The case for future media

In my last post, I advocated protected image recording in civil aviation. Its introduction has been long delayed despite a great number of safety recommendations that such recording be adopted. Delays occur but the world doesn’t stand still. Notwithstanding all the worldwide successes of achieving excellent safety performance, fatal aviation accidents continue to happen.

Emerging technologies arrive with faster introduction and adoption in every walk of life. For example, streaming media is growing at a pace far faster than past technological changes. There have been adventurous proposals that all civil aircraft should stream large amounts of data to a ground-based network for every moment of flight. The idea is not so wild. Conventional technology already allows manufactures, like Rolls-Royce to monitor the performance of their in-service aero engines across the globe[1]. The collection of data is paid for by the benifits gained in performance and understanding of the operational life of engines.

Could this be a replacement for dedicated on-board protected accident recording? My answer is: “no”.

Communication technofixes will help provide supporting information and be greatly valued. However, the benefits of protected on-board accident recording are in its incorruptibility and that it can preserve the last microseconds of an event. This is especially true when the event in question has unique attributes or is mysterious in some way.

Before the bombing of Pan Am Flight 103 over Lockerbie, Scotland[2], few had thought of using a Cockpit Area Microphone (CAM) for explosion detection. There were faint noises at the end of the accident recording that needed careful analysis.

The conventional technology we use is rapidly being superseded. Obsolescence is inevitable. Computational speed is increasing, as is memory capacity. So, on-board aircraft systems will be advancing in one way or another. That progress needs to include protected aircraft accident recording.

Telling the story of an accident must be authentic. The means to do it needs to be incorruptible.

Thus, it’s reasonable that a degree of conservatism will prevail. In other words, accident recording equipment should be based on reliable fully proven technology. Adoption of the state-of-the-art may be attractive but extensive proving should be undertaken first.

The need for progress is primarily to improve how lessons are learned. That’s the fundamental. Data recovered post-accident is turned into information that can be effectively used to improve safety. Shortening the time between aquiring data and taking safety action must be an aim.

The industry and the authorities could make a leap forward in protected image recording, in civil aviation by making those images 3-dimensional. Carefully placed cameras can provide a wraparound view of a cockpit in all conditions. Then 3D video recording on replay could provide a virtual reality experience.

Already available, this technical capability could then provide investigators with all the details of an event in 360-degree wraparound virtual reality detail. The post-accident learning possibilities are great. Study and investigation could become an immersive event. A well-constructed and selectively edited 3D views could be used as a training aids. This subject should be researched.



The case for video

Everyone recognises that accident investigation has played a big role in increasing aviation safety. Gathering evidence is a key part of that process. The continuous development of accident flight recorders has, from a basic capability in the 1960s, transformed what can be learnt from serious incidents and accidents. This is true worldwide.

In the days when accident flight recorders transitioned from tape-based recording to solid-state recording the opportunity to increase capability advanced further. Good quality audio, more aircraft parameters and better survivability have resulted.

In 1989, British Midland Airways Flight 092, Boeing 737-400[1], crashed onto the motorway embankment in the UK[2]. Post investigation the safety recommendations included a discussion of external image display[3]. The UK CAA fully accepted the recommendation.

I was part of the research effort that looked at the practicalities of introducing video image display in the cockpit. The ruggedised video cameras available at the time were bulky, expensive, and low resolution. British Airways fitted external cameras to a Boeing 747 classic aircraft as a trial. That system was flown and information gathered from normal operations.

This was an idea before its time. Today, external cameras are installed on several common aircraft types. These cameras make images available to the cockpit for an operational purpose, or to passengers as part of an in-flight entertainment system experience.

The Boeing 777-300 and -300ER can have external cameras fitted. One in the leading edge of each side of the tailplane facing the main gear and one belly-mounted, facing the nosewheel. The AIRBUS A340-600 and A340-500’s can have cameras. Pilots use them for taxying, observing cargo loading, refuelling, parking, and manoeuvring. The AIRBUS A380 has a camera on the tail looking forward.

