Black Box
WHEN AN AMERICAN AIRLINES BOEING 757 SLAMMED into a mountain in Colombia just before Christmas last year, the world was shocked that such a modern plane, with all the latest safety equipment, could come to such an end. Everyone wanted to know how it had occurred. Though the plane had vanished in the jungle without human witnesses, the aircraft’s mechanical witnesses—its cockpit voice and flight-data recorders—were able to tell us in a few days, with intimate detail, the plight of Flight 965. Three months later a military version of a Boeing 737 crashed outside of Dubrovnik, Croatia, killing Commerce Secretary Ronald H. Brown and thirty-four others. The shock here was not the sophistication of that plane but rather the reverse: It carried no flight recorder.
In the United States more than 40,000 people every year lose their lives in highway accidents. The toll in the skies is a tiny fraction of that figure. But airline passengers perish dramatically, in large numbers all at once, and these figures give aviation accidents a grim fascination that icy roads, drunk drivers, and sleepers at the wheel lack. We want to know what happened and whether it could happen to us. The “black box” was invented to answer those questions.
Lots of planes went down in the forty years after the Wright brothers’ first flight in 1903. In most cases, especially during wartime, it was obvious what had gone wrong. The Wright brothers themselves are credited with carrying the first flight-data recorder, a simple device that registered their distance flown, time in the air, and number of engine revolutions. It survived only because their plane did; “crash protection” for this recorder was not especially necessary at altitudes of six feet. The device Charles Lindbergh carried on The Spirit of St. Louis was a bit more sophisticated: a barograph marking ink on paper on a rotating drum, in a wooden box the size of a notecard file. It also survived and can be seen at the Smithsonian’s Air and Space Museum. Operators of nonpowered sailplanes often rigged a device using a condensed-milk can for the drum and the mechanism of a $1.98 alarm clock, hooked up to a simple altimeter. Blackened foil was attached to the milk can to accentuate the tracing. But because the devices had no protection, when these and other early planes were lost, so was any evidence of why.
With the boom in civil aviation after World War II came a boom in civilian passengers. Larger numbers of lives, as well as bigger and more expensive planes, were at stake. The airline industry began to get more serious about finding out what happened when things went wrong. A series of crashes in the early 1940s had already spurred the Civil Aeronautics Board to demand some sort of record that would remain intact beyond impact. But no reliable ones had been found, and war shortages had postponed further development. The CAB tried again in 1947, and the airlines made a deal to test the models a few companies were designing at that time.
The CAB had to rescind its rule after a year, because the models from the late 1940s never got very far, although General Electric was enthusiastic about its design using “selsyns”—tiny electrical position transmitters, attached directly to the aircraft’s instruments. These selsyns would send information through wires to a recording device at the back of the plane. Because of ink problems at high altitudes—blotting, freezing, and dust and dirt clogging the pens—GE used a stylus cutting into black paper coated with a thin layer of white lacquer. Placing the unit in the tail, commonly the last part of a plane to hit the ground, seems to have been the extent of crash protection. Another company, Frederic Flader, presaged by almost two decades the use of magnetic tape as a recording medium, but its unit never flew either.
Then a professor of mechanical engineering picked up the ball, the way inventors often do. In 1951 James J. Ryan, who taught at the University of Minnesota, joined an unlikely outfit to be pursuing aviation-safety research: General Mills. The company had been selling’grain products since the 1920s, but in World War II its mechanical division was pressed into service designing and building precision equipment for the Army Air Forces. It turned out to be quite successful, and after the war it remained active in the field.
RYAN WAS AN EXPERT ON instrumentation, vibration analysis, and machine design who had been working with accelerometers and recording altimeters. At General Mills he put it all together to create the Ryan VGA Flight Recorder. VGA stood for velocity (airspeed), G forces (vertical acceleration), and altitude. (Ryan went on to earn the nickname Crash Ryan for his work on automobile safety, work often done from the driver’s seat of his test cars; graduate students and dummies were also used. During a long career in engineering, Ryan invented many other things, including the retractable seat belt.) Besides V, G, and A, this first successful flight-data recorder (FDR) could be modified to record compass heading and engine torque.
