To prevent airliners from being hijacked and employed as flying bombs in a repeat of the horrific events of Sept. 11, added security layers involving armor and avionics are being debated.
The notion of equipping all passenger airliners with armored cockpit doors is now under intense discussion. If airplanes will be so equipped, the doors also will feature associated electronics for surveillance and security.
Even if the cockpit were breached, a last-ditch emergency defense could enable pilots to lock out local controls and force the airplane to fly to a landing under ground control. In this concept, the pilots would effectively become passengers in their own airplanes.
Numerous manufacturers stand ready to supply the industry with hardened cockpit doors capable of withstanding knife blades, bullets, fire and even small explosives terrorists might use in an attempt to blast open hinges and locks. And, no doubt, the pilots want the added assurance. "We definitely want strengthened doors. No ifs, ands or buts about it," declares Capt. John Cox, executive air safety chairman for the Air Line Pilots Association (ALPA). "The more I look into it, the more expeditious this program becomes."
Whatever the particular design, strengthened cockpit doors almost certainly will incorporate electronic security and surveillance features. For example, UK-based TTF Aerospace LLC, asserts that an armored door can be fitted with electronic or wireless actuated locks. The latch mechanisms, of whatever type, would be located behind the door’s protective armor plating. Indeed, one can envision a lock-release procedure similar to that employed for nuclear weapons, where it takes two people physically separated from one another to activate the weapon. So, too, in the case of cockpit doors, entering the correct entry code on the passenger cabin side of the locked door could require an authorizing code or key to be activated in the cockpit in order for the lock to open.
Las Vegas-based Proteus America offers a "high security cockpit door system." Featuring two doors (see illustration), the system offers pilots secure access to the lavatory but denies others access to the cockpit. A logic control circuit at the same time prevents the cockpit door from opening if the outer "isolation" door to the passenger cabin is open or unlocked. Sensors in the doors and lavatory would detect the presence of more than one person hiding in the lavatory or in the "airlock" space and would prevent the system from unlocking the cockpit door.
Security could be further enhanced if the entry to the cockpit were covered by a fiber optic or electronic camera, providing pilots a view of the area on the cabin side of the door. The camera would be mounted in the ceiling, a short distance from the door and looking forward. This would provide much greater security than, say, a fisheye lens in the door itself. By being able to look from the ceiling, scanning an area about 5 to 10 feet (1.5 to 3 meters) back from the door, the pilots would be able to tell if a terrorist had a knife jabbed into the back of a flight attendant to coerce cooperation.
The need for such video surveillance is underscored by this possibility: the terrorists may have used a simulated air-rage incident in order to lure one of the pilots out of the cockpit. In fact, complete video surveillance of the cabin may be on the horizon. The installation could be much like that employed by Swissair for fire detection (October 2001, page 59), with a view of the cabin located on the cockpit center console.
As a final line of defense, should terrorists break into the cockpit, one source suggests a BRB (big red button) in the cockpit. Pushing the BRB would lock out local controls and force the aircraft to fly a path to a landing place determined by a ground control station. In effect, the cockpit would "go dark" and become non-functional, thereby robbing the terrorist of the opportunity to kill more than just those people on the airplane.
Proponents of this feature believe it would make hijackings obsolete. The concept has acquired a moniker—"RoboLander." To be sure, the concept may well arouse in both pilots and passengers a morbid apprehension of automation failure. However, many passengers (without being aware of it) have been landed in fog with the airplane in full automatic control. The RoboLander’s supporters, recognizing the concept might stir the ire of pilots, nevertheless believe the technology is achievable and worth pursuing.
In the big red button concept, the captain could have an emergency activation code that would be dialed in before takeoff. In case of an apparent "situation" on board, he would activate the BRB by lifting a guard and pushing a button. Activation would immediately dump cockpit and flight data recorder information to a ground station, open a microphone for one-way, air-satellite-ground eavesdropping, and activate ground-commanded autoland at the nearest suitable (i.e., Cat III) airport.
The engine throttles would be in "electrical disconnect" and disabling controls (such as fuel switches) would be solenoid-switched to fail-safe ON. In the event of an imminent hijacking the pilot would hit the button and nobody on board could change course.
The capability clearly exists to operate jet aircraft without onboard human intervention. As an example, last April the U.S. Air Force publicized the trans-Pacific round-trip flight of the unmanned aerial vehicle, Global Hawk.
Additional details of the concept bear mentioning. Hijackers knowledgeable of aircraft systems might be able to nullify the RoboLander by pulling the appropriate cockpit circuit breakers. To prevent potential disabling, the circuit breakers (CBs) could be located behind a panel accessible only from the ground. Also, if the RoboLander system were powered by an auxiliary load-center, it would be accessible in flight only via the hatch to the electronics and equipment (E&E) bay. Another concern is the system’s safety. Remote control of a civil airliner probably would build upon existing guidance and control technologies. Proponents of the system contend that the reliability of satellite communications and autoland systems should enable the system to become a reality for Part 121 (scheduled airliner) operations in the medium term. Nevertheless, the communications links and control-transfer decision logic hint at potential failure modes.
Fairly complex software might well be needed to transfer control safely and to prevent return of control to a hijacker accidentally or by force. By the same token, the ground station would need to be able to relinquish control back to the pilot. (The pilot may state that the hijackers have been overpowered, or that it was really an air-rage incident in which the BRB was hit prematurely.)
The reported number of erroneous autopilot commands that often catch pilots by surprise also gives food for thought. The RoboLander concept will need a thorough technical and threat/failure analysis before any serious notion of deployment can be entertained.
The most security, at the least additional risk in implementation, involves making the cockpit inaccessible. A hardened cockpit door, bulkhead and associated video surveillance system would add complexity but would have no effect on flight safety. The fundamental fact is that if the hijacker does not have access to the cockpit, he cannot gain control of the aircraft.