Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-99-028
Details
Synopsis: On 9/8/94, about 1903:23 eastern daylight time, USAir (now US Airways) flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering to land at Pittsburgh Int'l. Airport, Pittsburgh, PA. Flight 427 was operating under the provisions of 14 code of federal regulations (CFR) part 121 as a scheduled domestic passenger flight from Chicago-O'Hare Int'l. Airport, Chicago, Il, to Pittsburgh. The flight departed about 1810, with 2 pilots, 3 flight attendants, and 127 passengers on board. The airplane entered an uncontrolled descent and impacted terrain near Aliquippa, PA. All 132 people on board were killed, and the airplane was destroyed by impact forces and fire. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan.
Recommendation: TO THE FEDERAL AVIATION ADMINISTRATION: Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with a flight data recorder system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second).
Original recommendation transmittal letter: PDF
Overall Status: Closed - Unacceptable Action
Mode: Aviation
Location: ALIQUIPPA, PA, United States
Is Reiterated: No
Is Hazmat: No
Is NPRM: No
Accident #: DCA94MA076
Accident Reports: Uncontrolled Descent and Collision With Terrain, USAir Flight 427, Boeing 737-300, N513AU
Report #: AAR-99-01
Accident Date: 9/8/1994
Issue Date: 4/16/1999
Date Closed: 11/8/2007
Addressee(s) and Addressee Status: FAA (Closed - Unacceptable Action)
Keyword(s):

Safety Recommendation History
From: NTSB
To: FAA
Date: 2/11/2008
Response: As a result of difficulties in determining the sequence of events in the USAir flight 427 accident, the Safety Board issued these recommendations. Among the parameters specifically mentioned in these recommendations are rudder pedal forces. On November 9, 1999, the FAA issued a notice of proposed rulemaking (NPRM) to amend the digital flight data recorder (DFDR) regulations for 737 aircraft to record additional flight data parameters as recommended. On May 11, 2000, the Board informed the FAA that the Board’s review of the NPRM indicated that although the document was responsive to some parts of these recommendations, the overall objective of the recommendations would not be met. Specifically, the Board indicated that the only way to provide the necessary information on rudder pedal forces would be to place transducers on all four rudder pedals. The use of the four transducers was necessary to identify whether the pilot or co-pilot were applying rudder inputs, or to determine whether the pilot and co-pilot were applying opposing rudder pedal inputs. Instead of the four-transducer system, the FAA proposed in the NPRM a system using a single transducer located between the pilots and the rudder. The Board stated that the difference between the single-transducer system in the NPRM, and the four-transducer system recommended, was essential to the investigation of accidents in the Boeing 737. Although our staffs have discussed these recommendations often, the FAA’s last written communication with the Safety Board concerning these recommendations was dated November 19, 2001. At that time, the FAA stated that it had completed development of a final rule to add a requirement for all 737 series airplanes to record additional flight data parameters, and the regulatory revisions were in executive coordination. The FAA considered pilots fighting each other on the rudder pedals to be a remote possibility, and Boeing had informed the FAA that development of a four-transducer system would require at least 18 months and involve major structural modifications. The FAA stated that it had reviewed this issue thoroughly and, in view of the engineering workload to address a remote possibility, had determined that adding individual sensors on each rudder pedal was not warranted. The FAA believed that the revised design of the DFDR on 737s was satisfactory to gather data required by an accident investigator. On May 28, 2002, the Board replied that because the FAA’s proposed final rule did not include a requirement for individual sensors on each rudder pedal, Safety Recommendations A-99-28 and -29 were classified Open Unacceptable Response. The FAA’s final rule was delayed while Boeing and 737 operators dealt with significant changes to the rudder system on these airplanes, which had been mandated by the FAA as a result of the USAir flight 427 accident. These modifications to the rudder system affected the revisions to the DFDR system, proposed in the FAA’s November 9, 1999, NPRM. On September 5, 2006, the FAA published a supplemental NPRM (SNPRM), “Revisions to Digital Flight Data Recorder Regulations for Boeing 737 Airplanes and for Part 125 Operators, which requested more current data on the status of the 737 fleet and the anticipated costs of installing the proposed monitoring equipment. The SNPRM also announced that the FAA would not require the recordation of each rudder pedal force (four sensors total), but rather would require a single rudder pedal force sensor located midstream in the rudder control system. In the SNPRM, the FAA indicated that equipping the 737’s DFDR system to record each rudder pedal would involve significant, costly, and time-consuming alterations to the structure of the 737. After the SNPRM comment period closed, Safety Board staff attempted to arrange a meeting with FAA staff to review in detail the extensive modifications that the FAA believed would be associated with a four-transducer system. Board staff did not believe that such a system would involve the cost-prohibitive modifications the FAA believed were necessary for this revision. However, because this issue was the subject of rulemaking, the FAA indicated that it could not discuss these details with the Board. For several years, newly manufactured 737s have been equipped with DFDRs that record many, but not all, of the additional parameters recommended. However, these DFDRs record only a single rudder pedal force sensor located midstream in the rudder control system and not each rudder pedal force (four sensors total) identified by the Safety Board as critical to understanding loss-of-control accidents. Because 8 1/2 years after these recommendations were issued, the FAA continues to indicate that it will not take the recommended action, and because Boeing has been equipping newly manufactured 737s with DFDRs that record many, but not all, of the parameters recommended, Safety Recommendations A-99-28 and -29 were classified Closed Unacceptable Action at the Board’s November 8, 2007, meeting.

