Flight Deck Security and Bomb Threats

Flight deck security is the protection of the pilots, and through them the aircraft's controls, against anyone who tries to take them over. Its centre is the reinforced flight deck door, with the rules and procedures for keeping it locked and for opening it safely. Bomb threat procedures deal with the other classic act of unlawful interference: a warning that an explosive device is on board, or the discovery of a suspect object.

Both are part of the layered security system set up under ICAO Annex 17 and national security programmes, which begins with screening on the ground (see aviation security). The flight deck door and the bomb procedures are the last layers, used when the earlier ones have failed or when a threat has to be treated as real until proved otherwise.

The reinforced flight deck door

After the hijackings of September 2001, flight deck doors on larger passenger aeroplanes were redesigned from light partitions into barriers. Under the EU rule, ORO.SEC.100, a passenger aeroplane in commercial air transport with a maximum certified take-off mass above 54,500 kg, or above 45,500 kg with more than 19 passenger seats, or with more than 60 passenger seats, must have an approved flight crew compartment door that:

• resists penetration by small-arms fire and grenade shrapnel, and forcible intrusion;
• can be locked and unlocked from either pilot station;
• comes with a means of monitoring the area outside the door from either pilot station.

The older EU-OPS rule applied above 45,500 kg or 60 passenger seats. In the United States the equivalent hardened door is required by 14 CFR 121.313(j).

Flight deck door security also depends on how the door is used. ICAO Annex 6 requires it to be closed and locked from the time all external doors are closed after embarkation until one is opened for disembarkation, except to let authorised persons pass. Under the EU rules the door is closed before engine start and, except for authorised access, stays closed, locked as the security procedures or the commander require, until engine shutdown. The FAA's 14 CFR 121.587 requires it closed and locked at all times while the aircraft is being operated, including taxi, take-off and the landing roll. Who may enter is also controlled: 14 CFR 121.547 lists the people who may be admitted, and under both EASA and FAA rules the commander has the final say.

The doors are also designed not to trap the crew. On the A320 and the 737 the electric lock needs power to stay locked, so after a complete loss of electrical power the door unlocks, although it stays closed. On the A320 the door can be forced open only from the flight deck side. On the 737, pressure sensors unlock decompression panels in the door if the cabin loses pressure, and release pins let the pilots separate a panel from a jammed door to get out. The 737's access system must be checked once each flight day, and its LOCK FAIL light checked out before start.

Door access and the emergency code

In normal operation a cabin crew member who needs to enter calls the flight deck or enters the normal access code on the keypad, is identified on the camera or viewer, and a pilot unlocks the door. On one A320 standard the pilot must hold a DOOR UNLOCK pushbutton while the cabin crew member pushes the door open; releasing it relocks the door. The rest of the time the pilots keep the door locked and decide, case by case, whether to open it.

If the flight crew do not answer, for example because both are incapacitated, the cabin crew use the cockpit door emergency access code. On the 737 a code of 3 to 8 digits followed by ENT is entered on a keypad beside the door and sounds a chime on the flight deck; lights on the keypad show red with the door locked, amber once the correct code has been entered and green when the door unlocks. The flight deck lock selector has three positions: AUTO, the normal position; UNLKD, which unlocks the door; and DENY, which rejects the request and blocks further code entries for a period. On the A320 described in the BEA's Germanwings report, a three-position toggle switch on the pedestal controls the door. UNLOCK opens it; with no action it stays locked; LOCK keeps it locked and disables the cabin keypad for 5 minutes. The emergency code sounds a continuous buzzer on the flight deck for 15 seconds, after which the door unlocks for 5 seconds unless someone on the flight deck selects LOCK or UNLOCK first. On the Embraer E190-E2 the pilots have 30 seconds to press INHIBIT after an emergency entry request from the cabin, which then blocks emergency entry for 500 seconds.

The design balances two risks: an intruder forcing the door, and a crew member locked out while the pilot inside is incapacitated or hostile. On 24 March 2015 the co-pilot of Germanwings flight 9525, an Airbus A320, locked the captain out of the flight deck and deliberately flew the aircraft into the French Alps; all 150 people on board died. The emergency access function cannot override a pilot on the flight deck who keeps the door locked, and the BEA found that the door, built to resist forcible intrusion, made it impossible to enter the flight deck before the impact. Three days later, in Safety Information Bulletin 2015-04, EASA recommended that operators require at least two authorised persons on the flight deck at all times, or equivalent measures. In 2016 it revised that recommendation to a risk-based approach: each operator assesses the risk and decides whether to keep the two-person procedure as one of its mitigating measures.

Secondary barriers

The door is weakest when it is open. Whenever it must be opened in flight, for a pilot to visit the toilet or for meals, the crew follow an approved procedure: a visual check of the area outside, and a secondary barrier or a cabin crew member guarding the approach to the door while it is open. A secondary barrier is a physical obstacle between the cabin and the flight deck door. It is not meant to stop a determined attacker indefinitely; its job is to slow anyone trying to reach the open door until it can be closed and locked again. Afterwards the door is unlocked for the returning crew member only once he or she has been identified, on the camera or viewer.

Bomb threat assessment

A bomb threat is a warning, usually by telephone or message to the airline, the airport or the authorities, that a device is on an aircraft. Even a hoax is serious: communicating false information that endangers an aircraft is itself an act of unlawful interference under Annex 17, and every threat is taken seriously until it has been assessed. The warning usually reaches the operator and the authorities on the ground first, and how credible it is, for example whether it identifies a particular flight, aircraft, time or place, shapes the response.

The crew act on the information through the operator's procedures and keep ATC informed. An aircraft known or believed to be the subject of unlawful interference is parked on the ground at the aerodrome's isolated aircraft parking position, which ICAO requires to be at least 100 m from other parking positions, buildings and public areas, and not over underground utilities such as gas, fuel, electrical or communications lines.

Bomb on board procedures

If a device may be on board in flight, the crew search the aircraft using the operator's bomb search checklist, which operators must carry, supported by guidance on the appropriate course of action if a bomb or suspicious object is found and by the least-risk bomb location for the type. The guidance, not improvisation, decides what may be done with a suspect object.

The flight crew declare an emergency and set the transponder according to the operator's procedure: under ICAO procedures 7500 signals unlawful interference, unless the situation makes 7700 more appropriate, and one E-Jet operator's bomb threat procedure, for example, uses 7700 with a bomb threat checklist kept in the forms folder (see transponder codes). If ATC asks the crew to confirm a 7500 squawk and a reply is not possible, silence is taken as confirmation. ATC gives the aircraft priority and does not mention unlawful interference on the frequency unless the aircraft has done so first and doing so will not aggravate the situation. After an act of unlawful interference the commander, or the operator, reports without delay to the designated local authority and to the authority of the State of the Operator.

The least-risk bomb location

The least-risk bomb location (LRBL) is the preferred place on each aircraft type to put a suspected or confirmed explosive device, the place where it would do the least harm if it went off. It is determined for each type, so it differs from one aircraft to the next. On the Embraer E190-E2, for example, one operator's procedures give the right aft door, and on the E190 E1 a left-side window in the last or second-last row.

Whether a suspect device may be moved at all, and how it is to be carried to the LRBL and prepared there, is set out in the guidance for the type. Because every type is different, the LRBL for each aircraft is part of the guidance that must accompany the operator's bomb search checklist.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.