Notation 7712: The National Transportation Safety Board has reviewed the Notice of Proposed Rulemaking (NPRM), “Revisions to Cockpit Voice Recorder and Digital Flight Data Recorder Rules,” which was published in the Federal Register (Vol. 70, No. 38) on February 28, 2005. The notice proposes to increase the duration of the cockpit voice recorder (CVR) and flight data recorder (FDR) recordings, increase the sampling rate of certain FDR parameters, require physical separation of the FDR and CVR, require improved reliability of the CVR and FDR power source, and require the recording of data-link-communications. Recommendations discussed in the NPRM, but rejected or not addressed by the proposed rulemaking, are the use of forward- and aft-mounted combination voice and data recorders and additional flight control parameters for Boeing 737 airplanes. The NPRM does not address the Board’s image recorder recommendations. However, the NPRM does mention the security benefits of deployable recorders, a subject not addressed in any Safety Board recommendations. The summary of the NPRM states that it was prepared in response to a series of safety recommendations issued by the Safety Board following a number of accidents and incidents from 1995 to 2000. These safety recommendations asked the FAA to take the following actions:
Amend, by December 31, 1995, 14 Code of Federal Regulations (CFR) 121.343, 125.225, and 135.152 to require that Boeing 727 airplanes, Lockheed L-1011 airplanes, and all transport category airplanes operated under 14 CFR Parts 121, 125, or 135 whose type certificate applies to airplanes still in production, be equipped to record on an FDR system, as a minimum, the parameters listed in “Proposed Minimum FDR Parameter Requirements for Airplanes in Service” plus any other parameters required by current regulations applicable to each individual airplane. Specify that the airplanes be so equipped by January 1, 1998, or by the later date when they meet stage 3 noise requirements but, regardless of stage 3 compliance status, no later than December 31, 1999. (A-95-26)
Require all aircraft currently required to be installed with a CVR to be retrofitted within 2 years with a CVR installation designed such that an uninterrupted recording from the boom or mask microphones and headphones for each flight crewmember’s position and from an area microphone can be made on dedicated channels of the CVR. A sidetone shall be produced only when the transmitter or interphone is selected, and, in addition, all audio signals received by hand-held microphones shall be recorded on the respective crewmember’s channel when keyed to the “ON” position. (A-96-89)
Require that all newly manufactured CVRs intended for use on airplanes have a minimum recording duration of 2 hours. (A-96-171)
Require retrofit after January 1, 2005, of all CVRs on all airplanes required to carry both a CVR and a FDR with a CVR that (A) meets Technical Standard Order (TSO) C123a, (B) is capable of recording the last 2 hours of audio; and (C) is fitted with an independent power source that is located with the digital CVR and that automatically engages and provides 10 minutes of operation whenever aircraft power to the recorder ceases, either by normal shutdown or by a loss of power to the bus. (A-99-016)
Require all aircraft manufactured after January 1, 2003, that must carry both a CVR and a digital flight data recorder (DFDR) to be equipped with two combination CVR/DFDR recording systems. One system should be located as close to the cockpit as practicable and the other as far aft as practicable. Both recording systems should be capable of recording all mandatory data parameters covering the previous 25 hours of operation and all cockpit audio including controller-pilot data-link messages for the previous 2 hours of operation. The system located near the cockpit should be provided with an independent power source that is located with the combination recorder, and that automatically engages and provides 10 minutes of operation whenever normal aircraft power ceases, either by normal shutdown or by a loss of power to the bus. The aft system should be powered by the bus that provides the maximum reliability for operation without jeopardizing service to essential or emergency loads, whereas the system near the cockpit should be powered by the bus that provides the second highest reliability for operation without jeopardizing service to essential or emergency loads. (A 99 017)
Amend Title 14 CFR Parts 25.1457 (CVRs) and 25.1459 (FDRs) to require that CVRs, FDRs, and redundant combination flight recorders be powered from separate generator buses with the highest reliability. (A-99-018)
Although not specifically referenced, the NPRM contains rule changes that partially address the following flight recorder recommendations:
Require that all newly manufactured transport-category aircraft that are required to carry an FDR be fitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-048)
Require that all existing transport aircraft that are required to carry an FDR be retrofitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate expected. (A-03-049)
Require that within 2 years, all Airbus A300-600/A310 and Boeing 747-400 airplanes and any other aircraft that may be identified as recording filtered data be retrofitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-050)
The following flight recorder recommendations that call for rulemaking were not addressed in this NPRM:
Require that all Boeing 737 airplanes operated under 14 CFR Parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with an FDR system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-028)
