Actually, yes. There's the MMPI, there are standard tests for conditions like Alzheimer's, and many others. These tests have reasonable - not perfect, but useful - correlations with observable and reported behaviours.
I'm not aware of any specific tests for suicidal ideation, but the FAA explicitly disqualifies pilots diagnosed with bipolar disorder, and other personality disorders are cause for concern.
I don't know if carriers include other checks. IMO it would be weird if they didn't - but I'm not a carrier.
My guess is that if it's aggressive suicide there will be some high-stress triggering incident in the recent past - debt, blackmail, a weird sexual history, a relationship breakup, or something of that ilk. Possibly even a very negative work review from an insane boss.
If there's nothing at all, that would be very strange and unusual.
From my memory of taking my 3rd class medical its trust based, if you don't have a written record in your med file of mental problems or tell the doc you have problems then there's no way for them to know.
Also from memory a 1st class was pretty much a 3rd class with stricter limits and an electrocardiogram which is why it costs microscopically more. At least in the old days if you got a 1st after it expired, it acted like a 2nd for the remainder of the year, and a 3rd for the next year, but a 1st cost more, so I didn't bother (not expecting to achieve ATP cert within 6 months of my solo LOL)
Crudely and inexactly but more or less true, you need a valid 3rd to be a general aviation pilot, a valid 2nd to haul cargo or be a bush pilot, and a valid 1st to work for an airline. Things will be slightly different in Germany but less different than you'd think... we have trust agreements to allow them to fly here and us to fly there so things are vaguely similar but it doesn't matter if my details are slightly off.
Finally you have to be realistic. If 25% of the population experiences a mental health issue at some point in their life or whatever ridiculously high percentage, then given the huge fraction of the population flying with issues, issues obviously almost never cause a problem, its right up there with meteor strikes. So you end up with false positive/negative issues. If you assume all men have been dumped by a girlfriend at least once that means roughly 3e9 false positive if you assume all dumped dudes are going to mass murder an entire airplane, a false positive rate of eight nines I think? That idea would be up there with banning German pilots, after all one of them apparently did kill a lot of people and the false postive rate is staggeringly lower than banning all people with mere claustrophobia or a bad attitude or whatever.
Could a rise in this sort of accidents (4 in 20 years, unheard-of before) mirror the rise in number of pilots, and the parallel loss of social status? As flying becomes "just another job", you will naturally get a normalized number of whacko pilots.
Rather than banning what we cannot see, maybe we should just start seriously considering scenarios where one pilot is a malicious actor.
Was it actually less common before, or just less noticed?
Air travel used to be substantially less safe. Improvements in safety have all but eliminated crashes due to mechanical failure, weather, mid-air collisions, etc. They've done nothing to prevent crashes due to rogue pilots, though. If the rate were constant, they'd be much more visible now because they'd make up a much larger proportion of the much smaller number of crashes.
I am not a pilot, but my father was and I have a brother who is. When my dad flew, up until the early '00s and past the WTC attacks, there were only yearly medical exams. No psych exams. Like many other pilots, my brother is an alcoholic, and this has given him trouble with some airlines, so he has taken jobs in the Arab world and east Asia (we're Mexican, from Mexico). As far as I know, the airlines have never offered him direct help for his alcoholism.
Btw, my brother knew some details about the accident before they were public news, I assume there must be some pilot grapevine where more details about the accident must be shared. Like I imagine most other pilots must be, he's very shaken by the incident. It's a matter of professional pride amongst the pilot community, I assume.
My father would sometimes be called as an expert witness for blackbox analysis. As a child, I remember him falling into deep depression whenever he had to do that, and he was always given a couple weeks' vacation time whenever that happened.
Your brother is an alcoholic in recovery, or a 'functioning' alcoholic? Don't the airlines breathalyse pilots before they fly? An old school friend who's now a commercial pilot told me they're not allowed to drink for 24hrs before flying. I guess if there are no actual checks they can ignore the rules til they get caught...
He's been... all kinds of alcoholic. He always was able to stop drinking two days before his flights, but I think he slipped once. I don't know if they breathalyse him. He doesn't like to tell me details about it. From what I can tell, he's doing better now.
Alcoholism is very common with pilots, though. This much I know, because I met many pilots through him and my father, and boy do they enjoy their drinks.
In my dad's time (he was "almost" a WW2 veteran, he was gonna fly on the second Mexican squadron, but the war ended before Mexico sent that squadron), being a pilot was comparable to being a movie star. So much prestige, so much partying. Some of that culture from the middle of the 20th century still lives on, and many pilots still, well, burn bright and burn fast.
I have a friend who is a senior pilot with a large airline, and the drinking/hazing/partying stories he told me from his younger years were eye-widening. They generally all try and stay sober for the pre-flight period, but outside of that, especially when not at home, boy do they party.
Not sure how much of that still goes on - a lot, I would guess.
Is there any good reason that auto-pilot could not be enabled to override suicidal actions of a pilot? Perhaps a system that requires input from both pilot and co-pilot to override?
What happens when a pilot has had a heart attack and there is only a co-pilot? Averting and intentional maneuver could also hamper the ability to fly the aircraft and given that these incidents, while they result in huge loss of life, are incredibly rare. As such the cost/benefit is not there.
I think auto-pilot already can override intentional actions of the pilot. It's my understanding that auto-pilot will prevent a pilot from many actions that would result in a stall?
Technically I believe the autopilot is a higher level in the system, and the anti-stall stuff (among others) is part of the lower-level fly-by-wire system. It's sort of like with a car and the difference between anti-lock brakes (fly-by-wire), cruise control (basic autopilot functionality), and autonomous steering to reach a certain location (advanced autopilot functionality).
In any case, you're right that the automation (by whatever name) can already override the pilot in many cases. But it's a really tricky problem because you can easily make things worse instead of better. For example, one reason that Air France 447 crashed was that one of the pilots was commanding the airplane as if it were in a fly-by-wire mode it was not actually in. The plane had already stalled, but he was flying it as if the computers would prevent him from stalling, rather than taking proper corrective action. A proper recovery maneuver would have saved it. This is ultimately pilot error, but automation is a strong contributing factor. For another example, Asiana 214 crashed because the pilot assumed the airplane was doing more for him than it really was, trusting the automation to keep his speed steady, which it wasn't set to do. Again, pilot error, but with automation as a contributing factor.
It seems likely that automation is a net gain when done right, but it requires careful consideration.
>What happens when a pilot has had a heart attack and there is only a co-pilot
The co-pilot flies. That's why there is a co-pilot.
(On really long flights there can be two co-pilots so that pilots can work in shifts, but medium-range flights like this can physically be flown by one pilot, two are there for safety).
"Co-pilot" is just a colloquial term for the first officer on a flight. Both the captain and first officer are "pilots" and both are fully qualified to operate the plane.
Newer planes are fully fly-by-wire, so you could build software to attempt to address the issue. The problem is identifying a suicidal action. A descent is not suicidal. There are many cases that make a sudden descent a life-saving procedure. For example, cabin depressurization. Alternately, an ATC could require a plane to descend rapidly to clear airspace for another flight that is disabled.
Now, consider that programmers make mistakes (even in aerospace) much more frequently than pilots decide to commit suicide. If a software system is given first-authority instead of a pilot you'll have more deaths due to the system than due to pilots intentional attempt to destroy a plane. The problem of suicidal pilots can be addressed by a number of known mechanisms, none of which jeopardize the safety of a flight. Pernicious problems of software quality are still incredibly difficult to address in any context.
I wonder, since the plane wasnt nosediving, it was descending, and the radars could probably detect that it wasnt descending to any place to land. Couldn't a remote operator stop the descent?
No. This is not Hollywood, and A320 is not a UAV. There's no option "hack into the thing and fly it from the back seat" (do I need to explain, here on HN, why a lack of remote control is also a Good Thing? "I've got the same combination on my luggage!")
It is extremely scary to me that you have to point this out to individuals. How does the reasoning process work for people who think like that? It must go something like "I can share photos with my mom on Facebook, so it must be possible to remotely fly a plane! #technologythatdoesntexistyet"
Oh, the technology exists, all right (UAVs), but nobody has been insane enough to use it for commercial aviation. So far - we might see a push in this direction now.
Its not like that at all. Planes are mostly fly by wire anyway today, so i m not sure why it would be harder to do that. You 're aware that drones fly remotely , right?
The question was not "why is this impossible?" but "why didn't someone remote control the GW flight"? Because, although all the required technological pieces are currently available, remote control is not actually implemented in any commercial aviation aircraft.
As to "why is it not implemented" - because it would create far, far more problems than it would solve, without a measurable benefit.
You statement is essentially just another way to say "it's just a small matter of programming"
All the technology exists for me to build a drone swarm to patrol my house constantly on the inside and out, deliver me a video stream, and to deter intruders with non-lethal force. That doesn't mean I just need to order the parts, assemble them, and use.
There is no off the shelf remote fly-by-wire for an Airbus A320 or any other passenger jet. Plenty of companies have done it as a one-off thing. This is for either testing UAV systems or using the plane as a crash test vehicle. This usually involves the same team of engineers that equipped the aircraft monitoring every single parameter in real time. The military has actually received criticism for conducting weapon systems 'tests' in this manner.
There is a huge difference between that and commercial operations of such a system. In a commercial environment, you can't have a team of engineers on constant standby. For planes flying for research purposes over unoccupied areas a high risk of total loss of control is completely acceptable. Commercial and military remote control aircraft all have systems that intentionally crash the vehicle if communications is lost and it leaves a designated area. This prevents potential loss of life due to mundane software bugs. You can't ethically build a system that intentionally crashes an airliner full of people as a response to a software bug.
Now you've just changed the scenario from "rogue pilot crashes airplane despite efforts of other pilot" to "rogue air traffic controller crashes airplane despite efforts of pilots."
Yeah obviously, the point is how to find the best compromise. It's not just for security, i m thinking of the unlikely scenario of pressure loss and the ability to maybe remotely bring the plane down or land it on the sea or anything.
