Questions and Answers on the Tragedy of Germanwings 9252
So I went out of town last week without saying anything, which is why you had sudden silence from me as the scale of this tragedy unfolded. I spoke to a few journalists but was not in a position to write an article for you until today. That means I get the benefit of over a week of investigation news and it’s also already clear what aspects of this, after the initial how could he? are causing the most confusion. So to make up for my absence, I’ve put together a set of questions and answers that I hope might be helpful in deciphering the reporting from the mainstream press.
What if the First Officer took ill? Why is everyone saying he did this deliberately? They can’t possibly know that!
Yes, actually, we do have enough evidence that criminal proceedings against him are in progress.
I can tell you one hundred percent: a pilot slumped over in the cockpit could not put the aircraft into a descent. The Airbus has a joystick at the side, not a control column in front.
The aircraft was configured by a human directly after the Captain left the cockpit. The First Officer chose to start a descent in what could only have been a deliberate action.
The Captain should have been able to access the cockpit using the keypad, as below, but he was locked out.
Finally, the Flight Data Recorder shows that the First Officer repeatedly accelerated the plane’s descent. He did not make a mistake: he was flying the aircraft into the mountains.
This was not the responses of a panicked man but quite clearly a decision taken to crash the aircraft.
How do investigators know that the First Officer locked the Captain out?
Normally, if one pilot leaves the cockpit, the other pilot simply lets him in upon his return. In the Airbus 320, there is a keypad by the door to allow access to crew as the door automatically locks.
The Chief Executive of Lufthansa stated that the Captain had the code to the keypad and that he would not have forgotten it. Even if he had, the other crew members also knew the code and could have let the Captain in.
However, to ensure security and that the key code can’t be forced off a crew member by a terrorist, there is a “lock” switch in the cockpit. The Lufthansa executive confirmed that, as set up for their aircraft, this would disable the keypad for five minutes. If the First Officer used this “lock” to ensure the Captain couldn’t get in, he probably overrode the keypad repeatedly, as the descent lasted for eight minutes, enough time for the Captain to get in again.
Why does the Captain not simply carry a key? How can it be possible to lock the Captain out?
The security in place is strictly to protect the cockpit from hijack. The Captain could be attacked in the cabin and the key taken off him, or he could be forced to relinquish the code. The locked door is a response to a threat from the passengers, not a threat from the flight crew. Thus, it makes sense that the control is inside the cockpit, to stop a forced entry.
The entire concept of protecting an aircraft from the flight crew is pretty crazy and not something that should ever be needed. Realistically, if pilots decide to crash the plane and kill everyone on board, it really isn’t that easy to stop them.
Regardless, surely we have to stop this ever happening again?
I’d like to refer you to an old post of mine: Fear of Landing – JetBlue Captain Break Down
Three years ago, the captain of a JetBlue flight began to act very oddly, rambling to his first officer about evaluations, religion and stated that they were not going to Vegas. The first officer became concerned when his captain said that “things just don’t matter”. The captain told the air traffic controllers to be quiet and turned off all the radios.
The First Officer invited another, off-duty pilot to join them and when the captain left the cockpit to use the toilet, the first officer locked him out and changed the security code. Passengers were able to subdue the screaming captain and restrain him until the aircraft landed safely.
So there’s the core of the problem: we can’t have a system in place that protects the cockpit from hijackers, saves the passengers from their captain on JetBlue flight 191 and also would have saved the passengers from the first officer on Germanwings flight 9525. There’s no way to protect against every possible scenario.
We just can’t make it one hundred percent risk free, however much we’d like to save every soul.
Why didn’t they already have a rule that you need two in the cockpit?
Some airlines already had this rule and last week, many or even most airlines decided to implement this as standard.
Personally, I’m not impressed with all these airlines jumping on the bandwagon to change these rules. I think all we’ve done is add a new point of vulnerability. Flight attendants do not receive the same amount of mental health checks as pilots and with this rule, we are increasing access to the cockpit rather than reducing it.
Previously, if you decided that you wanted to take control of the aircraft and crash it, you would first have to become a pilot and get a job as the flight crew. Now, all you have to do is get a job as a flight attendant.
In addition, the moment of transition, when one person is trying to get out while the other person is trying to get in, is a vulnerable time in the Boeing 737 and other smaller aircraft. The door must be held open for one person to exit so that the other can enter. From a hijack point of view, it opens a window of opportunity on every flight.
