Slashdot Mirror
Modern Cockpits: Harder To Invade But Easier To Lock Up
HughPickens.com writes: Jad Mouawad And Christopher Drew write in the NY Times that although airplane cockpits are supposed to be the last line of defense from outside aggressors, airlines have fewer options if the threat comes from within. One of the major safety protocols that actually made planes safer in the past 15 years was that the cockpits were turned into fortresses. Unfortunately, that exact advantage was exploited by the co-pilot of the Germanwings plane on Tuesday to crash it intentionally. "It is shocking to me that there was not a second person present in the cockpit," says Mark Rosenker, a former chairman of the National Transportation Safety Board. Access to the cockpit is strictly regulated in the United States. Passengers are not allowed to congregate near the cockpit door, and whenever the door is open, no one is allowed in the forward bathroom and flight attendants usually block aisle access, sometimes using a food cart. The Federal Aviation Administration mandates that a flight attendant must sit in the cockpit when either pilot steps into the passenger area; European regulations do not have a similar two-person rule, but they're now talking about creating one.
The Germanwings accident also points to potential shortcomings in how pilots are screened for mental problems, a recurring concern for an industry that demands focus and discipline in an increasingly technical job, often in stressful situations. In 2012, a well-regarded pilot with JetBlue, one of the airline's earliest employees, was physically restrained by passengers on a flight from New York to Las Vegas after displaying erratic behavior. In that case, the co-pilot locked the pilot out of the cabin and made an emergency landing in Amarillo, Tex. "Aircraft-assisted pilot suicides," as the Federal Aviation Administration calls them, are rare. They include the November 2013 crash of a Mozambique Airlines plane bound for Luanda, Angola, which bears an eerie resemblance to the Germanwings plane's demise. When the flight's co-pilot left to use the lavatory, the captain locked him out of the cockpit and manually steered the aircraft earthward. The crash of Egypt Airlines Flight 990 off Nantucket, Mass., in 1999, which killed all 217 people on board, was also caused by deliberate action, a National Transportation Safety Board investigation concluded. Experts on suicide say that the psychology of those who combine suicide with mass murder may differ in significant ways from those who limit themselves to taking their own lives.
The Germanwings accident also points to potential shortcomings in how pilots are screened for mental problems, a recurring concern for an industry that demands focus and discipline in an increasingly technical job, often in stressful situations. In 2012, a well-regarded pilot with JetBlue, one of the airline's earliest employees, was physically restrained by passengers on a flight from New York to Las Vegas after displaying erratic behavior. In that case, the co-pilot locked the pilot out of the cabin and made an emergency landing in Amarillo, Tex. "Aircraft-assisted pilot suicides," as the Federal Aviation Administration calls them, are rare. They include the November 2013 crash of a Mozambique Airlines plane bound for Luanda, Angola, which bears an eerie resemblance to the Germanwings plane's demise. When the flight's co-pilot left to use the lavatory, the captain locked him out of the cockpit and manually steered the aircraft earthward. The crash of Egypt Airlines Flight 990 off Nantucket, Mass., in 1999, which killed all 217 people on board, was also caused by deliberate action, a National Transportation Safety Board investigation concluded. Experts on suicide say that the psychology of those who combine suicide with mass murder may differ in significant ways from those who limit themselves to taking their own lives.
So, after 9/11 they rushed to put door locks on the damned things.
And, now, to the utter shock and amazement of everybody ... someone in the cockpit can lock people out of it. Exactly as they designed it.
I'm stunned, I tell 'ya.
Of course, now when the pilot has to take a leak there is one less cabin crew, which I'm sure you can construct a scenario in which that's not a good idea.
Lost at C:>. Found at C.
Unfortunately, if one of the pilots wants to take the aircraft somewhere (be it into the side of a mountain, or to Cuba, or wherever) there's little the engineers, airlines or ATC can do about it. Any security measure will have a gap.
And also, the pilots must have control of the aircraft. It's far more likely that an exception to protocol or security will be required to save lives than to endanger them.
I can see the fnords!
Having a flight-attendant sit in for a two-person rule may not have saved the plane, but at least the co-pilot would have to work harder for it.
Planes need to be able to do emergency landings, so it makes sense there's an override switch for landing in the terrain.
I agree that the 'two people in cockpit at all times' rule that already exists in the US is a good idea and I'm sure this will now be introduced in Europe. Some airlines in Europe, Canada and elsewhere are already introducing it, as we speak.
As for the argument that the tougher cockpit doors and lockout mechanisms are to blame for this incident ... that could be argued, but those changes have probably saved more lives over the last 14 years than were lost in this tragic incident, so rolling them back would be unwise. Admittedly this is somewhat like Lisa's tiger rock - we don't ~know~ how many potential hijackings or cockpit intrusions haven't occurred simply because would-be hijackers know that taking that approach is useless now. But looking at the number of hijackings per decade pre-9/11 and comparing to now, I think it's safe to say the strengthened doors and new cockpit access protocols were a net improvement.
