Germanwings flight 4u9525 CVR.

[a210210200]

it looks like all airlines will now not allow a single member of crew to be alone in the cockpit at any one time. I think we can all agree that it's amazing (frightening?) that this was not already accepted policy on all airlines.

Hopefully, the door locking protocol will be reviewed as well. This would hopefully deal with problems caused by suicidal crew members as well as ones that suddenly fall ill and maybe operate the controls in error as they lose their judgement and reasoning as they pass out. But always having two people in the cockpit would help here too.

It is more frightening that no one said the door lock logic was stupid in the decade+ it existed because even with two people either one could be the attacker and since they are already on the secure side and if they win the struggle the cabin crew can do nothing to fight back because of the door lockdown as it currently exists cannot be overridden. Pilot suicide isn't exactly unknown it is rare but no one bothered to think well this door is so secure if a pilot ever did try to commit suicide or worse target a building there is nothing the cabin crew could do with this lockdown logic.

With a cabin crew key pool hijackers would still have an extremely hard time obtaining all the keys without them being first erased and in a takeover by crew/person inside the cockpit already the cabin crew just has to use their keys together to override the door lock. The numbers of crew required and keys erased before the override is rendered in operable can be adjusted based on the crew and plane layout to optimize the balance of security.

The problem with the locked cockpit door, regardless of how many crew are required to be behind it, is that it accepts the premise that the passengers' lives don't matter. The whole point is to allow the crew to land the plane safely (i.e., to avoid an event like 9/11) all while terrorists/criminals do as they will with the unarmed and defenseless passengers.

This is why I propose a cabin crew key pool, the passengers clearly can also rise to the occasion as in United Flight 93 just have it as part of the safety training that if terrorist attack a crew member you should help and the key devices are the target and how they are erased. It allows passengers/cabin crew to have a fighting chance even if someone on the flight deck side is malicious.

The problem with the assumption that passenger's and cabin crew don't matter fails catastrophically when the terrorist/suicidal person is already on the secure side. Your totally screwed as demonstrated in Germanwings and probably MH370 (if we ever do recover anything).

[nctnico]

The only hope for survival would be to open the door at 10,000 feet and jump out, tying a heap of clothes to yourself as a parachute tail. This would slow you down somewhat, and then hope you hit the steep side of a snow packed mountain.

The chances of survival are very slim. You probably break several bones in your body the second you step out of an airplane in an airstream going 700km/h. And then you have to manage to avoid colliding with the wings, stay out of the engine exhaust stream and avoid the tail. After that it's about 3000 meters of free fall. Dropping into a lake is like landing on a piece of concrete so a steep snowy hill could be the best case scenario IF you don't start an avalanche.

[dannyf]

It is more frightening that no one said the door lock logic was stupid ...

Any mechanism would not be perfect and someone will figure out a way to explore it.

If you look at the number of aircraft-assisted suicides, the ones done by pilots are in the minority. So their primary goal is to keep out the bad guys - assuming that the pilots are trustworthy.

Not a perfect assumption but not a bad assumption either.

[a210210200]

Any mechanism would not be perfect and someone will figure out a way to explore it.

If you look at the number of aircraft-assisted suicides, the ones done by pilots are in the minority. So their primary goal is to keep out the bad guys - assuming that the pilots are trustworthy.

Not a perfect assumption but not a bad assumption either.

Just because you can't make it perfect doesn't mean you shouldn't change it when it is clearly logically flawed. Exploit I believe is what you mean to say and that is considered as part of the design of the key pool. People are already exploiting the existing system and crashing planes with it and if it isn't changed people will keep abusing it even more.

With the two person rule either could be the attacker or even a terrorist. You cannot assume the flight deck will never be under malicious control it is clearly a totally invalidated assumption. The weakness is now very obvious and widely spread in the press.

[donotdespisethesnake]

The problem with the locked cockpit door, regardless of how many crew are required to be behind it, is that it accepts the premise that the passengers' lives don't matter. The whole point is to allow the crew to land the plane safely (i.e., to avoid an event like 9/11) all while terrorists/criminals do as they will with the unarmed and defenseless passengers.

It is true, the locked door policy is not directly for passenger safety. It is to prevent terrorists using the plane as a weapon and killing people on the ground, in addition to those in the airplane. Although, deterring hijacking in general helps reduce risk for airline passengers. If terrorists just want to kill passengers or general public there are many easier targets.

