The tragedy of Germanwings flight 4U9525 triggered a number of initiatives and interim measures within the aviation industry. These measures were not the result of a structured approach to flight safety and security which must have a thorough threat and risk assessment as its foundation. Considering the vast number of flights taking place safely every single day, this accident was clearly an extremely rare event.
"Two crew members at all time"
One such measure was the "two-persons-in-the-cockpit" recommendation issued in the EASA Safety Information Bulletin SIB 2015-04, also known as the “four-eye-rule” or the "minimum occupancy" concept. It suggests that, when there are only two pilots in the flight deck and one of them has to leave for physiological needs or any other operational reason, another member of the crew (generally from the cabin crew) should be present on the flight deck with the remaining pilot.
The lack of consultation with all the relevant aviation stakeholders resulted in very mixed responses from the National Aviation Authorities and the airlines. Some airlines started implementing this recommendation immediately but did not carry out the necessary threat and risk assessment, nor did they provide necessary specific training. Other airlines applied it to passenger flights only, whereas the Germanwings situation could very well have happened in another type of operation such as non-revenue flights and cargo flights operated on passenger aircraft. The remaining airlines chose not to follow the recommendation at all, being confident that their own threat and risk assessment showed that the recommendation had the potential to actually reduce the security of the operation. This demonstrates that there was and is no consensus on the course of action.
This "minimum occupancy" concept is not new. However, when it was introduced, it was for practical reasons only, and not to prevent a situation like the one that occurred on the Germanwings flight. For example, in many aircraft, where there are no CCTV/surveillance cameras or remotely-operated door locking system in the cockpit. When one of the pilots leaves the flight deck, the presence of a cabin crew member is required to check behind the door and operate the door lock ensuring that the remaining pilot always stays at the controls.
ECA believes that the "minimum occupancy" concept will not prove effective against the reoccurrence of the Germanwings situation, and does not support its continuation and/or implementation, for the following reasons:
§ Inferring that flight crews require monitoring when they are on their own in the flight deck risks reducing passenger confidence in the pilots, whose daily task and responsibility is to fly them safely to their destination.
§ The presence in the cockpit of a person with no operational knowledge will neither improve security nor safety. It might actually create new safety and operational concerns. For example, such persons would be unlikely to recognize, understand and let alone solve any operational issue such as a TCAS RA or an emergency descent
§ The increased number of people now needed to participate in accessing and leaving the flight deck has the potential to seriously compromise in-flight security as there will be early indications to the passengers of the door's opening, an increase in the number of times that the door will be operated, and/or in the amount of time it will stay open.
§The "minimum occupancy" concept extends the access to the cockpit to a category of staff, whose background security checks may – in some particular cases – be less rigorous than for pilots. This is particularly pertinent for those who may be employed on temporary contracts through employment agencies (in certain cases from non-European countries, e.g. in Asia), and for whom the ‘entry-barriers’ to the profession are significantly lower than for pilots (in terms of length of training and related costs). This has the potential to increase the security threat, rather than reducing it.
Finally, in many cases neither the cabin crew nor the pilots received any adequate guidance or training on the procedure to be followed, including where the cabin crew stands / sits in the cockpit and what they should do, thereby creating both uncertainty and a ‘hassle factor’ that can create distraction in the flight deck. On smaller aircraft there may not be a suitable location for them. This could also have consequences for the person concerned should the aircraft encounter significant turbulence.
Cockpit door security
Reinforced cockpit doors are designed to prevent people with bad intentions from gaining access. Their installation, following the 9/11 attacks, significantly lowered the number of attempts to breach into the flight deck, and to date none of these attempts has been successful. Any new design and/or procedure that would enable the flight deck door to be opened from the passenger cabin would greatly reduce the flight deck integrity. It would give a terrorist the option to force crew members to open the door.
ECA continues to support, for all commercial transport aircraft, the installation of a cockpit door designed to resist forcible intrusions by unauthorized persons, capable of being locked and unlocked from either pilot’s station, and equipped with a cockpit door surveillance system. Only such installation can provide an adequate level of security by allowing the flight crew members to assess who is being admitted to the flight deck and then operate the door whilst staying seated and in permanent control of the aircraft. ECA stresses, however, that the security of cockpit doors should not be considered a substitute for proper and adequate ground security.
The "minimum occupancy" concept is NOT an effective security tool. Quite to the contrary, such a measure has the potential of introducing a risk higher than the one it is trying to prevent , and for which effective mitigating measures are not readily available.
It must be stressed that EASA is in the process of exploring other adequate – and more effective – mitigating measures which relate to human factors aspects exposed by the Germanwings tragedy. Such measures include strengthening the medical fitness of aircrew, improvement of pre-employment checks, and introducing Peer Support Programmes for aircrew. Such programmes enable early identification of problem cases through the intervention of ‘peers’ and allow the crew to be guided towards help before their issues have the potential to compromise aviation safety. ECA considers Peer Support Programmes and related steps should be at the forefront of the Agency’s actions.
ECA remains committed to contribute to the discussions taking place within the industry, EASA and the EU Institutions to consider any future recommendations designed to improve aircraft security.
In particular, ECA will contribute to EASA’s evaluation of the “minimum occupancy” concept and its impacts on safety and security. In this respect, ECA recommends that EASA reconsiders its SIB’s prescriptive recommendation that specifically singles out “minimum occupancy” as a measure to be taken . Instead it should be replaced by a generic SIB, recommending that the management of flight deck security be determined by each individual operator, as part of their Safety Management System, in consultation with their flight crew representatives and in agreement with the relevant national authority.
The EASA SIB 2015-04 acknowledges that its recommendation can actually increase the risk: “Any additional risks stemming from the introduction of such procedures or measures should be assessed and mitigated.”
 “…“operators are recommended to implement procedures requiring at least two persons authorised in accordance with CAT.GEN.MPA.135 to be in the flight crew compartment at all times, or other equivalent mitigating measures” …”