European Aviation Safety Agency
Notice of Proposed Amendment 2018-03
Recorders installation and maintenance thereof –
certification aspects
RMT.0249 (MDM.051)
EXECUTIVE SUMMARY
The objective of this Notice of Proposed Amendment (NPA) is to improve the availability and the quality of data recorded
by flight recorders, in order to better support safety investigations of accidents and incidents.
This NPA proposes to enhance and modernise the specifications for the installation of flight recorders on board large
aircraft, and addresses the following subjects:
— cockpit voice recorder (CVR) power supplies;
— automatic stopping of the recording after a crash;
— combination recorders;
— deployable recorders; and
— performance specifications for flight recorders.
The proposed changes are expected to:
— increase the level of safety;
— address safety recommendations;
— save costs;
— transpose International Civil Aviation Organization (ICAO) standards into EU rules; and
— achieve greater harmonisation with Federal Aviation Administration (FAA) regulations.
A second NPA that provides a proposal for further issues identified in the Terms of Reference (ToR) for rulemaking task
(RMT).0249 will be published at a later stage.
Action area: Aircraft tracking, rescue operation and accident investigations
Affected rules: Annex IV (Part-CAT) of Regulation (EU) No 965/2012, CS-25, CS-29
Affected stakeholders: — Operators
— Type certificate (TC) holders and applicants for TC / supplemental type certificate (STC) of large
aeroplanes and large rotorcraft required to be equipped with flight recorders
— Competent authorities
Driver: Safety Rulemaking group: No
Impact assessment: Light Rulemaking Procedure: Standard
27.01.2016 (Issue 2) 27.3.2018 2018/Q1 2019/Q1 2018/Q1
18.01.2014 (Issue 1)
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 1 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
Table of contents
Table of contents
1. About this NPA ..................................................................................................................................... 3
1.1. How this NPA was developed ...................................................................................................................3
1.2. How to comment on this NPA...................................................................................................................3
1.3. The next steps ...........................................................................................................................................3
2. In summary — why and what ............................................................................................................... 4
2.1. Why we need to change the rules — issue/rationale...............................................................................4
2.2. What we want to achieve — objectives ...................................................................................................7
2.3. How we want to achieve it — overview of the proposals ........................................................................7
2.4. What are the expected benefits and drawbacks of the proposals ...........................................................9
3. Proposed amendments and rationale in detail .................................................................................... 10
3.1. Draft regulation (Draft EASA opinion).....................................................................................................10
3.2. Draft acceptable means of compliance and guidance material (Draft EASA decision) ..........................11
3.3. Draft certification specifications (Draft EASA decision) ..........................................................................12
3.4. Draft acceptable means of compliance and guidance material (Draft EASA decision) ..........................23
4. Impact assessment (IA) ....................................................................................................................... 32
4.1. What is the issue .....................................................................................................................................32
4.2. Safety risk assessment ............................................................................................................................32
4.3. Who is affected .......................................................................................................................................32
4.4. How could the issue/problem evolve .....................................................................................................32
4.5. What we want to achieve — objectives .................................................................................................32
4.6. How it could be achieved — options ......................................................................................................33
4.7. What are the impacts..............................................................................................................................34
5. Proposed actions to support implementation...................................................................................... 37
6. References ......................................................................................................................................... 38
6.1. Affected regulations................................................................................................................................38
6.2. Affected decisions ...................................................................................................................................38
6.3. Other reference documents ...................................................................................................................38
7. Appendix ........................................................................................................................................... 39
7.1. Annex 1 ...................................................................................................................................................39
7.2. Annex 2 ...................................................................................................................................................46
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 2 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
1. About this NPA
1. About this NPA
1.1. How this NPA was developed
The European Aviation Safety Agency (EASA) developed this NPA in line with Regulation (EC)
No 216/20081 (hereinafter referred to as the ‘Basic Regulation’) and the Rulemaking Procedure2. This
rulemaking activity is included in the EASA 2017-2021 Rulemaking and Safety Promotion Programme3
under RMT.0249 (MDM.051). The text of this NPA has been developed by EASA, based on the input of
the European Flight Recorder Partnership Group4. It is hereby submitted to all interested parties5 for
consultation.
1.2. How to comment on this NPA
Please submit your comments using the automated Comment-Response Tool (CRT) available at
http://hub.easa.europa.eu/crt/6.
The deadline for submission of comments is 27 June 2018.
1.3. The next steps
Following the closing of the public commenting period, EASA will review all the comments received.
Based on the comments received, EASA will develop:
— a decision amending the certification specifications (CSs) and the related acceptable means of
compliance (AMC) for large aeroplanes (CS-25) and large rotorcraft (CS-29);
— an opinion proposing amendments to Regulation (EU) No 965/20127 (‘AirOPS regulation’) and a
decision with the related AMC and GM. The opinion is addressed to the European Commission,
which will use it as a technical basis in order to develop the amending Regulation.
The comments received and the EASA responses will be reflected in a comment-response document
(CRD). The CRD will be annexed to the respective decision and to the opinion.
1
Regulation (EC) No 216/2008 of the European Parliament and of the Council of 20 February 2008 on common rules in the field of
civil aviation and establishing a European Aviation Safety Agency, and repealing Council Directive 91/670/EEC,
Regulation (EC) No 1592/2002 and Directive 2004/36/EC (OJ L 79, 19.3.2008, p. 1) (http://eur-lex.europa.eu/legal-
content/EN/TXT/?qid=1467719701894&uri=CELEX:32008R0216).
2
EASA is bound to follow a structured rulemaking process as required by Article 52(1) of Regulation (EC) No 216/2008. Such a
process has been adopted by the EASA Management Board (MB) and is referred to as the ‘Rulemaking Procedure’. See MB Decision
No 18-2015 of 15 December 2015 replacing Decision 01/2012 concerning the procedure to be applied by EASA for the issuing of
opinions, certification specifications and guidance material (http://www.easa.europa.eu/the-agency/management-
board/decisions/easa-mb-decision-18-2015-rulemaking-procedure).
3
http://easa.europa.eu/rulemaking/annual-programme-and-planning.php
4
The EFRPG is a voluntary group of experts dedicated to evaluating issues related to the design, operation and serviceability of flight
recorders. It is composed of delegates from safety investigation authorities, national aviation authorities, industry and pilot
associations. In February 2016 the organisations represented in the EFRPG were: AAIB UK, Airbus, ANSV Italy, BEA France, BFU
Germany, Boeing, CAA UK, DGAC France, Airbus Helicopters, European Cockpit Association, FAA, Fedex, Lufthansa Technics, Pilatus.
5
In accordance with Article 52 of Regulation (EC) No 216/2008, and Articles 6(3) and 7 of the Rulemaking Procedure.
6
In case of technical problems, please contact the CRT webmaster (
[email protected]).
7
Commission Regulation (EU) No 965/2012 of 5 October 2012, laying down technical requirements and administrative procedures
related to air operations pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council
(OJ L 296 25.10.2012, p. 1) (http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1503665335129&uri=CELEX:32012R0965).
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 3 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
1. About this NPA
A second NPA proposing means to address the issues below, as identified in the ToR for RMT.02498,
will be published at a later stage:
— flight data recordings (FDR) power supplies;
— specifications for data link recording;
— provisions for ensuring the serviceability of flight recorders; and
— the quality of recording of cockpit voice recorders.
8
‘Recorders installation and maintenance thereof – certification aspects’ (https://www.easa.europa.eu/document-library/terms-of-reference-and-
group-compositions/tor-rmt0249-mdm051)
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 4 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
2. In summary — why and what
2. In summary — why and what
CS-25 and CS-29 contain certification specifications (CS XX.1457 and CS XX.1459) which are related to
the installation of CVRs and FDRs, when required by the AirOPS regulation.
2.1. Why we need to change the rules — issue/rationale
2.1.1. CVR power supplies
It was found during the investigations of accidents that the CVRs had been depowered prematurely
while they could have kept recording useful information if an alternate power source had been
installed. It also appeared during some of the investigations that some installations had both the FDR
and the CVR powered by the same electrical bus, so that a failure of this bus disabled both the flight
recorders while the aircraft was still flying and controllable (cf. Annex 1 in the Appendix).
The following safety recommendations (SRs) addressed to EASA and/or FAA in aircraft accident
investigation report(s) were considered during this RMT. Their aim is to address the issue of CVR/FDR
functions being disabled after an interruption of normal power. The need here is to enable the CVR to
continue recording after its main power source is lost, and to prevent the failure of a single power
supply from disabling both the FDR and the CVR:
SR CAND-1999-003: ‘As of 01 January 2005, for all aircraft equipped with CVRs having a recording
capacity of at least two hours, a dedicated independent power supply be required to be installed
adjacent or integral to the CVR, to power the CVR and the cockpit area microphone for a period of 10
minutes whenever normal aircraft power sources to the CVR are interrupted.’ (Accident to McDonnell
Douglas MD11, registered HB-IWF, on 02 September 1998).
SR UNKG-2005-074: ‘For newly manufactured aircraft, the European Aviation Safety Agency should
require that no single electrical bus failure terminates the recording on both cockpit voice recorder and
flight data recorder.’ (Serious incident on an Airbus A320-214, registered G-BXKD, on 15 January 2005).
SR UNKG-2005-075: ‘For newly manufactured aircraft, the European Aviation Safety Agency should
require that the cockpit voice recorder and cockpit area microphone are provided with an independent
10 minute back-up power source, to which the cockpit voice recorder and cockpit area microphone are
switched automatically, in the event that normal power is interrupted.’ (Serious incident on an Airbus
A320-214, registered G-BXKD, on 15 January 2005).
SR IRLD-2012-003: ‘European Aviation Safety Agency (EASA) should introduce a requirement that the
CVR should continue to record in the event of power failure.’ (Serious incident on an Boeing 737-8AS,
registered EI-ENB, on 21 December 2010, investigated by AAIU Ireland).
ICAO Annex 6 Part I contains Standard and Recommended Practices (SARPs) which require that large
commercial air transport aeroplanes, for which the application for type certification is submitted on or
after 1 January 2018, be fitted with an ‘alternate power source’ for the CVR and its associated cockpit
area microphone components (refer to Standard 6.3.2.4.1). It also contains a recommendation that ‘all
aeroplanes of a maximum certificated take-off mass of over 27 000 kg for which the individual
certificate of airworthiness is first issued on or after 1 January 2018 should be provided with an
alternate power source, as defined in 6.3.2.4.1, that powers at least one CVR’.
In addition, the FAA published a rule on 7 March 2008 on ‘Revisions to Cockpit Voice Recorder and
Digital Flight Data Recorder Regulations’ (Docket No FAA-2005-20245). This rule amended Part-25 and
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 4 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
2. In summary — why and what
Part-29 with new requirements to address the fact that any single electrical failure should not disable
both the CVR and FDR functions, and the need for a 10-minute backup power source for the CVR.
Certification Specifications for European Technical Standard Orders (CS-ETSO) already contain
requirements applicable to ‘recorder independent power supply’ (refer to ETSO-C155a). However,
there is no corresponding specification for the installation of such independent power supplies in the
CS for large aeroplanes (CS-25) or for large rotorcraft (CS-29). There is also no air operation rule
addressing such a requirement for already certified aircraft.
Note: EASA has also received several SRs that recommend an alternate power source for the FDR.
However, this topic will be addressed in the second NPA envisioned under this RMT.
2.1.2. Automatic stopping of the recording after an accident
Several safety investigation bodies have reported reliability issues with negative acceleration sensors,
i.e. so-called ‘g-switches’, which are used to stop the flight recorders after a crash impact. In several
occurrences involving high levels of airframe vibrations, some ‘g-switches’ were triggered prematurely
during the occurrence and, therefore, the recording of voices or data stopped before the end of the
flight (cf. Annex 2 of the Appendix).
The following SRs addressed to EASA and/or the FAA in aircraft accident investigation report(s) are
considered during this RMT. Their aim is to address the issue of the premature stopping of recordings:
SR UNKG-2008-074: ‘It is recommended that the Federal Aviation Administration and the European
Aviation Safety Agency review the certification requirements for automatically stopping flight
recorders within 10 minutes after a crash impact, with a view to including a specific reference
prohibiting the use of ‘g-switches’ as a means of compliance as recommended in ED-112 issued by
EUROCAE Working Group 50.’ (Accident to Bombardier BD-700, registered VP-CRC, on 29 January
2008).
SR UNKG-2011-045: ‘It is recommended that the European Aviation Safety Agency require the ‘crash
sensor’ in helicopters, fitted to stop a Cockpit Voice Recorder in the event of an accident, to comply
with EUROCAE ED62A.’ (Accident to AS332-L2 Super Puma, registered G-REDL, on 1 April 2009).