Is it the case on all modern planes that a co-pilot could lock out a pilot? Is there any proposal or precedent for a key-code override on the door lock?
I may be mistaken but I believe airline cockpits were made to be able to lock out people from entering in the event of a terrorist activity to take over the plane. This was initiated after 9/11.
That is true. What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not. I'm certain these scenarios have been considered, and I'm sure the developers had very solid reasons as to why something like this doesn't exist (if it actually does not).
I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range", and if it does, why can't it take automatic corrective action and override the pilot?
There's a good chance someone commenting here has worked in this area and could provide a very insightful response.
> What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not.
I believe it doesn't (not an expert though), as it'll assume you've lost control of the airplane and will try to recover. However in this case the descent was at a fairly standard speed. But yeah the autopilot will not override the pilot if the airplane seems under control.
The design of cockpit controls could be directed by a number of things such as government regulations, manufacturer features, industry standards, airline or pilot lobby groups, etc. I bet we are going to hear a lot about airplane flight controls in the coming days.
If you allow flight software to override a pilot's decision, what happens when the plane's instruments malfunction? You could end up with a situation where a faulty airspeed indicator causes the flight software to nosedive the plane in a futile attempt to prevent a stall that isn't happening.
1. the legal responsibility lies with the pilot(s); therefore there always needs to be an option to override or even shut down the computer
which is partly caused by
2. computers and their programs are anything but perfect; computer-assisted issues are usually resolved by human input ("speed is 253...254...255...oh look we're actually moving backwards, now what?!" "now we fly manually, you dumb toaster, because we're obviously not in the situation you think we are.").
In other words, "take control completely away from people and give it to automatics" is a recipe for a far more frequent trouble than an unpredictable outlier event.
I think (2) is overrated. Software used in critical situations already detects faulty readings based on various models that simulate the range of plausible values. It's only a matter of time until they're vastly more accurate than humans - if they aren't already.
Of course they are - in most situations, and this is one of the things that makes commercial aviation so safe.
Except when something very unexpected happens (e.g. not all sensor malfunctions can be distinguished from a reading that's outside of the usual range, yet plausible); in such situations, automatics disengage and people need to step in.
In other words, you can only get so many reliability nines and still be profitable for mass transport (as opposed to, for example, Space Shuttle).
>why the plane allows a pilot to take a fatal action
The plane is acting on sensor information, hardware and software, which might be flawed. That is why the pilots always need to be able to do a manual override.
Take for instance the Air France 447 crash: the first problem was freezing of pitot tubes to measure airspeed. That alone would have messed up auto-pilot. Then, the not very experienced co-pilot flying the plane also reacted wrong, and then the plane came down; the captain did not start to correct things in time.
Nobody considered a terrorist suicide by flying the plane into a building until it happened. So they made the doors lockable so that nothing passengers did could get them into the cockpit.
During that they obviously didn't think that any pilot would suicide the plane by flying it into the ground.
All the while there is value in driving planes into the ground, it's an unwinnable solution.
The TV news discussed the procedure used in the US, a flight attendant waits in the cockpit for the pilot to come back (I imagine this is done elsewhere too, but they weren't clear about that).
In the best-case scenario, if someone in the cockpit wants to keep people out, it sounds like the security mechanisms provide a way to do for for at least five and a half minutes.
Thanks for the link -though I'm baffled why NYT seems to think when I double click I want the page to change zoom levels rather than highlighting the word I'm interested in o_0
edit: oh, they just make it impossible to select text at all... nice.
There is a procedure in which the lock is overridden in case of no-response from the cockpit; it's time based so it might take somewhere between 45 seconds to 5 minutes to get the door open.
If the inhabitant of the cockpit chooses to respond with a locking command (in the case of the A320, moving the door switch forward); the door will remain closed no matter how hard you try.
It's a question of your threat model. Do you worry more about the cases where someone getting into the cockpit is a problem, or someone not getting into the cockpit is the problem? You can make provisions for both, but your final layer of security can only target one or the other. If you have an 'ultimate override code', eventually an attacker compromises it (hell, it'd probably be 1234 on most planes). If you have an 'ultimate lockout', eventually the wrong person locks everyone out.
Germanwings did not have a policy of requiring a second person in the cockpit in situations where the captain leaves the cockpit. I imagine this is going to become fault standard in aviation from now on.
I wonder how much that would have helped in this case though.
Someone determined to crash a plane would not have too much of a problem incapacitating any cabin crew member (by surprise most likely) before his attempt. I believe that having a second person in the cockpit is more useful (and seemingly essential) if the Pilot/Co-Pilot loses conciousness in order for the door to still be opened.
It's not an absolute solution, but it makes such a crime both psychologically and physically much more difficult. Turning a knob is impersonal and easy, but killing someone with your hands is neither.
> Killing someone is extremely easy if the other person trust you. You get behind her and hit her with a heavy object in the head or in the nape.
That makes it physically easy, but the psychological demands of that situation are clearly very different from turning a knob. I think there's good reason to think that there are people who would do the former, but not the latter. If the pilot is inclined to crash the plane due to overwhelming depression, for example, I doubt that this pilot is likely to also kill a flight attendant with his bare hands.
Also I think it would be hard to surprise a crew member in the confines of a cockpit... Most likely would result in at least some type of physical struggle
There is a significant gap from "lock the door, and crash the plane" and to "knock a person out, and then lock the door and crash the plane". Both have the same outcome, but the first require physical confrontation that I'm certain would make a difference in some situations.
My initial reaction to this is the fact that the co-pilot didn't attempt to seize the plane from the pilot or other crew, but only took advantage of an opportunity.
In this specific case, it may be possible that the co-pilot would not have forced the situation where he was in sole control of the plane.
The emotional side of me wants to call the man a coward, and a coward wouldn't be openly aggressive towards a flight attendant, but that's not a very productive point of view. In future cases, there's just no reason why a future murderous co-pilot couldn't be more aggressive, so it's still a situation worth considering.
The flight attendant also wedges the door open (and blocks entry/exit with a cart during this time. Yes, they could incapacitate, but it would take time to do this, get the door closed, and dead bolted. One would hope that the commotion would bring help before all of that could be accomplished.
From what I understand the door can be opened from the outside.
If true, the only case where having a second person present would be one where an unrelated emergency develops that requires immediate attention at the moment the first person becomes unconscious. I think that scenario is handled by requiring both officers to be in the cockpit at the times where such emergencies are most likely to develop (take off and landing)
Also, that second person would have to be able to fly the airplane. That would mean having a 3-person crew flying the plane (something that Airbus has worked hard at getting rid of for cost reasons), or having a bathroom in the cockpit (impractical, I guess)
In this case I think a remote operator could have seen that something was wrong for minutes, and could have taken over control of the plane, but of course, having that ability carries its own risks.
True. But the "no lone zone" is not a solution, merely a mitigation tactic, and a simple one at that. There's always a way around any obstacle; this would make such (nb extremely rare) events harder to pull.
First, remember the Breaking News Consumer's Handbook: Airline Edition (https://media2.wnyc.org/i/620/620/l/80/1/BNCHAE.jpg). Second, I'm sure that Mr. Robin is a nice guy, but there's no need to publish his stray speculations just two days after the crash.
It seems pretty far from stray speculations. It is assumed after a check of the black box. That is ultimately what we rely on for an after the fact analysis. If we can't use that what do we use? And you want to wait a year to find out what happened to your loved ones?
> And you want to wait a year to find out what happened to your loved ones?
"Your loved ones" died in an aircraft crash. They why of it matters less, and can wait for an accurate answer instead of rampant speculation.
As for the year time frame, it really can take up to a year to figure out. As you say, they're working from an incomplete puzzle. Perhaps the black box does say XYZ, but is that the whole story? They added a lot more security hardware to cockpit doors of late, was it suffering a malfunction? Or perhaps the copilot was panicking trying to figure out how to work around a malfunctioning button and froze up? Or he was knocked unconscious by the sudden descent? Many of these aircraft are 15+ years old at this point, an electrical fault is certainly not out of the question.
Speculation helps nobody but the press at this point.
PS. To the downvoters, please remember that we're barely two days into the investigation, and we're relying on "silence" and a third party report on very preliminary findings to jump to these conclusions.
I'm under the impression that he is speaking for the French Investigation of the incident. His statement is reasonably measured:
The most plausible interpretation is that the co-pilot through a voluntary act had refused to open the cabin door to let the captain in. He pushed the button to trigger the aircraft to lose altitude. He operated this button for a reason we don't know yet, but it appears that the reason was to destroy this plane.
The co-pilot was breathing normally for ten minutes while the door was being hammered repeatedly. Interpreting this as 'deliberate' inaction is hardly 'stray speculation'.
edit: plus, the other pilot was knocking on the door and asking him to open it. So... there was an audience. He also certainly knew the black box would record those moments.
Do we know that he didn't? My impression from investigations like this in the past is that facts tend to be released along with the conclusions that they support, presumably to keep public speculation from getting way out ahead of the actual investigation.
I would not be surprised to learn in the coming days that he did say things. But I don't think we'll find out until the investigators have a solid grasp of what this means for the investigation.
Well. I often do (No conversation, more like interjections and half statements on what I am currently doing. And I never ever do that when someone else is with me, that'd be very rude.).
Maybe I'm weird, but I think I'll wait for the full forensic investigation of the crash before delving into analysis of breathing patterns of the co-pilot from the black box. To each his own, I guess.
It is not (just) the breathing patterns, but the fact that the crew CAN OPEN THE DOOR with a code if an emergency (like a sudden decompression on the cabin that render pilots unconscious) happens.
The fact that they could not, and for the voice recording it is obvious they tried, means that the pilot deliberatively blocked the door again for not letting them go in.
While the breathing could also come from a heart-attack like situation where the pilot is effectively disabled, in this case he apparently activated the descending of the plane, after the pilot went out, which he can only do if he is conscious.
