Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-03-049
Details
Synopsis: The primary investigative use of the data recorded on the flight data recorder (FDR) is to accurately reconstruct the performance of an aircraft prior to and during an accident or incident. However, several notable accident investigations, including the ongoing investigation of American Airlines (AAL) flight 587, have highlighted some aspects of data recording that seriously hinder using data from the FDR to evaluate the performance of an accident aircraft’s flight control systems. These data recording problems have included problems with sampling rates and problems with the filtering of recorded data.
Recommendation: TO THE FEDERAL AVIATION ADMINISTRATION: Require that all existing transport aircraft that are required to carry a flight data recorder be retrofitted with a flight data recorder system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter's dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate expected.
Original recommendation transmittal letter: PDF
Overall Status: Closed - Unacceptable Action
Mode: Aviation
Location: Belle Harbor, NY, United States
Is Reiterated: No
Is Hazmat: No
Is NPRM: No
Accident #: DCA02MA001
Accident Reports: In-Flight Separation of Vertical Stabilizer American Airlines Flight 587, Airbus Industrie A300-605R, N14053
Report #: AAR-04-04
Accident Date: 11/12/2001
Issue Date: 11/6/2003
Date Closed: 10/27/2009
Addressee(s) and Addressee Status: FAA (Closed - Unacceptable Action)
Keyword(s): Recorders

Safety Recommendation History
From: NTSB
To: FAA
Date: 10/27/2009
Response: On March 7, 2008, the FAA published a final rule, titled Revisions to Cockpit Voice Recorder and Digital Flight Data Recorder Regulations. The final rule requires that transport-category aircraft manufactured after April 6, 2010, be equipped with and use an FDR that samples data at least 8 times per second for each flight control position, flight control surface position, and flight control input force. This requirement meets the intent of Safety Recommendation A-03-48, which is classified Closed Acceptable Action. Although the FAA stated that it recognizes the benefits of increasing the sampling rates of flight control parameters on all existing aircraft as recommended in Safety Recommendation A-03-49, it decided not to make this a requirement for existing aircraft. Therefore, Safety Recommendation A-03-49 is classified CLOSED—UNACCEPTABLE ACTION.

From: FAA
To: NTSB
Date: 11/20/2008
Response: Letter Mail Controlled 12/9/2008 3:08:58 PM MC# 2080716: Robert A. Sturgell, Acting Administrator, FAA, 11/20/08 The Federal Aviation Administration published a final rule, Revisions to Cockpit Voice Recorder and Digital Flight Data Recorder Regulations (73 FR 12542), on March 7, 2008 (copy enclosed). The final rule addresses increased recording performance requirements for certain flight data recorder (FDR) parameters. For all transport-category aircraft manufactured after April 6, 2010, the final rule increases the sampling rate of certain digital FDR parameters to 8 samples per second, consistent with recommendation A-03-48. Specifically, the affected parameters are each flight control position, flight control surface position, and flight control input force. While we recognize the benefits of increasing the sampling rates of flight control parameters on all existing aircraft as recommended in A-03-49, we are unable to quantify that benefit or balance it against the costs to current operators.

From: NTSB
To: FAA
Date: 11/7/2008
Response: Notation 7592B: The National Transportation Safety Board has reviewed the Federal Aviation Administration (FAA) Supplemental Notice of Proposed Rulemaking (SNPRM), “Filtered Flight Data,” which was published at 73 Federal Register 47857 on August 15, 2008. The SNPRM proposes changes to the flight data recorder (FDR) regulations concerning the filtering of flight data. This action plus the original notice of proposed rulemaking (NPRM), which was published at 71 Federal Register 66634 on November 15, 2006, addressed Safety Recommendations A 03 48 through -50. These recommendations addresses the filtering and smoothing of flight data and were issued in November 2003 as a result of flight recorder inadequacies identified during the Safety Board’s investigation of the 2001 American Airlines flight 587 accident in New York. That investigation was hampered by the lack of accurate aircraft flight control movement data, specifically rudder movement data, during the accident sequence. For the aircraft involved in that accident, the rudder position data being supplied to the FDR were being smoothed or filtered by the aircraft’s computer systems. During normal operations, the rudder position values recorded on the FDR system appeared to be accurate and corresponded to expected movement of the rudder. During the accident sequence, however, rudder movement was extremely rapid, and because of filtering, inaccurate and incomplete rudder position values were recorded. Actual rudder positions during the full alternating rudder inputs experienced by the airplane during the later portion of the flight, could not be determined accurately even with extensive mathematical analysis and flight control system modeling. This smoothing or filtering of the recorded data led the Safety Board to issue the three safety recommendations. Accurate recording of data, particularly critical flight control and aircraft position data, is crucial to Safety Board investigations of aircraft accidents. The Board is therefore encouraged that the FAA is taking action to correct the obvious deficiencies found in some flight recorder systems in use in modern aircraft—specifically, those listed in the Board’s February 2007 response to the November 2006 NPRM. The Safety Board generally agrees with the proposed action outlined in the SNPRM and urges the FAA to adopt the final rule correcting these recorder deficiencies as soon as possible. The Safety Board is concerned, however, that in trying to define filtering, the FAA is losing sight of the ultimate goal: to ensure that flight recorder data are recorded accurately, under all conditions, both static and dynamic, and that the recorded data meet the resolution, range, and accuracy requirements set forth in Appendix M of the FDR rule. In evaluating and approving proposed flight recorder installations, the FAA needs to remain focused on how well the system operates and not on the semantics associated with the definition of filtering. Accident investigations typically involve aircraft being operated outside of normal operating envelopes. In such situations, flight controls are in many cases manipulated to the extreme limits of their motion and are typically moved at rates that are not characteristic of normal operations. In addition, if an aircraft structure or system fails during these situations, flight control surfaces can move at rates that far exceed those of normal flight. In its response to the November 2006 NPRM, the Safety Board suggested that the wording in Appendix M be changed from “maximum rate available” to “maximum rate possible” to convey the importance of having recording systems capable of accurately recording motion at rates typically experienced during an accident sequence. Again, as in 2006, the Safety Board strongly urges the FAA to use the word “possible” in the final rule language to stress the importance of this critical evaluation criterion. The Safety Board believes that the FAA must establish and publish standard methods and evaluation criteria and that these criteria must be applied equally and uniformly to all recording systems being evaluated, under all conditions. The Board is concerned that, without a standardized and uniform approval process, not all applications for approval of FDR systems will be subject to the same thorough review and analysis that is necessary to adequately evaluate filtered flight recording systems. The Safety Board will be pleased to offer any technical assistance the FAA may require in reviewing and evaluating flight recorder filtering applications. The Safety Board is also willing to work with the FAA in the development of standard criteria to evaluate proposed flight recorder systems. Subject to the changes proposed in these comments, the Safety Board urges the swift adoption of the proposed SNPRM as a final rule. The Board understands that implementation of these complex rules is a lengthy process. The Safety Board first identified this critical issue almost 7 years ago. With an implementation date of 4 years after publication of the rule, 10 to 14 years will have elapsed before some of these systems will be compliant with the 1992 flight recorder regulations governing modern flight recording systems. The Safety Board appreciates the opportunity to comment on this SNPRM proposing changes to FDR regulations concerning the filtering of flight data and looks forward to working with the FAA soon to address the concerns presented in these comments.