EUROCAE has also addressed this issue and introduced the following provision in EUROCAE document
112A9, I-6.1.2: ‘Negative acceleration sensors (‘g’ switches) shall not be used as sole means of
detection because their response is not considered to be reliable’.
2.1.3. Combination recorders
Recorders designated in this NPA by the term ‘combination recorders’ combine two functions: the FDR
function and the CVR function. They may also have other recording functions (such as data link or
image recording). The installation of combination recorders can bring various benefits compared to
installing an FDR and a separate CVR:
When permitted by the operating requirements (typically on helicopters), a combination recorder that
replaces an FDR and a CVR allows savings in weight and maintenance costs. Furthermore, when two
combination recorders are installed on a large aeroplane, this can increase the likelihood that the FDR
and CVR data are fully retrieved after an accident (which has safety benefits). In addition, the
conditions provided by the CS-MMEL when two combination recorders are installed are more flexible
than for an FDR and a CVR (operational benefit).
9
EUROCAE Document 112A - Minimum Operational Performance Specification for Crash Protected Airborne Recorder Systems, September 2013.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 5 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
2. In summary — why and what
However, the certification specifications related to combination recorders and the means of
compliance with the operational requirements for them are not consistent or complete.
Firstly, CS 25.1457 and CS 25.1459 for Large Aeroplanes recommend that the FDR and the CVR be
located as far as practicable in order to maximise the probability that the crash-protected memory
survives the impact forces and a potential fire. However, in these paragraphs, the specifications for the
location of the flight recorders are too prescriptive.
Note: EASA currently addresses the certification of combination recorders through specific certification
review items (CRIs).
Secondly, the AMC to CAT.IDE.A.20010 recommends that when two flight data and cockpit voice
combination recorders are installed on board an aeroplane, one should be located near the flight crew
compartment and the other should be located in the rear section of the aeroplane.
The provisions in CS-25 should therefore be more performance-based regarding the location of the
flight recorders, and they should also address the case where two combination recorders are installed.
In addition, there is a need to address other aspects that are not specific to aeroplanes, such as power
supplies or the means of performing a pre-flight check when a combination recorder is installed.These
other aspects also need to be addressed in CS-25 and in CS-29.
2.1.4. Deployable recorders
A ‘deployable flight recorder’ or ‘deployable recorder’ is a crash-protected flight recorder which is
designed to be automatically separated from the aircraft in the event of an accident. It is sometimes
designated with the acronym ADFR (automatic deployable flight recorder).
The deployable recorder is a technology that can also greatly facilitate the localisation of an aircraft
after an accident over an oceanic area or a remote area, because it is designed to be buoyant and
fitted with an emergency locator transmitter (ELT), which starts emitting shortly after deployment.
While the automatic ELT fixed on the aircraft may be destroyed by crash forces or post-impact fire, the
ELT integrated in the deployable recorder is expected to survive the crash conditions in most accident
scenarios, and to transmit in any case a signal which can be located by COSPAS-SARSAT. In addition,
compared to a fixed flight recorder, which might be resting on the sea floor at a depth of several
thousand meters, a deployable recorder could be collected from the surface of the sea within a few
hours after the accident.
For these reasons, the use of a deployable recorder has been identified as one possible way to comply
with CAT.GEN.MPA.210, requiring that some categories of large aeroplanes first issued with an
individual Certificate of Airworthiness (CofA) on or after 1 January 2021 are equipped with ‘robust and
automatic means to accurately determine, following an accident where the aeroplane is severely
damaged, the location of the point of end of flight’.
However, the current provisions in CS 25.1457 and CS 25.1459 are not adequate for deployable flight
recorders. For instance, the provisions for facilitating the localisation and identification of a deployable
recorder at the scene of an accident are missing, as are any provisions to ensure the safety and
effectiveness of the deployment.The proposed requirements will therefore establish the basis for the
certification of deployable recorders.
Furthermore, ICAO SARPs addressing the installation of a deployable recorder were introduced in ICAO
Annex 6, Part I, Amendments 38 and 40.
10
Annex IV (Part-CAT) to the Air OPS Regulation (EU) 965/2012, CAT.IDE.A.200.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 6 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
2. In summary — why and what
2.1.5. Performance specifications for flight recorders
The AMC to CS 25.1457 and CS 25.1459 lack any reference to up-to-date industry standards regarding
the performance of the installed system. AMC 25.1457 still refers to EUROCAE Document ED-56,
although this document was superseded by ED-112 in 2003, which in turn was superseded by ED-112A
in 2013. None of the AMC to CS-25.1459, CS-29.1457 or CS-29.1459 specifies any industry standard
regarding the performance of the installed system.
In addition, references to ED-112 and ED-112A have already been introduced in ICAO Annex 6 (refer to
Part I, Chapter 6, Section 6.3) and Part III (refer to Section II, Chapter 4, 4.3), as well as in the AMC to
the EU rules for air operations (refer to AMC1 CAT.IDE.A.185 and AMC1.2 CAT.IDE.A.190). Hence the
performance specifications applicable to the FDR system and the CVR system in CS-25 and CS-29 need
to be updated.
2.2. What we want to achieve — objectives
The specific objective of this proposal is to improve the availability and quality of the data recorded by
flight recorders in order to better support safety investigation authorities in the investigation of
accidents and incidents. This includes, in particular, the objectives to:
— increase the robustness of flight recorders to the loss of their power supplies;
— prevent the premature termination of recording due to the untimely triggering of a negative
acceleration sensor;
— define the certification requirements for combination recorders; and
— define the certification requirements for deployable recorders.
2.3. How we want to achieve it — overview of the proposals
2.3.1. CVR power supply
This NPA proposes to introduce in CS-25 and CS-29 new provisions to enable a CVR to continue
recording after its main power source goes down, and to prevent the failure of a single power supply
from disabling both the FDR and the CVR. These provisions partially implement the stipulations of ICAO
Annex 6 Part I and they are also partially harmonised with FAR Part 25. The proposal also covers the
case of one (or two) flight data and cockpit voice combination recorder(s). In particular, the
introduction of the following new items is proposed:
— CS 25.1457 (d)(4) to (d)7) ;
— CS 29.1457 (d)(4) to (d)(7);
— AMC1 25.1457(d) and GM1 25.1457(d);
— AMC1 29.1457(d) and GM1 29.1457(d);
— CS 25.1459(a)(7) and (a)(8);
— CS 29.1459 (a)(6) and (a)(7);
— AMC1 25.1459(d).
Finally, EASA proposes to introduce provisions in the AirOPS Regulation related to CVR alternate power
sources for newly-manufactured aeroplanes with an MCTOM of over 27 000 kg. In particular, it is
proposed to make amendments to the following:
— CAT.IDE.A.185 (in Part-CAT), NCC.IDE.A.160 (in Part-NCC) and SPO.IDE.A.140 (in Part-SPO) ;
— AMC1 to CAT.IDE.A.185;
— AMC1 to CAT.IDE.A.200;
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 7 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
2. In summary — why and what
— AMC1 to NCC.IDE.A.160;
— AMC1 to NCC.IDE.A.175;
— AMC1 to SPO.IDE.A.140;
— AMC1 to SPO.IDE.A.155.
2.3.2. Automatic stopping of the recording after an accident
It is proposed to update the certification specifications to require that a negative acceleration sensor
(‘g-switch’) is not used as the sole means to detect a crash impact and to automatically stop the CVR
after the detection of such a crash impact. In addition, conditions are introduced to address the use of
the recorder start-and-stop logic to provide a means to automatically stop the CVR after a crash
impact. In particular, the following changes are proposed:
— amendment of CS 25.1457(d)(2);
— introduction of a new AMC1 to 25.1457(d)(2);
— amendment of CS 25.1459(f);
— amendment of CS 29.1457(d)(2);
— introduction of a new AMC1 to 29.1457(d)(2);
— amendment of CS 29.1459(e).
2.3.3. Combination recorders
It is proposed to introduce provisions in CS-25 to accommodate the installation of combination
recorders in line with the requirements set forth in the AirOPS Regulation, which implement ICAO
Annex 6, Part I, and which are harmonised with FAR Part 25. In particular, the following changes are
proposed:
— amendment of CS 25.1457 (d) and (e);
— amendment of CS 25.1459 (a) and (b);
— amendment of AMC 25.1457;
— creation of GM1 to 25.1457(e);
— creation of AMC1 to 25.1459;
— creation of AMC1 to 29.1457;
— creation of AMC1 to 29.1459.
2.3.4. Deployable recorders
It is proposed to introduce provisions in CS-25 on deployable recorders that implement ICAO Annex 6
Part I, and which take into account the specifications from ED-112A. In particular, the following
changes are proposed:
— amendment of CS 25.1457(d), (e) and (g);
— amendment of CS 25.1459(a), (b) and (d);
— amendment of the AMC to 25.1457 (introduction of subparagraph (c));
— introduction of the new AMC1 to 25.1459.
2.3.5. Performance specifications for the CVR and the FDR
It is proposed to introduce a reference to EUROCAE document 112A in the AMC to CS-25 and CS-29. In
particular, the following changes are proposed:
— amendment of AMC to 25.1457;
— amendment of AMC to 29.1457;
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 8 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
2. In summary — why and what
— creation of AMC1 to 25.1459;
— creation of AMC1 to 29.1459.
2.4. What are the expected benefits and drawbacks of the proposals
The expected benefits and drawbacks of the proposals are summarised below. For the full impact
assessment of the alternative options, please refer to Chapter 4.
2.4.1. CVR power supply
An alternate power source for the CVR and its dedicated sensor (the cockpit area microphone) can, in
some cases, provide for a prolonged recording, and therefore help in better understanding the
circumstances that led to an accident, or how the accident developed and was managed by the flight
crew. Installing the FDR system and the CVR system so that a single power supply cannot disable both
flight recorders also provides for a prolonged recording. The proposal partially aligns the EASA
certification specifications with the SARPs of ICAO Annex 6, Part I, and is harmonised with the FAA
requirements.
The related economic impact is expected to be negligeable. Indeed, aircraft designs are already
required to have an alternate power source in order in order to comply with the equivalent FAA
certification and operating rules. Therefore, the necessary design effort has already been made by
most of the manufacturers.
2.4.2. Automatic stopping of the recording after an accident
The proposal addresses, in the Certification Specifications for Large Aeroplanes and Large Rotorcraft,
the issue of the premature ending of recording due to nuisance triggers of crash detection sensors. It
also offers a framework for relying on the start-and-stop logic of the flight recorder, rather than on
dedicated crash detection sensors. The availability of exploitable data would help in better
understanding the circumstances that led to an accident.
No drawbacks, including adverse economic impacts, are expected.
2.4.3. Combination recorders
The proposal gives a common framework for the installation of combination recorders on board large
aeroplanes, as an alternative to single-function FDRs and CVRs. The proposal implements the SARPs of
ICAO Annex 6 and adresses an inconsistency between the certification specifications and the air
operation rules. In addition, the proposal is harmonised with FAA requirements.
No drawbacks, inlcuding advserse economic impacts, are expected.
2.4.4. Deployable recorders
The proposal implements the SARPs of ICAO Annex 6 and facilitates the approval of installation of
deployable recorders on board large aeroplanes.
An additional safety benefit is expected: deployable recorders are expected to provide for a more
reliable means of locating an aircraft after an accident (thanks to the integrated ELT), hence increasing
the chance of saving lives after the accident. This would also provide for a quick means to locate the
wreckage and retrieve flight recorder data in case of an accident over water or a remote area, saving
costs for the State(s) in charge of the investigations (several millions to several tens of millions of
euros).
No drawbacks are expected.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 9 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
3. Proposed amendments and rationale in detail
The text of the amendment is arranged to show deleted text, new or amended text as shown below:
— deleted text is struck through;
— new or amended text is highlighted in grey;
— an ellipsis ‘[…]’ indicates that the rest of the text is unchanged.
Wherever necessary, a rationale is provided in blue italics immediately after the proposed
amendments.
3.1. Draft regulation (Draft EASA opinion)
Annex IV
COMMERCIAL AIR TRANSPORT OPERATIONS
[Part-CAT]
Subpart D
INSTRUMENTS, DATA, EQUIPMENT
SECTION 1
Aeroplanes
1. CAT.IDE.A.185 is amended as follows
CAT.IDE.A.185 Cockpit voice recorder
[…]
(i) Aeroplanes with an MCTOM of over 27 000 kg and first issued with an individual CofA on or after
[date of publication + 3 years] shall be equipped with an alternate power source to which the CVR
and cockpit-mounted area microphone are switched automatically in the event that all other power
to the recorder is interrupted.
Rationale
While the need for alternate power sources for CVRs appears to be well supported by investigations of
accidents involving aeroplanes with an MCTOM of over 27 000 kg, this is not true for other categories
of aircraft. Therefore, when considering air operation rules, a requirement to carry an alternate power
source is only justified for aeroplanes with an MCTOM of over 27 000 kg .