Of course it's really early so you have to be very careful as to making judgements at this point, but if it really is pilot murder/suicide there is some (limited) precedence:-
There is debate in both flights as to whether it was murder/suicide, but the evidence is totally overwhelming that it was. Horrific but thankfully massively rare (as you might expect.) I do hope this isn't the cause here :(
I don't think we know enough at this point to be sure of that at all (and we don't even know if it's murder/suicide.) Also I don't think you are correct about the Egyptair flight - that was more of a sudden dive, whereas on the Silkair flight the perpetrator intentionally disconnected the flight data and cockpit voice recorders.
Just because the governments of the countries involved didn't like the outcome of the investigations (far more so in the case of the Egyptair flight) doesn't mean it was covered up by the perpetrators, this was clearly for political/religious reasons - the failure mode suggested by the Egyptian investigators was totally unsupported by evidence.
The Egyptair flight had the crashing pilot saying prayers to Allah all the way down, captured on the voice recorder. The engines were shut off and the other officer was fighting the stick all the way down. There is zero doubt as to what happened, only a political cover up by Egypt air authorities after they realised what had happened.
These doors very effectively mean that control of the plane would be put into the hands of the cabin crew, but magnifies the cost of a rogue operator -- I am certain the risks were evaluated and the challenge of a determined suicidal pilot was ruled outside scope.
And yes, there are emergency override codes, but there are also time override-overrides from within the cabin. Even if the protocol where two members of staff are always in the cabin was broken (or absent), again, that does not stop a rogue operator from despatching with the other person.
The question is (hypothetical at this stage, there are a lot of details still unknown): have these type of doors already saved more lives than the ~150 tragically lost this week?
I can't imagine a more false statement, as the business model before 9/11 was do nothing and cooperate and everyone will be safe, and the business model after 9/11 is every person on the plane must rush the hijackers or thousands will be killed. So the reinforced door is a response to a problem that no longer exists.
Ideally you'd have a door that is strong enough to be "people proof" for long enough for the entire passenger compartment to rush a dude, but not strong enough to survive the entire passenger compartment trying to get in and save the plane in this situation. Something that can survive a couple kicks but isn't a bank vault door. Pretty much a typical apartment door would be about right.
>So the reinforced door is a response to a problem that no longer exists.
I very much disagree. Previously, an attacker could get to the cockpit by surprise and by suddenly overwhelming cabin crew. That is now much. much more difficult.
How? The door is still locked, just not heavily reenforced. Passengers are going to notice someone trying to kick the door down and you can believe that person will be taken care of quickly.
Safety procedures in airplanes are generally not based on "passengers are going to notice and react". If you have a specific role for some passengers, like subduing disruptive individuals or opening and operating an emergency exit, the passengers are informed and qualified for the job. For instance, if you sit on an exit row, you need to be physically agile enough, and the crew instructs you to learn how to operate the door.
Assuming your attacker is easily identified prior to reaching the door.
I disagree on this one. Bruce Schneier, who writes often, and passionately, on the ridicelousness of "security theater", cites doors (along with your your statement that passengers must resist) as having improved safety to a measurable degree.
But there isn't, sadly, an absolutely fix for every vulnerability. We can reduce the number of incidents and mitigate the risk, but some will always remain. It is the price one pays for such extraordinary freedoms and luxuries.
But then how long would it take to break open the door in this case? I haven't read about the time between when the descent was set in, the pilot returning and realizing he was locked out - I'm sure someone that deliberately wants to crash the plane can do so within a minute (dump fuel, start a nosedive at max speed and start spinning, etc). You can't break open a door when your plane is upside-down.
The locking doors aren't theatre though, they are a specific action that has a clear impact (control over commercial planes is limited to a much smaller set of people).
It's difficult to look into an alternate universe, but it's not out of the question that the only reason we still have air travel at all is reinforced cockpit doors. Prior to that, the risk/reward profile was distressingly in favor of the attacker, and as asymmetric warfare continues its likely decades-long ascendancy, using airplanes as weapons was likely to become ever more popular, with corresponding unpleasant second-order effects which would be a distraction to enumerate here, but in summary, "really bad for the global economy".
As is the way of things, the current manifestations of asymmetric warfare can muddy up the discussion with modern-day politics, so please allow me to remind you that science fiction authors have been predicting the rise of it since at least the 1980s, just due to the ever-rising destructive power any one individual can wield. Who or what cause happens to pick it up is an accident of history, but you can be guaranteed someone will try. This is an incentive structure that those of us on the side of civilization are going to be doing continuous battle with for a long time.
I strongly doubt it (for the particular case of strong cockpit doors).
Historically, hijackings are more deadly than rogue pilots. Neither one is a particularly big threat, but hijackings are the more important threat of the two. How many potential attacks from the past decade and a half got stopped in the planning stage because "Well gee, Bob, that sounds great, but how are we going to get into the cockpit?" While this stuff is rare, I bet it's not zero.
Beyond that, does not having a locked cockpit door actually save you from rogue pilots? I don't think so. There's a lot you can do to defeat other people when you're the only one belted in at the controls. A series of violent vertical maneuvers would suffice to defeat anyone trying to get back in. Imagine if, instead of locking the door, this guy had just pushed the nose over to negative two gees, then pulled up at positive three, repeat until everyone is dead? Or, pull the breakers for the higher-level fly-by-wire systems, point the nose at the ground, apply full throttle, and rip the wings off? The thinking seems to be that there was a calm 10 minutes or so in which he could have been stopped if only the door hadn't been in the way, but the only reason there was a calm 10 minutes was because the door was in the way.
They didn't necessarily crash, but dead passengers weren't uncommon in hijackings, typically either killed by the hijackers, killed by security services storming the airplane, or both:
Hey that article is exactly on topic. Here's an excerpt and my translation below:
"Was geschieht, wenn sich ein Pilot zur Toilette begibt, sein Kollege im Cockpit - aus welchen Gründen auch immer - das Bewusstsein verliert oder verstirbt (solche tragischen Fälle kommen durchaus vor) und der nun außerhalb des Flightdecks befindliche Pilot plötzlich keinen Zutritt mehr zur Steuerzentrale des Flugzeuges hat? "
What happens if one pilot visits the WC and his colleague in cockpit - for whatever reason - loses his consciousness (such tragic cases do happen) and yet the pilot outside of the flight deck has no more access to control center of the aircraft?
It almost foresaw what was to happen on flight 4U9525.
You also have to ask whether a lack of the door lock would have prevented the crash. Can a rogue pilot crash the plane fast enough that the door locks are irrelevant? Can he crash it while the other pilot is in the cockpit? I remember other black box recordings from another crash where one pilot was merely confused, steering the plane into a crash while the others tried to save it, and no one realized what was going on until it was too late.
That was the Air France flight, and it strikes me as a major UX disaster. The flight sticks' input was averaged, as if that's ever a desirable scenario!
"Oh yeah, we know we want to keep it level, so you pull back on the stick a bit, I'll push it an equal amount and we'll be okay." Yeeeah.
This not how simultaneous side-stick input works. Conflicting inputs are rejected with a warning ; dual input is also indicated with a warning. Non-conflicting inputs are summed, to model the way traditional centre sticks/yokes would work, when both pilots are acting. Generally, due to procedure, only one pilot is controlling the aircraft at any time; and, there is a "hand-off" to pass the control between them. There is a priority override button on each side-stick to take control from the other pilot.
However, a potential problem with side-sticks arises because the sticks are independent -- the non-controlling stick does not mirror (i.e., no force feedback) the controlling stick movement, as would happen with the mechanically connected centre sticks/yokes. Meaning, the non-controlling pilot cannot tell what the controlling pilot is doing.
This was the problem on AF447. If you read the CVR log, one pilot was confused about how to handle the situation and, unfortunately, he took control several times during the recovery attempt. In the final seconds, he verbally states he is pulling back on the stick (attempting to climb), which revealed to the [then returned to the cockpit] captain what he was doing, but there was not enough time to correct (forward, nose down) to exit the stall before they struck the ocean surface.
(The stall warning itself was another disastrous UX problem as well, in my opinion.)
Bruce Schneier has said several times that reinforced doors are one of the very few improvements when it comes to airplane security[1]. I think the deeper question would be, if your pilot is compromised, can you really do anything?
If the pilot of the EgyptAir Flight 990[2] could not keep his co-pilot from crashing the plane, what could a mob of random passengers realistically do? It seems to me like the DRM problem - you can't protect the pilot and keep them from hijacking the plane at the same time.
At least the doors will prevent any of the other random 150 passengers from taking the plane. That does seem to me like an improvement.
Yeah, iris scan isn't safe either if attackers can get the authorized person in their control.
Maybe using two random people from the crew would be best, hard to find out for an attacker and still safe against "forgetting" the secret code.
Or, a less high-tech solution: use the knife of your airline meal set to cut away the finger.
Then the airline will move on in the arms race by responding with a fingerprint reader that wants to have a pulse in the finger, and then it doesn't work when the user is in distress and has an extremely high pulse. And then there is an accident and we the armchair security experts come up with more bright ideas.
>Or, a less high-tech solution: use the knife of your airline meal set to cut away the finger.
Last time I had an airline meal, even in first class, the knife "blade" was hard rubber mounted on a blunt metal handle. It could barely cut the food cleanly, never mind someone's finger.
That's not foolproof either. There's always a compromise to make: if you have more automation to prevent pilot from being suicidal or making mistakes, you also have more automation that prevents a pilot - or anyone - taking over when the computer control goes wrong.
Let's accept it: we may make things gradually better, but there is no silver bullet that would solve all these problems.
Fine. You authorize the whole crew, not by fingerprint and not by code, but by voice recognition and secret code words per person.
Then you allow the override to be overridden by a majority (recursively). Sounds way better than making the door break when a majority of people kicks at them. It is faster than remembering and entering codes, and cannot be overridden by one sick authorized person.
An attacker would have to control the whole crew to make them do what he wants, to a level where they actually speak the secret words. In an event where the crew anticipates a crash, giving in on pressure would be the worst option to take.