The breadbox-size FDR weighed ten pounds and was divided into two compartments. The bottom contained devices for making the measurements: the altimeter (an aneroid bellows attached by pneumatic tubes to the plane’s static [atmospheric] pressure lines), the accelerometer (a cube of metal bouncing on a cantilever beam measuring from -3G to +12G), and the airspeed indicator (a diaphragm measuring static pressure and dynamic pressure—the pressure you’d feel if you stuck your hand out the window). The indicator could register speeds up to 500 mph.
In the top compartment was the recording device. The three instruments were connected to individual styli, which scratched fine dots onto a moving sheet of aluminum foil, 2½ inches wide and one-thousandth of an inch thick. The foil traveled at 3½ to 5½ inches per hour, powered by a small electric motor. A fourth stylus inscribed time on the foil in an up-and-down line, each peak representing one minute.
The foil was said to withstand temperatures up to 1,000 degrees Fahrenheit for more than 30 minutes. The box was sealed against humidity and was advertised to be crashproof, fireproof, unaffected by vibration or temperature extremes, and able to withstand long submersion in seawater. The Ryan recorder was mounted in the tail of the aircraft and set to operate for 300 hours without service. Unlike the General Electric prototype, with its array of sensors, this FDR had its own internal instruments and so was self-contained, except for its connection to the plane’s readings of airspeed and heading.
GENERAL MILLS MADE MINOR modifications to Ryan’s box, and in 1953 it came out as a sphere, the absence of corners and edges making it slightly harder to dent and crush. It popped open around the middle like a walnut and was comparably tough. It was painted yellow. “We used to call it the Sputnik ,” recalls one engineer of the satellite-shaped device. General Mills sold the design to Lockheed, which produced it as Model 109-C until 1969. The similar Model 109-D was rectangular, to fit more easily into a plane’s radio rack. (These devices migrated forward on planes for a while—to the radio or electronics rack behind the cockpit, or sometimes in the wheel well. But placing the FDR as far as possible from the nose and the fuel tanks made the most sense, and they have remained in the tail section since the early 1960s.)
This recorder had the skies to itself until 1957, when the CAB adopted a rule requiring FDRs on all aircraft heavier than 12,500 pounds carrying passengers above 25,000 feet. (It was modified to cover all altitudes in 1960.) This was the dawn of the jet age, when the DC-8, the Boeing 707, and the Caravelle were going into service. Fireand crash-protection requirements were spelled out, and the recorders had to measure five parameters: airspeed, altitude, compass heading, vertical acceleration, and time.
The rule created a market for FDRs, and its explicit specifications made entering the business easy. One company that jumped at the opportunity was another unlikely-sounding entrant, Waste-King. The Southern California firm got its name from its profitable line of garbage disposals and other kitchen appliances, but it also did a good business supplying the local aerospace industry.
Arne Harja, a newly hired engineer, had never seen a Lockheed FDR when he was assigned to come up with WasteKing’s version: “We just took the CAB specs and figured it out.” The WasteKing FDR differed from Lockheed’s in a few small ways. Instead of aluminum foil Waste-King used a nickelchromium alloy called Inconel, which had a much higher melting point and thus greater survivability. The foil was five inches wide. The Waste-King FDR engraved all five required parameters with diamond styli on one side, with the ability to add more parameters on the other. The magazine held enough foil to last two hundred hours, withstand a fire of 2,000 degrees Fahrenheit, take a shock of 100 Gs, and be immersed in salt water for 36 hours. The box was rectangular.
Waste-King’s FDR design soon was sold to Fairchild, which today, as Loral Data Systems, makes about half the FDRs produced in the United States. The other half come from AlliedSignal, formerly Sundstrand and before that United Data Control, which hired Harja away from Waste-King in the early 1960s. At the same time, Minneapolis-Honeywell was working on the first flight-data recorders using magnetic tape.
Overseas the British developed a similar design using wire instead of foil. The French took a different route. In the late 1940s the birthplace of Daguerre began making FDRs using a photographic system, with light rays and mirrors burning data onto light-sensitive paper. It had obvious disadvantages: inflammability and the tendency of the recorded information to disappear if the paper was exposed to light in a crash. The French later came around to foil recorders.
The “scratch” recorder, as the foil FDR is known, was remarkably reliable. Between 1959 and 1973 only 8 percent of FDRs examined after accidents or incidents could not be read because of damage or equipment malfunction. Human malfunction on the ground—poor maintenance, for example—was more often to blame when data was lost.