There are also regional flights with three-man crews: two pilots and a single flight attendant to cover the cabin. Is the cabin to be abandoned in order for the flight attendant to stand uncomfortably in the cockpit?
It is possible that the First Officer would never attempted this awful plan if someone had stayed with him. It’s possible that the cabin crew member would have fought the First Officer for control when he disabled the keypad to deny the captain entrance. But I remain unconvinced by the wisdom of this attempt to reduce the likelihood of what is an incredibly rare event.
Why have they spent so much time and money on the recovery of the Flight Data Recorder after the Cockpit Voice Recorder made it clear that the crash was intentional?
Because it would clearly either corroborate the existing evidence that the First Officer deliberately flew the aircraft into the ground or give us new data to explain what happened.
As it happens, the data shows that the first officer repeatedly increased the rate of descent, confirming that this was a deliberate action.
Shouldn’t we have video in the cockpit too?
Straight up: in my opinion, the main reason to add a video feed would be to sate morbid curiosity. Right now, we have the cockpit voice recorder and the flight data recorder which store information about the flight and attempts to ensure that we have enough data to recreate an accident and understand why it went wrong. It may not be possible for you and me to recreate the actions in the cockpit based on soft sounds, but that’s exactly what the analysis of the CVR is. These on-board recorders are put through surviveability testing including:
- Crash Impact Test — 3400gs for 6.5 ms would be required to meet most accident scenarios. This test is actually performed with a cannon. A Fairchild CVR has survived a crash that was estimated to be more than 6000 gs.
- Static Crush — In this test, 5,000-pound pressure is applied against all six axis points.
- Pierce Test — A pierce test employs a 500-lb. weight dropped from 10 feet. It has been modified to be performed with a hardened steel pin.
- Fire Test — The devices are subjected to 1100 degrees Centigrade for 60 minutes, then undergo 10 hours at 260 degrees Centigrade.
Any further recording devices would have to go through the same testing and be placed securely so as to have a useful view of the cockpit and yet not be dislodged by turbulence or really anything other than a full impact. And then, we have very little new information that couldn’t be recovered / recreated from the existing recorders.
Having a video of this would be a journalist’s dream but it is unlikely that investigators would receive enough new data to make it worth it.
How did a deranged pilot get control of a commercial airplane? How could the Airline not have known?
It’s not all that easy to determine if a person is going to go off the rails. If we banned everyone with any mental issue from flying, then it would be close to impossible to source enough pilots to cover current flights, let alone industry growth. In addition, although reporting is encouraged, it can be very frightening for a pilot to admit to issues like depression or alcoholism which could mean losing her job or her licence.
The New Yorker puts this into perspective with lots of good references.
Andreas Lubitz, Psychiatry, and the Germanwings Disaster – The New Yorker
But as any mental-health professional will tell you (and as many did in the wake of the crash), nearly one in three Americans meets the criteria for a mental-disorder diagnosis in any year, and more than half of us will qualify at some point in our lives. Once diagnosed, people with mental illnesses, even severe psychotic disorders like schizophrenia, do not commit violent crimes at higher rates than the rest of the population. And most people who have had suicidal thoughts do not go on to kill themselves, let alone a planeload of strangers. More intense psychological scrutiny coupled with the possibility of getting fired, as the head of an organization of German flight attendants warned, could easily backfire. “I would warn against making the crew into completely transparent people,” he said. “That would just mean that someone would not go to a doctor.”
But then how do we protect against pilots with mental disorders?
One thing that would undoubtably help is a long-term disability program. A user on the Professional Pilots Rumour Network posts about how this worked at American West.
Airbus A320 crashed in Southern France – Page 143 – PPRuNe Forums
We had pilots with a wide variety of issues from substance abuse to heart conditions able to go out on medical leave at 60% of their income. Long term disability kicked in 3 months after the initial short term period. There was no sick leave used in the process, if you had a condition that kept you out longer than 3 months you were placed in the program. Some guys never did get their medical back, they were able to stay on disability until social security retirement age. It was an industry leading benefit, one we fought hard to retain. I know for a fact that guys that may have hid an issue were proactive in getting help becaiuse of this program. I worked on the Aeromedical committee for ALPA when we had that union on the property.
