Jay H. apathoid@earthlink.net    (numerous emails asking for a rebuttal)
Apathoid is apathetic and apparently agrees with Rick that Remote Control Take over is a plausible hypothesis.

"With modern technology, almost anything is possible; certainly "robo-jets" are possible." - Apathoid, airline mechanic
From article on Remote Takeover on 9/11: A Critical Analysis (PDF).

[Comments from Rick are in red brackets]  photos added for clarity
Click here for Jay's Original PDF document

[This is an informative analysis, showing the role of the Cabin Air Pressure Outflow Valve.  However, it did not sufficiently cover how the CAPOV could have been tampered with, to release the air from the fuselage, suffocating the pilots, crew, passengers, and duped hijackers.  The Flight Management System is discussed, acknowledging the possibility that it could have been modified for Remote Control.]

* Apathoid (Jay H.) does not deal with the hypothesis in the above video.
* He merely stated that the process is difficult. So what? That's their job. Boeing does many difficult things (including flying an F16 by Remote Control) and succeeded, as proven by their patent, which requires a working model.
* He proposes nerve gas which is unnecessary when the air is let out of the cabin.
* Much RCTO capability was already built into the Boeing jets. Nobody had to sneak in the planes to install it.
* The workers were making the plane hijack proof - a very worthy cause that installers would agree with.

I'm an Aviation Maintenance Technician/Avionics Technician for a major US airline. I've been in this industry for 11 years and working on airliners for 7 of those. I have extensive experience on both aircraft types used on 9/11, doing both routine maintenance (767 overhaul for two and a half years) as well as non-routine maintenance, ie troubleshooting and repair. I've worked on pretty much every system on the 757/767. My main areas of experience are the Electrical System, Autoflight System, Navigation System, Communications System, Indicating and Warning Systems. I also have a good bit of modification experience installing such systems as: Predictive Windshear, Enhanced Ground Proximity Warning, Inertial Reference System, Fuel Tank Transient Suppression (known as the TWA 800 mod), Passenger Entertainment, post-911 Secure Cockpit Door Modifications, as well as dozens of smaller modifications usually brought on by FAA Airworthiness Directives. Most of these modifications require a major wiring rework and installation of new wiring and equipment. I believe my avionics background, specifically my 767 experience, qualifies me to talk about what it takes to turn a 757/767 into a drone and the major difficulties of doing so.

2) No planes at all. This theory is not worth going over in detail because of the myriad of dilemmas that need reconciliation. The biggest one being the fact that hundreds of people saw American Flight 11 crash into the North Tower with their own two eyes. Tens of thousands, if not hundreds of thousands, saw United Flight 175 hit the South Tower with their own eyes. Enough said.

3) Remotely guiding Flights 11, 77, 93 and 175 into their respective targets. This solves all of the problems presented above and then some. But how would it be accomplished, theoretically? Is there an easy way ? Short answer. No, there is not an easy way to do this for two reasons:

-A very well trained flight crew.

-A very complex and very redundant web of systems that work together to control every aspect of flight.

Moreover, the pilots have complete control over these systems from the flight deck, and they are constantly monitored by the airplanes defenses such as the Master Caution/Warning System, Engine Indicating and Crew Alerting System (EICAS) as well as the Aircraft Condition Monitoring System (ACMS). I'm getting ahead of myself, though. I'll go into these systems later on, in depth, and show how they can not only detect a sabotage, but detect problems in real-time as they happen.

The remainder of this essay will concentrate on scenario 3.  I will outline an array of possibilities for remotely guiding the airplanes and go over the difficulties of each. These difficulties can be installation problems, functionality problems and most importantly - the crews ability to defeat an intrusive system by ultimately killing the power that feeds it through a variety of methods, and I will go over all of those.

First of all, I will be using lots of acronyms in this essay. Aviation loves its acronyms, I have a listing in my toolbox that has over 700 aviation maintenance acronyms! I've already mentioned a few, but I will make a list here for reference.

AC - Alternating Current

ACARS - Aircraft Communication Addressing and Reporting System

ACMP - Alternating Current Motor Pump

ACMS - Aircraft Condition Monitoring System

ADC- Air Data Computer

AFCS - Automatic Flight Control System

APU - Auxiliary Power Unit

ARINC - Aeronautical Radio Incorporated

BIT - Built In Test

BITE - Built In Test Equipment

CDU - Control Display Unit

CRT - Cathode Ray Tube

DC- Direct Current

EDP - Engine Driven Pump

EEC - Electronic Engine Control

EICAS - Engine Indicating and Crew Alerting System

ER - Extended Range

ETOPS - Extended Twin-Engine Operations -or- Engines Turning Or Passengers Swimming.

