4 ms·

Is it the case on all modern planes that a co-pilot could lock out a pilot? Is there any proposal or precedent for a key-code override on the door lock?

larrydag 12y ago
I may be mistaken but I believe airline cockpits were made to be able to lock out people from entering in the event of a terrorist activity to take over the plane. This was initiated after 9/11.
- lsadam0 12y ago
  That is true. What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not. I'm certain these scenarios have been considered, and I'm sure the developers had very solid reasons as to why something like this doesn't exist (if it actually does not). I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range", and if it does, why can't it take automatic corrective action and override the pilot? There's a good chance someone commenting here has worked in this area and could provide a very insightful response.
  - Anderkent 12y ago
    > What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not. I believe it doesn't (not an expert though), as it'll assume you've lost control of the airplane and will try to recover. However in this case the descent was at a fairly standard speed. But yeah the autopilot will not override the pilot if the airplane seems under control.
  - larrydag 12y ago
    The design of cockpit controls could be directed by a number of things such as government regulations, manufacturer features, industry standards, airline or pilot lobby groups, etc. I bet we are going to hear a lot about airplane flight controls in the coming days.
  - biot 12y ago
    If you allow flight software to override a pilot's decision, what happens when the plane's instruments malfunction? You could end up with a situation where a faulty airspeed indicator causes the flight software to nosedive the plane in a futile attempt to prevent a stall that isn't happening.
  - Piskvorrr 12y ago
    Two reasons, legal and technical. 1. the legal responsibility lies with the pilot(s); therefore there always needs to be an option to override or even shut down the computer which is partly caused by 2. computers and their programs are anything but perfect; computer-assisted issues are usually resolved by human input ("speed is 253...254...255...oh look we're actually moving backwards, now what?!" "now we fly manually, you dumb toaster, because we're obviously not in the situation you think we are."). In other words, "take control completely away from people and give it to automatics" is a recipe for a far more frequent trouble than an unpredictable outlier event.
    - mavhc 12y ago
      Damn those ancient 9 bit aeroplane computers
      - Piskvorrr 12y ago
        LOL. But seriously, stuff like that already happened, multiple times. Most famously, http://www.dailytech.com/Lockheeds+F22+Raptor+Gets+Zapped+by+International+Date+Line/article6225.htm http://www.dailytech.com/Lockheeds+F22+Raptor+Gets+Zapped+by...
    - icebraining 12y ago
      I think (2) is overrated. Software used in critical situations already detects faulty readings based on various models that simulate the range of plausible values. It's only a matter of time until they're vastly more accurate than humans - if they aren't already.
      - Piskvorrr 12y ago
        Of course they are - in most situations, and this is one of the things that makes commercial aviation so safe. Except when something very unexpected happens (e.g. not all sensor malfunctions can be distinguished from a reading that's outside of the usual range, yet plausible); in such situations, automatics disengage and people need to step in. In other words, you can only get so many reliability nines and still be profitable for mass transport (as opposed to, for example, Space Shuttle).