Require that all Boeing 737 airplanes operated under 14 CFR Parts 121 or 125 that are not equipped with a flight data acquisition unit be equipped, at the earliest time practicable but no later than August 1, 2001, with an FDR system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-029)
Require that all aircraft operated under Title 14 CFR Part 121, 125, or 135 and currently required to be equipped with a CVR and DFDR be retrofitted by January 1, 2005, with a crash-protected cockpit image recording system. The cockpit image recorder system should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by the people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. The cockpit image recorder should be mounted in the aft portion of the aircraft for maximum survivability and should be equipped with an independent auxiliary power supply that automatically engages and provides 10 minutes of operation whenever aircraft power to the cockpit image recorder and associated cockpit camera system ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder system, as well as the circuit breakers for the CVR and the DFDR, should not be accessible to the flight crew during flight. (A-00-030)
Require that all aircraft manufactured after January 1, 2003, operated under Title 14 CFR Part 121, 125, or 135 and required to be equipped with a CVR and DFDR also be equipped with two crash-protected cockpit image recording systems. The cockpit image recorder systems should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. One recorder should be located as close to the cockpit as practicable and the other as far aft as practicable. These recorders should be equipped with independent auxiliary power supplies that automatically engage and provide 10 minutes of operation whenever aircraft power to the cockpit image recorders and associated cockpit camera systems ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker of the cockpit image recorder systems, as well as the circuit breakers for the CVRs and the DFDRs, should not be accessible to the flight crew during flight. (A-00-31)
The Safety Board recognizes that the FAA’s proposed revisions attempt to increase the capability and survivability of CVR and FDR systems while imposing minimum financial burdens on the industry. However, the Board is concerned that the failure to address many of the more significant recorder recommendations at this time will ultimately result in a larger economic obligation for industry and may delay implementation of the associated safety improvements. This is particularly true for the Airbus A380 and Boeing 787, which are in pre-production, making this an ideal opportunity to implement dual combined recorders as well as cockpit image recording.
The Safety Board applauds the FAA’s proposed action to require that all CVRs record a minimum of 2 hours of audio information. The Board has cited in its recommendations many accidents and incidents where the existing 30-minute CVR recorder duration was not sufficient. The Board also endorses the timeline set forth in the NPRM that requires all newly manufactured aircraft to be equipped with a 2-hour CVR within 2 years of the rule date. The Board also agrees that the 4-year phase-in that was proposed to retrofit the existing fleet is appropriate and will not cause undue hardships in the aviation community. All of the manufacturers of CVRs in the United States currently produce a 2-hour model that meets the crash and survivability specifications set forth in the FAA’s TSO-123a. In addition, several manufacturers offer a lower cost upgrade to an existing 30-minute CVR to increase the record duration to 2 hours.
Magnetic Tape Obsolescence
The proposed rulemaking action, although not as timely and extensive as recommended, addresses some significant and longstanding safety concerns. The proposed requirement for a 2 hour CVR recording will allow for a more thorough and accurate investigation of non-catastrophic occurrences as well as accidents that evolve over time periods greater than 30 minutes. This rule change will also significantly increase the crash fire survivability and reliability of the CVR because it will, in effect, eliminate magnetic tape CVRs that only meet TSO C-84 or C-51a standards, which were introduced in the 1960s. The Safety Board is encouraged by the FAA’s recognition of the need to eliminate magnetic tape as a CVR recording medium. The NPRM notes the “vulnerability to damage and decreased reliability” and the dwindling supply of magnetic tape. This same reasoning can be applied to TSO C-51a magnetic tape FDRs; unfortunately, the rule changes do not call for the elimination of magnetic tape FDRs. Magnetic-tape FDRs, which record in the digital format, have in fact been more problematic than magnetic-tape CVRs, which record in a more robust analog format. For both FDRs and CVRs, operators are finding it cost-effective to replace tape-based recorders with solid-state models. However, a relatively small number of operators continue to use magnetic tape FDRs, with decreasing reliability and inadequate crash and fire protection. Manufacturers estimate that they have a 2- to 3-year supply of spare parts for critical hardware such as drive motors and belts, recording heads, and the tape itself. The vendors for these items have either stopped production or gone out of business. In the very near term, operators using magnetic tape FDRs will be forced to replace unserviceable FDRs with solid-state-equivalent FDRs or continue to fly with marginally serviceable FDRs. One recorder manufacturer estimates that approximately 2,500 of their magnetic tape FDRs are in service and nearly all are installed on third-tier carriers operating older aircraft such as DC-8s, Boeing 727s, and 707s.