Despite the acceptance of cameras and displays in numerous places on an aircraft there is no mandatory requirement to record the images that they present.

Internationally, aviation accident investigators are in favour of crash-protected image recording systems. The US NTSB did have a published list of “most-wanted” transportation safety improvements that included a call for the introduction of mandatory cockpit video recorders.

After the loss of Air France AF447 in 2009, the French aviation accident investigators recommended that ICAO require that aircraft undertaking public transport flights with passengers be equipped with an image recorder that makes it possible to observe the whole of the instrument panel.

Some arguments against installed cameras that made sense in an era before the iPhone mobile, iPad and GOPRO camera now seem insubstantial. Commercial off the shelf equipment can provide powerful image display and recoding capabilities. This is in the context of a world where passengers and crew regularly carry mobile devices with high quality cameras.

Today, the inclusion of a crash-protected cockpit image recording system on commercial aircraft is not a radical step.

One argument against installed cameras remains. Those who have been part of a fatal aircraft accident investigation know that the impact of seeing human remains is not to be underestimated. A legitimate concern is that a cockpit video recording, that continues throughout an accident scenario may record the injuries suffered by those covered by installed cameras. In such a case the protection of the accident recordings is a matter of extreme sensitivity.

Should such sensitive recordings be released into the public domain a great deal of harm may be done. Thus, a decision to mandate cockpit video recording must fully consider the special needs to protect the confidentiality of accident recordings. Whereas in the past the means to afford high levels of protection was at the limits of the available technology, now advancements make this possible.

There are both aviation safety and security aspect to cockpit video recording. Aviation accidents are not normally crime scenes. However, disruptive behaviour or hijacking by a passenger or a wilful malicious act by a crew member can be examples of aviation crimes[4][5][6].

There has been a strong objection to video recording in aviation but the arguments against are falling away. Protecting the confidentiality of downloaded accident recordings is vital but it can be done. The technical pros and cons have been explored in detail[7].

Frequent recommendations have already been made on this subject over a decade without significant progress having been made. Surely, it’s now time to act.



[3] 4.19 The CAA should expedite current research into methods of providing flight deck crews of public transport aircraft with visual information on the status of their aircraft by means of external and internal closed circuit television monitoring and the recording/recall of such monitoring, including that associated with flight deck presentations, with a view towards producing a requirement for all UK public transport aircraft to be so equipped (Made 30 March 1990).




[7] CAP 762. CAA Research Project. The Effectiveness of Image Recorder Systems in Accident Investigations.

Flight recorders are essential

Digital Flight Data Recorders (FDRs) and Cockpit Voice Recorders (CVRs) have become essential tools for accident investigation. With the Boeing 737-800, flight MU5735 having been in-service with China Eastern Airlines for less than 7 years there’s a good chance both recorders will help unravel the events leading to its fatal loss.

Accident flight recorders are dependent upon the aircraft digital and audio sources that are acquired when they are operating. Although the recorders are highly reliable in normal operation the sensors that feed them may not be so reliable[1]. For this reason, the authorities have chosen to highlight the importance of a maintenance program that includes the entire recording system[2]. It can be disruptive to an accident investigation if the information available from the recorders is insufficient, inaccurate, or of poor quality.

It’s rare for the recorders not to be found post-accident but it does happen in some remote locations. They can be recovered from enormous ocean depths and hostile terrain. In the sad story of Malaysia Airlines Flight MH370 in March 2014, neither the Boeing 777-200ER aircraft or flight recorders have been found.

In comparison with the successes of accident flight recording and replay the list of unrecovered and unusable recorders is short[3]. However, it does point to the need to constantly revisit the minimum approval standards, installation, and maintenance requirements for recorders.

Having dual independent combined recorders can increase the chances of success. This is making the recorder a more general-purpose equipment capable of taking video sources and data from the air traffic system as well as an aircraft.

Independent backup electrical power can help keep the recorders going beyond significant damage to an aircraft. This does help pick-up the last possible information from an accident timeline.

