16 ms·

This is a proposal from the NTSB to the FAA to raise the CVR recording time from 2 hours to 25 hours, in line with ICAO. This is very likable scenario for every

This is a proposal from the NTSB to the FAA to raise the CVR recording time from 2 hours to 25 hours, in line with ICAO. This is very likable scenario for everyone except pilots unions. > The NTSB has conducted 10 investigations since 2018 where the CVR was overwritten, including four runway incursions, Homendy said. I tuned into the NTSB press brief last night, and they emphasized understanding communication is important for the best accident analysis. Homendy stated that they now do not have any record of communication between the flight deck and cabin.

wolverine876 3y ago
Why stop at 25? Record all of every flight and archive it. Develop a standardized structure to make it searchable by different factors or combinations of factors (e.g., 777 model later than Z & decending & outside temp < X & throttle is > Y & etc.) When there's an accident, you could review similar circumstances. From my ignorant perspective on air safety, it would seem to be a gold mine.
- H8crilA 3y ago
  This industry is ridiculously slow compared to IT. Air traffic comms (both voice AM and text ACARS/VDL) are not only not encrypted, but also crucially not even authenticated. So you can send text messages and speak to any aircraft at any privilege level (just say you're ATC) with a simple SDR. Or you can spoof a faulty engine message on the downlink channel.
  - teovall 3y ago
    The antiquated AM mode and the lack of encryption or even digital encoding is a safety feature for air traffic voice communications. Very weak signals still have a chance of being intelligible and if two signals are transmitted at once on the same frequency, both can still be heard.
    - H8crilA 3y ago
      Yeah but it's terrible for security. Also digital modes work just fine at the same range - I have no problem hearing ADS-B messages from up to 200mi away from my ground level antenna, where the max range is only limited by the curvature of the planet. And note that the real problem is with authentication (MACs, or digital signatures), not encryption. Public availability of those records is actually probably beneficial. It's a common misconception to think that you need to encrypt while in reality you perhaps need to encrypt, but first you absolutely must authenticate.
      - ryandrake 3y ago
        Is this an actual problem that is happening in practice, though? How many instances of "unauthenticated" airband communication have caused an accident? I don't know. Even if the answer is nonzero, I'd be willing to bet it's less than ten in decades.
        H8crilA 3y ago
        There was a guy in Berlin who was issuing fake landing clearances recently: https://aviation.direct/en/berlin-falscher-fluglotse-narrte-die-piloten-sechs-monate-lang https://aviation.direct/en/berlin-falscher-fluglotse-narrte-... It took 6 months to find him, and mind you that that guy was the opposite of clever (he was talking from his bathtub, from what I remember, and he started out not even knowing the ATC language). Also, it really makes sense to think ahead just a bit, you know. Not everything has to be triggered with an accident, and in this case we're likely talking about terrorism, since no one would do this without realising just how bad the legal consequences are.
      - tjohns 3y ago
        You don't really need more security, because if a pilot gets an ATC instruction that doesn't make sense, they're going to question it. Pilots aren't following instructions blindly, everything is mentally cross-checked against what we expect should be happening for situational awareness. (And ATC would also hear the interloper and immediately speak up.) On top of that, almost everyone in the US also has some form of collision avoidance technology now, as well (either TCAS or ADS-B). And there's plenty of times where the only time I could hear ATC was with the squelch full open, trying to pick a faint signal out through the static. Digital modes are terrible for this.
  - psunavy03 3y ago
    This is an annoyance, not a safety issue. No aircrew is just going to blindly follow instructions routing them off to east Jesus after they already understand where they're going and how they're cleared to get there. What's more, on any given freq, you're talking to one controller. And if another voice comes over the freq giving you instructions that don't make sense, the response is going to be a polite version of "WTF?"
    - H8crilA 3y ago
      Why do you think the ATC will hear it? You can use a high gain antenna. Also, you can play some really nasty tricks with things that override the ATC, such as TCAS. Or things that are independent of the ATC, like that faulty engine readings sent over ACARS that I mentioned earlier. There really is no way to do it safe without authentication codes or digital signatures. PS. And the readback can be just jammed.
