AMC 25.1457 Cockpit voice recorders

ED Decision 2020/024/R

1.       General

The installation of a recorder with an ETSO authorisation against ETSO-C123c (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1457(a).

In showing compliance with CS 25.1457, the applicant should take account of EUROCAE Document No ED-112A ‘MOPS for Crash Protected Airborne Recorder Systems’ or a later revision.

‘Deployable recorder’ designates a flight recorder installed on the aeroplane which is capable of automatically deploying from the aeroplane.

‘CVR system’ designates the cockpit voice recorder (CVR) and its dedicated equipment (e.g. dedicated sensors or transducers, amplifiers, dedicated data busses, dedicated power source).

2.       Combination recorders

a.       If the recorder performs several recording functions (i.e. it is a combination recorder), the means for pre-flight checking the recorder for proper operation should indicate which recording functions (e.g. FDR, CVR, data-link recording, etc.) have failed.

b.       When two flight data and cockpit voice combination recorders are installed, either because they are required or because they are an acceptable alternative to a flight data recorder and a cockpit voice recorder, then these two fight data and cockpit voice combination recorders should be connected to separate power buses.

3.       Automatic means to stop the recording after a crash impact

The automatic means to stop the recording (which is required if the recorder has a recording duration of less than 25 hours) should operate even if a power supply is still available.

The automatic means to stop the recording within 10 minutes after a crash impact may rely on:

a.       dedicated crash impact detection sensors. In that case, negative acceleration sensors (also called ‘g-switches’) should not be used as the sole means of detecting a crash impact; or

b.       the recording start-and-stop logic, provided that this start-and-stop logic stops the recording 10 minutes after power is lost on all engines (and, when applicable, the APU) when the aeroplane is on the ground.

4.       Means for pre-flight checking of the recorder

The means for pre-flight checking of the recorder should be able to detect and indicate the following:

a.       A loss of electrical power to the flight recorder system;

b.       A failure of the data acquisition and processing stages;

c.       A failure of the recording medium and/or drive mechanism; and

d.       A failure of the recorder to store the data in the recording medium as shown by checks of the recorded data including, as far as is reasonably practicable for the storage medium concerned, its correct correspondence with the input data.

5.       Means for the flight crew to stop the cockpit voice recorder function

The means required for the flight crew to stop the cockpit voice recorder function after the completion of the flight is needed in order to preserve the recording for the purpose of investigating accidents and serious incidents. In fulfilling this requirement, it is acceptable to use circuit breakers to remove the power to the equipment. Such a means to stop the cockpit voice recorder function is not in contradiction with CS 25.1357(f), because it would not be used under normal operating conditions, but after an accident or a serious incident has occurred.

6.       Power sources

a.       An alternate power source is a power source that is different from the source(s) that normally provides (provide) power to the cockpit voice recorder function.

In CS 25.1457(d)(6), a ‘normal shutdown’ of power to the cockpit voice recorder means a commanded interruption of the power supply from the normal cockpit voice recorder power bus; for example, after the termination of a normal flight. ‘All other power’ means the electrical power source(s) used for normal operation of the cockpit voice recorder function. The following applies to the installation of an alternate power source:

i.        A tolerance of 1 minute on the 10 minutes minimum power requirement of CS 25.1457(d)(6) is acceptable;

ii.       The use of aeroplane batteries or other power sources is acceptable, provided that electrical power to the essential and critical loads is not compromised;

iii.      If the alternate power source relies on dedicated stand-alone batteries (such as a recorder independent power supply), then these batteries should be located as close as practicable to the recorder;

iv.      The means for performing a pre-flight check of the recorder for proper operation should include a check of the availability of the alternate power source;

v.       If the cockpit voice recorder function is combined with other recording functions within the same unit, the alternate power source may also power the other recording functions; and

vi.      If two flight data and cockpit voice combination recorders are installed, either because they are required, or because they are an acceptable alternative to single-function recorders, then only one recorder needs to have an alternate power source for the cockpit voice recorder function. This should be the combination recorder that is located closer to the cockpit area.

b.       If the cockpit voice recorder function has a recording duration of less than 25 hours, the electrical power to this function should not be supplied for more than 10 minutes after power is lost on all engines (and, when applicable, the APU) when the aeroplane is on the ground.