Unfortunately we have lost that benefit in the merger with American. I personally think that this is short sighted on the part of the present union, APA, and the company. Guys that don’t have sick bank, which is about 40 percent of the combined pilot group, will not have the money coming in if they have a significant issue. That is disincentive to getting help. We should encourage proactive health fitness, not hinder it.
We self certify our fitness to fly every leg, it’s an ACARS entry we make before each flight. The burden is on the pilot to be honest and truthful. The system cannot operate any other way, it is too burdensome to check every pilot every leg. And it would be stupid to do so. This is not a common problem. 99.9 % of us just do our jobs safely and quietly every day. We have a bigger threat from weather and fatigue than we do from mental instability.
Will this accident bankrupt Lufthansa?
Airlines have insurance specifically to protect them in the case of liability for accidents. In this case, there are over 30 insurers led by Allianz.
Allianz pencils in $300 mln cost for Germanwings crash – sources | Reuters
The initial estimate represents about 20 percent of the $1.5 billion in premiums in the global market for airline insurance. The estimate includes the loss of the aircraft, which is seen at about $6.5 million, the recovery efforts, legal fees and indemnification of the passengers’ families.
Why are there so many plane crashes suddenly?
There aren’t. Honestly, there really aren’t more crashes happening now and air travel isn’t suddenly unsafe. Ever since Malaysia Airlines flight 370 disappeared, we’ve had incredible news coverage of crashes that wouldn’t have had much more than a mention in newspapers in previous years. It’s a hot subject, it gets viewers, and it fills news hours. People are incredibly interested — certainly I have become much more popular at parties in the past year!
One of the whole points of doing the Why Planes Crash series was that I wanted to offer a wide spread of accidents around the world, which I knew most people would never have heard of. The fact is, I may well decide to stop the series at 2014 as public knowledge about air accidents massively increased.
It’s hard to believe watching the news, but air travel became safer in 2014. Despite what the opinion columns would have you believe, Asian airline carriers improved their safety record in 2014, which is largely invisible because Asian accidents are being covered which never were before.
How can you say that flying is safe after all this?
Public transportation is generally safe. However, the public (by which I mean all of us) is extremely interested in crashes and pretty much disinterested in flights where nothing happens.
The International Air Transport Association released their IATA – 2014 Safety Performance report for commercial aviation last month.
2014 had the lowest accident rate in history, the equivalent of one accident for every 4.4 million flights. There were 12 fatal accidents with 641 fatalities out of a total of 38 million flights.
The fatalities in 2014 is high, to be sure but 537 of those were from the two Boeing 777 accidents suffered by Malaysia Airlines, which really swings the stats.
IATA says that more than 3.3 billion people flew safely on 38 million flights (30.6 million by jet, 7.4 million by turboprop). So out of 3.3 billion journeys, 641 were fatal. That doesn’t make the loss of those lives any less tragic but it really does put into perspective.
The average per year over the five year period of 2009-2013 was 19 fatal accidents and 517 fatalities…but we’ve never seen anything like the current news coverage before, which makes it feel like aircraft are dropping out of the sky.
Aviation safety performance improved in 2014 in every region in the world (compared to the respective five-year rate 2009-2013). So flying today is safer than it ever was. Only the media coverage has changed.
So what should we do?
Right now, the focus has to be on this particular accident and how it happened. We should not, however, rush to make half-cocked changes based on partial information and we must avoid opening air travel up to new risks in a rush to protect from this specific situation.
Investigators will look for systemic weaknesses which could have led to this and consider what could be done to minimise the risk of similar situations. The French investigative body (BEA) has already said that, “the Safety Investigation will be oriented towards the cockpit door locking system logic and cockpit access and exit procedures, as well as the criteria and procedures applied to detect specific psychological profiles.”
Armed with this information, we can look at getting real results in an industry that is already one of the safest.
Good to have you back, Sylvia !
A lot about this crash has become known fact. The CVR already gave the answer, now the FDR has been found which confirmed that indeed the F/O locked the captain out of the cockpit and committed suicide, taking all 149 people with him.
Here in Europe there are several ways to insure against disability and of course in most EU countries the state will provide a safety net. Pilots can, usually via their union, take out a loss of licence insurance. Most serious airlines will also have schemes to assist pilots who failed their medical.
And of course, failing a medical examination does not necessarily mean that the pilot will be disabled.
