Pontifications: Remote control of airliners a bad idea

Hamilton (5)

By Scott Hamilton

March 30, 2015: In the aftermath of what a French prosecutor said was the apparent suicide-mass murder of 150 people on Germanwings 9525, there have been some calls for and questions of creating a system of allowing ground controllers to assume command of airborne airliners in the event rogue pilot situation develops.

This is a bad idea.

There is no doubt this is technically feasible. After all, remote control is becoming more and more common. These systems are called drones or Unmanned Aerial Vehicles or Unmanned Aerial Systems. The systems need only be adapted to passenger or cargo-carrying vehicles. The idea has already been seriously floated about one-person cockpits for airliners or freighters. One day making these UAVs is only the next step.

But not today, and not for this reason.

The logistical and practical considerations are enormous.

The biggest practical consideration is this: how does a ground person know what’s going on in the cockpit, or on the airplane, to make a determination to take over the airplane? Is there enough time of any given incident to correctly evaluation the situation? If pilots are dealing with a true emergency but don’t have time to radio (remember the adage, aviate, navigate and communicate, in that order), whose command inputs does the airplane follow: the pilots on the scene or the pilots on the ground?

In the case of Germanwings 9525, those eight or nine or 10 minutes of radio silence on an off-course airplane descending quickly but not in an emergency descent raised a wide variety of questions in the hours immediately after the crash and in the 24 hours before the shocking press conference. Was there an emergency? Was there a depressurization? Were the pilots consumed with the emergency (aviating) and with no time to communicate? Were they victims of hypoxia?

If these were the unknowns for hours, how does a ground pilot draw conclusions in 8-10 minutes? If the ground pilot concludes incorrectly, and the airborne pilots were in fact engaged in dealing with an emergency, what’s the airplane to do? Follow its hands-on pilots, or someone hundreds or thousands of miles away?

If a remote control pilot were to take over, how does he communicate with the cabin crew?

And what about the situation where minutes or hours are reduced to a much shorter time? Air France 447 took 3 1/2 minutes to fall from cruising altitude of nearly 40,000 ft to impact the water. If the on-scene pilots couldn’t figure out what was happening (though in this case, they certainly should have), could a ground pilot have done better in that short period of time?

The practical considerations just go on and on.

With thousands of airliners and freighters flying every day, the technical and human bandwidth required would be immense. You need ground personnel skilled in every type of airliner. They would have to be type-rated, in addition to their normal duties. They’d have to have constant simulator time to maintain current ratings. All this is feasible, but at what cost?

One responds, the cost is saving the lives of those on the airplanes. I get that, but the two-person rule now gaining wider-spread acceptance seems the more practical solution. The two-person rule may well have served as a deterrent in most (but not all) cases listed below.

Pilot suicides

There have been a handful of known or highly likely pilot suicides-mass murder in the past 30-plus years. In addition, there was one attempt by a jump-seat rider to bring down a cargo airplane. In this instance, the cockpit crew successfully fought back, but not before all were injured and the airplane was barrel-rolled in an effort to put the attacker off.

According to a list compiled by Bloomberg News:

  • Malaysia Airlines MH370. The disappearance of this Boeing 777-200ER remains unsolved but it is widely believed within aviation circles that this was a pilot suicide-induced event.
  • LAM Mozambique Airlines, in 2013, in which a pilot was determined by investigators to intentionally crash an Embraer 190.
  • Egyptair flight 990 in 1999, the Boeing 767 crashed into the sea after takeoff from New York. The pilot managed to re-enter the cockpit after the co-pilot, who was flying, initiated a dive, according to investigators, but the pilot was unable to recover control.
  • Air Botswana, 1999, an ATR-42.
  • Silk Air, Boeing 737, in 1997. The pilot dove the airplane into a river.
  • Federal Express Flight 705, a DC-10-30F, is the attempt referred to above.

There was also the time a fired PSA ground personnel used his employee ID to bypass security, enter the cockpit of a BAe 146 and shoot both pilots. The airplane crashed.

In an interview I did last week for CNN International (which, hopefully, is more responsible than CNN USA), I was asked about the two-person rule and what if that second person was in on a plot to doom the airplane. Certainly a conspiracy is possible; no system is 100% fool-proof. As we have now seen with Germanwings, the very door, reinforced and with beefed up locks to prevent another 9/11, kept the Good Guy out, by a Bad Guy in the cockpit. On the other hand, there was the JetBlue A320 flight in which the captain exited the cockpit and proceeded to act in a delusional manner. The co-pilot used the locking override to prevent the pilot from re-entering the cockpit. Passengers and crew had to subdue the pilot, and the co-pilot made an unscheduled landing, where medical personnel (and the police) awaited the captain. The door and override system worked exactly as intended.

As long as systems are designed by humans, humans will be able to figure out a way to get around them. As long as humans are in the equation, no screening system will be perfect. As one caller into a Seattle radio show pointed out, you could have a psychological exam today and tomorrow your world go fall apart, sending you over the edge. Same thing with a physical exam: declared in perfect health today, heart attack tomorrow.

Today’s system may have its flaws, but I’ll take those two pilots in the front end over the prospect of some ground pilot trying to figure out what’s happening by remote control. Maybe this is a late 21st Century solution. But not now.

 

 

 

97 Comments on “Pontifications: Remote control of airliners a bad idea

  1. Fully concur, the “problem” can only be addressed with soft actions, no technical solution appears useful. And despite the list of pilot suicides, there is no reason to suspect all pilots from now on and consider one man alone on the flight deck as “dangerous”. Therefore, I don’t like the “two people rule”.