But all the security protocols in the world can't completely prevent incidents like this. Two people in the cockpit may make it slightly more difficult, but it just means the suicidal pilot needs to incapacitate the other person in there first. That adds an additional mental barrier (it is psychologically 'easier' to simply turn a dial and set an altitude below the terrain level, than it is to kill someone or knock them out first), so will prevent at least some of these incidents that may have otherwise occurred. But there is no complete solution because at the end of the day, those in the cockpit are in control of the machine and can do what they want with it. We put our trust in them, and in the airlines' ability to ensure their medical and psychological health.
airlines have fewer options if the threat comes from within.
This shouldn't be a surprise. It's the same thing with networked systems. It's not outside threats which pose the problem, it's the people on the inside who either inadvertently or deliberately cause the problems.
Once you've granted someone access to your data, no amount of firewalls, air gaps or anything else can prevent that person from doing damage in some form, even if only taking that data and giving it someone else on the outside.
In this case, since the co-pilot was on the inside and had the ability to override the security code to open the door, the damage was done long before he crashed the plane.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
I believe it was mentioned that it was a Good Thing when a co-pilot locked out a captain who was freaking out, allowing the co-pilot to make and emergency landing and save the passengers.
As I understand it, these systems don't actually ~prevent~ the pilot doing something that they have explicitly commanded, provided it's not something that as you say will push it outside of its stable flight envelope (and even there, you can still do that by forcing the flight control systems to revert to alternate law). In this case there wasn't really any 'programming' involved ... he simply turned a dial to tell the autopilot to descend to an altitude that was lower than the terrain level (incidentally, at the point the descent was initiated, they were near the Mediterranean coast so the local terrain level was close to 0 ... however their path then took them into much higher terrain).
You are correct that the aircraft 'knows' about the terrain. It'll throw warnings at you if you tell it to descend below the safe altitude for the sector you're in, and when terrain is physically detected nearby you'll get GPWS alarms etc. But that's information for the pilot only - it won't physically stop you flying somewhere you've explicitly told it do go.
The computers aren't in complete control. If a pilot wants to do an emergency landing, he must have that option. The computers prevent some things, and they warn for others, but it's impossible to have a computer judge all kinds of complex situations, including various kinds of mechanical or sensor problems.
Also, look at United 93. In some cases, it is preferable to have a plane crash into the terrain at high speed instead of having a hijacker control it into an office building.
This accident fatly underlines the point....
I, for one, welcome the new word "fatly" into the world of English discourse...
The word appears to follow the rules of English word-making. It is also highly visual and conveys its imagery in a succinct yet easily digested way to probably all speakers of English, no matter how weak their grasp of the language might be.
Shakespeare would have been proud of this word. This is one he could have easily used, had he but thought of it first.
Will
Your TFH is on a bit tight, but your real problem is lack of knowledge.
Computers are not "in control" of Airbus aircraft, any more than computers are in control of Ford cars. There is absolutely a manual - it just isn't a physical link, because we've moved beyond wires and pulleys, or even hydraulics.
Large aircraft are designed for skilled pilots - ones who can respond to the often unusual disasters that strike when in the air. There's an override for everything, because you never know when you might need to do something unusual in response to some other failure. Want to engage the thrust reversers while in-flight? Sure - normally that would be catastrophic, but that might be the only way to prevent an overspeed in a steep dive. Want to land without lowering the gear? It'll yell at you but it won't stop you.
In fact, very few things even require an override. The normal thing for an aircraft to do when it thinks the pilot is making a mistake is to yell at them, not stop them. And in this case, we have on the cockpit voice recording the sounds of the alarm saying "PULL UP. PULL UP. PULL UP."
But the aircraft didn't stop him, because there are easily dozens of situations where stopping him would have been even worse. For example, an all-engines out emergency landing. Or a GPS malfunction, and there's no mountain there. Or... you get the picture.
There are no aircraft that don't have a mode that acts like manual. There are a few military aircraft where, even in manual, the flight computers will make constant control movements to keep it stable, but even in a B-2, if you slam the stick forward, it'll dive right into the ground.
Also, look at United 93. In some cases, it is preferable to have a plane crash into the terrain at high speed instead of having a hijacker control it into an office building.
Or with US Airways Flight 1549 (which was an Airbus A320-200) it was preferable to plop it into a river.
Sully and the flight crew made a judgment call that they weren't going to reach any of the possible landing fields, so they turned the plane around and dropped it into the Hudson. It's unlikely the Airbus computers thought that was an appropriate action...
#DeleteChrome
And Shakespeare came so very close to doing so:
As a matter of fact, the Oxford English Dictionary says that Barclay wins the honor for using fatly first.
Magnificent thing, the English language, so fatly adorned with so many words.