The
International Aviation Safety Association
Message from:
safety@iasa-intl.com
Wed, Jun 3, 2009 — David Evans
Articles
With some of the wreckage of
Air France flight 447 now spotted
floating on the waters of the
Atlantic Ocean, the search is on for
the submerged cockpit voice and
flight data recorders (CVR/FRD). The information hopefully
recorded should shed light on what happened the night of 31 May to bring the
jetliner down amidst severe convective weather (see Aviation Safety Journal,
‘Difficulty Locating Lost Jet’s
Flight Recorders
Shows Need for Upgraded Technology’).
If the recorders are located a day, a week, two weeks from now – or never
located in the 13,000 feet of water – the technology exists to already have the
data and cockpit conversations in hand, though the offloading of the information
through satellites and onto one or more ground stations. The concept was first
articulated about ten years ago by Contributing Editor John Sampson, and others
have been pushing for it as well, including Sy Levine. He has argued that
bandwidth is not a problem, and that the amount of data offloaded from thousands
of commercial jetliners will not clog the system.
The National Transportation Safety Board (NTSB) has not called for transmitting
CVR/FDR data while in flight, or moments before a crash. The Board, rather, has
called for dual cockpit voice and flight data recorders to be installed in the
front and aft ends of the airplane, with improved electric power supplies. This
recommendation focuses on getting good data recorded in the first place, but it
leaves the next obvious question unanswered: what is the purpose of recording
great data if it sits at the bottom of the ocean, in a trackless jungle, or on
the windswept arctic tundra. Reading, analyzing and acting upon what is recorded
on the CVR/FDR is the important thing.
The NTSB has not made comparable recommendations to ensure that CVR/FDR data is
broadcast electronically so that it is retrieved quickly for use by
investigators.
The technology exists to do so, has already been implemented by the
U.S. military
for some of its airplanes, and is found in limited application in the civilian
aviation sector. But it has not been put in place for commercial airliners,
despite the fact that jet engines on commercial jets already feature modules
that broadcast in real-time information on engine health.
Sampson developed the Iridian/Roadshow concept of real time flight data
monitoring and telemetry a decade ago. As he points out:
“The Iridium satellite
constellations have now been exploited by numerous firms with
permutations of the original concept of in flight data-streaming to ground
stations. However, because back-to-base data-streams remain an unnecessary
expense, they are still not in wide use amongst the airlines. The use of Low
Earth Orbiting satellite continuous re-transmission of in flight data from
airborne aircraft remains a niche application, mainly utilized for specialist
military (unmanned flight0 and geologic survey purposes. There are a few
safety-related systems in general use (i.e. VIP jets but not in long-haul
airlines).
“Thus we have a situation such as June 2009’s
Air France 447 where many months, if
not years, will elapse before the victims’ families and airworthiness
authorities may conclude a ‘probable’ cause – assuming that the A330’s flight
recorders are found and recovered, and contain intact data.”
Sampson paints a picture of a fictional airliner, Flight 426, a
Boeing 747,
ditched because of an electrical short circuit (and worse), with no survivors.
But the cockpit voice and flight data had already been transmitted to a shore
station:
“As Flight 426 slips below the waves the airline maintenance chief looks up from
his data terminal 1,700 nautical miles away and says to the concerned faces
around him: ‘It’s all there, every bit of the last 4 hours and 23 minutes. We’ve
got cockpit voice and 512 channels of digital flight data. Get on the phone to
Head Office and see if they copied it also. Advise BASI [Bureau of Air Safety
Investigation] and Boeing that we’ve got it all, all that they’ll ever need to
get to the bottom of this.’
“He turns to his subordinate and instructs him: ‘Seal all [the aircraft]
maintenance records, refueling and turnaround servicing paperwork. Lock it in
the Operations safe.’
“ ‘Can you play back the Voice for us now?’
“ ‘Sorry, no, it’s digitally encrypted and the crypto-key can only go in a
sealed envelope to BASI.’
“ ‘Do you have the final ditching position?’
“ ‘Yes, that’s here in the clear on screen under the GPS logo and it’s been
passed to the en route ships and aircraft … [the captain] intentionally ditched
within sight of a merchant tanker. They say there are no survivors. ”
In Sampson’s fictional account, the Boeing “GO” Team held a press conference the
next day:
“Some of you will know that the dictionary definition of Iridian is anything
pertaining to the iris or a rainbow. The iris discriminates colors. For us,
after just such an event as yesterday’s, for the first time we have all the
colors we need. I refer to the multiple channels of operating data that was
dumped from the CVR, GPS and DFDR (pointing) from this three hour point onwards,
via an Iridium satellite
constellation data relay … At this point (pointing) the Iridian data-bus was
triggered by some DFDR electrical parameter exceedances and it began
data-dumping history – and then later events –from power-on to power-off (which
was the ditching event). We have a complete telemetry record of what happened
within the systems, all radio communications and the
cockpit voice recording. As well as that, we had a very accurate
GPS ditching position relayed upon which to base a survivor search. The aircraft
lies at the bottom of a 2,800 meter deep trench and it is unlikely that there
will be any recovery efforts at that depth. However, thanks to Iritian and
Roadshow we have all the data we need to analyze the accident and to promptly
ensure it never happens again.”