From: NTSB
To: FAA
Date: 11/21/2006
Response: Notation 7839: The National Transportation Safety Board has reviewed the Federal Aviation Administration’s (FAA) Supplemental Notice of Proposed Rulemaking (SNPRM) titled “Revisions to Digital Flight Data Recorder Regulations for Boeing 737 Airplanes and for Part 125 Operators,” published in the Federal Register, Volume 71, Number 171, on September 5, 2006. In 1999, the Safety Board issued safety recommendations concerning the digital flight data recorder (DFDR) issue addressed in the subject SNPRM; that is, the need to increase the number of DFDR parameters required for all Boeing 737 airplanes and, in particular, those parameters needed to fully record rudder movement. These recommendations, A-99-28 and A-99-29, which were issued in connection with the USAir flight 427 accident and are on the Safety Board’s Most Wanted list, state: Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations Parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with a flight data recorder system that records, at a minimum, the parameters required by Federal Aviation Administration Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-28) Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations Parts 121 or 125 that are not equipped with a flight data acquisition unit be equipped, at the earliest time practicable but no later than August 1, 2001, with a flight data recorder system that records, at a minimum the parameters required by Federal Aviation Administration Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-29) In December 1999, the FAA issued an NPRM (FAA-1999-6482) in response to these recommendations. In a letter to the FAA dated May 11, 2000, the Safety Board responded that although the NPRM “may meet the intent of some of the areas of our recommendations, the overall objective will not be met. Specifically, the Safety Board strongly feels that the only way to provide the necessary information on rudder pedal forces would be to place transducers on all four rudder pedals.” The focus of this new SNPRM is to obtain updated cost information to support the 1999 NPRM, and to modify slightly the requirements to record control column force. The basics of the proposed rulemaking regarding rudders remain the same. The Safety Board is therefore concerned that the new monitoring equipment proposed in the subject SNPRM still does not fully address the Board’s recommendations and that the proposed changes will not allow investigators to dif¬ferentiate crew actions from anomalies in the rudder control system. Specifically, a single point sensor placed “midstream” in the rudder control system will not reveal whether crew inputs are in opposition to each other or if the nose wheel steering or some other system anomaly forward of the sensor is causing the inputs. In addition, any jams in the controls between the pedals and the sensor may go undetected because the force exerted by the crew will not be registered by the sensor. That said, the Safety Board recognizes the need to consider carefully the cost involved in retrofitting 737 airplanes but cost should not preclude installation of the more comprehensive DFDRs. The Board therefore urges the FAA to continue to work with the manufacturer to develop a cost-effective rudder force measurement system that will capture the needed data without requiring extensive modifications to existing aircraft. Further, the Safety Board notes that, when a suitable system is developed, all Boeing 737 aircraft should be outfitted with the new rudder force system. The Safety Board supports all of the other modifications proposed in the SNPRM and agrees that the single control wheel force parameter will be sufficient if both control wheel positions are recorded. The Safety Board appreciates the opportunity to comment on this important rulemaking activity.

From: FAA
To: NTSB
Date: 3/1/2006
Response: In its 3/1/2006 annual report to Congress, Regulatory Status of the National Transportation Safety Board's "Most Wanted" Recommendations to the Department of Transportation, the DOT wrote: In 1999, the FAA issued a Notice of Proposed Rulemaking to address this recommendation. The NPRM proposed to increase the number of digital flight data recorder parameters required for all 8-737 series airplanes. Since that time, the FAA has mandated significant changes to the rudder system on these airplanes and these changes impact the proposal in the NPRM. Therefore, the FAA is evaluating the need to publish a Supplemental Notice of Proposed Rulemaking (SNPRM) rather than a final rule. The goal of an SNPRM would be to request more current data on the status of the 8-737 fleet and the anticipated costs of installing the proposed monitoring equipment. A draft SNPRM is currently under review within the Department, and, if approved, would then go to the Office of Management and Budget.