    We have to live with some challenges coming from our human nature.

    • Are you a Pilot? There will be more Pilots in the Future that commit suicide-murder……….Yoke/Sidestick as the tool.

      Why such hesitation?………. to mandate the 2 person rule for Regional-Size jets and above in size.

      Flight Attendants should be required (in the Future) to have basic knowledge of flying.

      Regulators/Carriers should require a Private-Pilot License as a Resume requirement.

      People are getting crazier and more active(Pilots are the same Demographic)………..2 people in the Cockpit is a good-idea………even if it only keeps one potential tragedy from happening in the future.

      • A second person in the cockpit doubles the chances one of them is suicidal.
        Just because the current system lead to the current tragedy doesn’t mean we need to set up a different situation for the next tragedy. I can imagine it is an inconvenience to pilots to have to ask someone if they can go to the toilet, and the cabin crew is not just sitting around either – they’re busy too.

  2. This tragic situation tends to lead to a knee jerk reaction. Regarding the security doors issue I believe we are barking up the wrong tree. In terms of risk management there should be far greater assessment of the pilots prior to them getting into the cockpit and more effective ongoing monitoring. We have gone from a time when the vast majority of pilots were ex military and a bit older. they were a far lower suicide risk for multiple reasons, age, screening in previous job etc. Now we are in a position where anyone with a little aptitude and a willingness to splash the cash can gain flight status. this means that we will have younger and potentially more mentally unbalanced peoples in the mix. Risk management should be a multi-layered system and the cockpit doors is the last of many, many controls that appear not to be in place in this scenario. What is certain is that we must consider pilot suicide a very real threat as this known issue has been effectively been ignored

    • The knee jerk reaction was IMHO the creation of the impenetrable cockpit in the first place — as a reaction to the events of September 11, 2001.

      Now, it’s no realistic to deconstruct the said invention. However, it’s totally unacceptable IMO to just accept that there’s not much to be done with the risk of pilots going rogue, and that supposedly therefore, that we just have to live with that risk.

      • And you have to wonder if there is a copy cat aspect coming into play as well.

      • if the reality of an situation is unacceptable to you, that must be your problem.
        Nobody likes what happened, nobody “Just” accepts it – But is there a real alternative. Taking to the air, racing along at 10.000 meters and 850 km per hour in a thin walled tube has certain inherent risks. You either live with those, or you don’t fly…

  3. OK, I’m not a pilot, but I don’t see the tech challenges as insurmountable. You need live video from the cockpit (at least 3 cameras: 1 at the door, 1 wide angle to cover the whole cockpit, 1 focused on the controls), a quickly accessible stored video of say the last 5 minutes, real time health monitoring of the pilots and the aircrafts key parameters and sufficient bandwidth data connection. All exist. Detecting an abnormal flight profile relatively quickly is also possible. All airlines are then required to take part in an insurance scheme that puts specially trained pilots available 24/7 on the ground with the remit to stabilise the flight if necessary, giving sufficient time for specific action to be decided.

    At the very minimum, removing any outside control, it must be possible to update the software on modern designs, using radar, satellite positioning, on board mapping etc., to have the computer take control of the plane and put it in a safe circuit (ie away from populated areas) if the profile indicates controlled flight into ground from high altitude. Not so sure at lower altitude in hilly terrain, but worth addressing anyway to help avoid pilot error controlled flight into ground.

    • And with say 5000 aircraft airborne every day, you need 40,000 people to monitor all those aircraft.

      Does not even rise to the level of a poor idea.

      • Is “Does not even rise to the level of a poor idea.” intended to be an insult?

        As for the personell requirement of it, you misunderstand. It is existing ATCs that would monitor flight profiles. No additional staff or workload required there. If a flight profile goes outside expected limits or if the health monitoring detects an abnormality, instead of the ATC operator having access solely to voice comms to determine the situation they would have additional access to live video and health monitoring and 5 minutes video precedeing the ‘issue’. If there was cause for concern the case could be elevated to on the ground pilots to assist. I don’t know how many times per day flight profiles change to a degree sufficient to warrant concern but I doubt it is very many. May be as little as requiring 2 ‘aircrew’ on the ground in each continent under the insurance scheme. Certainly nothing even remotely like 40000 people.

    • Also not a pilot, but the purpose of the crash avoidance system is not to fly the plane, it is to prevent contact with the ground in undesirable locations using the on-board auto-pilot and give more than 5 minutes of time for on board staff to react. Basically, if the plane is NOT near an airport and in a flight path where ground contact is predictable, the autopilot shuts out the pilot and takes the plane to a safe altitude until the ground control releases controls back to the pilots.

      There is no reason ground control needs to be certified to fly the plane, all they need to do is to provide direction and altitude inputs until a responsible pilot if re-established on the plane itself. Even if that’s a steward being talked through how to fly the plane.

      Modern auto-pilots are equipped to recover from a wide variety of problems, including even a barrel rolling dive. At least one crash was the result of a pilot who didn’t fully understand his situation and kept fighting the auto-pilot. Had that pilot let go of the yoke, the plane would have recovered itself. Instead, because he was confused, the plane plowed into the ground.

      The purpose of crash avoidance is not to fly the plane, but to avoid the ground contact. If for some reason a conscious pilot cannot be raised on the communications system, then the plane can be sent to a location where there will be the least amount of damage when the fuel runs out. Planes configured for crash avoidance would be useless to hi-jackers, since they wouldn’t have control over causing damage to targets or even the direction of the plane once they attempt a crash. Success of survival-challenged pilots (whether from suicidal intent or confusion or ???) would be reduced (if not eliminated).