From: NTSB
To: FAA
Date: 2/13/2007
Response: Notation 7592A: The National Transportation Safety Board has reviewed the FAA’s Notice of Proposed Rulemaking (NPRM), “Filtered Flight Data,” which was published at 71 Federal Register 66634 on November 15, 2006. The notice proposes to amend the digital flight data recorder (DFDR) regulations to prohibit the filtering of some original parameter sensor signals. The NPRM states that it was prepared in response to safety recommendations issued by the Safety Board on November 6, 2003, following the November 12, 2001, fatal accident involving American Airlines flight 587, an Airbus A300-600, which crashed shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. These safety recommendations asked the FAA to take the following actions: Require that all newly manufactured transport-category aircraft that are required to carry a flight data recorder be fitted with a flight data recorder system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-48) Require that all existing transport-category aircraft that are required to carry a flight data recorder be retrofitted with a flight data recorder system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-49) Require that, within 2 years, all Airbus A300-600/A310 and Boeing 747-400 airplanes and any other aircraft that may be identified as recording filtered data be retrofitted with a flight data recorder system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-50) These recommendations are currently classified “Open?Acceptable Response.” In reviewing the proposed rule changes, the Safety Board is pleased that the FAA agrees that filtering of DFDR data for certain parameters is unacceptable. The Board will not discuss the provisions for increased sampling rates for some parameters, also called for in Recommendations A-03-48, -49, and -50, which the FAA has indicated that it will address in a separate flight recorder rulemaking action. The importance of prohibiting filtering was discussed when the DFDR data sources for the Boeing 777 were being selected. Boeing consulted with the Safety Board to determine if the filtered accelerometer output from the inertial guidance system would be a suitable source for the DFDR acceleration parameters on the B777, thinking that the noise-free filtered signal would be an enhancement over the noisier analog device normally used. The Board responded that filtering might remove signal characteristics used to identify events such as brake release runway surface departure and touchdown that can be critical to an investigation. Boeing agreed, and then changed the signal providing data to the DFDR from filtered to unfiltered. The Safety Board is concerned that unless a parameter is specifically prohibited from being filtered, manufacturers will not consult with the regulatory or investigative authorities on the suitability of a filtered signal as a DFDR input, but will choose data sources based solely on convenience of installation. Although the Safety Board agrees with the FAA’s approach, which proposes to remove ambiguity in the rule pertaining to the parameter filtering prohibitions, the Board believes that the list of parameters prohibited from filtering is missing a significant number of critical parameters that could be distorted by filtering. In addition, filtering can introduce random timing biases that can change the timing of one parameter relative to another. Accordingly, the table below lists the specific parameters that the Safety Board proposes be added to those that are prohibited from filtering. No. Parameter Name Discussion 1 Time Investigators generally examine the timing of DFDR data to the fraction of a second; therefore, any distortion in the reference time could adversely affect the investigators’ conclusions. 2, 3 Pressure Altitude Indicated Airspeed The raw output from the Air Data Computer or air data device used to process pitot static pressure, which already processes the data, must not be filtered. In past investigations, pressure anomalies that would be eliminated by filtering have provided critical evidence. 5, 11, 18 Normal, Lateral, and Longitudinal Acceleration Filtering has the potential of removing short-term aberrations critical for identifying touchdown, brake release, runway departure, and other data. 4, 6, 7 Heading, Pitch, and Roll Filtering of these signals could compromise the angular velocity terms that are computed from these parameters. Accurate calculations of body angular rates are needed to calculate the kinematics consistency of many DFDR parameters. Filtering of these data, which could compromise the results of calculations where body angles are combined with other parameters to derive non-recorded values such as sideslip angle. 26 Radio Altitude Filtering could eliminate short-term aberrations that could provide timing for the passage of obstructions or objects along the flight path. Time-derivative altitude (rate of climb) could be in error if filtered. Radio altitude is the most accurate measurement of altitude during takeoff and landing when the aircraft is in ground effect. 32 Angle of Attack Sudden short-term changes in angle of attack, which can be indicative of wind gusts (windshear) and the precise onset of stall, may be eliminated or distorted by filtering. 68 Brake Pressure Filtering of this brake pressure could produce a time offset that would impact the determination of time of brake application, which can be critical in landing overruns and takeoff abort accidents. 70 Yaw or Sideslip Angle Sudden short-term changes in this parameter, which may be indicative of air mass changes, may be eliminated or distorted if filtered. 77 Hydraulic Pressure Sudden short-term changes that could indicate the health and behavior of hydraulic pressure and related systems may be eliminated or distorted by filtering. Although the proposed change to Appendix M helps eliminate any ambiguity in the intent of the language, the Board feels that the following change to the FAA’s proposed language is also needed. Appendix M to Part 121-Airplane Flight Recorder Specifications The recorded values must meet the designated range, resolution, and accuracy requirements during static and dynamic conditions. Dynamic conditions means the parameter is experiencing change at the maximum rate available possible, including the maximum rate of reversal. Finally, the Safety Board notes its agreement with the concerns expressed by the FAA regarding Airbus’s approach to the A320 rudder position-filtering problem (page 66639 of the NPRM). These concerns are that (1) Airbus’s solutions for correcting the A320 rudder position-filtering problem are complex and expensive and that (2) Airbus has been unwilling to provide another solution. Because the rudder is the only flight control that will function in the event of a total fly-by-wire flight control system failure, rudder position has the potential to be the most critical parameter in investigating a possible malfunction with the aircraft’s fly-by-wire flight control system. The Safety Board urges the FAA to work with Airbus to resolve these issues so that the filtering problem can be corrected in existing aircraft in a timely manner. The Safety Board understands that industry may oppose the retrofit requirements specified in the proposed rule due to cost concerns, which are particularly applicable to the A320 family of aircraft. The Safety Board cautions the FAA that the more important concern is that by not bringing all existing aircraft into compliance with data filtering requirements, future accidents may occur for reasons that might elude investigators who are unable to obtain timely and accurate flight performance data for existing aircraft. In addition to ensuring the compliance of existing aircraft models, the Safety Board urges the FAA to vigilantly monitor future aircraft designs and modifications to forestall any misinterpretation of existing or proposed flight recorder rules concerning data filtering. The Safety Board appreciates the opportunity to comment on this NPRM.