      - seabass-labrax 3y ago
        You're absouletly right. Here's a pretty good article covering some of the attacks that could be done against radio navigation systems: https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r... On a foggy day when the visibility is right at minimums, I can imagine a huge risk of aircraft being sent off-course right before landing. Hopefully the pilots would still be able to recover the situation - the TOGA button is right there on the thrust levers on most aircraft - but nobody is infallible. I would imagine that some military transport aircraft have backup, INS-based navigation systems that create a synthetic glidepath without external radio signals. Airbus have been trying to introduce such systems on commercial airliners for quite a while, although that is intended to allow landing on more remote runways rather than specifically to improve security against malicious interference. All that is to say that the lack of fatal aviation accidents that we know were caused by malicious radio interference doesn't in any way make the attack less feasible. Digital signatures, even with conventional X509 certificates straight out of the OpenSSL library, would go a long way to mitigate this risk. What about the risk of the signatures failing? The worst-case scenario is that the pilots get a warning on their ECAM display: "Comms not secure". That should at least alert them to the possibility of false readings even if it can't correct them.
- burnerthrow008 3y ago
  Exactly! And while we're at it, why stop with CVRs? Software is a key component of all engineering domains today, and thus a critical safety factor. All MacBooks (the most popular developer machine today) have built-in microphones. We should using them to record all dev conversations (after all, there's zero incremental hardware cost to doing so), as well as all keystrokes of anyone who writes software, 24/7, so that we can retrospectively analyze why they failed to avoid writing buggy code and the decisions that led to it. Everyone who has had their PII leaked will rejoice, knowing that we can finally "get" those nasty open- and closed-source developers who created CVEs. "B-b-but, that's different!"
  - cheschire 3y ago
    But it is different. Your message could've had an entirely different tone that would have provided a thoughtful yet tangential analogy. Instead you've chosen a specious strawman approach for some reason. There's a clear and obvious difference between a self-important person who writes software and a person who pilots hundreds of folks over top of thousands of other folks in a slow and only mildly explosive missile.
    - abadpoli 3y ago
      That mildly-explosive missile has software running on it too. So do a lot of actual missiles, for that matter. If we record every action of the pilot of a plane, why wouldn’t we also record every action of the developers who wrote the autopilot software, or the fly-by-wire software?
      - mvdtnz 3y ago
        Because the developers don't need to make snap decisions under stressful conditions with lives at stake. If you can't see the difference, sorry, that's on you.
        abadpoli 3y ago
        Making snap decisions under stressful conditions has nothing to do with recording actions for later root cause analysis. If you can’t see the difference, sorry, that’s on you.
- purpleblue 3y ago
  Have multiple cameras on every airplane and record absolutely everything so that pilots and passengers both have skin in the game. We are relying on individual phone cams to record events which is stupid. We are in an age where this kind of information is already pushed on police officers and the public in general. The amount of safety information we can get will be extremely invaluable, especially with something like a catastrophic failure like this 737 MAX failure.
- t0mas88 3y ago
  Voice recording is a big privacy concern for the crew. This is our workplace, so you would be recording every conversation, also any idle chat of which there is quite a lot in cruise flight. The current voice recording is only accepted by the crew with the agreement that it is not stored, and can only be pulled after a serious incident in which case there will be a no-blame investigation. But what you're trying to solve, already exists without the voice recording part. It's called FOQA or Flight Operations Quality Assurance. Mandatory for airlines in Europe, not yet mandatory in the US but may be in the future. It records hundreds of parameters from engine indications to touchdown speed, G-loading, control inputs etc. Automatically uploaded to the operator and tracked for the whole fleet. That data is de-identified and used for safety analysis and improvement.
  - mvdtnz 3y ago
    Respectfully, it is your workplace in which you're responsible for the lives of thousands of people each week. I don't think it's unreasonable to keep proper tabs.
