Germanwings flight 4u9525 CVR.

[HighVoltage]

It seems the Co-Pilot was suffering from depression, but nobody noticed.
The Flight Data Recorder has not been found, but the news are talking about conclusive evidence.

[Kjelt]

But on smaller aircraft, the weight penalties would be prohibitive.

So what, if there is a decision made (which is going to be again reviewed) that the cockpit should be a fortress than the consequences should be taken to make it a fortress.

Back on topic, the co-pilot could not have known when the pilot was going to take a piss, this time it was luckily over uninhabited country.
I must not think of what would have happened if the pilot had taken that piss when they were flying over some major cities.

[a210210200]

It might take three seconds to disable the computers, if you're slow. I said a quick crew re-entry is you best change of survival, not a 100% certainty.
Previous accidents are irrelevant as rogue actions would have been modified to defeat your card pooling.

Quick crew re-entry is the same thing as quick terrorist entry. It doesn't work for terrorist or suicide.

How would they defeat the card pool, the cards are updated when the enter the plane and only the plane computer controls the keys generated and they use standard cryptography to ensure security. You would have to control the door hardware and avionics to bypass the door mechanism. Or attack crew members inside the passenger cabin.

[a210210200]

And that has happened. http://en.wikipedia.org/wiki/Federal_Express_Flight_705
A cargo aircraft (no pax), but a deadheading pilot went ape-shit with hammers and a spear gun.

The only way to mitigate against flight crew suicide attempts is to remove them entirely. The technology IS already there, the only part of a typical flight that actually requires a human is taxying (assuming no systems failures occur).

BUT - how many of the travelling public would accept being self-loading cargo inside a drone?

The problem is that what happens when the computer gets confused or its data link is jammed or fails. Humans are useful in exceptional situations but of course they too can cause exceptional situations to occur but engineering controls with human factors analysis can account for that. Worse I don't think we have an encrypted GPS that civil aviation can use so GPS spoofing could also occur.

[cimmo]

But on smaller aircraft, the weight penalties would be prohibitive.

So what, if there is a decision made (which is going to be again reviewed) that the cockpit should be a fortress than the consequences should be taken to make it a fortress.

Once we go down that road, then it gets silly. Would we end up with a requirement for an armed security guard (renta-cop) in the cockpit, with orders to shoot any pilot that appears suicidal?

The fact of the matter is that society requires trust. Every time you drive, you trust the oncoming traffic will remain on their side of a painted line. For whatever reason, sometimes that trust fails and people die.
But statistically, flying is still safer than any other mode of travel - even when the deaths are due to deliberate actions.

[Wytnucls]

More to do with a low self-esteem individual finding solace in the short-lived dominating feeling and adrenalin rush derived from the murder of a hundred plus strangers and crew, unhindered. Luckily, a rare trait amongst aircrew personnel. Just wished the shrinks would be able to detect those tendencies at the initial interview.

[cimmo]

And that has happened. http://en.wikipedia.org/wiki/Federal_Express_Flight_705
A cargo aircraft (no pax), but a deadheading pilot went ape-shit with hammers and a spear gun.

The only way to mitigate against flight crew suicide attempts is to remove them entirely. The technology IS already there, the only part of a typical flight that actually requires a human is taxying (assuming no systems failures occur).

BUT - how many of the travelling public would accept being self-loading cargo inside a drone?

The problem is that what happens when the computer gets confused or its data link is jammed or fails. Humans are useful in exceptional situations but of course they too can cause exceptional situations to occur but engineering controls with human factors analysis can account for that. Worse I don't think we have an encrypted GPS that civil aviation can use so GPS spoofing could also occur.

I was not suggesting a drone-airliner as a serious alternative (that's why I made that final comment). I was trying to  point out that there really is no alternative but to trust the pilots and occasionally die due to their human frailties.
No system is perfect. 

[a210210200]

I was not suggesting a drone-airliner as a serious alternative (that's why I made that final comment). I was trying to  point out that there really is no alternative but to trust the pilots and occasionally die due to their human frailties.
No system is perfect.