Therefore, the Safety Board proposes that the FAA add the following language to replace magnetic tape FDRs with recorders that meet TSO C-124a:
Part 121.343 (g): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version.
Part 121.344 (m): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version.
Part 125.225 (j): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version.
Part 129.20 (b): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version.
Part 135.152: (l) After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version.
Recording of Data-Link Communications
The Safety Board is pleased that the FAA has proposed rules for the recording of data-link communications. The Board believes that the in-flight recording of data-link communications presented to and transmitted by the flight crew will become as vital to future investigations as CVR information has proven to be. In addition to accident investigations, this information could play an important role in troubleshooting technical problems that may arise as data-link communications play an ever-increasing role in air traffic management. The NPRM preamble quite correctly points out the importance of capturing data-link communication at the proper locations within the communications system, and the rule clearly spells that out in the following text: “output from the communications unit that translates the signal into usable data.”
However, the rule language is somewhat ambiguous as to what must be recorded. Fortunately, the preamble clearly defines what must be recorded as follows: (1) the message priority assignment; (2) the number of messages in uplink/downlink queues; (3) the content of all messages generated by the flight crew; (4) the time each downlink message is generated (that is, when the flightcrew selects “send”); (5) the time any message is available for display to the flight crew; and (6) the time any message is actually displayed to the flight crew. The Safety Board believes that the rule language must contain these vital recording requirements in order to remove any ambiguity as to what must be recorded. Not including this level of detail in the rule language would create an opportunity to misinterpret the intent of the rule, which could result in an installation that would be of little use to investigators.
Further, the data-link portion of the preamble also states that “the FAA was unable to propose a practical, feasible method of capturing ‘what the pilot sees’ off the actual cockpit display” and that “there is no developed technology for reliable recording of information.” However, the Safety Board is of the opinion that an image recording of the cockpit display could provide specifics as to what data-link communications are displayed to and generated by the flight crew and when those messages are displayed or sent. An image recording would also indicate the quality of the display. Adding a properly placed cockpit video camera would allow data link messages displayed to the crew to be recorded on the image recorder. The use of video technology would not require any modifications to the existing aircraft’s communication or display systems. This addition might greatly reduce the time and expense of retrofitting older aircraft to record data-link messages.
The Safety Board is also concerned with proposed data-link rule language that states, “[Each cockpit voice recorder … will record the following:] If data-link communication equipment is installed, all data-link communications, using an approved data message set.” Currently the FAA has not approved any data-link message sets, nor has it issued any guidance as to how to determine if a given message set is approved. An advisory circular or other guidance material is clearly needed to define what messages to record. In addition, the proposed operational requirements call for the recording of data-link communications 2 years after data-link equipment is installed. The Safety Board sees no reason to delay the requirement for 2 years when the installed communications equipment should have the capability of outputting the required data-link messages to the voice recorder at the time of installation.
Therefore, the Safety Board suggests the following changes to the proposed rule language:
Change the appropriate paragraphs of Parts 23, 25, 27, and 29 as follows:
If data-link communications equipment is installed, all data-link communications must use an approved data message set that must be recorded so that the following can be determined: (1) the message priority assignment; (2) the number of messages in uplink/downlink queues; (3) the content of all messages generated by the flightcrew; (4) the time each downlink message is generated (that is, when the flightcrew selects “send”); (5) the time any message is available for display to the flight crew; and (6) the time any message is actually displayed to the flight crew. The timing of all message traffic must have a minimum resolution of 1 second.
Boeing 737 FDR Recommendations
The NPRM references safety recommendations A-95-25 through -27, A-99-28, and A 99 29, which called for additional flight control parameters for the Boeing 737. The NPRM also references the 1999 NPRM associated with these recommendations. However, because this NPRM does not propose any rule changes associated with these recommendations, and because no action appears to have been taken on the 1999 NPRM in the nearly 5 years since it was issued, the Safety Board is concerned that the FAA plans to take no further action on these recommendations.
