After 9/11 there was a lot of talk about how to prevent it, and the best method was to fortify the cockpit door and prevent unauthorized access. Every security system, however, sometimes prevents authorized people from getting access, and the tragic results of that are now clear to the world. This is likely a highly unusual event, and we should not go overboard, but it’s still interesting to consider.
(I have an extra reason to take special interest here, I was boarding a flight out of Spain on Tuesday just before the Germanwings flight crashed.)
In 2001, it was very common to talk about how software systems, at least on fly-by-wire aircraft, might make it impossible for aircraft to do things like fly into buildings. Such modes might be enabled by remote command from air traffic control. Pilots resist this, they don’t like the idea of a plane that might refuse to obey them at any time, because with some justification they worry that a situation could arise where the automated system is in error, and they need full manual control to do what needs to be done.
The cockpit access protocol on the Airbus allows flight crew to enter a code to unlock the door. Quite reasonably, the pilot in the cockpit can override that access, because an external bad guy might force a flight crew member to enter the code.
So here’s an alternative — a code that can be entered by a flight crew member which sends and emergency alert to air traffic control. ATC would then have the power to unlock the door with no possibility of pilot override. In extreme cases, ATC might even be able to put the plane in a safe mode, where it can only fly to a designated airport, and auto-land at that airport. In planes with sufficient bandwidth near an airport, the plane might actually be landed by remote pilots like a UAV, an entirely reasonable idea for newer aircraft. In case of real terrorist attack, ATC would need to be ready to refuse to open the door no matter what is threatened to the passengers.
If ATC is out of range (like over the deep ocean) then the remote console might allow the flight crew — even a flight attendant — to direct the aircraft to fly to pre-approved waypoints along the planned flight path where quality radio contact can be established.
Clearly there is a risk to putting a plane in this mode, though ATC or the flight crew who did it could always return control to the cockpit.
It might still be possible to commit suicide but it would take a lot more detailed planning. Indeed, there have been pilot suicides where the door was not locked, and the suicidal pilot just put the plane into a non-recoverable spin so quickly that nobody could stop it. Still, in many cases of suicide, any impediment can sometimes make the difference.
Update: I have learned the lock has a manual component, and so the pilot in the cockpit could prevent even a remote opening for now. Of course, current planes are not set to be remotely flown, though that has been discussed. It’s non trivial (and would require lots of approval) but it could have other purposes.
A safe mode that prevents overt attempts to crash might be more effective than you think, in that with many suicides, even modest discouragement can make a difference. It’s why they still want to put a fence on the Golden Gate Bridge had have other similar things elsewhere. You won’t stop a determined suicide but it apparently does stop those who are still uncertain, which is lots of them.
The simpler solution — already going into effect in countries that did not have this rule already — is a regulation insisting that nobody is ever alone in the cockpit. Under this rule, if a pilot wants to go to the bathroom, a flight attendant waits in the cockpit. Of course, a determined suicidal pilot could disable this person, either because of physical power, or because sometimes there is a weapon available to pilots. That requires more resolve and planning, though.