Other measures are implemented to improve safety for the aircraft passengers and flight crew outside the secure flight deck, and arguably they have been successful.

Preventing attack from air crew themselves is just something that has never been addressed, nor really even recognised as a problem. It's happened on a few occasions. The locked door policy is one of those unintended consequences. In one case, the FO used the door lock to prevent access by his Captain who was behaving irrationally, so it works both ways.

[Neganur]

Just fyi.
It has absolutely not been said that the doctor that gave sick leave for that day was a psychiatrist. Just that in the past he had been treated by various doctors.
Several torn sick leaves have been found is what one newspaper claims, among them is one from a neurologist/psychiatrist another from the university hospital in the town where he lived.
Also All the interviews I have seen with a psychiatrist were just some random expert and not the actual doctor who gave the sick leave. Where are you getting all this from? It seems you're not reading the news properly.

[dannyf]

when it is clearly logically flawed.

I think that's in dispute.

[a210210200]

Preventing attack from air crew themselves is just something that has never been addressed, nor really even recognised as a problem. It's happened on a few occasions. The locked door policy is one of those unintended consequences. In one case, the FO used the door lock to prevent access by his Captain who was behaving irrationally, so it works both ways.

When the Captain is behaving irrationally the cabin crew could evaluate this and ask the FO what is going on and for him to explain what is going on. In my system the crew would need to use their keys together so many people would have to think the Captain is not behaving insane to override the door for him. If he is crazy and tries to attack the cabin crew to get all of there keys then the hijack scenario plays out where by they fight back and it takes only a few to erase their keys to keep the door secure.

If the captain was locked out and is sane but the FO is not responding to calls or anything but is locking out the door control then they would be able to determine he is likely insane/suicidal and would use the door override as a group.

when it is clearly logically flawed.

I think that's in dispute.

If your going to dispute it you have to say why otherwise your providing no counterpoint.

[economist]

It is true, the locked door policy is not directly for passenger safety. It is to prevent terrorists using the plane as a weapon and killing people on the ground, in addition to those in the airplane. Although, deterring hijacking in general helps reduce risk for airline passengers. If terrorists just want to kill passengers or general public there are many easier targets.

Agreed. Any collection of unarmed and helpless people would do.

[G0HZU]

It is more frightening that no one said the door lock logic was stupid in the decade+ it existed because even with two people either one could be the attacker and since they are already on the secure side and if they win the struggle the cabin crew can do nothing to fight back because of the door lockdown as it currently exists cannot be overridden.

I agree that the existing door lock protocol is a bit scary and needs to be reviewed.

I still can't quite fathom why some gun lovers in the USA think that giving each of the crew a gun would have helped in this case. It's hard to argue any case where it would be justifiable to give the crew a gun. Do they think the pilot or copilot would leave the cabin with some form of runted gun to sort out terrorists? Walking past 100 suspects down a cramped cabin aisle when armed only with some form of runted gun doesn't seem like a good plan. Maybe I need to watch more movies to see how Bruce Willis would do it

[pickle9000]

It takes one second to disable the computers. Your best chance of survival with a suicidal pilot is by letting the other one in again asp, not by pooling multiple security cards.
A 'second person in the cockpit' rule will reduce the threat to a large extent.

Procedural changes always win over hardware. They can be implemented system wide quickly with minimal cost.

[a210210200]

It takes one second to disable the computers. Your best chance of survival with a suicidal pilot is by letting the other one in again asp, not by pooling multiple security cards.
A 'second person in the cockpit' rule will reduce the threat to a large extent.

Procedural changes always win over hardware. They can be implemented system wide quickly with minimal cost.

Procedural changes don't always work, can you procedurally change a non-FBW system to include FBW technology. Nope. Planes are a big blob of technology so making the door lock a bit smarter with a new pin pad isn't exactly a significant cost component of the plane.

Knee jerk procedural changes are commonly associated with this thing called security theatre, it is a false sense of security with the root technological fault un-addressed. Second person could be the attacker and either person still has the element of surprise and can totally lockdown the flight deck after.

The door lock system itself was designed in a hurry without consideration for what consequences it might have, I am proposing to fix it by altering the pin pad to accept a cabin crew key pool.