There’s a case for a longer duration audio recording and increasing the number of data parameter retained. This demand for more information is insatiable since there’s always a scenario that can be imagined where more data would help an investigation.

Video recording has long been talked about. It’s happening in a few situations but has not generally been adopted as a mandatory requirement for large aircraft operations. I think it is needed.


[2] EASA Safety Information Bulletin, SIB No.: 2009-28R1, Issued: 08 January 2015.


Past fatal accidents

What can cause an aircraft to plumet from high altitude in an uncontrollable way? A selection of accidents come to my mind.

One tragic accident was Indonesia AirAsia Flight 8501, Airbus A320-216[1] in December 2014. Here a malfunction in the rudder control system was reacted to by the crew in an inappropriate way. This fatal accident was put down to pilot error. That is mishandling after an aircraft system failure leading to a stall and plunge into the sea.

The loss of control and crash of Alaska Airlines Flight 261 McDonnell Douglas MD-83[2] in January 2000 is different from the recent Boeing 737 fatal accident but it warrants inspection[3]. For a start the MD-80 series has a high tail and rear engines. However, Flight 261 had a highly experienced crew, but the failure of a critical control component meant the aircraft became unrecoverable. Also, the MD-80 series of aircraft is of a similar generation to the Boeing 737. For both aircraft types, the control of the horizontal stabilizer is necessary to maintain safe flight. The MD-60 accident involved a catastrophic loss of pitch control.

Looking at the sequence of the fatal accident of SilkAir Flight 185, Boeing 737-300[4], in December 1997 it has some similarities. The lead investigators were unable to determine the cause, but suspicion fell on the aircraft rudder controls. This accident remains controversial. The accident flight recorders either stopped because wires broke or because their power was wilfully disconnected. We will never know which was the case.

Again, an accident with an inconclusive report is that of the uncontrolled descent and crash of United Airlines Flight 585. Boeing 737-200[5], March 1991. Anomalies were identified in the accident airplane’s rudder control system, but the accident was not attributed to these problems.

As can be seen from this small sample of accidents the interaction between aircraft and crew, when a control system failure occurs is a matter of great interest.






Flight recorders found

The tragic loss of all those on board China Eastern Airlines Flight MU 5735 continues in my thoughts and prayers. It’s good to hear announcements that progress is being made at the crash site.

It’s excellent news to see, from photographs published, that the aircraft accident recorder Crash Survivable Memory Units (CSMUs) are intact. Both the Digital Flight Data Recorder (DFDR) and Cockpit Voice Recorder (CVR) have been recovered.

The CVR records at least 2 hours of flight audio on a solid-state memory. Special procedures exit to recover the recordings from the recorder’s internal memory chips. This becomes difficult if the memory chips have suffered impact damage, like a crack for example. Investigators and the equipment manufacture are incredibly skilful extracting what data can be extracted.

The DFDR records at least 25 hours of flight data on a solid-state memory. There should be around 1000 parameters available for the analysis.

The technical specifications for these accident flight recorders were originally developed in the 1990s. At that time there was a transition from magnetic tape-based recordings to the use of solid-state memory. If the records are fully recoverable there should be a story of what happened in the critical moments before the aircraft started its fatal dive.

It’s possible to synchronise the recordings from the CVR and DFDR to reconstruct the actions of the crew. There are no video recordings. However, the audio and flight data can give a comprehensive picture of what happened during the accident.

Pilot commands and flight control system positions are recorded.

In parallel to the investigation of the material coming from the crash site, no doubt the authorities will be checking that no defect or deferred maintenance was reported in the technical log before departure of the aircraft.

By bringing all the evidence together a complete picture can be constructed. There are over 4,500 Boeing 737-800s now in service worldwide. This investigation will have a global impact.

What are the likely scenarios?

When dealing with aircraft system safety, I often found it difficult to encourage design engineers to look at aircraft level effects. It was more common to address each set of systems as if they were the only ones that counted.