After an accident, interpreting that data fell somewhere between a science and an art. It was conducted by technicians from the CAB and later the National Transportation Safety Board (NTSB). In the early days examiners sometimes opened the box right at the scene of the crash and gleaned a rough reading from the foil using a clear plastic overlay. This practice proved too haphazard, and today all black boxes are shipped unopened to the lab in Washington.
In the lab the foil was spread out beneath a microscope on a specially designed readout machine. Each parameter trace was translated to numerical values and plotted on a graph. The process could take up to a week, depending on the condition of the foil and how much of a jumble the tiny scratchings had become. A flattened section of crushed foil looks like a relief map of a mountain range, and following dots over those mountains takes time.
Crumpled foil was more the norm than the exception when FDRs were specified to withstand only 100 Gs, roughly the trauma of being dropped from the ceiling onto a concrete floor. Most planes fell farther than that. In 1965 the government specifications were upped to 1,000 Gs for 5 milliseconds. After this change more than 90 percent of the foil was decently recoverable. Today the standards have been raised to 3,400 Gs for 6.5 milliseconds.
THE CRASH- AND FIRE-PRO tection trials a black box must endure seem designed by Torquemada. A single unit must be shot from a cannon into a calibrated pillow to 3,400 Gs; stabbed by a quarter-inch hardened-steel rod attached to a 500-pound weight and dropped from ten feet; crushed in a vise at 5,000 pounds of pressure; and barbecued with blowtorches for one hour at 1,100 degrees Centigrade, then for ten hours at 265 degrees Centigrade. (This last slow bake was added because jet fuel burns at a lower temperature than gasoline. With fireresistant walls and upholstery on planes, the danger has become less a hot flash fire than a long-burning, cooler one.) A black box must also be able to survive for a month under 20,000 feet of seawater. This test is performed on a separate unit because it’s unlikely that impact, fire, and deep sea exposure will all happen in the same accident.
Black boxes lost at sea can be found by their locator beacon, a small cylinder attached to the outside of the box that is activated by water. It beeps for thirty days, and the sound can be picked up by sensitive microphones on the search vessel. To make the “black” box easier to find on land, it is painted international orange and has reflective tape affixed, though some that have been through fires look more like what their name suggests.
The orange box, five by seven by twenty inches, is simply a dust cover. The guts—the recording mechanism—is protected beneath several lines of defense: a thick stainless steel or titanium case, a one-inch layer of thermal insulation, another layer of paraffin to dissipate heat by melting (in the early days water-filled bladders were used), and finally a framework of aluminum holding the recorder. After four minutes in the fire test, the aluminum will melt and leak out in a bright silvery pool. No one cares about that or the mechanisms inside; only the recording has to survive.
In the early 1960s a second method for figuring out what was going on in the air came into use: recording the pilots’ voices. The cockpit voice recorder (CVR), little more than a crashproof tape recorder, became mandatory on large passenger aircraft in 1965. The tape runs in a thirty-minute loop and is erased at the end of the flight. More than a few accidents have been solved by CVRs, but not, as one might suppose, from hearing what the pilot and copilot are saying, which is often no more revealing than “What’s that?” or “That looks odd.” Rather, the detectivelike engineers at the NTSB decipher and analyze the variety of clicks, rattles, and engine hums behind the voices. These noises have revealed, for example, the instant in 1976 when a bolt of lightning struck an Iranian Air Force jet, igniting a fuel tank and bringing the 747 down. The FDR could only show the sudden drop, not explain what had caused it.
Indeed, those five simple parameters measured by scratch recorders were telling us mainly what, not why. More and better information was needed as jets evolved into bigger, more complicated machines. The only substantial improvement to the scratch recorder—switching from pneumatic tubing to electrical servos—came in the mid-1960s, when the stretched DC-Ss, DC-9s, and Boeing 727-200s were simply too long for all that tubing to carry data accurately back to the FDR in the tail.