Only newly manufactured aeroplanes are in the scope of the proposed rules, because the safety benefit
brought by an alternate power source is not considered significant enough to outweigh the economic
impact of retrofitting.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 10 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
3.2. Draft acceptable means of compliance and guidance material (Draft EASA decision)
3.2.1. Draft AMC/GM to Annex IV (Part-CAT)
1. AMC1 CAT.IDE.A.185 is amended as follows
AMC1 CAT.IDE.A.185 Cockpit voice recorder
[…]
(c) if required to be installed, the alternate power source should provide electrical power to operate
both the CVR and the cockpit area microphone for at least 9 minutes. If the cockpit voice recorder
has a recording duration of less than 25 hours, the alternate power source should not provide
electrical power for more than 30 minutes.
2. AMC1 CAT.IDE.A.200 is amended as follows
AMC1 CAT.IDE.A.200 Flight data and cockpit voice combination recorder
GENERAL
(a) When two flight data and cockpit voice combination recorders are installed, one should be located
near the flight crew compartment, in order to minimise the risk of data loss due to a failure of the
wiring that gathers data to the recorder. The other should be located at the rear section of the
aeroplane, in order to minimise the risk of data loss due to recorder damage in the case of a crash.
(b) When two flight data and cockpit voice combination recorders are installed and an alternate power
source is required for the CVR function, it is acceptable to provide this alternate power source only
to the cockpit area microphone and the recorder located closer to the flight crew compartment.
Rationale
An appropriate duration for the engagement of the alternate power source is essential for the
preservation of the CVR recording. Hence, lower and upper boundaries should be defined for the
duration of the alternate power source. When the alternate power source is implemented by the means
of a recorder independent power supply (RIPS), CS-ETSO, ETSO-C155a (Recorder independent power
supply) is applicable. ETSO-C155a refers to Section 5 of EUROCAE Document 112, which specifies an
engagement duration of 10 ± 1 minutes.
While a minimum engagement duration of 10 – 1 = 9 minutes is recognised as necessary for the
alternate power source to bring any benefits at all, it is not considered safety-effective to require the
maximum engagement duration to be 10 + 1 = 11 minutes. Data from historical accidents shows that
after a loss of all engines at cruise altitude, a large aeroplane may glide for up to or slightly more than
20 minutes. Annex 2 of the Appendix contains examples of accidents and serious incidents with a loss of
all engines (and sometimes the auxiliary power unit (APU)) while in flight. Adding 10 minutes to the
previous value for recording the landing roll and first evacuation actions, an engagement duration of
up to 30 minutes may be beneficial in some cases. However, when considering the CVR recording
duration, in order to not overwrite too much of the recording of the events before the normal CVR
power supply was lost, ideally the maximum engagement duration of the APS should not exceed a
given portion of the CVR recording duration. In practice, while losing 1 hour of older recordings could
be acceptable for a CVR with a recording duration of 25 hours or more, it would not be the case for a
CVR with a recording duration of 2 hours (nowadays there is almost no aeoroplane equipped with a
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 11 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
CVR model that has a recording duration of between 2 and 25 hours) . In the latter case, it is proposed
to limit the maximum engagement duration of the alternate power source to 30 minutes when the CVR
recording duration is less than 25 hours. The proposed AMC is less constraining than ICAO Annex 6 Part
I and the FAA operating requirements, which prescribe that the engagement duration of the alternate
power source is 10 ± 1 minutes.
When two combination recorders are installed instead of one FDR and one CVR, there is no need to
provide an alternate power source to both recorders. In that case, it is preferable to power the recorder
closer to the flight crew compartment, because the link between this recorder and the cockpit area
microphone is shorter than between the cockpit area microphone and the recorder located at the rear
of the aircraft, so it is less likely that this link would be cut due to a structural failure or fire.
3.3. Draft certification specifications (Draft EASA decision)
3.3.1. Draft Certification Specifications for Large Aeroplanes (Draft EASA decision amending CS-25)
BOOK 1: SUBPART F — EQUIPMENT
1. CS 25.1457 is amended as follows
CS 25.1457 Cockpit voice recorders
[…]
(d) Each cockpit voice recorder must be installed so that –
(1) It receives its electric power from the bus that provides the maximum reliability for operation
of the cockpit voice recorder without jeopardising service to essential or emergency loads
and without jeopardising emergency operations of the aeroplane;
Rationale
To harmonise with the equivalent FAA requirement (refer to FAR 25.1457(d)(1)).
[…]
(2) There is an automatic means to simultaneously stop the recorder and prevent each erasure
feature from functioning, within 10 minutes after crash impact.; and
Rationale
The deleted part is is already included in the provisions of 25.1457 (f). The means for automatically
stopping the CVR after a crash impact shall stop the CVR even if power can still be supplied by the CVR
normal power source or the CVR alternate power source.
(3) There is an aural or visual means for pre-flight checking of the recorder for proper operation.
(4) Any single electrical failure external to the recorder does not disable both the cockpit voice
recorder function and the flight data recorder function;
Rationale
To harmonise with the equivalent FAA requirement (see FAR 25, 25.1457(d)(4)).
(5) There is a means for the flight crew to stop the cockpit voice recorder function upon
completion of the flight in a way such that re-enabling the cockpit voice recorder function is
only possible by dedicated manual action;
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 12 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
Rationale
In order to preserve most of the useful CVR recording after a serious incident, there should be a means
for the flight crew to stop any CVR function when the aircraft is on the ground. Indeed
CAT.GEN.MPA.105(10)(iii) in Part-CAT requires the commander of a flight to ensure that ‘in the event of
an accident or a serious incident, or if preservation of recordings of flight recorders is directed by the
investigating authority:
(A) flight recorders’ recordings are not intentionally erased;
(B) flight recorders are deactivated immediately after the flight is completed; and
(C) precautionary measures to preserve the recordings of flight recorders are taken
beforeleaving the flight crew compartment;’
In addition, a means for the flight crew to stop the CVR upon completion of the flight becomes
particularly relevant for serious incidents, where the CVR will not be stopped by the automatic means
to stop the CVR within 10 minutes of a crash impact, and the serious incident may have occurred hours
before landing. In that case, as much of the recording of the flight as possible should be preserved,
which means that the flight crew should have means to stop the CVR immediately after completion of
the flight.
When the CVR is stopped by the flight crew, only a manual and dedicated action should enable the
restarting of the CVR function: this is to avoid inadvertent restarting of the CVR (e.g by re-powering the
aircraft for troubleshooting), which would result in the overwriting of the relevant part of the CVR
recording.
(6) It has an alternate power source:
— that provides at least 9 minutes of electrical power to operate both the recorder
and cockpit-mounted area microphone; and
— to which the recorder and cockpit-mounted area microphone are switched
automatically in the event that all other power to the recorder is interrupted
either by a normal shutdown or by any other loss of power from the electrical
power bus.
Rationale
For the alternate power source (APS) to be of any benefit, it should not stay engaged for less than 10 –
1 = 9 minutes.
(7) If the recorder is deployable:
(i) It is capable of being automatically deployed.
(ii) The automatic deployment capability is engaged at least while the aeroplane is
airborne and it may also be engaged while the aeroplane is moving on the ground
at high speed;
Rationale
This is to harmonise with the standards in ICAO Annex 6 Part I, Appendix 8, 4.1 and to address the
deployment criteria, including the timing and conditions under which the recorder shall deploy. While
the aircraft is moving on the ground at low speeds (such as during taxying or the first part of the take-
off roll), deployment of the recorder might affect the capability for safe flight and landing (for example
because the relative airstream would typically not be strong enough to ensure that the trajectory of the
recorder would take it clear of the airframe). Therefore the deployment feature could be locked during
this period, and released once the aircraft takes off.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 13 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
(iii) The deployment occurs upon the detection of severe structural damage that
causes the immediate break-up of the aeroplane;
(iv) The deployment occurs upon the immersion of the aeroplane in water;
Rationale
These conditions rely on the deployment criteria provided in ED-112A, Section 3, 3-1.7 Deployment
Criteria. In addition, ICAO Annex 6 Part I, Appendix 8, 4.1 states that:
— ‘deployment shall take place when the aeroplane structure has been significantly deformed;
— deployment shall take place when an aeroplane sinks in water’.
(v) An assessment of the effects of unintended deployment is made in accordance
with the specifications of CS 25.1309 and it includes effects on third parties;
Rationale
The risk is that people on the ground may be injured by the deployed recorder. While the scope of
CS 25.130911 and AMC 25.1309 is limited to injuries to aircraft occupants and the safe continuation of
the flight, the system of classification offered by these provisions could also be used for the risk to
people on the ground. Given the size and weight of a deployable flight recorder12, it is unlikely that it
could seriously injure more than one person or cause extensive damage, if there is no scattered debris.
Therefore, the severity associated is not expected to exceed a level that corresponds to ‘hazardous’ in
AMC 25.1309: ’Hazardous: Failure Conditions, which would reduce the capability of the aeroplane or
the ability of the crew to cope with adverse operating, conditions to the extent that there would be:
A large reduction in safety margins or functional capabilities;
Physical distress or excessive workload such that the flight crew cannot be relied upon to perform their
tasks accurately or completely; or
Serious or fatal injury to a relatively small number of the occupants other than the flight crew.’
For such a level of severity, an acceptable probability would be less than 10 E-7 per flight hour
according to AMC 25.1309. In addition, it should be considered that only a small proportion of
unintended deployments will result in the most severe effect as described above. This assumption could
be justified by the proportion of the areas overflown that have a low or very low population density.
Even in the case of an unintended deployment over a dense urban area, the probability that the
recorder would hit anyone is certainly low. A conservative probability value of 10 % (i.e. 10 E-1) of
deployment cases is proposed as an assumption. In order to not cause an unacceptable level of safety,
the probability of deployment (intended and unintended) should be less than 10 E-6 per flight hour in
order for the probability to seriously injure someone on the ground to be less than 10 E-7 per flight
hour.
Note: ED-112A recommends ‘The overall quantitative probability (per flight hour) of the failure event
‘non-commanded deployment’ shall be <10 E-7. This probability objective addresses such hardware and
software components, which contribute directly to the deployment event’.
(vi) There is no means to manually deploy the recorder when the aircraft is capable of
moving under its own power; and
11
CS 25.1309: ‘(b) The aeroplane systems and associated components, considered separately and in relation to other systems, must
be designed so that:
(1) Any catastrophic failure condition
(i) is extremely improbable; and
(ii) does not result from a single failure; and
(2) Any hazardous failure condition is extremely remote; and
(3) Any major failure condition is remote.”
12
Example of a deployable recorder model installed on military aeroplanes: weight 3.8 kg, dimensions: 600 mm × 325 mm × 90 mm.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 14 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
Rationale
For search and rescue purposes it is always preferable for the ELT signal to be emitted from the place
where the flight ended. From an investigation point of view, a premature deployment of the flight
recorder may deprive investigators of the data needed in order to understand the cause of an accident.
ICAO Annex 6 Part I, Appendix 8, 4.1 states that ‘ADFR shall not be capable of manual deployment;’.
(vii) An indication is made to the flight crew when the flight recorder is no longer
attached to the aeroplane.
Rationale
It is essential that the flight crew is informed without delay after the deployment of the recorder or the
loss of the recorder (e.g. due to a failure of the attachment) (except during critical flight phases such as
take-off or landing) because:
— this would also trigger the integrated ELT, resulting in a false alert that the local ANSP, the local
Research Coordination Center and the aircraft operator would need to be quickly informed about;
— a flight recorder is a MMEL item and therefore the aircraft operator would need to be informed
without delay that a flight recorder is missing in order to have a spare unit ready;
— in a case of deployment during the take-off roll or the landing roll, the aircraft could potentially leave
on the runway an object that might create damage to following aircraft;
— it is important to recover the deployed recorder in order to aid failure investigation to understand
the reason for unintended deployment.
ICAO Annex 6 Part I, Appendix 8, 4.1 states that ‘an alert shall be made to the flight crew when the
ADFR is no longer captive to the aircraft’.
The deployment indication could be temporarily delayed until the end of critical flight phases such as
take-off or landing in order not to disturb the flight crew, except if the recorder might hit the airframe
and affect the safe conduct of the flight (e.g. because the air speed is too low): in this case an indication
should be immediately provided to the flight crew.
(e) The record container must be located and mounted to minimise the probability of rupture of the
container as a result of crash impact and consequent heat damage to the record from fire. In meeting
this requirement, the record container must be as far aft as practicable, but may not be where aft
mounted engines may crush the container during impact. However, it need not be outside of the
pressurised compartment. The container of the cockpit voice recorder is located and mounted to
minimise the probability of the container rupturing as a result of a crash impact or deployment and
consequent heat damage to the recording from fire, and to minimise the risk of compromising a
continued safe flight and landing.