To prevent attackers from muting all but the required majority of crew members, sensors all over the plane must be able to record any emergency code words spoken in the event of an attack, which will enact certain security measures (depending on the code word could lock or unlock the possibility to enter the cockpit, notify air security etc). This system should of course not be able to be deactivated.
And if you really wanted to make things sure, you could install majority-authorization buttons on every seat setup to be pressed by a percentage of boarded people within a period of mere seconds, which would allow the people on the plane to make a decision. For an attacker it is not possible to make all those people press the button, since he would not know who is not complying.
Of course you can also have some remote mechanism of unlocking, although the security implications of remote authorization and transmission of commands would be complicated to get right and open too many attack vectors.
I guess you are making fun of someone, but that is a good demonstration why too complex procedures are not a good idea.
Any procedure that aircraft crew is supposed to handle also needs to be something that is trained, memorized, and practiced regularly. Certain simplicity is ideal.
No. It is certainly not my intention to make fun of the case that a copilot is able to control a machine and crash it at his will.
Lufthansa is saying "there is no system that can prevent this kind of incident".
They will have to take the possibility into account that you have to protect the plane against an authorized person as well, and think about possible solutions to this problem. Solving conflicting interests is not an easy task.
In summary, there must be mechanisms to de-authorize personal, by means of majority vote. To prevent an attack vector, biometric systems need to be used to verify other authorized personal safely (it might be far fetched, but measuring certain stress hormons might prevent attackers from controlling authorized personal and using them to override controls as well, and likewise, other authorized people must be able to act, e.g. by having controls that cannot be blocked by any means (re voice recorders all over the plane to enable or disable locks etc, again by majority vote)). Does that sound too futuristic? I wouldn't want to board a plane if I cannot be sure that any and all cases are covered.
> Then you allow the override to be overridden by a majority (recursively).
Thus rendering the doors essentially useless, as hijackers threaten to kill passengers one-by-one until the crew (who will generally outnumber the 1-2 people in the cockpit) open the door.
I think it's the same thing as intelligence (in the national security sense). You can do lots of things to prevent outsiders from getting in, but if the insiders want to circumvent the protections, they can. Someone has to have "root" access, when you can't trust that person, you are done.
About the only thing I could think of is some way for people to report a problem like this and air traffic controllers on the ground having a way to take over control of the plane from people inside the plane. But that too could have problems (what if the air traffic controller on the ground is the murderous one, and now he is crashing planes that the pilot can't control).
I think it's a near impossible problem to fully solve. The closest thing I can think of is positive train control (PTC) which sets safe boundaries and overrides the operator if the train exceeds those boundaries. In this case maybe the plane simply can not be flown into the airspace around the Alps no matter how much the pilot wants to.
Been there done that. The entourage I was in (30 people going to enjoy the woods) was once stopped in airport for carrying knives. Hell yeah we did, everyone did, the longest one was 40 cm long and all were carried visibly.
We just told the guards to sod off as we had our own private transport plane we were waiting for. Who on earth would hijack their own plane? Especially as there were 30 armed people on board?
Rather than ATC taking over the plane, which seems like a non-trivial exercise, it might be a lot easier to allow them to override the door 'lock' mode in the cockpit (which ignores the keypad code for door entry) so that in this case the pilot/others outside could have asked ATC for it and got in. This means that there isn't someone outside the cockpit on the plane who has 'root' access (so nobody can be threatened for it).
Even then, there are considerations like not allowing the cockpit to kill all com links / power so that people outside the cockpit are still able to communicate with the ground to get the root pwd, and as mentioned elsewhere the person inside the cockpit could change their strategy to make recovery of control difficult or impossible even in this case (EDIT: e.g. throwing the plane about). Also, you'd probably want >1 ATC person to authorise to reduce the chance of the door being unlocked by someone at ATC in cahoots with hijackers.
Do you know the rational behind having override-overrides from the cockpit? For me, this only makes sense under the assumption that Prob(malicious agent who knows emergency codes in cockpit and good agents knowing codes outside ) is much smaller Prob(good agent knowing codes in cockpit and malicious agents knowing codes outside). How is this assumption justified? Under current regulations, the latter is becoming more and more unlikely. Or this could be fixed by letting the protocol to lock the door from inside the cockpit depend on an exchange with a trusted third party like air controllers.
[edit: language]
In post-9/11 world a good agent would not open the door even at the threat of his life, because were the attackers gain control of the cockpit, he would die anyway, and a lot of other people too.
I think that's the only possible counterpoint, really. But the override should be constructed so that it can only put the plane onto a "safe" autopilot route. And even then, I'm not really sure if that's actually safe without giving the plane collision avoidance, because it's entirely conceivable that in some urban airports just reverting to straight and level could cause a crash.
If you're descending into an airport near NYC it's possible that you need to fly towards the city, turn and then continue descending to land. If you hit the autopilot external override at the right time you could be lower than the tallest buildings and get locked into flying into them without enough time to react.
The real solution would seem to be what other people in the thread are suggesting; you must always have two people in the cockpit. At least one pilot and possibly another crew member.
The autopilot on modern aircraft is more than capable of landing the plane. I have a friend who flies for Air Canada who tells me that Air Canada requires pilots to be in manual control of the aircraft from takeoff to 500 feet, but after that the pilot can put the plane in autopilot and not touch anything until they're on the ground if she wants to. The plane will even apply breaking thrust after touchdown and bring the plane to a stop.
At this point, pilots are really there to take care of unusual situations that the computer can't (which do happen from time to time.)
The idea that a pilot could put a plane on autopilot soon after takeoff and then "not touch anything" and end up landed on the ground again is patently ludicrous. There are certainly things that automatic controls can do to make flying and landing a plane easier but they don't resemble your description at all.
What about the much less hypothetical case that one of the pilots becomes unconscious while the other is out of the cabin. How is he supposed to get back in, ever?
These doors can be unlocked using a secret regularly changing code. After this code is entered a buzzer will inform the pilot for 30s. Then the door opens.
The pilot can override the code by locking the door in which case it can only be opened from the cockpit for some minutes (5-20).
(4) If one pilot leaves a pilot duty station of an aircraft when operating at altitudes above 25,000 feet MSL, the remaining pilot at the controls shall put on and use an approved oxygen mask until the other pilot returns to the pilot duty station of the aircraft.
Additionally, it's either US airline operating procedure (or perhaps FAA regulations, I couldn't find it though) for a second crew member to stay in the cockpit when one of the pilots has to leave.
These types of scenarios are why the U.S. requires a flight attendant to enter the cockpit when a pilot exits. I wouldn't be surprised if the agencies in Europe implement the same policy by the end of the week.
Let's hope so. Not fool-proof but this is a sound procedure isn't it? So why wasn't it implemented by European Authorities as well? I wonder what their counter-arguments were?
I think the assumption was always that incapacitated pilots (e.g. because of a medical issue) would be the issue that would require someone to enter the locked cockpit. For those cases the procedure works as intended (the door can be opened from the outside if the person on the inside really doesn’t react). I don’t think suicidal pilots were on the forefront of anyone’s mind.
In hindsight a policy of always having at least two people does seem preferable. (And, just a little reminder here: Just because someone is willing to fly a plane with 149 other people on board into a mountain doesn’t mean they would be willing to do other awful things, too, like acting violently in person against another person, for example a flight attendant. Preventing this kind of behavior may well be about putting in place many small hurdles.)
I think it’s pretty clear that people in the cabin should never be able to access the cockpit against the express will of people inside the cockpit (preventing scenarios in which someone violently forces someone with knowledge of how to access the cockpit – e.g. a pilot coming back from the toilet – to divulge that information and gaining access that way), so realistically you can only throw people at this problem – and throwing people at this problem is thankfully in this case relatively straightforward and shouldn’t really have any other negative consequences. I don’t see a technical solution to this problem, but there might not have to be one.
Another BBC story mentioned that some airlines (but not Lufthansa) have a policy where there has to be two people in the cockpit at all times. When the pilot/co-pilot leaves another member of the crew takes their place.
The entire point of the door lock is to let control of the aircraft remain in the hands of the crew in the cockpit. If there was a root pass, that could be rendered useless - which is what they do not want.
I'm struck by how these pilots (chilling in itself that it's happened enough times to count as its own group) are described as being suicidal. While technically true, it detracts from the greater truth that they are mass-murderers. If someone shot up a mall and killed 150 people then ate a bullet, would we describe them as suicidal?
I don't have a greater point I suppose, but it seems worth thinking about. Except, perhaps-- how do you go about 'screening' for inclination to mass-murder?
As there have been quite a few incidences of a pilot intentionally crashing a plane, It would be interesting to see if the ratio of mass-murdering pilots to pilots is larger than mass-murderers vs the adult population.
This would have to be adjusted to the fact that most people is not usually in a position to easily kill this many people, while pilots are in a mostly daily basis.
(Unless I misunderstood) the gentleman running the press conference actively refused to call it a suicide as the co-pilot was responsible for the lives of the >150 people onboard at the time.
I think it's fair to hand waive it as "intentional crash". Even if those people are not dead, they have been missing for over a year. I imagine it must be a fairly hellish experience if they are not dead.
For purposes of prevention/screening/etc., I think it makes sense to differentiate between "pilot wants to put the plane in the ground" and "pilot wants to abscond with the plane". Apparently that's just me though.
There's always going to be a human involved at some point (at least until the machines take over, but then they probably won't be flying us around). If it's all automated, then instead of a crazy pilot killing everyone on his airliner, it might be a crazy programmer killing everyone on every airborne airliner.
> Those don't always work
Of course not, nothing always works. You are implying that checks are worthless because they failed on this co-pilot.
In the context of a pilots mental state verses malicious source code being installed on a set of flight computers, I'd have to say the computer is easier to validate. That many more people have to approve the process. With a pair of pilots the validation process is much smaller and more complex.
We need to stop thinking that machines are flawed and that humans know best. The fact of life is that machines can and do perform better than humans, the only reason flight computers don't currently is that there hasn't been the investment in making them do so. Sensors fail but that is an engineering problem that can be solved.