FDRs made a major leap to accommodate the expanding planes. If voices could be recorded in the CVR on magnetic tape, so could data, in digital form. The digital flight data recorder (DFDR) took off. Using either ¼-inchwide, 1-mil-thick Mylar tape or a metal version called Vicalloy (which is much less meltable than plastic), DFDRs recorded zeros and ones at around 1,700 bits per inch of tape, the tape progressing at a little less than half an inch per second, over four or six tracks for twenty-five hours. That was a lot of room for information, twenty times more than before, so new parameters were added: eleven in all for older and smaller aircraft and seventeen for newer ones. These included such parameters as thrust for each engine; flap, slats, and thrust reverser positions; pitch attitude and roll attitude; and lateral acceleration. (Eleven and seventeen were the minimum number of parameters required by law; modern DFDRs can track hundreds, and some airlines have installed ones with greater capacity.)
All this information could not possibly be transmitted to the DFDR via individual wires. So the flight data acquisition unit (FDAU) was created to gather analog signals from sensors all over the plane; format, multiplex, and digitize them; and send them back to the DFDR.
Apart from the obvious advantages of more parameters, DFDR tape was reusable and impervious to seawater. It was not impervious to heat, so DFDR fire protection had to be substantially improved. Even so, sculptures of melted Mylar have sometimes been extracted from black boxes at the NTSB lab. The tape recorders can also have trouble with vibration (“When a plane comes bouncing down a runway, you’re going to have data dropout,” says Tom Jacky, a NTSB engineer), and the heads need regular cleaning and maintenance.
Reading out this large amount of data at the NTSB lab required, and was eased by, computers. Starting in the early 1970s, the DFDR tape was transcribed onto nine-track computer tape and fed into a PDP 11/40 computer, which digested it and printed it out in tabular form.
Dr. Carol Roberts, an electronics and computer expert who came to the NTSB in 1972, remembers the very first DFDR readout, from a major accident six months after she arrived. An Eastern Airlines L-1011 had crashed near Miami on a clear night. “The pilots didn’t think the nose landing gear was down, but it was only the indicator light bulb that had gone out. The pilots got distracted fooling with the light, and while leaning over, pushed the control wheel forward. That caused the aircraft to descend and disengaged the autopilot. They thought the autopilot was holding them at a fixed altitude, but really no one was flying the plane.” They lost altitude, a wing dipped, and the aircraft cartwheeled into the Everglades. The Lockheed Model 209 DFDR was recording not seventeen but sixty-two parameters. These parameters, along with the voices on the CVR, showed what had gone wrong. As a result of this and similar accidents, ground-proximity warning systems, which alert the crew to fast-approaching terrain, have been required on large aircraft since 1975.
Credit for another major safety improvement goes to the DFDR for its role in the long process of elucidating wind shear. An Iberian Airlines DC-10, landing in Boston in 1973, began to descend too fast and struck a runway approach light. Wind shear had caused the sudden descent, too late for the pilot to correct it. Data from the flight recorder, which took in ninety-six parameters, allowed the NTSB investigators to compute the wind speeds and get a better picture of the situation than even a camera would have yielded. They were able to separate the pilot’s role from what the plane did on its own. It was the first time wind shear was successfully identified as a primary factor in an accident; before then pilots had often been blamed.
Flight safety has been additionally enhanced by tape technology with the quick-access recorder. This is a flightdata recorder with no crash protection, installed near the cockpit, which records data onto a cassette that can be easily removed after a flight. The point is to check engine operation, maintenance, and airplane performance before something fails.
In the 1970s and 1980s metal lost its place to plastic as a recording medium. In the 1990s plastic is losing out to silicon, as DFDRs go solid state. (Scratch recorders have been banned from U.S. planes since 1989, but they still hobble into the NTSB labs from accidents in other parts of the world.) Data from this third generation of flight recorders can be downloaded in minutes directly into an everyday computer or onto a disc. Magnetic-tape DFDRs needed their heads, tape, and mechanical parts seen to regularly, but in the words of Phil Wright of Loral Data Systems, “With solid state, you just bolt it together and never look in again.” Some units have even made the FDAU obsolete; all data can come directly into the recorder. Few planes with solid-state DFDRs have fallen from the skies thus far, so the NTSB engineers have little experience but lots of optimism about how well the chips will survive.
COMPUTER TECHNOLOGY IN flight has been a blessing as well as a blow for accident investigators. Increasingly the data in the black box is all that remains after an accident; there is no “physical” evidence. Before, a broken cable or an analog dial could be picked up at a crash scene, giving additional clues about what had happened at the moment of impact. But since the mid1970s “fly-by-wire” technology has used computer systems to control the aircraft, with less and less human input or mechanical linkage. The instrument panel itself is computer-generated; glowing cathode-ray-tube screens are replacing the analog dials in what are now called “glass cockpits.”