From: NTSB
To: FAA
Date: 4/29/2005
Response: [On 2/28/2005, FAA issued an NPRM addressing this issue. The Board's comments on the NPRM, as it relates to this recommendation, follow] The NPRM references safety recommendations A-95-25 through -27, A-99-28, and A-99-29, which called for additional flight control parameters for the Boeing 737. The NPRM also references the 1999 NPRM associated with these recommendations. However, because this NPRM does not propose any rule changes associated with these recommendations, and because no action appears to have been taken on the 1999 NPRM in the nearly 5 years since it was issued, the Safety Board is concerned that the FAA plans to take no further action on these recommendations. Therefore, the Safety Board must reiterate its commitment to these recommendations and urge the FAA to take action on them. Notation 7712: The National Transportation Safety Board has reviewed the Notice of Proposed Rulemaking (NPRM), “Revisions to Cockpit Voice Recorder and Digital Flight Data Recorder Rules,” which was published in the Federal Register (Vol. 70, No. 38) on February 28, 2005. The notice proposes to increase the duration of the cockpit voice recorder (CVR) and flight data recorder (FDR) recordings, increase the sampling rate of certain FDR parameters, require physical separation of the FDR and CVR, require improved reliability of the CVR and FDR power source, and require the recording of data-link-communications. Recommendations discussed in the NPRM, but rejected or not addressed by the proposed rulemaking, are the use of forward- and aft-mounted combination voice and data recorders and additional flight control parameters for Boeing 737 airplanes. The NPRM does not address the Board’s image recorder recommendations. However, the NPRM does mention the security benefits of deployable recorders, a subject not addressed in any Safety Board recommendations. The summary of the NPRM states that it was prepared in response to a series of safety recommendations issued by the Safety Board following a number of accidents and incidents from 1995 to 2000. These safety recommendations asked the FAA to take the following actions: Amend, by December 31, 1995, 14 Code of Federal Regulations (CFR) 121.343, 125.225, and 135.152 to require that Boeing 727 airplanes, Lockheed L-1011 airplanes, and all transport category airplanes operated under 14 CFR Parts 121, 125, or 135 whose type certificate applies to airplanes still in production, be equipped to record on an FDR system, as a minimum, the parameters listed in “Proposed Minimum FDR Parameter Requirements for Airplanes in Service” plus any other parameters required by current regulations applicable to each individual airplane. Specify that the airplanes be so equipped by January 1, 1998, or by the later date when they meet stage 3 noise requirements but, regardless of stage 3 compliance status, no later than December 31, 1999. (A-95-26) Require all aircraft currently required to be installed with a CVR to be retrofitted within 2 years with a CVR installation designed such that an uninterrupted recording from the boom or mask microphones and headphones for each flight crewmember’s position and from an area microphone can be made on dedicated channels of the CVR. A sidetone shall be produced only when the transmitter or interphone is selected, and, in addition, all audio signals received by hand-held microphones shall be recorded on the respective crewmember’s channel when keyed to the “ON” position. (A-96-89) Require that all newly manufactured CVRs intended for use on airplanes have a minimum recording duration of 2 hours. (A-96-171) Require retrofit after January 1, 2005, of all CVRs on all airplanes required to carry both a CVR and a FDR with a CVR that (A) meets Technical Standard Order (TSO) C123a, (B) is capable of recording the last 2 hours of audio; and (C) is fitted with an independent power source that is located with the digital CVR and that automatically engages and provides 10 minutes of operation whenever aircraft power to the recorder ceases, either by normal shutdown or by a loss of power to the bus. (A-99-016) Require all aircraft manufactured after January 1, 2003, that must carry both a CVR and a digital flight data recorder (DFDR) to be equipped with two combination CVR/DFDR recording systems. One system should be located as close to the cockpit as practicable and the other as far aft as practicable. Both recording systems should be capable of recording all mandatory data parameters covering the previous 25 hours of operation and all cockpit audio including controller-pilot data-link messages for the previous 2 hours of operation. The system located near the cockpit should be provided with an independent power source that is located with the combination recorder, and that automatically engages and provides 10 minutes of operation whenever normal aircraft power ceases, either by normal shutdown or by a loss of power to the bus. The aft system should be powered by the bus that provides the maximum reliability for operation without jeopardizing service to essential or emergency loads, whereas the system near the cockpit should be powered by the bus that provides the second highest reliability for operation without jeopardizing service to essential or emergency loads. (A 99 017) Amend Title 14 CFR Parts 25.1457 (CVRs) and 25.1459 (FDRs) to require that CVRs, FDRs, and redundant combination flight recorders be powered from separate generator buses with the highest reliability. (A-99-018) Although not specifically referenced, the NPRM contains rule changes that partially address the following flight recorder recommendations: Require that all newly manufactured transport-category aircraft that are required to carry an FDR be fitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-048) Require that all existing transport aircraft that are required to carry an FDR be retrofitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate expected. (A-03-049) Require that within 2 years, all Airbus A300-600/A310 and Boeing 747-400 airplanes and any other aircraft that may be identified as recording filtered data be retrofitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-050) The following flight recorder recommendations that call for rulemaking were not addressed in this NPRM: Require that all Boeing 737 airplanes operated under 14 CFR Parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with an FDR system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-028) Require that all Boeing 737 airplanes operated under 14 CFR Parts 121 or 125 that are not equipped with a flight data acquisition unit be equipped, at the earliest time practicable but no later than August 1, 2001, with an FDR system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-029) Require that all aircraft operated under Title 14 CFR Part 121, 125, or 135 and currently required to be equipped with a CVR and DFDR be retrofitted by January 1, 2005, with a crash-protected cockpit image recording system. The cockpit image recorder system should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by the people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. The cockpit image recorder should be mounted in the aft portion of the aircraft for maximum survivability and should be equipped with an independent auxiliary power supply that automatically engages and provides 10 minutes of operation whenever aircraft power to the cockpit image recorder and associated cockpit camera system ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder system, as well as the circuit breakers for the CVR and the DFDR, should not be accessible to the flight crew during flight. (A-00-030) Require that all aircraft manufactured after January 1, 2003, operated under Title 14 CFR Part 121, 125, or 135 and required to be equipped with a CVR and DFDR also be equipped with two crash-protected cockpit image recording systems. The cockpit image recorder systems should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. One recorder should be located as close to the cockpit as practicable and the other as far aft as practicable. These recorders should be equipped with independent auxiliary power supplies that automatically engage and provide 10 minutes of operation whenever aircraft power to the cockpit image recorders and associated cockpit camera systems ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker of the cockpit image recorder systems, as well as the circuit breakers for the CVRs and the DFDRs, should not be accessible to the flight crew during flight. (A-00-31) The Safety Board recognizes that the FAA’s proposed revisions attempt to increase the capability and survivability of CVR and FDR systems while imposing minimum financial burdens on the industry. However, the Board is concerned that the failure to address many of the more significant recorder recommendations at this time will ultimately result in a larger economic obligation for industry and may delay implementation of the associated safety improvements. This is particularly true for the Airbus A380 and Boeing 787, which are in pre-production, making this an ideal opportunity to implement dual combined recorders as well as cockpit image recording. 2-Hour CVR The Safety Board applauds the FAA’s proposed action to require that all CVRs record a minimum of 2 hours of audio information. The Board has cited in its recommendations many accidents and incidents where the existing 30-minute CVR recorder duration was not sufficient. The Board also endorses the timeline set forth in the NPRM that requires all newly manufactured aircraft to be equipped with a 2-hour CVR within 2 years of the rule date. The Board also agrees that the 4-year phase-in that was proposed to retrofit the existing fleet is appropriate and will not cause undue hardships in the aviation community. All of the manufacturers of CVRs in the United States currently produce a 2-hour model that meets the crash and survivability specifications set forth in the FAA’s TSO-123a. In addition, several manufacturers offer a lower cost upgrade to an existing 30-minute CVR to increase the record duration to 2 hours. Magnetic Tape Obsolescence The proposed rulemaking action, although not as timely and extensive as recommended, addresses some significant and longstanding safety concerns. The proposed requirement for a 2 hour CVR recording will allow for a more thorough and accurate investigation of non-catastrophic occurrences as well as accidents that evolve over time periods greater than 30 minutes. This rule change will also significantly increase the crash fire survivability and reliability of the CVR because it will, in effect, eliminate magnetic tape CVRs that only meet TSO C-84 or C-51a standards, which were introduced in the 1960s. The Safety Board is encouraged by the FAA’s recognition of the need to eliminate magnetic tape as a CVR recording medium. The NPRM notes the “vulnerability to damage and decreased reliability” and the dwindling supply of magnetic tape. This same reasoning can be applied to TSO C-51a magnetic tape FDRs; unfortunately, the rule changes do not call for the elimination of magnetic tape FDRs. Magnetic-tape FDRs, which record in the digital format, have in fact been more problematic than magnetic-tape CVRs, which record in a more robust analog format. For both FDRs and CVRs, operators are finding it cost-effective to replace tape-based recorders with solid-state models. However, a relatively small number of operators continue to use magnetic tape FDRs, with decreasing reliability and inadequate crash and fire protection. Manufacturers estimate that they have a 2- to 3-year supply of spare parts for critical hardware such as drive motors and belts, recording heads, and the tape itself. The vendors for these items have either stopped production or gone out of business. In the very near term, operators using magnetic tape FDRs will be forced to replace unserviceable FDRs with solid-state-equivalent FDRs or continue to fly with marginally serviceable FDRs. One recorder manufacturer estimates that approximately 2,500 of their magnetic tape FDRs are in service and nearly all are installed on third-tier carriers operating older aircraft such as DC-8s, Boeing 727s, and 707s. Therefore, the Safety Board proposes that the FAA add the following language to replace magnetic tape FDRs with recorders that meet TSO C-124a: Part 121.343 (g): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 121.344 (m): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 125.225 (j): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 129.20 (b): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 135.152: (l) After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Recording of Data-Link Communications The Safety Board is pleased that the FAA has proposed rules for the recording of data-link communications. The Board believes that the in-flight recording of data-link communications presented to and transmitted by the flight crew will become as vital to future investigations as CVR