Safe continued flight and landing depends on a whole host of interactions. Picking up a technical specification, for say an autopilot, reading it and understanding it is one thing. It’s harder to appreciate how it interacts with every other part of an aircraft in flight.

Considering a large commercial aircraft there are only a few general conditions that can create a total catastrophe. I’m using a specific meaning of that well used word. In this case, catastrophe is a complete aircraft level failure situation that is non-recoverable. A chain of events that leads inevitably to fatalities and a total hull loss.

There are only a few general conditions because there are design commonalities between modern civil aircraft. For example, they all need surfaces that generate lift and surfaces that enable aircraft control. They all have propulsion systems that generate thrust. If they are for civil passenger transport, they all have environmental control systems that maintain a habitable environment within a pressurised area.

In flying, they all are subject to the effects of weather. That is any hostile situation that can exist in the atmosphere, from ground up.

With what is so far known about the crash of China Eastern flight MU5735, when thinking about potential aircraft level events, it’s not possible to rule out many scenarios.

However, it’s extremely difficult to conceive of a weather event on the day of occurrence that could have led to such a disastrous outcome. No great storm activity was reported. So, this is unlikely to have been an accident like Air France flight AF447 in 2009[1]. A high-altitude stall can be recovered if no other significant negative factors come into play.

Additionally, it’s extremely difficult to imagine this accident as a depressurising event. So, this is unlikely to have been an accident like Helios Airways flight 522 in 2005[2]. Unless there was a massive explosive decompression that caused structural and control damage. Japan Air Lines Flight 123 in 1985 had such a tragic fate[3].

Engines can fail in a spectacular way but that does not normally destroy a whole aircraft. A total loss of propulsion turns a large aircraft into a large glider. The trajectory of this aircraft suggests something happened that was far more devastating than the loss of one, or both engines.

Issues related to communication and navigation can put to one side given that the accident from start to finish was so rapid. No crew communication is reported to have taken place.

Following the deductions made above the remaining possibilities that warrant consideration are to do with either or both, structural failure, and unrecoverable aircraft control failure. The accident investigators working on-site will be looking at the deformations found in the recovered wreckage. They will be looking at collecting and putting together what remains of the aircraft control system. They will be saving every electronic circuit board they can find.

By far the remotest possibility is a wilful act of destruction. It’s better to first rule out more likely aircraft scenarios before posing questions that bringing into question those on-board.

Global commercial aviation has a tremendous safety record. China’s aviation safety record is a strong one. As has been said by commentators: planes don’t just drop out of the sky like that one. The urgency of the accident investigation is all too evident. The sooner there’s a plausible theory the sooner corrective action can be put in place.





Unsurprisingly, China Eastern Airlines has now grounded its fleet of Boeing 737-800s. This popular and well-used civil aircraft has a good safety reputation. Until more is known, the airline is taking a precautionary approach. 123 passengers and 9 crew members have been lost.

If the video evidence from a security camera is to be taken as reliable, then the dive of the Boeing 737 was uncontrolled and significant structural damage was evident. The on-line pictures show the aircraft at a relatively low altitude. So, it’s not possible to say at what point prior to these images that structural damage occurred. The speed of the dive could have either caused or contributed to the aircraft’s break-up. 

Whatever it was that suddenly led to a complete loss from 30,000ft remains mysterious. Looking at the aircraft transponder data, the indications are that the flight was normal up until a point where an unexpected event occurred that was immediate and devastating. Even if the flight crew did have some recognition of failure conditions on-board, it does seem that little time to intervene was available. One assumption in aviation is that crews are provided with training in respect of emergency and abnormal procedures and can act accordingly when failures occur.

A great deal hangs on the recovery and replay of the two accident flight recorders.

The accident flight recorders are separate and installed in the rear section of the aircraft. This is done to increase their chances of survival in most accident and serious incident scenarios. Each requires electrical power. Several means of providing power are available including the aircraft’s batteries. However, if the electrical power wiring to the recorders is severed then they will stop recording. This is true for wiring from their aircraft data sources too.