      Fighter jets already take over control and self-pilot when the onboard pilot fails to respond. So, a plane taking control of itself is not a new idea.

  4. A ground pilot taking control of an aircraft right away might be a bridge to far. However reality always comes as a smart compromise.

    ATC controllers have seen to many aircraft diving down into nowhere, desperately trying to get contact with a suicidal or incapable crew.

    An escalation platform in which an ATC controller can quickly escalate to his manager who can hit a red button stabilizing the aircraft at a safe level.. until contact with the cockpit has been restored, buying time. Not perfect, but could potentially safe more lives than it takes. And that’s what it is all about.

    I’m getting a bit depressed with crashes of principally flyable aircraft. Pls include AF 447, Flight 1951, Flight 8501, Flight 235.

    After 100 years of flight the traditionally bold sunglassed savior of flights is turning into the weakest link. Are we able to accept a changing reality?

    http://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_commercial_aircraft#2014

    • precisely my point, pilot candidates have changed dramatically over recent years and the terms and conditions have eroded substantially. Without substantial checks and balances this sort of problem amongst others such as unacceptably poor basic skills eg AF447 will just get worse. It is less chuck yeager nowadays and more a mundane task for relatively low paid job

      • see Mr. Learmount on that topic from 2008:
        http://www.flightglobal.com/blogs/learmount/2008/12/piloting_is_going_blue-collar/

        I’d be surprised if your observation re candidate quality is true for Europe. All the accidents fitting into this special scope are all about dysfunctional personalities ( as single actor or in interaction ) and definitely not about “hands on” qualification shortcomings.

        Increasing pressure in this context will be contraproductive.
        You’ll push more stable individuals into a borderline stressed state and thus increase numbers of personal breakdowns in unfitting situations.

    • ATC or anyone else to remotely takeover ? Geeeezeeeeeeeeeee cubed!

      That would be a ” hackers delight ” or how to crash a dozen airliners in a few minutes..

      ” Please sit back and relax – nothing can possibly go wrong go wrong go wrong . . .”

      Its not what could be done , its what should be done and for why.

      • It should not be a decision on the ATC’s part. It should be built into the auto-pilot of the plane, where ATC only provides direction and altitude input after the auto-pilot has taken over. It should be an emergency response system triggered by a prolonged dangerous condition (e.g. inadequate response to terrain warning, entry into controlled air space, etc.) and intended for short duration until the onboard situation is stabilized. At that point, control is released back to who ever is in the pilot’s seat.

        Once the auto-pilot has taken over, there is no longer a need for the cockpit door lock-out since the pilot is no longer in control of the plane. What good would it do to hi-jack a plane equipped that way, when isn’t going to do what you want anyway? Even if a terrorist convinces ATC they are a credible candidate, it does no good because the auto-pilot will just take control if you try again. If there is no credible person to take control of the plane, ATC can send it to a location where there will be the least damage when it runs out of fuel. I’d rather the passengers on the plane have 3 hours w/no cockpit door to block them to try to get control of the plane than 3 minutes.

  5. The remote control would need a fuse like any other system. At least the receiver would need one.

    It is only a matter of time until the system will be hacked. 9/11 without even suicide terrorists.

    Very bad idea indeed.

  6. I would have thought that in a large professional organisation, with continual debriefs and regular communication, that employees would be monitored and have access to counseling. This would be for all employees and not restricted to pilots. A troubled employee will not be able to function efficiently.

    So I will ask the question – Do Lufthansa have the same standards and governance across the entire group? Have they short-changed their LCC division by allowing them to cut corners?

    • Generally, medical support is offered to all employees in western Europe. The employer has no right to look at, or even know about medical assistance unless it directly affects operations (time off for Doctors appointments, no leg work if you have a broken leg etc.)

      • There is a range of (transmittable) ailments that require doctors do mandatory reporting to authorities.
        Also child abuse which appears to be a quandary.
        Perpetrators just keep their abused kid away from the doc with even worse outcome. A fine line to walk for any professional.
        Mandatory reporting of mental illnesses carries the same downside. Patients will avoid the doctor to every ones detriment.

  7. A pre-programmed route and landing to alternate airports using control inputs and engine thrust thru FMS system can save the aircraft in more cases than CFIT when the flightpath deviate too much from the approved route and activated by flight control center. What comes to mind are the Hypoxia events, Loss of aircraft control like Sioux City, some modes with dual engine shutdowns like SAS Gottrora. Another solution would be to eject passengers seated in rows thru aft door with parachute after turning seat row 180 degrees before ejetion.

    • Yep, ejecting passengers, I can just see the headlines.

      and the cost, hmmm, a mere $40,000 for a 500 mile flight, I don’t think so.

  8. I’m so romantic over pilot skills. Neither do I believe things used to be better in the past. F.ck-.ps were less visible, communicated, nobody wanted to know/ discuss outside the relevant conservative meeting rooms. # flights have grown enrmously, so the number of exceptions too.

    IMO pilots should not be too creative (just in the sim), socially engaged (hostages behind the door), innovative (stick to the book), explorers (just get me home), womanizers (2nd person in cockpit), hierarchical (KoreanAir). Better predictable, fantasy less , procedural.

