International Aviation Safety Association

Search exact phrase      :
Search any of the words :



Aviation Online Magazine




The International Aviation Safety Association
Message from:
Wed, Jun 3, 2009 — David Evans

With some of the wreckage of Air France flight 447 now spotted floating on the waters of the Atlantic Ocean, the search is on for the submerged cockpit voice and flight data recorders (CVR/FRD). The information hopefully recorded should shed light on what happened the night of 31 May to bring the jetliner down amidst severe convective weather (see Aviation Safety Journal, ‘Difficulty Locating Lost Jet’s Flight Recorders Shows Need for Upgraded Technology’).

If the recorders are located a day, a week, two weeks from now – or never located in the 13,000 feet of water – the technology exists to already have the data and cockpit conversations in hand, though the offloading of the information through satellites and onto one or more ground stations. The concept was first articulated about ten years ago by Contributing Editor John Sampson, and others have been pushing for it as well, including Sy Levine. He has argued that bandwidth is not a problem, and that the amount of data offloaded from thousands of commercial jetliners will not clog the system.

The National Transportation Safety Board (NTSB) has not called for transmitting CVR/FDR data while in flight, or moments before a crash. The Board, rather, has called for dual cockpit voice and flight data recorders to be installed in the front and aft ends of the airplane, with improved electric power supplies. This recommendation focuses on getting good data recorded in the first place, but it leaves the next obvious question unanswered: what is the purpose of recording great data if it sits at the bottom of the ocean, in a trackless jungle, or on the windswept arctic tundra. Reading, analyzing and acting upon what is recorded on the CVR/FDR is the important thing.

The NTSB has not made comparable recommendations to ensure that CVR/FDR data is broadcast electronically so that it is retrieved quickly for use by investigators.

The technology exists to do so, has already been implemented by the U.S. military for some of its airplanes, and is found in limited application in the civilian aviation sector. But it has not been put in place for commercial airliners, despite the fact that jet engines on commercial jets already feature modules that broadcast in real-time information on engine health.

Sampson developed the Iridian/Roadshow concept of real time flight data monitoring and telemetry a decade ago. As he points out:

“The Iridium satellite constellations have now been exploited by numerous firms with permutations of the original concept of in flight data-streaming to ground stations. However, because back-to-base data-streams remain an unnecessary expense, they are still not in wide use amongst the airlines. The use of Low Earth Orbiting satellite continuous re-transmission of in flight data from airborne aircraft remains a niche application, mainly utilized for specialist military (unmanned flight0 and geologic survey purposes. There are a few safety-related systems in general use (i.e. VIP jets but not in long-haul airlines).

“Thus we have a situation such as June 2009’s Air France 447 where many months, if not years, will elapse before the victims’ families and airworthiness authorities may conclude a ‘probable’ cause – assuming that the A330’s flight recorders are found and recovered, and contain intact data.”
Sampson paints a picture of a fictional airliner, Flight 426, a Boeing 747, ditched because of an electrical short circuit (and worse), with no survivors. But the cockpit voice and flight data had already been transmitted to a shore station:

“As Flight 426 slips below the waves the airline maintenance chief looks up from his data terminal 1,700 nautical miles away and says to the concerned faces around him: ‘It’s all there, every bit of the last 4 hours and 23 minutes. We’ve got cockpit voice and 512 channels of digital flight data. Get on the phone to Head Office and see if they copied it also. Advise BASI [Bureau of Air Safety Investigation] and Boeing that we’ve got it all, all that they’ll ever need to get to the bottom of this.’

“He turns to his subordinate and instructs him: ‘Seal all [the aircraft] maintenance records, refueling and turnaround servicing paperwork. Lock it in the Operations safe.’

“ ‘Can you play back the Voice for us now?’

“ ‘Sorry, no, it’s digitally encrypted and the crypto-key can only go in a sealed envelope to BASI.’

“ ‘Do you have the final ditching position?’