From: NTSB
To: FAA
Date: 4/29/2005
Response: [On 2/28/2005, FAA issued an NPRM addressing this issue. The Board's comments on the NPRM, as it relates to this recommendation, follow] The Safety Board is encouraged by the FAA's proposal to increase the sampling rate of flight control parameters for newly manufactured aircraft, as called for in safety recommendation A-03-048. The Board is disappointed, however, that the proposed rule does not address existing aircraft as called for in recommendation A-03-49. Recommendations A-03-48 and A-03-49 seek to improve the capability of FDR systems on both new and existing transport-category aircraft by taking full advantage of the increased storage capacity of modern solid-state recorders to capture data at "a frequency sufficient to determine a complete, accurate and unambiguous time history of parameter activity, with emphasis on capturing each parameter's dynamic motion at the maximum rate possible." Because flight controls are typically the most dynamic parameters, the proposed rule goes a long way toward satisfying recommendation A-03-48. However, by not including a retrofit requirement or a requirement to include other under-sampled parameters, the proposed rule falls short. The Safety Board would welcome the opportunity to work with the FAA to identify other aircraft-specific parameters that may be under-sampled. Our experience with FDR data suggests that the number of under-sampled parameters, other than flight controls, is relatively small and would be confined to unique or novel features of a given make and model aircraft. Notation 7712: The National Transportation Safety Board has reviewed the Notice of Proposed Rulemaking (NPRM), “Revisions to Cockpit Voice Recorder and Digital Flight Data Recorder Rules,” which was published in the Federal Register (Vol. 70, No. 38) on February 28, 2005. The notice proposes to increase the duration of the cockpit voice recorder (CVR) and flight data recorder (FDR) recordings, increase the sampling rate of certain FDR parameters, require physical separation of the FDR and CVR, require improved reliability of the CVR and FDR power source, and require the recording of data-link-communications. Recommendations discussed in the NPRM, but rejected or not addressed by the proposed rulemaking, are the use of forward- and aft-mounted combination voice and data recorders and additional flight control parameters for Boeing 737 airplanes. The NPRM does not address the Board’s image recorder recommendations. However, the NPRM does mention the security benefits of deployable recorders, a subject not addressed in any Safety Board recommendations. The summary of the NPRM states that it was prepared in response to a series of safety recommendations issued by the Safety Board following a number of accidents and incidents from 1995 to 2000. These safety recommendations asked the FAA to take the following actions: Amend, by December 31, 1995, 14 Code of Federal Regulations (CFR) 121.343, 125.225, and 135.152 to require that Boeing 727 airplanes, Lockheed L-1011 airplanes, and all transport category airplanes operated under 14 CFR Parts 121, 125, or 135 whose type certificate applies to airplanes still in production, be equipped to record on an FDR system, as a minimum, the parameters listed in “Proposed Minimum FDR Parameter Requirements for Airplanes in Service” plus any other parameters required by current regulations applicable to each individual airplane. Specify that the airplanes be so equipped by January 1, 1998, or by the later date when they meet stage 3 noise requirements but, regardless of stage 3 compliance status, no later than December 31, 1999. (A-95-26) Require all aircraft currently required to be installed with a CVR to be retrofitted within 2 years with a CVR installation designed such that an uninterrupted recording from the boom or mask microphones and headphones for each flight crewmember’s position and from an area microphone can be made on dedicated channels of the CVR. A sidetone shall be produced only when the transmitter or interphone is selected, and, in addition, all audio signals received by hand-held microphones shall be recorded on the respective crewmember’s channel when keyed to the “ON” position. (A-96-89) Require that all newly manufactured CVRs intended for use on airplanes have a minimum recording duration of 2 hours. (A-96-171) Require retrofit after January 1, 2005, of all CVRs on all airplanes required to carry both a CVR and a FDR with a CVR that (A) meets Technical Standard Order (TSO) C123a, (B) is capable of recording the last 2 hours of audio; and (C) is fitted with an independent power source that is located with the digital CVR and that automatically engages and provides 10 minutes of operation whenever aircraft power to the recorder ceases, either by normal shutdown or by a loss of power to the bus. (A-99-016) Require all aircraft manufactured after January 1, 2003, that must carry both a CVR and a digital flight data recorder (DFDR) to be equipped with two combination CVR/DFDR recording systems. One system should be located as close to the cockpit as practicable and the other as far aft as practicable. Both recording systems should be capable of recording all mandatory data parameters covering the previous 25 hours of operation and all cockpit audio including controller-pilot data-link messages for the previous 2 hours of operation. The system located near the cockpit should be provided with an independent power source that is located with the combination recorder, and that automatically engages and provides 10 minutes of operation whenever normal aircraft power ceases, either by normal shutdown or by a loss of power to the bus. The aft system should be powered by the bus that provides the maximum reliability for operation without jeopardizing service to essential or emergency loads, whereas the system near the cockpit should be powered by the bus that provides the second highest reliability for operation without jeopardizing service to essential or emergency loads. (A 99 017) Amend Title 