>Debate about whether to adopt the longer recording standard weighs considerations about cost and privacy implications against safety.
>The U.S. FAA has previously rejected the NTSB's call for mandating the retrofitting aircraft with new cockpit voice recorders, saying the costs would be significant at $741 million versus $196 million under incremental upgrades it proposed.
>Pilots have also opposed the move, with the union representing pilots for air-freight company Atlas Air telling the FAA the longer recordings would be an invasion of worker privacy.
Whether or not a "technical barrier" exists is a non-sequitur. Just because you can get a $10 audio recorder on aliexpress that records 200 hours, doesn't mean it takes $10 to implement this change per plane.
I bet many investigators would be very happy with the aliexpress implementation ...
Then you can gradually harden the new addon. This could be a way to make it all even more expensive.
If your cheap 24-hour system decides to self-immolate, it might be the cause of the incident rather than just help determine what the cause was.
It is appropriate to use caution and care. You are right about that. It is obstructionist to demand every possible mode of failure be used as an excuse to block progress. It is possible to use flaky hardware that will increase risk. But it isn't that hard or expensive to use reasonable care to avoid it while dramatically improving the tech. To pretend that any new tech would automatically lead to hundreds of deaths and should therefore never be considered is ridiculous on its face.
“Reasonable care” is expensive for airline grade hardware. You don’t just add features because they sound good. You don’t throw tech at the wall and see what sticks. You engineer reasonable solutions to real problems.
It’s nothing like building a webpage.
Im starting to wonder if the yet to be certified 777X will store for more than 2 hours as it takes 16 hour flights.
This airplane was brand new. It should be using something more modern.
Workers responsible for multi-million dollar machines and sometimes hundreds of human lives. I doubt anyone but the pilots care one bit about their on-the-job privacy.
Mandate the 25hr recording duration.
Mandate that full playback can only be done for accident investigation purposes By NTSB, unless requested by the crew(s). Some limited duration carve-out to allow maintenance crews to listen to last 15 mins to verify operation.
That’s silly. And we all know it. Nothing in a cockpit is “private” in this regard when it comes to transport of hundreds of people.
> cost
There it is. That’s all it ever is. If the cost of doing it right is higher than the fines of gambling with doing it wrong, the wrong way will always be chosen.
This is bog standard corporate life under capitalism.
It is about privacy, it's easy to verify the history of pilot's unions concerns and objections.
Incorrect. This is a struggle of ratio between regulation and lobby..
And then suggesting to revoke the licenses of a crew that at one of the most stressful moments in their career, right after a major incident, forgets to pull a circuit breaker is ridiculous. Luckily that is not how things in the aviation industry are done.
The problem in the US is that there has also been more disciplinary use of the recordings (by the company, not the NTSB). In Europe things are a bit more strictly regulated and there wasn't any resistance to the 25 hour change.
This sort of negligence is intentional. My guess would be it started as a requirement for analog recording and was carried over without change and purposefully left at two hours when equipment went digital. The fact that EU has a 25 hour length requirement and the FAA refuses to update their rules to extend to some reasonable length tells us everything we need to know about this situation.
i'll bet lunch the actual recorder hardware in the airplanes is the same with the only difference being a knob set to EU rules or FAA rules.
https://www.reuters.com/business/aerospace-defense/us-faa-wa...
CVRs were always highly contentious when introduced, due to exactly the situations you see today in the media. The pilot unions were concerned that these recordings would be released to the public, both out of context and releasing private personal data not relevant to the public - especially if anything at all salacious could be found.
There were strict protections about CVR data never being released, but of course those restrictions more or less no longer exist today in reality - leaks abound.
I think those that dismiss this concern entirely are the folks who cannot think critically. It highlights a legitimate concern for workplace privacy, of which the Overton window has shifted drastically into less privacy expectations over my lifetime. The public will nearly unanimously call for 25 hours here, but this was not the case even 40 years ago.
I think the benefit outweighs the concerns in this particular case, but you are now seeing the same fight regarding cockpit video recorders. I can't say the pilots are wrong given the history of CVR data breaches.
If I were a pilot I'd grudgingly support the existence of the CVRs, but I can't say I'd really like the idea. I've seen how sound bites get taken completely out of context and sound worse than they were intended at the time. I've also seen how CVR data is absolutely critical in resolving some accidents. It's all a tradeoff, but certainly not an immediately obvious one unless you value privacy at zero.
Edit: The idea behind the 2 hours thing, was that 2 hours would be plenty of time to record anything relevant to an actual accident. Either the plane is in pieces and recording has stopped, or the recordings get pulled on successful landing after declaring emergency. The entire intent was to limit what was available to only the accident sequences - not general chit chat 5 hours prior to any event while they were waiting for taxi clearance. Technical limitations at the time also didn't hurt this argument.
Also I think it's good to point out that relying on the pilots to pull the breaker after an incident is not ideal and one of those things that the union has absolutely kept in as a feature, not a bug. This has obviously been abused.
