The Data Downlink Dilemma

Bona fide watershed accidents tip the scales, unleashing new laws and regulations intended to stop machines falling from the sky in similar fashion. Delta 191 begat windshear remedies; TWA 800 led to more stringent wiring regulations. But watershed accidents are usually the last in a series of similar crashes where the weight of evidence—and sometimes public opinion—demand action be taken. Not so for Air France Flight 447, where the inability to locate and recover the flight data and cockpit voice recorders has slowed the investigation and made determining definitive probable cause difficult if not impossible.

“Unfortunately,” says Jim Cash, the US National Transportation Safety Board’s technical adviser for recorders, “I guess we’ve been waiting on the AF447 event for 50 years. It finally happened—the worst possible scenario.”

According to the French Bureau d’Enquetes et d’Analyses, 26 overwater accidents involving commercial transport category aircraft occurred between 1980 and 2009. Cumulatively, those aircraft carried 52 FDRs and CVRs. Searchers recovered 49. Two missing boxes—the CVR and DFDR from AF447—still lie somewhere in the South Atlantic Ocean depths as of this writing. The third, the FDR from South African Airways Flight 295, still lies beneath the Indian Ocean. Searchers wrenched the 747 Combi’s CVR from 16,100 ft. of water after an exhaustive hunt.

If unrecoverable recorders are rare, so too are recorders whose data is so damaged that it cannot be read. NTSB cites just three instances over the past 20 years or so. That said, recommendations already are flowing from the crash of AF447 on the night of May 31/June 1, 2009. BEA wants EASA and ICAO to extend to 90 days the amount of time underwater locator beacons must function, to give searchers a better shot at finding them. BEA also wants aircraft operating over maritime areas to be fitted with an additional ULB. In terms of devices that pop to the surface in a water impact, the French accident investigative agency recommends that IACO’s Flight Recorder Panel “establish proposals on the conditions for implementing deployable recorders.”

Most importantly, it recommends that EASA and ICAO “study the possibility of making it mandatory” that commercial aircraft “regularly transmit basic flight parameters”—position, altitude, speed and heading—to give accident investigators a better chance of solving any future inflight tragedies in which data and voice recorders are lost or destroyed.

AF447’s ACARS transmitted altitude and position reports every 10 min., and 24 automated maintenance messages within a 5-min. period leading up to the crash. A BEA Interim Report on the accident says those messages reflect “inconsistency in the measured speeds” of the A330. That led to replacement of the aircraft type’s pitot tubes. Now what BEA and others want is a serious, systematic evaluation of the feasibility of linking critical flight parameters to the ground, either regularly or triggered by some unforeseen event.

Metering the Messages

What investigatory agencies don’t want, apparently, is steady, constant streaming of such data. “We tried to assess the cost of such transmission,” says Aranud Desjardin, senior investigator in BEA’s engineering department. “I don’t think that would be feasible . . . for all aircraft to broadcast all data all the time.” Cash agrees. “It became very apparent right off the bat that even with today’s costs . . . continuous downstreams from the aircraft was probably not an economic solution.” Viewed that way, traditional black boxes “will win out every time.”

If continuous data streaming is out, there’s another option: Regular transmissions, every 10-15 min. or so. But there’s a problem. For safety investigatory purposes, Cash cautions, “15 minutes is probably not all that useful because too much happens between snapshots.” The ideal, investigators seem to agree, is triggered bursts of data that emanate from aircraft when things go really awry. “That’s what we’re working on now,” he says.

The inherent problem, of course, is making sure trash doesn’t touch off that trigger. It’s the classic conundrum: “You want to try to detect as many emergency situations as possible,” says Desjardin, “but at the same time you don’t want to have the criteria too loose so that you would trigger for any slight turbulence, or any minor incident on board.” Transmissions cost carriers money.

BEA has helped set up a working group to tackle triggering criteria, among other issues. “A number of different items are being considered,” says Tim Ridgely, a Boeing data downlink expert and lead engineer with Boeing Commercial Airplanes’ avionics organization. Among the criteria the group is considering: Cabin altitude, master warnings and cautions, certain excess speeds, stall warnings.

“That’s what we’re working on,” says Cash. “Accident investigation agencies around the world are supplying data from past accidents . . . There’s kind of a real fine line between what’s a valid event and what’s not.”

Even if experts are able to winnow down what constitutes a true trigger, in some instances burst information as the accident sequence unfolds may not be sufficient. To really understand what precipitates an accident, contextual data leading up to the event itself can be critical. “Normally, you’d want . . . data coming into the event,” he says, “a little historical data, precursor data.”

Pascal Andrei agrees. He’s Airbus’s head of aircraft security and the person in charge of the manufacturer’s Internal Flight Data Recorder Recovery Project. He advocates a “moving buffer” of information, “the record onboard the aircraft” of the data 10 min. prior to the trigger. “As soon as we detect [the triggered event] this buffer is sent to the ground.”