    - eitland 3y ago
      Respectfully: the pilots have been doing an absolutely excellent job with it for decades without us having to destroy their privacy. An argument can easily be made that this extra stress will make flying less safe. Edit: my next car will probably have mandatory spyware and unlike pilots there won't be a guaranteed no blame process if something happens. It is pretty easy to see how this will be abused by insurance companies and data harvesters. I think I kind of understand the processes that lead to this. But I seriously wish tech people wouldn't be accepting it and even argue for it.
      - wholelotta 3y ago
        Respectfully, history is a terrible measure for carrying on as we have. Tech people are arguing for accountability in a life/death scenario. That there is no privacy in public spaces is a longstanding social/legal tradition. A cockpit is physically private for physical security reasons but the pilots in the cockpit are acting on behalf of public trust. Their social norms in that physical context are not their own to define. If pilots want privacy they can quit and sit at home.
- benhurmarcel 3y ago
  This already exists for aircraft parameters. Not audio.
- DrNosferatu 3y ago
  [read me elsewhere]
  - garciasn 3y ago
    In this case it would be the airline pilot and/or flight attendant unions.
- spuz 3y ago
  I can't find it now, but there was a Reddit thread from a US flight instructor at the time of the China Eastern Airlines crash of 2022 who had previously trained pilots in China. He claimed the airline policy was to record cockpit audio of every single flight and have multiple people review that flight for anomalies. Any deviation from the standard procedure was logged and marked against the offending pilot. The pilots were extremely reluctant to act outside the guidelines of their training in a way that this person thought put safety at risk. As you can imagine, this is not a situation that US pilots want to be subject to and they are probably right that safety would actually be made worse.
- AdamJacobMuller 3y ago
  For flight data metrics, this makes sense, but this is significantly already happening with aircraft systems transmitting data back to central monitoring systems in realtime. Pilots can see an errant value (say a moderately high temperature somewhere) and call up an engine specialist and ask them if it's a concern and that specialist can look at a plethora of data on the plan in flight. The planes can also "phone home" and report things which should be looked over or fixed during the next downtime and maintenance organizations can proactively order parts or schedule personnel to fix issues before the plane even lands. This is all being done in the name of efficiency, but, it no doubt has positive safety benefits too. Airlines and manufacturers can already run a query like "how many hours between replacement of part X on average" and "how many hours between replacements of part X for planes which regularly fly to middle eastern countries (hot and dry)" For audio recordings, in the absence of an incident, I see no reason to do it.

wolverine876 3y ago

Why stop at 25? Record all of every flight and archive it. Develop a standardized structure to make it searchable by different factors or combinations of factors (e.g., 777 model later than Z & decending & outside temp < X & throttle is > Y & etc.) When there's an accident, you could review similar circumstances. From my ignorant perspective on air safety, it would seem to be a gold mine.

H8crilA 3y ago
This industry is ridiculously slow compared to IT. Air traffic comms (both voice AM and text ACARS/VDL) are not only not encrypted, but also crucially not even authenticated. So you can send text messages and speak to any aircraft at any privilege level (just say you're ATC) with a simple SDR. Or you can spoof a faulty engine message on the downlink channel.
- teovall 3y ago
  The antiquated AM mode and the lack of encryption or even digital encoding is a safety feature for air traffic voice communications. Very weak signals still have a chance of being intelligible and if two signals are transmitted at once on the same frequency, both can still be heard.
  - H8crilA 3y ago
    Yeah but it's terrible for security. Also digital modes work just fine at the same range - I have no problem hearing ADS-B messages from up to 200mi away from my ground level antenna, where the max range is only limited by the curvature of the planet. And note that the real problem is with authentication (MACs, or digital signatures), not encryption. Public availability of those records is actually probably beneficial. It's a common misconception to think that you need to encrypt while in reality you perhaps need to encrypt, but first you absolutely must authenticate.
    - ryandrake 3y ago
      Is this an actual problem that is happening in practice, though? How many instances of "unauthenticated" airband communication have caused an accident? I don't know. Even if the answer is nonzero, I'd be willing to bet it's less than ten in decades.