Therefore, the Safety Board must reiterate its commitment to these recommendations and urge the FAA to take action on them.
Dual Combined FDR/CVR Recorders
In regard to dual combined FDR/CVR recorders, one mounted near the cockpit and the other as far aft as practicable, the Safety Board takes exception to the NPRM statement that, “After a careful analysis of the benefits of having two systems, the FAA is unable to justify the excessive cost that would be incurred in the installation of two complete systems.” Although recommendations A-99-017 and A-00-031 specify two combined (CVR/FDR) recording systems, the intent of these recommendations was to have two redundant recorders—not to require two flight data acquisition units and two sets of cockpit microphones. If the FAA’s analysis included “two complete systems,” as the NPRM states, the cost estimates would be unnecessarily inflated.
However, the Safety Board does not agree with the NPRM statement that “in the case of an accident so catastrophic that neither recorder survives [meaning the currently required, aft-mounted recorders], a second set of recorders located in the front of the aircraft would probably not survive either.” In fact, there are a number of instances in which the circumstances of a catastrophic accident could have resulted in a forward-mounted recorder surviving and the aft-mounted recorder being lost to fire or impact.
One example is the Air France Airbus A320, which crashed in Strasburg, France, in 1992. In this accident, the aft-mounted FDR was destroyed by fire while the unprotected quick-access recorder mounted below the cockpit survived. Another example is the crash of a Lauda Air Boeing 767 in Thailand in 1991; in this accident, the aft-mounted recorder was lost to fire while the unprotected, solid-state memory located on the engines survived. It should be noted that fire has proven to be more destructive to solid-state recorders than crash impact, and the only complete losses of solid-state flight recorder data have been due to fire. Solid-state recorders have proven to be quite resistant to impact damage, even surviving the very severe impact sustained during the September 11, 2001, crashes.
The NPRM also implies that a crash resulting in the loss of an aft-mounted recorder would most certainly result in the loss of a forward-mounted recorder. Accident history does not support this position, as illustrated in those accidents in which the aft-mounted recorders were lost. The explosion of Pan Am Flight 109, a Boeing 747 over Lockerbie, Scotland, separated the cockpit, which landed relatively intact far clear of the burning fuselage wreckage. In the United Airlines DC10 crash in Sioux City, Iowa, the cockpit separated but maintained enough structural integrity to allow the cockpit crew to survive; it is logical to conclude that forward-mounted recorders would also have survived the accident. In the 1996 Boeing 757 accident in Cali, Columbia, which involved a controlled collision with terrain, vital information was recovered from the unprotected solid-state memory in the Flight Management System unit located under the cockpit. In numerous accident scenarios, forward-mounted recorders could have survived, even though aft-mounted recorders might have been destroyed by post-crash fire (for example, during ground collisions, takeoff abort overruns, landing overruns, and approach and landing accidents).
The second reason for placing a combined CVR/FDR as close to the cockpit as practicable is to ensure an acceptable recording of the cockpit acoustic environment if the wiring to the aft-mounted CVR is compromised as the result of a progressive fire, explosive decompression, structural failure, or uncontained engine failure. Such occurrences may not result in the immediate loss of the aircraft. For Swiss Air Flight 111, which crashed in Halifax, Nova Scotia, in 1998, the flight continued for about 6 minutes after the CVR stopped. Had the MD-11 involved in flight 111 been fitted with a forward-mounted CVR and a recorder independent power supply as proposed in this NPRM for newly manufactured aircraft, it is possible that the acoustic environment of the cockpit could have been recorded for the final critical minutes of the flight. Value Jet flight 592, which crashed in Miami, Florida, in 1996, also experienced an in-flight fire, in this case causing the CVR and FDR to stop approximately 40 to 50 seconds prior to the crash. In both cases, a forward mounted combined CVR/FDR fitted with a recorder independent power supply (RIPS) would have provided the best opportunity to record the audio environment of the cockpit.
To summarize the Safety Board’s position on combined CVR/FDRs, longstanding accident investigation experience indicates that the enhanced crash/fire survivability of TSO C123a and C124a flight recorders and the use of combined CVRs/FDRs, one mounted near the cockpit and the other mounted as far aft as practicable, will greatly improve the likelihood of survivability and recording of critical flight recorder data following a catastrophic accident. All three recorder manufacturers agree with this position, as do airframe manufacturers, Boeing and Embraer. Embraer, in fact, is currently delivering its model EMB-170/190 to U.S. operators with forward- and aft-mounted combined CVR/FDRs, and Boeing is currently considering a similar design in its new 787 aircraft.
