[DennisP]

How about this: every crew member has a wireless button. If two of them push the button, the AI irrevocably takes over and lands the plane at the nearest airport. Pilot locks self in cockpit and heads for the mountain? Push the button.

If the AI would crash the plane one time in a thousand, and the pilot would intentionally crash the plane one time in a million, then this system reduces risk to one in a billion.

It helps against terrorists too. They have to disable almost the entire crew at once, or they'll have a nice leisurely ride to a waiting SWAT team.

[fulafel]

Airline safety culture is highly developed in the course of a long time, and a lot of it is enabled by assuming benign actors. A lot of safety principles, assumptions and practices would go out the window when you start factoring in insider adversaries and preventing the secondary plots that would pop from your threat model after adding the first couple of controls.

[aaronem]

> they'll have a nice leisurely ride to a waiting SWAT team

...and no reason not to murder the entire passsenger load on the way there, save possibly to have hostages once the aircraft's on the ground. I really don't think you have thought this all the way through.

[DennisP]

I don't see how it gives them any extra incentive to murder. I'd say it gives them less, since there's nothing to gain.

It's also a better situation by far than letting them crash the plane into a building, and if the system is known to exist it's a deterrent against hijacking planes in the first place. And if there's a struggle on board, it's less likely that the struggle will cause a crash.

[aaronem]

> I don't see how it gives them any extra incentive to murder.

Schrecklichkeit, maybe?

[frik]

Yes, good idea. But the ground control should then supervise the AI of the aircraft and takes over control if needed. Otherwise a sensor defects could have consequences, like Lufthansa Flight 1829.

[DennisP]

If you allow external control, there's also risk of an external hack. It might work out if external control is only possible after the button is pushed; that would still allow for a hack coordinated with onboard attackers, but maybe that's giving terrorists too much credit.

But I'd be happy relying on the steep odds against hardware failure happening on the same flight as human attack, as long as we can keep those variables reasonably independent.