Remote control: built-in or bolt-on?
by Jerry Russell
Advocates of the theory that remote control might have been used to guide the
9/11 aircraft to their targets, have been troubled by a debate over whether the
necessary remote controls were actually built-in to the aircraft, or whether
they were bolted-on as a retrofit for the specific tasks of 9/11. Both
theories have been viewed as having difficulties: building the system as
standard equipment would require too many people to know about the system
(causing security difficulties), while a retrofit of the system would also be
too complex and expensive with excessive risks of discovery.
A review of Boeing documentation shows that in fact, the 757/767 flight
computer has nearly all of the required capabilities as standard equipment,
including guidance, communications, GPS navigation, and traffic control
The 757-200 flight deck, designed for two-crewmember
operation, pioneered the use of digital electronics and advanced displays.
Those offer increased reliability and advanced features compared to older
A fully integrated flight management computer system
(FMCS) provides for automatic guidance and control of the 757-200 from
immediately after takeoff to final approach and landing. Linking together
digital processors controlling navigation, guidance and engine thrust, the
flight management system ensures that the aircraft flies the most efficient
route and flight profile for reduced fuel consumption, flight time and crew
The precision of global positioning satellite system
(GPS) navigation, automated air traffic control functions, and advanced
guidance and communications features are now available as part of the new
Future Air Navigation System (FANS) flight management computer.
Flight decks of the 757 and 767 are nearly identical
and both aircraft have a common type-rating. Pilots qualified to fly one of
the aircraft can fly any of the seven 757/767 family members with only minimal
Furthermore, additional functionality can easily be added by simply uploading
the required software.
Operational program software (OPS).
The operating system of an LRU, the OPS acts on data contained in the
operation program configuration (OPC) files to define the function of the LRU.
The OPS is typically the largest, most complex software associated with an LRU,
both in the amount of information it contains and the time required to load
the software. Obtaining certification for new versions of an OPS requires
commensurate time and effort.
Operational program configuration (OPC).
This software is a specialized database that determines the LRU
configuration and function by enabling or disabling optional features
contained in the OPS. Configuration information is also supplied to many LRUs
through hard-wired discretes (program pins). The large number of possible
combinations of software and program-pin configurations complicates
configuration management. Though an OPC will probably never completely replace
program pins, Boeing has placed as much configuration information as possible
in the OPC. The OPC is small compared to the OPS and typically requires less
than one minute to load.
A database is a collection of data arranged for easy access and retrieval
by the operating system of an LRU. Some of the databases used by software
loadable LRUs are:
Flight management computer (FMC) navigation database (NDB).
The NDB, which is quite familiar to operators, is
a database of navigation and route information used by the FMC to
carry out navigation tasks. NDB software is typically revised every 28 days
and becomes available approximately one week before it becomes effective.
Unlike other loadable software, the NDB is date controlled as opposed to part
Loadable software can be a useful tool for Boeing
operators by providing them with the ability to quickly change or update
functionality on their commercial airplanes. If
operators take the necessary steps to prepare for the maintenance of loadable
software systems, they can keep fewer hardware LRUs in stock, increase
hardware commonality, and reduce airplane modification time. The maintenance
activity to use loadable software includes procuring the necessary loadable
software parts and loadable LRUs, managing software libraries, preloading
loadable software parts into loadable LRUs off
the airplane, and verifying that loadable software part configurations conform
to airplane certification documentation.
Remote control technology readily available
Here we find the solution to the question of how a hijack recovery system
could be implemented using a central control facility, so that knowledge of the
capability would not need to be widely dispersed among ground control
personnel. The technology would be implemented using satellite
communications links, as noted by the Chicago Tribune:
But companies that have designed such systems for
the military say it wouldn't be difficult to adapt the technology for
General Atomics Aeronautical Systems Inc. developed a remote-controlled
reconnaissance plane for the Air Force called Predator, which flew in Bosnia
during the conflict there. Used by the military since 1994, it can be landed
by pilots linked by satellite using controls on the ground or ordering an
onboard computer to do the job.
Tom Cassidy, president and CEO of the San Diego company, said he sent
Transportation Secretary Norman Mineta a letter shortly after the Sept. 11
"Such a system would not prevent a hijacker from causing mayhem on the
aircraft or exploding a device and destroying the aircraft in flight,"
the letter said, "but it would prevent him from flying the aircraft into
a building or populated areas."
Cassidy said Thursday that a pilot aboard a commercial airliner could turn the
plane's guidance over to ground controllers at the press of a button,
preventing a hijacker--or anyone else aboard--from flying the plane.
That system also would keep people on the ground from taking control of a
plane away from the pilot, Cassidy said, because the pilot would first have to
give up control.
Aircraft anywhere in the nation could be remotely controlled from just one or
two locations using satellite links, Cassidy said. Those locations could be
heavily fortified against terrorists.
"The technology is available," Cassidy said. "We use it every
We can only conclude that the hijack recovery capability could easily have
been implemented as a secret project well prior to September 11; but also that
if it had not been built as a standard capability, it could also have been
uploaded as a simple software upgrade for specific mission requirements.
I recently received some mail from a reader that pointed out another possible
problem for the remote control theory. The 777 was Boeing's first true
fly-by-wire design. The 757 and 767 apparently used a mechanical linkage with
hydraulic power assist. Although the 757 and 767 are equipped with fully
automatic flight controls, the pilot can always over-ride the automatic systems.
Normally this is done by simply disabling the automatic systems, but in any
event the mechanical linkage would always allow the pilot to wrestle control by
applying sufficient force to the yoke. It would be like driving a car with a
power steering pump failure.
Also a discussion here, much of which I don't agree with, but possibly some
good info about how the standard control system is designed
Vialls imagines a system where the airplane flies itself regardless of pilot
input. But implementation of such a system in the 757/767 would require a
complete overhaul of the aircraft control systems, to create a means to disable
the mechanical linkage.
It would probably be possible to add a remote control to the 757/767 with
software changes only, but such a system would only be effective if the crew
(and presumably the hijackers) were somehow disabled or detained or otherwise
prevented from wrestling with the yoke to override the computer controls.
This isn't necessarily a fatal objection to remote control theory, but we
would need to explain how both the original crew and the hijackers (if any) were
prevented from attempting to override the system.
For more on Vialls and the remote control theory, also see my earlier article
"New questions on remote control and 9/11".
Another reader points out that extra hydraulic power could probably be added
to the system fairly easily, possibly by just modifying valves or pumps.