FADEC - Full Authority Digital Electronic Control

FBW - Fly By Wire

FCC - Flight Control Computer

FMC - Flight Management Computer

FMS - Flight Management System

GCU - Generator Control Unit

HMG - Hydraulic Motor Generator

IAS - Indicated Airspeed

IDG - Integrated Drive Generator

ILS - Instrument Landing System

IRS - Inertial Reference System

LCCA - Lateral Central Control Actuator

LNAV - Lateral Navigation

MEC - Main Equipment Center

MCDP - Maintenance Control Display Panel(Autopilot)

MU - Management Unit (ACARS)

PBE - Portable Breathing Equipment

PCA - Power Control Actuator

TMC - Thrust Management Computer

TRU - Transformer Rectifier Unit

VHF - Very High Frequency

VNAV - Vertical Navigation

The 757 and 767 are the first of the Boeing generation of "electronic jets". The 767 came out first in 1982, the 757 in 1983. These aircraft may look a bit different on the outside, but the flight decks and systems are nearly identical. For all intents and purposes, the systems I'll be describing below are the same for both aircraft with only minor differences. These airplanes have numerous built-in fail safes and are extremely redundant in their systems, thus would be difficult to commandeer remotely.

Electrical Power on the B757/767 is provided by several sources which can't be run in parallel. The sources are the Engine IDGs, APU Generator (usually ground only, but can be run in flight), External Power, and the aircrafts Main Battery. There is also a backup Hydraulic Motor Generator (HMG) available on the 767ER which can supply 28 Volts DC in the event of a failure of both IDGs, it runs off the Center Hydraulic System and is not available on the non-ER versions of the 767 or the 757.

The IDGs provide 3 phase 115 Volts AC 400 Hz power to the aircrafts Main AC busses during normal operation. These buses are monitored by their respective GCUs, which ensure that the equipment receiving power from the bus is protected from a variety of fault conditions such as overvoltage, undervoltage, etc. Normally the buses are connected by a Bus Tie Breaker, but the pilots can operate the busses in isolation if desired. In addition to operating the busses in isolation, the busses can be switched off from the flight deck manually. DC power is typically generated by TRUs which convert the 115VAC to 28VDC to power the essential instruments on the Standby DC Bus. In the event of a complete AC failure, the ships Main Battery can supply power the Standby DC Bus for approximately 30 minutes. The Hot Battery Bus is a part of the DC Standby Bus and is physically connected to the Battery. When AC power is lost the DC Standby Bus essentially becomes the Hot Battery Bus through the Standby Power Relay. Sounds confusing, eh? It is, but the system works flawlessly (usually).

The AFCS modes are as follows: Heading Select, Altitude Hold, Altitude Select, Vertical Speed, Flight Level Change (FLCH), LNAV, VNAV, APPR(ILS), Backcourse ILS, IAS/Mach and finally Autoland.

Heading Select - Steers aircraft to heading determined by the heading select knob.

Altitude Hold - Levels off at current barometric altitude.

Altitude Select - Used in conjunction with other modes (VNAV, FLCH, Vertical Speed). Aircraft levels off at altitude in the altitude window.

Vertical Speed - Aircraft climbs or descends at the rate selected, used with other vertical modes.

Flight Level Change - Uses IAS hold function to climb or descend at a set speed.

LNAV - Aircraft flies a lateral profile as defined by the FMS waypoints..

VNAV - Aircraft flies a vertical profile as defined by the FMS using altitude/airspeed constraints (ie 250/10000 - 250 kts at 10,000 ft at X waypoint). VNAV and LNAV share waypoints.

APPR (ILS) - Automated approach captures ground radio signals called the localizer and glideslope, which guide the airplane to the centerline and touchdown zone. Used in conjunction with Autoland.

IAS/Mach - TMC maintains thrust to capture and hold speed in the Speed window.

Autoland - Coupled with ILS, performs an automatic landing by auto-idling thrust, auto-flaring and auto-rollout.

If you ever notice an unusually soft landing, especially in bad weather - rest assured that the airplane has just landed itself. No applause necessary!

Enhances the AFCS capability and calculates the most economic climbs/cruises/descents. Waypoints can be existing waypoints in the aircrafts navigation database or user-defined. Each waypoint has an altitude and airspeed constraint which the aircraft will meet, if possible. The system consists of 2 FMCs and 2 CDUs. The FMCs operate either/or, the CDUs can be operated simultaneously, one for each pilot. There is a lot more capability to this system than I am describing, but the other functions are not really pertinent to this discussion.

The EICAS system is basically the airplanes immune system and nervous system. It's hard to characterize this system briefly because it’s so involved. Basically, it’s a multi-faceted system with 2 main sub-systems: the Engine Indicating portion - and that’s all I'll say about that because it’s completely irrelevant here. The other half is the Crew Alerting System, which could mean not only the flight crew, but the maintenance crew as well.