Rationale
Deployment should be achieved without affecting the capability for safe flight and landing for the
whole flight envelope, including when the aircraft is airborne and when the aircraft is moving at high
speed on the ground. ICAO Annex 6 Part I, Appendix 8, 4.1 states that ‘the ADFR deployment shall not
compromise the safe continuation of the flight;’.
When a deployable recorder is installed, it is installed such that:
(1) Deployment can be achieved without significantly reducing the chance of survival of the
container of the recorder and its integrated emergency locator transmitter when the
aeroplane is airborne;
Rationale
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 15 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
This is to address the risk of the recorder or its integrated ELT being damaged during the deployment
sequence, so that the recorder could not be localised using the ELT signal, or recorded data could be
lost due to the deployment. This could be the case if the integrated ELT or its antenna was damaged,
the recorder airfoil was damaged and no longer buoyant, or no longer capable of making itself upright
in the water (making transmission of the ELT signal impossible because the ELT remained immersed).
ICAO Annex 6 Part I, Appendix 8, 4.1 states that ‘the ADFR deployment shall not significantly reduce the
chance of survival of the recorder and of successful transmission by its ELT;’.
(2) The deployment capability cannot be manually disengaged from the cockpit when the
aeroplane is capable of moving under its own power.
Rationale
This is to avoid non-deployment when deployment is needed. ICAO Annex 6 Part I, Appendix 8, 4.1
states that ‘the flight crew shall have no means to disable ADFR deployment when the aircraft is
airborne’.
(f) If the cockpit voice recorder has a bulk an erasure device, the installation is designed to minimise
the probabilities of inadvertent operation and of actuation of the device during crash impact
Rationale
The term ‘bulk erasure’ is specific to the use of magnetic media (magnetic tape or magnetic wire) for
recording, and therefore a more generic term should be used.
(g) Each recorder The container of the cockpit voice recorder –
(1) is either bright orange or bright yellow,; however, when the recorder is deployable, the
surface visible from outside the aeroplane, when the recorder is installed, may be of another
colour;
Rationale
This is to address the need to identify (by the use of colour and reflective tapes) the crash-protected
memory when installed on the aircraft, and after deployment.
In Amendment 41 of Annex 6 Part I, the possibility for the flight recorders to be bright yellow has been
removed for deployable recorders (refer to Annex 6 Part I, Appendix 8, 1.2). In order to facilitate the
search for the flight recorders at the scene of the accident, and given that in practice most models of
flight recorders are already bright orange, it is proposed to only retain this colour.
However, for a deployable recorder, when considering the surface visible from outside the aeroplane,
the colour may depend on the external livery of the airline.
ICAO Annex 6 Part I, Apppendix 8, 1.2 states that: ‘1.2 Automatic deployable flight recorder containers
shall: a) be painted a distinctive orange colour, however the surface visible from outside the aircraft
may be of another colour;’.
(2) Haves reflective tape affixed to its external surface to facilitate its location under water;
and
(3) Haves, when the recorder is not deployable, an underwater locating device, when required
by the operating rules, on or adjacent to the container which is secured in such a manner that
they are not likely to be separated during crash impact.;
Rationale
‘When required by operating rules’ is not necessary: basically all fixed crash-protected flight recorders
are required to be equipped with an underwater locating device (ULD) per ICAO Annex 6, FAA and EU
rules, etc.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 16 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
In addition, a ULD is necessary for locating a flight recorder under water. In the case of a deployable
recorder, because it should float, no underwater search operations will be necessary to locate it.
(4) Has, when the recorder is deployable, an integrated emergency locator transmitter that
automatically starts emitting during or after deployment, and
Rationale
This is In order to facilitate the immediate alerting of S&R centres, to allow localisation of the crash site,
and the actual position of the Recording Memory Unit to be detected.
(5) Is, when the recorder is deployable, able to float on water and self-oriented so that
emergency signal transmission is not impeded.
Rationale
Given that a deployable recorder is not fitted with a ULD, it relies on the ELT signal for its localisation
after an accident over water. Therefore the ELT that is integrated with the deployable recorder must be
out of the water, which in turn implies that the recorder has to float and be capable of righting itself in
the water in a way such that its integrated ELT does not stay immersed.
ICAO Annex 6 Part I, Appendix 8, 4.1 states that ‘the ADFR shall be able to float on water;’.
2. CS 25.1459 is amended as follows
CS 25.1459 Flight data recorders
(a) Each flight data recorder required by the operating rules must be installed so that –
[…]
Rationale
‘Flight recorder’ is replaced by ‘flight data recorder’ in the title and the text of CS 25.1459, in order to
align the designation of this piece of equipment with ICAO Annex 6 Part I, FAA Part 25 and the EU rules
for air operation.
[...]
(3) It receives its electrical power from the bus that provides the maximum reliability for
operation of the flight recorder without jeopardising service to essential or emergency
loads and without jeopardising the emergency operation of the aeroplane;
Rationale
This is to harmonise with the equivalent FAA requirement (see FAR 25, 25.1459(a)(3)(ii)).
[...]
(5) Except for recorders powered solely by the engine-driven electrical generator system,
there is an automatic means to simultaneously stop a the recorder that has a data erasure
feature and prevent each erasure feature from functioning, within 10 minutes after crash
impact.; and
Rationale
This is to align it with the similar requirement in CS 25.1457.
[…]
(7) If the cockpit voice recorder function is also performed by the recorder and no other
recorder is installed, any single electrical failure external to the recorder does not disable
both the cockpit voice recorder function and the flight data recorder function;
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 17 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
Rationale
To harmonise with equivalent FAA requirement (see FAR 25, 25.1459(a)(7)).
(8) If another recorder is installed to perform the cockpit voice recorder function, any single
electrical failure external to the recorder dedicated for the flight data recorder function
does not disable both recorders;
(9) If the recorder is deployable, it complies with CS 25.1457(d)(7).
Rationale
This is to harmonise the text with ICAO Annex 6 Part I.
(b) Each non-ejectable recordThe container of the flight data recorder must be located and mounted
so as to minimise the probability of container rupture or deployment resulting from crash impact
and subsequent damage to the recording from fire, and to minimise the risk of compromising a
continued safe flight and landing. In meeting this requirement
(1) Tthe recordcontainer must be located as far aft as practicable, but need not be aft of the
pressurised compartement, and may not be where aft-mounted engines may crush the
container upon impact (See AMC 25.1459(b)).
When a deployable recorder is installed, the installation must comply with
CS 25.1457(e)(3).
Rationale
This is to ensure that the deployment does not compromise the safe continuation of the flight, in
whichever flight phase the deployment occurs (including ground phases).
(c) A correlation must be established between the flight data recorder readings of airspeed, altitude,
and heading and the corresponding readings (taking into account correction factors) of the first
pilot’s instruments.
[…]
(d) Each recorder The container of the flight data recorder must comply with CS 25.1457(g).
Rationale
These requirements on the container do not depend on the type of flight recorder (FDR, CVR, etc),
therefore they do not need to be repeated in CS 25.1459.
(1) Be either bright orange or bright yellow;
(2) (1) Have reflective tape affixed to its external surface to facilitate its location under water;
and
(23)Have an underwater locating device, when required by the operating rules, on or adjacent
to the container which is secured in such a manner that they are not likely to be
separated during crash impact.
(e) Any novel or unique design or operational characteristics of the aircraft must be evaluated to
determine whether any dedicated parameters must be recorded on the flight data recorders in
addition to, or in place of, existing requirements.
(f) If the flight data recorder has an erasure device, the installation must be designed to minimise the
probability of the inadvertent operation or actuation of the erasure device during a crash impact.
Rationale
This is to align the text with the similar requirement for CVRs.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 18 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
3.3.2. Draft Certification Specifications for Large Rotorcraft (Draft EASA decision amending CS-29)
1. CS 29.1457 is amended as follows
CS 29.1457 Cockpit voice recorders
[…]
d) Each cockpit voice recorder must be installed so that:
(1) It receives its electric power from the bus that provides the maximum reliability for operation
of the cockpit voice recorder without jeopardising service to essential or emergency loads
and without jeopardising the emergency operation of the rotorcraft:;
Rationale
This is to harmonise with the equivalent FAA requirement (see FAR 29, 29.1457(d)(1)).
(2) There is an automatic means to simultaneously stop the recorderand prevent each erasure
feature from functioning, within 10 minutes after crash impact;.and
Rationale
The deleted part is is already included in the provisions of 29.1457 (f). The means for automatically
stopping the CVR after a crash impact shall stop the CVR even if power can still be supplied by the CVR
normal power source or the CVR alternate power source.
(3) There is an aural or visual means for pre-flight checking of recorder the for proper operation;
(4) If the flight data recorder function is also performed by the recorder and no other recorder is
installed, any single electrical failure external to the recorder does not disable both the
cockpit voice recorder function and the flight data recorder functions;
(5) If another recorder is installed to perform the flight data recorder function, any single
electrical failure external to the recorder that is dedicated to the cockpit voice recorder
function does not disable both recorders;
Rationale
This is to harmonise with the equivalent FAA requirement (see FAR 29, 29.1457(d)(4)).
(6) There is a means for the flight crew to stop the cockpit voice recorder function upon
completion of the flight in a way such that re-enabling the cockpit voice recorder function is
only possible by dedicated manual action.
Rationale
In order to preserve most of the useful CVR recording after a serious incident, there should be a means
for the flight crew to stop any CVR function when the aircraft is on the ground. When the CVR is
stopped by such a means, only a manual and dedicated action should enable the restarting of the CVR
function.
(7) It has an alternate power source:
— That provides 10 ± 1 minutes of electrical power to operate both the recorder and
cockpit-mounted area microphone;
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 19 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
— To which the recorder and cockpit-mounted area microphone are switched
automatically in the event that all other power to the recorder is interrupted either
by a normal shutdown or by any other loss of power from the electrical power bus.
Rationale
This is to harmonise with the FAA Requirement (see FAR 29, 29.1457(d)(5)).
For a helicopter, it is assumed that the flight phase after the loss of all engines would in any case not
last more than 10 minutes (including the evacuation phase), therefore the maximum engagement
duration of the APS does not need to be more than 10 + 1 minutes. Indeed, the rate of descent for a
standard autorotative descent is typically between 2 000 ft/min et 3 000 ft/min and most helicopters
have a flight ceiling of around 20 000 ft or less. In addition, in the vast majority of cases, the height
above terrain is much less than 20 000 ft when engine power is lost, so the autorotative descent lasts
much less than 10 minutes (typically a few tens of seconds to 2 or 3 minutes).
(e) The record container of the cockpit voice recorder is must be located and mounted to minimise the
probability of rupture of the container as a result of crash impact and consequent heat damage to the
record from fire.
(f) If the cockpit voice recorder has a bulk an erasure device, the installation is designed to minimise
the probabilities of inadvertent operation and of actuation of the device during crash impact.
Rationale
The term ‘bulk erasure’ is specific to the use of magnetic media (magnetic tape or magnetic wire) for
recording, and therefore a more generic term should be used.
(g) Each The recorder container of the cockpit voice recorder is must be either bright orange or bright
yellow.
Rationale
In order to facilitate the search for the flight recorders at the scene of the accident, and given that, in
practice, most models of flight recorders are already bright orange, it is proposed, as for CS-25, to only
retain this colour.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 20 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
2. CS 29.1459 is amended as follows
CS 29.1459 Flight data recorders
(a) Each flight data recorder required by the applicable operating rules is must be installed so that: […]
Rationale
Flight recorder’ is replaced by ‘flight data recorder’ in the title and the text of CS 29.1459, in order to
align the designation of this piece of equipment with ICAO Annex 6 Part III, FAA Part 29 and the EU
rules for air operations.
(3) It receives its electrical power from the bus that provides the maximum reliability for
operation of the flight recorder without jeopardising service to essential or emergency
loads and without jeopardising the emergency operation of the rotorcraft;
[…]
Rationale
This brings harmonisation with the equivalent FAA requirement (see FAR 29, 29.1459(a)(3)).
(5) Except for recorders powered solely by the engine-driven electrical generator system, there
is an automatic means to simultaneously stop a the recorder that has a data erasure
feature and prevent each erasure feature from functioning, within 10 minutes after crash
impact;.
Rationale
This is to align with CS 29.1457.
(6) If the cockpit voice recorder function is also performed by the recorder and no other
recorder is installed on board the rotorcraft, any single electrical failure external to the
recorder does not disable both the cockpit voice recorder function and the flight data
recorder functions; and
(7) If another recorder is installed on board the rotorcraft to perform the cockpit voice
recorder function, any single electrical failure external to the recorder dedicated to the
flight data recorder function does not disable both recorders.
Rationale
This brings harmonisation with the equivalent FAA requirement (see FAR 29, 29.1459(a)(6)).
