi or Penang, for example.

    Re: “The whole disappearance began mere seconds after the plane passed IGARI.”

    It was also shortly after the aircraft reached the cruising altitude, though I admit that pressure-related accidents typically occur from 15 to 25 min in flight.

    Re: “The plane was actively flown at top speed, at high altitude.”

    There could be a reason to return to the mainland asap.

    Re: “It possessed the means to communicate with the ground but didn’t use it.”

    How do you know this? How do you know they didnt make attempts, and that SDU logon 18:25 is not a result of these attempts?

    Re: “Finally, the failure of the seabed search, now officially confirmed by the leader of the search himself, clearly indicates what I wrote here over a year ago: the plane was actively piloted until the end.”

    No, this is only one possibility. The most likely reason is that either mode of the flight was different, or FMT did not really occur between 18:25 and 18:41. For example, if ADIRU fails, the flight could not continue in LNAV or TRK HOLD modes. It could continue in HDG HOLD, but after manual input of magnetic heading. Why would you expect LNAV, HDG or TRK hold if a technical failure took place? That is a reason why I am interested whether FMC is also powered by the left bus. If yes, and if the left bus was depowered, the plane could not navigate by waypoints.

    The door-related issue indicates to me that such a hijacking could not be performed solo, and requires a team posessing high-tech knowledge. This makes it less likely. On contrary, inability to jettison fuel and that the door would be unlocked support mechanical failure.

    In summary, I don’t see any reason to rule out mechanical failure; on contrary, all the facts you listed are consistent with it.

  18. Dennis,

    When you consider particular circumstances, it is equivalent of splitting the “mechanical failure” bin into several bins. Likewise, if you consider politically-motivated sabotage within the “sabotage” group, its probability would be <<8%.

  19. @oleksandr

    Just because it flew towards airports doesnt mean it tried to land. It could still communicate. It could still turn the transponder back on. It just flew by. More clues id say. Also no lights could be seen up in the sky from mh370.

  20. There will be no more witnesses saying they saw mh370. The oilrig worker, maldives, the woman in the boat is it.

  21. @Oleksandr

    The fact that you are considering mechanical causes is positive IMO. We just have different a differing calibration relative to likelihood. No biggie.

  22. Trond,

    Re: “Just because it flew towards airports doesnt mean it tried to land.”

    Likewise the fact it flew along FIRs does not mean it tried to stay unnoticed.

    Re: “It could still communicate.”
    How? And how do you know this?

  23. @oleksandr

    It flew along firs to not get contacted. That plane flew like it needed to get away, not to land.

    I know there were no technical errors. Sdu had nothing to do with errors. Everything points to what did not happen. Rolls royce and boeing knows the plane had no malfunctions.

  24. @Freddie: Thank you for the details posted May 17, 2016 at 1:13 AM.

    Based on the times at the waypoints the following groundspeeds are obtained:

    BEDAX – ISBIX 388 kt
    ISBIX – YPCC 373 kt
    YPCC – YPXM 371 kt
    YPXM – 0:11:00 300 kt

    Using those speeds between waypoints and the actual times at the pings, the arc crossing positions are shown here:

  25. In my last post, for “arc crossing positions” read “positions at the actual times of the pings”.

  26. @Trond Posted May 16, 2016 at 9:15 AM
    “.. I have reasons to sound like a maniac”
    Rest assured, a silent majority strongly value your inputs and no Attack Dog should take you down.

  27. @Cheryl said, “Your #5 is intriguing, the ‘software initiated manual reboot’ with no power loss, which is what I have been saying that the AES/SDU never was off, but how are they getting into the Classic Aero software system, what holds this non-volatile memory the software or the AES/SDU unit itself?”

    Ruben Santamarta has shown how vulnerable SATCOMs are. From my paper on the possibility of a BFO spoof, I wrote:

    Ruben Santamarta, a security consultant associated with IOActive, studied the potential for the malicious attack of SATCOMs. In a landmark white paper entitled A Wakeup Call for SATCOM Security, he studied the vulnerabilities of SATCOMs offered across many sectors, including maritime, land communications, industrial control, civil aviation, and military, and presented his results at Blackhat 2014. His method of study was to obtain the firmware for the SDU and then reverse engineer (disassemble) the code using an Interactive Disassembler (IDA). Santamarta found that every SATCOM he studied had vulnerabilities that could be exploited by hackers.

    To be clear, Santamarta did not study the Honeywell Thales MCS series of SATCOMs, although the Cobham Aviator 700, which offers Classic Aero service like the MCS-6000 on MH370, was part of the study. For the Aviator 700, he found backdoors, a weak password reset, insecure protocols, and hardcoded credentials. He discovered a backdoor that could be entered through the Multi-Controller Display Unit (MCDU) in the cockpit that would allow parameters to be changed and the SDU to be rebooted. A similar method might have been used to alter the inclination parameters stored in the non-volatile memory in the SDU of MH370.

  28. Thanks, Jeff. It would be interesting to know of the names or at least the titles of the Malaysian officials in the company of the Transportation Minister when he met the French terrorism judge. Ten bucks says that the Malaysians kept the discussion on the civil side of the fence, and that the Chief of the RMP was not present at the meeting.

    On another note, while there certainly are a number of highly sophisticated hijacking scenarios that are plausible, I am beginning to be of the view that the analyses of the various systems of the aircraft in the search for clues has itself led many to mistakenly believe that a hijacking would have had to been perpetrated by a crew with advanced technical capabilities. To this, I would bet another ten bucks that some of the people here have even bigger brains then they themselves imagine, and that theirs would quite eclipse the domes of the hijackers.

    Switches, buses, waypoints: the cockpit of an aircraft is a user interface, basically, with its highly sophisticated systems technology having been hidden away behind a pretty green curtain by its likewise highly sophisticated designers. The pilots (or hijackers) are not there as technologists; technology is already present in abundance. Rather, what pilots actually bring to the flight deck is their trained, intuitive subjectivity – the instincts of a pilot. A cockpit of 777 is ergonomic and designed specifically to tolerate human error; it’s not the Large Hadron Collider.

    In the wine-making business, there is something called a “cellar nose”, which is when you have spent so much time in your own cellar that you fail to notice that your carefully crafted wine has turned to cat piss. I would suggest that at least some of us raise our noses out of the schematics and acknowledge the fact that a low-tech hijacking (e.g., a gun in an ear) is likewise far from being off the table.

    @Cheryl Very kind of you, thank you.

  29. @All, Thanks for your contributions. I’m closing the thread here, please add your comments to the newest post, cheers.

Comments are closed.