EICAS is a very important tool for technicians because of all the data it can provide as well as displaying hard faults in form of a text messages such as: ZONE TEMP BITE (a failure in the Pack Zone Controller or its peripherals), or my favorite CARGO DET AIR (a failure in the Cargo Smoke Detection blowers). Often times, the first indication of a problem on the airplane is an EICAS message that mysteriously pops up and won't go away.

EICAS information is displayed on 2 CRTs on the Center Instrument Panel. There are many sub menus and screens available to view specific data on any system.

Another system closely related to EICAS is ACMS. ACMS is constantly monitoring many inputs and actually will generate ACARS reports and beam them down to the ground in real time. ACMS receives inputs from every major system on the aircraft.

Not part of EICAS, but this is as good a time as any to talk about BIT/BITE. BITE refers to the part of a computer that is constantly monitoring itself for faults. It’s usually a built-in program that can detect faults from within the computer itself or peripherals. After a fault is detected, an EICAS message is typically displayed. Using the ZONE TEMP BITE message above, the problem could be anywhere in the Air Conditioning System. So we go down hatch to the Main Equipment Center(MEC) and run a BIT on the Zone Temp Controller. BIT refers to a test routine that can detect faults during the test, or display stored faults. A fault code or indication should lead us the culprit. Every major system on the 757/767 has BITE/BIT capability and interfaces with EICAS. Again, it’s getting awfully tough to do a sabotage job without the airplane detecting it.

ACARS is a datalink system that uses the No. 3 VHF Communication radio to uplink/downlink data. Typically, this data consists of nothing more than engine performance data, gate connection info, weather reports, etc. But the interesting thing about this system is the provision it has for compatibility with the FMS. An even more interesting thing about this system is the "language" it speaks, namely ARINC 429. The same language that both the AFCS and FMS speak. With a wiring, and possibly hardware modification, ACARS could conceivably take inputs from the ground to steer the aircraft using the FCCs (Flight Control Computer). I'll go into this more later on.

Very briefly. The IRS (Inertial Reference System) system acts as a GPS of sorts, computing the current aircraft position and heading with respect to either magnetic north or true north. It does a heck of a lot more than that, but again, the other functions aren't really pertinent so I am going to skip them for brevity. Altitude and airspeed is computed by the ADCs. The IRS and ADCs are tied into pretty much every system on the airplane including, of course, the AFCS and FMS.

Lateral Control: There are two main cable systems, a primary and a backup. They are nearly identical with the difference being that the backup does not run its linkage through the Feel and Centering Mechanism.

As I mentioned before, there are 3 autopilot servos for the lateral axis. These are called LCCAs, they differ from the elevator and rudder servos in that they are also used when not taking autopilot inputs. There is so much "monkey-motion" going on in the roll system, that the LCCAs actually have to provide a hydraulic assist in normal operation because the amount of force needed to move all this linkage is quite great. This will be another issue that will come into play later as I go over a specific type of takeover system.

Pitch Control: Dual System, not nearly as complicated as the Lateral Control System. The Captains column controls the left elevator PCA, the First Officers column controls the right PCA. These two independent systems are normally bussed together, but there is an override system and either one can control the elevators fully in the event that one fails.

Components: There are a total of 29 hydraulic actuators assisting the above cable systems and associated linkage (droop mechanisms, feel and centering, lost motion and overrides). There are 8 aileron PCAs, 6 for the elevator, 12 for the spoilers (these devices are used in roll assist) and 3 for the rudder.

Very briefly. Supplies the juice to the aforementioned 29 actuators at a nominal pressure of 2800 psi. There are different configurations between the 757, 767 and 767ER. But the basic idea is 2 Engine Driven Pumps (EDPs), 2 ACMPs and an Air Driven Pump. On 767s, there are an additional 2 ACMPs to help the EDPs if the pressure falls too far. During normal operations, all pumps are operational and sharing the load, but since the EDPs are rated at 37 gpm to the ACMPs 7 gpm, it’s fair to say the bulk of the load falls to the EDPs, this is important later on.

Ok, now that you're armed with a basic understanding of the systems involved, you should have a pretty good idea of the difficulties a remote-takeover plot would encounter. As I alluded to earlier, the aircrafts defenses from mechanical failure also make great defenses from sabotage. Even the simplest of modifications would be made difficult and likely rejected by the aircrafts EICAS computers and onboard BITE [not unless they were modified too]. But, as we'll see, a bigger problem for our saboteurs becomes the ease at which these simple mods can be defeated by the pilots. As a result, these simple mods will get exponentially more complicated which makes them even more vulnerable to detection from EICAS, ACMS and human eyes.

