Hacker News Reader

Comment by maaarghk | Hacker News Reader

Is it the case on all modern planes that a co-pilot could lock out a pilot? Is there any proposal or precedent for a key-code override on the door lock?

View on HN

There is a procedure in which the lock is overridden in case of no-response from the cockpit; it's time based so it might take somewhere between 45 seconds to 5 minutes to get the door open.

If the inhabitant of the cockpit chooses to respond with a locking command (in the case of the A320, moving the door switch forward); the door will remain closed no matter how hard you try.

It's a question of your threat model. Do you worry more about the cases where someone getting into the cockpit is a problem, or someone not getting into the cockpit is the problem? You can make provisions for both, but your final layer of security can only target one or the other. If you have an 'ultimate override code', eventually an attacker compromises it (hell, it'd probably be 1234 on most planes). If you have an 'ultimate lockout', eventually the wrong person locks everyone out.

The NY Times article has a good description of the cockpit door override procedures.

http://www.nytimes.com/2015/03/27/world/europe/germanwings-c...

In the best-case scenario, if someone in the cockpit wants to keep people out, it sounds like the security mechanisms provide a way to do for for at least five and a half minutes.

Thanks for the link -though I'm baffled why NYT seems to think when I double click I want the page to change zoom levels rather than highlighting the word I'm interested in o_0

edit: oh, they just make it impossible to select text at all... nice.

The TV news discussed the procedure used in the US, a flight attendant waits in the cockpit for the pilot to come back (I imagine this is done elsewhere too, but they weren't clear about that).

This video describes the function quite well: https://www.youtube.com/watch?v=ixEHV7c3VXs

I may be mistaken but I believe airline cockpits were made to be able to lock out people from entering in the event of a terrorist activity to take over the plane. This was initiated after 9/11.

That is true. What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not. I'm certain these scenarios have been considered, and I'm sure the developers had very solid reasons as to why something like this doesn't exist (if it actually does not).

I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range", and if it does, why can't it take automatic corrective action and override the pilot?

There's a good chance someone commenting here has worked in this area and could provide a very insightful response.

> What I'm wondering about is why the plane allows a pilot to take a fatal action. For example, why would an auto-pilot system allow a jetliner to nose dive? Maybe it does not.

I believe it doesn't (not an expert though), as it'll assume you've lost control of the airplane and will try to recover. However in this case the descent was at a fairly standard speed. But yeah the autopilot will not override the pilot if the airplane seems under control.

The design of cockpit controls could be directed by a number of things such as government regulations, manufacturer features, industry standards, airline or pilot lobby groups, etc. I bet we are going to hear a lot about airplane flight controls in the coming days.

If you allow flight software to override a pilot's decision, what happens when the plane's instruments malfunction? You could end up with a situation where a faulty airspeed indicator causes the flight software to nosedive the plane in a futile attempt to prevent a stall that isn't happening.

Two reasons, legal and technical.

1. the legal responsibility lies with the pilot(s); therefore there always needs to be an option to override or even shut down the computer

which is partly caused by

2. computers and their programs are anything but perfect; computer-assisted issues are usually resolved by human input ("speed is 253...254...255...oh look we're actually moving backwards, now what?!" "now we fly manually, you dumb toaster, because we're obviously not in the situation you think we are.").

In other words, "take control completely away from people and give it to automatics" is a recipe for a far more frequent trouble than an unpredictable outlier event.

Damn those ancient 9 bit aeroplane computers

LOL.

But seriously, stuff like that already happened, multiple times. Most famously, http://www.dailytech.com/Lockheeds+F22+Raptor+Gets+Zapped+by...

I think (2) is overrated. Software used in critical situations already detects faulty readings based on various models that simulate the range of plausible values. It's only a matter of time until they're vastly more accurate than humans - if they aren't already.

Of course they are - in most situations, and this is one of the things that makes commercial aviation so safe.

Except when something very unexpected happens (e.g. not all sensor malfunctions can be distinguished from a reading that's outside of the usual range, yet plausible); in such situations, automatics disengage and people need to step in.

In other words, you can only get so many reliability nines and still be profitable for mass transport (as opposed to, for example, Space Shuttle).

>why the plane allows a pilot to take a fatal action

The plane is acting on sensor information, hardware and software, which might be flawed. That is why the pilots always need to be able to do a manual override.

Take for instance the Air France 447 crash: the first problem was freezing of pitot tubes to measure airspeed. That alone would have messed up auto-pilot. Then, the not very experienced co-pilot flying the plane also reacted wrong, and then the plane came down; the captain did not start to correct things in time.

http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....

Nobody considered a terrorist suicide by flying the plane into a building until it happened. So they made the doors lockable so that nothing passengers did could get them into the cockpit.

During that they obviously didn't think that any pilot would suicide the plane by flying it into the ground.

All the while there is value in driving planes into the ground, it's an unwinnable solution.

> . For example, why would an auto-pilot system allow a jetliner to nose dive?

It doesn't... usually. Everything can be overridden.

> I'm curious if the plane has enough input to determine "if we continue this course we will crash into the mountain range"

Yeah. "Whoop Whoop TERRAIN". "Whoop Whoop PULL UP"

Haven't actually heard the recording, but those are probably among the alarms in the cockpit. The pilot is still required to raise the altitude.

http://en.wikipedia.org/wiki/Ground_proximity_warning_system

As other comments pointed out, sensors are still faulty. Not sure if any airplanes actually have auto pull-up capability.

Reply on news.ycombinator.com