  - ptaipale 12y ago
    >why the plane allows a pilot to take a fatal action The plane is acting on sensor information, hardware and software, which might be flawed. That is why the pilots always need to be able to do a manual override. Take for instance the Air France 447 crash: the first problem was freezing of pitot tubes to measure airspeed. That alone would have messed up auto-pilot. Then, the not very experienced co-pilot flying the plane also reacted wrong, and then the plane came down; the captain did not start to correct things in time. http://www.bea.aero/en/enquetes/flight.af.447/rapport.final.en.php http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....
  - brc 12y ago
    Nobody considered a terrorist suicide by flying the plane into a building until it happened. So they made the doors lockable so that nothing passengers did could get them into the cockpit. During that they obviously didn't think that any pilot would suicide the plane by flying it into the ground. All the while there is value in driving planes into the ground, it's an unwinnable solution.
  - outworlder 12y ago
    > . For example, why would an auto-pilot system allow a jetliner to nose dive? It doesn't... usually. Everything can be overridden. > I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range" Yeah. "Whoop Whoop TERRAIN". "Whoop Whoop PULL UP" Haven't actually heard the recording, but those are probably among the alarms in the cockpit. The pilot is still required to raise the altitude. http://en.wikipedia.org/wiki/Ground_proximity_warning_system http://en.wikipedia.org/wiki/Ground_proximity_warning_system As other comments pointed out, sensors are still faulty. Not sure if any airplanes actually have auto pull-up capability.
maxerickson 12y ago
The TV news discussed the procedure used in the US, a flight attendant waits in the cockpit for the pilot to come back (I imagine this is done elsewhere too, but they weren't clear about that).
uptown 12y ago
The NY Times article has a good description of the cockpit door override procedures. http://www.nytimes.com/2015/03/27/world/europe/germanwings-crash.html http://www.nytimes.com/2015/03/27/world/europe/germanwings-c... In the best-case scenario, if someone in the cockpit wants to keep people out, it sounds like the security mechanisms provide a way to do for for at least five and a half minutes.
- BuildTheRobots 12y ago
  Thanks for the link -though I'm baffled why NYT seems to think when I double click I want the page to change zoom levels rather than highlighting the word I'm interested in o_0 edit: oh, they just make it impossible to select text at all... nice.
bulte-rs 12y ago
There is a procedure in which the lock is overridden in case of no-response from the cockpit; it's time based so it might take somewhere between 45 seconds to 5 minutes to get the door open. If the inhabitant of the cockpit chooses to respond with a locking command (in the case of the A320, moving the door switch forward); the door will remain closed no matter how hard you try.
Cyclenerd 12y ago
This video describes the function quite well: https://www.youtube.com/watch?v=ixEHV7c3VXs https://www.youtube.com/watch?v=ixEHV7c3VXs
saalweachter 12y ago
It's a question of your threat model. Do you worry more about the cases where someone getting into the cockpit is a problem, or someone not getting into the cockpit is the problem? You can make provisions for both, but your final layer of security can only target one or the other. If you have an 'ultimate override code', eventually an attacker compromises it (hell, it'd probably be 1234 on most planes). If you have an 'ultimate lockout', eventually the wrong person locks everyone out.