    Few good artists and pilots in the same body..
    https://www.ironmaiden.com/fefiles/images/bd_990.jpg
    Bruce Dickinson (ill, hope for his full recovery)

  9. I’m with you, Scott. Expecting a controller on the ground, even he were an experienced pilot (type-rated for the particular aircraft) to intervene and change the outcome is unrealistic. How would you find and train such people?The Bad Guy in the cockpit could simply kill the engines and start pulling circuit breakers.
    As for mandating a second person in the cockpit at all times, it might be a feel-good idea, but exactly what does a flight attendant do? Rap a pilot’s knuckles if she sees him touch a control?

    • The idea is that the second person would enable the other pilot to return to cockpit, as a sort of overide for the door lock

  10. The system would be clearly hackable and could produce mayhem with multiple flights, that would make 9/11 look like a minor event.

    It seems a more effective safety improvement would be to empower the automation to reject fatal control inputs. Imagine if the autopilot refused to deviate from the filed (and updated) flight plan/profile. In this case, all the data was in the onboard computer. At the moment the altitude was dialed in and the button pushed, the autopilot knew the flight was headed for a crash. So, if the nav system was programmed (onboard, NOT via link to someone on the ground) to detect and reject extreme and fatal control inputs, it could trigger a safe-mode that would automatically revert back to the filed flightplan. Such a safe mode would then automatically squawk emergency, fly the most direct distance to the next filed fix/altitude and continue on to filed destination.

    • There are already so many strong proponents for the Boeing “I can crash the plane when I want it, pilot tops computer” arrangement around.
      Do you think this is a wise idea?

    • Exactly, cos the computer is never failing. The auto pilot was failing in the Air France flight and trained pilots were unable to recover.

      How could a computer decide whether it’s a rogue pilot doing something wrong, or if it’s an emergency that needs a specific action?

      I also absolutely agree with Scott that a remote control solution is out of the question. Just imagine the other way round. What would have happened to US Airways Flight 1549? Suddenly an ATC/Ground Station taking over? Having to assess the situation in seconds? Yes, the crew on board was responding and could have spoken on the radio. But that is just unnecessary distraction which was urgently needed to recover the flight.

      Yet the logistical overhead needed. The airlines don’t use real-time black boxes cos the bandwidth cost is too high. Having a permanent uplink to ground station for a ground pilot being able to take over in seconds is causing much more cost, let alone having people sitting there waiting for an emergency to happen. And you might have to have redundant people on stand-by. Cos what if there are two or three emergencies just at the same time? Which one you deal with?

      • AF447 : Autopilot “failed”

        patently wrong.
        Autopilot switched off on lack of valid input as designed.
        This behavior is still deemed to be “correct as designed”.

    • Any system can be hacked if it has any sort of digital communication with the ground or some network. To just can a system “because it can be hacked” would probably have stymied any military development of digital data link technology or RPV technology a long time ago.

      And who’s to say someone will not have access to the automatic flight control system and flash it with a code to reject pilot input and crash the plane? Or someone uploading errant digital terrain data to spoof the system? Every potential system can be compromised.

      • Maybe, maybe not. Clearly on the aircraft there is the possibility of some sort of 2 key system.

  11. Sir, you are writing about MAVs, not UAVs. I concur that it is indeed a bad idea to have two crews concurrently trying to control an aircraft.
    The case is much different if you completely remove the flightdeck in favour of remote control/automated flying. Then it becomes an idea which only current day passengers may be scared of. Future generations probably will refuse to board a an aircraft flown by a human pilot.

    • Yep. The fact is that automation *has* vastly improved safety overall and that most incidents are *still* caused by human error.

      Turning an aircraft into a drone combines the worst of both worlds (humans suddenly struggling to control something remotely (with time delay, poor feedback, even less “flying” experience than the pilots complained about after AF447) with new channels open to hacking, sabotage, communication failure, unforseen error modes…

      Getting fully automated aircraft, on the other hand, should vastly reduce the number of “oops” moments leading to potential incidents. If most aircraft are automated then there’s the added benefit that you can also automate the traffic management for even greater safety and efficiency.

      All it needs is a change in public perception – which will probably come not long after driverless cars become commonplace… which they will.

      • Some Devil’s Advocacy:
        If you introduce WALDO trouble saver crews that cover enough flights you create crews specialised on aircraft recovery and are in good training.

        On the third hand:
        Drone operators currently loose their assets in droves ( and not due to enemy action ). Not much publicised but a fact.
        I am still waiting to see a drone versus airliner collision. will probably resemble the Gol Transportes Aéreos Flight 1907 crash. ( or did it happen and it was “burried” ;-? MH370 could be a fit.)

  12. I agree that the ground control “third pilot” thing is a non-starter.

    at the end of the day, the Pilot in command needs to have the absolute ability to override all system constraints if they are to be able to save the aircraft in anomalous situations.

    • In recent situations, the Pilot in command had the absolute ability to override all system constraints and they were able to destroy the aircraft in normal situations.

      In the past we could not prevent it, even if we wanted to. It’s like the Fly by Wire discussions 30 years ago. Or two man cockpit 40 years ago.. CAT III autoland 50 years ago.

  13. For as long as pilots on an aircraft can crash it when they want to, we will need to have precautions against rogue pilots.

    But the day is approaching when nobody in an aircraft can do anything that would endanger the aircraft and its passengers. We already have restrictions on maneuvers that endanger the structure of the aircraft, and clearly more automation can solve problems like the 777 crash at San Francisco where the pilots flew too slowly.