Therefore, the Safety Board proposes the following rule language:
For Parts 23, 25, 27 and 29, add the following to the end of (b): When two combined voice and data recorders that record the same data are installed, one recorder must be mounted as close to the cockpit as practicable so as to minimize the signal path between the cockpit microphones and the recorder. The forward-mounted recorder must be fitted with a recorder independent power supply that provides 10 minutes of uninterrupted power to the CVR system following the loss of recorder power for any reason.
For Parts 91, 121, 125, 129, 135, add the following language:
Newly manufactured aircraft after (insert date 2 years from the effective date of this final rule) that are required to carry both a CVR and an FDR must be fitted with two combined CVR/FDRs that meet the requirement of 23.1457 or 25.1457 of this chapter.
Recorder Independent Power Supply
The Safety Board is pleased that the FAA plans to require the installation of a 10-minute independent power source for the CVR that will engage when electrical power to the CVR is lost. However, the Board is disappointed that this requirement will apply only to newly manufactured aircraft. The Board believes that a 4-year retrofit similar to that being considered for the 30-minute-to-2-hour CVR conversion should also be applied to RIPS. The benefits gained from a CVR independent power supply vastly outweigh the additional costs. In fact, incorporating RIPS into the recorder chassis, as is being proposed by one recorder manufacturer, would significantly reduce installation and hardware costs, especially if the operator replaces an older, 30-minute tape CVR with a new 2-hour recorder. A different option is to mount RIPS under the existing CVR mounted tray, a means currently employed by another CVR manufacturer. This installation would be totally self-contained and would not require any modifications to the aircraft.
In addition, the rule language fails to require that the independent power supply be colocated with the CVR so as to minimize the opportunity for a mechanical disconnect between the recorder and the independent power supply. Therefore, the Safety Board proposes that Parts 23.1457, 25.1457, 27.1457 and 29.1457 be changed by adding the following text at the end of (d)(5)(ii): “As far as practicable, the independent power supply must be colocated with the CVR to eliminate the possibility of an electrical disconnect.”
The Safety Board also suggests that the operating rules be changed to require the installation of a CVR independent power supply 4 years after the date of the final rule.
Separate Power for CVR and FDR
The Safety Board notes that the proposed rule changes agree with the Board’s recommendation that the FDR and CVR be on separate generator busses with the highest reliable power so that any single electrical failure does not disable both the CVR and FDR. However, the Board also notes that the proposed rule language applies to newly manufactured aircraft only, even though the recommendation was aimed at existing aircraft as well. The Board believes that most existing aircraft meet this requirement and that any retrofit requirement will have minimal economic impact. Therefore, the Safety Board requests that this rule change apply to existing aircraft as well.
CVR and FDR Start-Stop Criterion
The Safety Board appreciates the efforts of the FAA to correct some ambiguities and deficiencies in the existing flight recorder rule language. These corrections include changing the CVR operating rules to require that the CVR operate from the start of the checklist, before the first engine is started, and requiring separate containers for the FDR and CVR. These changes are worthwhile and will help ensure the capture of information that otherwise would have been lost.
In addition, the Safety Board would like to use this opportunity to suggest removing some of the legacy requirements that are no longer relevant to modern, solid-state recorders, or those requirements that have proven ineffective or detrimental. Included among these changes are the “start-stop” criterion for the FDR and the automatic means of stopping the voice recorder 10 minutes after crash impact.
The current rule requires that the FDR be operated from the start of takeoff roll until it has completed the landing roll. This operational requirement was designed to maximize the supply of the expendable metallic recording medium used by the very first FDRs introduced in the late 1950s. Most airframe manufacturers and operators ignored this provision in the rules and, for the most part, operated the FDR shortly after engine start. However, at least one manufacturer connected the FDR power through the parking brake so that the FDR was turned off when the brake was set. The February 2, 2005, accident at Teterboro, New Jersey, involving Canada Air Challenger CL-600, has identified another problematic FDR start criterion. In this instance, the FDR electrical power was applied when the anticollision (strobe) light switch was placed in the “on” position. The failed logic was that the crew would always turn the anticollision lights on before taking the active runway. Unfortunately, in this case, that did not occur and critical FDR data covering the takeoff abort were not recorded. The Board believes that this method of powering the FDR should be prohibited.
