Glitch forces fix to cockpit doors
For more than two years, U.S. airplane passengers have flown more securely because high-tech cockpit doors created a barrier to prevent...
Seattle Times aerospace reporter
For more than two years, U.S. airplane passengers have flown more securely because high-tech cockpit doors created a barrier to prevent a repeat of 9/11, when terrorists entered the cockpit and commandeered four planes.
But, the doors were not foolproof.
In December 2003, a Northwest Airlines maintenance mechanic inside an Airbus A330 jet on the ground in Minneapolis pushed the microphone button to talk into his handheld radio. Though he hadn't touched the cockpit door, he heard the sound of its lock operating.
Radio interference from his walkie-talkie had scrambled the electronics inside the door's locking mechanism.
The discovery sparked a secretive and expensive engineering effort that started with Airbus and eventually hit Boeing, and is only now nearing completion.
The security glitch affected all A330 and A340 jets — about 400 — that had installed an Airbus-designed fortified door.
In May 2004, Boeing learned from three airline customers that it, too, had the same problem, affecting some 1,700 jets. All Boeing wide-bodies with fortified cockpit doors designed by the jet maker were vulnerable.
Because of a radio-interference problem, pressing a button on a walkie-talkie could unlock the fortified cockpit door on Airbus and Boeing twin-aisle jetliners. Jets with doors designed by vendors other than the two original manufacturers didn't have the problem.
Boeing: All 747, 767 and 777 wide-bodies that had installed a Boeing-designed fortified door — about 1,700 jets worldwide — had to be fixed. The fixes were completed last month, 16 months after Boeing learned of the problem.
Airbus: All A330 and A340 jets with an Airbus-designed fortified door had to be fixed. More than 400 of those were flying worldwide when the problem emerged, only about 20 in the U.S. The fixes in North America were completed a year ago, but 20 months after Airbus learned of the problem, not quite all are fixed worldwide. Airbus declined to specify the number remaining.
Boeing and Airbus insist there was no immediate danger. The mechanic had to be standing in precise spots with a particular walkie-talkie tuned to a specific frequency and with a certain signal strength.
"It's an extraordinarily limited issue," said Airbus spokeswoman Mary Anne Greczyn.
Federal Aviation Administration spokeswoman Laura Brown said the agency was unable to replicate the problem on airplanes in flight.
Regardless, top experts at both airplane manufacturers have spent nearly two years working quietly with the FAA to redesign the door lock.
Boeing completed fixing the latches on all its affected jets last month.
The FAA this week is expected to issue an airworthiness directive, a formal, after-the-fact order to all U.S. registered airlines with Boeing jets that they must install a fix designed by Boeing.
All affected Airbus jets registered in the United States, about 20 airplanes, were fixed by September 2004.
"All the foreign carriers that fly [into the U.S.] are fixed, too," said Brown.
She said the FAA did not issue an airworthiness directive for Airbus because so few jets in the U.S. were affected.
Airbus' Greczyn said last week the fix is now "nearly completed" on all affected jets worldwide.
Four months after 9/11, the FAA mandated that cockpit doors on all jets flying in the U.S. be strengthened.
The design demands were extraordinarily tricky. The doors had to be strong enough to withstand bullets, yet engineered to burst open to avoid a catastrophic twisting of the airframe in the event of a sudden loss of cabin pressure.
The airlines had just 15 months to change the doors on about 7,000 U.S.-operated aircraft and some 2,000 foreign-owned.
Boeing and Airbus each developed designs using door-locking mechanisms from a California supplier.
In both cases, the cockpit door is secured by aluminum rods that slide into the lock or unlock positions when activated by an electronic signal. Rapid decompression would also unlock the door.
A technical expert familiar with the intricacies of radio frequency, or RF, agreed to discuss the interference issue on condition he not be identified. He works for the government and believes he could lose his job for speaking publicly about a sensitive security topic, even in general terms.
The expert said it is difficult to build any electronic product that's protected from radio interference in a wide range of frequency bands.
He said a door controller is typically activated via a numeric code, which produces an electronic signal to unlock the door. A strong-enough external signal of the right frequency flooding the circuit could fool the mechanism into thinking it was the "unlock the door" signal.
"The world is filled with RF signals, and lots of times signals mix. It's mathematically feasible to come up with a combination of frequencies that could mix just enough to be right on target," said the expert. "The world of RF is black magic."
The expert expressed concern that if "an educated electrical engineer with a terrorist mind twist" could get hold of a door-lock controller, it might be possible to reverse-engineer the mechanism and find the frequency that would unlock it.
"It wouldn't take long to break down an engineering formula," the expert said. "It could be done in 30 minutes."
But the chief engineer who led Boeing's effort to fix the problem on its jets said the interference happens only in very narrow circumstances, and that even an electronics expert would have great difficulty exploiting this vulnerability. Boeing asked that the engineer not be named to ensure his personal safety.
"I'd have to have equipment. I'd have to get it through security. I'd have to know the right channel," the chief engineer said.
"I'd need to know quite a lot about where parts are installed on the airplane. I'd need to do a lot of things I couldn't actually do" on a commercial flight.
When Boeing first learned of the issue last year, the FAA issued a secret security-sensitive airworthiness directive alerting airlines.
After initially coming up with a quick fix, Boeing decided to go for a longer-term, more-robust solution developed in cooperation with a top FAA specialist based in Seattle.
Team worked in secrecy
A team of about five engineers secretly worked on the problem for more than a year.
"We deliberately kept the wraps on it within Boeing," the chief engineer said. "If people didn't need to know, they didn't know."
Boeing did not provide an estimate of the costs.
"Cost didn't come into it," said the chief engineer. "My concern was making sure we got a good technical solution."
Originally, airlines paid $29,000 for each of the Airbus wide-body door kits and between $40,000 and $100,000 for the Boeing wide-body kits, depending on the plane's model and configuration.
The government provided a $97 million subsidy to defray costs, about $13,000 per door.
The FAA tested and certified both door designs; the tests failed to reveal the radio frequency interference issue.
"We did testing for every scenario you can imagine," the FAA's Brown said. "You don't know what you don't know."
Airbus supplied the majority of fortified doors in its own aircraft, and Boeing won 60 percent of the market to install the fortified doors in its jets.
After the glitch was discovered, the FAA examined the doors made by third-party vendors and found no similar interference problem.
Both Boeing and Airbus used the same supplier, Adams Rite Aerospace of Fullerton, Calif., for their in-house door control.
Supplier passed tests
Airbus' Greczyn and Boeing spokesman Jim Proulx both stressed the supplier had met certification requirements and passed the interference tests then in place.
Executives at Adams Rite did not return repeated calls or respond to e-mail requests for comment.
Following the scramble to fix the electronic locks, both plane makers are also providing a backup option.
Boeing already had provided a manual bolt lock as a backup. A pilot could use it in case of a perceived threat.
Airbus does not install a mechanical backup lock as standard.
But as a result of the locking incident, Greczyn said "a mechanical backup ... has been designed and certified and is available to customers to apply at their discretion."
Dominic Gates: 206-464-2963 or email@example.com