According to Sampson, a crew experiencing a “PAN, PAN, PAN” emergency or worse
(“MAYDAY”) would select the appropriate
air traffic control
transponder code (7700/7600/7500) to have both their CVR and DFDR data-dump
auto-uplinked to their own airline’s operations site (telemetry to anywhere on
earth). In addition, the system would automatically initiate uplink – if the
crew were disabled, the data would therefore be transferred anyway. For this
automatic feature, the initiators would include:
1.Rapid/explosive decompression
2.Crew removal from stowage of smoke masks or hand-held fire extinguishers.
3.Cargo hold smoke alarms.
4.Excessive G force rise-rates or excursions (severe turbulence, loss of
control, control failure, such as rudder hardovers.
5.Parameter exceedances (slats, flaps or undercarriage extending at high speed,
engine overtemps, etc.
6.Rapid-rate emergency descents.
7.Aircraft stall stick-shaker actuation.
8.Fuel dumping.
9.Loud noises (gunshots, explosions, structural failure).
10.Trim runaway.
11.Inappropriate reconfiguration (i.e. flap extension at high altitudes –
normally prohibited above 20,000 feet – cargo door or access panel opening, or
flight deck cabin
door forced open).
Sampson points out that the data/voice uploading could be initiated by air
traffic control (via transponder responses) if hijacking were suspected because
of a diversion from the airplane’s assigned track or nil voice radio
communication with the flight crew.
This concept solves the perplexing problem of massive, costly searches and
months of puzzling over expensively salvaged debris. The savings should be
considerable in terms of money, protracted doubts, crew uncertainty and
passenger anxieties. It should also reduce the hazards to both searchers and
retrieval crews. It would tend to minimize families’ anguish if the cause were
known rapidly, by virtue of the revealing DFDR data-stream and interfaced CVR
transcript. The torture of an air crash is all the more agonizing because of the
years of waiting and speculation, followed by a “probable cause” and further
years of litigation.
The Iridian/Roadshow concept should be popular with aircrews, whether they
survive or not. To protect pilots privacy, as now happens, access to
cockpit voice recordings
would be limited (by encryption) to accident investigators. Better, more
complete data may also reduce the percentage of accidents attributable to pilot
error. At present, this percentage tends to be fattened unfairly because it’s a
popular “fall back” position (cf the early B737 rudder accidents).
Operations staff at many airlines retrieve real-time engine and systems data
in-flight for crew, aircraft operational, and maintenance scheduling purposes.
Not to extend this capability, such that it could carry cockpit voice,
positional, and digital flight data recorder information for underway abnormal
operations, would be irresponsible.
Sy Levine envisions more than off-loading data in the face of an imminent crash.
“By the real time sharing of the digital safety data, all the necessary crash
prevention parameters become visible and usable to actively anticipate and
prevent accidents,” he maintains. His patented technology is called RAFT, for
Remote Aircraft Flight Recorder and Advisory Telemetry System. “RAFT transmits
the DFDR data in real-time to the ground, so that the experts equipped with an
aircraft simulation capability can provide the pilot with the safest way to
handle the situation,” he says.
Satellites, he says, can handle many times the amount of data offloaded. Levine
maintains that 24 hours worth of digital
flight recorder data, for all U.S.
airlines, taxi and cargo aircraft is “not an insurmountable data quantity.” The
data, he says, would fit on two personal computer disks.
He sees multiple safety benefits:
“Each air carrier receives its own data, including safety and privileged
encrypted data … RAFT substantially increases safety and increases air carrier
operational efficiency. Once the data is at the air carriers the standard FOQA
[Flight Operations Quality Assurance] post-flight software tools can be
utilized. In addition, RAFT permits a paper-less inspection, maintenance log and
Aviation Safety Reporting System (ASRS). Thus, it corrects the deficiencies in
the present flight recorders and provides a significant enhancement to air
safety and operational efficiency by providing an aircraft data super highway.”
In short, transmitting the data for instant use is preferable to archiving it in
a shockproof box that may take weeks to recover, if ever.
(For more on Sampson’s concept, see
http://tinyurl.com/kv2owv;
for Levine, see
www.safelander.com)