information has proven to be. In addition to accident investigations, this information could play an important role in troubleshooting technical problems that may arise as data-link communications play an ever-increasing role in air traffic management. The NPRM preamble quite correctly points out the importance of capturing data-link communication at the proper locations within the communications system, and the rule clearly spells that out in the following text: “output from the communications unit that translates the signal into usable data.” However, the rule language is somewhat ambiguous as to what must be recorded. Fortunately, the preamble clearly defines what must be recorded as follows: (1) the message priority assignment; (2) the number of messages in uplink/downlink queues; (3) the content of all messages generated by the flight crew; (4) the time each downlink message is generated (that is, when the flightcrew selects “send”); (5) the time any message is available for display to the flight crew; and (6) the time any message is actually displayed to the flight crew. The Safety Board believes that the rule language must contain these vital recording requirements in order to remove any ambiguity as to what must be recorded. Not including this level of detail in the rule language would create an opportunity to misinterpret the intent of the rule, which could result in an installation that would be of little use to investigators. Further, the data-link portion of the preamble also states that “the FAA was unable to propose a practical, feasible method of capturing ‘what the pilot sees’ off the actual cockpit display” and that “there is no developed technology for reliable recording of information.” However, the Safety Board is of the opinion that an image recording of the cockpit display could provide specifics as to what data-link communications are displayed to and generated by the flight crew and when those messages are displayed or sent. An image recording would also indicate the quality of the display. Adding a properly placed cockpit video camera would allow data link messages displayed to the crew to be recorded on the image recorder. The use of video technology would not require any modifications to the existing aircraft’s communication or display systems. This addition might greatly reduce the time and expense of retrofitting older aircraft to record data-link messages. The Safety Board is also concerned with proposed data-link rule language that states, “[Each cockpit voice recorder … will record the following:] If data-link communication equipment is installed, all data-link communications, using an approved data message set.” Currently the FAA has not approved any data-link message sets, nor has it issued any guidance as to how to determine if a given message set is approved. An advisory circular or other guidance material is clearly needed to define what messages to record. In addition, the proposed operational requirements call for the recording of data-link communications 2 years after data-link equipment is installed. The Safety Board sees no reason to delay the requirement for 2 years when the installed communications equipment should have the capability of outputting the required data-link messages to the voice recorder at the time of installation. Therefore, the Safety Board suggests the following changes to the proposed rule language: Change the appropriate paragraphs of Parts 23, 25, 27, and 29 as follows: If data-link communications equipment is installed, all data-link communications must use an approved data message set that must be recorded so that the following can be determined: (1) the message priority assignment; (2) the number of messages in uplink/downlink queues; (3) the content of all messages generated by the flightcrew; (4) the time each downlink message is generated (that is, when the flightcrew selects “send”); (5) the time any message is available for display to the flight crew; and (6) the time any message is actually displayed to the flight crew. The timing of all message traffic must have a minimum resolution of 1 second. Boeing 737 FDR Recommendations The NPRM references safety recommendations A-95-25 through -27, A-99-28, and A 99 29, which called for additional flight control parameters for the Boeing 737. The NPRM also references the 1999 NPRM associated with these recommendations. However, because this NPRM does not propose any rule changes associated with these recommendations, and because no action appears to have been taken on the 1999 NPRM in the nearly 5 years since it was issued, the Safety Board is concerned that the FAA plans to take no further action on these recommendations. Therefore, the Safety Board must reiterate its commitment to these recommendations and urge the FAA to take action on them. Dual Combined FDR/CVR Recorders In regard to dual combined FDR/CVR recorders, one mounted near the cockpit and the other as far aft as practicable, the Safety Board takes exception to the NPRM statement that, “After a careful analysis of the benefits of having two systems, the FAA is unable to justify the excessive cost that would be incurred in the installation of two complete systems.” Although recommendations A-99-017 and A-00-031 specify two combined (CVR/FDR) recording systems, the intent of these recommendations was to have two redundant recorders—not to require two flight data acquisition units and two sets of cockpit microphones. If the FAA’s analysis included “two complete systems,” as the NPRM states, the cost estimates would be unnecessarily inflated. However, the Safety Board does not agree with the NPRM statement that “in the case of an accident so catastrophic that neither recorder survives [meaning the currently required, aft-mounted recorders], a second set of recorders located in the front of the aircraft would probably not survive either.” In fact, there are a number of instances in which the circumstances of a catastrophic accident could have resulted in a forward-mounted recorder surviving and the aft-mounted recorder being lost to fire or impact. One example is the Air France Airbus A320, which crashed in Strasburg, France, in 1992. In this accident, the aft-mounted FDR was destroyed by fire while the unprotected quick-access recorder mounted below the cockpit survived. Another example is the crash of a Lauda Air Boeing 767 in Thailand in 1991; in this accident, the aft-mounted recorder was lost to fire while the unprotected, solid-state memory located on the engines survived. It should be noted that fire has proven to be more destructive to solid-state recorders than crash impact, and the only complete losses of solid-state flight recorder data have been due to fire. Solid-state recorders have proven to be quite resistant to impact damage, even surviving the very severe impact sustained during the September 11, 2001, crashes. The NPRM also implies that a crash resulting in the loss of an aft-mounted recorder would most certainly result in the loss of a forward-mounted recorder. Accident history does not support this position, as illustrated in those accidents in which the aft-mounted recorders were lost. The explosion of Pan Am Flight 109, a Boeing 747 over Lockerbie, Scotland, separated the cockpit, which landed relatively intact far clear of the burning fuselage wreckage. In the United Airlines DC10 crash in Sioux City, Iowa, the cockpit separated but maintained enough structural integrity to allow the cockpit crew to survive; it is logical to conclude that forward-mounted recorders would also have survived the accident. In the 1996 Boeing 757 accident in Cali, Columbia, which involved a controlled collision with terrain, vital information was recovered from the unprotected solid-state memory in the Flight Management System unit located under the cockpit. In numerous accident scenarios, forward-mounted recorders could have survived, even though aft-mounted recorders might have been destroyed by post-crash fire (for example, during ground collisions, takeoff abort overruns, landing overruns, and approach and landing accidents). The second reason for placing a combined CVR/FDR as close to the cockpit as practicable is to ensure an acceptable recording of the cockpit acoustic environment if the wiring to the aft-mounted CVR is compromised as the result of a progressive fire, explosive decompression, structural failure, or uncontained engine failure. Such occurrences may not result in the immediate loss of the aircraft. For Swiss Air Flight 111, which crashed in Halifax, Nova Scotia, in 1998, the flight continued for about 6 minutes after the CVR stopped. Had the MD-11 involved in flight 111 been fitted with a forward-mounted CVR and a recorder independent power supply as proposed in this NPRM for newly manufactured aircraft, it is possible that the acoustic environment of the cockpit could have been recorded for the final critical minutes of the flight. Value Jet flight 592, which crashed in Miami, Florida, in 1996, also experienced an in-flight fire, in this case causing the CVR and FDR to stop approximately 40 to 50 seconds prior to the crash. In both cases, a forward mounted combined CVR/FDR fitted with a recorder independent power supply (RIPS) would have provided the best opportunity to record the audio environment of the cockpit. To summarize the Safety Board’s position on combined CVR/FDRs, longstanding accident investigation experience indicates that the enhanced crash/fire survivability of TSO C123a and C124a flight recorders and the use of combined CVRs/FDRs, one mounted near the cockpit and the other mounted as far aft as practicable, will greatly improve the likelihood of survivability and recording of critical flight recorder data following a catastrophic accident. All three recorder manufacturers agree with this position, as do airframe manufacturers, Boeing and Embraer. Embraer, in fact, is currently delivering its model EMB-170/190 to U.S. operators with forward- and aft-mounted combined CVR/FDRs, and Boeing is currently considering a similar design in its new 787 aircraft. Therefore, the Safety Board proposes the following rule language: For Parts 23, 25, 27 and 29, add the following to the end of (b): When two combined voice and data recorders that record the same data are installed, one recorder must be mounted as close to the cockpit as practicable so as to minimize the signal path between the cockpit microphones and the recorder. The forward-mounted recorder must be fitted with a recorder independent power supply that provides 10 minutes of uninterrupted power to the CVR system following the loss of recorder power for any reason. For Parts 91, 121, 125, 129, 135, add the following language: Newly manufactured aircraft after (insert date 2 years from the effective date of this final rule) that are required to carry both a CVR and an FDR must be fitted with two combined CVR/FDRs that meet the requirement of 23.1457 or 25.1457 of this chapter. Recorder Independent Power Supply The Safety Board is pleased that the FAA plans to require the installation of a 10-minute independent power source for the CVR that will engage when electrical power to the CVR is lost. However, the Board is disappointed that this requirement will apply only to newly manufactured aircraft. The Board believes that a 4-year retrofit similar to that being considered for the 30-minute-to-2-hour CVR conversion should also be applied to RIPS. The benefits gained from a CVR independent power supply vastly outweigh the additional costs. In fact, incorporating RIPS into the recorder chassis, as is being proposed by one recorder manufacturer, would significantly reduce installation and hardware costs, especially if the operator replaces an older, 30-minute tape CVR with a new 2-hour recorder. A different option is to mount RIPS under the existing CVR mounted tray, a means currently employed by another CVR manufacturer. This installation would be totally self-contained and would not require any modifications to the aircraft. In addition, the rule language fails to require that the independent power supply be colocated with the CVR so as to minimize the opportunity for a mechanical disconnect between the recorder and the independent power supply. Therefore, the Safety Board proposes that Parts 23.1457, 25.1457, 27.1457 and 29.1457 be changed by adding the following text at the end of (d)(5)(ii): “As far as practicable, the independent power supply must be colocated with the CVR to eliminate the possibility of an electrical disconnect.” The Safety Board also suggests that the operating rules be changed to require the installation of a CVR independent power supply 4 years after the date of the final rule. Separate Power for CVR and FDR The Safety Board notes that the proposed rule changes agree with the Board’s recommendation that the FDR and CVR be on separate generator busses with the highest reliable power so that any single electrical failure does not disable both the CVR and FDR. However, the Board also notes that the proposed rule language applies to newly manufactured aircraft