Before I go further, lets lay down a few rules to keep this essay fairly brief. I will be assuming that the modifications can be accomplished in a relatively short timeframe, [Not necessarily. They could have had weeks. We need to see the jet repair logs.] short enough that UA or AA wouldn't know about them, which is already making a HUGE assumption because aircraft are hardly ever left unattended. Commercial airliners are not automobiles. They need daily maintenance due to their complexity and sheer number of parts that can (and do) fail. Much of this maintenance is done overnight between the last flight and first flight of the next day. MCOs, or Maintenance Carry Overs, are cleared if there is time. Any non-routine items are cleared from the ships logbook (and additionally the cabin discrepancy log). There is also typically one or more routine checks performed overnight. These checks can be in the form of transit checks, pre-departure checks, layover checks and ETOPS reliability checks. Aircraft already down for heavy maintenance are worked around the clock, 7 days a week. There may be a brief instance where an aircraft is left unattended, perhaps when maintenance is complete and the aircraft is waiting to be towed or taxied to the departure gate for its next flight - this is usually no more than a few hours, sometimes a lot less.

Another thing I won't go into is sleeper agents who might have assisted the ground operation. [Covert agents could have been planted.  We need to see original ground crew personnel logs.].   I can't see how anyone would sacrifice their lives for the operation. Technically speaking, that’s getting close to suicide hijacker territory anyway. If you can find one sleeper for each flight, surely you could find 4 for each. Now things would start to resemble the "official story". No need for robojets.

I will also not entertain any exotic theories such as pilotless flights. Any airline worker knows of the interactions between the pilots, gate agents, dispatch and cabin crew prior to boarding. Pilots also have to make those announcements and brief the flight attendants prior to pushback. I could go on, but the idea is so ridiculous it’s not worth going over in depth.

With all that out of the way, lets start looking at some scenarios. I will introduce a scenario, go over what the modification would entail, then I will outline the ways the pilots can defeat the system, which will lead to further modification, hence, another sub-scenario and so on and so forth until no viable takeover options are left.

This scenario involves modification of the ACARS system to be able to input to the autopilot FCC's as well as the FMS computers, which will give ground controllers the ability to fly the airplane by properly formatting ARINC 429 data words and uplinking them. The ground setup would be elaborate, possibly involving a full motion simulator to generate the ARINC data. The ground controllers could then uplink FMS waypoints and have the airplane fly an LNAV/VNAV flight plan all the way to their respective targets. The modification would also have to null the pilots corrective AFCS inputs or disconnect commands once the takeover started, this would be more difficult than it sounds. Another thing, the pilots moving the Stabilizer Trim will disconnect the AFCS, so that will have to be modified somehow. Stabilizer Trim cannot be disabled without Stab Trim Control Module/EICAS/FCCs/MCDP/Stab Trim Position Module or the pilots noticing. So, the only option here would be to remove the Stab Trim discrete to the FCCs, but the FCCs internal BITE would notice, and trigger an EICAS message. In addition to Stab Trim, merely applying force to the Control Column will disengage the Autopilot (another FCC discrete), so that will have to dealt with as well.

That said, this wouldn't be very effective anyways. Even uplinking precise lat/long/speed/alt waypoints to the FMC would be a problem because of the inaccuracy of the IRS system, which could in error by hundreds of meters as I mentioned above. The WTC Towers were 208' wide, a 767 has a wingspan of 156'. That’s not a lot of wiggle room, the lateral error can be only 10 meters maximum for this to work. The error in the IRS system would make the autopilot takeover scenario a terrible idea. A new position computing system would be required for this and other similar scenarios.   [A homing beacon planted in the WTCs and Pentagon would assist accurate targeting. Paul Bremmer's company, Marsh & McLennan was the only company hit in WTC 1.]

It is possible that GPS position data from the aircrafts Enhanced Ground Proximity Warning System (EGPWS) could be used, if installed. I'll make a couple of assumptions here. First, that UA/AA 757/767s were fitted with EGPWS in 2001. It's certainly not a given because, as of 2005, EGPWS mods were still being performed at my airline for the 767. The second assumption is that this GPS data is accurate to a few meters, and can be used in place of IRS without EICAS detecting loss of IRS information to various systems; this is quite an assumption actually. I'll explain; referring to the IRS Block Diagram below, we see that position information to the FCCs and FMCs are provided by 2 separate ARINC data busses.

What does this mean? It means that all the systems getting fed IRS data on these busses (TMC, Weather Radar, Yaw Damper, GPWC, RDMI ) will now be getting GPS data, which is quite different in format and content from the IRS data. This would be one of the biggest hurdles for our saboteurs. [Not with a homing beacon.]  To give you an idea of how difficult this might be to modify, I need only tell you of my experience installing IRS on aircraft not yet fitted with it. Just installing and reworking wiring harnesses totals about 400 man-hours, that’s with an overhaul aircraft already "torn down" with equipment racks removed. The total for an IRS upgrade is about 1,200 man-hours. Our saboteurs would have to keep the modification to a minimum, so only the FCCs, FMCs and CDUs need to be given GPS data. But there is a catch, the data between these devices and the devices still getting IRS information would be in disagreement as all these computers are constantly cross-talking. I have no idea how this could be resolved without using GPS on every system as I mentioned above.