    After a few years of that we will see the time when there is nothing for the pilots to do. (but that may be a long time out)

    Let’s see how driverless cars evolve. That will be an indication of how fast pilotless planes with paying passengers can arrive.

    For those who bemoan the decrease in skills and experience of pilots, I can only point to the fact that the number of deaths in aircraft accidents has been continuously decreased as traffic has soared. Increased automation is responsible for much of that.

    • Not more automations for the SFO debacle, just good automation.

      Airbus does it right, Boeing leaves a couple of ugly voids.

      1. auto throttle does not come back in when the airspeed drops to stall

      2. The stall indicators are so close to stall at close to ground level they are too late.

  14. Scott H: “The biggest practical consideration is this: how does a ground person know what’s going on in the cockpit, or on the airplane, to make a determination to take over the airplane?”

    A ground person would know if he/she was informed by those aboard (i.e. the cabin crew or a locked-out pilot).

    Scott H: “Is there enough time of any given incident to correctly evaluation the situation?”

    Sure, if a locked out pilot and the cabin crew have easy access to a fail-safe “dead man’s switch” thus letting the ground take over and automatically land the plane at the nearest available airport.

    Scott H: If pilots are dealing with a true emergency but don’t have time to radio (remember the adage, aviate, navigate and communicate, in that order), whose command inputs does the airplane follow: the pilots on the scene or the pilots on the ground?

    The same procedure as today. You let the people aboard have the final decision whether or not to let the ground take over control.

    Scott H: “If these were the unknowns for hours, how does a ground pilot draw conclusions in 8-10 minutes? If the ground pilot concludes incorrectly, and the airborne pilots were in fact engaged in dealing with an emergency, what’s the airplane to do?”

    The ground pilot only starts controlling when given authority by the people aboard the aircraft (i.e. the good guys). However, in case of an emergency, the aircraft’s flight control system would be programmed to immediately maneuver the airplane back to straight-and-level flight; independent of the ground — and in order to save the aircraft from imminent collision with the ground, the FCS would obviously have an Automatic Ground Collision Avoidance System (Auto-GCAS) installed as well.

    Scott H: “If a remote control pilot were to take over, how does he communicate with the cabin crew?”

    When the “dead man’s switch” is activated by either the cabin crew or the pilot locked out of the cockpit, a secure two-way radio system would be activated as well.

    Scott H: “And what about the situation where minutes or hours are reduced to a much shorter time? Air France 447 took 3 1/2 minutes to fall from cruising altitude of nearly 40,000 ft to impact the water. If the on-scene pilots couldn’t figure out what was happening (though in this case, they certainly should have), could a ground pilot have done better in that short period of time?”

    Conceivably, if AF447 had been equipped with said system, the first officer (i.e. Pilot Not Flying) — or later, even the captain himself — could have exited the cockpit and activated the “dead man’s switch” (i.e. located just outside the cockpit) before the plane hit an altitude of 10,000 ft, or so.

    • Don’t forget, the AF447 pitot tubes were iced up, which confused the autopilot. A controller on the ground would be just as confused.

      • I’m talking about stall recovery due to the high altitude upset, and by which time the pitot tubes were not iced-over anymore.

        • Addendum:

          The aircraft would have automatically recovered from the stall due to the first course of action of the now independently operating flight control system being to immediately maneuver the airplane back to straight-and-level flight, as it would have been programmed to do, as a first course of action (e.g. operating independently from the ground and without crew interference). Only when the aircraft would have regained straight-and-level flight — assuming a successful stall recovery — would the aircraft have been “controllable” from the ground by way of two way satellite communication.

          • “Conceivably, if AF447 had been equipped with said system, the first officer (i.e. Pilot Not Flying) — or later, even the captain himself — could have exited the cockpit and activated the “dead man’s switch” (i.e. located just outside the cockpit) before the plane hit an altitude of 10,000 ft, or so.”

            How naive is this view. So the pilot in AF447 would have thought, while being confused and overwhelmed with the situation he was trying to recover from to say: Ohh, I’m not gonna make, and probably won’t. So let’s just get out of my seat, doing nothing for some vital seconds, go back into the cabin, hit a dead-man-switch and hope that a guy at the other end of the world will do better than me. Never ever!! It will not happen.

            And what if the bad guy sits on the ground? He could crash the aircraft as well, and not even be harmed by it. Assume, a terrorist organization is placing a “sleeper” into the ground-ops controls. You just wait there till an emergency happens, and you can do whatever you want.

            There are way too many issues associated with that, which potentially could lead to other problems.

          • No, I wasn’t talking about the Pilot Flying (PF), but rather about the Pilot Not Flying (PNF) who — as the crisis unfolded – was seemingly more preoccupied that the Captain should return ASAP, indicating that he was becoming increasingly unhappy with how the PF was handling the aircraft. It was not clear who had command authority and the PF and the PNF failed to cooperate (e.g. the captain left the PF in charge of the controls when he left the cockpit despite the gap in seniority and experience between the PNF and the PF). The left side-stick can be set to disable the right side-stick, thus the PNF could have taken back full control at any one time since he was sitting in the Captain’s seat. But he didn’t. If there had been a panic button aboard (i.e. dead man’s switch), the confused PNF could conceivably have left his seat and activated said switch. So could the Captain have done (i.e. after he had re-entered the cockpit), if he’d concluded that with the dramatic descent rate of 10,000 ft per minute, not much time was left to do anything but to press a “panic” button; that is, if said option would have been available — which it wasn’t. 😉

            Failing to ignore the artificial horizon for attitude the functioning airspeed indicator were the critical mistakes.