14 CFR Parts 25.1457 (CVRs) and 25.1459 (FDRs) to require that CVRs, FDRs, and redundant combination flight recorders be powered from separate generator buses with the highest reliability. (A-99-018) Although not specifically referenced, the NPRM contains rule changes that partially address the following flight recorder recommendations: Require that all newly manufactured transport-category aircraft that are required to carry an FDR be fitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-048) Require that all existing transport aircraft that are required to carry an FDR be retrofitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate expected. (A-03-049) Require that within 2 years, all Airbus A300-600/A310 and Boeing 747-400 airplanes and any other aircraft that may be identified as recording filtered data be retrofitted with an FDR system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-050) The following flight recorder recommendations that call for rulemaking were not addressed in this NPRM: Require that all Boeing 737 airplanes operated under 14 CFR Parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with an FDR system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-028) Require that all Boeing 737 airplanes operated under 14 CFR Parts 121 or 125 that are not equipped with a flight data acquisition unit be equipped, at the earliest time practicable but no later than August 1, 2001, with an FDR system that records, at a minimum, the parameters required by FAA final rules 121.344 and 125.226, dated 7/17/97, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-029) Require that all aircraft operated under Title 14 CFR Part 121, 125, or 135 and currently required to be equipped with a CVR and DFDR be retrofitted by January 1, 2005, with a crash-protected cockpit image recording system. The cockpit image recorder system should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by the people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. The cockpit image recorder should be mounted in the aft portion of the aircraft for maximum survivability and should be equipped with an independent auxiliary power supply that automatically engages and provides 10 minutes of operation whenever aircraft power to the cockpit image recorder and associated cockpit camera system ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder system, as well as the circuit breakers for the CVR and the DFDR, should not be accessible to the flight crew during flight. (A-00-030) Require that all aircraft manufactured after January 1, 2003, operated under Title 14 CFR Part 121, 125, or 135 and required to be equipped with a CVR and DFDR also be equipped with two crash-protected cockpit image recording systems. The cockpit image recorder systems should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. One recorder should be located as close to the cockpit as practicable and the other as far aft as practicable. These recorders should be equipped with independent auxiliary power supplies that automatically engage and provide 10 minutes of operation whenever aircraft power to the cockpit image recorders and associated cockpit camera systems ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker of the cockpit image recorder systems, as well as the circuit breakers for the CVRs and the DFDRs, should not be accessible to the flight crew during flight. (A-00-31) The Safety Board recognizes that the FAA’s proposed revisions attempt to increase the capability and survivability of CVR and FDR systems while imposing minimum financial burdens on the industry. However, the Board is concerned that the failure to address many of the more significant recorder recommendations at this time will ultimately result in a larger economic obligation for industry and may delay implementation of the associated safety improvements. This is particularly true for the Airbus A380 and Boeing 787, which are in pre-production, making this an ideal opportunity to implement dual combined recorders as well as cockpit image recording. 2-Hour CVR The Safety Board applauds the FAA’s proposed action to require that all CVRs record a minimum of 2 hours of audio information. The Board has cited in its recommendations many accidents and incidents where the existing 30-minute CVR recorder duration was not sufficient. The Board also endorses the timeline set forth in the NPRM that requires all newly manufactured aircraft to be equipped with a 2-hour CVR within 2 years of the rule date. The Board also agrees that the 4-year phase-in that was proposed to retrofit the existing fleet is appropriate and will not cause undue hardships in the aviation community. All of the manufacturers of CVRs in the United States currently produce a 2-hour model that meets the crash and survivability specifications set forth in the FAA’s TSO-123a. In addition, several manufacturers offer a lower cost upgrade to an existing 30-minute CVR to increase the record duration to 2 hours. Magnetic Tape Obsolescence The proposed rulemaking action, although not as timely and extensive as recommended, addresses some significant and longstanding safety concerns. The proposed requirement for a 2 hour CVR recording will allow for a more thorough and accurate investigation of non-catastrophic occurrences as well as accidents that evolve over time periods greater than 30 minutes. This rule change will also significantly increase the crash fire survivability and reliability of the CVR because it will, in effect, eliminate magnetic tape CVRs that only meet TSO C-84 or C-51a standards, which were introduced in the 1960s. The Safety Board is encouraged by the FAA’s recognition of the need to eliminate magnetic tape as a CVR recording medium. The NPRM notes the “vulnerability to damage and decreased reliability” and the dwindling supply of magnetic tape. This same reasoning can be applied to TSO C-51a magnetic tape FDRs; unfortunately, the rule changes do not call for the elimination of magnetic tape FDRs. Magnetic-tape FDRs, which record in the digital format, have in fact been more problematic than magnetic-tape CVRs, which record in a more robust analog format. For both FDRs and CVRs, operators are finding it cost-effective to replace tape-based recorders with solid-state models. However, a relatively small number of operators continue to use magnetic tape FDRs, with decreasing reliability and inadequate crash and fire protection. Manufacturers estimate that they have a 2- to 3-year supply of spare parts for critical hardware such as drive motors and belts, recording heads, and the tape itself. The vendors for these items have either stopped production or gone out of business. In the very near term, operators using magnetic tape FDRs will be forced to replace unserviceable FDRs with solid-state-equivalent FDRs or continue to fly with marginally serviceable FDRs. One recorder manufacturer estimates that approximately 2,500 of their magnetic tape FDRs are in service and nearly all are installed on third-tier carriers operating older aircraft such as DC-8s, Boeing 