larrydag 12y ago

I may be mistaken but I believe airline cockpits were made to be able to lock out people from entering in the event of a terrorist activity to take over the plane. This was initiated after 9/11.

lsadam0 12y ago
That is true. What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not. I'm certain these scenarios have been considered, and I'm sure the developers had very solid reasons as to why something like this doesn't exist (if it actually does not). I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range", and if it does, why can't it take automatic corrective action and override the pilot? There's a good chance someone commenting here has worked in this area and could provide a very insightful response.
- Anderkent 12y ago
  > What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not. I believe it doesn't (not an expert though), as it'll assume you've lost control of the airplane and will try to recover. However in this case the descent was at a fairly standard speed. But yeah the autopilot will not override the pilot if the airplane seems under control.
- larrydag 12y ago
  The design of cockpit controls could be directed by a number of things such as government regulations, manufacturer features, industry standards, airline or pilot lobby groups, etc. I bet we are going to hear a lot about airplane flight controls in the coming days.
- biot 12y ago
  If you allow flight software to override a pilot's decision, what happens when the plane's instruments malfunction? You could end up with a situation where a faulty airspeed indicator causes the flight software to nosedive the plane in a futile attempt to prevent a stall that isn't happening.
- Piskvorrr 12y ago
  Two reasons, legal and technical. 1. the legal responsibility lies with the pilot(s); therefore there always needs to be an option to override or even shut down the computer which is partly caused by 2. computers and their programs are anything but perfect; computer-assisted issues are usually resolved by human input ("speed is 253...254...255...oh look we're actually moving backwards, now what?!" "now we fly manually, you dumb toaster, because we're obviously not in the situation you think we are."). In other words, "take control completely away from people and give it to automatics" is a recipe for a far more frequent trouble than an unpredictable outlier event.
  - mavhc 12y ago
    Damn those ancient 9 bit aeroplane computers
    - Piskvorrr 12y ago
      LOL. But seriously, stuff like that already happened, multiple times. Most famously, http://www.dailytech.com/Lockheeds+F22+Raptor+Gets+Zapped+by+International+Date+Line/article6225.htm http://www.dailytech.com/Lockheeds+F22+Raptor+Gets+Zapped+by...
  - icebraining 12y ago
    I think (2) is overrated. Software used in critical situations already detects faulty readings based on various models that simulate the range of plausible values. It's only a matter of time until they're vastly more accurate than humans - if they aren't already.
    - Piskvorrr 12y ago
      Of course they are - in most situations, and this is one of the things that makes commercial aviation so safe. Except when something very unexpected happens (e.g. not all sensor malfunctions can be distinguished from a reading that's outside of the usual range, yet plausible); in such situations, automatics disengage and people need to step in. In other words, you can only get so many reliability nines and still be profitable for mass transport (as opposed to, for example, Space Shuttle).
- ptaipale 12y ago
  >why the plane allows a pilot to take a fatal action The plane is acting on sensor information, hardware and software, which might be flawed. That is why the pilots always need to be able to do a manual override. Take for instance the Air France 447 crash: the first problem was freezing of pitot tubes to measure airspeed. That alone would have messed up auto-pilot. Then, the not very experienced co-pilot flying the plane also reacted wrong, and then the plane came down; the captain did not start to correct things in time. http://www.bea.aero/en/enquetes/flight.af.447/rapport.final.en.php http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....
- brc 12y ago
  Nobody considered a terrorist suicide by flying the plane into a building until it happened. So they made the doors lockable so that nothing passengers did could get them into the cockpit. During that they obviously didn't think that any pilot would suicide the plane by flying it into the ground. All the while there is value in driving planes into the ground, it's an unwinnable solution.
- outworlder 12y ago
  > . For example, why would an auto-pilot system allow a jetliner to nose dive? It doesn't... usually. Everything can be overridden. > I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range" Yeah. "Whoop Whoop TERRAIN". "Whoop Whoop PULL UP" Haven't actually heard the recording, but those are probably among the alarms in the cockpit. The pilot is still required to raise the altitude. http://en.wikipedia.org/wiki/Ground_proximity_warning_system http://en.wikipedia.org/wiki/Ground_proximity_warning_system As other comments pointed out, sensors are still faulty. Not sure if any airplanes actually have auto pull-up capability.

maxerickson 12y ago

The TV news discussed the procedure used in the US, a flight attendant waits in the cockpit for the pilot to come back (I imagine this is done elsewhere too, but they weren't clear about that).

uptown 12y ago

The NY Times article has a good description of the cockpit door override procedures. http://www.nytimes.com/2015/03/27/world/europe/germanwings-crash.html http://www.nytimes.com/2015/03/27/world/europe/germanwings-c... In the best-case scenario, if someone in the cockpit wants to keep people out, it sounds like the security mechanisms provide a way to do for for at least five and a half minutes.

BuildTheRobots 12y ago
Thanks for the link -though I'm baffled why NYT seems to think when I double click I want the page to change zoom levels rather than highlighting the word I'm interested in o_0 edit: oh, they just make it impossible to select text at all... nice.

bulte-rs 12y ago

There is a procedure in which the lock is overridden in case of no-response from the cockpit; it's time based so it might take somewhere between 45 seconds to 5 minutes to get the door open. If the inhabitant of the cockpit chooses to respond with a locking command (in the case of the A320, moving the door switch forward); the door will remain closed no matter how hard you try.

Cyclenerd 12y ago

This video describes the function quite well: https://www.youtube.com/watch?v=ixEHV7c3VXs https://www.youtube.com/watch?v=ixEHV7c3VXs

saalweachter 12y ago

It's a question of your threat model. Do you worry more about the cases where someone getting into the cockpit is a problem, or someone not getting into the cockpit is the problem? You can make provisions for both, but your final layer of security can only target one or the other. If you have an 'ultimate override code', eventually an attacker compromises it (hell, it'd probably be 1234 on most planes). If you have an 'ultimate lockout', eventually the wrong person locks everyone out.