7.       Recorder container

The attachment of the recorder container should comply with the specifications given in EUROCAE Document No ED-112A.

The container of a non-deployable recorder should be installed in the rear section of the aeroplane and in an area that increases the chances of the equipment surviving crash impact forces and the heat damage caused by a fire. However, it should not be installed where aft-mounted engines may crush the container during impact.

If two combination flight data and cockpit voice recorders (non-deployable) are installed, then the container of the recorder that is dedicated to the cockpit voice recorder function may be located near the flight crew compartment if at least one recorder is installed in the rear section.

8.       Deployable recorder

If the recorder is deployable:

a.       The automatic deployment capability should be available as long as the aeroplane is airborne; this should include cases in which electrical power is lost from the engines and APU.

In the event of a landing on water, the deployment should occur upon the immersion of the aeroplane in water; this means that the automatic deployment capability should remain available after contact with the water for a certain period in order to allow automatic deployment upon immersion;

b.       The assessment of the effects of unintended deployment of the recorder in flight should include:

i.        The effects on the continued safe flight and landing of the aeroplane. This assessment should cover the normal flight envelope of the aeroplane and include the following aspects:

—         Potential impact on aeroplane structure, including flight control surfaces, and on systems; and

—         Aerodynamic effects caused by the cavity created in the structure after deployment.

In order to address the effects of the impact on the aeroplane after deployment, the applicant should:

—         either demonstrate that impact with the aeroplane is extremely improbable;

—         or demonstrate continued safe flight and landing after impact damage, considering all flight phases. The demonstration should include the effect of the damage to the structure and systems on residual strength, stability, control and aeroelasticity:

—          Residual strength should be demonstrated in accordance with AMC 25.571, Section 10.(c); and

—          Freedom from aeroelastic instability should be demonstrated within the aeroelastic stability envelope as defined by CS 25.629(b)(2); and

ii.       The effects on persons other than aeroplane occupants due to unintended deployment while the aeroplane is airborne, in particular the risk of serious or fatal injuries for persons being hit by the deployed part.

Several methods can be adopted in order to quantify the probability of causing serious or fatal injuries to the persons on the ground associated with unintended deployment of a recorder. However, the following variables should be used:

—         The density of population, with reasonable correction factors related to time exposure and shielding such as being indoors and shielded by, for example, buildings, or being in a means of transportation; and

—         The size and weight of the deployed part.

The probability of causing a serious or fatal injury is expressed as the combination of:

—         the probability of an unintended deployment;

—         the probability of a person being hit by the deployed part; and

—         the probability that, if hit by the deployed part, a person will suffer serious or fatal injuries. This probability may be set to 1, as a conservative assumption; otherwise, the applicant may propose another value to EASA for approval.

c.       The assessment of the effects of unintended deployment of the recorder on ground should include:

i.        The risk of injuries caused to persons. This should include those who are involved in aeroplane maintenance, ground handling, taxiing, rescue operations, or emergency evacuation; and

ii.       The effects on other aircraft and facilities.

In particular:

—         A conspicuous placard or label that is visible from the outside of the aeroplane should be placed adjacent to the recorder deployment point;

—         ICA and/or operational procedures should be provided to prevent injuries during maintenance and ground handling;

—         Operational procedures should define the first actions to be taken by the flight crew when the recorder is no longer attached to the aeroplane, in order to address any risk to continued safe flight and landing and the possible effects on other aircraft and facilities;

—         Procedures should address the precautions that should be taken to avoid injuries which could be caused by an unintended deployment during emergency evacuation;

—         Information that addresses the precautions to be taken by search-and-rescue services after an accident should be publicly available; and

—         The deployment mechanism should only release the recorder in one piece.

d.       There may be a means to manually disengage the deployment capability when the aeroplane is not capable of moving under its own power; however, in this case, an alert should be provided to the flight crew during the pre-flight checks if the deployment capability is disengaged;

e.       The deployable recorder installation should be such as to guarantee the highest probability of the deployment of the recorder in the event of an explosion or a collision. In particular, the installation and the performance of the deployment capability should be such that, in most cases of collision, the deployment of the recorder can take place before the deployment mechanism is damaged. However, the installation should be such that, to the extent possible, the recorder does not deploy in a non-catastrophic occurrence such as a hard landing or a tail strike.

f.       The demonstration of compliance with CS 25.1457(e) should cover the whole flight envelope of the aeroplane, and additional trajectories that might be expected during the initial stages of an accident sequence.