727s, and 707s. Therefore, the Safety Board proposes that the FAA add the following language to replace magnetic tape FDRs with recorders that meet TSO C-124a: Part 121.343 (g): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 121.344 (m): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 125.225 (j): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 129.20 (b): After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Part 135.152: (l) After (insert date 4-years from effective date of final rule), whenever a flight recorder required by this section is installed, it must meet the requirements of TSO C124a or later version. Recording of Data-Link Communications The Safety Board is pleased that the FAA has proposed rules for the recording of data-link communications. The Board believes that the in-flight recording of data-link communications presented to and transmitted by the flight crew will become as vital to future investigations as CVR information has proven to be. In addition to accident investigations, this information could play an important role in troubleshooting technical problems that may arise as data-link communications play an ever-increasing role in air traffic management. The NPRM preamble quite correctly points out the importance of capturing data-link communication at the proper locations within the communications system, and the rule clearly spells that out in the following text: “output from the communications unit that translates the signal into usable data.” However, the rule language is somewhat ambiguous as to what must be recorded. Fortunately, the preamble clearly defines what must be recorded as follows: (1) the message priority assignment; (2) the number of messages in uplink/downlink queues; (3) the content of all messages generated by the flight crew; (4) the time each downlink message is generated (that is, when the flightcrew selects “send”); (5) the time any message is available for display to the flight crew; and (6) the time any message is actually displayed to the flight crew. The Safety Board believes that the rule language must contain these vital recording requirements in order to remove any ambiguity as to what must be recorded. Not including this level of detail in the rule language would create an opportunity to misinterpret the intent of the rule, which could result in an installation that would be of little use to investigators. Further, the data-link portion of the preamble also states that “the FAA was unable to propose a practical, feasible method of capturing ‘what the pilot sees’ off the actual cockpit display” and that “there is no developed technology for reliable recording of information.” However, the Safety Board is of the opinion that an image recording of the cockpit display could provide specifics as to what data-link communications are displayed to and generated by the flight crew and when those messages are displayed or sent. An image recording would also indicate the quality of the display. Adding a properly placed cockpit video camera would allow data link messages displayed to the crew to be recorded on the image recorder. The use of video technology would not require any modifications to the existing aircraft’s communication or display systems. This addition might greatly reduce the time and expense of retrofitting older aircraft to record data-link messages. The Safety Board is also concerned with proposed data-link rule language that states, “[Each cockpit voice recorder … will record the following:] If data-link communication equipment is installed, all data-link communications, using an approved data message set.” Currently the FAA has not approved any data-link message sets, nor has it issued any guidance as to how to determine if a given message set is approved. An advisory circular or other guidance material is clearly needed to define what messages to record. In addition, the proposed operational requirements call for the recording of data-link communications 2 years after data-link equipment is installed. The Safety Board sees no reason to delay the requirement for 2 years when the installed communications equipment should have the capability of outputting the required data-link messages to the voice recorder at the time of installation. Therefore, the Safety Board suggests the following changes to the proposed rule language: Change the appropriate paragraphs of Parts 23, 25, 27, and 29 as follows: If data-link communications equipment is installed, all data-link communications must use an approved data message set that must be recorded so that the following can be determined: (1) the message priority assignment; (2) the number of messages in uplink/downlink queues; (3) the content of all messages generated by the flightcrew; (4) the time each downlink message is generated (that is, when the flightcrew selects “send”); (5) the time any message is available for display to the flight crew; and (6) the time any message is actually displayed to the flight crew. The timing of all message traffic must have a minimum resolution of 1 second. Boeing 737 FDR Recommendations The NPRM references safety recommendations A-95-25 through -27, A-99-28, and A 99 29, which called for additional flight control parameters for the Boeing 737. The NPRM also references the 1999 NPRM associated with these recommendations. However, because this NPRM does not propose any rule changes associated with these recommendations, and because no action appears to have been taken on the 1999 NPRM in the nearly 5 years since it was issued, the Safety Board is concerned that the FAA plans to take no further action on these recommendations. Therefore, the Safety Board must reiterate its commitment to these recommendations and urge the FAA to take action on them. Dual Combined FDR/CVR Recorders In regard to dual combined FDR/CVR recorders, one mounted near the cockpit and the other as far aft as practicable, the Safety Board takes exception to the NPRM statement that, “After a careful analysis of the benefits of having two systems, the FAA is unable to justify the excessive cost that would be incurred in the installation of two complete systems.” Although recommendations A-99-017 and A-00-031 specify two combined (CVR/FDR) recording systems, the intent of these recommendations was to have two redundant recorders—not to require two flight data acquisition units and two sets of cockpit microphones. If the FAA’s analysis included “two complete systems,” as the NPRM states, the cost estimates would be unnecessarily inflated. However, the Safety Board does not agree with the NPRM statement that “in the case of an accident so catastrophic that neither recorder survives [meaning the currently required, aft-mounted recorders], a second set of recorders located in the front of the aircraft would probably not survive either.” In fact, there are a number of instances in which the circumstances of a catastrophic accident could have resulted in a forward-mounted recorder surviving and the aft-mounted recorder being lost to fire or impact. One example is the