If all of that can be resolved, we now have an airplane that can hit a target remotely within a few meters laterally, and altitude isn’t really a factor in the WTC attack flight plan. For the Pentagon, the altitude would be more tricky because the building is only 77 feet high, that gives us an error margin of +/- 38 ft. However, altitude data from the ADCs is very accurate, easily within 50 feet and possibly 20 ft or better, so the Pentagon is not a stretch either assuming the autopilot can fly the profile tightly at 500 mph.

The problem for our saboteurs is the ease at which this system can be disabled by the crew, in a variety of easy ways. [Not if they were asphyxiated and unconscious]  Keeping in mind that the flow of control would be: Ground->ACARS->FMC->FCCs->Autopilot Servos....Any one of these will work:

- Pull the FCC circuit breakers (3 places). This will give pilots control of the airplane by pulling power to the autopilot computers.

- Pull the FCC Servo Power circuit breakers(3 places) . This will remove power from the autopilot servos.

- Pull the ACARS MU circuit breaker(1 place).

- Pull the FMS circuit breakers(2 places). This will stop the ARINC data from entering the FCCs.

- Isolate the Left and Right Main AC Busses, and switch the Generator Control Switches "off" one at a time, until control is regained. (ACARS is powered by the L AC bus) Autopilot can still be used.

- More drastically, the crew could opt to drop both AC busses offline and fly on Standby Power. This would kill ACARS but not the FCCs or FMS. Same effect as above.

It could be argued that all these breakers can be interlocked by simply cutting the wiring going from the breaker to the FCC's/FMCs/Servos and supplying new wiring, possibly from a nearby terminal strip or circuit breaker on the same bus. But I'm not really sure that would make a difference, considering the last 2 options above, and I don’t know how the new feeding breakers would take the extra load. They'd probably open (pop).

- Start pulling every circuit breaker in the flight deck, until control is regained. Or...

- Switch both Generator Control Switches "off", Switch the Standby Power Selector to "off", Switch the Battery "off"

The latter halts every moving electron in the aircrafts wiring. There will be side-effects to such drastic measures. Specifically, no control over pressurization or air conditioning; this might be a bad thing at altitude, but not catastrophic. Limited engine control, but nothing too major. No operative fuel pumps, not disastrous because thirsty engines can be suction/gravity fed. Most of the hydraulics will still be working, the EDPs pull most of the load anyways. Since the airplane is cable driven, there will be no control problems. So we have: 2 working engines, 2 working hydro systems, and functioning flight controls - that's enough to limp home with.

The problems I mentioned above won't be devastating if the crew descends quick after killing power. Hypoxia would not be an issue, at all, because whatever position the Cabin Outflow Valve (pressurization control valve) was in prior to loss of power, would be where it stays when power is removed. So cabin pressure wouldn't change until a descent started. At that point, this is where the Negative/Positive Pressure Relief Valves come in. These devices will dump excess negative/positive pressure before dangerous pressure levels are reached. These valves have no electrical connections, they are fed by pressure sensing lines and operate mechanically.

The engines on 757/767s are FADEC, which means they are essentially fly-by-wire engines. No mechanical linkage goes from the flight deck to the engines for control, it is all electronic. So how are we going to control the engines with no power....? Well, the engines EEC's still have power because they have their own power supplies, which can't be turned off (as long as the engines are turning). It’s almost like these airplanes were designed to be robo-proof !

This 737 limped home with no power, not even a battery. As far as I know, this is a one-of-a-kind incident, and the odds of losing all electrical power is worse than losing both/all engines, which has happened a few times.

This about wraps any case for using existing internal guidance to takeover the aircraft. It's too easily defeated and the sabotage would probably be detected by BIT/BITE/EICAS or the mechanics themselves long before the takeover could take place. Overall, a bad idea unless it’s augmented by taking the pilots of the equation.

I was almost not going to talk about this because, frankly, it would take way too long to install [Agreed] (going outside the original premise of this essay) and would easily be detected by maintenance as well as the aircrafts defenses. But, since this is what everyone envisions when they hear or read the words "drone" or "remote control" - I think I need to briefly outline the major problems with this scenario.

The first thing that comes to mind is power. Is this system going to use the existing electrical system, or supply its own power? How involved would it have to be? What sort of guidance would be used? How will it physically take control of the airplane; will it use its own AC (or more likely DC) servomotors or will it use existing autopilot servos? Where will this new equipment/wiring be installed to avoid easy detection?

