4 ms·

One might argue the problem was not the attempt to make systems resilient, but rather the attack model was too narrow: What if a malicious pilot had been part

One might argue the problem was not the attempt to make systems resilient, but rather the attack model was too narrow: What if a malicious pilot had been part of the threat model? instead of terrorist-proof cockpit doors, attacker-proof cockpit doors: split the cockpit in half (strong plexiglass), each has their own combination code for their own door. As soon as one pilot starts disobeying ATC, they can choose which pilot gets control of the airplane... True, the pilots can no longer circle j* during their boring flights...

nradov 8y ago
Those are terrible ideas. No one can foresee all possible threats, or reliably predict which ones will come to pass. It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised?
- DoctorOetker 8y ago
  >Those are terrible ideas. To the extent the ideas from the peanut gallery are terrible, it is because intellectual property does not allow the peanut gallery to inspect the full airplane designs, schematics etc... I feel confident the community at large (or the relatives and acquaintances of the deceased and their lawyers and or engineers they appoint) could provide better criticisms. But if my aunt had balls she would have been my uncle: intellectual property kills. What is the statistical value of a human life? What is the statistical value of intellectual property? >No one can foresee all possible threats, or reliably predict which ones will come to pass. I think that is an open question. But let's pretend you are right for the sake of argument. Improvement does not necessitate foreseeing all problems, excluding failure modes as they are discovered is still improvement, even if they aren't absolute panaceas. >It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. Space reasons? I'm sure the passengers appreciated their extra millimeter of legroom while crashing into the alps... why not each their own breaker and the circuit only breaks when their breakers agree on breaking? i.e. logical AND. Yes any additional complexity would make the problem space more complex, and should be dealt with using formal verification etc... >And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised? Obviously, the plane only listens to ATC pilot selection when one pilot disagrees (visualize a big red disagree button if you will). As long as none of the pilots has the disagree button engaged the plane ignores ATC. ATC can not initiate selection of pilot. Yes there situations that still admit malicious pilots like: collusion between 2 pilots, collusion between a pilot and an ATC controller. Use things like sortition, and reward ratting out proposals of collusion... Edit: spelling
  - nradov 8y ago
    The reason that professionals don't want to hear suggestions from the peanut gallery is mostly that the peanut gallery usually comes up with the same silly, impractical ideas over and over again. This distracts the professionals from working on real solutions. Intellectual property has little to do with it. But if IP is your concern, well you can cheaply purchase complete plans for dozens of different light aircraft designs and build them yourself with basic tools. Feel free to do that and use your own airplane as a test platform for your proposals. No one is stopping you; it's totally legal as long as you follow the regulations for experimental aircraft. Let us know when you're done and have something proven to work over thousands of flight hours. From a systems engineering standpoint, everything you have described would add complexity and would likely be a net negative for safety.
    - DoctorOetker 8y ago
      I'm not suggesting professionals want to hear suggestions from the peanut gallery. I don't believe on enforcing desires. I merely postulate that the relatives of the deceased, insurance companies, lawyers and engineers appointed by these family members and possibly judges may want to hear suggestions, or even be forced to hear suggestions during due process...
  - DuskStar 8y ago
    I think "someone sitting in the pilot's seat will always be able to crash the plane" is a pretty reasonable assumption. (How do you prevent an intentional cartwheel on takeoff or landing? There are regions of the flight envelope where 2-3 seconds of pessimal input are unrecoverable. ATC override won't help you there) So given that, we aren't trying to prevent the pilot/copilot from intentionally crashing the plane, we're trying to prevent two things: 1. Prevent any passenger on the flight from crashing the plane 2. Prevent anyone from crashing the plane into a location of their choice Locking cockpit doors prevent the first one. Locking cockpit doors plus 2-in-cockpit rules (as mandated by the FAA, and not implemented by GermanWings) do a good job of preventing the second.
    - DoctorOetker 8y ago

nradov 8y ago

Those are terrible ideas. No one can foresee all possible threats, or reliably predict which ones will come to pass. It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised?

DoctorOetker 8y ago
>Those are terrible ideas. To the extent the ideas from the peanut gallery are terrible, it is because intellectual property does not allow the peanut gallery to inspect the full airplane designs, schematics etc... I feel confident the community at large (or the relatives and acquaintances of the deceased and their lawyers and or engineers they appoint) could provide better criticisms. But if my aunt had balls she would have been my uncle: intellectual property kills. What is the statistical value of a human life? What is the statistical value of intellectual property? >No one can foresee all possible threats, or reliably predict which ones will come to pass. I think that is an open question. But let's pretend you are right for the sake of argument. Improvement does not necessitate foreseeing all problems, excluding failure modes as they are discovered is still improvement, even if they aren't absolute panaceas. >It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. Space reasons? I'm sure the passengers appreciated their extra millimeter of legroom while crashing into the alps... why not each their own breaker and the circuit only breaks when their breakers agree on breaking? i.e. logical AND. Yes any additional complexity would make the problem space more complex, and should be dealt with using formal verification etc... >And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised? Obviously, the plane only listens to ATC pilot selection when one pilot disagrees (visualize a big red disagree button if you will). As long as none of the pilots has the disagree button engaged the plane ignores ATC. ATC can not initiate selection of pilot. Yes there situations that still admit malicious pilots like: collusion between 2 pilots, collusion between a pilot and an ATC controller. Use things like sortition, and reward ratting out proposals of collusion... Edit: spelling
- nradov 8y ago
  The reason that professionals don't want to hear suggestions from the peanut gallery is mostly that the peanut gallery usually comes up with the same silly, impractical ideas over and over again. This distracts the professionals from working on real solutions. Intellectual property has little to do with it. But if IP is your concern, well you can cheaply purchase complete plans for dozens of different light aircraft designs and build them yourself with basic tools. Feel free to do that and use your own airplane as a test platform for your proposals. No one is stopping you; it's totally legal as long as you follow the regulations for experimental aircraft. Let us know when you're done and have something proven to work over thousands of flight hours. From a systems engineering standpoint, everything you have described would add complexity and would likely be a net negative for safety.
  - DoctorOetker 8y ago
    I'm not suggesting professionals want to hear suggestions from the peanut gallery. I don't believe on enforcing desires. I merely postulate that the relatives of the deceased, insurance companies, lawyers and engineers appointed by these family members and possibly judges may want to hear suggestions, or even be forced to hear suggestions during due process...
- DuskStar 8y ago
  I think "someone sitting in the pilot's seat will always be able to crash the plane" is a pretty reasonable assumption. (How do you prevent an intentional cartwheel on takeoff or landing? There are regions of the flight envelope where 2-3 seconds of pessimal input are unrecoverable. ATC override won't help you there) So given that, we aren't trying to prevent the pilot/copilot from intentionally crashing the plane, we're trying to prevent two things: 1. Prevent any passenger on the flight from crashing the plane 2. Prevent anyone from crashing the plane into a location of their choice Locking cockpit doors prevent the first one. Locking cockpit doors plus 2-in-cockpit rules (as mandated by the FAA, and not implemented by GermanWings) do a good job of preventing the second.
  - DoctorOetker 8y ago