Air France Airbus A320, which crashed in Strasburg, France, in 1992. In this accident, the aft-mounted FDR was destroyed by fire while the unprotected quick-access recorder mounted below the cockpit survived. Another example is the crash of a Lauda Air Boeing 767 in Thailand in 1991; in this accident, the aft-mounted recorder was lost to fire while the unprotected, solid-state memory located on the engines survived. It should be noted that fire has proven to be more destructive to solid-state recorders than crash impact, and the only complete losses of solid-state flight recorder data have been due to fire. Solid-state recorders have proven to be quite resistant to impact damage, even surviving the very severe impact sustained during the September 11, 2001, crashes. The NPRM also implies that a crash resulting in the loss of an aft-mounted recorder would most certainly result in the loss of a forward-mounted recorder. Accident history does not support this position, as illustrated in those accidents in which the aft-mounted recorders were lost. The explosion of Pan Am Flight 109, a Boeing 747 over Lockerbie, Scotland, separated the cockpit, which landed relatively intact far clear of the burning fuselage wreckage. In the United Airlines DC10 crash in Sioux City, Iowa, the cockpit separated but maintained enough structural integrity to allow the cockpit crew to survive; it is logical to conclude that forward-mounted recorders would also have survived the accident. In the 1996 Boeing 757 accident in Cali, Columbia, which involved a controlled collision with terrain, vital information was recovered from the unprotected solid-state memory in the Flight Management System unit located under the cockpit. In numerous accident scenarios, forward-mounted recorders could have survived, even though aft-mounted recorders might have been destroyed by post-crash fire (for example, during ground collisions, takeoff abort overruns, landing overruns, and approach and landing accidents). The second reason for placing a combined CVR/FDR as close to the cockpit as practicable is to ensure an acceptable recording of the cockpit acoustic environment if the wiring to the aft-mounted CVR is compromised as the result of a progressive fire, explosive decompression, structural failure, or uncontained engine failure. Such occurrences may not result in the immediate loss of the aircraft. For Swiss Air Flight 111, which crashed in Halifax, Nova Scotia, in 1998, the flight continued for about 6 minutes after the CVR stopped. Had the MD-11 involved in flight 111 been fitted with a forward-mounted CVR and a recorder independent power supply as proposed in this NPRM for newly manufactured aircraft, it is possible that the acoustic environment of the cockpit could have been recorded for the final critical minutes of the flight. Value Jet flight 592, which crashed in Miami, Florida, in 1996, also experienced an in-flight fire, in this case causing the CVR and FDR to stop approximately 40 to 50 seconds prior to the crash. In both cases, a forward mounted combined CVR/FDR fitted with a recorder independent power supply (RIPS) would have provided the best opportunity to record the audio environment of the cockpit. To summarize the Safety Board’s position on combined CVR/FDRs, longstanding accident investigation experience indicates that the enhanced crash/fire survivability of TSO C123a and C124a flight recorders and the use of combined CVRs/FDRs, one mounted near the cockpit and the other mounted as far aft as practicable, will greatly improve the likelihood of survivability and recording of critical flight recorder data following a catastrophic accident. All three recorder manufacturers agree with this position, as do airframe manufacturers, Boeing and Embraer. Embraer, in fact, is currently delivering its model EMB-170/190 to U.S. operators with forward- and aft-mounted combined CVR/FDRs, and Boeing is currently considering a similar design in its new 787 aircraft. Therefore, the Safety Board proposes the following rule language: For Parts 23, 25, 27 and 29, add the following to the end of (b): When two combined voice and data recorders that record the same data are installed, one recorder must be mounted as close to the cockpit as practicable so as to minimize the signal path between the cockpit microphones and the recorder. The forward-mounted recorder must be fitted with a recorder independent power supply that provides 10 minutes of uninterrupted power to the CVR system following the loss of recorder power for any reason. For Parts 91, 121, 125, 129, 135, add the following language: Newly manufactured aircraft after (insert date 2 years from the effective date of this final rule) that are required to carry both a CVR and an FDR must be fitted with two combined CVR/FDRs that meet the requirement of 23.1457 or 25.1457 of this chapter. Recorder Independent Power Supply The Safety Board is pleased that the FAA plans to require the installation of a 10-minute independent power source for the CVR that will engage when electrical power to the CVR is lost. However, the Board is disappointed that this requirement will apply only to newly manufactured aircraft. The Board believes that a 4-year retrofit similar to that being considered for the 30-minute-to-2-hour CVR conversion should also be applied to RIPS. The benefits gained from a CVR independent power supply vastly outweigh the additional costs. In fact, incorporating RIPS into the recorder chassis, as is being proposed by one recorder manufacturer, would significantly reduce installation and hardware costs, especially if the operator replaces an older, 30-minute tape CVR with a new 2-hour recorder. A different option is to mount RIPS under the existing CVR mounted tray, a means currently employed by another CVR manufacturer. This installation would be totally self-contained and would not require any modifications to the aircraft. In addition, the rule language fails to require that the independent power supply be colocated with the CVR so as to minimize the opportunity for a mechanical disconnect between the recorder and the independent power supply. Therefore, the Safety Board proposes that Parts 23.1457, 25.1457, 27.1457 and 29.1457 be changed by adding the following text at the end of (d)(5)(ii): “As far as practicable, the independent power supply must be colocated with the CVR to eliminate the possibility of an electrical disconnect.” The Safety Board also suggests that the operating rules be changed to require the installation of a CVR independent power supply 4 years after the date of the final rule. Separate Power for CVR and FDR The Safety Board notes that the proposed rule changes agree with the Board’s recommendation that the FDR and CVR be on separate generator busses with the highest reliable power so that any single electrical failure does not disable both the CVR and FDR. However, the Board also notes that the proposed rule language applies to newly manufactured aircraft only, even though the recommendation was aimed at existing aircraft as well. The Board