The crash of Germanwings Flight 9525 on Tuesday sent a stark message that aircraft manufacturer Airbus needs to address issues with the design and layout of its cockpits.
The crash, along with others recently involving Airbus aircraft, show that it’s too easy for junior officers to take control of the plane. The cockpit door latching system, a major focus in Tuesday’s crash, should be reexamined, as it allows junior officers to deny reentry into the cockpit to anyone, even the captain of the aircraft. In addition, the dual joystick fly-by-wire control system remains troublesome as it allows junior pilots to override the actions of more senior pilots without them knowing, creating confusion that could bring down a jet.
Lufthansa, which owns Germanwings, confirmed on Thursday that the crash of Flight 9525 was due to “deliberate” pilot error. Apparently, the junior pilot, Andreas Günter Lubitz, 27, was left alone in the cockpit while the senior pilot, Patrick Sonderheimer, left the cockpit, presumably to go to the bathroom. When Sonderheimer tried to get back into the cockpit, he was unable to gain entry. He is heard yelling for Lubitz to open the door on the flight’s cockpit voice recorder, which was analyzed by crash experts on Wednesday.
Sonderheimer tried to regain entry into the cockpit for 10 minutes while the plane was in a steady, yet sharp, descent downward.
Throughout the commotion, nothing was heard from inside the cockpit, except for Lubitz’s breathing, officials say. The last sounds on the recording were of the senior pilot trying to break the cockpit door down, followed by the screams of passengers right before the plane crashed on the side of a mountain in the French Alps, killing all 150 people on board.
Officials say that the junior pilot used the flight management system to start the descent of the plane, which, at the altitude the flight was at, could only be done voluntarily. This has led officials to believe that the co-pilot deliberately set in motion the events that caused the crash.
Asked whether this was suicide, Lufthansa CEO Carsten Spohr said at an afternoon press conference, “I am not a lawyer. I am the CEO of a big company. If one person takes 149 people with him to death, it is not suicide.”
To be fair, we are waiting for the results of the flight’s data recorder, which records the pilots instructions sent to any electronic systems on an aircraft. It is conceivable that something may have happened to Lubitz after he activated the flight management system, such as a brain aneurysm, leaving him unconscious and unable to open the cockpit door for the other pilot.
If you are wondering how a senior pilot could be locked out of the cockpit, you’re in good company. Following the events of September 11, airlines were mandated to beef up cockpit security. Keys would no longer be allowed to access the cockpit amid fear that a terrorist could somehow wrestle them away from a flight attendant. On the Germanwings flight, the cockpit door was controlled by an electronic keypad located outside the cockpit as well as a switch located inside the cockpit in the center console.
On the A320, the model used for Germanwings Flight 9525, the locking switch in the cockpit can be toggled up or down. If the switch is up, the door will unlock. If it is left in the neutral (center) position, the door will be locked, as is required by law while in flight. When it is toggled down, the door locks as it does in the neutral position but it also prevents the use of the numerical keypad on the outside of the door to gain entry for five minutes. We don’t know for sure if the door was put in the locked position by Lubitz once the senior pilot left the cockpit, nor do we know if the senior pilot tried to gain entry into the cockpit using the digital keypad (officials say he just banged on the door).
But whether this was deliberate or an accident, the failsafes and the door locking system failed. It either locked the senior pilot out or locked the junior pilot in. An official from Airbus tells Fortune that it designed the door so that it can only be unlocked from inside the cockpit because it was mandated to do so by the FAA following the events of September 11. But the lock switch is located in the cockpit and potential override procedures are not mandated by government authorities.
Airbus places the lock switch in the center console by default, which means that either pilot could accidentally toggle the switch if they collapsed for some reason. Airbus says that it offers airlines the choice of having the switch mounted either in the center console, as it is now by default, or mounted above the pilots on the ceiling of the aircraft. The ceiling position seems like a far more sensible place to put this switch to avoid accidentally toggling it.
