I guess a good thing to note about this is that aviation is so close to optimum safety level that it's hard to find unambiguous ("pareto") improvements; you can just find a different tradeoff. The gradient is pretty close to zero.
What if a malicious pilot had been part of the threat model? instead of terrorist-proof cockpit doors, attacker-proof cockpit doors: split the cockpit in half (strong plexiglass), each has their own combination code for their own door. As soon as one pilot starts disobeying ATC, they can choose which pilot gets control of the airplane...
True, the pilots can no longer circle j* during their boring flights...
To the extent the ideas from the peanut gallery are terrible, it is because intellectual property does not allow the peanut gallery to inspect the full airplane designs, schematics etc... I feel confident the community at large (or the relatives and acquaintances of the deceased and their lawyers and or engineers they appoint) could provide better criticisms. But if my aunt had balls she would have been my uncle: intellectual property kills. What is the statistical value of a human life? What is the statistical value of intellectual property?
>No one can foresee all possible threats, or reliably predict which ones will come to pass.
I think that is an open question. But let's pretend you are right for the sake of argument. Improvement does not necessitate foreseeing all problems, excluding failure modes as they are discovered is still improvement, even if they aren't absolute panaceas.
>It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points.
Space reasons? I'm sure the passengers appreciated their extra millimeter of legroom while crashing into the alps... why not each their own breaker and the circuit only breaks when their breakers agree on breaking? i.e. logical AND. Yes any additional complexity would make the problem space more complex, and should be dealt with using formal verification etc...
>And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised?
Obviously, the plane only listens to ATC pilot selection when one pilot disagrees (visualize a big red disagree button if you will). As long as none of the pilots has the disagree button engaged the plane ignores ATC. ATC can not initiate selection of pilot. Yes there situations that still admit malicious pilots like: collusion between 2 pilots, collusion between a pilot and an ATC controller. Use things like sortition, and reward ratting out proposals of collusion...
Edit: spelling
1. Prevent any passenger on the flight from crashing the plane
2. Prevent anyone from crashing the plane into a location of their choice
Locking cockpit doors prevent the first one. Locking cockpit doors plus 2-in-cockpit rules (as mandated by the FAA, and not implemented by GermanWings) do a good job of preventing the second.
yeah, in the Airbus A300 just kick the rudders a few times fully left to right (see American Airlines Flight 587) [1]
> 2-in-cockpit rules (as mandated by the FAA, and not implemented by GermanWings)
Just to clarify, GermanWings was not under FAA jurisdiction, so the 2-in-cockpit rule did not apply.
Also, EASA implemented the 2-in-cockpit rule in 2015 after the GermanWings accident [2], but withdrew it in 2016 and replaced it with a more flexible rule [3] after consultation with stakeholders, as "the rule to have 2 persons in the cockpit at all times introduces additional safety and security risks." [4]
As I said somewhere above, there's rarely scope for a pareto improvement in aviation.
[1] https://en.wikipedia.org/wiki/American_Airlines_Flight_587
[2] https://www.easa.europa.eu/newsroom-and-events/news/easa-rec...
[3] https://www.easa.europa.eu/newsroom-and-events/news/minimum-...
[4] https://www.eurocockpit.be/news/end-2-persons-cockpit-rule-s...
Kicking the rudder fully left to right a few times would most likely put any modern airliner outside of its structural limits (and would probably injure lots of passengers even if it didn't). I believe the A300 had very sensitive rudder controls, which made it possible to create extreme loads on the rudder via a sequence of relatively small back-and-forth movements.
The English language is a bit poor on existential and universal quantifiers, which renders the above sentence a bit ambiguous: it could be interpreted as 1) "For every flight and prevention method there will always exist some opportunities for a pilot to crash the plane" (with which I tend to agree) or 2) "For every flight and prevention method, the pilot will at all times be able to crash the plane" (with which I don't agree)
>(How do you prevent an intentional cartwheel on takeoff or landing? There are regions of the flight envelope where 2-3 seconds of pessimal input are unrecoverable. ATC override won't help you there)
I tend to agree.
>So given that, we aren't trying to prevent the pilot/copilot from intentionally crashing the plane
This doesn't follow. We can still limit the attack scenarios to say situations like landing and taking off. It doesn't need to be binary, a reduction in threats is still desriable. For example if Lubitz had been even more antisocial in his destruction by suicide, he could easily have crashed the plane into the surface storage for nuclear waste next to a nuclear power plant. The reactor itself does not house that much nuclear material, while the typical surface storage next to it tends to contain a lot of nuclear waste. He might still kill the passengers on landing and take off, but as crude as it sounds, it's still better than losing the very same passengers and having a nuclear contamination on our hands!
The 2-in-cockpit rule sounds rather weak in my opinion, as it becomes a matter of who is stronger or who strikes first, the element of surprise etc...
From a systems engineering standpoint, everything you have described would add complexity and would likely be a net negative for safety.
I believe FAA of US specifically alerted German government's air travel agency (?) about the need to have another crew member (like flight attendant) to be in the cockpit if one of the two had to leave cockpit to use restroom etc, exactly to avoid this kind of scenario.
But the Germany govt agency apparently thought it was unlikely to happen and ignored the recommendation.
I could be wrong, but pretty sure about reading that bit while reading about the incident...