Your opinion/take on this is relatively new. While technically (legally) correct, there was a whole lot of social pushback on this statement or idea even in my lifetime.
This take on workplace privacy has not been the social standard for very long, and is certainly not a universally shared opinion.
Edit: To avoid comment spam here on an irrelevant side-subject. I didn't say it was a regression or a bad thing. I simply am pointing out it has massively shifted in a relatively short period of time. There was serious public debate about introducing these at all just a generation ago. Now it's seen as completely normal to have your entire workday recorded with zero expectation of privacy. It's a rather drastic shift in society.
1: Are we clicking buttons that could kill hundreds of customers without any chance of it being stopped by external oversight and review? To underscore the danger, is the cubicle secured by an anti-terrorist door which was installed after thousands died when terrorists attacked a similar cubicle before?
2. Are the recordings specially sequestered and regularly overwritten by default, as opposed to being kept indefinitely in a big database for anybody in my reporting chain to look at on a whim?
_____
For example, if I was "coding" inside the control room of a nuclear power plant and developing scripts to help automate the next hour of control-rod movements, I think I would be wayyyy more accepting of a 24-hour disaster recording loop in a box for the US Department of Energy.
Tech-bros will read this and say nobody died due to their software, but that's neither true nor the point. Giving every supposedly private interaction at work a chance to leak only sounds reasonable when it's not you
This smacks of "Privacy for me but not for thee", to say nothing of the effect it would have on the perpetual low-level pilot shortage due to things like working conditions.
> the perpetual low-level pilot shortage due to things like working conditions.
There are a lot of pilots “waiting in the wings” at smaller carriers, currently being paid peanuts, to get nice cushy jobs at major carriers with union protections who won’t mind having their voice recorded and stored for 24 hours while on the job behind the yokes.
That union opposes cockpit video monitoring and has opposed the extension of CVR recordings.*2
*1 - https://www.alpa.org/en/about-alpa/our-pilot-groups
*2 - https://www.flyingmag.com/faa-proposes-extending-cockpit-voi...
This is not just the state of things in most companies, but it is a legal requirement in companies subject to the Sarbanes-Oxley Act.
fwiw I don't particularly like either state of affairs, but pragmatically some business interns somewhere at JP Morgan has all of their communication recorded and preserved for regulatory oversight, the fact that pilots don't is a testament to their union, and not because it wouldn't be considered normal in today's working world.
The only way to stop the CVR from recording is to depower the airplane (which is one of the steps you take prior to an emergency evacuation) or to pull the circuit breaker if the airplane needs to stay powered.
A pilot would never pull the circuit breaker without confirmation from management or safety to do so. It’s just not done routinely. Depending on the airline, it may not even be the pilot’s responsibility to do so. Every airline has a binder (likely, several binders) full of procedures to follow after a NTSB-reportable accident. No one person is expected to do the job of many.
Declaring an emergency (standing alone) should not be a reason to pull the CVR, IMO. There should be an aviation-safety related reason at a minimum. (Declaring an emergency to facilitate expedited handling for a passenger medical emergency should not trigger a need to preserve the CVR recordings, as one concrete example.)
In ~95% of declared emergencies, there is zero paperwork or followup required. In over half of them, the pilot elected to (voluntarily but advisedly) fill out a NASA ASRS form (which is about a 15 minute task and something they probably would have done under the same circumstances without the emergency declaration). ( https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf )
It may be that training pilots specifically to declare emergency as soon as there's a problem rather than waiting until they're sure they can't solve the problem and need outside assistance will improve overall safety outcomes.
There's a tragic case I watched a safety video about where the private pilot, very low on fuel, asks if he can land at a (closed) airbase whose traffic controller he's talking to. The base's controller says he cannot land unless he's an emergency. That was his last chance to survive, all he needs to do is say he's an emergency - "I'm on fumes, I need to land right now" she'd turn the base's lights on, he puts it down on a strip that's not meant for civilians and maybe he spends the evening explaining to some MPs how he fucked up - but he's not dead. Instead he accepts this as a "No" and flies on for a few more miles until he runs out of fuel and crashes.
PS1: I saw what I think is that same ASF video ( https://youtu.be/fLlWf-Fk_YM?t=10m ). Really frustrating, especially how obvious it was an emergency to everyone except the two people on the radio (where the bulk of blame belongs to the pilot of N4975S.
PS2: One of my instructors was in CAPS Event #59. I talked to her afterwards; she was a fan. :)
Calling them all "saves" is overstating the incremental benefit.
(I've technically declared pan-pan once, there was no paperwork.)
I will absolutely, unreservedly dismiss the concern of a pilot for privacy in the cockpit because I can think critically. The notion that someone deserves privacy in the cockpit of commercial aircraft is outrageously silly and utterly indefensible. Pilot your own personal aircraft if you want that privacy.