            The acting captain’s left-hand controls (Robert) can be set to disable the right-hand side stick (Bonin). Failing to do this, ignoring the artificial horizon for attitude, and the now-functioning airspeed were the critical mistakes.

      • AF447: autopilot confused

        no. AP did disengage on known lack of sensor input as designed and this is still deemed a well designed response.

    • The same pilots who could not look at an instrument panel and determine

      1. the nose was high

      2. VSI was going at around 10,000 fpm DOWN

      Right.

  15. There are only two imperative needs for pilots to leave the security of the flight deck once they are airborne. Those are, first, is to use the washroom and, second, to use bunks on long range trips.

    The safest, most efficient, quickest and least costly solution to the “two persons on the flight deck” concept is to move those facilities into an expanded secure flight deck area. But those two persons must be type qualified pilots. Flight attendants lacking flying experience could be worse than useless in an emergency.

    Pipe dreams of automated aircraft that will determine an aircraft’s problems, take corrective action and then fly themselves safely to the nearest airport are just that: pipe dreams. The popular media alternative – having an air traffic controller take over the aircraft remotely and then fly it to safety – is equally unreal.

    • They are not there for an emergency, they are there to get the door open if something weird happens be it the pilot suicide attempt or more remotely a medical incident.

      Yes I think they should have some flight training, not to assist but to know what is reasonable and what is not. they could also act as an assistant for finishing a flight if a pilot is dealt with or said medical leave them non responsive.

  16. At a bare minimum, why can’t cockpit access be remote controlled? Perhaps, use a video feed to assess the situation in the cabin and cockpit and then grant access to whoever who wants to get back in the cockpit.

    • And just to keep it simple, it could just be an emergency “override lock” code that is not known to anybody on the flight and issued verbally by ground control authority via phone. No need for remote controlled electronics.

      • It would be interesting to know how many accidents are avoided by the computers vs the pilots. My guess is that the pilots still win, but its getting closer.Assuming the problem isn’t with the computers themselves, my money is on them every time. Just the same information as the pilots, but not inclined to panic. Until now I’ve always thought that the best thing about pilots is that they are always first at the scene of an accident, this tends to damp down any recklessness.

      • nyx: good or bad the idea was to make it difficult for a hi-jacker to coerce someone into opening the door.

  17. – The co pilot was treated for suicide impulses years ago
    – The co pilot stimulated the captain to take a leak
    – Captain start kicking the door 10 minutes before impact
    – Panicking passengers can be heard screaming 8 minutes before impact

    • I haven´t read anything about anyone in the plane making a phone call as they were going down. Seems to me someone ought to call 911 or relatives when they knew something was going to happend. 8 minutes is fairly long time.

      • cell phone service above 8K feet is not very good , and in a remote mountain range dozens of miles from any city village is not very good either. perhaps IF they recover some cell phones, there may be some records ..

  18. Keep in mind these so called automated aircraft when something simple like a pitot ices up, what does it do? It turns the aircraft over to a pilot.

    Hmmm,

    • Interesting point. Why has it been programmed like that? It’s a perfect example of something a computer would be far better at. Same thing with collision avoidance.

    • Which is why they are currently testing alternative air speed indicators that don’t rely on the centuries old pitot tube, which is, as you say, vulnerable to icing.

    • “Keep in mind these so called automated aircraft when something simple like a pitot ices up, what does it do? It turns the aircraft over to a pilot.

      Hmmm,”

      Well hmmm yourself – because it does this BY REGULATION to satisfy skeptics exactly like you!

      The rules were written that way because people trusted pilots more than automation. I’d say that after three decades of demonstrated fly-by-wire reliability it’s high time these rules were re-written. Let the automation handle everything it can during incidents, with some robust logic to handle possible sensor failure etc., while informing the crew as clearly as possible so they can intervene where necessary. That also means better reporting logic to avoid the information overload the Qantas guys had to deal with after the A380 engine failure…

  19. Right after 911- as I recall- A pilot on a commercial flight made an announcement over the PA. Paraphrased it was to the effect that from now on if some nut job tried to invade the cockpit as the hijackers had done, there would be a hundred or more passengers who would do whatever is needed to overcome such a person.

    And that has happened a few times since.

    Locked doors help- and so do sturdy doors – and a person ( FA) at the dooorway to at least delay such a person.

    Adding remote controls, and like gizmos would be merely for optical reasons but no real deterrent – much like forcing vested- identified – flight crews to go thru a search same as little old ladies, shoes, suspenders, eyeglasses, etc. makes good optics-.

  20. Andreas Lubitz was desperate because further progress in his career was barred from defective vision. His suicidal mind was set onto a larger goal : getting promoted from Germanwings A320 feeder flights over to Lufthansa long haul A380. During those ten minutes he kept silent because he knew he had failed. His motive in life as a pilot was to crash an A380. Instead he was crashing a mere A320, in a last resort suicide as a pilot, knowing he would shortly be grounded by the medics …

    I think the problem is not in aircraft remotely controlled automation but in DHR employment procedures. Understanding, monitoring and controlling the psyche of a very special group of employees : the Professional Pilots. New and better empathy tools are required to “séparer le bon grain de l’ivraie” in time before ‘le passage à l’acte’ … meaning that this issue is not for Engineers to deal with, but for Psychologists and Psychiatrists.

    • “During those ten minutes he kept silent because he knew he had failed. His motive in life as a pilot was to crash an A380. Instead he was crashing a mere A320, …”

      Ingenious slant in interpretation. could be quite close.
      What led you to make that step?