[donotdespisethesnake]

I guess we need the reverse Turing test. The autopilot should test the pilots to see if they are fit to be allowed in the cockpit. The autopilot is named HAL, of course.

The pilots have the ability to crash the plane on any flight they want, even with the other pilot or flight crew sat in the other seat. Near the ground, it would happen to quick for the other pilot to regain control.

Trying to devise a system with pilots to prevent that is just impractical, although it is conceivable that ground or automatic control would do it. Are people prepared to fly pilot-less planes? Would it just open another source of failure or terrorist attack?

Ideally, medically unfit pilots would not be allowed on the flight deck. Unfortunately, mental health screening is very bad at predicting who will become a risk sometime in the future. The only option for the airline would be to permanently ground anyone suspected of risk. Pilots would then just cover up MH health issues, which is a lot easier than hiding physical health issues.

In the end though, all activities in life carry some risk. The risk of death by suicidal pilot is tiny, so is it even worth worrying about?

[a210210200]

Trying to devise a system with pilots to prevent that is just impractical, although it is conceivable that ground or automatic control would do it. Are people prepared to fly pilot-less planes? Would it just open another source of failure or terrorist attack?

Well technically automatic ground collision avoidance, http://aviationweek.com/defense/ground-collision-avoidance-system-saves-first-f-16-syria would help stop CFIT.

And normal law on Airbus also provide a number of protection against dropping out of the sky. Sure the pilots could try to bypass, trick, disable these systems but at least you have some more time to take back control. Pilot-less planes passenger planes are dangerous because either the remote link could be hacked/disabled or if stand alone once there is a computer failure and the voting logic system has not enough votes to reach majority then your screwed. With a drone it has no one on it so if it crashes due to any of those failures it is just a monetary/time/physical resource loss. If a passenger jet say like an A380 crashes because the voting logic screwed up then your going to get ultra-sued out of the water. (Pilots also help individualize liability to some degree)

[pickle9000]

It takes one second to disable the computers. Your best chance of survival with a suicidal pilot is by letting the other one in again asp, not by pooling multiple security cards.
A 'second person in the cockpit' rule will reduce the threat to a large extent.

Procedural changes always win over hardware. They can be implemented system wide quickly with minimal cost.

Procedural changes don't always work, can you procedurally change a non-FBW system to include FBW technology. Nope. Planes are a big blob of technology so making the door lock a bit smarter with a new pin pad isn't exactly a significant cost component of the plane.

- Even if a better hardware solution exists it may not be implemented or implemented in a timely fashion. This can be cost related, country, manufacturer issues. The majority of airliners are in service not on a production line.
- Crash investigators are concerned with safety. If they suspect an issue (such as having an extra person in a cockpit) to be beneficial they will state it early on so airline can inform pilots. Even if the issue proves to be false in the future.
- There are many things that could be added to increase safety. Video under belly, on tail, on cockpit door, in cockpit for example. If stored on a flight recorder would be an exceptional benefit.     

[a210210200]

- Even if a better hardware solution exists it may not be implemented or implemented in a timely fashion. This can be cost related, country, manufacturer issues. The majority of airliners are in service not on a production line.
- Crash investigators are concerned with safety. If they suspect an issue (such as having an extra person in a cockpit) to be beneficial they will state it early on so airline can inform pilots. Even if the issue proves to be false in the future.
- There are many things that could be added to increase safety. Video under belly, on tail, on cockpit door, in cockpit for example. If stored on a flight recorder would be an exceptional benefit.   

So your saying unscrewing two cabin accessible units which just control three electronic strikes and updating their software and sticking the back with a hardware modification is too onerous, expensive, ...

They replace units and modules all the time on a plane I'm pretty sure the membrane pad on the pin pad breaks too the unit is easily replaced and is not an integral system. It was added after the fact to most planes and is a door strike control not a flight control computer.

It has two modes of operation, unlock and lock. We just need to make the control logic of those two states better.

It is nowhere even remotely similar to the cost/weight of wiring and installing a video data recorder.

[TerraHertz]

*** Conspiracy stuff again from TerraHertz deleted by moderator. This stuff does not belong here ***

[a210210200]

It's kind of sad to see all the arguments about what changes to security/door codes, etc could make airplanes 'safe', or at least safer. Sorry, it's impossible to make something like flying absolutely safe.