[…]
(b) Each non-ejectable The container of the flight data recorder is must be located and mounted so as
to minimise the probability of container rupture resulting from crash impact and subsequent damage
to the recording from fire.
(c) A correlation is established between the flight data recorder readings of airspeed, altitude, and
heading and the corresponding readings (taking into account correction factors) of the first pilot’s
instruments.[…]
(d) Each recorder The container of the flight data recorder must:
(1) Be either is bright orange or brigh yellow;
(2) have has a reflective […]…
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 21 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
(e) If the flight data recorder has an erasure device, the installation is designed to minimise the
probability of the inadvertent operation or actuation of the erasure device during crash impact.
Rationale
This is to align the text for FDRs with the similar requirements for CVRs.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 22 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
3.4. Draft acceptable means of compliance and guidance material (Draft EASA decision)
3.4.1. Draft AMC/GM to CS-25 Large Aeroplanes
AMC — SUBPART F– EQUIPMENT
1. AMC 25.1457 is amended as follows
AMC 25.1457 Cockpit Voice Recorders
1. General
In showing compliance with CS 25.1457, the applicant should take into account EUROCAE document
No. ED-112A ‘MOPS for Crash Protected Airborne Recorder Systems’. ED-56 ‘Minimum Operational
Performance Requirement for Cockpit Voice Recorder System’, as referred to in ETSO-C123a.
Rationale
ED-56A was superseded by ED-112 in 2003, which in turn was superseded in 2013 by ED-112A. ICAO
Annex 6, Part I, Chapter 6, 6.3, Note 5, states: ‘For aeroplanes for which the application for type
certification is submitted to a Contracting State on or after 1 January 2016, specifications applicable to
flight recorders may be found in EUROCAE ED-112A, Minimum Operational Performance Specification
(MOPS), or equivalent documents.’
2. Combination recorders
a. If the recorder performs several recording functions (i.e. it is a combination recorder), the
means for pre-flight checking the recorder for proper operation should indicate which
recording functions have failed.
Rationale
The flight recorders are MMEL items. The CVR recording function or the FDR recording function of a
combination recorder may be inoperative, provided the other function is operative (refer to CS-MMEL)
b. When two flight data and cockpit voice combination recorders are installed because they
are required or because they are an acceptable alternative to a flight data recorder and a
cockpit voice recorder, then these two flight data and combination recorders should be
connected to separate power buses.
Rationale
When considering the case of two flight data and cockpit voice combination recorders, ED-112A
specifies that the FDR functions (respectively the CVR functions) in the combination recorders shall be
powered by two different electrical sources unless it is shown that any single electrical failure external
to a recorder does not disable both FDR functions (respectively both CVR functions). This is interpreted
as meaning that combination recorders should be connected to separate power buses that also rely on
different power sources, as far as practicable.
3. Automatic means to stop the recorder after a crash impact
The automatic means to stop the recorder should operate even if a power supply is still available. The
automatic means to stop the recorder within 10 minutes after a crash impact may rely on:
(a) dedicated crash impact detection sensors. In that case, negative acceleration sensors (also
called ‘g-switches’) should not be used as the sole means of detecting a crash impact; or
Rationale
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 23 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
G-switches have been pointed out as being unreliable by EUROCAE Documents ED-56A and ED-112, so
instead of using them, other means for stopping the recording in case of a crash impact are
recommended;
G-switches continue to be pointed out as being unreliable by EUROCAE Documents ED-112A, which
recommends that they should not be used as the sole means for detecting a crash impact;
There have been 10 cases of premature endings of recording being caused by undesired g-switch
triggers (see Annex 2). These cases did not affect aeroplanes with an MCTOM of over 27 000 kg, for
which g-switches have not been used as a means to comply with CS 25.1457;
The MOPS for aircraft emergency locator transmitters contained in ED-62A include specifications for
g-switches; however, these specifications are not expected to provide for a better detection of crash
impact because they are meant for another purpose (rescuing survivors), and therefore, they are based
on a trade-off between nuisance warnings and missed alerts that is different from the appropriate
trade-off for a flight recorder.
(b) the recorder start-and-stop logic, provided that this start-and-stop logic stops the recorder
between 9 and 10 minutes after power is lost on all engines (and, when applicable, the APU)
when the aircraft is on the ground.
Rationale
If the start-and-stop logic is used to comply with CS 29.1457(d)(2), it should be ensured that this logic
does not stop the recorder before the APS has fulfilled its purpose of delivering backup electrical power
to the recorder for its minimum engagement duration (9 minutes) after engine power is lost, in order to
record gliding approaches, landing rolls without power (in cases of a loss of all engines in flight) and
emergency evacuations (e.g. if there is a fire on board). Therefore, the condition is that the aircraft is on
the ground and that the recorder is stopped not earlier than 9 minutes after power is lost on all
engines.
On the other hand, CS 29.1457(d)(2) requires the automatic means to stop the recorder within 10
minutes of a crash impact. As a result, the start-and-stop logic must stop the recorder between 9 and
10 minutes after a loss of power on all engines.
4. Means for the flight crew to stop the recorder
The means required for the flight crew to be able to stop the cockpit voice recorder function after
completion of the flight is needed in order to preserve the CVR recording for the purpose of
investigating accidents and serious incidents. In fulfilling this requirement, it is acceptable to use circuit
breakers to remove the power to the equipment. Such a means to stop the cockpit voice recorder
function is not in contradiction to 25.1357(f), because its use would not be under normal operating
conditions, but after an accident or a serious incident has occurred.
Rationale
CAT.GEN.MPA.105(10)(iii) requires the commander of a flight to ensure that ‘in the event of an accident
or a serious incident, or if preservation of recordings of flight recorders is directed by the investigating
authority:
(A) flight recorders’ recordings are not intentionally erased;
(B) flight recorders are deactivated immediately after the flight is completed; and
(C) precautionary measures to preserve the recordings of flight recorders are taken before leaving the
flight crew compartment;’
In addition, a means for the flight crew to stop the CVR upon completion of the flight becomes
particularly relevant for serious incidents, where the CVR will not be stopped by the automatic means to
stop the CVR within 10 minutes of a crash impact.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 24 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
5. Power sources
(a) If the recorder supports a data link recording function, this function does not require a separate
power bus.
(b) An alternate power source is a power source that is different from the source that normally
provides power to the cockpit voice recorder function. In CS 25.1457(d)(7), a ‘normal shutdown’ of
power to the cockpit voice recorder means a commanded interruption of the power supply from the
normal cockpit voice recorder power bus, for example, after the termination of a normal flight. If an
alternate power source is installed:
i. The use of aeroplane batteries or other power sources is acceptable, provided that electrical
power to essential and critical loads is not compromised.
ii. If the alternate power source relies on dedicated stand-alone batteries (such as a recorder
independent power supply), then these batteries should be located as close as practicable to the
recorder.
Rationale
With regard to the use of aeroplane batteries, refer to ICAO Annex 6 Part I, Chapter 6, 6.3.2.4, Note 1:
‘Note 1.— ‘Alternate’ means separate from the power source that normally provides power to the CVR.
The use of aeroplane batteries or other power sources is acceptable provided that the requirements
above are met and electrical power to essential and critical loads is not compromised.’ In addition,
alternative installation designs such as those that use the aircraft emergency battery were already
accepted by the FAA through their equivalent level of safety (ELOS) findings for several aircraft models.
(Refer to ELOS Memo TD0774IB-T-SA-1 for Airbus models A330 and A340, and to ELOS Memo SP0778IB-
T-SE-101 for ATR models ATR 42-500 and ATR 72-200). EASA has concurred with these ELOS finding.
When the APS relies on stand-alone batteries, they should be close to the recorder in order to reduce
the risk that the power line between the APS and the recorder is cut prematurely (i.e. in the first 9
minutes after it became engaged). ED-112A, Chapter 5-6, 5-6.2 states: ‘The RIPS and the recorder to be
powered should be located as close as practical so as to minimize the length of the interwiring’.
iii. The means for performing a pre-flight check of the recorder for proper operation should
include a check on the availability of the alternate power source.
iv. When the cockpit voice recorder function is combined with other recording functions within
the same unit, the alternate power source may also power the other recording functions.
Rationale
This is to harmonise with ICAO Annex 6, Part I, Amendment 38.
v. If two flight data and cockpit voice combination recorders are installed because they are
required or because they are an acceptable alternative to single-function recorders, then
only one recorder needs to have an alternate power source for the cockpit voice recorder
function. This should be the combination recorder located closer to the cockpit area.
Rationale
The combination recorder that has the CVR function should have an alternate power source.
(c) If the cockpit voice recorder function has a recording duration of less than 25 hours, electrical
power should not be supplied for more than 30 minutes after power is lost on all engines.
Rationale
When considering the duration of the CVR recording, in order to not overwrite too much of the
recording of events, the recording should stop after the power on all engines is lost. In practice, while
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 25 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
losing 1 hour of older recordings could be acceptable for a CVR with a recording duration of 25 hours or
more, it would not be the case for a CVR with a recording duration of 2 hours. It is proposed to not
power the CVR more than 30 minutes after power on all engines is lost.
It should be noted that in ELOS Memo TD0774IB-T-SA-1, it was stressed that power would be supplied
‘until aircraft total immobilisation’, not just for 10 ± 1 minutes. In addition, the investigation of the
accident of the B-737 registered EI-ENB on 21/12/2010 pointed out the need to record, when possible,
the evacuation phase.
It should also be noted that (b) applies to all aeroplanes, whether or not they have an alternate power
source. Indeed some aeroplane models already use the aircraft emergency batteries as the main power
supply to the CVR: in that case, even if the aeroplane emergency battery is capable of powering the CVR
for a longer period, it is not desirable to keep the CVR powered for more than 30 minutes when it has a
recording duration of less than 25 hours.
6. Recorder container
The attachment of the recorder container should comply with the specifications given in EUROCAE
Document No ED-112A.
The recorder container should be installed in the rear section of the aeroplane in an area that increases
the chances of the equipment surviving crash impact forces and heat damage caused by fire. For this
purpose, the recorder container should be installed in the rear section of the fuselage. However, it
should not be installed where aft mounted engines may crush the container during impact.
When two separate combination flight data and cockpit voice recorders are installed, then the
container of the recorder dedicated to the cockpit voice recorder function may be located near the
flight crew compartment if at least one recorder is installed in the rear section and meets
crashworthiness specification applicable to fixed flight recorders.
Rationale
This is to address the issue of the location of the combination recorders. The CVR should be located
near the flight crew compartment, in order to minimise the risk of data loss due to a failure of the
wiring that carries data to the recorder.
For consistency with air operations requirements: CS 25.1457 and CS 25.1459 recommend that the FDR
and the CVR be located as far aft as practicable in order to maximise the probability that the crash-
protected memory survives the impact forces and a potential fire. However, these parapgraphs do not
contain any specific provisions for combination recorders. The Air Operations requirements, on the
other hand, recommend that when two flight data and cockpit voice combination recorders are
installed, one should be located near the flight crew compartment (…). The other one should be located
at the rear section of the aeroplane (refer to Annex IV to Commission Regulation (EU) 965/2012 (Part-
CAT), CAT.IDE.A.200).
7. Deployable recorder
When the recorder is deployable:
(a) The deployable recorder installation should comply with CS 25.1457(e)(3).
Rationale
This is to address the fact that the deployment should not compromise the safe continuation of the
flight, in whichever flight phase the deployment occurs (including ground phases).
(b) There may be a means to manually disengage the deployment capability when the aircraft
is not capable of moving under its own power; however, in this case, an indication should
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 26 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
be made to the flight crew during the pre-flight checks if the deployment capability is
disengaged.
Rationale
Such a manual disengagement is to avoid an undesirable deployment during maintenance.
(c) The deployable recorder installation should be such that the recorder deploys in the event
of an explosion or collision. However, the installation should not be such that the recorder
deploys in a non-catastrophic occurrence such as a hard landing or a tail strike.
(d) Deployment should take place without the deployed recorder striking any part of the
airframe when the aircraft is airborne or when the aeroplane is moving on the ground at
high speed. This should be achieved for the whole flight envelope, including a margin
outside the normal flight envelope which might be expected during the initial stages of an
accident sequence. Similarly, deployment from an aircraft in an unusual attitude should not
make the survival of the recorder less likely.
Rationale
This is in order to limit undesirable deployments, which have several consequences: the loss of a MMEL
item, a foreign object being left on the runway, unnecessary transmission of an emergency signal to
COSPAS-SARSAT, etc.
(e) The indication that the recorder is no longer attached to the aircraft should be presented as
early as permitted by the principles of AMC 25.1322.
Rationale
It is essential that the flight crew is informed without delay regarding the deployment of the recorder or
the loss of the recorder (e.g. due to a failure of the attachment) (except during critical flight phases
such as take-off or landing) because:
— this would also trigger the integrated ELT, resulting in a false alert that the local ANSP, the local
Research Coordination Center and the aircraft operator would need to be quickly informed about.