      - H8crilA 3y ago
        There was a guy in Berlin who was issuing fake landing clearances recently: https://aviation.direct/en/berlin-falscher-fluglotse-narrte-die-piloten-sechs-monate-lang https://aviation.direct/en/berlin-falscher-fluglotse-narrte-... It took 6 months to find him, and mind you that that guy was the opposite of clever (he was talking from his bathtub, from what I remember, and he started out not even knowing the ATC language). Also, it really makes sense to think ahead just a bit, you know. Not everything has to be triggered with an accident, and in this case we're likely talking about terrorism, since no one would do this without realising just how bad the legal consequences are.
    - tjohns 3y ago
      You don't really need more security, because if a pilot gets an ATC instruction that doesn't make sense, they're going to question it. Pilots aren't following instructions blindly, everything is mentally cross-checked against what we expect should be happening for situational awareness. (And ATC would also hear the interloper and immediately speak up.) On top of that, almost everyone in the US also has some form of collision avoidance technology now, as well (either TCAS or ADS-B). And there's plenty of times where the only time I could hear ATC was with the squelch full open, trying to pick a faint signal out through the static. Digital modes are terrible for this.
- psunavy03 3y ago
  This is an annoyance, not a safety issue. No aircrew is just going to blindly follow instructions routing them off to east Jesus after they already understand where they're going and how they're cleared to get there. What's more, on any given freq, you're talking to one controller. And if another voice comes over the freq giving you instructions that don't make sense, the response is going to be a polite version of "WTF?"
  - H8crilA 3y ago
    Why do you think the ATC will hear it? You can use a high gain antenna. Also, you can play some really nasty tricks with things that override the ATC, such as TCAS. Or things that are independent of the ATC, like that faulty engine readings sent over ACARS that I mentioned earlier. There really is no way to do it safe without authentication codes or digital signatures. PS. And the readback can be just jammed.
    - seabass-labrax 3y ago
      You're absouletly right. Here's a pretty good article covering some of the attacks that could be done against radio navigation systems: https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r... On a foggy day when the visibility is right at minimums, I can imagine a huge risk of aircraft being sent off-course right before landing. Hopefully the pilots would still be able to recover the situation - the TOGA button is right there on the thrust levers on most aircraft - but nobody is infallible. I would imagine that some military transport aircraft have backup, INS-based navigation systems that create a synthetic glidepath without external radio signals. Airbus have been trying to introduce such systems on commercial airliners for quite a while, although that is intended to allow landing on more remote runways rather than specifically to improve security against malicious interference. All that is to say that the lack of fatal aviation accidents that we know were caused by malicious radio interference doesn't in any way make the attack less feasible. Digital signatures, even with conventional X509 certificates straight out of the OpenSSL library, would go a long way to mitigate this risk. What about the risk of the signatures failing? The worst-case scenario is that the pilots get a warning on their ECAM display: "Comms not secure". That should at least alert them to the possibility of false readings even if it can't correct them.
burnerthrow008 3y ago
Exactly! And while we're at it, why stop with CVRs? Software is a key component of all engineering domains today, and thus a critical safety factor. All MacBooks (the most popular developer machine today) have built-in microphones. We should using them to record all dev conversations (after all, there's zero incremental hardware cost to doing so), as well as all keystrokes of anyone who writes software, 24/7, so that we can retrospectively analyze why they failed to avoid writing buggy code and the decisions that led to it. Everyone who has had their PII leaked will rejoice, knowing that we can finally "get" those nasty open- and closed-source developers who created CVEs. "B-b-but, that's different!"
- cheschire 3y ago
  But it is different. Your message could've had an entirely different tone that would have provided a thoughtful yet tangential analogy. Instead you've chosen a specious strawman approach for some reason. There's a clear and obvious difference between a self-important person who writes software and a person who pilots hundreds of folks over top of thousands of other folks in a slow and only mildly explosive missile.
  - abadpoli 3y ago
    That mildly-explosive missile has software running on it too. So do a lot of actual missiles, for that matter. If we record every action of the pilot of a plane, why wouldn’t we also record every action of the developers who wrote the autopilot software, or the fly-by-wire software?