Flights are almost fully automatic already. They saw data showing the pilot turned off autopilot and set the target cruising altitude to 100m. Putting a block in place unless you're in an area where that is safe (flat).
I was recently flying in a small airplane (SR22) and the terrain detection system was going bonkers when we were landing saying that terrain was getting close to us. They have all the data, they just need to build in some more protections.
That's not what he's saying. The world isn't as black-and-white as "it can be hacked, so it's not worth it"... He's talking about raising the barrier to entry for this kind of situation via automation, much like TCAS would have prevented the Uberlingen collision.
Preventing accidents and stopping a rogue insider are very different issues. Remote control opens a bunch of new attack surfaces, while not helping with the original problem.
No, no, no, no. There is no technical solution to this non-technical issue. I understand the frustration of "but surely there MUST be a scriptable way out of this," but IMNSHO there isn't (short of strong AI).
This issue of humans in the cockpit? You're saying there's no technical solution to this ....... except AI, which would be a technical solution to this issue.
Except that strong AI is not current technology, or even near-future technology. In other words, "hmm, this wouldn't be a problem if only we could do abracadabra and solve it with magic; therefore it's not a problem. We can't do abracadabra, and hence can't solve it this way? La la la, I can't hear you!"
(Not sure I'd call that a technical solution, but let's assume so.)
We could make planes fly themselves today. This is (mostly) how military drones work. On a couple of my tours, we worked with drones that flew themselves almost completely. My best friend in the universe reenlisted just to fly them, and they fly themselves for most of their missions.
Trust me: Planes could fly themselves using today's technology.
Emphasis on almost. I'm not going to reiterate what's been said here: https://news.ycombinator.com/item?id=9289225 , so just the TL;DR version: in case of major trouble, a CFIT of an unoccupied vehicle is a viable safety option, for that 1% that almost works. Try that with an airplane full of people...and you would become a terrorist. Tiny, tiny difference, nothing to worry about.
That's a nice thought, but how would ATC determine what needs to be done? We are only finding out that this was an intentional act long after the plane has hit the ground. For all ATC knows, opening the door to the cockpit could be the WRONG action. If no one is responding from the cockpit, they have no clue what is going on other than the telemetry they are getting from radar and the plane's systems (which in this case wouldn't tell them much).
In fact, pilots are trained to communicate AFTER they have gotten the plane in a state to where they can either continue the flight or ditch safely if communication would distract them from the task at hand. ATC knows this, so even if they saw the plane dropping like a sack of rocks, they would probably assume that there was a problem and that the pilots are in a position in which a steep dive will help mitigate the problem (which can happen, such as depressurization).
If you add some additional information on the status of the plane (engines, electronics, etc) in addition to the telemetry you could infer much more on the current situation aboard the plane. In this case the simple reversal of the initiation of the descent (as a precautionary measure) might have prevented the unfolding of events. Obviously we can all think of corner cases where the pilots and the ATC would come to different (and potentially disastrous) conclusions while being unable to communicate and resolve these differences.
Ultimately I think that remote control or a comparable safety measure will become a necessity in civil aviation, because passengers will demand it to feel safer.
"In this case the simple reversal of the initiation of the descent (as a precautionary measure) might have prevented the unfolding of events."
I think you might have missed my point. What telemetry do you think would have given ATC enough information in 8 minutes that would tell them reversing the descent is the correct course of action? If anything, the data in this flight would have indicated that the dive was initiated by the pilot, and would suggest allowing him to continue the actions. And how long would they have to discuss what should be done? The descent started 8 minutes before the plane hit the ground. That is a very short amount of time for people on the ground without full information to make the call. They would probably spend at least half that time trying to make contact with the pilot.
The bottom line is that the person best appraised of how to fly the plane is the one behind the controls, and that is how aviation has traditionally treated these situations. If a pilot wants to bring down a plane bad enough, it's mighty hard to stop them.
Anyways, and this is my speculation, I am fairly certain that remote control has been brought up many times before in aviation, and that there is a good reason why it isn't presently implemented. And as for the corner cases, those corner cases matter. This isn't a software engineering problem we are talking about.
Precisely. People are proposing complex algorithmic solutions to a problem where applying such things might potentially make things worse. Generally, civil aviation is remarkably safe, and we should not go with knee-jerk potentially counter-productive reactions.
Airline pilots are a highly selective group of people, well trained, and they are showing every day how they work with integrity. That someone has once gone over and killed himself and others should not obscure our assessment of the situation. We have about 88 000 departures per day in the world. We don't accept even ppm-range risks of disaster if we know how to mitigate them, but when we're this low, we need to be careful that "improvements" don't actually degrade performance.
Now you have two problems: instead of worrying about rogue pilots, you have to worry about rogue pilots and rogue remote control. Oh, and latency in remote control is also a nice thing to have. And signal loss. And jamming. So, five problems (actually, that's just a random sample).
The chance that multiple operators in a collective are actively abusing their control (and try to crash the plane) is decreasing in probability. History shows that such actions are usually performed by individuals. Even high latencies would not have prevented a successful intervention in this case (they've had a window of about 8 minutes for an intervention). Jamming is a possibility and an issue with the current communication systems the pilots already rely on.
Is it realistic that we see human controls largely removed from passenger plane pilots? Or ground-based group overrides? I know that for the largest jets, pilots already operate within some sort of computer-decided 'envelope' (I think it's called) of reasonable decisions.
I think we will see personal driving banned in some cities (CBDs at least) or routes in the coming decades as self-driving cars come to dominate our roads.
I'd suspect the risks of a ground-control system would be substantially higher than the chance of a pilot deliberately crashing a plane every decade or so.
The problem with automation is that it's completely dependent on inputs from sensors, and those do malfunction. This incident from last year involves fighting the automation due to exactly such a problem:
There are enough instances of sensors and autopilot malfunctioning, there should always be manual-override procedures and a human operator available to take control. I don't see this changing any time soon.
There's no way of telling though. Maybe a terrorist attack would have happened a week earlier if the terrorist didn't know they couldn't get past the locked door, so they didn't try it.
It seems clear that in this case the co-pilot's actions were voluntary, but what if a co-pilot were to have a medical emergency while (s)he's alone in the cockpit? Would the pilot be able to re-enter?
This seems like a huge risk that wasn't considered when the new strengthened cockpit doors were installed.
In an emergency event you are most likely to forget secret codes. Some kind of biometric sensor would be better, although then attackers could take the authorized person hostage, so it is best to have it shared among two random crew people, simply by voice recognition.
> It seems clear that in this case the co-pilot's actions were voluntary, but what if a co-pilot were to have a medical emergency while (s)he's alone in the cockpit? Would the pilot be able to re-enter?
That's what I thought, too. Does the pilot also (always?) have a key to the cockpit door in his pocket (risk, because than a terrorist could steal it while the pilot goes to toilet) so that he could reenter the cockpit? So for me a plausible explanation is the the co-pilot had a medical emergency while alone in the cockpit. Now comes the question:
Would pressing the descent button in this case perhaps even increase the chance of survival (in this case the co-pilot was doing a quick-witted decision) or not?
It's still amazing how some obvious procedures aren't standard in many airlines until something horrible happens. There should be two people in the pit at all times. If the pilot goes to take a leak an attendant takes his place until he returns. It's not really a hard procedure to implement.
So this means that his reason must be personal and important only to himself. That leaves me wondering, what personal reason can one have to do such a thing?
It may come down more to a "state of mind" than "personal reason". I.e. nothing very rational. I guess investigators will look at his relationships, communications with other people before the flight, and so on.
"Terrorism is commonly defined as violent acts (or the threat of violent acts) intended to create fear (terror), perpetrated for a religious, political, or ideological goal, and which deliberately target or disregard the safety of non-combatants (e.g., neutral military personnel or civilians)."
This guy is a mass murdered, not a terrorist (in the usual sense of the word).
> Terrorism is commonly defined as violent acts (or the threat of violent acts) intended to create fear (terror)
It depends on the motivation of the pilot i.e. Did he intend to create fear? At this point the motivations remain unclear, so it can't be termed an act of terrorism.
There was an incident just last November where the flight systems put a A320 into a nose dive towards the ground and the pilots had to restart the board systems in order to pull the machine up.
It's also unlikely to be true. If they can hear the pilot trying to break the cockpit door down on the CVR, then there is little doubt that most passengers on an A319 can also hear/see same.
Maybe they didn't start screaming until it was obvious that they were going to crash, but they knew that the captain couldn't get back into the cockpit long before that.
It dislikes terrain alright. There's a master alarm and audible "pull up!" warning... If they ever release the complete tape the last minute or so will be very, very grim.
There is a code pad that unlocks the door in case the pilot(s) don't answer the requests to open the door via intercom. The code does not however unlock the door immediately but activate a light and a beeping sound inside the cockpit for 30 seconds. Within this time frame the pilots can either decide to open the door immediately or to overwrite the unlocking, which locks the door for 5 minutes. This is to prevent attackers from entering even if they threaten to kill the crew member and thereby pressured them to enter the code. If the pilots don't react during the 30 seconds the door unlocks.
Is leaving for toilet the only reason for the pilot to leave the cockpit? I seen some comments on having a third person with the co-pilot if the pilot leaves, but is not another "simplistic solution" to have a toilet for pilots within the cockpit lock doors? I understand it is not as simple as "just add a toilet" but I was thinking for of future designs.
I always wondered why the pilots don't wear some kind of fitbit-like bracelets or something similar that would measure (even imperfectly) their vital signs and record them as a third set of data apart from voice and flight data. There are many (although admittedly unlikely, but still) scenarios that could have happened in this case (the co-pilot might have fainted, someone else could have entered the cockpit unnoticed etc), and all we have is the sound recording telling us that he "breathed normally".
Beyond breathing, it's also known that the guy commanded a descent into the ground in a way that's basically impossible to do by accident. That pretty much rules out any sort of health problem (besides the mental kind).