— a flight recorder is a MMEL item and therefore the aircraft operator would need to be informed
without delay that a flight recorder is missing in order to have a spare unit ready.
—in a case of deployment during the take-off roll or the landing roll, the aircraft could potentially leave
on the runway an object that might create damage to following aircraft.
—it is important to recover the deployed recorder in order to aid failure investigation to understand the
reason for unintended deployment.
(f) The deployment capability should perform under all environmental conditions for which the
aircraft is certificated.
(g) The effect of exposure to environmental conditions (such as temperature, rain, lightning
strikes, etc.) on the serviceability of the flight recorder and of its deployment capability
should be addressed by protection and/or maintenance instructions. Instructions should
also be defined to avoid operations on aircraft external surfaces (such as painting, cleaning,
applying anti-icing fluids, etc.) affecting the serviceability of the flight recorder and its
deployment capability.
(h) The risk of injuries caused to persons on the ground due to unintended deployment of the
recorder during aircraft maintenance, taxying or ground handling should be adressed by:
— detailed instructions; and
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 27 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
— the fact that the deployment mechanism can only release the recorder in one piece.
Rationale
Unlike fixed recorders (not located at the surface of the aircraft), deployable recorders are exposed to
environmental conditions.The deployment does not release more than one piece, in order to limit the
hazard of foreign objects on a runway, as well as the risk to people on the ground. ICAO Annex 6 Part I,
Appendix 8, 4.1 states that ‘the ADFR deployment shall not release more than one piece;’.
2. AMC 25.1459(a)(4) and AMC 25.1459(b) are deleted, and a new AMC 25.1459 is created as follows
AMC 25.1459 Flight Data Recorders
1. General
In showing compliance with CS 25.1459, the applicant should take into account EUROCAE document
No. ED-112A ‘MOPS for Crash Protected Airborne Recorder Systems’.
2. Automatic means to stop the recorder after a crash impact
Refer to the Section of AMC 25.1457 titled ‘Automatic means to stop the recorder after a crash
impact’.
3. Means for pre-flight checking of the recorder
The means for pre-flight checking of the recorder should be able to detect and indicate the following:
a. loss of electrical power to the flight recorder system;
b. failure of the data acquisition and processing stages;
c. failure of the recording medium and/or drive mechanism; and
d. failure of the recorder to store the data in the recording medium as shown by checks of the
recorded data including, as reasonably practicable for the storage medium concerned, its
correct correspondence with the input data.
4. Recorder container
Refer to the Section of AMC 25.1457 titled ‘Recorder container’.
5. Combination recorder
Refer to the Section of AMC 25.1457 titled ‘Combination recorder’.
6. Deployable recorder
Refer to the Section of AMC 25.1457 titled ‘Deployable recorder’
3.4.2. Draft AMC/GM to CS-29 Large Rotorcraft
AMC — SUBPART F – EQUIPMENT
1. AMC 29.1457 is created as follows:
AMC 29.1457 Cockpit Voice Recorders
1. General
In showing compliance with CS 29.1457, the applicant should take into account EUROCAE document
No. ED-112A ‘MOPS for Crash-Protected Airborne Recorder Systems’.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 28 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
2. Automatic means to stop the recorder after a crash impact
The automatic means to stop the recorder within 10 minutes after a crash impact may rely on:
(a) dedicated crash impact detection sensors. In that case, negative acceleration sensors (also
called ‘g-switches’) should not be used as the sole means of crash impact detection; or
Rationale
G-switches have been pointed out as being unreliable by EUROCAE Documents ED-56A and ED-112, so
instead of using them, other means for stopping the recording in case of a crash impact are
recommended;
G-switches continue to be pointed out as being unreliable by EUROCAE Documents ED-112A, which
recommends that they should not be used as the sole means for detecting a crash impact;
There have been 10 cases of premature endings of recording being caused by undesired g-switch
triggers. These cases did not affect aeroplanes with an MCTOM of over 27 000 kg, for which g-switches
have not been used as a means to comply with CS 25.1457;
There is neither evidence nor substantiation that an acceleration-based sensor is reliable enough for
detecting a crash impact for the purpose of stopping the flight recorders;
The MOPS for aircraft emergency locator transmitters contained in ED-62A include specifications for g-
switches, however, these specifications are not expected to provide for a better detection of crash
impact because they are meant for another purpose (rescuing survivors), and therefore they are based
on a trade-off between nuisance warnings and missed alerts that is different from the appropriate
trade-off for a flight recorder.
(b) the recorder start-and-stop logic, provided that this start-and-stop logic stops the
recorder between 9 and 10 minutes after the loss of power on all engines.
Rationale
It should be ensured that if the start-and-stop logic is used to comply with CS 29.1457(d)(2), then this
logic does not stop the recorder before the APS has fulfilled its purpose of delivering backup electrical
power to the recorder for its minimum engagement duration (9 minutes) after engine power is lost, in
order to record autorotation and emergency evacuations (e.g if there is a fire on board). Therefore, the
condition is that the recorder should be stopped not earlier than 9 minutes after power is lost on all
engines. On the other hand, CS 29.1457(d)(2) requires the automatic means to stop the recorder within
10 minutes of a crash impact. As a result, the start-and-stop logic must stop the recorder between 9
and 10 minutes after a loss of power on all engines.
3. Means for the flight crew to stop the CVR
The means for the flight crew to stop the cockpit voice recorder function after completion of the flight
is needed in order to preserve the cockpit voice recorder recording for the purpose of investigating
incidents and serious incidents. In fulfilling this requirement, it is acceptable to use circuit breakers to
remove the power to the equipment. Such a means to stop the cockpit voice recorder function is not in
contradiction to 25.1357 f), because its use would not be under normal operating conditions, but after
an accident or a serious incident has occurred.
4. Power sources
(a) The alternate power source is a power source different from the source that normally provides
power to the recorder. In CS 29.1457(d)(7), a normal shutdown of power to the recorder means a
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 29 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
commanded interruption of the power supply from the normal cockpit voice recorder power bus, for
example after termination of a normal flight. If an alternate power source is installed:
i. The use of helicopter batteries or other power sources is acceptable, provided that electrical
power to essential and critical loads is not compromised.
ii. If the alternate power source relies on dedicated stand-alone batteries (such as a recorder
independent power supply) then these batteries should be located as close as practicable to
the recorder.
iii. When the cockpit voice recorder function is combined with other recording functions within
the same unit, the alternate power source may also power the other recording functions.
iii. The means for pre-flight checking of the recorder for proper operation should include a
check of the availability of the alternate power source.
(b) If the recorder supports a data link recording function, this function does not require a separate
power bus.
5. Combination recorder
In cases where the recorder performs several recording functions, the means for pre-flight checking of
the recorder for proper operation should indicate which recording functions (e.g. FDR, CVR, data-link
recording, etc.) have failed.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 30 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
3. Proposed amendments and rationale in detail
2. A new AMC 29.1459, is created as follows:
AMC 29.1459 Flight Data Recorders
1. General
In showing compliance with CS 29.1459, the applicant should take into account EUROCAE document
No. ED-112A ‘MOPS for Crash-Protected Airborne Recorder Systems’.
2. Automatic means to stop the recorder after a crash impact
Refer to the Section of AMC 29.1457 titled ‘Automatic means to stop the recorder after a crash
impact’.
3. Combination recorder
Refer to the Section of AMC 29.1457 titled ‘Combination recorder’.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 31 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
4. Impact assessment (IA)
4. Impact assessment (IA)
4.1. What is the issue
CS-25 and CS-29 contain certification specifications (CS XX.1457 and CS XX.1459) and related AMCs for
the installation of CVRs and FDRs, when required by the AirOPS Regulation.
This RMT proposes to improve the availability of flight recorders, by amending the CS. In particular, the
following issues are addressed:
— FDR and CVR power supplies;
— automatic stopping of a recording after an accident;
— combination recorders;
— deployable recorders; and
— performance specifications for flight recorders.
Each of these issues has been detailed in Chapter 2 above.
4.2. Safety risk assessment
All five issues are related to the availability of data from flight recorders.
Flight recorders are not critical for the safe conduct of a flight; however, they are essential safety
investigation tools. The unavailability of flight recorder data may delay or hinder the identification of a
hazard that led to an accident. Ultimately, a similar accident on other aircraft at risk could occur
because the root cause of the first accident was not identified.
4.3. Who is affected
The stakeholders affected by this issue are:
— large aeroplane and large rotorcraft type certificate (TC)/supplemental type certificate (STC)
holders and applicants;
— operators of large aeroplanes and large rotorcraft used in commercial air transport;
— civil aviation safety investigation authorities;
— EASA and national aviation authorities of the Member States.
4.4. How could the issue/problem evolve
If no corrective action is taken by EASA, the issues identified in Section 4.1 above are expected to
remain unchanged.
4.5. What we want to achieve — objectives
The goal of this RMT is to improve the availability of data for the investigation of accidents, and in
doing that, to improve the level of safety of aircraft by updating the requirements and CSs regarding
flight recorders for large aeroplanes and large rotorcraft.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 32 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
4. Impact assessment (IA)
4.6. How it could be achieved — options
Tables of selected policy options
Table 1: A – FDR and CVR power supply
Option Short title Description
No
0 Do nothing No policy change (no change to the rules; risks remain as outlined in the
issue analysis).
1 CS-25 and Require in CS-25 and CS-29 alternate power supplies for CVRs and that a
CS-29 update single power supply failure does not disable both the CVR and the FDR.
2 Part-CAT Require that all aeroplanes with an MCTOM over 27 000 kg and first
update issued with an individual CofA on/or after [date of publication + 3 years]
be equipped with an alternate power source for their CVRs.
3 CS-25 and CS- Option 1+2.
29 + Part-CAT
update
Table 2: B - Automatic stop of the recording after a crash
Option Short title Description
No
0 Do nothing No policy change (no change to the rules; risks remain as outlined in the
issue analysis).
1 CS-25 and Require that the automatic means for stopping the recorder after a
CS-29 update crash impact operates even if a power supply is still available.
Create an AMC to recommend that a negative acceleration sensor is not
used as the sole means to detect a crash impact and to provide the
conditions under which relying on the start-and-stop logic of the
recorder is acceptable.
Table 3: C - Combination recorders
Option Short title Description
No
0 Do nothing No policy change (no change to the rules; risks remain as outlined in the
issue analysis).
1 CS-25 update Include provisions in CS-25 that define the conditions for the installation
of combination recorders.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 33 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
4. Impact assessment (IA)
Table 4: D - Deployable recorders
Option Short title Description
No
0 No change No policy change (no change to the rules; risks remain as outlined in the
issue analysis).
1 CS-25 update Include provisions in CS-25 that define the conditions for the installation
of deployable recorders.
Table 5: E – Performance specifications
Option Short title Description
No
0 No change No policy change (no change to the rules; risks remain as outlined in the
issue analysis).
1 CS-25 and Include in the AMC to CS-25 and to CS-29 references to EUROCAE
CS-29 update Document 112A.
4.7. What are the impacts
4.7.1. Safety impact
For the five subjects, the safety risk identified in Section 4.2 would remain unchanged with Option 0
(no rule change).
For subject A (for which three options are proposed): Option 3 (which includes a requirement on newly
manufactured large aeroplanes, i.e., a production cut-in), would allow EASA to address the safety risk
sooner than Option 1 (in which the requirement is limited to new designs).
For subjects B & E, (for which two options are proposed): the update of CS-25/CS-29 and the related
AMC would help to improve the availability of FDR and CVR recordings after an accident or a serious
incident, thereby facilitating the investigations conducted by civil aviation safety investigation bodies.
This, in turn, would contribute to better identifying and mitigating the causes of accidents/serious
incidents.
For subjects C & D (for which two options are proposed): giving a common framework for the
installation of combination recorders and deployable recorders would facilitate the approval of
installations that use these technologies. This would, in turn, increase the probability that flight
recorder data can be retrieved by safety investigation authorities, hence accelerating the
understanding of accident causes and the identification of corrective actions.
4.7.2. Environmental impact
For the five subjects, no environmental impact is expected.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 34 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
4. Impact assessment (IA)
4.7.3. Social impact
An unexplained accident may have a temporary negative impact on the brand image of the parties
involved and on the public perception of aviation safety in general, as long as uncertainty regarding the
causes of the accident remains.
For each subject, this negative impact would remain unchanged with Option 0, while any other option
would contribute to mitigating this potential negative social impact.
4.7.4. Economic impact
Option 0 (A, B, C, D, E)
For each of the subjects, the cost induced with Option 0 would remain unchanged or would increase:
— for additional extended safety investigations because flight recorder data would not be available
(A, B);
— for extended missions searching for lost recorders, such as in the examples of AF 447 or MH 370
( D);
— for design organisations when designing new products without any available certification
specifications. The certification of such designs would need to be handled through special
conditions, which would involved costs in time and resources for both EASA and the applicant.