You can also trust the cabin crew as a pool (the pooled key system) and improve overall safety. You still trust the pilots you just make the door logic better. Just because it isn't perfect doesn't mean we can't improve it.

[Wytnucls]

Card pooling is easily defeated by a rogue pilot destroying the aircraft within seconds.
The current system works in case of an attempted hijack. Nothing is 100% proof. An unrealistic scenario can always be found to undermine any procedure.
All airlines are moving towards the '2 people in the cockpit rule' as the best solution.

[cimmo]

All airlines are moving towards the '2 people in the cockpit rule' as the best solution.

In the early days of cockpit automation and removal of flight engineers and navigators, the joke was that a future cockpit would have two pilots and a dog.

The dog's job was to bite any pilot who attempted to touch the controls.

The pilots jobs were to feed the dog.

[a210210200]

Card pooling is easily defeated by a rogue pilot destroying the aircraft within seconds.
The current system works in case of an attempted hijack. Nothing is 100% proof. An unrealistic scenario can always be found to undermine any procedure.
All airlines are moving towards the '2 people in the cockpit rule' as the best solution.

If a rouge pilot manages to do it within seconds then yes you are screwed. But MH370 was 7+ hours, Germanwings had many minutes. The current system doesn't work because it has clear flaws in its control logic. Also airbus planes have flight control laws which increase the number of seconds it takes and if the person isn't a pilot then they wouldn't be able to disable it easily.

2 people in the cockpit and 4 in the cabin is the best solution. It would be very hard to get the keys from the rear of the plane to the front without causing a riot in a hijack situation.

In a suicide scenario or terrorist pilot you may have time to save the plane depending on their objective and this pooled key system offers that possibility so instead of having 100's of people screaming and banging on a door for minutes in vain they have a chance at taking back control.

Nothing is 100% proof but we can make it safer still, otherwise what is the point of increasing air safety rules as planes don't crash much anyway. Tell that to the families of Germanwings 4U9525.

[EEVblog]

I agree. Supposedly this thing can sustain 3000+g. And if the case is disintegrated, there is a severe design issue here.

This is what happens to a plane that hits an immovable object at 500MPH, supposedly not that much faster than this flight hit at.


I'm surprised the recorders survive at all in these types of crashes. Being in the tail would have a lot to do with that.
In this case it appears as though the plane hit an angled slope, so that also takes a lot of energy out on the impact, but still massive.

[a210210200]

I'm surprised the recorders survive at all in these types of crashes. Being in the tail would have a lot to do with that.
In this case it appears as though the plane hit an angled slope, so that also takes a lot of energy out on the impact, but still massive.

If the FDR data unit is damaged/lost we are very lucky it wasn't the CVR data unit that was lost/damaged as that was pretty much instantly conclusive. The suicidal pilot may have been trying intentionally to cause a crash that would test the physical limits the data recorders in an attempt to hide his actions.

[Gixy]

Fighter aircraft often have ejectable recorders in the tail. Upon detection of an abnormal acceleration (deceleration), the recorder is automatically ejected. This will be mandatory on commercial airplane soon, allowing to recover earlier recorders in case of ocean dive (the recorders will float). This is already used on the last Airbus A350.

[nctnico]

It might take three seconds to disable the computers, if you're slow. I said a quick crew re-entry is you best change of survival, not a 100% certainty.
Previous accidents are irrelevant as rogue actions would have been modified to defeat your card pooling.

Quick crew re-entry is the same thing as quick terrorist entry. It doesn't work for terrorist or suicide.

Perhaps. But people now know terrorists are going to kill them either way so they might put up a fight with the terrorists before they can even reach the cockpit. I'd vote for putting the good old curtain which seperates the cockpit from the rest of the plane back.

[a210210200]

Fighter aircraft often have ejectable recorders in the tail. Upon detection of an abnormal acceleration (deceleration), the recorder is automatically ejected. This will be mandatory on commercial airplane soon, allowing to recover earlier recorders in case of ocean dive (the recorders will float). This is already used on the last Airbus A350.

I doubt you could make everyone install one on every existing plane though it would be an expensive modification if done after mfg.