Let’s hope that there is a complete recoverable record.

Crash-protected flight recorders

The crash of China Eastern Airlines Flight MU 5735 is deeply saddening. My thoughts are for the families, friends, and loved ones of those who were on board that ill-fated flight.

Watching video that has been circulated in social media the signs are that the China Eastern Airlines Boeing 737-800 dived and hit the ground at very high speed. The aircraft appears to have plummeted more than 20,000 feet in about a minute.

The aircraft crash site is in a difficult to get to location[1]. Authorities in China are searching the hillside looking for evidence as to what happened and recovery of the aircraft accident flight recorders[2]. Given what is suspected to have been a high-speed impact, damage to the accident flight recorders can’t be ruled out. They are made to withstand high impacts but are not invulnerable.

It’s most likely that the flight recorders will be of the solid-state type. This is where memory devices are enclosed in a strong crash protected metal box. So, much of the flight recorder could have severe damage but the recordings inside should be preserved.

On this type of public transport civil aircraft, there are usually two accident flight recorders fitted. One Cockpit Voice Recorder (CVR) and one Flight Data Recorder (FDR). To ensure that they meet rigorous technical requirements accident flight recorders are approved by aviation authorities. The technical requirements for approval are called: Technical Standard Orders (TSO)[3][4].

In both the US and European systems, TSO 123 is applicable to CVRs, and TSO 124 is applicable to FDRs. These two TSOs call up the applicable industry standards of EUROCAE ED-112A, MOPS for Crash Protected Airborne Recorder Systems[5]. This comprehensive technical document defines the minimum specification to be met for all aircraft required to carry flight recorders which may record flight data or cockpit audio in a crash survivable recording medium to be used for aircraft accident investigation.

One of the tests described in this long-standing international standard requires manufactures to shoot a crash protected module into a target at high speed. This test is often done by loading up a large pneumatic cannon, charging it and firing a module at a specially made target. To pass the test the module must survive sufficiently well to replay a recorded record.

So, there is a good chance that the on-board crash-protected recorders of MU 5735 might have survived. Let’s hope so.






A wing and a prayer


Fascination with the new. Who can resist? Advanced Air Mobility (AAM) provides just that. Often visualised in Science Fiction, plans for flying cars, taxies and autonomous machines buzzing around our heads are as popular as ever. A long-held dream of taking the imagination and making it real is the business of a lot of new entrants in aviation. The proliferation of projects is astonishing. Even with all the hype aside, there’s a strong chance that some organisations will suceeed in changing our skies forever.

This is great. It’s a way of decarbonising but continuing to fly. It opens new ways of undertaking vital tasks, like getting drugs and vaccinees to remote regions of the world. Emergency services can benifit in getting people from A to B faster and less expensivly. It may help get internal combustion engines off our congested roads in major cities. Air quailty may then improve for densly populated areas.

Nothing is for free. The shear complexity of the problems that need to be solved are taxing some smart people all over the globe. Not only that but the accommodation of aviation’s hundred-year legacy must be factored in too. That’s one reason why research and technical programmes are swallowing up the funds with a voracious appetite. Academics, consultants, and engineers are tapping into the pool of funds that Governments are making available.

Aviation has a pitfall that in that it is very unforgiving when errors and failures occur. It’s why the refrain that fits into every safety advocate’s lexicon is – safety is our number one priority. I will not argue as to how sincere those words are spoken. In the vast majority of cases, people mean what they say.

The awareness that in-service aircraft accidents can sink businesses is not lost on most protagonists. Health and Safety practitioners often say: “If you think safety is too expensive, try an accident”.

This note is more about the gaps that are evidence. Reading several publications on advanced air mobility safety and operations, I’m struck by the vagueness and wooliness of the material available. Or at least that’s how the material often starts. Then there’s a rush into infinitesimal detail to crack problems that seem more tangible. There are two problem spaces. There’s the part where uncertainty prevails. Then there’s the part where the nicely bounded nutty, gritty technical problems exist.