(A, B, C, D).
— for re-designs because unacceptable solutions would have been designed and EASA expectations
were not available in the certification specifications.
Option 1 (A, B, C, D, E)
The economic impact would be negligible, since only new designs would be affected. Aircraft designers
would have time to take into account the new certification specifications for flight recorders at an
earlier stage, and include their cost in the global design cost of the entire product.
Option 2 and 3 (A)
The economic impact here would also be negligible. Current designs of newly manufactured aeroplanes
would need to be modified. However, this is mitigated by the fact that aircraft designers are already
required to comply with the equivalent FAA certification and air operation requirements to have an
alternate power source13. Therefore the re-design efforts have already been made by most of the
manufacturers.
Globally, Options 1, 2 and 3 allow the costs resulting from Option 0 as mentioned above to be avoided.
4.7.5. Impact on harmonisation
The proposed amendments would globally have a positive impact on harmonisation, since some of
them (in particular, the provisions for CVR power supplies, for deployable recorders, and for
combination recorders) are aligned with ICAO Annex 6 and/or with the equivalent FAA requirements.
13
This means that all U.S. registered turbine-engine aeroplanes that have a seating capacity of more than 20 or a maximum payload
capacity of 6 000 lb or more, and which were manufactured after 7 April 2010, are required to carry a CVR installed in accordance
with CS 25.1457, including the ‘independent power source’: refer to FAR 125.227(h).
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 35 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
4. Impact assessment (IA)
4.7.6. General Aviation and proportionality issues
Not applicable. The proposal does not affect General Aviation (GA).
4.7.7. Conclusion
4.7.8. Comparison of options
Option 0 does not meet EASA's objectives. It would not help to prevent future accidents and would
have no economic benefits.
On the contrary, the benefits of the selected preferred options (see the green boxes below) are:
— an increase in the level of safety;
— that they address safety recommendations;
— cost savings for search and rescue activities;
— cost savings for certification activities;
— transposition of the ICAO standards and recommendations into the EU rules; and
— greater harmonisation with FAA regulations.
These options have no impact on the environment or on GA and do not create any proportionality
issues. Therefore, no drawbacks are expected.
Therefore, the selected preferred options are summarised in the table below (green boxes show the
selected options):
Option 0 Option 1 Option 2 Option 3
Do nothing Update CS Update Part-CAT Update CS + Part-CAT
A (Resilience to power Not selected preferred
loss)
B (Automatic stopping
of recording) Not selected preferred Not applicable
C (Combination
recorders)
D (Deployable
recorders)
E (Performance
specifications for flight
recorders )
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 36 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
5. Proposed actions to support implementation
5. Proposed actions to support implementation
No particular action is expected.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 37 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
6. References
6. References
6.1. Affected regulations
Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and
administrative procedures related to air operations
6.2. Affected decisions
— Decision No. 2003/2/RM of the Executive Director of the Agency of 17 October 2003 on
certification specifications, including airworthiness codes and acceptable means of compliance,
for large aeroplanes (« CS-25 »)
— Decision No. 2003/16/RM of the Executive Director of the Agency of 14 November 2003 on
certification specifications for large rotorcraft (« CS-29 »)
— Decision No. 2012/018/R of the Executive Director of the Agency of 24 October 2012 on
Acceptable Means of Compliance to Part-CAT
6.3. Other reference documents
— ICAO Annex 6 Operation of Aircraft, Part I International Commercial Air Transport –Aeroplanes,
10th edition, 2017.
— ICAO Annex 6, Operation of Aircraft, Part III International Operations – Helicopters, 8th edition,
2016
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 38 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
7. Appendix
7.1. Annex 1
Table 1: Occurrences of premature ending of CVR recording due to loss of power on all engines
(including the APU)
Aircraft Aircraft Date of the Investigation Findings made in the investigation report;
Make and registration occurrence authority If any, safety recommendation
Model and operator (Name and State)
DC-9 N904VJ, 11/05/1996 NTSB, USA On May 11, 1996, the crew of ValuJet flight 592, a DC-9-32,
ValuJet reported smoke and fire shortly after departing Miami,
Florida. The flight recorders stopped about 40 to 50 seconds
before the airplane crashed on its return to the airport, killing
all 111 passengers and crew.
’1.1 History of flight
At 1412:45, the controller transmitted, “Critter five ninety two
keep the turnaround heading uh one two zero.” There was no
response from the flight crew. The last recorded FDR data
showed the airplane at 7,200 feet amsl, at a speed of 260
KIAS, and on a heading of 218.
(…) The accident occurred at 1413:42.’
B747 N93119, TWA 07/07/1996 NTSB, USA ‘The cessation of the CVR recording at 2031:12 was consistent
with the loss of electrical power to the recorder.’
‘1.11.1 Cockpit Voice Recorder
The cessation of the CVR recording at 2031:12 was consistent
with the loss of electrical power to the recorder.’
B737 9V-TRF, Silk 19/12/1997 NTSC, Indonesia On December 19, 1997, SilkAir flight 185, a Boeing 737,
Air entered a rapid descent from 35 000 ft, which ended with a
high speed impact in the Sumatran River near Palembang,
Indonesia. There were 104 fatalities. The Indonesian
investigation, in which the Safety Board participated,
determined that both flight recorders stopped prior to the
airplane entering the rapid descent (summary provided by
NTSB USA).
MD-11 HB-IWF, 02/09/1998 TSB, Canada ‘2.19 Remaining few minutes following stoppage of recorders
Swissair The final 5 minutes and 37 seconds of the flight, from when
the flight recorders stopped at 01:25:41, were not recorded on
the FDR or the CVR. To the extent possible, the events that
occurred were reconstructed using information from ground-
based primary radar data, full-authority digital electronic
control non-volatile memory data, air traffic control (ATC)
recordings, witness statements, and wreckage examination.’
‘4.1.2 Flight Recorder Duration and Power Supply
When aircraft power to the SR 111 flight recorders was
interrupted at 10 000 feet, the FDR and CVR stopped
recording. The aircraft continued to fly for about six minutes
with no on-board information being recorded. This lack of
recorded information hampered the accident investigation.
With maintenance-free independent power sources, it is now
feasible to power new-technology CVRs and the cockpit area
microphone (CAM) independently of normal aircraft power for
a specific period of time in the event that aircraft power
sources to the CVR are interrupted or lost.
Therefore, to enhance the capture of CVR information needed
for accident investigation purposes, the TSB made the
following recommendation:
As of 01 January 2005, for all aircraft equipped with CVRs
having a recording capacity of at least two hours, a dedicated
independent power supply be required to be installed
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 39 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
Aircraft Aircraft Date of the Investigation Findings made in the investigation report;
Make and registration occurrence authority If any, safety recommendation
Model and operator (Name and State)
adjacent or integral to the CVR, to power the CVR and the
cockpit area microphone for a period of 10 minutes whenever
normal aircraft power sources to the CVR are interrupted.
A99-03 (issued 9 March 1999)
At the time of the occurrence, FDR and CVR installation in MD-
11 aircraft were both powered from AC Generator Bus 3. The
Smoke/Fumes of Unknown Origin Checklist (…) requires the
use of the SMOKE ELEC/AIR selector. This switch is used to cut
power to each of the three electrical buses in turn in order to
isolate the source of the smoke/fumes. The nature of this
troubleshooting procedure requires that the switch remain in
each position for an indeterminate amount of time, typically at
least a few minutes. When the SMOKE ELEC/AIR selector is in
the first (3/1 OFF) position, alternating current (AC) Generator
Bus 3 is turned off, thereby simultaneously disabling the FDR
and the CVR.
With both the CVR and the FDR on the same generator bus, a
failure of that bus, or the intentional disabling of the bus (e.g.,
the result of checklist actions in an emergency), will result in
both recorders losing power simultaneously. To enhance the
capture of information needed for the identification of safety
deficiencies, the TSB made the following recommendation:
Aircraft required to have two flight recorders be required to
have those recorders powered from separate generator
buses. A99-04 (issued 9 March 1999)’
B767 SU-GAP, 31/10/1999 NTSB, USA ‘Review of radar data
Egyptair [...]
As previously discussed, these primary radar data (with
extrapolated FDR data and simulation results) indicated that
after the airplane’s FDR and CVR stopped recording, the
airplane descended to an altitude of about 16,000 feet amsl,
then climbed to about 25,000 feet msl and changed heading
from 80º to 140º before it began its second descent, which
continued until it impacted the ocean’
A330 C-GITS 24/08/2001 GPIAA, Portugal ‘1.11.5 Recorders Power Source
Because the recorders are both powered from the same AC2
bus, and did not have an independent power supply, the
recorders did not record events after the aircraft electrical
system reverted to emergency electrical configuration.
Effectively, the last 19 minutes of flight of the engines-out
approach and landing were not recorded, a situation that
deprived investigators of data and hampered the investigation
into this critical portion of the flight.’
‘2.2.1 Flight recorder power supply
The loss of flight recorder information for the last 19 minutes
of the engines-out descent and landing on this occurrence did
not adversely affect the investigation to this accident for the
following reasons:
The crew survived and was able to provide factual
information.
ATS recordings provided additional information
regarding crew communications and aircraft position
data.
There were no safety-significant events during this
phase of flight that could have led to the discovery
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 40 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
Aircraft Aircraft Date of the Investigation Findings made in the investigation report;
Make and registration occurrence authority If any, safety recommendation
Model and operator (Name and State)
of underlying factors and the need for safety
recommendations.
Notwithstanding, had the circumstances been different, the
lack of data following the power loss on both engines would
have severely affected the ability of the investigation to make
findings as to the causes and contributing factors to this
occurrence. ’
‘Therefore, it is recommended that the European
Organization for Civil Aviation Equipment, ICAO, all civil
aviation authorities and safety investigation authorities:
Take into account the circumstances of this particular
occurrence in their deliberations on the requirements for
independent power supplies for on-board aircraft recordings’
A320 G-BXKD 15/01/2005 AAIB, UK ‘the recorder stopped when the AC power supply was interrupted
when the engines were shut off about three seconds after the aircraft
touched down at Gatwick Airport. The subsequent landing roll was
thus not recorded.’
‘The CVR and FDR are both connected to the same AC power source
and did not have an independent power supply. The recorders thus
ceased to record after the aircraft reverted to the emergency
electrical configuration following engines shut-down, and denied
accident investigators information that could have been vital had the
outcome of the landing been different.’
‘Safety Recommendation 2005-074
For newly manufactured aircraft, the European Aviation Safety
Agency should require that no single electrical bus failure terminates
the recording on both cockpit voice recorder and flight data
recorder.
Safety Recommendation 2005-075
For newly manufactured aircraft, the Joint Airworthiness Authorities
should require that the cockpit voice recorder and cockpit area
microphone are provided with an independent 10 minute back-up
power source, to which the cockpit voice recorder and cockpit area
microphone are switched automatically, in the event that normal
power is interrupted.’
B737 EI-ENB 21/12/2010 AAIU, Ireland ‘1.2 Cockpit Voice Recorder (CVR)
The CVR was downloaded and was found to be of good quality, but it
was difficult to decipher due to the sound of breathing subsequent to
the FO donning his oxygen mask. The CVR confirmed the accuracy of
the flight and cabin crew’s recollections. However, it terminated while
the engines were spooling down and did not record the subsequent
evacuation order, PA announcements or the conduct of associated
procedures.
The CVR electrical power source on this aircraft is from the 115V AC
Transfer Bus No. 2. This Bus is de-energised when the engines are shut
down unless the Auxiliary Power Unit (APU) is running with its
generator on line or external power has been connected; in such cases
the CVR will then run for an additional 5 minutes.
If neither external nor APU electrical power is available, the CVR
ceases recording when the electrical power supply from the engines is
lost during shutdown.’
‘2.2 Evacuation Order
When smoke was reported in the cockpit, the aircraft was
decelerating and approaching a short taxiway that led to the ramp.
CCTV recorded the aircraft coming to a stop on the ramp and later the
doors opening and the evacuation commencing. It is unclear at what
point the order was made to evacuate the aircraft as the CVR
recording stopped during engine shut down.’
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 41 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
Aircraft Aircraft Date of the Investigation Findings made in the investigation report;
Make and registration occurrence authority If any, safety recommendation
Model and operator (Name and State)
‘2.4 Cockpit Voice Recorder (CVR) Power supply
Because the CVR recording stopped during engine shut down it was
not possible to clarify what happened subsequently, as the CVR no
longer recorded activities in the cockpit due to the failure of the
electrical power supply from the engines.’