The applicant may use the following Table 1 parameter ranges that have been observed during occurrences of loss of control of large aeroplanes:

Table 1: Parameter ranges

g.       The alert that the recorder is no longer attached to the aeroplane should be provided as early as permitted by the principles of AMC 25.1322.

h.       The deployment capability should function under all the environmental conditions for which the aeroplane is certificated.

i.        The effect of exposure to environmental conditions (such as temperature, rain, lightning strikes, etc.) on the serviceability of the flight recorder and of its deployment capability should be addressed by design features and/or by ICA. ICA or operational procedures or both should also be provided such as to prevent maintenance and operational actions on the external surfaces of the aeroplane (such as painting, cleaning, application of de-/anti-icing fluids, etc.) from adversely affecting the serviceability of the flight recorder and its deployment capability.

j.        In order to limit the effects on search-and-rescue services of an unintended activation of the emergency locator transmitter (ELT) that is integrated in the recorder:

—         unintended deployment of the recorder should be classified at least as a major failure condition; and

—         operational procedures should define the flight crew actions to be taken after they realise that an unintended recorder deployment has taken place, including actions to prevent an unnecessary search-and-rescue response.

Furthermore, in order to identify the conditions which triggered an unintended deployment of the recorder (including the ensuing activation of the ELT) or an activation of the ELT without deployment of the recorder, appropriate data should be recorded on board or transmitted to the ground to support the post-flight analysis.

9.       Evaluation of the CVR recording

The following acceptable means of compliance with CS 25.1457(b) is provided to demonstrate that the performance of a new or modified CVR system is acceptable and that the quality of the CVR recording is acceptable. Inspections of the CVR recording that are part of the Instructions for Continued Airworthiness are not in the scope of this paragraph.

a.       The CVR system should be installed in accordance with the recommendations made in EUROCAE Document ED-112A, in particular:

—         Chapter 2-5, Equipment installation and installed performance, and

—         Part I, Cockpit Voice Recorder System, Chapter I-6.1.1 Interface design, I‑6.1.2 Recorder Operation and I-6.1.3 Bulk Erasure Interlocks.

Particular attention should be given to the location of the cockpit area microphone (CAM). ED‑112A, Chapter I-6.2., Equipment location, provides guidance on this topic.

It should be noted that the CVR may record on more than four channels, and that this may help to avoid superimposition between signal sources recorded on the same CVR channel.

b.       To ensure that the CVR system is properly installed, and to verify that the quality of the audio signals recorded on all the channels is acceptable, the applicant should conduct a flight test. The recording obtained should be evaluated to confirm that the quality is acceptable during all the normal phases of flight (including taxi-out, take-off, climb, cruise, descent, approach, landing, and taxi-in). ED‑112A provides guidance for testing a new CVR installation. (Refer to Chapter I-6.3).

c.       The evaluation of the CVR recording should include:

i.        the tasks described in ED-112A, Annex I-A, Chapter I-A.3;

ii.       checking that the vocal signal sources are intelligible and that non-vocal alerts on headsets or speakers can be identified;

iii.      checking that the levels of sidetone signals (e.g. radio) and public address are adjusted so that these signals are audible and do not mask the signals from the flight crew microphones (refer to ED-112A, Part I, Chapter I-6.1.1);

iv.      checking the start-and-stop function of the CVR system. The CVR should begin to operate no later than when power from sources other than from the alternate power source is available and the pre-flight checklist is started. The CVR should continue to operate until either the completion of the final post-flight checklist or until 10 minutes after power is lost on all engines (and, when applicable the APU) and the aeroplane is on the ground.; and

v.       checking for the presence of any fault in the memory of the built-in-test feature of the CVR, if applicable.