In recent years, most aircraft manufacturers have connected the FDR power to engine oil pressure, which automatically triggers electrical power to the FDR when engine oil pressure is sensed on any engine. Automatically starting the FDR provides some assurance that the FDR will record a partial engine start for the first engine started, the complete engine start for the remaining engines, and the continued operation of the aircraft until no engine oil pressure is sensed and the aircraft is on the ground. Therefore, the Safety Board suggests that the respective operating rules be updated to require that the FDR be operated before engine start for the purpose of flight or provide an automatic means of starting the FDR when engine oil pressure is sensed on any engine, and that the FDR operate continuously until termination of the flight when all engines are shut down.
Although the regulations do not require an automatic means of powering the FDR at takeoff if it is not powered prior to the transition from ground to air, the Safety Board is unaware of any aircraft that is not so equipped. This safeguard has proven very beneficial in a number of accidents and incidents where the FDR was not powered prior to liftoff. Therefore, to ensure that this practice continues, the Board suggests that the airworthiness requirements in the regulations be changed to provide for the automatic application of electrical power to the FDR at liftoff to safeguard against the failure of any automatic or manual means of powering the FDR.
The Safety Board would also like to suggest that, because the proposed rule change replaces the 30-minute CVR with a 2-hour CVR, the requirement that the CVR have an automatic means of stopping the recording within 10 minutes after a crash impact is less important and may be removed. To accomplish this, some airframe manufacturers have installed an accelerator-sensing switch (“G” switch), which stops a CVR in the event of a crash. The Safety Board’s experience with use of the “G” switch to sense a crash and in turn stop the recorder has been negative. In at least two accidents, the “G” switch was prematurely tripped, and as a result, the CVR was not operating at the time of the accidents. In these accidents, activation of the “G” switch resulted in the loss of valuable information about the final seconds of the accident or the circumstances surrounding the post-accident evacuation.
Other international safety investigation agencies share the Safety Board’s reservations concerning the “G” switch. This sentiment was expressed in the March 2003 European Organisation of Civil Aviation Electronics (EUROCAE) ED 112 document, “Minimum Operational Performance Specification for Crash Protected Airborne Recorders Systems,” which updated the minimum manufacturing specifications for accident flight data and voice recorders; it stated that
If required by operational rules, acceptable means of stopping the recorder after an accident include:
i. detection of loss of oil pressure on all engines together with loss of airspeed.
ii. airframe crash sensors,
iii. water immersion sensors e.g. to detect ditching of a helicopter.
Negative acceleration sensors (e.g. switches) shall not be used because their response is not considered to be reliable.
The Safety Board believes that, with the introduction of 2-hour CVRs, the need for the traditional “G” switch is no longer necessary. In most of the incidents and accidents investigated by the Board, it would be far better not to have any automatic means of shutting down the 2-hour CVR when a crash is sensed due to the risk of losing valuable information resulting from a premature “G” switch activation. The costs associated with disabling or removing a “G” switch, which could be accomplished at the same time as the retrofit of the 2-hour CVR, would be minimal.
The Safety Board therefore requests that Part 23.1457, 25.1457, 27.1457 and 29.1457, be changed to remove section (d)(2).
Hot Boom Mikes
Since October 11, 1991, most CVR installations have required the recording of audio signals received by a boom or mask microphone. Additionally, the flight crew has been required to wear boom microphones when operating aircraft below 18,000 feet mean sea level. The addition of boom microphone audio information has dramatically assisted the Safety Board in its use of recorded audio. The resulting audio is normally of such quality that the Board has been able to use it to perform extensive human performance analysis, including examination of pilot stress by measuring changes to breathing rate or spoken words throughout the flight. Additionally, use of boom microphone audio information has in part enabled Board investigators to identify psychological abnormalities, including hypoxia, drug or alcohol impairment, strokes, and heart attacks. Although this information is available to the Board on aircraft that were manufactured or equipped after October of 1991, most aircraft in the fleet are not equipped nor required to be equipped with pilot boom microphones. The Board views the installation of the new 2-hour CVR as an ideal opportunity for standardizing all CVR installations on large aircraft by requiring that all aircraft equipped with a CVR be equipped with pilot boom microphones.