The issue involving the placement of the lock switch isn’t unique to Airbus. Boeing, in its rival 737 aircraft, puts its door switch 10 centimeters away from the airplane’s rudder control button. The proximity of these items almost led to tragedy in 2011 when a junior pilot onboard an an All Nippon Airways flight accidentally toggled the rudder control button by mistake, thinking he was unlocking the door for the captain who had been on break. The sharp turn of the rudder caused the plane to violently roll on its axis and fly upside down—seriously. Luckily, no one died in this incident, but it could have easily ended very badly for everyone onboard.
While Boeing and Airbus share design concerns about the location of their locking buttons, Airbus alone uses a unique dual joystick flight controller that can be very dangerous in an emergency. The dual controllers are located on the sides of the aircraft—to the left of the captain, who normally occupies the left-hand seat, and to the right of the junior pilot, who normally occupies the right-hand seat.
These joysticks are problematic because they allow either pilot to move the aircraft’s pitch up and down or side to side without the other one knowing. That’s because the pilots’ bodies can obscure the movements being made by their hand on the joystick.
The placement of the joysticks became a major source of contention for Airbus in 2009, with the downing of Air France Flight 447, an Airbus 330 en route from Rio de Janeiro to Paris. In this incident, the captain had left the cockpit to take a rest, leaving the first officer and junior pilot in charge of the aircraft (this aircraft had three pilots given the flight time and aircraft type). When the plane reached its cruising altitude over the Atlantic Ocean, its pitot tubes, which measure air speed and such, froze, rendering them useless. As a result, the autopilot was automatically switched off.
Pilots are not used to maneuvering a jet at such high altitudes, so both panicked when they were given control of the plane, especially the junior pilot. Fear of crashing caused the junior pilot to instantly push up on the joystick, pulling the nose upward. This caused the plane to stall and fall straight down like a rock. The captain came rushing into the cabin and was working with the first officer to try and stabilize the plane, but neither could understand why they were rapidly losing altitude. Then the junior pilot said in panic, “But I’ve had the stick back the whole time!” At that moment the captain realized that the junior pilot had been causing the stall and told him to let go, but it was already too late and the plane crashed into the ocean.
The location of these joysticks are a major source of contention among pilots. Some, like Captain Chesley “Sully” Sullenberger, who famously landed an out-of-control Airbus on the Hudson River after it struck a flock of birds during takeoff, believes that such confusion wouldn’t have happened onboard a Boeing jet because the control wheels are larger and more obvious. The Boeing controls, called a yoke, look like two big steering wheels and sit directly in front of both pilots. If one pilot changes the pitch, the other would instantly know it, as the yoke in front of them would move.
Airbus officials tell Fortune that it would be wrong to conflate the issues that brought down Flight 447 with the apparently deliberate issues that brought down Flight 9525. But while the Airbus sidestick doesn’t seem to be an issue in the crash of Flight 9525, it is yet another example of how junior pilots with less experience can bring down a plane. Airbus said it believes younger pilots are just as capable as older pilots in handling an aircraft, given their extensive training by their employers.
Airbus can’t design a perfect cockpit, but it should design failsafes that prevent junior officers from taking control of aircraft at critical moments. For example, in addition to moving the lock button to the ceiling, the captain should also be able to enter a special code on the keypad outside the door, known only to him, which would allow him to immediately override the lock switch. Furthermore, junior pilots shouldn’t be allowed to control an aircraft without the captain or first officer knowing exactly what they are doing. This might involve relocating the side sticks to the center of the craft so that both pilots can easily see what the other is doing.
While it may turn out that Lubitz did indeed set the plane on a collision course with the French Alps, a great deal of information—namely, the flight data recorder—needs to be recovered and analyzed before making any conclusions. It is possible that the plane’s autopilot was knocked out in midflight, as what happened on Air France Flight 447, and Lubitz panicked and froze.
In any case, Lubitz should have never been allowed to lock himself into the cockpit, with no way for the captain to re-enter. New procedures requiring flight attendants to switch places with pilots who leave the cockpit are being implemented in airlines across Europe in the wake of this accident. That may help decrease the chances of such a scenario occurring again, but it’s far from a sure thing.