I should just move on to the next scenario because this one is already deteriorating fast. We aren't talking about a NASA/USAF test bed here. We're talking about 4 civilian airliners in scheduled service, that get regular maintenance checks and servicing as well as non-routine maintenance. But imagining for a moment that visibility isn’t an issue, lets take a look at the most likely scenario and see what it would take to even install this system, and how it quickly becomes very a involved chore requiring a complete teardown and redesign of the flight control system.

Power: As described above, power can be removed easily from any/all systems on the airplane. This leaves us with 2 options for power in this system.

1) Connection to the Hot Battery Bus.

2) "Foreign" Power Supply which cant be turned off from the flight deck.

Option 1 may seem attractive to our saboteurs, at first glance, for several reasons. Despite the pilots ability to simply switch the Battery "off", the Hot Battery Bus remains powered as long as the Battery has a charge; ergo, anything powered by this bus cannot be shut off. Also, use of the aircrafts battery would preclude the need for a "foreign" power supply that would certainly be detected. But there are major problems with this approach. On 767s, there is access door to the Main Equipment Center (MEC) just behind the cockpit. All a pilot would have to do is pull up the carpet, remove the door, descend down the stairs and the battery would be looking right at him. It's the easiest thing in the world to disconnect, just a single turn of the wrist will do it, no tools necessary. The bigger problem here is the batteries short life expectancy. It’s supposed to wield 30 minutes of emergency power if the aircrafts AC fails. However, that estimate is under normal circumstances, operating in Standby mode supplying units with relatively low amperage requirements. Autopilot servos (or worse, foreign servos connected to the flight control linkage) would demand a lot of amperage from the battery and quickly kill it. Why? Earlier, in describing the Flight Control System, I pointed out the fact that the amount of force needed to move the cables in the Lateral Control System is so great that the LCCAs have to assist the pilots control inputs during normal operation. The foreign roll servos would "smoke" the battery before the aircraft could even plot a course towards its target. Clearly option 1 wont work.

Servos: As I mentioned, there are 2 options.

1) Use the existing autopilot servos (there are 9) and route power and control wiring to them from our foreign batteries.

2) Use "foreign" servos.

The first option would seem to be the way to go. However, it’s not clear just how much battery juice they'd need. The autopilot servos would drain power fast, but if the ground "pilots" kept the controlling to a minimum, they might be able to get away with it using enough batteries. The installation of wiring from the batteries (wherever they wound up) would be a nightmare. To get wiring all the way back to the elevator and rudder servos, every ceiling panel would have to be dropped and wiring would have to be run the length of the fuselage, through the Aft Pressure Dome on back to the jackscrew compartment, and to the servos. By using a relay, you could keep the servos from draining the batteries during normal operation prior to takeover. This may also help fool EICAS, as it wouldn’t be able to detect the batteries through the power wires while the relay contact was open. The major problem with this scenario is that it wouldn't work as a standalone system because the pilots could still interfere with the takeover system by commanding autopilot servo inputs from AFCS panel, or manually moving the control columns which will disengage the autopilot servos, giving control back to the pilots. This is a built-in safety feature on commercial airliners which prevents a renegade autopilot from causing a disaster. Our conspirators would have to sabotage all existing AFCS disengage mechanisms...without the FCC BITE/MCDP/EICAS or the pilots knowing about it. I guess it’s option 2 then.

Well, maybe not, because option 2 is probably impossible. 3 big problems. First, as with the batteries, you need to find a suitable place for these devices. Here's the catch, you have to use the existing flight control cable paths and that really narrows the locale down. Off the top of my head, I'd say 90% of the cable runs are unusable due to proximity of other cables, devices, ceilings, floors, etc.. Then, as with the batteries, you're installing more foreign components for the mechanics to find. If all that's not bad enough, these devices can be overridden by the "stock" servos or manual control column inputs so our saboteurs would still have to be modify existing systems in addition to installing new systems. This is why I said earlier that a complete redesign would probably be the way to go. There is just no easy way to do this....

Control: This scenario is pretty much shot, so control and guidance wouldn't really matter! It would be the easiest part for sure. A transmitter, a receiver, optical guidance(video camera). Pretty straightforward and easier to hide, and easier to install than half a dozen 28 volt batteries or servos, for sure.

This is a variation of the first scenario I described, with the only difference being an attempted sabotage to disable the pilots before they could regain control. There are a couple of ways to do this:

- Sabotage the Pressurization System to incapacitate the passengers and crew.

- Release Nerve Gas or some other chemical agent that would disable the crew.

Sounds easy, but is it?