only, even though the recommendation was aimed at existing aircraft as well. The Board believes that most existing aircraft meet this requirement and that any retrofit requirement will have minimal economic impact. Therefore, the Safety Board requests that this rule change apply to existing aircraft as well. CVR and FDR Start-Stop Criterion The Safety Board appreciates the efforts of the FAA to correct some ambiguities and deficiencies in the existing flight recorder rule language. These corrections include changing the CVR operating rules to require that the CVR operate from the start of the checklist, before the first engine is started, and requiring separate containers for the FDR and CVR. These changes are worthwhile and will help ensure the capture of information that otherwise would have been lost. In addition, the Safety Board would like to use this opportunity to suggest removing some of the legacy requirements that are no longer relevant to modern, solid-state recorders, or those requirements that have proven ineffective or detrimental. Included among these changes are the “start-stop” criterion for the FDR and the automatic means of stopping the voice recorder 10 minutes after crash impact. The current rule requires that the FDR be operated from the start of takeoff roll until it has completed the landing roll. This operational requirement was designed to maximize the supply of the expendable metallic recording medium used by the very first FDRs introduced in the late 1950s. Most airframe manufacturers and operators ignored this provision in the rules and, for the most part, operated the FDR shortly after engine start. However, at least one manufacturer connected the FDR power through the parking brake so that the FDR was turned off when the brake was set. The February 2, 2005, accident at Teterboro, New Jersey, involving Canada Air Challenger CL-600, has identified another problematic FDR start criterion. In this instance, the FDR electrical power was applied when the anticollision (strobe) light switch was placed in the “on” position. The failed logic was that the crew would always turn the anticollision lights on before taking the active runway. Unfortunately, in this case, that did not occur and critical FDR data covering the takeoff abort were not recorded. The Board believes that this method of powering the FDR should be prohibited. In recent years, most aircraft manufacturers have connected the FDR power to engine oil pressure, which automatically triggers electrical power to the FDR when engine oil pressure is sensed on any engine. Automatically starting the FDR provides some assurance that the FDR will record a partial engine start for the first engine started, the complete engine start for the remaining engines, and the continued operation of the aircraft until no engine oil pressure is sensed and the aircraft is on the ground. Therefore, the Safety Board suggests that the respective operating rules be updated to require that the FDR be operated before engine start for the purpose of flight or provide an automatic means of starting the FDR when engine oil pressure is sensed on any engine, and that the FDR operate continuously until termination of the flight when all engines are shut down. Although the regulations do not require an automatic means of powering the FDR at takeoff if it is not powered prior to the transition from ground to air, the Safety Board is unaware of any aircraft that is not so equipped. This safeguard has proven very beneficial in a number of accidents and incidents where the FDR was not powered prior to liftoff. Therefore, to ensure that this practice continues, the Board suggests that the airworthiness requirements in the regulations be changed to provide for the automatic application of electrical power to the FDR at liftoff to safeguard against the failure of any automatic or manual means of powering the FDR. The Safety Board would also like to suggest that, because the proposed rule change replaces the 30-minute CVR with a 2-hour CVR, the requirement that the CVR have an automatic means of stopping the recording within 10 minutes after a crash impact is less important and may be removed. To accomplish this, some airframe manufacturers have installed an accelerator-sensing switch (“G” switch), which stops a CVR in the event of a crash. The Safety Board’s experience with use of the “G” switch to sense a crash and in turn stop the recorder has been negative. In at least two accidents, the “G” switch was prematurely tripped, and as a result, the CVR was not operating at the time of the accidents. In these accidents, activation of the “G” switch resulted in the loss of valuable information about the final seconds of the accident or the circumstances surrounding the post-accident evacuation. Other international safety investigation agencies share the Safety Board’s reservations concerning the “G” switch. This sentiment was expressed in the March 2003 European Organisation of Civil Aviation Electronics (EUROCAE) ED 112 document, “Minimum Operational Performance Specification for Crash Protected Airborne Recorders Systems,” which updated the minimum manufacturing specifications for accident flight data and voice recorders; it stated that If required by operational rules, acceptable means of stopping the recorder after an accident include: i. detection of loss of oil pressure on all engines together with loss of airspeed. ii. airframe crash sensors, iii. water immersion sensors e.g. to detect ditching of a helicopter. Negative acceleration sensors (e.g. switches) shall not be used because their response is not considered to be reliable. The Safety Board believes that, with the introduction of 2-hour CVRs, the need for the traditional “G” switch is no longer necessary. In most of the incidents and accidents investigated by the Board, it would be far better not to have any automatic means of shutting down the 2-hour CVR when a crash is sensed due to the risk of losing valuable information resulting from a premature “G” switch activation. The costs associated with disabling or removing a “G” switch, which could be accomplished at the same time as the retrofit of the 2-hour CVR, would be minimal. The Safety Board therefore requests that Part 23.1457, 25.1457, 27.1457 and 29.1457, be changed to remove section (d)(2). Hot Boom Mikes Since October 11, 1991, most CVR installations have required the recording of audio signals received by a boom or mask microphone. Additionally, the flight crew has been required to wear boom microphones when operating aircraft below 18,000 feet mean sea level. The addition of boom microphone audio information has dramatically assisted the Safety Board in its use of recorded audio. The resulting audio is normally of such quality that the Board has been able to use it to perform extensive human performance analysis, including examination of pilot stress by measuring changes to breathing rate or spoken words throughout the flight. Additionally, use of boom microphone audio information has in part enabled Board investigators to identify psychological abnormalities, including hypoxia, drug or alcohol impairment, strokes, and heart attacks. Although this information is available to the Board on aircraft that were manufactured or equipped after October of 1991, most aircraft in the fleet are not equipped nor required to be equipped with pilot boom microphones. The Board views the installation of the new 2-hour CVR as an ideal opportunity for standardizing all CVR installations on large aircraft by requiring that all aircraft equipped with a CVR be equipped with pilot boom microphones. Therefore, the Safety Board proposes that the rule language be changed to provide for the following: that within 4 years of the effective date of the final rule, all aircraft that are required to carry a CVR be capable of recording the uninterrupted audio signals received by a boom or a mask microphone in accordance with Part 25.1457(c)(5). Increased Sampling Rate for Flight Controls The Safety Board is encouraged by the FAA’s proposal to increase the sampling rate of flight control parameters for newly manufactured aircraft, as called for in safety recommendation A-03-048. The Board is disappointed, however, that the proposed rule does not address existing aircraft as called for in recommendation A 03 49. Recommendations A-03-48 and A-03-49 seek to improve the capability of FDR systems on both new and existing transport-category aircraft by taking full advantage of the increased storage capacity of modern solid-state recorders to capture data at “a frequency sufficient to determine a complete, accurate and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible.” Because flight controls are typically the most dynamic parameters, the proposed rule goes a long way toward satisfying recommendation A-03-48. However, by not including a retrofit requirement or a requirement to include other under-sampled parameters, the proposed rule falls short. The Safety Board would welcome the opportunity to work with the FAA to identify other aircraft-specific parameters that may be under-sampled. Our experience with FDR data suggests that the number of under-sampled parameters, other than flight controls, is relatively small and would be confined to unique or novel features of a given make and model aircraft. Cockpit Image Recording The Safety Board is disappointed that this rulemaking effort did not provide for cockpit image recording. In its June 2, 2002, response to safety recommendations A-00-30 and 31, which called for cockpit image recorders on Part 121, 125, and 135 aircraft, the FAA stated that “the issue of installation of crash-protected video recording equipment in airplanes and the appropriate time frame for the installation should be submitted to the RTCA Future Flight Data Collection Committee for consideration.” Accordingly, the RTCA subcommittee, jointly chaired by the FAA and the Safety Board, conducted a series of meetings attended by a wide range of representatives from government, industry, and labor. In its fall 2001 report, the subcommittee concluded that image recorder technology existed or could be made available to meet the Safety Board recommendations. Labor opposed the installation of cockpit image recorders citing privacy concerns. The FAA’s response also mentioned the efforts of EUROCAE to develop minimum operational performance specifications for image recorders and the FAA’s willingness to incorporate the standards into a TSO. EUROCAE ED-112 contains specifications for image recorders for the types of cockpit image recordings called for in safety recommendations A 99 59, A 99 60, A 00 30, and A 00 31. In July 2004, the Safety Board conducted a 2-day public hearing on aviation image recording. The FAA participated as a party to the hearing and also provided a number of witnesses. Other participants included labor, industry, and the U.S. military. The hearing produced testimony highlighting the benefits of image recording and the capability of existing technology to implement cockpit image recorders. The Safety Board’s image recorder recommendations list numerous case histories where image recorders would have provided vital information that could have yielded in-depth information about the facts, conditions, and circumstances surrounding those accidents. The investigations conducted by the Board and other governments since the issuance of these recommendations further strengthen our opinion that cockpit image recorders can play a key role in accident investigations by providing critical human performance and cockpit environment information that is otherwise unavailable. The Safety Board therefore encourages the FAA to move quickly to implement the Safety Board’s cockpit image recorder recommendations. Closing Remarks Although the Safety Board is pleased with some of the more significant rule changes in the NPRM, including, among other improvements, the 2-hour CVR, increased sampling of flight control parameters, recording of data-link messages, and the considerable effort to clarify some longstanding technical issues, we are disappointed with the lack of some retrofit requirements, the rejection of recommendations for installing forward- and aft-mounted combined CVR/FDR recorders, and the FAA’s failure to address image recording. In addition, the Safety Board hoped this rulemaking effort would take full advantage of this opportunity to require implementation of dual combined voice data and image recorders in the Airbus A380 and Boeing 787 while both were in pre-production, when installation costs would be at a minimum. Although the proposed NPRM represents a step forward by addressing several CVR and FDR issues, the Safety Board remains committed to all outstanding recorder recommendations and encourages the FAA to move quickly to implement them. The Safety Board reiterates its position that by taking action now on many of the more significant recorder recommendations, the FAA will enable aircraft manufacturers to save money while implementing important safety improvements.