      • My proposition is a romantic reformulation of words quoted from Lubitz by his girlfriend : “one day, the entire world will become fully aware of my name …”

        • Yup. That was what I assumed to be in your view.
          Independently I do wonder if he was aiming just for negative KARMA or wanted to turn the focus to some perceived shortcoming in the airline industry.

          • Neither am l a psychologist, nor a Pilot. But once my direct Boss was a (German Airbus Test) Pilot. He believed that to motivate a junior Salesman, suffice to push his nose. Go do this and that, NOW ! If Lubitz has been pushed around by his Management, I’d understand his need to a coming out from deep down. I don’t think though that he had an agenda or carried a message. I think he was distressed by this world’s Misery, deciding to take the fast lane out, with panache. He was aiming for a feather in his hat … if the Directorate of Human Resources (or the medics) hadn’t planned to ground the man, ie if they’d given him ten more years to cultivate his Career, l guess he’d taken a triumphal 549 people with him beyond, instead of those 149 poor souls ?

  21. Not quite sure how many airline pilots are responding to this Leeham posts, but I for one, as a B777 Captain , have great reservations about the idea of a pilotless airliner, and the ability of ground personnel to “take over”.
    Although technically it may be feasible, I believe there are a thousand things I do in the cockpit each day/night to enhance the safety and comfort of any said flight. Little mundane things that have taken decades of experience to accumulate.
    Sadly, my once proud profession has been diluted to the words of self proclaimed experts, and TV pundits who have never had the “pleasure” of trying to avoid severe weather in the dead of night, while trying to communicate on a cr@p HF radio, with a controller that barely speaks a word of English… in a remote portion of the world, that few have ever visited or know exists.
    It’s been diluted by LCC’s that charge pilots to pay for their own training; By regulations that allow Cadets with less than 500 hours to sit next to me in the cockpit and chat up the “hosties” to show how manly they are.
    A once respected profession… and I could rant on for hours, but to stick more to the point, …we are there for a reason… to provide the human element of thought, reason and experience. Controlling from the ground is technically feasible… but as posted earlier, the costs would be enormous to provide a “dispatcher”, if you will, that has the type rating and understanding of aircraft systems, to the enormous numbers of aircraft that are flying about the world at any given moment???
    As for having a third person in the cockpit… it’s more of a PR stunt than anything of real value. I have a crash axe right behind me, as used on the FedEx incident, that could take out a FA in no time. And quite honestly, we do have cabin crew come to visit occasionally, but during an emergency or weather avoidance, their presence can be a detriment.
    I encourage my F/O to get up and leave the cockpit often… stretch your legs, get something to drink, etc. Come back a bit fresher, and then focus again on the tasks at hand.
    For those of you who have not had the pleasure of being restricted to a cockpit for 14 hours, with only the opportunity to get up for a piddle break, I encourage you to go sit in a closet this evening, turn out the lights with a running vacuum cleaner next to you, and watch video games on your lap top for the duration.
    There is an opportunity to learn something from this accident…. and I hope we can elevate the concerns of many pilots regarding experience of new hires, the ever present “threat” of the semi-annual medical… and WHY it is a threat to our very insecure profession. Also, the deteriorating T&C’s of many carriers, and the added stress this puts on the employees. Thank You.

    • How about a EMERGENCY auto-land/over ride system………..Pilot/flight Attendants can(mayday) or push a remote-control device-on hip(like a key ring)/undisclosed (glass shielded)button on any aircraft?.

      If ATC/Trained Military Officials detects a problem with Auto Descent/Landing to nearest airport……….they can take-over and land or abrogate the impending the situation?

        • Pilots and the their Unions/Syndicates believe they are Mythical Gods…………..they don’t want to be told what to do, and when change does happen………..it causes headaches for FAA-EU/International Aviation authorities/Carriers to agree on anything…to make flying safer.

          Even after the most Recent Horrific Incident……….the reply from many Pilots is;

          1. “so what if we kill a whole lotta passengers every once in a while”……….cuz…………most of us won’t.

          2. “passengers,Carriers, don’t understand the stress we are under.

          Get a new freaking job if they can’t handle doing their job….or be under the constant scrutiny other high-impact occupations/employers require.

          • “Get a new freaking job if they can’t handle doing their job….or be under the constant scrutiny other high-impact occupations/employers require.”

            do you have any example occupations for this ?

          • DOD Jobs, Captains of Ships,Military Pilots are constantly scrutinized,High-Tech Industry,Medical Professions, Child-Care workers, bus Drivers/Commercial Drivers,etc………the list just goes on and on….regular Psyche Evaluations are demanded and looked-over………without a confidential release form.

            Many Insurance companies require a Psyche(in addition to a medical evaluation) for Life Insurance Polices

            In the Military,if it’s even suspected you are a little koo coo…….your put in different occupation,lessen the Liability to others. With or without a Psychologist/Psychiatric finding.

            And with the abundance of “Crazy” Pilots flying……..hey it’s all good……..’we only do a mass murder every few years’ . “We are Gods, leave us alone”

            Be assured, the “Crazy” unbalanced individuals in the Airline Industry (flight attendants too) are probably already known to other Pilots and Flight crews……….so it becomes a game of Russian Roulette………until the next mass-murder occurs.

    • Actually terrain following radar (TFR) was developed in the late 1960’s for military jets, allowing them to essentially fly thru the grand canyon hands off at speeds near mach 1 and within about 100 feet. AFIK the F-111 was the first to use it in service.