believes that most existing aircraft meet this requirement and that any retrofit requirement will have minimal economic impact. Therefore, the Safety Board requests that this rule change apply to existing aircraft as well. CVR and FDR Start-Stop Criterion The Safety Board appreciates the efforts of the FAA to correct some ambiguities and deficiencies in the existing flight recorder rule language. These corrections include changing the CVR operating rules to require that the CVR operate from the start of the checklist, before the first engine is started, and requiring separate containers for the FDR and CVR. These changes are worthwhile and will help ensure the capture of information that otherwise would have been lost. In addition, the Safety Board would like to use this opportunity to suggest removing some of the legacy requirements that are no longer relevant to modern, solid-state recorders, or those requirements that have proven ineffective or detrimental. Included among these changes are the “start-stop” criterion for the FDR and the automatic means of stopping the voice recorder 10 minutes after crash impact. The current rule requires that the FDR be operated from the start of takeoff roll until it has completed the landing roll. This operational requirement was designed to maximize the supply of the expendable metallic recording medium used by the very first FDRs introduced in the late 1950s. Most airframe manufacturers and operators ignored this provision in the rules and, for the most part, operated the FDR shortly after engine start. However, at least one manufacturer connected the FDR power through the parking brake so that the FDR was turned off when the brake was set. The February 2, 2005, accident at Teterboro, New Jersey, involving Canada Air Challenger CL-600, has identified another problematic FDR start criterion. In this instance, the FDR electrical power was applied when the anticollision (strobe) light switch was placed in the “on” position. The failed logic was that the crew would always turn the anticollision lights on before taking the active runway. Unfortunately, in this case, that did not occur and critical FDR data covering the takeoff abort were not recorded. The Board believes that this method of powering the FDR should be prohibited. In recent years, most aircraft manufacturers have connected the FDR power to engine oil pressure, which automatically triggers electrical power to the FDR when engine oil pressure is sensed on any engine. Automatically starting the FDR provides some assurance that the FDR will record a partial engine start for the first engine started, the complete engine start for the remaining engines, and the continued operation of the aircraft until no engine oil pressure is sensed and the aircraft is on the ground. Therefore, the Safety Board suggests that the respective operating rules be updated to require that the FDR be operated before engine start for the purpose of flight or provide an automatic means of starting the FDR when engine oil pressure is sensed on any engine, and that the FDR operate continuously until termination of the flight when all engines are shut down. Although the regulations do not require an automatic means of powering the FDR at takeoff if it is not powered prior to the transition from ground to air, the Safety Board is unaware of any aircraft that is not so equipped. This safeguard has proven very beneficial in a number of accidents and incidents where the FDR was not powered prior to liftoff. Therefore, to ensure that this practice continues, the Board suggests that the airworthiness requirements in the regulations be changed to provide for the automatic application of electrical power to the FDR at liftoff to safeguard against the failure of any automatic or manual means of powering the FDR. The Safety Board would also like to suggest that, because the proposed rule change replaces the 30-minute CVR with a 2-hour CVR, the requirement that the CVR have an automatic means of stopping the recording within 10 minutes after a crash impact is less important and may be removed. To accomplish this, some airframe manufacturers have installed an accelerator-sensing switch (“G” switch), which stops a CVR in the event of a crash. The Safety Board’s experience with use of the “G” switch to sense a crash and in turn stop the recorder has been negative. In at least two accidents, the “G” switch was prematurely tripped, and as a result, the CVR was not operating at the time of the accidents. In these accidents, activation of the “G” switch resulted in the loss of valuable information about the final seconds of the accident or the circumstances surrounding the post-accident evacuation. Other international safety investigation agencies share the Safety Board’s reservations concerning the “G” switch. This sentiment was expressed in the March 2003 European Organisation of Civil Aviation Electronics (EUROCAE) ED 112 document, “Minimum Operational Performance Specification for Crash Protected Airborne Recorders Systems,” which updated the minimum manufacturing specifications for accident flight data and voice recorders; it stated that If required by operational rules, acceptable means of stopping the recorder after an accident include: i. detection of loss of oil pressure on all engines together with loss of airspeed. ii. airframe crash sensors, iii. water immersion sensors e.g. to detect ditching of a helicopter. Negative acceleration sensors (e.g. switches) shall not be used because their response is not considered to be reliable. The Safety Board believes that, with the introduction of 2-hour CVRs, the need for the traditional “G” switch is no longer necessary. In most of the incidents and accidents investigated by the Board, it would be far better not to have any automatic means of shutting down the 2-hour CVR when a crash is sensed due to the risk of losing valuable information resulting from a premature “G” switch activation. The costs associated with disabling or removing a “G” switch, which could be accomplished at the same time as the retrofit of the 2-hour CVR, would be minimal. The Safety Board therefore requests that Part 23.1457, 25.1457, 27.1457 and 29.1457, be changed to remove section (d)(2). Hot Boom Mikes Since October 11, 1991, most CVR installations have required the recording of audio signals received by a boom or mask microphone. Additionally, the flight crew has been required to wear boom microphones when operating aircraft below 18,000 feet mean sea level. The addition of boom microphone audio information has dramatically assisted the Safety Board in its use of recorded audio. The resulting audio is normally of such quality that the Board has been able to use it to perform extensive human performance analysis, including examination of pilot stress by measuring changes to breathing rate or spoken words throughout the flight. Additionally, use of boom microphone audio information has in part enabled Board investigators to identify psychological abnormalities, including hypoxia, drug or alcohol