From: FAA
To: NTSB
Date: 2/1/2005
Response: In its 2/1/2005 annual report to Congress, Regulatory Status of the National Transportation Safety Board's "Most Wanted" Recommendations to the Department of Transportation, the DOT wrote: Final issuance o f this rule was delayed by the issuance of an Airworthiness Directive that required the rudder system ofthe B-737 fleet to be replaced with a new, redesigned rudder system. The B-737 fleet is currently installing the newly designed rudder and the decision was made to better align the compliance time o f this rule with the compliance time of the rudder system retrofit, to minimize industry impact. The final rule is at OST for review.

From: NTSB
To: FAA
Date: 5/28/2002
Response: The Safety Board looks forward to reviewing the final rule; however, we note that the FAA has stated that it still does not believe that adding individual sensors on each rudder pedal is warranted. Therefore, pending our review of the final rule once it is issued, Safety Recommendations A-99-28 and -29 remain classified "Open--Unacceptable Response."

From: FAA
To: NTSB
Date: 11/19/2001
Response: Letter Mail Controlled 11/21/2001 9:45:28 AM MC# 2010921: The Federal Aviation Administration's (FAA) final rule to amend the digital flight data recorder regulations for transport-category airplanes to add a requirement for all Boeing 737 series airplanes to record additional flight data parameters is completed and in executive coordination. The issues raised in the Board's letter dated June 7, 2001, were addressed during the deliberations of preparing the notice of proposed rulemaking. The main issue is whether to record pilot-to-system or pilot-to-pilot interaction. The FAA considers pilots "fighting" each other on the rudder pedals to be a remote possibility. Additionally, Boeing representatives have stated that they could not develop engineering data in less than 18 months and that installing individual sensors on each rudder pedal would require major structural modifications. The FAA has reviewed this issue thoroughly and, in view of the engineering workload to address a remote possibility, has determined that adding individual sensors on each rudder pedal is not warranted. The FAA believes that the revised design of the digital flight data recorders is satisfactory to gather any data that may be required by an accident investigator. I will provide the Board with a copy of the final rule as soon as it is issued.