This is the other side of the coin of giving someone too much power.
After 2001 the pilots were considered "good" and the rest of the crew and passengers "bad".
But what happens when pilot intentions are not good? In this case the crew and passengers are impotent to save their selves.
This is probably what happened in the last two missed airplanes too.
The same is happening with the Government, after 2001 the people have given too much power to the Government because they considered it "good" against the "bad" guys. But as the people in Germany knows, the people in the Government could be the bad guys.
Any ideas for future improvements to the current mechanism?
A possible idea is to release the lock (allowing entry using the PIN) if the board computer determines that a crash is likely. (This is safe, because it's unlikely that there is an attacker who wants to enter the cockpit and at the same time a situation likely to result in a crash.)
This clearly only helps against the problem with the locked door, but it seems comparatively easy to implement.
Edit: Another idea: The autopilot should prevent a crash and the only way to disable it should be by pressing two buttons at opposite sides of the cockpit (so two persons have to cooperate).
Without trying to be a luddite, what happens in a self-driving car crash? That is, in court, not physically. This is yet to be tested; also, what happens in a meaningful concentration of autonomous vehicles? I'd wait at least for these to be tested before declaring autonomous vehicles "essential."
276 comments
[ 0.29 ms ] story [ 269 ms ] threadI just asked a friend who used to be a pilot for Ryan Air and he said he had never received one.
I'm not aware of any specific tests for suicidal ideation, but the FAA explicitly disqualifies pilots diagnosed with bipolar disorder, and other personality disorders are cause for concern.
I don't know if carriers include other checks. IMO it would be weird if they didn't - but I'm not a carrier.
My guess is that if it's aggressive suicide there will be some high-stress triggering incident in the recent past - debt, blackmail, a weird sexual history, a relationship breakup, or something of that ilk. Possibly even a very negative work review from an insane boss.
If there's nothing at all, that would be very strange and unusual.
Also from memory a 1st class was pretty much a 3rd class with stricter limits and an electrocardiogram which is why it costs microscopically more. At least in the old days if you got a 1st after it expired, it acted like a 2nd for the remainder of the year, and a 3rd for the next year, but a 1st cost more, so I didn't bother (not expecting to achieve ATP cert within 6 months of my solo LOL)
Crudely and inexactly but more or less true, you need a valid 3rd to be a general aviation pilot, a valid 2nd to haul cargo or be a bush pilot, and a valid 1st to work for an airline. Things will be slightly different in Germany but less different than you'd think... we have trust agreements to allow them to fly here and us to fly there so things are vaguely similar but it doesn't matter if my details are slightly off.
http://flighttraining.aopa.org/students/presolo/special/medi...
Finally you have to be realistic. If 25% of the population experiences a mental health issue at some point in their life or whatever ridiculously high percentage, then given the huge fraction of the population flying with issues, issues obviously almost never cause a problem, its right up there with meteor strikes. So you end up with false positive/negative issues. If you assume all men have been dumped by a girlfriend at least once that means roughly 3e9 false positive if you assume all dumped dudes are going to mass murder an entire airplane, a false positive rate of eight nines I think? That idea would be up there with banning German pilots, after all one of them apparently did kill a lot of people and the false postive rate is staggeringly lower than banning all people with mere claustrophobia or a bad attitude or whatever.
Rather than banning what we cannot see, maybe we should just start seriously considering scenarios where one pilot is a malicious actor.
Air travel used to be substantially less safe. Improvements in safety have all but eliminated crashes due to mechanical failure, weather, mid-air collisions, etc. They've done nothing to prevent crashes due to rogue pilots, though. If the rate were constant, they'd be much more visible now because they'd make up a much larger proportion of the much smaller number of crashes.
Btw, my brother knew some details about the accident before they were public news, I assume there must be some pilot grapevine where more details about the accident must be shared. Like I imagine most other pilots must be, he's very shaken by the incident. It's a matter of professional pride amongst the pilot community, I assume.
My father would sometimes be called as an expert witness for blackbox analysis. As a child, I remember him falling into deep depression whenever he had to do that, and he was always given a couple weeks' vacation time whenever that happened.
http://www.pprune.org/rumours-news/558654-airbus-a320-crashe...
Alcoholism is very common with pilots, though. This much I know, because I met many pilots through him and my father, and boy do they enjoy their drinks.
In my dad's time (he was "almost" a WW2 veteran, he was gonna fly on the second Mexican squadron, but the war ended before Mexico sent that squadron), being a pilot was comparable to being a movie star. So much prestige, so much partying. Some of that culture from the middle of the 20th century still lives on, and many pilots still, well, burn bright and burn fast.
Not sure how much of that still goes on - a lot, I would guess.
But fuck that co-pilot.
But a pilot with time alone in the cockpit can most likely trick the flight computers into whatever mode he wishes.
In any case, you're right that the automation (by whatever name) can already override the pilot in many cases. But it's a really tricky problem because you can easily make things worse instead of better. For example, one reason that Air France 447 crashed was that one of the pilots was commanding the airplane as if it were in a fly-by-wire mode it was not actually in. The plane had already stalled, but he was flying it as if the computers would prevent him from stalling, rather than taking proper corrective action. A proper recovery maneuver would have saved it. This is ultimately pilot error, but automation is a strong contributing factor. For another example, Asiana 214 crashed because the pilot assumed the airplane was doing more for him than it really was, trusting the automation to keep his speed steady, which it wasn't set to do. Again, pilot error, but with automation as a contributing factor.
It seems likely that automation is a net gain when done right, but it requires careful consideration.
The co-pilot flies. That's why there is a co-pilot.
(On really long flights there can be two co-pilots so that pilots can work in shifts, but medium-range flights like this can physically be flown by one pilot, two are there for safety).
http://www.askthepilot.com/copilots-are-pilots-too/
Now, consider that programmers make mistakes (even in aerospace) much more frequently than pilots decide to commit suicide. If a software system is given first-authority instead of a pilot you'll have more deaths due to the system than due to pilots intentional attempt to destroy a plane. The problem of suicidal pilots can be addressed by a number of known mechanisms, none of which jeopardize the safety of a flight. Pernicious problems of software quality are still incredibly difficult to address in any context.
As to "why is it not implemented" - because it would create far, far more problems than it would solve, without a measurable benefit.
All the technology exists for me to build a drone swarm to patrol my house constantly on the inside and out, deliver me a video stream, and to deter intruders with non-lethal force. That doesn't mean I just need to order the parts, assemble them, and use.
There is no off the shelf remote fly-by-wire for an Airbus A320 or any other passenger jet. Plenty of companies have done it as a one-off thing. This is for either testing UAV systems or using the plane as a crash test vehicle. This usually involves the same team of engineers that equipped the aircraft monitoring every single parameter in real time. The military has actually received criticism for conducting weapon systems 'tests' in this manner.
There is a huge difference between that and commercial operations of such a system. In a commercial environment, you can't have a team of engineers on constant standby. For planes flying for research purposes over unoccupied areas a high risk of total loss of control is completely acceptable. Commercial and military remote control aircraft all have systems that intentionally crash the vehicle if communications is lost and it leaves a designated area. This prevents potential loss of life due to mundane software bugs. You can't ethically build a system that intentionally crashes an airliner full of people as a response to a software bug.
I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range", and if it does, why can't it take automatic corrective action and override the pilot?
There's a good chance someone commenting here has worked in this area and could provide a very insightful response.
I believe it doesn't (not an expert though), as it'll assume you've lost control of the airplane and will try to recover. However in this case the descent was at a fairly standard speed. But yeah the autopilot will not override the pilot if the airplane seems under control.
1. the legal responsibility lies with the pilot(s); therefore there always needs to be an option to override or even shut down the computer
which is partly caused by
2. computers and their programs are anything but perfect; computer-assisted issues are usually resolved by human input ("speed is 253...254...255...oh look we're actually moving backwards, now what?!" "now we fly manually, you dumb toaster, because we're obviously not in the situation you think we are.").
In other words, "take control completely away from people and give it to automatics" is a recipe for a far more frequent trouble than an unpredictable outlier event.
But seriously, stuff like that already happened, multiple times. Most famously, http://www.dailytech.com/Lockheeds+F22+Raptor+Gets+Zapped+by...
Except when something very unexpected happens (e.g. not all sensor malfunctions can be distinguished from a reading that's outside of the usual range, yet plausible); in such situations, automatics disengage and people need to step in.
In other words, you can only get so many reliability nines and still be profitable for mass transport (as opposed to, for example, Space Shuttle).
The plane is acting on sensor information, hardware and software, which might be flawed. That is why the pilots always need to be able to do a manual override.
Take for instance the Air France 447 crash: the first problem was freezing of pitot tubes to measure airspeed. That alone would have messed up auto-pilot. Then, the not very experienced co-pilot flying the plane also reacted wrong, and then the plane came down; the captain did not start to correct things in time.
http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....
During that they obviously didn't think that any pilot would suicide the plane by flying it into the ground.
All the while there is value in driving planes into the ground, it's an unwinnable solution.
It doesn't... usually. Everything can be overridden.
> I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range"
Yeah. "Whoop Whoop TERRAIN". "Whoop Whoop PULL UP"
Haven't actually heard the recording, but those are probably among the alarms in the cockpit. The pilot is still required to raise the altitude.
http://en.wikipedia.org/wiki/Ground_proximity_warning_system
As other comments pointed out, sensors are still faulty. Not sure if any airplanes actually have auto pull-up capability.
http://www.nytimes.com/2015/03/27/world/europe/germanwings-c...
In the best-case scenario, if someone in the cockpit wants to keep people out, it sounds like the security mechanisms provide a way to do for for at least five and a half minutes.
edit: oh, they just make it impossible to select text at all... nice.
If the inhabitant of the cockpit chooses to respond with a locking command (in the case of the A320, moving the door switch forward); the door will remain closed no matter how hard you try.