Perhaps. But people now know terrorists are going to kill them either way so they might put up a fight with the terrorists before they can even reach the cockpit. I'd vote for putting the good old curtain which seperates the cockpit from the rest of the plane back.

Secondary barriers exist but they add a not insignificant weight and cost the secure door probably has stopped hijackings for happening because it is very secure (probably too secure from even a legitimate attempt to access). With a cabin crew override system the passengers would not impede its use. In a terrorist situation it allows the entire cabin to fight over all areas to prevent terrorists from getting to the keys the cabin crew hold before they erase them.

This would provide the passengers and cabin crew a chance of taking back control in this case while not allowing terrorists easy access.

[Gixy]

And what about no door at all between cabin and cockpit? Dedicated outdoor access, private lavatories, completely isolated cockpit with all the crew always present.

[rr100]

Not only you need the extra door (if even possible do "cut" for existing airplanes), plus lavatories but you also need food and drink for the pilots (all both one-time and ongoing costs - access, bringing food/drinks and taking out the trash/cr*p would cost extra).

You might also need extra people and/or extra trainings because you have everything segregated, extra first aid kits.

And even with that there's still the possibility to have next year (or in 5 or in 20 years) a situation where the plane crashes because the pilots are confined to their cabin.

[TerraHertz]

Oh, the co-pilot was depressed? Breathed evenly all the way down, till the plane hit a rock wall at 600mph, while also ignoring the pilot trying to smash the door down, and not even saying anything in response?

Let's call that one the 'suddenly suicidal AND robotic-insane co-pilot' version.

I think I'll reserve judgment on that one for a while.
My guess: If the co-pilot caused it, then he'd had a stroke or brain aneurism.

I saw a graphic of the descent profile. It was remarkably even - a straight line really. I find it hard to believe a suicidal person would maintain a nice even flight path the whole way down under manual control. Especially with a door being hammered behind them. If it was human action, it had to be something like an initiating action at the start, then no further action. Such as because he couldn't do anything due to stroke. Finding the FDR guts would be good.

The problem with some brain accident that caused a weird 'set descent' action, then prevented any further action (just sitting there breathing), is that seems to require the plane to be still flying in autopilot mode. But is there a ground avoidance system? Or does it just sound a warning and keep descending anyway? Or maybe, flying into a steep mountainside exceeded the avoidance system abilities? Actually, thinking about it I'm pretty sure airliners do NOT have ground avoidance. Just a terrain proximity alarm.
So, copilot starts to have a brain accident, his last action is to set a steady descent rate. After which he's completely incapacitated.

Alternatively there's the possibility of 'software intervention', combined with some means of rapid incapacitation of cockpit crew. And depressurisation is not in the running, since the alarms would have been sounding, and apparently they weren't.

Wrong gas mix might do it. But I don't think planes have any means for reducing the O2 percentage in the air, let alone in the cockpit exclusively. It's just outside air, increased in pressure as necessary.
Adding a knockout gas to only the cockpit air? With the pilot being outside at the time an unexpected complication.

There's fundamentally no way to make a plane safe from pilot choices. It's essential to be able to be able to switch the flight computers off (normal law to direct law), and fast, for cases where the sensor instruments go AWOL/iced-up/whatever. But in direct law the pilot can tear the plane to pieces in seconds if he wants to. For instance, just engage reverse thrust deflectors on one engine. No more wing. Just as fundamentally, having anti-hijack software built into flight computers, with an external command link via the transponder (a radio modem) is just asking for trouble. There's no such thing as 100% security in digital systems. Especially when it's the people holding the keys, who are the least to be trusted.

Questions:
Is the cockpit door lock ultimately under software control by the engineering computer?
I wonder why this news article was edited to remove mention of fighter jets present at the time of impact?

[a210210200]

And what about no door at all between cabin and cockpit? Dedicated outdoor access, private lavatories, completely isolated cockpit with all the crew always present.

Then your totally screwed if a pilot takes over as there is no way at all (not even a door).