Negative Attitude

Then there’s the issue of attitude, specifically the attitude of an airplane. An aircraft in an inverted position may be unable to transmit data because satellite antennae sit atop the fuselage of modern transports. “We’re trying to assess . . . satellite connectivity,” says Desjardin, “[when] the aircraft is upside down, or has some high pitch or roll rates.”

Ridgely elaborates: “We believe the attitude of the airplane . . . during descent in an event might shield the antenna from these satellites and disrupt the communications link.” The fix? “We don’t believe the current technology is there to avoid that.” He saysthe problem isn’t confined to satcom signals. HF transmissions—employed over open water when VHF links are lost—also are subject to aircraft shielding.

Andrei believes data buffers might help in either instance. As the aircraft begins to roll, or pitch down precipitously, that could trigger a burst of both historical buffer and real-time data. “We have to identify these points during flight where we have to send data to the ground very quickly, points at which the aircraft is entering a very bad situation.”

Despite the obstacles, suppliers generally agree there are solutions. Honeywell Aerospace declined to make an individual available for interview but did provide a statement: “While the technology exists to allow streaming of some information, it is up to the aviation regulatory authorities to set standards and to determine whether flight data streaming or any other technology should become standard equipage on aircraft.” ARINC declined to comment for this article.

Canada’s Star Navigation Systems Group is selling a new iteration of its In Flight Monitoring Service. What differentiates the Star product from mere ACARS? “It’s very simple,” asserts Chairman and CEO Viraf Kapadia. “We are proactive rather than reactive. At the same time, we do live flight data analysis while the aircraft is in flight.” CTO Dale Sparks says the system is “fully integrated,” drawing data not just from the DFDR “but from multiple other systems.”

Sparks says Star’s system can be configured for “dynamic triggering” so that “it can send down a message right away.” The system is independent of other communication channels, links that handle air-to-ground phone, WiFi and such. “Our system can transmit 4,500-plus parameters per minute,” he contends. That’s “between 80 and 150 per second . . . a significant amount of information.” Kapadia insists the information doesn’t carry significant cost, not if regularized data downloads are plugged into Flight Operations Quality Assurance and Maintenance Operations Quality Assurance programs. The key is faster trend monitoring.

The system is flying operationally right now on an A310 in South Asia. The vendor declines to name the carrier, but Kapadia says the setup has accumulated 6,000 flying hr. Among immediate benefits to the airline: Identifying a pilot who over-rotated on takeoff and bringing him in for further training. At this stage, Star’s offering encompasses data derived from the DFDR and other aircraft systems, not the CVR. While Kapadia says it will have CVR capability “within 12 to 18 months,” it will come at a price: Bandwidth. 

Cash says it takes 30 times more of it to handle voice, “and video is even worse . . . because of the sheer volume of data.”

There is a poor man’s answer to this: Limit emergency burst data to a small number of specific parameters—perhaps altitude, heading, attitude, speed and such. “The ACARS bandwidth could handle that data,” says Ridgely, “with the caveat that you’d have to have the communication link.”

The working group met at BEA on June 17-18. According to Desjardin, “elements presented during the meeting indicate that there are triggering criteria robust enough to detect emergencies while reducing the nuisance trigger rate to a very low value.” The triggering criteria include things like extreme aircraft attitudes, TAWS warnings, excessive vertical speed, excessive accelerations and excessive control inputs. “However, additional testing and evaluation is necessary to assess whether satellite connections can be maintained when aircraft are subject to high pitch and roll values,” he agrees. More work is being undertaken in this area.

As of this writing, no accident investigatory body or regulatory agency has recommended mandating downlinking safety data. They’re merely exploring feasibility. The focus of BEA’s post-AF447 initiative, says Andrei, remains quicker recorder recovery and resultant improved search and rescue. Find the recorders faster, find possible survivors. In an otherwise survivable overwater accident, that’s the mantra, “our main issue,” he says.

AF447 appears nonsurvivable. Yet officials want to prepare for one that is, to be in a position to know precisely where to go, and fast.  Cash says, “one of the messages [ACARS] sent had positional information: Latitude, longitude, altitude. Unfortunately, it was set up to report position every [few] minutes. If it had been reporting positions more [often], it would have been a lot more useful. That would have narrowed down the area they had to look for recorders.”

No one interviewed by ATWis advocating chucking onboard recorders. “Our technology is not replacing the black box,” says Sparks. “Triggered data might work,” says Andrei, “but we have to keep traditional CVRs and DFDRs.”

The next few years should tell whether Air France Flight 447 rises to the level of a watershed accident, one that fundamentally alters the way the industry operates. For the time being, the verdict is as unclear as the location of those recorders.