And there is absolutely an "Overton window", but it is wrong to think that whatever way it moves is a regression or worsening (which is the classic "everything is always getting worse" melodrama). Sometimes the way things are is not rational or optimized, but just are.
The 2 hour thing was nothing but a technical limit (a literal loop of magnetic tape), and every other justification is retconning.
The 2 hour thing was 30 minutes when it was magnetic tape. It moved to digital a while ago and that's when the unions negotiated it to 2 hours after some incidents. The 2 hour limit was not based on anything technical that I'm aware of.
The privacy stuff is absolutely not reconning. Heck, it was pretty much the most talked about topic over the water cooler when I was doing some IT contract work for ALPA in my teens.
My memory is certainly fuzzy but not quite that fuzzy.
So if you don't agree, you can't think critically. Got it.
Or maybe, we did think about it critically and simply don't agree.
There are various way this can be solved. We have modern encryption that could make this far, far safer then it is today. We have methods from data leaking. We have process to only allow data to be decrypted if required.
This would actually force us to really think critically about who has what access when. In planing this the airlines, unions, FAA should sit together with some technical experts and think of this critically.
This seems less complex to me then a modern high bypass turbo engine.
There are not. You cannot solve a social problem with a technical solution. If the data exists, it can and likely will be used.
> This highlights a complete failure on multiple levels and an inability to critically think about the problem space. How much time was spent implementing a system that under most circumstances where it would be needed would render itself entirely useless?
I was responding in particular to this. It does not highlight an inability to think critically unless you value privacy at zero and only look at these recordings as a technical problem. Under most circumstances when it's needed this system has functioned exactly as designed. You read about the failures because they are the exception. Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement.
I would actually agree with you in general if for not that comment. It simply means we disagree. But it surely does not mean no one has thought critically about this subject when it was introduced or since.
Except in reality we use often use technical solution to solve social problems. Or rather technical capabiltiy gives us the means to approach a social problem in a different way.
> unless you value privacy at zero
The assumption that privacy is 100% impossible if something is recorded and stored is simply categorically false.
> only look at these recordings as a technical problem
I didn't do that. I suggested that the FAA, the Unions, the Airlines and the manufactures sit together and come up with a solution of what the exact data access policies are.
> Under most circumstances when it's needed this system has functioned exactly as designed.
And yet when going threw the history of air incidents, there are lots of cases where this isn't the case. Most isn't good enough.
> You read about the failures because they are the exception.
Sure and a server crashing is the exception, and yet somehow most of use still run 2 server if we want things to work continuously.
The argument 'mostly its fine, its just occasionally that a couple 100 people die and we don't know why' just doesn't work for me. Yes in most cases its not that dramatic, but it would still be very useful.
> . Believing that CVRs as-designed fail under "most circumstances" would be a lack of critical thought to me. I was limiting my scope to this statement.
Fair.
Could even have some indicator in the cockpit that it's in emergency mode for the pilots to turn it back to loop mode in case of a false positive.
At least the voice recorder is 2 hours instead of half an hour now. But watching those incident videos I've seen a couple that ended up being investigated but the pilots didn't pull the circuit breaker and the investigation was based on the flight recorder, specially in those cases where things end up fine.
For the most severe incidents, recording stops at the end of the incident. The current two hours is an increase of the previous 30 minutes. The old 30 minute limit made a little more sense at the time considering the mechanical nature of the recorders at that time.
I think if the plane is still operational for 2 hours then the data is a lot less important than the alternative scenarios.
Its unbelievable how often the voice recording gets overwritten. This has been a problem for literally decades. How this is not solved is mind blowing.
This would be trivial to store, and trivial to upload. People have wifi in the plane but somehow we can't upload a few voice recordings and other flight data. (and before somebody jumps on me, yes its not 'trivial' but its a hell of a lot easier then about 1000 other things a modern plane does). And private as an argument doesn't' really work either.
The amount of valuable data lost is mind blowing. Not just in cases where things fail, but also in cases where everything goes right.
And then, somehow they don't have cameras that allow pilots to see the engines and other vital parts of the plane. Somehow passenger can fucking watch movie. But if a captain wants to know if the engine fell of the plane they have to send somebody from the cabin crew to run around and look out of the window.
Probably people in the 70s who thought having a recording at all is star trek stuff.
There a lot of things today that are less human-usable than they were a half-century ago, but also much more flexible and less expensive. We're still in a weird transitional phase post-transistor.
The voice recorder overwrites itself on a two-hour loop. Two hours of voice data takes about a gigabyte of space at most. There is no technical barrier to right sizing this, and there is nothing special about the aerospace use case that prevents it.
Why would anyone think a two-hour buffer for something so critical would be appropriate? And why would it continue to overwrite itself after it’s grounded? Why is there no backup? Has it never been thought relevant to gather, say, an entire flights worth of data instead?
This highlights a complete failure on multiple levels and an inability to critically think about the problem space. How much time was spent implementing a system that under most circumstances where it would be needed would render itself entirely useless?