Someone determined to crash a plane would not have too much of a problem incapacitating any cabin crew member (by surprise most likely) before his attempt. I believe that having a second person in the cockpit is more useful (and seemingly essential) if the Pilot/Co-Pilot loses conciousness in order for the door to still be opened.
Killing someone is extremely easy if the other person trust you. You get behind her and hit her with a heavy object in the head or in the nape.
If the pilot is busy doing something like piloting the plane, it is very easy for a copilot to get rid of her.
That makes it physically easy, but the psychological demands of that situation are clearly very different from turning a knob. I think there's good reason to think that there are people who would do the former, but not the latter. If the pilot is inclined to crash the plane due to overwhelming depression, for example, I doubt that this pilot is likely to also kill a flight attendant with his bare hands.
In this specific case, it may be possible that the co-pilot would not have forced the situation where he was in sole control of the plane.
The emotional side of me wants to call the man a coward, and a coward wouldn't be openly aggressive towards a flight attendant, but that's not a very productive point of view. In future cases, there's just no reason why a future murderous co-pilot couldn't be more aggressive, so it's still a situation worth considering.
If true, the only case where having a second person present would be one where an unrelated emergency develops that requires immediate attention at the moment the first person becomes unconscious. I think that scenario is handled by requiring both officers to be in the cockpit at the times where such emergencies are most likely to develop (take off and landing)
Also, that second person would have to be able to fly the airplane. That would mean having a 3-person crew flying the plane (something that Airbus has worked hard at getting rid of for cost reasons), or having a bathroom in the cockpit (impractical, I guess)
In this case I think a remote operator could have seen that something was wrong for minutes, and could have taken over control of the plane, but of course, having that ability carries its own risks.
http://en.wikipedia.org/wiki/Two-man_rule#No-lone_zone
"Your loved ones" died in an aircraft crash. They why of it matters less, and can wait for an accurate answer instead of rampant speculation.
As for the year time frame, it really can take up to a year to figure out. As you say, they're working from an incomplete puzzle. Perhaps the black box does say XYZ, but is that the whole story? They added a lot more security hardware to cockpit doors of late, was it suffering a malfunction? Or perhaps the copilot was panicking trying to figure out how to work around a malfunctioning button and froze up? Or he was knocked unconscious by the sudden descent? Many of these aircraft are 15+ years old at this point, an electrical fault is certainly not out of the question.
Speculation helps nobody but the press at this point.
PS. To the downvoters, please remember that we're barely two days into the investigation, and we're relying on "silence" and a third party report on very preliminary findings to jump to these conclusions.
So we just have to wait a little longer and must take into account the answer will never be found.
The most plausible interpretation is that the co-pilot through a voluntary act had refused to open the cabin door to let the captain in. He pushed the button to trigger the aircraft to lose altitude. He operated this button for a reason we don't know yet, but it appears that the reason was to destroy this plane.
edit: plus, the other pilot was knocking on the door and asking him to open it. So... there was an audience. He also certainly knew the black box would record those moments.
But I give up, this is pointless.
I would not be surprised to learn in the coming days that he did say things. But I don't think we'll find out until the investigators have a solid grasp of what this means for the investigation.
The fact that they could not, and for the voice recording it is obvious they tried, means that the pilot deliberatively blocked the door again for not letting them go in.
He also cries before hitting ground.
https://twitter.com/flightradar24/status/581073962274328576/...
* An EgyptAir flight in 1999 - http://en.wikipedia.org/wiki/EgyptAir_Flight_990
* A Silkair (Singapore airline) flight in 1997 - http://en.wikipedia.org/wiki/SilkAir_Flight_185
There is debate in both flights as to whether it was murder/suicide, but the evidence is totally overwhelming that it was. Horrific but thankfully massively rare (as you might expect.) I do hope this isn't the cause here :(
http://en.wikipedia.org/wiki/Royal_Air_Maroc_Flight_630
and
http://en.wikipedia.org/wiki/Japan_Airlines_Flight_350
...and of course deep suspicions remain about MH370.
In this case it would seem that no effort was made to hide the fact it was intentional.
Just because the governments of the countries involved didn't like the outcome of the investigations (far more so in the case of the Egyptair flight) doesn't mean it was covered up by the perpetrators, this was clearly for political/religious reasons - the failure mode suggested by the Egyptian investigators was totally unsupported by evidence.
And yes, there are emergency override codes, but there are also time override-overrides from within the cabin. Even if the protocol where two members of staff are always in the cabin was broken (or absent), again, that does not stop a rogue operator from despatching with the other person.
The question is (hypothetical at this stage, there are a lot of details still unknown): have these type of doors already saved more lives than the ~150 tragically lost this week?
Ideally you'd have a door that is strong enough to be "people proof" for long enough for the entire passenger compartment to rush a dude, but not strong enough to survive the entire passenger compartment trying to get in and save the plane in this situation. Something that can survive a couple kicks but isn't a bank vault door. Pretty much a typical apartment door would be about right.
If they are outside trying to get into the cockpit, there may be time for passengers to react and neutralize them?
I very much disagree. Previously, an attacker could get to the cockpit by surprise and by suddenly overwhelming cabin crew. That is now much. much more difficult.
I disagree on this one. Bruce Schneier, who writes often, and passionately, on the ridicelousness of "security theater", cites doors (along with your your statement that passengers must resist) as having improved safety to a measurable degree.
But there isn't, sadly, an absolutely fix for every vulnerability. We can reduce the number of incidents and mitigate the risk, but some will always remain. It is the price one pays for such extraordinary freedoms and luxuries.
https://www.schneier.com/news/archives/2008/11/the_things_he...
As is the way of things, the current manifestations of asymmetric warfare can muddy up the discussion with modern-day politics, so please allow me to remind you that science fiction authors have been predicting the rise of it since at least the 1980s, just due to the ever-rising destructive power any one individual can wield. Who or what cause happens to pick it up is an accident of history, but you can be guaranteed someone will try. This is an incentive structure that those of us on the side of civilization are going to be doing continuous battle with for a long time.
Historically, hijackings are more deadly than rogue pilots. Neither one is a particularly big threat, but hijackings are the more important threat of the two. How many potential attacks from the past decade and a half got stopped in the planning stage because "Well gee, Bob, that sounds great, but how are we going to get into the cockpit?" While this stuff is rare, I bet it's not zero.
Beyond that, does not having a locked cockpit door actually save you from rogue pilots? I don't think so. There's a lot you can do to defeat other people when you're the only one belted in at the controls. A series of violent vertical maneuvers would suffice to defeat anyone trying to get back in. Imagine if, instead of locking the door, this guy had just pushed the nose over to negative two gees, then pulled up at positive three, repeat until everyone is dead? Or, pull the breakers for the higher-level fly-by-wire systems, point the nose at the ground, apply full throttle, and rip the wings off? The thinking seems to be that there was a calm 10 minutes or so in which he could have been stopped if only the door hadn't been in the way, but the only reason there was a calm 10 minutes was because the door was in the way.
Is this true? I can't remember a single other plane hijacking that resulted in the deaths of passengers outside of 9/11.
There were definitely a couple.
http://en.wikipedia.org/wiki/List_of_aircraft_hijackings
Lots of those were resolved without death, or with just a few deaths, but many others got lots of people killed.
It certainly was debated before (here a german article from a year ago, closing with the cynical words "Than you're also dead, but at least save from terrorists. How comforting." http://www.austrianwings.info/2014/05/verriegelte-cockpittue... )
"Was geschieht, wenn sich ein Pilot zur Toilette begibt, sein Kollege im Cockpit - aus welchen Gründen auch immer - das Bewusstsein verliert oder verstirbt (solche tragischen Fälle kommen durchaus vor) und der nun außerhalb des Flightdecks befindliche Pilot plötzlich keinen Zutritt mehr zur Steuerzentrale des Flugzeuges hat? "
What happens if one pilot visits the WC and his colleague in cockpit - for whatever reason - loses his consciousness (such tragic cases do happen) and yet the pilot outside of the flight deck has no more access to control center of the aircraft?
It almost foresaw what was to happen on flight 4U9525.
"Oh yeah, we know we want to keep it level, so you pull back on the stick a bit, I'll push it an equal amount and we'll be okay." Yeeeah.
However, a potential problem with side-sticks arises because the sticks are independent -- the non-controlling stick does not mirror (i.e., no force feedback) the controlling stick movement, as would happen with the mechanically connected centre sticks/yokes. Meaning, the non-controlling pilot cannot tell what the controlling pilot is doing.
This was the problem on AF447. If you read the CVR log, one pilot was confused about how to handle the situation and, unfortunately, he took control several times during the recovery attempt. In the final seconds, he verbally states he is pulling back on the stick (attempting to climb), which revealed to the [then returned to the cockpit] captain what he was doing, but there was not enough time to correct (forward, nose down) to exit the stall before they struck the ocean surface.
(The stall warning itself was another disastrous UX problem as well, in my opinion.)
Completely agreed about the stall warning as well, I just didn't mention it. Don't warn about stalls unless there's actually danger of stalling!
If the pilot of the EgyptAir Flight 990[2] could not keep his co-pilot from crashing the plane, what could a mob of random passengers realistically do? It seems to me like the DRM problem - you can't protect the pilot and keep them from hijacking the plane at the same time.
At least the doors will prevent any of the other random 150 passengers from taking the plane. That does seem to me like an improvement.
[1] https://www.schneier.com/essays/archives/2005/12/airline_sec...
[2] https://en.wikipedia.org/wiki/EgyptAir_Flight_990
For instance, to replicate someones fingerprints all you need is a high res photo of their hand from a distance.
Then the airline will move on in the arms race by responding with a fingerprint reader that wants to have a pulse in the finger, and then it doesn't work when the user is in distress and has an extremely high pulse. And then there is an accident and we the armchair security experts come up with more bright ideas.
Last time I had an airline meal, even in first class, the knife "blade" was hard rubber mounted on a blunt metal handle. It could barely cut the food cleanly, never mind someone's finger.
Let's accept it: we may make things gradually better, but there is no silver bullet that would solve all these problems.