“ ‘Yes, that’s here in the clear on screen under the GPS logo and it’s been passed to the en route ships and aircraft … [the captain] intentionally ditched within sight of a merchant tanker. They say there are no survivors. ”
In Sampson’s fictional account, the Boeing “GO” Team held a press conference the next day:

“Some of you will know that the dictionary definition of Iridian is anything pertaining to the iris or a rainbow. The iris discriminates colors. For us, after just such an event as yesterday’s, for the first time we have all the colors we need. I refer to the multiple channels of operating data that was dumped from the CVR, GPS and DFDR (pointing) from this three hour point onwards, via an Iridium satellite constellation data relay … At this point (pointing) the Iridian data-bus was triggered by some DFDR electrical parameter exceedances and it began data-dumping history – and then later events –from power-on to power-off (which was the ditching event). We have a complete telemetry record of what happened within the systems, all radio communications and the cockpit voice recording. As well as that, we had a very accurate GPS ditching position relayed upon which to base a survivor search. The aircraft lies at the bottom of a 2,800 meter deep trench and it is unlikely that there will be any recovery efforts at that depth. However, thanks to Iritian and Roadshow we have all the data we need to analyze the accident and to promptly ensure it never happens again.”
According to Sampson, a crew experiencing a “PAN, PAN, PAN” emergency or worse (“MAYDAY”) would select the appropriate air traffic control transponder code (7700/7600/7500) to have both their CVR and DFDR data-dump auto-uplinked to their own airline’s operations site (telemetry to anywhere on earth). In addition, the system would automatically initiate uplink – if the crew were disabled, the data would therefore be transferred anyway. For this automatic feature, the initiators would include:

1.Rapid/explosive decompression
2.Crew removal from stowage of smoke masks or hand-held fire extinguishers.
3.Cargo hold smoke alarms.
4.Excessive G force rise-rates or excursions (severe turbulence, loss of control, control failure, such as rudder hardovers.
5.Parameter exceedances (slats, flaps or undercarriage extending at high speed, engine overtemps, etc.
6.Rapid-rate emergency descents.
7.Aircraft stall stick-shaker actuation.
8.Fuel dumping.
9.Loud noises (gunshots, explosions, structural failure).
10.Trim runaway.
11.Inappropriate reconfiguration (i.e. flap extension at high altitudes – normally prohibited above 20,000 feet – cargo door or access panel opening, or flight deck cabin door forced open).
Sampson points out that the data/voice uploading could be initiated by air traffic control (via transponder responses) if hijacking were suspected because of a diversion from the airplane’s assigned track or nil voice radio communication with the flight crew.

This concept solves the perplexing problem of massive, costly searches and months of puzzling over expensively salvaged debris. The savings should be considerable in terms of money, protracted doubts, crew uncertainty and passenger anxieties. It should also reduce the hazards to both searchers and retrieval crews. It would tend to minimize families’ anguish if the cause were known rapidly, by virtue of the revealing DFDR data-stream and interfaced CVR transcript. The torture of an air crash is all the more agonizing because of the years of waiting and speculation, followed by a “probable cause” and further years of litigation.

The Iridian/Roadshow concept should be popular with aircrews, whether they survive or not. To protect pilots privacy, as now happens, access to cockpit voice recordings would be limited (by encryption) to accident investigators. Better, more complete data may also reduce the percentage of accidents attributable to pilot error. At present, this percentage tends to be fattened unfairly because it’s a popular “fall back” position (cf the early B737 rudder accidents).

Operations staff at many airlines retrieve real-time engine and systems data in-flight for crew, aircraft operational, and maintenance scheduling purposes. Not to extend this capability, such that it could carry cockpit voice, positional, and digital flight data recorder information for underway abnormal operations, would be irresponsible.

Sy Levine envisions more than off-loading data in the face of an imminent crash. “By the real time sharing of the digital safety data, all the necessary crash prevention parameters become visible and usable to actively anticipate and prevent accidents,” he maintains. His patented technology is called RAFT, for Remote Aircraft Flight Recorder and Advisory Telemetry System. “RAFT transmits the DFDR data in real-time to the ground, so that the experts equipped with an aircraft simulation capability can provide the pilot with the safest way to handle the situation,” he says.

Satellites, he says, can handle many times the amount of data offloaded. Levine maintains that 24 hours worth of digital flight recorder data, for all U.S. airlines, taxi and cargo aircraft is “not an insurmountable data quantity.” The data, he says, would fit on two personal computer disks.

He sees multiple safety benefits:

“Each air carrier receives its own data, including safety and privileged encrypted data … RAFT substantially increases safety and increases air carrier operational efficiency. Once the data is at the air carriers the standard FOQA [Flight Operations Quality Assurance] post-flight software tools can be utilized. In addition, RAFT permits a paper-less inspection, maintenance log and Aviation Safety Reporting System (ASRS). Thus, it corrects the deficiencies in the present flight recorders and provides a significant enhancement to air safety and operational efficiency by providing an aircraft data super highway.”
In short, transmitting the data for instant use is preferable to archiving it in a shockproof box that may take weeks to recover, if ever.

(For more on Sampson’s concept, see; for Levine, see