The problems we are seeing with the reinforced cockpit doors are caused by design decisions made under the assumption that people forward of the door are good and people aft of the door are bad. While that is generally true, it is not always true. We have had at least three cases in the last four years where this assumption proved to be false: 4U9525, ET702, TM470. In all cases, the bad guys forward of the door were only able to do their deed because of the locking doors. It's about time we redesign the system under better assumptions.

Several of you upthread have suggested a number of ways to force a door unlock, such as fingerprints, iris scans, more codes to enter, etc., and argued that those methods should perhaps force the door to open. Keep in mind that these methods only identify people, not their intent. Imagine for a moment that the 4U captain had sensed trouble with his co-pilot, had persuaded the co-pilot to go to the back for a minute, and locked the co-pilot out. Great. But wait, with a way to force the door open, the "trusted" co-pilot would be able to get back in. Uh oh.

What we need is a system that separates good guys from bad guys based on their intent, not their identity. This is hard. How do we do that? We can perhaps make a reasonable assumption that, on any flight, if there are bad guys on an airplane they will always be a small minority. (And hey, if we are wrong and an airplane full of bad guys crashes as a result that may not be such a bad thing.) So how about a voting system whereby if the majority (or large percentage) of occupants vote to open the door, the door opens? It could go something like this. FA enters a code to initiate the vote. If during the next 60 seconds 40+ passengers press and hold their reading light buttons simultaneously, then the door opens. Easy for 40 good guys. Can it be abused? Well, it would take 40 bad guys to pull this off, and you never have 40 bad guys on a plane. On the 4U flight, the 4U captain could probably have explained the predicament and gotten 40 pax to go along with him and save this plane. It would also have worked on UA93, without a need to use the galley cart.

Now in reality getting a bunch of people to agree to do this is complex, and there may not be enough time. In the 4U case there was time (8 minutes or so), but in the SilkAir 185 or Egyptair 990 there wouldn't have been because the suicidal pilots were nose diving and that only takes a couple of minutes.

But you get my point, I hope. Design a mechanism based on trust and intent, not based on identity. And do not assume that the people in the cockpit are the good ones.