To prevent attackers from muting all but the required majority of crew members, sensors all over the plane must be able to record any emergency code words spoken in the event of an attack, which will enact certain security measures (depending on the code word could lock or unlock the possibility to enter the cockpit, notify air security etc). This system should of course not be able to be deactivated.
And if you really wanted to make things sure, you could install majority-authorization buttons on every seat setup to be pressed by a percentage of boarded people within a period of mere seconds, which would allow the people on the plane to make a decision. For an attacker it is not possible to make all those people press the button, since he would not know who is not complying.
Of course you can also have some remote mechanism of unlocking, although the security implications of remote authorization and transmission of commands would be complicated to get right and open too many attack vectors.
Any procedure that aircraft crew is supposed to handle also needs to be something that is trained, memorized, and practiced regularly. Certain simplicity is ideal.
Thus rendering the doors essentially useless, as hijackers threaten to kill passengers one-by-one until the crew (who will generally outnumber the 1-2 people in the cockpit) open the door.
About the only thing I could think of is some way for people to report a problem like this and air traffic controllers on the ground having a way to take over control of the plane from people inside the plane. But that too could have problems (what if the air traffic controller on the ground is the murderous one, and now he is crashing planes that the pilot can't control).
I think it's a near impossible problem to fully solve. The closest thing I can think of is positive train control (PTC) which sets safe boundaries and overrides the operator if the train exceeds those boundaries. In this case maybe the plane simply can not be flown into the airspace around the Alps no matter how much the pilot wants to.
We just told the guards to sod off as we had our own private transport plane we were waiting for. Who on earth would hijack their own plane? Especially as there were 30 armed people on board?
That's the safest way to travel!
Even then, there are considerations like not allowing the cockpit to kill all com links / power so that people outside the cockpit are still able to communicate with the ground to get the root pwd, and as mentioned elsewhere the person inside the cockpit could change their strategy to make recovery of control difficult or impossible even in this case (EDIT: e.g. throwing the plane about). Also, you'd probably want >1 ATC person to authorise to reduce the chance of the door being unlocked by someone at ATC in cahoots with hijackers.
If you're descending into an airport near NYC it's possible that you need to fly towards the city, turn and then continue descending to land. If you hit the autopilot external override at the right time you could be lower than the tallest buildings and get locked into flying into them without enough time to react.
The real solution would seem to be what other people in the thread are suggesting; you must always have two people in the cockpit. At least one pilot and possibly another crew member.
At this point, pilots are really there to take care of unusual situations that the computer can't (which do happen from time to time.)
Source: I have a pilots license.
https://www.youtube.com/watch?v=ixEHV7c3VXs
YEEEEAAAAHHHHHHHHHHH
The pilot can override the code by locking the door in which case it can only be opened from the cockpit for some minutes (5-20).
Source: https://www.youtube.com/watch?v=ROIH3KCEIvs&hd=1
(4) If one pilot leaves a pilot duty station of an aircraft when operating at altitudes above 25,000 feet MSL, the remaining pilot at the controls shall put on and use an approved oxygen mask until the other pilot returns to the pilot duty station of the aircraft.
Additionally, it's either US airline operating procedure (or perhaps FAA regulations, I couldn't find it though) for a second crew member to stay in the cockpit when one of the pilots has to leave.
In hindsight a policy of always having at least two people does seem preferable. (And, just a little reminder here: Just because someone is willing to fly a plane with 149 other people on board into a mountain doesn’t mean they would be willing to do other awful things, too, like acting violently in person against another person, for example a flight attendant. Preventing this kind of behavior may well be about putting in place many small hurdles.)
I think it’s pretty clear that people in the cabin should never be able to access the cockpit against the express will of people inside the cockpit (preventing scenarios in which someone violently forces someone with knowledge of how to access the cockpit – e.g. a pilot coming back from the toilet – to divulge that information and gaining access that way), so realistically you can only throw people at this problem – and throwing people at this problem is thankfully in this case relatively straightforward and shouldn’t really have any other negative consequences. I don’t see a technical solution to this problem, but there might not have to be one.
Seems like a sensible idea with hindsight.
If Pilot had a root pass for the door lock, this could have ended up differently.
My sincerest condolences to families of passengers..
The point with the designs now is that once they are locked, they stay locked, and no amount of killing hostages gets it opened.
I don't have a greater point I suppose, but it seems worth thinking about. Except, perhaps-- how do you go about 'screening' for inclination to mass-murder?
The first officer shut the captain out who tried to break the door until the end.
http://www.aeroinside.com/item/3416/lam-e190-over-botswana-n...
Automate this stuff.
In the context of a pilots mental state verses malicious source code being installed on a set of flight computers, I'd have to say the computer is easier to validate. That many more people have to approve the process. With a pair of pilots the validation process is much smaller and more complex.
We need to stop thinking that machines are flawed and that humans know best. The fact of life is that machines can and do perform better than humans, the only reason flight computers don't currently is that there hasn't been the investment in making them do so. Sensors fail but that is an engineering problem that can be solved.
I was recently flying in a small airplane (SR22) and the terrain detection system was going bonkers when we were landing saying that terrain was getting close to us. They have all the data, they just need to build in some more protections.
(Not sure I'd call that a technical solution, but let's assume so.)
Trust me: Planes could fly themselves using today's technology.
In fact, pilots are trained to communicate AFTER they have gotten the plane in a state to where they can either continue the flight or ditch safely if communication would distract them from the task at hand. ATC knows this, so even if they saw the plane dropping like a sack of rocks, they would probably assume that there was a problem and that the pilots are in a position in which a steep dive will help mitigate the problem (which can happen, such as depressurization).
Ultimately I think that remote control or a comparable safety measure will become a necessity in civil aviation, because passengers will demand it to feel safer.
I think you might have missed my point. What telemetry do you think would have given ATC enough information in 8 minutes that would tell them reversing the descent is the correct course of action? If anything, the data in this flight would have indicated that the dive was initiated by the pilot, and would suggest allowing him to continue the actions. And how long would they have to discuss what should be done? The descent started 8 minutes before the plane hit the ground. That is a very short amount of time for people on the ground without full information to make the call. They would probably spend at least half that time trying to make contact with the pilot.
The bottom line is that the person best appraised of how to fly the plane is the one behind the controls, and that is how aviation has traditionally treated these situations. If a pilot wants to bring down a plane bad enough, it's mighty hard to stop them.
Anyways, and this is my speculation, I am fairly certain that remote control has been brought up many times before in aviation, and that there is a good reason why it isn't presently implemented. And as for the corner cases, those corner cases matter. This isn't a software engineering problem we are talking about.
Airline pilots are a highly selective group of people, well trained, and they are showing every day how they work with integrity. That someone has once gone over and killed himself and others should not obscure our assessment of the situation. We have about 88 000 departures per day in the world. We don't accept even ppm-range risks of disaster if we know how to mitigate them, but when we're this low, we need to be careful that "improvements" don't actually degrade performance.
Such a terrible idea in such a short sentence...
I think we will see personal driving banned in some cities (CBDs at least) or routes in the coming decades as self-driving cars come to dominate our roads.
http://www.aeroinside.com/item/4946/lufthansa-a321-near-bilb...
This seems like a huge risk that wasn't considered when the new strengthened cockpit doors were installed.
That's what I thought, too. Does the pilot also (always?) have a key to the cockpit door in his pocket (risk, because than a terrorist could steal it while the pilot goes to toilet) so that he could reenter the cockpit? So for me a plausible explanation is the the co-pilot had a medical emergency while alone in the cockpit. Now comes the question:
Would pressing the descent button in this case perhaps even increase the chance of survival (in this case the co-pilot was doing a quick-witted decision) or not?
"Terrorism is commonly defined as violent acts (or the threat of violent acts) intended to create fear (terror), perpetrated for a religious, political, or ideological goal, and which deliberately target or disregard the safety of non-combatants (e.g., neutral military personnel or civilians)."
This guy is a mass murdered, not a terrorist (in the usual sense of the word).
It depends on the motivation of the pilot i.e. Did he intend to create fear? At this point the motivations remain unclear, so it can't be termed an act of terrorism.
May be self-driving planes is next stage of aviation evolution just like drones for military purposes.
If we look outside, technological trends and intents of organizational leaders are in the direction of more automation and lesser human dependence.
This is nightmare fuel. I cannot imagine what they went through. No human should have to end their life this way...such a tragedy.
Maybe they didn't start screaming until it was obvious that they were going to crash, but they knew that the captain couldn't get back into the cockpit long before that.
On long flights pilots are also rotated in and out of rest breaks.
After 2001 the pilots were considered "good" and the rest of the crew and passengers "bad".
But what happens when pilot intentions are not good? In this case the crew and passengers are impotent to save their selves.
This is probably what happened in the last two missed airplanes too.
The same is happening with the Government, after 2001 the people have given too much power to the Government because they considered it "good" against the "bad" guys. But as the people in Germany knows, the people in the Government could be the bad guys.
A possible idea is to release the lock (allowing entry using the PIN) if the board computer determines that a crash is likely. (This is safe, because it's unlikely that there is an attacker who wants to enter the cockpit and at the same time a situation likely to result in a crash.)
This clearly only helps against the problem with the locked door, but it seems comparatively easy to implement.
Edit: Another idea: The autopilot should prevent a crash and the only way to disable it should be by pressing two buttons at opposite sides of the cockpit (so two persons have to cooperate).
Honestly, I wanted to help with something constructive here but I don't think we will ever solve the problem of crazy people in the cockpit.
Autopilot engaged.
Your autopilot has malfunctioned and has initiated a steep dive. This has knocked the other pilot unconscious.
> DISENGAGE AUTOPILOT
You need another person to disengage the autopilot. Autopilot remains engaged.
> DISENGAGE AUTOPILOT USING YOUR FOOT
The buttons are too far apart, you cannot reach both at the same time. Autopilot remains engaged.
>
The plane hits the ground and disintegrates. YOU HAVE DIED. Do you want your posessions identified (Y/n)?
> _