From: NTSB
To: FAA
Date: 6/7/2001
Response: There is no indication in your letter that the FAA’s final rule addressed these issues. Further, while the Safety Board is dismayed that the NPRM issued in November 1999 did not result in a final rule before the end of January 2001, the Board is more concerned that the final rule may not address the issues raised in the Board’s May 11, 2000, letter. If that is the case, the final rule would be considered unacceptable in addressing the intent of the Board’s recommendations. Safety Recommendations A-99-28 and -29 remain classified “Open--Unacceptable Response.”

From: FAA
To: NTSB
Date: 3/29/2001
Response: Letter Mail Controlled 04/02/2001 6:13:25 PM MC# 2010282 The Federal Aviation Administration (FAA) completed the final rule to amend the digital flight data recorder regulations for transport-category airplanes to add a requirement for all Boeing 737 series airplanes to record additional flight data parameters. However, the final rule was returned for review in accordance with the Presidential directive issued January 21, 2001. The FAA has completed its review and has resubmitted the final rule for executive coordination. I will provide the Board with a copy of the final rule as soon as it is issued.

From: NTSB
To: FAA
Date: 5/11/2000
Response: THE SAFETY BOARD'S REVIEW OF THE NPRM INDICATES THAT ALTHOUGH IT MAY MEET THE INTENT OF SOME OF THE AREAS OF OUR RECOMMENDATIONS, THE OVERALL OBJECTIVE WILL NOT BE MET. SPECIFICALLY, THE SAFETY BOARD STRONGLY FEELS THAT THE ONLY WAY TO PROVIDE THE NECESSARY INFORMATION ON RUDDER PEDAL FORCES WOULD BE TO PLACE TRANSDUCERS ON ALL FOUR RUDDER PEDALS. THE TRANSDUCERS WOULD PROVIDE THE ABILITY TO IDENTIFY WHETHER THE PILOT OR COPILOT WAS APPLYING RUDDER INPUTS, OR DETERMINE WHETHER THE PILOT AND COPILOT HAVE OPPOSING PEDAL FORCES APPLIED. THE FAA ACKNOWLEDGES IN THE NPRM THAT THERE IS A DIFFERENCE IN THE EXACT NATURE OF THE DATA ACQUIRED USING BOEING'S APPROVED SINGLE TRANSDUCER SYSTEM AND THE SAFETY BOARD'S PREFERRED FOUR-PEDAL SENSOR RETROFIT. THAT DIFFERENCE IS ESSENTIAL TO THE OVERALL SUCCESS OF INVESTIGATION OF ACCIDENTS IN THIS AIRCRAFT AND THE PREVENTION OF FUTURE ACCIDENTS THROUGH THAT PROCESS. BECAUSE THE FAA HAS NOT CLEARLY STATED IN THE NPRM THAT THE FOUR-PEDAL TRANSDUCER IS THE ONLY ACCEPTABLE MEANS OF ACCOMPLISHING THE PROPOSED RULEMAKING, A-99-28 AND -29 ARE CLASSIFIED "OPEN--UNACCEPTABLE RESPONSE."

From: FAA
To: NTSB
Date: 2/1/2000
Response: Letter Mail Controlled 02/07/2000 3:52:54 PM MC# 2000178 ON 11/9/99, THE FAA ISSUED A NOTICEOF PROPOSED RULEMAKING (NPRM) PROPOSING TO AMEND THE DIGITAL FLIGHT DATA RECORDER REGULATIONS FOR TRANSPORT-CATEGORY AIRPLANES TO ADD A REQUIREMENT FOR ALL BOEING 737 SERIES AIRPLANES TO RECORD ADDITIONAL FLIGHT DATA PARAMETERS. I HAVE ENCLOSED A COPY OF THE NPRM FOR THE BOARD'S INFORMATION. I WILL PROVIDE THE BOARD WITH A COPY OF THE FINAL RULE AS SOON AS IT IS ISSUED.