The medical fitness required is setting a high bar. At the end of my flying career I was deemed “temporarily unfit”. In order to get my 1st class medical renewed it would have meant a procedure that I did not take. My last years of flying were free-lance on Citations. I flew Ce500, 550Bravo, a Stallion, an old Astec Eagle and a 650. It was just at the start of the recession and all aircraft disappeared when the owners / operators went bust, sold the aircraft or had it taken by the bank.
Nevertheless, I passed the test to drive a bus. I now am a student of Irish Culture and History and in between show tourists around Ireland. Often driving the bus and talking into a boom mike.
Yes, I miss flying but after 40 odd years and 22000 hours of accident-free flying, what else can I want? I flew many types from a single-seater Turbulent to a BAC 1-11 and many types in between (including the DH 82 Tiger Moth).
So to return to the subject:
There are some knee-jerk reactions to the drama.
Two people in the cockpit at all times? Two objections: The cockpit door would have to be open a longer time to allow a pilot out and a cabin crew member in. The chance that the remaining crew member would get a heart attack just during the absence of the other pilot is infinitely small and who can guarantee that this period when the cockpit door is unlocked is not the moment a hijacker has been waiting for?
The other objection is: We have an accident which in fact is not an accident. Because in my book an accident is caused, well, accidentally. In other words: not premeditated. This was not an accident, it was suicide. The tragedy is that the co-pilot decided to take everyone on board with him. But who can guarantee that the cabin crew member who enters the cockpit is not the very person with suicidal intentions? The unthinkable has happened, it was a pilot. But if a pilot can lose all rational thinking so can everyone else! The fact is that any solution could possibly present another problem.
What is at the very heart of this tragedy is the fact that this pilot had a long previous history of mental problems. This only emerged after the crash.
Doctor – patient confidentiality made it legally impossible for the doctors to ring the alarm bells, not even when they became aware that the patient was a pilot. Only he could have informed the airline and as has become known, he did not use the doctor’s note that he was unfit to fly.
I can only think of making a psychological check a mandatory part of the regular routine medical examination. This would not breach the confidentiality: the certificate simply states the class and fit, unfit or temporarily unfit.
Without a medical certificate the pilot’s licence is not valid so a pilot cannot ignore it. Airlines keep a record of when a licence is to be renewed and track the issue (or non-issue) of the medical certificate.
Conditions may be attached e.g. a reduced period of validity. Still, it would not guarantee that it would catch all medical problems. But it increases the chances that a pilot who has a disorder will be prevented from reporting for duty and killing all aboard his (or her) airplane.
The two in a cockpit rule is not a knee jerk reaction. installing ballistic cockpit doors after 9/11 was the real knee jerk reaction.
German Wings was a predictable human tragedy and those who demanded ballistic cockpit doors never thought it through.
I mean honestly the 9/11 hijackers were under FBI surveillance for months beforehand. TSA allowed them to board the plane with minimal scrutiny.
The correct response now is to make the whole plane a fortress, not the cockpit door.
The correct response to disturbed pilots is to do what New Zealand does. In New Zealand all pilots from PPL up, sacrifice privacy for the privilege of flying. As a pilot in New Zealand, NZ CAA has access to all official records, medical records, traffic offences, criminal records, family court proceedings and it works. In NZ medical professionals are under a legal obligation to disclose information to the CAA. That is how it should be.
There must be no secrets in aviation and pilots can’t be trusted to be candid about health problems.
Sadly Lufthansa could not be trusted to take seriously a pilot with suicidal tendencies.
Simon,
I cannot agree with you: the “two in the cockpit” rule is a kneejerk reaction to a kneejerk reaction.
When I was flying the airline stuff we carried a veritable library in the cockpit. AOM, BOM, route manuals, spare loadsheets and TL (=RTOW) tables, maps, you name it.
In the “BOM” (Basic Operations Manual) was a chapter that instructed the crew how to react to a hijack.
Of course, a berserk cockpit crew member was not taken into consideration.
There were several different opinions. Some thought that a locked cockpit door was not going to solve anything. A determined hijacker would simply shoot a random passenger or cabin crew member and would continue doing so until the door would be opened. Others thought it would be a first line of defence.
We also carried sheets saying in many languages:
“We will comply with anything you want us to do” or words to that effect – short of course of flying into buildings or mountains.
The jury is still out although it would seem that events have moved in favour of some form of access.