I'm just going to ignore all that conspiracy mumbo jumbo and focus on what you talk about the door and safety.

It is impossible to make flying absolutely safe but flying only become as safe as it is through continuous improvement in technology, procedures, techniques, design, human factors study. And its just a door control unit this isn't rocket science. The fix I propose of a pooled cabin crew key system allows for crew to override in the clearly it can happen situation where the cockpit is under malicious control.

Improved door logic through a pooled cabin crew override system is a simple cheap fix that doesn't compromise security.

[rolycat]

Since I grew up around guns, lived in the gun culture most of my life I see them as harmless as a soldering iron.

The primary purpose of a gun is to inflict harm - seeing them as harmless is delusional.

Unless the soldering iron mortality rate in the USA is in the tens of thousands per annum?
 

[pickle9000]

Egypt Air Flight 990 was nuts.

http://news.aviation-safety.net/2013/12/22/list-of-aircraft-accidents-caused-by-pilot-suicide/

[TerraHertz]

A thought about the locked door, and the entry code.
Everyone assumes that the pilot outside could enter the correct code, and therefore the copilot had to have been entering over-rides. Therefore was conscious, and all that implies.

But, there's a very simple electronic fault that could change that scenario radically. Suppose one of the code entry keypad buttons went flaky?
I doubt there's a display showing the code numbers as they are entered. So, a faulty button in the keypad would result in the pilot entering his code, the code failing, and possibly he doesn't even know why.

I wonder if the code entry pad even makes a beep or something as the keys are pressed? Even if so, there are some keypad circuits that use resistor dividers so that each key produces a distinct output voltage, then a micro works out which button was pressed by doing an AtoD. If it was that kind of keypad, a component fault or even a bit of conductive dirt could give wrong numeric button values, while seeming to work/beep, etc.
What's the bet the cockpit door security keypad wasn't designed to the same failsafe standards as the flight instrumentation?

If what happened was something like copilot has brain aneurysm, then pilot can't get back into cockpit due to faulty keypad button, that would have to be a record for the cheapest part failure causing the worst accident.

[Wytnucls]

Unlikely. The keypad is used often through the flight and is very reliable. Each press of a key is registered with a beep and the full code triggers a chime in the cockpit that can be heard through the door.

There is now an interview of the copilot's former girlfriend, who described an individual of unstable character, with suicidal tendencies.

[pickle9000]

Again, I think making it mandatory to have two persons in the cockpit at all times good.

I used to work on some semi-automated railway equipment. At times I need to get to the sensors located on the workheads. The accepted procedure was to put a lockout tag on the equipment and get at it. I was a contractor and no way was I crawling in that area without the batteries disconnected, and a lookout on hand to keep people off the machine. Even just a momentary power up and I'm in three pieces. I see no reason an airline should not have the same belief. A second person, unskilled or otherwise will add greatly to the safety of the aircraft. 

[TerraHertz]

Unlikely. The keypad is used often through the flight and is very reliable. Each press of a key is registered with a beep and the full code triggers a chime in the cockpit that can be heard through the door.

Good. So the CVR will register those chimes several times, presumably. I hope it is released eventually. If the chimes are absent, then either the keypad was faulty, or code changed/forgotten (by everyone.)

There is now an interview of the copilot's former girlfriend, who described an individual of unstable character, with suicidal tendencies.

Well that certainly changes things.
If his medical condition was psychological, of that nature, and known, then it's a clear failure of the airline's medical screening. Wonder what the lawyers will make of that?

[cimmo]

But, there's a very simple electronic fault that could change that scenario radically. Suppose one of the code entry keypad buttons went flaky?
I doubt there's a display showing the code numbers as they are entered. So, a faulty button in the keypad would result in the pilot entering his code, the code failing, and possibly he doesn't even know why.

As per the images in the flight crew manual and the video, there is no digital display either on the access panel  or in the cockpit to confirm data entry. Also,  it very much appears as if the keypad uses capacitive touch technology. This technology is far from perfectly reliable.

FWIW, to some extent I concur with your thoughts on the 'bigger picture'. There are so many ways for any genuine and resourceful 'bad guys' to stuff up our daily lives and if they existed in the numbers that we are told, then we would know about it the hard way. I will not go into details for fear of raising a flag or two, but our highly intertwined tech based western society has hundreds of easily exploitable weak points.