From: NTSB
To: FAA
Date: 1/11/2000
Response: Notation 7224: The National Transportation Safety Board has reviewed the Federal Aviation Administration's (FAA) Notice of Proposed Rulemaking (NPRM) entitled "Revisions to Digital Flight Data Recorder Regulations for Boeing 737 Airplanes and for Part 125 Operations," published in the Federal Register, Volume 64, Number 222, on November 18, 1999. The proposed rule changes are the result of Safety Board investigations of two accidents and one incident.' The Board determined that the probable cause of the USAir flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The Board's investigation showed that the rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit (PCU) servo valve secondary slide and overtravel of the primary slide. Simulations of the PCU show that if the secondary slide were jammed to the servo valve housing while offset from its neutral position and the primary slide moved to an overtravel position as a result of pilot inputs to the rudder pedals, the rudder could move in the direction opposite from that commanded by the pilot. The Board made similar findings for United Airlines flight 585 and Eastwind Airlines flight 517. Although Boeing and Safety Board staffs agreed that the rudders moved to the blowdown limit in the three cases, arguments were made, and continue to be made, that the pilots caused the rudders to move rather than malfunctions in the rudder systems. Many years of investigative efforts were required for the Board to conclude that the rudder system was the likely source of the large rudder deflections. The lengthy investigations, continuing occurrences of serious incidents similar in nature to the referenced accidents and incident, and the nondefinitive resolution of pilot involvement prompted the Safety Board to issue, on April 16, 1999, the following safety recommendations to the FAA: Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations Parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with a flight data recorder system that records, at a minimum, the parameters required by Federal Aviation Administration Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (Safety Recommendation A-99-28) Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations Parts 121 or 125 that are not equipped with a flight data acquisition unit be equipped, at the earliest time practicable but no later than August I, 200 I, with a flight data recorder system that records, at a minimum the parameters required by Federal Aviation Administration Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (Safety Recommendation A-99-29) The proposed requirements, as drafted, would satisfy Safety Recommendations A-99-28 and -29, except for the slight modification of the compliance dates and the number of flight control input force sensors. The Safety Board recognizes the rationale for the proposed modification of the compliance dates for retrofit of 737s with and without flight data acquisition units (FDAUs) to August 18,2000, and August 20, 2001, respectively, to coincide with the 1997 regulation. Although the Safety Board would prefer a compliance date of August 20, 2001, for all 737s, we understand the FAA's decision to extend the compliance period to August 19, 2002, for those airplanes that installed a FDAU between July 16, 1996, and November 18, 1999, in order to meet the 1997 regulations. The proposal to allow one force sensor per airplane axis to measure flight control input forces, however, would hinder the ability of investigators to differentiate crew actions from anomalies in the flight control system. This ability to differentiate is central to the Safety Board's recommendations. The actual rudder pedal force exerted by each crewmember is critical to understanding the loss of control problems experienced by the 737. The measurement of rudder pedal force for all four pedals will allow investigators to isolate the pedal force of each crewmember from inputs by airplane systems. A single sensor placed "midstream" in the rudder control system, as proposed by Boeing, would not identify whether the crew inputs were in opposition to each other or whether the nose wheel steering or some other system anomaly forward of the sensor caused the inputs. In addition, any jams in the controls between the pedals and the sensor may go undetected because the force exerted by the crew would not be registered by the sensor. Therefore, if the upgrade requires only a single force sensor in the rudder system, the possibility will remain that the information recorded would not be sufficient to identify some future flight control problems even after the proposed retrofit. The Safety Board appreciates that Boeing has made significant design changes in the 737 rudder system, both in the next-generation models and through retrofits to the 737-100 through -500 series airplanes. Even with these changes, however, the complexity of the 737 rudder system and its lack of redundancy provide the potential for multiple, unforeseen failure mechanisms that could be catastrophic. Incidents involving flight control anomalies continue to occur. For example, on February 23, 1999, a Boeing 737-200, registration N282AU, operated as MetroJet (USAir) flight 2710, experienced a rudder deflection and made an emergency landing at Baltimore-Washington International (BWI) airport. The airplane was equipped with an ll-parameter flight data recorder; no control surface positions were recorded and the only cockpit flight control information was control column position. Although the investigation is continuing, the pilots reported an "out of control rudder" to air traffic control, and the Safety Board's flight simulation work indicates that there was a sustained, slow moving rudder to maximum blowdown deflection during the flight that has so far remained unexplained. Further, not knowing rudder pedal force has made it impossible to separate pilot actions from rudder system anomalies. The Safety Board notes that, as it recommended, the FAA has proposed an increase in sampling rates for parameter 88, "All Cockpit Flight Control Input Forces," contained in Part 121, Appendix M, and Part 125, Appendix E, for Boeing 737 airplanes. The Board also notes that the FAA further proposes that the "remarks" section of parameter 88 should not apply to 737s. However, the "remarks" section covers more than sampling rate requirements; it also covers a requirement to record both control force inputs for those airplanes that have a flight control breakaway capability that allows either pilot to independently operate the control. This latter requirement should still apply to 737s. Although concerns had existed that current control force sensors would not meet the range and accuracy requirements of the proposed rule, suitable control force sensors are likely to be available by the compliance dates. Therefore, the Safety Board contends that separate sensors to measure the pilot and copilot flight control input forces must be used when breakaway features are employed. In summary, the Safety Board agrees with the general parameter requirements and the modified compliance dates. However, given the long and contentious history associated with uncommanded rudder movements on Boeing 737 airplanes, another catastrophic crash of a 737 in which the actions of the crew or airplane systems cannot be differentiated as the source of the rudder movement would be intolerable. Therefore, the Safety Board urges the FAA to reconsider its position and require pilot and copilot input forces to be measured with separate sensors for each control wheel, each control column, and each rudder pedal. We appreciate the opportunity to comment on this important rulemaking activity and urge the FAA to act on the Board's comments to the NPRM and to expedite the issuance of the final rule.

From: FAA
To: NTSB
Date: 6/25/1999
Response: Letter Mail Controlled 6/30/99 3:02:35 PM MC# 990699: The FAA agrees with the intent of these recommendations and will develop a notice of proposed rulemaking (NPRM) proposing to address these safety recommendations. It is anticipated that the NPRM will be published by September 30, 1999. I will provide the Board with a copy of the NPRM as soon as it is issued.

From: NTSB
To: FAA
Date:
Response: At the 1997 Most Wanted List of Transportation Safety Improvements Board Meeting, the Board voted to add Safety Recommendations H-97-18, M-95-6, and R-97-9 to the MWL in the issue area "Automatic Information Recording Devices." Safety Recommendations A-98-54, A-99-16, A-99-17, A-99-18, A-99-28, A-99-29, A-99-59, A-99-60, A-00-030, H-99-53, H-99-54, and R-98-30 were added at a later date.

From: NTSB
To: FAA
Date:
Response: At the 1995 Board meeting addressing the NTSB’s Most Wanted List of Transportation Safety Improvements (MWL), the Board voted to place Safety Recommendations A-95-26 and A-95-27 on the Federal MWL under the issue category “Flight Data Recorders: Expanded Parameters.” In 1998 the name of this category was changed to “Automatic Information Recording Devices.” It became an intermodal category at the May 5, 1998 Board meeting addressing the NTSB’s Most Wanted List of Transportation Safety Improvements, when the Board voted to add Safety Recommendations H-90-28, M-95-6, R-96-46 and R-96-47. At the 1998 MWL Board meeting, the Board voted to change the category’s name to “Automatic Information Recording Devices.” In 1999 the category was renamed "Improve Audio and Data Recorders/ Require Video Recorders" and the Board voted to add Safety Recommendations A-98-54, A-99-16, A-99-17, A-99-18, A-99-28, A-99-29, A-99-59, and A-99-60 to the category. Safety Recommendations A-00-30, A-00-31, A-03-64, and A-09-10 were added at later dates.