As far a tampering with the Pressurization System, good luck. I didn’t talk about this system above but I'll outline it briefly now. There are 2 Pressure Auto Controllers which can be selected either manually or automatically. The Cabin Outflow Valve receives open/close commands from the Auto Controllers and regulates pressurization by modulating a door. If a Controller fails (there are a multitude of fault conditions), EICAS will display the warning "CABIN ALT AUTO 1(2)", the system will then switch over the backup controller without any pilot input.  Should that controller fail, a "CABIN AUTO INOP" message will be displayed by EICAS. Even if cabin altitude rises without a fault being detected, an aneroid switch in the system will activate at 11,000' cabin altitude, and command the Cabin Outflow Valve closed, halting the loss of pressurization. Should this fail, there is a backup DC system which commands the Outflow Valve directly from a selector switch on the Pressurization Control Panel in the flight deck. There is also an Altitude Switch that activates a red "Cabin Altitude" warning light, a red "CABIN ALTITUDE" EICAS warning message, which is accompanied by a steady aural tone - this happens at 10,000' cabin altitude. There are also Outflow Valve position and Cabin Altitude indicators in the flight deck. As you can tell, the pressurization is a redundant system and would be extremely difficult to sabotage. However, even if successful in defeating this system, the pilots would merely don their Protective Breathing Equipment masks which supply oxygen.  NOT IF HIJACKERS PREVENTED THEM

To summarize, our saboteurs would have to:

- Modify both Auto Controllers to open the Cabin Outflow Valve through an input signal and defeat the internal fault detection circuitry. This mod would be done at circuit card level. This would be a very involved modification as the internal BITE would have to be disabled or heavily sabotaged in addition to the fault detection circuits. Even if that is possible, how would EICAS/ACMS react to this? Would EICAS have to be sabotaged too? Another problem here is time. The Auto Controllers are nice culprits for any pressurization EICAS messages, as such, they get removed/replaced quite often. Just removing one of these in the time interval from modification to takeover will negate the sabotage.

- Disable the aneroid switches without the controllers internal BITE detecting this. These switches override anything happening within the controller, and their single job on the airplane is to shut the Outflow Valve if 11,000' is reached.

-Disable the Manual DC system. Tampering with the selector switch might do, but the units self test might fault the Controller, displaying an EICAS message. Simply disabling the DC motor on the Outflow Valve wouldn't work either because the pressurization BIT would find the fault and EICAS would, once again, foil the plot. There really isn’t much more to the DC system outside the selector and the DC motor. The only option here would be a relay designed to open the circuit when energized. Add it to the list of things that need to be installed/modified.

- Disable the Cabin Altitude Switch, the Cabin Altitude Indicator/Cabin Rate Indicator and the Outflow Valve Position Indicator so the pilots will be unaware of rising cabin altitude. This is just as important as above, because the pilots will simply don their masks if cabin alt reaches 10,000'. However, I'm going to go out on a limb and say that these really cannot be tampered with because the sabotage would affect normal operation and the unit would simply be replaced after the first flight. In addition, EICAS and the Pressurization BITE would certainly detect the inoperable gauges, so the unit (Pressurization Indicator Panel) would never fly in the first place.

Even if the sabotage is somehow successful overriding all these fail-safes without EICAS or BITE knowing about it (I'd like to re-iterate, that I'm assuming this is possible - it likely isn't), the pilots can still don their masks as they feel the onset of hypoxia, they are trained to know the warning signs especially in the wake of the tragic Payne Stewart(RIP) case. There is also a Passenger Oxygen System that uses oxygen generators, this is tied to a 13,500' Aneroid Switch will drop the masks automatically, the pilots can manually drop them as well.

There are a couple of instances recently where a catastrophic failure of the pressurization system occurred, resulting in a loss of consciousness of the flight crew. The result of both failures tragically led to deaths of everyone onboard the 2 aircraft. The first case is Payne Stewart's Lear jet. Needless to say, a Lear jet is nowhere near as complex, automated, or redundant as a 767 in regard to the Pressurization System. The second instance was Heilos Flight 522, a 737-300. While the 737's Pressurization System may be more similar to a 767s than a Lear jets, it’s still nowhere near as redundant. There is only 1 Auto Controller which controls both the Auto and Standby modes. The Manual DC mode works the same way the 767's does. What the 737 doesn't have is: a backup Controller, auto switching, a comprehensive BITE/fault detection circuit within the Auto Controllers, EICAS, aneroid switches to close the Outflow valve should both Auto Controllers fail or a "smart" Pressurization Control Panel capable of BITE. This does not make the 737's Pressurization System unsafe, at all, it's still a very capable system. It’s just that 757/767's were designed for long-range, overwater operations (ETOPS) and need the extra redundancy for certification.