On the medical secret issue: unfortunately you do not understand the legal differences between jurisdictions. Lufthansa (and other airlines) simply do not have the option, even to the point where a pilot cannot even waive his or her right to the legal confidentiality. He or she can provide the data on a voluntary basis only.
So there is absolutely no way that a German airline (in common with airlines in other countries) can gain access to medical records if the person concerned is not willing to divulge them.
I have been involved with this issue when I was chief pilot of a small operation.
A pilot had disappeared at Schiphol Airport shortly before commencing a single-crew flight in a Cessna 310 to Spain. I was in London with another aircraft of the same company. The missing pilot had reported for duty, signed the papers and had left the crew centre at Schiphol Centre to pick up the aircraft which had been parked at the executive centre at Schiphol East.
He never arrived and the police searched everywhere, including in the many ditches along the service road. He was not found. We called out a standby pilot to take over and the flight to Spain departed with a delay of, if I remember correctly, more than 3 hours.
To cut a short story long (!!), the missing pilot’s aunt called in during the afternoon. He had gone to her house. He was fine now, had been unwell.
The pilot himself refused to answer any questions, except saying that he had seen a doctor who had given him a clean bill of health.
Repeated requests to give more information were met with refusal, citing his right to “doctor-patient confidentiality”. The doctor had told him that he was in good health, we had to be satisfied with that.
The problem was that, as it turned out later, he had felt unwell on his drive to the aircraft parking and had parked his car in a staff car park where he became unconscious for several hours. When he woke up, he drove to his aunt.
This put us in a quandary. ONLY an approved aviation medical centre can clear a pilot for flying duty. No other doctor can, not even a specialist.
Since his aviation medical was due only a few weeks later, and against the wishes of the operations manager who wanted to go for dismissal, I grounded him on full pay under condition that he told the aviation doctors what had happened.
He agreed but before this medical examination took place I caught him working as a free-lance flight instructor. This was a gross breach of our company regulations and he left me with no option but to inform the medical centre myself.
It ended his flying career.
This story just goes to illustrate how difficult it is to act if a pilot is unfit to fly but unwilling to cooperate.
Lufthansa had absolutely no way of finding out.
In my case, if this pilot had become unwell an hour later he would have been in the air on an air taxi flight with 5 passengers when it happened.
It would have led to an unexplained accident. There are no FDR nor CVR in a Cessna 310.
So not Lufthansa is guilty but the lawmakers !
Lufthansa (German Wings) did not know about their pilot’s medical problem nor did they have any way of finding out unless he divulged voluntarily.
Which, as we know, he didn’t.
Lufthansa would find themselves in court if they tried to enforce what you suggest, Simon.
Which does not mean that I do not agree with you on that point, but if a psychological examination were to be made part of the regular aviation medical it would perhaps not close but at least reduce in size the current legal loophole. Otherwise it may take years for the law makers to work out a change in the law which could have far-reaching consequences.
I’m not sure I understand your response to
“Shouldn’t we have video in the cockpit too?”
Digital data is digital data (I assume any new system would be digital and not analog.), whether the information protected is aircraft telemetry, cockpit audio or cockpit video. Protecting the data would be an identical. The stored data would not necessarily need to be located anywhere near where the video recorder is located. It could be dispersed through the aircraft like the CVR and FDR currently are, to maximize the chances of at least one recorder surviving.
Yes. analog generated information does take more storage when recorded as digital. Sound perhaps ten times more than telemetry; and video perhaps a hundred times more than sound or a thousand times more than telemetry.
I have also wondered at the length of recording time selected by FAA and NTSB in “cooperation” with the airlines and the ALPA. Thirty minutes. While this may have made sense when the first modern reusable tape units were developed in the early 1960s. This is a ludicrous limitation today.
Digital storage has been undergoing an exponential expansion of capacity for the entire history of flight recorders. Generally, capacity has expanded by three orders of magnitude (x1000) every ten to fifteen years.
Taking 1970 as a starting point, seven years after the patenting of the first modern magnetic flight recorder. That means our current capability is somewhere between 2 billion and 64 trillion times as great today, depending on the exact technology used.
The idea that the time was recently extended from thirty minutes to only two hours on some classes of flights is simply mystifying. Using the worst case combination of all of the most pessimistic numbers I just mentioned, a flight should be able to record approximately 114 years of telemetry, audio and video for the same cost as recording 30 minutes of telemetry in 1970.
No majors or regional flight should ever depart without the entire flight being recorded.