[Gixy]

@ TerraHertz

- Stable descent has probably be done by automatic pilot ; anyway the scale of available documents isn't precise enough to see any pilot inputs
- Cockpit door is an autonomous system, independant from the flight computers
- there are 3 levels of protection (including mechanical) to avoid thrust reverse extension in flight
- a fighter took off when the Air Traffic Control launched the alert and overflew the site just after the crash, not before. This allowed to find rapidly the wreckage.

[VK3DRB]

I agree. Supposedly this thing can sustain 3000+g. And if the case is disintegrated, there is a severe design issue here.

This is what happens to a plane that hits an immovable object at 500MPH, supposedly not that much faster than this flight hit at.
...

I'm surprised the recorders survive at all in these types of crashes. Being in the tail would have a lot to do with that.
In this case it appears as though the plane hit an angled slope, so that also takes a lot of energy out on the impact, but still massive.

So how do they recover the bodies if they are pulverised to dust?

The only hope for survival would be to open the door at 10,000 feet and jump out, tying a heap of clothes to yourself as a parachute tail. This would slow you down somewhat, and then hope you hit the steep side of a snow packed mountain.

How about falling out at 33,000 feet and living? en.wikipedia.org/wiki/Vesna_Vulovi?

A side comment... the video obvious shows a sophisticated but flawed door lockout system. Calling a French air hostess "Sally" on the video is a bit insulting. I have never heard of a Sally who is a French national of French ancestry.

[Kjelt]

I think I'll reserve judgment on that one for a while.
My guess: If the co-pilot caused it, then he'd had a stroke or brain aneurism. 

Yeah right and then each minute over and over again manually overrule the first pilot emergency access code by using a switch, each minute again and again , don't think so.

[Artlav]

But people now know terrorists are going to kill them either way so they might put up a fight with the terrorists before they can even reach the cockpit.

Don't be so sure. Everyone will be thinking "someone else would attack them first", or something to that effect.
It's actually a bit sad how a couple people with guns in cramped space can completely overwhelm hundreds of people.

And what about no door at all between cabin and cockpit? Dedicated outdoor access, private lavatories, completely isolated cockpit with all the crew always present.

That is an interesting approach. There is no good reason for the pilots to leave the cockpit, give or take various emergency situations.

One big question is communications - should the cabin crew be able to contact the pilots at all?
If yes, then the terrorists would be able to threaten the pilots.
If no, someone getting sick on board would have to wait till landing.

I find it hard to believe a suicidal person would maintain a nice even flight path the whole way down under manual control.

Certainly, and as far as we know the speed is consistent with the autopilot being in rapid descent mode. All he had to do is flip a switch and turn a knob.

One possibility i seen discussed a lot is that the pilot felt the approach of sickness, mis-identified it as decompression in progress and tried to set the plane to go back into the thick air, then passed out.

Only problem is, to quote the police: "the States Attorney in Dusseldorf confirmed that the two homes of the first officer have been searched in order to find clues to the motives of the first officer. A medical certificate requiring sick leave has been found during those searches, the certificate was found torn, the first officer reported for the flight nonetheless."

They don't specify what kind of certificate it was - psychological or physical, so it can mean either scenario.

But is there a ground avoidance system?

No such thing. The autopilot is basically a fly-straight-and-level device, with an ability to maintain a set altitude and heading.

Alternatively there's the possibility of 'software intervention', combined with some means of rapid incapacitation of cockpit crew.

Less than likely. The cockpit is not that isolated from the rest of the plane, controlled decompression takes a while and would affect everyone (and  be audible in the pilot's breathing), knockout gasses are nowhere to be obtained from, gas mixture can not be controlled (it's just outside air).

And any logical intervention will be in the form of making autopilot fly somewhere, not disabling the crew - it is a fly-by-wire plane, without computer cooperation it can't be controlled at all.

just engage reverse thrust deflectors on one engine. No more wing.

Happened once. Wings stayed intact, but the plane rapidly lost speed, stalled and fell. They added a lot of interlocks to prevent it in flight since then.

[ElektroQuark]

"I saw a graphic of the descent profile. It was remarkably even - a straight line really. I find it hard to believe a suicidal person would maintain a nice even flight path the whole way down under manual control."


It wasn't under manual control. He changed autopilot altitude to 100 feet.