There are often far more questions than answers. Documents that proport to have answers are littered with questions. I’m reminded of the HHGTTG[1]. Talking about the invention of the wheel and a group considering what to do with it: “Well, if you’re so smart – what colour should it be?”

Asking the right questions is a must but there’s a lack of clarity too. Before going into painstaking detail on a set of scenarios a sound report should states its underlying assumptions first. It’s not a good idea to bypass the fundamentals. For AAM to go beyond a novelty, real world difficulties need to be faced head on. Context matters. Sharing the airspace with existing users must be considered[2]. Safety assessment must take account of interactions with General Aviation, ballons, recreational activities, aerial work, emergency services and military operations[3].

It wouldn’t be a bad idea to consider how accident investigation will be conducted, even at this early stage. No doubt lots of data will flow from AAM but will it be what’s needed when things go wrong?


[2] UK CAA CAP2272, October 2021


How can we prevent organisational accidents?

Part 5

It’s my 62nd birthday in a couple of days. I live on a residential road where there’s a large education college. Around here, it’s impossible, during term time, to go anywhere without being faced with gaggles of 18-year-olds. They are finding their way, on the first steps shape the world of the future.

Although there’s 44 years between us, I don’t feel that much different from the engineering apprentice that I was at Yeovil College[1] in 1978. It’s true that I know a lot more but the curiosity, fascination with how things work and sense of wonder that I had then remains.

In my career, I’ve been fortunate in having experiences in, and working with a wide range of organisations across the globe. Therefore, I’ll not be reticent in expressing a view on what works and what doesn’t.

Those 44 years have been a transformative time. It really has been a dramatic shift from a primary analogue to the predominantly digital. What engineering organisations do, and how they organise has changed far further than was predicted by pragmatic futurists in 1978.

I’m going to relate this to the story of the Boeing 737. It is the most populous civil aircraft in everyday use around the world. It has, if you aggregate all the hours of in-service flying experience, an excellent safety record. More pilots know how to fly it and more mechanics know how to fix it than any other civil aircraft type.

These facts make the MAX saga even more galling. How on earth did such an experienced engineering organisation like Boeing make such a fatal mess? The question has been asked by a lot of people in the past 5-years. There plenty of analysis, investigation, and speculation for the public to chew over. From highly technical reports to sensationalist documentaries.

Is there a phenomenon at the core of the succession of mistakes that were made? I think there is. It has to do with the reason why chains of events don’t break easily when there’s a high level of commitment to a course of action.

This occurs in aircraft accidents when a pilot knows that they should turn back but chooses not to do so, with fatal effects. It’s often called: Press-on-it is[2]. Organisations can have “goal fixation” as much as individuals can. That fixation can come about due to commercial pressure or pride or a naturally competitive spirit. A corporate urge to carry on regardless overtook Boeing, and the FAA and others.

From its inception to an aircraft that I might board tomorrow, the basic 737 is as ancient as I am. At its core it’s a 1960s aircraft that has undergone several big transformations. Bit like the dramatic shift from a primary analogue to the predominantly digital world.

Aircraft manufacturers, of all types are faced with this question. When is enough, enough? When do we stop modifying, upgrading, or converting a basic aircraft type?

I did design work for the BAe Advanced Turboprop (ATP)[3], The aircraft was a redesign of the Hawker Siddeley HS 748[4]. A long lived and successful aircraft type. Unfortunately, it was a redesign too far. Too many compromises, facing hot competition in the twin turboprop market. The ATP achieved limited sales and production was terminated. A decision was made to stop. I think that if BAe had started with a clean sheet of paper in the 1980s there’d still be a successful aircraft flying.

Back to the MAX saga. In my opinion it was a change too far. However, once committed to that change there was no turning back. Noone was able to decide to stop or rethink. A strong corporate urge to carry on regardless blinded people to the reality of the situation that was unfolding.

The MAX is a derivative of a derivative. The 737 went from “classic” to Next Generation to MAX over 4-decades. The story is not over but the last 5-years will never be forgotten by the aircraft industry.