      • I think that was actually Keesje’s point – the technology to let automation improve safety by overriding errant human decisions is either there already or relatively easy to develop…

        The “problem” is the resistance by the establishment (pilots, regulations*…) and public perception.

        (*) I can see that restrictive regulation is becoming more and more of an issue – excessive conservatism is the result of a paradox: on the one hand, there is a need to develop new things to improve safety, efficiency and customer satisfaction, on the other hand every single improvement has to demonstrate that it is at least as safe as the existing methods. The result, since it costs years of expensive testing and documenting to prove that widget Y is at least as safe as widget X, is that the manufacturer usually chooses to produce widget X+, with limited testing and documentation to show how the update complies. The other result is that the authority produces update after update to the regulations with every minor advance made and every new failure mode found – making compliance more and more complex for the manufacturers for any significant change to the widgets they produce. All this is understandable, but unfortunately it makes the industry less likely to make bold steps forward than it did in the early 20th century.

        • Has there ever been a case someone has obeyed the “pull up, pull up “warning with a worse result than not obeying it?

          • Huh?

            I don’t think you understood my point at all ’cause I have no idea what you’re trying to say.

          • I think grubbie wonders why not have the aircraft do what it asks the pilot.

      • The F-105 An/Asg19 radar system had a terrain avoidance feature in the early 1960’s but it was an analog system too highly dependent on the fire control system maintainer’s calibration skills for the combat pilots to trust. I spent many an hour trying to calibrate a level “avoidance” plane to keep my pilot tops in the 335TFS, with no permanent effect.

        • Yep- remember- to err is human- to really foul up takes a computer . . which is often described as a super fast idiot.

  22. If there’s no downside, surely it should be automated. Probably wouldn’t have helped in this case, but certainly would have in others.

    • Sorry I wasn’t really trying to make a point, I was just wondering if someone knew the answer. Logically automation is always better, at least in theory.

      • Sorry I wasn’t really trying to make a point, I was just wondering if someone knew the answer. Logically automation is always better, at least in theory. Stop press at least Keesje understands me!

    • How do you fix landings?
      Landing is except for the final flare a CFIT 😉

      • The aircraft does, of course, know where the airports and their runways are. I don’t see this as an issue at all.

  23. Mobile FD door-lock control device ?

    We have a problem because the safe-switch controlling the door-lock to the flight-deck panzer-door is a dash-board installed and hard-wired device which is left to Pilot2 to operate from his seat at the inside if Pilot1 leaves the flight-deck compartment to take a leak @ Lav 1L on the out-side.

    Easy to solve ! Make that switch to become a hand-zapper like an Audi A8 car-key. Make it having a wi-fi or InfraRed or BlueBerry or Radio-Frequency or Ka-Band or otherwise Broadband coded (scrambled) transmission system unhackable or difficult to hack or copy. Also make it 99.9999…. % dependable ?! Now then the flightcrew member who leaves the cockpit puts the zapper in his pocket whereby the remaining pilot cannot anymore block the door from inside. We have solved the dilemma !? The problem is to get back in for the Pilot who is on the outside. Easy : he zaps open the panzer-door from the OUTSIDE and re-enters his work-place.

    • So you give him the wet noodle narco treatment when he comes out of the loo and then enter the cockpit by way of that nice little door zapper.
      ( anyway, those zappeer thingies are neither outstandingly reliable nor unhackable.)

      • Be positive, think positive, Uwe !? My invention means PROGRESS. Better leaving access control to the security-sensitive flight-deck to the Pilot, because his mental dispositions are under close routinely scrutiny by airline DHR psychologists (Flight Attendants not so much so). Nothing prevents this procedure from combining with the FA supplemental watchman protocol, but here said FA (senior, male, trained in CC techniques) is placed OUT-side the flight-deck, nearby Lav 1L, to protect the Pilot from foul play as he exits that Lavatory, giving him safe-way back into the Flight-Deck, sparing him any unwarranted surprises from rogue passengers ?

  24. Geeze- why not give 2 ex military seals, special forces, delta force, green berets a job on each flight. armed with tasers, AR-15s, pepper spray, and 12 gage sawed off to sit in two front seats ?
    That would preven anyone from whacking the captain or FO to get his magic key.
    Employ a vet !
    But it wouldn’t help if the pilot in command simply threw the deadbolt on the door . .

    GET REAL !!

    • No airline will be willing to loose a pax or two on every other flight just because some trigger happy ex seal couldn’t hold it.

      US police shot dead ~100 persons just in March of this year.
      Throw the door out. KISS.

  25. uwe- relaxc fella – you obviously missed my sarcasm in my reply to frequent traveler.

  26. There are two classes of Engineers (or Ingenious Minds, or Inventors) : G. Michael Maddock & Raphael Luis Vitón classified the brand nº 2, those who make use of their ingeniosity to invalidate ideas proposed by their peers. Sub-brands are the “Victims”, the “Non-Believers” and the “Know-It Alls” … Brand nº 1 is made up of people proposing to solve a problem with a positive new idea of their own making … follow my eyes …

  27. @ don shuper : quote/ But it wouldn’t help if the pilot in command simply threw the deadbolt on the door . . /unquote ?

    Am I missing something : what do you mean with “threw the deadbolt on the door” ?? I am not familiar with the panzer-door seen from the inside … but I am convinced these doors can be constructed “simple” ie only with an electronically zappable lock, oder ?

Leave a Reply

Your email address will not be published.