Therefore, the Safety Board proposes that the rule language be changed to provide for the following: that within 4 years of the effective date of the final rule, all aircraft that are required to carry a CVR be capable of recording the uninterrupted audio signals received by a boom or a mask microphone in accordance with Part 25.1457(c)(5).
Increased Sampling Rate for Flight Controls
The Safety Board is encouraged by the FAA’s proposal to increase the sampling rate of flight control parameters for newly manufactured aircraft, as called for in safety recommendation A-03-048. The Board is disappointed, however, that the proposed rule does not address existing aircraft as called for in recommendation A 03 49. Recommendations A-03-48 and A-03-49 seek to improve the capability of FDR systems on both new and existing transport-category aircraft by taking full advantage of the increased storage capacity of modern solid-state recorders to capture data at “a frequency sufficient to determine a complete, accurate and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible.” Because flight controls are typically the most dynamic parameters, the proposed rule goes a long way toward satisfying recommendation A-03-48. However, by not including a retrofit requirement or a requirement to include other under-sampled parameters, the proposed rule falls short. The Safety Board would welcome the opportunity to work with the FAA to identify other aircraft-specific parameters that may be under-sampled. Our experience with FDR data suggests that the number of under-sampled parameters, other than flight controls, is relatively small and would be confined to unique or novel features of a given make and model aircraft.
Cockpit Image Recording
The Safety Board is disappointed that this rulemaking effort did not provide for cockpit image recording. In its June 2, 2002, response to safety recommendations A-00-30 and 31, which called for cockpit image recorders on Part 121, 125, and 135 aircraft, the FAA stated that “the issue of installation of crash-protected video recording equipment in airplanes and the appropriate time frame for the installation should be submitted to the RTCA Future Flight Data Collection Committee for consideration.” Accordingly, the RTCA subcommittee, jointly chaired by the FAA and the Safety Board, conducted a series of meetings attended by a wide range of representatives from government, industry, and labor. In its fall 2001 report, the subcommittee concluded that image recorder technology existed or could be made available to meet the Safety Board recommendations. Labor opposed the installation of cockpit image recorders citing privacy concerns. The FAA’s response also mentioned the efforts of EUROCAE to develop minimum operational performance specifications for image recorders and the FAA’s willingness to incorporate the standards into a TSO. EUROCAE ED-112 contains specifications for image recorders for the types of cockpit image recordings called for in safety recommendations A 99 59, A 99 60, A 00 30, and A 00 31. In July 2004, the Safety Board conducted a 2-day public hearing on aviation image recording. The FAA participated as a party to the hearing and also provided a number of witnesses. Other participants included labor, industry, and the U.S. military. The hearing produced testimony highlighting the benefits of image recording and the capability of existing technology to implement cockpit image recorders.
The Safety Board’s image recorder recommendations list numerous case histories where image recorders would have provided vital information that could have yielded in-depth information about the facts, conditions, and circumstances surrounding those accidents. The investigations conducted by the Board and other governments since the issuance of these recommendations further strengthen our opinion that cockpit image recorders can play a key role in accident investigations by providing critical human performance and cockpit environment information that is otherwise unavailable. The Safety Board therefore encourages the FAA to move quickly to implement the Safety Board’s cockpit image recorder recommendations.
Although the Safety Board is pleased with some of the more significant rule changes in the NPRM, including, among other improvements, the 2-hour CVR, increased sampling of flight control parameters, recording of data-link messages, and the considerable effort to clarify some longstanding technical issues, we are disappointed with the lack of some retrofit requirements, the rejection of recommendations for installing forward- and aft-mounted combined CVR/FDR recorders, and the FAA’s failure to address image recording. In addition, the Safety Board hoped this rulemaking effort would take full advantage of this opportunity to require implementation of dual combined voice data and image recorders in the Airbus A380 and Boeing 787 while both were in pre-production, when installation costs would be at a minimum. Although the proposed NPRM represents a step forward by addressing several CVR and FDR issues, the Safety Board remains committed to all outstanding recorder recommendations and encourages the FAA to move quickly to implement them. The Safety Board reiterates its position that by taking action now on many of the more significant recorder recommendations, the FAA will enable aircraft manufacturers to save money while implementing important safety improvements.