Answers can still be found in the black box— if enough parameters have gone in. The blessing of computer technology appears on the other end, when the box is pried open and the data downloaded at the NTSB lab. Since its doors opened in 1967, the board has investigated more than 100,000 aviation accidents as well as thousands on the ground and waterways. In the windowless lab the aged foil readout machine sits in a corner, almost abandoned. The action is now on the computers, which dominate the other half of the room. Broken-up black boxes are scattered on a table in the center, one encrusted with dirt as if it had been planted, one badly torn up, one no longer orange but charred black from a slow-burning fire.
The information on tape or disc from a DFDR is downloaded onto a Hewlett-Packard 9000 computer and put into a program that in five to ten minutes (it used to take several hours) translates a flight into multicolored graphs or tables. While the graphs and tables are useful, actually seeing an animated plane in motion is even better. This software enables the flight to be put on video.
IN A SMALLER, DARKENED ROOM engineers peer at a bank of electronic equipment and four television screens. A young man named Doug Brazy shows a visitor two computer simulations of accidents. On the right side of the screen, he explains, dials and graphs show the altitude, airspeed, heading, artificial horizon, and engine power; in the top left, superimposed yellow type shows the cockpit conversation. The plane floats across the center of the screen. The images are vivid; the landscape, runways, and airline logo are painted in, the forms evenly shaded as if they were three-dimensional. “It shows everything but the weather,” comments one engineer. Another says, “A flat 50 percent gray screen would do it [i.e., simulate the poor visibility], but you couldn’t communicate the fear.” Indeed, fear, or at least anguish, grips the first-time viewer, as the plane is shown smoothly descending, then turning to the right, then starting a quick roll to the right, then turning nose down, still rolling, until nearly vertical. The film stops in midair. That’s the end of reliable DFDR readings. After that point, a second or two short of impact, they can’t be absolutely positive of the data.
These animated films have been useful at hearings, to present the accident clearly to the public, especially the families of the victims. Wrenching as it is to watch, the experience is cathartic for family members; they see that no one could have survived. But the films are not produced for public relations. “The driving force is to see an awful lot of information at once,” says Brazy, “and to see it happen in real time. Looking at plots and numbers takes a while to understand how quickly things are going by.”
One of those films was of an October 1994 crash near Roselawn, Indiana. An American Eagle commuter plane went down in a soybean field, killing all 68 on board. It carried a DFDR recording ninety-eight parameters. One week later the NTSB was able to present a preliminary report pointing to ice buildup on the wings. Almost two months before, in early September, USAir Flight 427 had crashed outside Pittsburgh, killing 132 people. The NTSB still does not know what brought that plane down; its flight recorder read only thirteen parameters.
The available technology for flightdata recording—discs, chips, hundreds of parameters—is ten to twenty years ahead of most recorders now in the air. It takes money and downtime (i.e., more money) to revamp these systems. In February 1995 the NTSB, spurred on by frustration over the Flight 427 mystery, sent upgrade recommendations to the Federal Aviation Administration, which sets the rules. The recommendations include an increase in the number of parameters recorded and, for some parameters, a higher sampling rate than once per second. The NTSB is especially interested in lateral acceleration and what position the flight-control surfaces—the rudder, elevator, and ailerons—are actually in, as opposed to what the dial in the cockpit says. DFDRs can easily handle such details; the upgrade involves placing many more sensors around the plane. Retrofitting an analog plane for the desired twenty-four parameters would cost from $25,000 to $70,000, the NTSB estimates. But even $70,000, amortized over ten years at average use, comes out to less than seven cents per passenger.
The DFDR on the plane that crashed last December in Colombia was tracking more than three hundred parameters. Its data suggest that the crew was confused about its location and took a wrong turn. Such sophisticated recorders may someday be commonplace. Other potential improvements are cockpit videos and recorders that eject from the plane on impact.
The flight-data recorder mounted on the tail of the next plane you board is not going to save your life. Its predecessors have already done that —yours and millions of others. Fortyfive years ago this lifesaving information came from a crumpled piece of aluminum foil. Now we can watch every nuance of a plane crash on video. It’s not a video you’ll ever see as an inflight movie. But because of flight recorders, you can sleep soundly through whatever film they do show.