Overall, the pressurization sabotage is a terrible idea, if it’s even possible. Even if successful, there is no way to know how the flight crew would react in response. Maybe in addition to all the above, the saboteurs can remove the oxygen tanks and replace them with gas? Who knows, but the Crew Oxygen tanks are tested (actually breathed from) regularly as well.

This may be a more attractive idea, but how would it be accomplished? [Gassing is possible, but suffocation is simpler.]  How much gas would be needed? How would it released? Where on the aircraft would the gas canisters be stored? Does the aircraft have defenses for this too?

The only way it would be effective, was if it was released in the Air Conditioning System ducting. Otherwise, it would be local and wouldn’t likely be terribly effective, eventually getting vented overboard. The aircraft is constantly recycling air; venting 50% during any air "cycle". This means the gas would need to be released with a sufficient quantity and it would have to be potent. Again, as with the above scenario, the pilots have a defense - their oxygen masks as well as smoke goggles. These oxygen tanks would have to be removed and replaced with tanks containing an agent that will incapacitate a pilot. Also, due to frequent mask checks - these tanks would've needed to be replaced overnight, just before the attack. Why cant you just release all the oxygen? EICAS monitors the pressure through a pressure sensor on the tank.

So where exactly should these gas canisters be installed? My best bet is in the flight deck ducting. Since there are many ducts leading to different zones on the airplane, the air tends to be very local so gas released in the mid cabin would not likely find its way to the flight deck. To able to do this, the ducts would have to be opened up and the canister placed in such a way that it doesn’t move around, perhaps fastened with velcro. Why cant you just place the canister randomly in the cockpit? Easy, the pilots would see it.

Does the airplane have defenses against this? Of course it does! Smoke in the cockpit is a major concern in aviation, so there are systems in place to deal with it. The Equipment Cooling Override/Smoke Clearance Valve can suck the smoke out of the Flight Compartment, as well as the MEC, and vent it overboard. This would also have to be disabled: good luck in not having the Equipment Cooling BITE and EICAS detect the sabotage.

To sum up, this approach requires

- Replacing the pilots Oxygen with some other agent.

- Install remotely operated canisters to release gas in the flight deck.

- Disabling the Smoke Clearance System

Sounds easy enough, but I'll refer you to scenario 1 to get an overall picture of this approach - still many problems. Also, thinking this through, I just don’t see it happening. First, the gas would be released. Naturally the pilots would don their masks. However, they would surely be aware that they were breathing something other than oxygen, and would retreat from the flight deck. Is this enough? Well, no. There are PBE oxygen tanks, as well, that the pilots could use and retake the cockpit. There are between 10-15 of them depending on the aircraft, so our saboteurs would have to rig these as well. Merely removing them or releasing the contents wouldn’t do, as these are checked for availability and pressure frequently. Also, the gas canisters contents would eventually be vented overboard by the ventilation/re-circulation system, so the pilots would still have time to retake the flight deck(they'd have between 20-40 minutes) even if all the PBE was sabotaged.

Even if the pilots couldn't retake the cockpit right away, they COULD make their way down to the MEC and start removing boxes, once they removed the 3 FCCs - the airplane would be free from ground guidance. The pilots could then theoretically take turns at the controls holding their breath, while wearing their smoke goggles to protect their eyes from the gas. This may sound silly but it’s better than crashing.

Overall, I really don’t buy the "helpless crew" theory.

Looking into the "remote drone" theory in regard to 9/11, I happened upon an interesting claim. The claim is that a new remote control system is currently be tested by the Air Force and Raytheon and has made pilotless flight possible. Is this claim accurate? From Killtown's Smoking Guns:

Here is where the confusion arises:

http://www.prnewswire.com/cgi-bin/micro_stories.pl?ACCT=149999&TICK=RTN&STORY=/www/story/10-01-2001/0001582324&EDATE=Oct+1,+2001

The aircraft was not pilotless, it merely flew an automated approach and landing. Most people are quite ignorant of aviation and this is a example of how nonsensical claims arise and later mutate. This is not a super-secret system being used to turn commercial aircraft into drones, it's merely a replacement for the aging ILS system already in place. It’s called JPALS and it uses GPS for approach guidance instead of ILS, which uses radio signals. The FAA has already been developing similar systems to JPALS; WAAS(Wide Area Augmentation System) and now LAAS (Local Area Augmentation System) will be the way forward. WAAS will be a replacement for the VOR/NDBs systems which are used in enroute navigation. LAAS will used for approach guidance and will replace ILS.

If I was planning a conspiracy that would involve taking over airliners and crashing them into predetermined targets, I might choose a 777 or an Airbus A330/340. These are FBW aircraft, so you can't simply remove electrical power if you want control of the airplane. I might also use a DC-10 or a 747 Classic, no EICAS to worry about. To me, the 757/767 is simply the worst choice as a "robojet", unless you completely redesigned the plane.