    - mvdtnz 3y ago
      Because the developers don't need to make snap decisions under stressful conditions with lives at stake. If you can't see the difference, sorry, that's on you.
      - abadpoli 3y ago
        Making snap decisions under stressful conditions has nothing to do with recording actions for later root cause analysis. If you can’t see the difference, sorry, that’s on you.
purpleblue 3y ago
Have multiple cameras on every airplane and record absolutely everything so that pilots and passengers both have skin in the game. We are relying on individual phone cams to record events which is stupid. We are in an age where this kind of information is already pushed on police officers and the public in general. The amount of safety information we can get will be extremely invaluable, especially with something like a catastrophic failure like this 737 MAX failure.
t0mas88 3y ago
Voice recording is a big privacy concern for the crew. This is our workplace, so you would be recording every conversation, also any idle chat of which there is quite a lot in cruise flight. The current voice recording is only accepted by the crew with the agreement that it is not stored, and can only be pulled after a serious incident in which case there will be a no-blame investigation. But what you're trying to solve, already exists without the voice recording part. It's called FOQA or Flight Operations Quality Assurance. Mandatory for airlines in Europe, not yet mandatory in the US but may be in the future. It records hundreds of parameters from engine indications to touchdown speed, G-loading, control inputs etc. Automatically uploaded to the operator and tracked for the whole fleet. That data is de-identified and used for safety analysis and improvement.
- mvdtnz 3y ago
  Respectfully, it is your workplace in which you're responsible for the lives of thousands of people each week. I don't think it's unreasonable to keep proper tabs.
  - eitland 3y ago
    Respectfully: the pilots have been doing an absolutely excellent job with it for decades without us having to destroy their privacy. An argument can easily be made that this extra stress will make flying less safe. Edit: my next car will probably have mandatory spyware and unlike pilots there won't be a guaranteed no blame process if something happens. It is pretty easy to see how this will be abused by insurance companies and data harvesters. I think I kind of understand the processes that lead to this. But I seriously wish tech people wouldn't be accepting it and even argue for it.
    - wholelotta 3y ago
      Respectfully, history is a terrible measure for carrying on as we have. Tech people are arguing for accountability in a life/death scenario. That there is no privacy in public spaces is a longstanding social/legal tradition. A cockpit is physically private for physical security reasons but the pilots in the cockpit are acting on behalf of public trust. Their social norms in that physical context are not their own to define. If pilots want privacy they can quit and sit at home.
benhurmarcel 3y ago
This already exists for aircraft parameters. Not audio.
DrNosferatu 3y ago
[read me elsewhere]
- garciasn 3y ago
  In this case it would be the airline pilot and/or flight attendant unions.
spuz 3y ago
I can't find it now, but there was a Reddit thread from a US flight instructor at the time of the China Eastern Airlines crash of 2022 who had previously trained pilots in China. He claimed the airline policy was to record cockpit audio of every single flight and have multiple people review that flight for anomalies. Any deviation from the standard procedure was logged and marked against the offending pilot. The pilots were extremely reluctant to act outside the guidelines of their training in a way that this person thought put safety at risk. As you can imagine, this is not a situation that US pilots want to be subject to and they are probably right that safety would actually be made worse.
AdamJacobMuller 3y ago
For flight data metrics, this makes sense, but this is significantly already happening with aircraft systems transmitting data back to central monitoring systems in realtime. Pilots can see an errant value (say a moderately high temperature somewhere) and call up an engine specialist and ask them if it's a concern and that specialist can look at a plethora of data on the plan in flight. The planes can also "phone home" and report things which should be looked over or fixed during the next downtime and maintenance organizations can proactively order parts or schedule personnel to fix issues before the plane even lands. This is all being done in the name of efficiency, but, it no doubt has positive safety benefits too. Airlines and manufacturers can already run a query like "how many hours between replacement of part X on average" and "how many hours between replacements of part X for planes which regularly fly to middle eastern countries (hot and dry)" For audio recordings, in the absence of an incident, I see no reason to do it.