d.       The evaluation of the CVR recording should fulfil all of the conditions below:

i.        The equipment used for the CVR recording replay should meet the specifications of Chapter I-A.2 of Annex I-A of ED-112A or a higher standard;

ii.       The replay and evaluation of CVR recordings should be performed by personnel who have adequate knowledge of CVR systems and aircraft operations, and who have appropriate experience of the techniques used to evaluate recordings;

iii.      The observations from the evaluation should be documented in an evaluation report. An example of an evaluation report is provided in ED-112A, Annex I-A; and

iv.      The evaluation report should indicate the quality of each audio signal required to be recorded by CS 25.1457(c) according to defined criteria. For example, the following audio quality rating scale may be used:

GOOD:

1.       When considering a vocal signal source (crew voice, radio reception, radio sidetone, interphone, public address, synthetic voice in callouts, warnings and alerts) recorded on a channel other than the CAM channel, the signal is intelligible without using any signal post-processing techniques, and no significant issue (e.g. saturation, noise, interference, or inadequate signal level of a source) affects the quality of this signal;

2.       When considering non-vocal alerts recorded on a channel other than the CAM channel, the sounds are accurately identifiable in the recording without using any signal post-processing techniques, and no significant issue affects the quality of the sound recording;

3.       When considering the CAM, the recording is representative of the actual ambient sound, conversations and alerts as if an observer was listening in the cockpit, and no significant issue affects the quality of the signal; and

4.       No ‘medium’ or ‘major’ issue is identified on any channel (see Table 1 below for examples).

FAIR: a significant issue affects the signal source being considered. However, the related signal can still be analysed without signal post-processing, or by using signal post‑processing techniques provided by standard audio analysis tools (e.g. audio level adjustment, notch filters, etc.). The severity of the identified issues is not rated higher than ‘medium’ (see Table 1 below for examples).

POOR: the signal source being considered is not intelligible or not identifiable, and this cannot be corrected even with the use of signal post-processing techniques. The severity of the identified issues is not necessarily rated as ‘major’, it may also be rated as ‘medium’, depending on the consequences for the required signal sources (see Table 1 below for examples); and

v.       the audio quality rating of a CVR channel required by CS 25.1457(c) should be the same as the worst audio quality rating among the signal sources to be recorded on this channel.

e.       The performance of the CVR system should be considered acceptable by the applicant only if, for none of the signal sources required by CS 25.1457(c) or by the applicable operating rules, the quality of the audio recording was rated as ‘poor’. In addition, if the CVR system is part of a new aeroplane type, the performance of the CVR system should be considered acceptable by the applicant only if, for all of the signal sources required by CS 25.1457(c) and by the applicable operating rules, the quality of the audio recording was rated as ‘good’.

Table 1: Examples of issues affecting a signal source and of the associated severity.

*CAM line: microphone+control or preamplifier unit+wiring to the CVR

10.     Instructions for Continued Airworthiness (ICA)

When developing the ICA for the CVR system, required by CS 25.1529 and Appendix H, the applicant should address all the failures that may affect the correct functioning of the CVR system or the quality of the recorded audio signals.

Examples of failures (indicative and non-exhaustive list):

—          Loss of the recording function or of the acquisition function of the CVR;

—          Any communication or audio signal (required by CS 25.1457(c) or by the applicable air operations regulations) is missing, or is recorded with an audio quality that is rated ‘poor’ (refer to the example of audio quality rating provided in Section 9 of this AMC);

—          Failure of a sensor, transducer or amplifier dedicated to the CVR system (e.g. failure of the cockpit area microphone);

—          Failure of a means to facilitate the finding of the CVR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder);

—          Failure of any power source dedicated to the CVR (e.g. dedicated battery);

—          Failure of the start-and-stop function;

—          Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).

[Amdt 25/2]

[Amdt 25/23]

[Amdt 25/26]