Blog: Aviation Cyber Security

The surprising existence of the erase button on cockpit voice recorders

PTP Aviation Team 20 Dec 2022

Introduction

Safety and transparency are important in aviation. One tool that helps here is the Cockpit Voice Recorder (CVR), which records audio from the cockpit during flights. It is crucial for accident investigations, helping authorities understand what happened before an incident. However, you might be surprised to learn that CVRs have an erase button. This feature, while it might seem strange, has specific purposes and is surrounded by strict rules to prevent misuse.

TL;DR

  • CVRs record cockpit audio for safety investigations
  • The erase button protects crew privacy with strict use conditions
  • Regulations prevent misuse and prohibit erasure during flight
  • Short recordings historically overwrote critical data
  • Modern CVRs store up to 25 hours to balance safety and privacy
  • Longer recordings raise concerns over misuse of data
  • Trust in CVRs depends on airline safety culture

The purpose of the CVR ERASE button

The erase button on a CVR helps protect crew privacy and prevent misuse of recordings. It can only be used under specific conditions though.

Imagine you’re a pilot discussing sensitive operational details or personal matters during a long flight. You wouldn’t want that recorded forever, right? The erase button is like the “delete history” button on your browser. Sometimes, what happens in the cockpit should stay in the cockpit!

If there was no incident on the flight, it’s not unreasonable for the pilot to erase that data.

The erase button ensures personal and irrelevant conversations aren’t recorded. However, It’s not a free pass to erase everything. Strict rules ensure it’s used appropriately.

Regulatory safeguards

Rules and standard procedures ensure the erase function is used responsibly. For example, on the Airbus A320, the CVR erase function can only be activated if the plane is on the ground, the parking brake is on, and the ground control button is engaged. These safeguards prevent the accidental or intentional erasure of important data that could be vital in an investigation.

According to the Federal Aviation Administration (FAA), the CVR erase feature is allowed under specific conditions, such as when the aircraft is on the ground and the parking brake is set. This ensures the erase function cannot be used during flight, thereby protecting critical data needed for investigations.

Consequences of erasing CVR data

Erasing CVR data can have serious consequences, especially for aviation safety and accident investigations. The main purpose of the CVR is to capture audio from the cockpit, which is crucial for understanding the events leading up to an incident. If this data is erased, it can hinder investigations and prevent authorities from finding out the cause of an accident. This loss of important information can hinder efforts to improve safety protocols and procedures based on lessons learned from past incidents.

More over, tampering with or erasing CVR data can lead to legal consequences. Rules often require the preservation of CVR data for a certain period, and failure to comply can result in penalties. The integrity of CVR data is essential for maintaining trust between airlines, regulatory bodies, and the public. Erasing data can damage this trust and raise concerns about accountability and transparency.

Technological advances

Modern CVRs have improved data recovery capabilities and longer recording durations to reduce the risk of data loss. These advancements help ensure that even if the erase button is used, important data can still be recovered. This is particularly important in the context of ongoing efforts to enhance aviation safety and prevent future accidents, but it also means that pilots have less control over what is permanently erased, potentially affecting their privacy.

Additionally, CVR models are designed to record a minimum of 25 hours of flight data. These specifications are aligned with regulatory requirements and practical considerations for data management and storage capacity, compared to older models that recorded only a few hours.

This is to avoid the incident from being overwritten by the 2-hour limit. However, there is a lot of debate about how long the CVR length should be. This means more of a pilot’s conversations and activities in the cockpit are captured. While this is beneficial for safety and investigation purposes, it also means that more personal and potentially irrelevant conversations are recorded.

30 minutes, 2 hours… 25 hours? How long should CVR recordings be?

The early days of CVRs

Until recently, cockpit voice recorders (CVRs) only stored 30 minutes of audio. Limitations in recording media meant that CVRs were designed to preserve the final moments leading up to an incident. While this was sufficient for many investigations, it often failed to provide a complete picture of events.

Challenges with short recording times

Short recording durations posed significant challenges, especially if an incident occurred early in a flight. By the time the aircraft landed, critical audio could be overwritten. Pilots could preserve data by pulling the CVR circuit breaker as outlined in the Quick Reference Handbook (QRH), but this also stopped further recordings. As a result, if a subsequent incident occurred, it would not be captured, leaving gaps in investigation data.

Regulatory progress and advances in technology

Advances in storage technology have enabled longer recording durations, but regulatory changes were slow to follow. Concerns about pilot privacy were a major factor.

In 2008, the U.S. Federal Aviation Administration (FAA) extended CVR recording durations from 30 minutes to 2 hours for certain aircraft. This was a significant improvement, ensuring critical data from longer flights was preserved. However, investigations continued to face challenges, especially in incidents where data was overwritten before the severity of the situation was recognized.

The push for 25-hour recordings

The shift toward 25-hour CVRs was driven by incidents like the 2017 Air Canada near-miss at San Francisco International Airport. In this case, an Airbus A320 descended to just 100 feet above ground level before realizing it was aligned with a taxiway occupied by multiple aircraft. The CVR data were overwritten before the severity of the incident was understood, preventing investigators from analysing key aspects like crew decision-making and situational awareness.

This incident, along with 33 other cases where CVR data was lost, led to the FAA proposing a 25-hour recording requirement for newly manufactured aircraft in December 2023. The National Transportation Safety Board (NTSB) strongly supported this recommendation, emphasizing that longer recordings provide investigators with a more complete understanding of incidents.

Global adoption of 25-hour CVR standards

While the FAA was in the rulemaking process, other regulatory bodies had already established requirements for extended CVR recording durations, setting a global benchmark for aviation safety.

EASA’s 25-hour mandate

In 2015, the European Union Aviation Safety Agency (EASA) introduced regulations requiring large commercial aircraft (those with a maximum takeoff weight of 27,000 kg (60,000 pounds) or more) manufactured after January 1, 2021, to be equipped with CVRs capable of recording at least 25 hours of cockpit audio.

ICAO’s global standards

The International Civil Aviation Organization (ICAO) followed suit in 2016, mandating 25-hour CVR capabilities for all applicable aircraft manufactured after January 1, 2021. ICAO emphasized the importance of extended recordings for capturing pre and post flight activities, delays, and other key moments critical to investigations. However, the implementation of these standards is uneven, as not all regions have mandated their adoption.

With these standards, EASA and ICAO have highlighted the global significance of extended CVR durations in improving safety and providing investigators with comprehensive data.

Balancing safety and privacy

The transition from 2-hour to 25-hour CVRs represents a significant leap in aviation safety. By capturing a broader window of cockpit activity, investigators can better understand incidents and prevent future occurrences. However, the move to 25-hour recordings has sparked privacy concerns among pilots and unions, such as the Air Line Pilots Association (ALPA). They argue that extended recordings could capture personal conversations irrelevant to safety investigations, raising fears of misuse by employers, law enforcement, or other parties.

Data protection is also a critical issue. While investigators need access to CVR data for safety purposes, strict controls must ensure that recordings are not used for disciplinary actions or beyond their intended scope.

Blame culture vs. a ‘Just’ culture

The debate over the erase button and CVR length also taps into a broader issue: how the culture within airlines affects pilots’ trust in using CVRs. In a ‘just’ culture, where honest mistakes are viewed as learning opportunities, pilots may feel more comfortable leaving recordings intact and having longer CVR recordings. But in organizations with a blame-heavy culture, pilots might worry about recordings being used against them for minor issues. In these environments, the CVR erase button could be seen as a tool for self-protection rather than a last-resort privacy measure.

Is pushing that ERASE button career preservation, or career suicide? You decide…