‘European Aviation Safety Agency (EASA) should introduce a
requirement that the CVR should continue to record in the event of
power failure. IRLD201203’
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 42 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
Table 2: Examples of accidents and serious incidents with a long gliding phase
Aircraft Aircraft Date of the Investigation Indications found in the report related to the gliding phase
Make and registration occurrence authority
Model and operator (Name and
State)
A330 C-GITS, Air 24/08/2001 GPIAA, ‘At 06:26, when the aircraft was about 65 nautical miles from the
Transat Portugal Lajes airport and at an altitude of about FL345, the crew reported
that the left engine had also flamed out and that a ditching at sea
was possible. Assisted by radar vectors from Lajes air traffic
control, the crew carried an engine-out, visual approach, at night
and in good visual weather conditions. The aircraft landed on
runway 33 at the Lajes airport at 06:45.’
‘The CVR recording spanned 28 minutes and 24 seconds of the
flight, (…) ending at 06:27:41, shortly after the flameout of the
second engine when electrical power was switched to
EMERGENCY’
Around 19 minutes of descent with no engine and no CVR
recording.
B737 PK-GWA, 16/01/2002 NTSC, Indonesia ‘On January 16, 2002, (…) a Boeing 737-300, PK-GWA, ditched into
Garuda the waters of the Bengawan Solo River, Central Java during a
forced landing, following loss of power on both engines as the
aircraft was descending through 19,000 ft. The dual engine flame
out occurred shortly after the aircraft entered severe
cumulonimbus cloud formations with turbulence and heavy rain
and ice.
…
The aircraft landed successfully between two iron bridges in the
upstream direction, and came to a stop with its nose pointing to
the right of the landing path. The aircraft settled down on its belly,
with the wings and control surfaces largely intact, and was
partially submerged.
The evacuation following the landing was successful. Twelve
passengers suffered injuries, the flight crew and two flight
attendants were uninjured, one flight attendant suffered serious
injuries, and another flight attendant was found in the waters of
the river and fatally injured.’
‘Then at 09.24 UTC the speed increased up to 410 knots, before
the SSR target disappeared and faded out.
The PSR (Primary Surveillance Radar) showed the target moved
fast in an unstable flight path. At 09.32 UTC the PSR target
disappeared for few seconds then came back again at 09.33 UTC,
which was the last time the PSR target showed. ’
‘The stoppage of the recording indicates that the CVR stopped
due to loss of AC power. ’
Around 8 minutes of descent with no engine. The CVR stopped
with the loss of alternating current power.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 43 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
Bombardier N8396A, 14/10/2004 NTSB, USA ‘FDR data showed that, about 2152:08, the airplane was in level
CL-600 Pinnacle flight at 41,000 feet
Airlines …
About 2154:57, the FDR recorded the fifth activation of the
stick-shaker and the fourth activation of the stick-pusher. Even
with the stickpusher’s activation, the motion of the airplane
continued to increase its AOA to the maximum measurable value
of 27º.
The pitch angle increased to 29º, and the airplane entered an
aerodynamic stall.
…
About 2155:14, the controller told the pilots to descend and
maintain an altitude of 24,000 feet; about 5 seconds later, the
captain acknowledged the assigned altitude. About 2155:20, the
FDR stopped recording because normal a.c. power to the airplane
was lost.
(The CVR had a different source of power and continued to
record.) The last reliable N2 (core speed) recorded by the FDR
before it stopped operating was 46 percent for the No. 1 engine
and 51 percent for the No. 2 engine.
…
The FDR resumed operation about 2159:16.25 FDR data showed
that the auxiliary power unit (APU) was supplying electrical power
to the airplane, both engines’ N1 indications continued to
decrease, and both engines’ N2 indications were at zero
…
FDR data showed that, during the next several minutes, four
APU-assisted engine restarts were attempted, but the N2 speed
for both engines remained at zero throughout the restarts.
…
About 2215:03, the CVR recorded the captain stating, “we’re
gonna hit houses,” and, about 2 seconds later, the enhanced
GPWS alert “pull up.” About 2215:06, the CVR recorded a sound
similar to an impact and stopped recording about 1 second
afterward’
Around 20 minutes of descent with no engines. The CVR was
recording until the impact with the ground thanks to ‘a different
source of power’ from alternating current.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 44 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
B767 C-FCAG, Air 02/01/2005 TSB, Canada ‘On 02 January 2005, a Boeing 767-375 aircraft (registration C-
Canada FCAG, serial number 24085)
operating as Air Canada Flight 092, was on a scheduled flight from
Toronto/Lester B. Pearson
International Airport, Ontario, to Santiago/Aeropuerto Comodoro
Arturo Merino Benitez, Chile (…) the aircraft was in cruise flight at
flight level (FL) 370 approximately
180 nautical miles (nm) north of Santiago, 60 nm prior to the
planned start of descent. At that
time, the crew received an engine indicating and crew alerting
system (EICAS) warning of low
fuel pressure output from both boost pumps in the left main fuel
tank, and 45 seconds later the
left engine (General Electric CF6-80C2B6 turbofan, serial number
690255) flamed out.
The crew immediately opened the fuel cross-feed valve, declared
a Mayday with Santiago radar
and began a drift-down descent. As the aircraft descended
through FL330, the auxiliary power
unit (APU) was started. At approximately FL230, 18 minutes after
the engine flamed out, the
crew restarted the left engine. The aircraft continued to Santiago
with both engines operating
and landed without further incident’
Around 18 minutes of descent with no engines. No indication of
a CVR recording in the report.
ATR72 TS-LBB, 06/08/2005 ANSV, Italy ‘After gliding for approximately 16 minutes, the aircraft ditched
Tuninter approximately 23 nm northeast from Palermo’s airport’
‘In case of electrical failure of the two generators, as in case of engine
shutdown, the electrical supply is ensured, for the essential users only, by
two batteries (main battery at 43 Ah and the emergency battery at 15 Ah)’
‘the CVR continued to record until the impact with the water which
indicates that the main battery was still working’
Around 16 minutes of descent with no engines. The CVR kept recording
because it was on the main battery.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 45 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
7.2. Annex 2
Table 1: Investigation reports identifying a trigger of a g-switch as the most probable cause of a
premature end of recording
Aircraft Aircraft Date of the Investigation Findings made in the investigation report;
Make and registration occurrence authority If any, safety recommendation
Model and operator (Name and
State)
Sikorsky, G-BEWL 25/07/1990 AAIB, UK The aircraft ‘was fitted with a 30 minute duration Fairchild A100A
S-61N Cockpit Voice Recorder’
‘The CVR almost certainly stopped as soon as power to it was
interrupted under the influence of the g switch when the initial
tail rotor strike was sensed’
Eurocopter, G-TIGK 19/01/1995 AAIB, UK ‘The helicopter was equipped with a combined voice and flight
AS332 data recorder (CVFDR). It was determined that the recorder had
lost its power supply as a result of the operation of the G-switch
due to the level of tail rotor vibration induced by the lightning
strike’
Safety recommendation:
‘In order to prevent the premature cessation of electrical power
supply to helicopter combined voice/flight data recorders
(CVFDR) caused by abnormal excessive vibration effects on
associated G-switches, it is recommended that the CAA:
1. Require operators to render inoperative CVFDR G-
switches, as an interim measure, and
2. Take action to identify a more suitable method of
stopping such flight recorders during crash impact
(Safety recommendation 97-32)’
Eurocopter, G-BWZX 12/12/1997 AAIB, UK ‘it was determined that the G-switch,
AS332 which was fitted in the power supply to the CVFDR in accordance
with CAA specification No 11, had operated at the time of the
lightning strike. This had prevented the CVFDR from recording
aircraft data and audio pertaining to the handling of the damaged
aircraft as it returned to the rig.’
Safety recommendation:
‘For this reason the following Safety Recommendation is made:
The CAA reassess the response made to part 1 of Safety
Recommendation 97-32 with a view to rendering the CVFDR G-
switch inoperative. (Safety Recommendation 99-24).’
Sikorsky, G-BMAL 12/07/2001 AAIB, UK ‘The aircraft was fitted with a GEC-Plessey Avionics Combined
S76 Voice and Flight Data Recorder(CVFDR)… The CVFDR was fitted
with an acceleration cut-off switch, which interrupts electrical
power if a local acceleration above 4.5 g at 45 degrees to the
longitudinal fuselage datum is exceeded’
‘the g switch activated which then precluded the peak normal
acceleration being recorded. While not necessary for
investigation purposes during this accident, this g switch
activation, in other accidents and serious incidents, has resulted
in the loss of essential information.
In the accident involving G-BMAL, the early activation of the g
switch denied knowledge of the peak recorded normal
acceleration to enable the operator to gauge and plan the extent
of the inspections and repairs necessary.’
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 46 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
Bombardier VP-CRC 29/01/2008 AAIB, UK ‘The CVR was a solid state, 2-hour recorder which captured the
last two hours of flight into Luton. [...] The system included an
‘impact’ or ‘g’ switch interlock, designed to cut the power to the
CVR in the event of a significant crash impact. The switch
operates by sensing acceleration and removing the power supply
to the CVR in the event of the acceleration exceeding 3g. The
switch was mounted in the rear section of the aircraft, at a 45
degree incline to the longitudinal axis. [...]
Upon arrival in Luton, the CVR recording ceased just after the
nose landing gear touched down. The FDR recording showed a
peak normal acceleration at touchdown of 1.2g and longitudinal
acceleration peak, just prior to the loss of CVR, of -0.22g. When
downloaded, the CVR operated normally and no cut in the
aircraft DC essential power supply was reported. Maintenance
records did not confirm the operation of the ‘g’ switch but system
troubleshooting suggested that it was the most likely cause of the
CVR stopping.’
‘As stated in the G-TIGK report, the AAIB was, and continues to
be, unaware of any accidents where recorders would have
continued to run after the crash impact had no ‘g’ switch been
fitted. However, several accidents were encountered where
premature operation of the ‘g’ switch had impeded the accident
investigation.’
Safety recommendation:
‘It is recommended that the Federal Aviation Administration and
the European Aviation Safety Agency review the certification
requirements for automatically stopping flight recorders within
10 minutes after a crash impact, with a view to including a
specific reference prohibiting the use of `g` switches as a means
of compliance as recommended in ED112 issued by EUROCAE
Working Group 50.’
Cessna 650 I-FEEV, Air 07/02/2009 ANSV, Italy Accident (on-going investigation)
One
Executive The aircraft experienced a deep fall, and the end of FDR recording
corresponds to a height above terrain of more than 4 000 ft,
while the CVR kept recording until impact. Because of the very
high energy, the aircraft was completely destroyed, so that the
FDR and the CVR little useful evidence could be recovered on the
accident site. The g-switch activation is considered the most likely
cause of the premature end of FDR recording.
Sikorsky, C-GZCH 12/03/2009 TSB, Canada The aircraft ‘was equipped with a Penny & Giles multipurpose
S92 flight recorder (MPFR)’ which records both flight data recorder
(FDR) data and cockpit voice recorder (CVR) audio
‘The MPFR stopped recording about 44 seconds before impact
and then began recording again about 1.7 seconds before the
impact. TSB’s examination of the MPFR and the components
which
supply it with data, as well as the associated wiring, determined
that there was no indication of
a pre-existing condition that would have prevented normal
operation.’
‘By design, electrical power (power) to the MPFR is routed
through a dedicated relay. As long as this relay is not energized,
power will be supplied to the MPFR. Once energized, by either
the
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 47 of 49
An agency of the European Union
European Aviation Safety Agency NPA 2018-03
7. Appendix
omni-directional inertia switch (g-switch) or the water immersion
switches, the power to the
MPFR will be cut.’
Eurocopter, G-REDL 01/04/2009 AAIB, UK ‘The CVFDR recording ended prematurely and curtailed the only
AS332 data and audio recording source designed to survive an accident.
The outcome of this was a limited amount of data for the
remainder of the accident sequence, which relied on information
recovered from non-crash-protected components.’
‘Loss of power to the CVFDR is likely to have been caused either
by a loss of electrical power supply or power interruption by the
g-switch. Recorded VHF transmissions, radar data and downloads
from the SMD memory and the HUMS data card suggest that
electrical power was still available to those systems sharing the
same power supply as the CVFDR, after the CVFDR recording
ceased.’
‘There are currently no programmes to modify in-service systems
which were qualified prior to the release of ED112. As such, some
existing flight recording systems may suffer a loss of data early in
the accident sequence. Simply removing the existing switches
means that some systems would no longer be compliant with the
requirement to stop the cockpit voice recording within 10
minutes of an accident. One possible solution would be to change
the existing mechanical g-switches for a more reliable or
improved sensor.’
Safety Recommendation:
‘It is recommended that the European Aviation Safety Agency
require the ‘crash sensor’ in helicopters, fitted to stop a Cockpit
Voice Recorder in the event of an accident, to comply with
EUROCAE ED62A.’
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 48 of 49
An agency of the European Union