impairment, strokes, and heart attacks. Although this information is available to the Board on aircraft that were manufactured or equipped after October of 1991, most aircraft in the fleet are not equipped nor required to be equipped with pilot boom microphones. The Board views the installation of the new 2-hour CVR as an ideal opportunity for standardizing all CVR installations on large aircraft by requiring that all aircraft equipped with a CVR be equipped with pilot boom microphones. Therefore, the Safety Board proposes that the rule language be changed to provide for the following: that within 4 years of the effective date of the final rule, all aircraft that are required to carry a CVR be capable of recording the uninterrupted audio signals received by a boom or a mask microphone in accordance with Part 25.1457(c)(5). Increased Sampling Rate for Flight Controls The Safety Board is encouraged by the FAA’s proposal to increase the sampling rate of flight control parameters for newly manufactured aircraft, as called for in safety recommendation A-03-048. The Board is disappointed, however, that the proposed rule does not address existing aircraft as called for in recommendation A 03 49. Recommendations A-03-48 and A-03-49 seek to improve the capability of FDR systems on both new and existing transport-category aircraft by taking full advantage of the increased storage capacity of modern solid-state recorders to capture data at “a frequency sufficient to determine a complete, accurate and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible.” Because flight controls are typically the most dynamic parameters, the proposed rule goes a long way toward satisfying recommendation A-03-48. However, by not including a retrofit requirement or a requirement to include other under-sampled parameters, the proposed rule falls short. The Safety Board would welcome the opportunity to work with the FAA to identify other aircraft-specific parameters that may be under-sampled. Our experience with FDR data suggests that the number of under-sampled parameters, other than flight controls, is relatively small and would be confined to unique or novel features of a given make and model aircraft. Cockpit Image Recording The Safety Board is disappointed that this rulemaking effort did not provide for cockpit image recording. In its June 2, 2002, response to safety recommendations A-00-30 and 31, which called for cockpit image recorders on Part 121, 125, and 135 aircraft, the FAA stated that “the issue of installation of crash-protected video recording equipment in airplanes and the appropriate time frame for the installation should be submitted to the RTCA Future Flight Data Collection Committee for consideration.” Accordingly, the RTCA subcommittee, jointly chaired by the FAA and the Safety Board, conducted a series of meetings attended by a wide range of representatives from government, industry, and labor. In its fall 2001 report, the subcommittee concluded that image recorder technology existed or could be made available to meet the Safety Board recommendations. Labor opposed the installation of cockpit image recorders citing privacy concerns. The FAA’s response also mentioned the efforts of EUROCAE to develop minimum operational performance specifications for image recorders and the FAA’s willingness to incorporate the standards into a TSO. EUROCAE ED-112 contains specifications for image recorders for the types of cockpit image recordings called for in safety recommendations A 99 59, A 99 60, A 00 30, and A 00 31. In July 2004, the Safety Board conducted a 2-day public hearing on aviation image recording. The FAA participated as a party to the hearing and also provided a number of witnesses. Other participants included labor, industry, and the U.S. military. The hearing produced testimony highlighting the benefits of image recording and the capability of existing technology to implement cockpit image recorders. The Safety Board’s image recorder recommendations list numerous case histories where image recorders would have provided vital information that could have yielded in-depth information about the facts, conditions, and circumstances surrounding those accidents. The investigations conducted by the Board and other governments since the issuance of these recommendations further strengthen our opinion that cockpit image recorders can play a key role in accident investigations by providing critical human performance and cockpit environment information that is otherwise unavailable. The Safety Board therefore encourages the FAA to move quickly to implement the Safety Board’s cockpit image recorder recommendations. Closing Remarks Although the Safety Board is pleased with some of the more significant rule changes in the NPRM, including, among other improvements, the 2-hour CVR, increased sampling of flight control parameters, recording of data-link messages, and the considerable effort to clarify some longstanding technical issues, we are disappointed with the lack of some retrofit requirements, the rejection of recommendations for installing forward- and aft-mounted combined CVR/FDR recorders, and the FAA’s failure to address image recording. In addition, the Safety Board hoped this rulemaking effort would take full advantage of this opportunity to require implementation of dual combined voice data and image recorders in the Airbus A380 and Boeing 787 while both were in pre-production, when installation costs would be at a minimum. Although the proposed NPRM represents a step forward by addressing several CVR and FDR issues, the Safety Board remains committed to all outstanding recorder recommendations and encourages the FAA to move quickly to implement them. The Safety Board reiterates its position that by taking action now on many of the more significant recorder recommendations, the FAA will enable aircraft manufacturers to save money while implementing important safety improvements.

From: NTSB
To: FAA
Date: 5/10/2004
Response: The Safety Board notes that the FAA agrees with the intent of these safety recommendations and that a staff level meeting between the FAA and the Board is planned to clarify several questions, including specification of the parameters of concern. Pending completion of the recommended actions, Safety Recommendations A-03-48 and -49 are classified OPEN—ACCEPTABLE RESPONSE.

From: FAA
To: NTSB
Date: 2/2/2004
Response: The Federal Aviation Administration (FAA) agrees with the intent of these safety recommendations regarding the requirement for increased rates for certain parameters to ensure that they are recorded at a sufficient rate to accurately determine the dynamic motion of those parameters. Our staffs are planning to meet shortly to clarify several questions related to these recommendations, including specification of the parameters of concern. The FAA will work with the Board's staff to discuss the best approach to ensuring that the recorded data will provide sufficient information to determine the aircraft's flight characteristics accurately during an accident investigation.