AviationWeek.com/awst AVIATION WEEK & SPACE TECHNOLOGY/MARCH 30-APRIL 12, 2015 39
Check 6 Aviation Week editors discuss
how cockpit security is being rethought
in the wake of the Germanwings crash.
AviationWeek.com/podcastA
French prosecutor’s evidence that a co-pilot deliberately flew
the Germanwings Airbus A320 into terrain brings to the fore
questions of whether crash-proofing technologies, many developed
after the 9/11 terrorist attacks and for the unmanned aircraft indus-
try, could be a solution for the future.
There have been at least four other crashes since 1994 that
investigators believe can most likely be explained by deliberate
pilot action—a Royal Air Maroc ATR 42 in 1994, a Silk Air Boeing
737 in 1997, an Egyptair Boeing 767 in 1999 and a Linhas Aereas
de Mocambique (LAM) Embraer 190 in November 2013, eerily
similar in details to the Germanwings crash. Deliberate action by
pilots is also still pursued as one of the theories surrounding the
disappearance last year of Malaysia Airlines MH370.
According to data from Flightradar24, a crowd-sourced pro-
vider of automatic dependent surveillance broadcast (ADS-B)
tracking, the Germanwings co-pilot likely changed the altitude
command for the Airbus’s autopilot system shortly after arriving
at cruise altitude. After the captain left the cockpit, the co-pilot
presumably dialed the autopilot system hold altitude down to 100
ft. Flightradar24 ofcials say it took two days to decode the ADS-
B data, which is included in the transponder stream and had been
sent to investigators in addition to being published online.
The autopilot appears to have followed the command, descend-
ing the aircraft to the set altitude—well below the terrain in the
area. There were no automated reports of equipment failures.
Similar circumstances surrounded the LAM crash in Africa. A
preliminary report from Namibia’s aircraft accident investigation
team on the LAM E190 crash, issued in late 2013, revealed that
the captain was alone on the flight deck in cruise at flight level 380
(about 38,000 ft.)—the same altitude of the Germanwings’ A320
before its unannounced descent—when the flight data recorder
showed that the altitude command for the autopilot system was
manually changed to an altitude below the terrain. The first ofcer
had left the flight deck to use the lavatory; the aircraft’s mechanical
health was not in question.
The aircraft descended at high rates on a relatively constant
heading, with the captain changing throttle settings and deploy-
ing speed brakes, most likely to keep the aircraft from exceeding
John Croft Washington
HUMAN FACTORS
its maximum dive velocity. This scenario was replicated in an E190
simulator owned by Azul and shown to be “very close” to the data re-
corder output. As with Germanwings evidence provided by prosecu-
tors, the cockpit voice recorder in the LAM crash revealed sounds of
“repeated banging” on the cockpit door, presumably by the first of-
cer attempting to reenter the flight deck. The final report is pending.
While cockpit procedures (such as requiring at least two crew
members on station at all times) and pilot psychological evalua-
tions will likely take on heightened importance in the wake of the
Germanwings crash, so too will technological solutions that could
prevent deliberate actions by a crew or commandeer.
Work underway at NASA into single-pilot operations opens
the door for a system that would permit a ground-based first of-
ficer to take control of the aircraft; however, the current form of
the research would allow that only if the captain onboard allowed
the takeover. A senior aerospace executive familiar with the work
says the single-pilot technology exists, but the larger question is
whether the next step will be to go from two pilots onboard to zero.
He says a lone pilot would have no colleague that could stop him
or her if they wanted to do harm to the aircraft, either as part of a
terrorist plot or simply a mental breakdown.
Other work conducted post-9/11 could take on new relevance.
Honeywell developed an automatic recovery system for fly-by-
wire aircraft, proving the concept in a Beechcraft King Air and
United Airlines A319 in 2005. Rather than providing a pilot with
an audio or visual warning, as is the case with terrain awareness
and warning systems, the new system would automatically take
control of the aircraft to avoid obstacles—at the time these were
presumed to be buildings with high political value. cFLIGHTRADAR24conducted a normal, cordial conversa-
tion before the captain left the cockpit
to use the lavatory. The European Avia-
tion Safety Agency allows one pilot to
leave the cockpit for operational or
“physiological” reasons. The first of-
cer did not speak after the captain left.
Knocking and banging on the cockpit
door—presumably from the captain
seeking to regain access to the flight
deck—is audible on the cockpit voice
recorder. The escalating noise also
leads the prosecutor to believe that the
captain and others tried to smash the
door with force.
ATC made several attempts to con-
tact Flight 4U 9525, to no avail; the air-
craft’s transponder code had not been
switched to emergency mode. Other
aircraft in the area also tried to contact
the doomed Germanwings A320.
Robin said the recording picked up
normal breathing by the first ofcer
as well as screams from the cabin inDecoded transponder data from Flightradar24 shows
a commanded altitude change that may have sent
Flight 9525 into the Alps.the flight’s final moments. He has ef-
fectively ruled out terrorism. Criminal
probes of fatal aircraft accidents are
commonplace in France, and Robin’s
involvement started before any evi-
dence of a crime came to light. c